jwinterm 4f9d00f1d2 feat(db): unified single-use challenge store [operator §0.2] ...

The shared server-nonce store every signed action consumes (admin login,
first-run setup, self-service erasure). DB-backed so consumption is atomic and
correct under concurrent requests and a future load-balanced fleet:

  DELETE FROM challenges WHERE nonce=$1 AND purpose=$2 AND expires_at > NOW()
                         RETURNING subject

Winning the race returns one row; zero rows = replay/expired/wrong-purpose =>
reject (no TOCTOU). issue_challenge mints a 256-bit nonce bound to a purpose and
optional subject; consume_challenge is the atomic single-use step that pairs with
verify_signed_action (already built, §0.1). Periodic expiry sweep bounds the
table; the table holds no secret and is documented as backup-excluded
(ephemeral, links pubkey->time).

migration 20260625000001; ConsumedChallenge exported; 3 L1 tests (consume-once /
replay-rejected, wrong-purpose rejected, expired rejected).

2026-06-25 17:33:59 -04:00

..

20260622000001_initial_schema.sql

feat: Grin slatepack relay (non-custodial async mailbox, feature-flagged)

2026-06-23 17:39:13 -04:00

20260622000002_login_and_restore.sql

feat: db query layer (sessions, keys, audit, grin relay, login, restore)

2026-06-22 14:32:17 -04:00

20260625000001_challenges.sql

feat(db): unified single-use challenge store [operator §0.2]

2026-06-25 17:33:59 -04:00