Persist OAuth sessions across server restarts #72

New issue

Open

opened 2026-03-03 15:18:21 -08:00 by fable · 0 comments

fable commented

2026-03-03 15:18:21 -08:00

Contributor

The current MemoryAuthStore implementation loses all OAuth session state when the server process exits, forcing every user to re-authenticate on restart.

Replace it with a SQLite-backed ClientAuthStore implementation that persists both ClientSessionData (completed sessions) and AuthRequestData (in-flight login state) to the existing database.

This also ensures the in-flight pending_logins map (for AwaitLogin) is the only truly ephemeral state—acceptable to lose on restart since any pending login would need to restart anyway.

Related to #9.

The current `MemoryAuthStore` implementation loses all OAuth session state when the server process exits, forcing every user to re-authenticate on restart. Replace it with a SQLite-backed `ClientAuthStore` implementation that persists both `ClientSessionData` (completed sessions) and `AuthRequestData` (in-flight login state) to the existing database. This also ensures the in-flight `pending_logins` map (for `AwaitLogin`) is the only truly ephemeral state—acceptable to lose on restart since any pending login would need to restart anyway. Related to #9.