Struct TokenRegistry 

pub struct TokenRegistry {
    map: RwLock<HashMap<String, TokenRecord>>,
}

Thread-safe, in-memory store of live token records.

Wrapped in Arc so it can be cloned cheaply into the axum app state and the Tauri-managed super::MediaServerHandle.

Fields

map: RwLock<HashMap<String, TokenRecord>>

Implementations

impl TokenRegistry

pub fn new() -> Self

Create an empty registry.

pub fn mint( &self, profile_id: ProfileId, bucket: BucketId, key: String, region: String, ttl_secs: u64, session_id: String, ) -> (String, i64)

Mint a fresh token for the given S3 object.

Returns (token, expires_at) where token is the URL-safe base64 string (64 chars, 48 random bytes) and expires_at is a Unix epoch seconds timestamp.

Arguments

• profile_id — profile whose credentials service the request.
• bucket / key — S3 coordinates.
• region — AWS region for the bucket (used to route get_object).
• ttl_secs — seconds until expiry (1-hour default → pass 3600).
• session_id — calling session; used by revoke_session.

pub fn lookup(&self, token: &str) -> Option<TokenRecord>

Look up a token. Returns None when unknown or expired.

pub fn lookup_with_status(&self, token: &str) -> Result<Option<TokenRecord>, ()>

Variant of lookup that distinguishes “token unknown” from “token expired”.

• Ok(Some(record)) — token is known and live.
• Ok(None) — token is known but expired → 403.
• Err(()) — token does not exist → 404.

pub fn revoke(&self, token: &str)

Revoke a single token by removing it from the registry.

pub fn revoke_session(&self, session_id: &str)

Remove all tokens belonging to session_id.

Called on session end so no token outlives its session.

pub fn gc(&self)

Remove all expired tokens. Call periodically to avoid unbounded growth.

Trait Implementations

impl Default for TokenRegistry

fn default() -> TokenRegistry

Returns the “default value” for a type.