AshOnetime.Window (ash_onetime v0.5.0)

Inclusive replay and expiry window validation.

Summary

Functions

Retention safety margin, in seconds, added beyond a nonce's acceptance window before the spent nonce becomes eligible for cleanup.

validate(issued_at, expires_at, evaluated_at, max_age, skew)

Functions

cleanup_after(issued_at, max_age, skew)

@spec cleanup_after(DateTime.t(), non_neg_integer(), non_neg_integer()) ::
  DateTime.t() | {:error, :invalid}

cleanup_skew_margin_seconds()

@spec cleanup_skew_margin_seconds() :: pos_integer()

Retention safety margin, in seconds, added beyond a nonce's acceptance window before the spent nonce becomes eligible for cleanup.

The acceptance window is evaluated against the application clock, while cleanup eligibility is evaluated against the PostgreSQL clock. This margin guarantees a spent nonce stays retained until strictly after its acceptance window has closed — and therefore cannot be deleted and re-admitted (double-spent) — as long as the PostgreSQL clock is not ahead of the application clock by more than this margin. Keep both clocks synchronized (e.g. via NTP); operators with looser synchronization should raise it. Configure with config :ash_onetime, :cleanup_clock_skew_margin_seconds, integer_seconds (default 1).

validate(issued_at, expires_at, evaluated_at, max_age, skew)

@spec validate(
  DateTime.t(),
  DateTime.t() | nil,
  DateTime.t(),
  non_neg_integer(),
  non_neg_integer()
) :: :ok | {:error, :invalid}