GenServer that owns the :break_glass_tokens ETS table.
Maintains at most one active break-glass session token in memory. A node restart automatically invalidates any active token — by design.
ETS Table
Table name: :break_glass_tokens
Record format: {:active_token, token :: binary(), inserted_at :: DateTime.t()}
Access: :protected with read_concurrency: true
lookup/1 reads ETS directly — no GenServer round-trip. All mutations go
through GenServer.call/2 so writes are serialised and race-free.
Functions
build_and_store/0— generates a 32-byte cryptographically random token, stores it with a UTC timestamp, and returns the binary tokenlookup/1— returns{:ok, inserted_at}if the token matches, or:errordelete/1— removes the token if it matches; returns:okor:errorclear/0— unconditionally removes the active token record
Summary
Functions
Generates a 32-byte cryptographically random token, stores it with a UTC insertion timestamp (replacing any previously stored token), and returns the raw binary token.
Returns a specification to start this module under a supervisor.
Unconditionally removes the active token record from the ETS table.
Deletes the stored token if it matches token.
Looks up token in the ETS table.
Starts the TokenStore GenServer and registers it under Elixir.BreakGlass.TokenStore.
Functions
@spec build_and_store() :: binary()
Generates a 32-byte cryptographically random token, stores it with a UTC insertion timestamp (replacing any previously stored token), and returns the raw binary token.
Returns a specification to start this module under a supervisor.
See Supervisor.
@spec clear() :: :ok
Unconditionally removes the active token record from the ETS table.
Returns :ok.
@spec delete(token :: binary()) :: :ok | :error
Deletes the stored token if it matches token.
First checks the stored token against token via an ETS read, then
delegates the actual removal to the GenServer to serialise the write.
Returns :ok on a successful match-and-delete, or :error when the token
does not match (or no token is stored).
@spec lookup(token :: binary()) :: {:ok, DateTime.t()} | :error
Looks up token in the ETS table.
Reads ETS directly — no GenServer round-trip.
Returns {:ok, inserted_at} when token matches the stored token, or
:error when there is no match or no token is stored.
@spec start_link(keyword()) :: GenServer.on_start()
Starts the TokenStore GenServer and registers it under Elixir.BreakGlass.TokenStore.