[or-else]

Password-reset codes currently depend on cache cleanup for expiration. This change persists their deadline and carries it through authentication as auth.Rec.ExpiresAt. Token issuance caps the encoded expiration at that absolute deadline and rejects an insufficient remaining validity window. A code redeemed with 2.75 seconds remaining cannot produce a valid token after a four-second account lookup.

Token expiration is truncated to its actual whole-second encoding. Login propagates issuance failures before authenticating the session and checks reset-token validity again before replying. Normal authenticated login explicitly renews token validity; reset-only login preserves its deadline.

REST providers receive the absolute deadline as rec.expires_at; issuance rejects missing, expired, or overlong provider expirations. Login independently checks the returned expiration against the original bound. Account creation handles login errors before accessing success parameters, preventing a token-generation failure from panicking {acc login=true}.

Cache retries and consumption use conditional writes, and issuance atomically reclaims expired or legacy records without overwriting concurrent replacements. All four database adapters implement the conditional operations. Codes issued before this change are rejected and can immediately be replaced. Exported additions have Godoc comments.

Validation:

• Server and all auth package tests pass, including with the race detector and all four database adapters enabled.
• All non-database-integration packages pass with all adapter build tags.
• New REST serialization/provider-boundary and account-creation regression tests reproduced both review failures before the fixes and pass afterward. The full server/auth race suite passes with all adapter build tags.
• Regression tests cover delayed issuance, encoded deadline bounds, fractional-second validity, real code-to-token issuance, login error propagation, expiry without cleanup, retry limits, concurrent replacement, and conditional consumption.
• Live database tests were not rerun for this replacement. The retained atomic cache operations passed disposable MySQL, MongoDB, and RethinkDB tests during the earlier work; PostgreSQL runtime coverage remains unavailable.

Replaces closed PR #1023, with a fresh commit based on devel.

[Copilot]

🟡 Changes recommended

Unresolved authentication error-handling and provider-boundary issues block approval, and cross-adapter runtime validation remains incomplete.

2 open issues

• Preserve reset-token deadlines across REST provider boundary · New
• Prevent account-creation panic on token issuance failure · New

1 file not reviewed

• server/store/mock_store/mock_store.go: Generated file

What changed in this PR

This PR carries absolute password-reset deadlines through authentication and token issuance, preventing storage delays from extending reset validity.

Changes:

• Persist reset-code deadlines and enforce whole-second token expiration limits.
• Propagate token-generation errors before authenticating sessions and recheck reset-token validity before replying.
• Add conditional cache operations across all four database adapters, with regression and integration tests.

File	Description
server/​store/​store.go	Exposes conditional cache mutations.
server/​store/​mock_store/​mock_store.go	Adds mocks for conditional cache operations.
server/​session.go	Handles issuance failures and preserves reset deadlines.
server/​session_reset_token_test.go	Tests login expiration and issuance failures.
server/​db/​rethinkdb/​tests/​rethink_test.go	Adds atomic cache integration coverage.
server/​db/​rethinkdb/​adapter.go	Implements conditional mutations and fixes cache decoding.
server/​db/​postgres/​tests/​postgres_test.go	Adds atomic cache integration coverage.
server/​db/​postgres/​adapter.go	Implements conditional cache mutations.
server/​db/​mysql/​tests/​mysql_test.go	Adds atomic cache tests and reconnects pooled connections.
server/​db/​mysql/​adapter.go	Implements case-sensitive conditional cache mutations.
server/​db/​mongodb/​tests/​mongo_test.go	Adds atomic cache integration coverage.
server/​db/​mongodb/​adapter.go	Implements conditional cache mutations.
server/​db/​common/​test_data/​pcache.go	Provides shared cache concurrency checks.
server/​db/​adapter.go	Extends the database adapter interface.
server/​auth/​token/​auth_token.go	Caps token issuance at absolute deadlines.
server/​auth/​token/​auth_token_test.go	Tests delayed issuance and expiration precision.
server/​auth/​code/​auth_code.go	Persists deadlines and conditionally updates or consumes codes.
server/​auth/​code/​auth_code_test.go	Tests expiration, replacement races, and token issuance.
server/​auth/​auth.go	Adds the absolute expiration field to authentication records.

_{Review effort: Balanced}

[Copilot]

🔵 Needs a closer look

Security-sensitive changes across four database adapters warrant human review, with PostgreSQL runtime coverage unavailable and an account-creation panic still unresolved.

3 open issues

• Prevent panic when credential validation returns missing login params · New
• Prevent account-creation panic on token issuance failure
• Preserve reset-token deadlines across REST provider boundary

1 file not reviewed

• server/store/mock_store/mock_store.go: Generated file

_{Review effort: Balanced}

[Copilot]

🔵 Needs a closer look

Authentication timing and cross-database atomicity require human review, with an unresolved login timing issue and unavailable live PostgreSQL coverage.

2 open issues

• Prevent account-creation panic on token issuance failure
• Preserve reset-token deadlines across REST provider boundary

1 previously missed issue

In code that hasn't changed since last review

Issue tokens only after device update completes

server/​session.go:1077

Token issuance now precedes the synchronous device update, but the final expiration check only covers FeatureNoLogin. An ordinary login with a valid two-second token lifetime and a four-second store.Devices.Update returns 200 with an already-expired token and an authenticated session; previously the token was generated after that write. Please perform device storage before issuing the token and authenticating the session, or ensure ordinary tokens remain usable before committing session state and replying.

1 resolved since last review

• Prevent panic when credential validation returns missing login params

1 file not reviewed

• server/store/mock_store/mock_store.go: Generated file

_{Review effort: Balanced}