feat: add revocable account sessions and password changes

[D3SOX]

Sync authentication tokens are currently stateless, so users cannot inspect or revoke individual devices, and changing a password cannot invalidate existing access.

This adds stored account sessions for password, OIDC, and pairing authentication. JWTs carry a session ID, authenticated requests verify that the session is active, and new endpoints list, rename, and revoke sessions or change the account password. Pairing sessions remain provisional until the receiving device consumes the approved payload.

Existing clients remain compatible. Login and registration device IDs are optional, and valid JWTs issued before this change lazily create revocable legacy sessions. Password changes advance an account session generation, which invalidates unseen legacy tokens and concurrent logins that verified the previous password.

The README and privacy policy document the retained encrypted device data and session timestamps.

Testing

• cargo test
• cargo clippy --all-targets -- -D warnings
• cargo check --no-default-features --features postgres

Client: OpenTubeX/OpenTubeX#1042

Supports OpenTubeX/OpenTubeX#942.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Team

Run ID: 5ede98b1-1c5b-4835-b54f-5a649616d257

📥 Commits

Reviewing files that changed from the base of the PR and between 6b7412c and fd68208.

📒 Files selected for processing (19)

• PRIVACY.md
• README.md
• migrations/postgres/2026-09-01-000000-0000_account_sessions/down.sql
• migrations/postgres/2026-09-01-000000-0000_account_sessions/up.sql
• migrations/sqlite/2026-09-01-000000-0000_account_sessions/down.sql
• migrations/sqlite/2026-09-01-000000-0000_account_sessions/up.sql
• src/auth.rs
• src/database.rs
• src/database/account_session.rs
• src/database/pairing.rs
• src/dto.rs
• src/handlers.rs
• src/handlers/encrypted_sync.rs
• src/handlers/pairing.rs
• src/handlers/session.rs
• src/handlers/user.rs
• src/main.rs
• src/models.rs
• src/schema.rs

Included review availability: Your plan provides up to 1 included review per hour; 0 remain after this review.

---

📝 Walkthrough

Walkthrough

The pull request adds persistent account sessions with session-bound JWTs, device metadata, revocation, expiry, legacy-token migration, password-change rotation, session-management endpoints, and provisional sessions for secure pairing.

Changes

Account session authentication

Layer / File(s)	Summary
Session schema and contracts migrations/*/2026-09-01-000000-0000_account_sessions/*, src/schema.rs, src/models.rs, src/dto.rs, src/auth.rs, README.md	Adds the account_session schema, session models, DTOs, JWT jti support, and migration instructions.
Session storage and cleanup src/database/account_session.rs, src/handlers/session.rs, src/handlers.rs, src/main.rs, src/handlers/encrypted_sync.rs	Adds session queries, activity throttling, revocation, password rotation, expiry cleanup, validation helpers, request extraction, and capability reporting.
Authentication and session management src/handlers/user.rs, PRIVACY.md, README.md	Registration, login, and OIDC now issue stored sessions. Middleware resolves and refreshes sessions. New endpoints list, update, revoke, and rotate sessions.
Pairing session lifecycle src/database/pairing.rs, src/handlers/pairing.rs, PRIVACY.md, README.md	Pairing claims create provisional sessions. Consumption activates them. Cancellation and expiry remove them.

Estimated code review effort: 4 (Complex) | ~60 minutes

Merge Risk: 🔵 Low · up to fd682

The PR adds revocable sessions and provisional pairing state. A reused pairing identifier could collide with an existing active session, potentially activating access before pairing is consumed or causing pairing completion to fail; this is a bounded edge case that should have explicit owner awareness before merge.

Sequence Diagram(s)

Account session authentication

sequenceDiagram
  participant Client
  participant AuthMiddleware
  participant AccountSessionStore
  participant SessionEndpoint
  Client->>AuthMiddleware: session-bound JWT
  AuthMiddleware->>AccountSessionStore: resolve active session
  AccountSessionStore-->>AuthMiddleware: AccountSession
  AuthMiddleware->>AccountSessionStore: touch last_active_at
  AuthMiddleware->>SessionEndpoint: authenticated request
  SessionEndpoint-->>Client: session response

Loading

Pairing session activation

sequenceDiagram
  participant PairingClient
  participant PairingHandler
  participant PairingStore
  participant AccountSessionStore
  PairingClient->>PairingHandler: claim pairing request
  PairingHandler->>PairingStore: claim with candidate session
  PairingStore->>AccountSessionStore: create pending session
  PairingStore-->>PairingHandler: pairing and account session
  PairingClient->>PairingStore: consume pairing payload
  PairingStore->>AccountSessionStore: activate pending session

Loading

🚥 Pre-merge checks | ✅ 4 | ❌ 1

❌ Failed checks (1 warning)

Check name	Status	Explanation	Resolution
Docstring Coverage	⚠️ Warning	Docstring coverage is 38.64% which is insufficient. The required threshold is 80.00%. Docstring coverage is scoped to functions touched by this diff. Analyzed 88 functions across 13 files. (6 skipped:…	Write docstrings for the functions missing them to satisfy the coverage threshold.

✅ Passed checks (4 passed)

Check name	Status	Explanation
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Description check	✅ Passed	The description clearly explains the addition of revocable account sessions, password changes, pairing behavior, compatibility, documentation, and testing.
Title check	✅ Passed	The title clearly and concisely summarizes the primary change: adding revocable account sessions and password-change support.

Full details: Docstring Coverage

Explanation

Docstring coverage is 38.64% which is insufficient. The required threshold is 80.00%. Docstring coverage is scoped to functions touched by this diff. Analyzed 88 functions across 13 files. (6 skipped: 6 unsupported.)

• Fix all pre-merge checks with AI

✨ Finishing Touches 💡 1

📝 Generate docstrings 💡

• Create stacked PR
• Commit on current branch

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch account-session-management

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[macroscopeapp]

Approvability

Verdict: Not approved

Macroscope's review found this PR not approvable — This PR substantially changes authentication and account lifecycle behavior by introducing persisted sessions, revocation, password rotation, legacy-token migration, and provisional pairing sessions. It also adds security-sensitive database and JWT changes, so the breadth and impact warrant human review.

Not approved because:

• Credit balance exhausted. Approvability relies on correctness review in order to determine eligibility

^{Review your spending limits in Billing settings. You can add or adjust custom eligibility rules. Learn more.}