Lookup any user (whether confirmed or not) by their ID.

Lookup any user (whether confirmed or not) by their email address.

Actually add a new user. The user may already have an ID, otherwise the DB will automatically create one (auto-increment). NOTE that mixing calls with Just an ID with those without is a very bad idea and will quickly lead to errors!

Add a new user and return the new user's UserId. Ensures that user name and email address are unique.

Add a new unconfirmed user (i.e. one whose email address we haven't confirmed yet). Ensures that user name and email address are unique.

Add a password reset token. Return the user whose password this token can change.

Change a password with a given password reset token and remove the token. Throw an error if the token does not exist or has expired.

Change email with a given token and remove the token. Throw an error if the token does not exist or has expired.

Change password. Should only be called once the old password has been verified.

Delete user with given UserId. Throw an error if user does not exist.

Add new service.

Delete service with given ServiceId. Throw an error if service does not exist.

Add a new persona to the DB. A persona has a unique name and a user to which it belongs. The PersonaId is assigned by the DB. May throw NoSuchUser or PersonaNameAlreadyExists.

Delete a persona. Throw NoSuchPersona if the persona does not exist in the DB.

Add a new context. The first argument identifies the service to which the context belongs. May throw NoSuchService or ContextNameAlreadyExists.

Delete a context. Throw an error if the context does not exist in the DB.

Add a persona to a group. If the persona is already a member of the group, do nothing.

Remove a persona from a group. If the persona is not a member of the group, do nothing.

Add a group (subgroup) to another group (supergroup) so that all members of subgroup will also be considered members of supergroup. If subgroup is already a direct member of supergroup, do nothing. Throws GroupMembershipLoop if adding the relation would cause a loop.

Remove a group (subgroup) from another group (supergroup). If subgroup is not a direct member of supergroup, do nothing.

List all groups a persona belongs to, directly or indirectly. If p is a member of g1, g1 is a member of g2, and g2 is a member of g3, [g1, g2, g3] will be returned.

Lookup session. If session does not exist or has expired, throw an error. If it does exist, bump the expiry time and return session with bumped expiry time.

Start a new thentos session. Start time is set to now, end time is calculated based on the specified Timeout. If the agent is a user, this new session is added to their existing sessions. Only confirmed users are allowed to log in; a NoSuchUser error is thrown otherwise. FIXME not implemented: If the agent is a service with an existing session, its session is replaced.

End thentos session and all associated service sessions. If thentos session does not exist or has expired, remove it just the same.

Always call this transaction if you want to clean up a session (e.g., from a garbage collection transaction). This way in the future, you can replace this transaction easily by one that does not actually destroy the session, but move it to an archive.

Get the names of all services that a given thentos session is signed into

Like lookupThentosSession, but for ServiceSession. Bump both service and associated thentos session. If the service session is still active, but the associated thentos session has expired, update service sessions expiry time to now and throw NoSuchThentosSession.

Like startThentosSession for service sessions. Bump associated thentos session. Throw an error if thentos session lookup fails. If a service session already exists for the given ServiceId, return its token.

Like endThentosSession for service sessions (see there). If thentos session or service session do not exist or have expired, remove the service session just the same, but never thentos session.

Add a new role to the roles defined for an Agent. If Role is already assigned to Agent, do nothing.

Remove a Role from the roles defined for an Agent. If Role is not assigned to Agent, do nothing.

All Roles of an Agent. If Agent does not exist or has no roles, return an empty list.

Store the solution to a captcha in the DB. May throw CaptchaIdAlreadyExists.

Submit a solution to a captcha, returning whether or not the solution is correct. Calling this action deletes the referenced captcha from the DB, so every captcha must be solved (or not) at first attempt. Throws NoSuchCaptchaId if the given CaptchaId doesn't exist in the DB (either because it never did or because it was deleted due to garbage collection or a prior call to this action).

Go through "thentos_sessions" table and find all expired sessions.

Remove all expired unconfirmed users from db.

Remove all expired password reset requests from db.

Remove all expired email change requests from db.

Remove all expired captchas from db.

Throw an error from a situation which (we believe) will never arise.

Given either a UserId or a ServiceId, return an Agent. Throws an error if not exactly one of the arguments is Just (totality enforced by constraint on `services.owner_{user,service}`). Useful for getting an Agent from the database.