Wire auth explain to local auth ops

crates/geth-store/src/lib.rs

@@ -289,6 +289,35 @@ impl Store {
             .map_err(StoreError::from)
     }
 
+    pub fn insert_auth_op(&self, op: &StoredAuthOp) -> Result<(), StoreError> {
+        self.conn.execute(
+            r#"INSERT OR REPLACE INTO auth_ops(op_id, resource_id, op_json, created_at_ms)
+               VALUES (?1, ?2, ?3, ?4)"#,
+            params![op.op_id, op.resource_id, op.op_json, op.created_at_ms],
+        )?;
+        Ok(())
+    }
+
+    pub fn list_auth_ops_for_resource(
+        &self,
+        resource_id: &str,
+    ) -> Result<Vec<StoredAuthOp>, StoreError> {
+        let mut stmt = self.conn.prepare(
+            r#"SELECT op_id, resource_id, op_json, created_at_ms
+               FROM auth_ops WHERE resource_id = ?1 ORDER BY created_at_ms, op_id"#,
+        )?;
+        let rows = stmt.query_map(params![resource_id], |row| {
+            Ok(StoredAuthOp {
+                op_id: row.get(0)?,
+                resource_id: row.get(1)?,
+                op_json: row.get(2)?,
+                created_at_ms: row.get(3)?,
+            })
+        })?;
+        rows.collect::<Result<Vec<_>, _>>()
+            .map_err(StoreError::from)
+    }
+
     pub fn insert_ssh_cert_request(
         &self,
         request: &StoredSshCertRequest,
@@ -476,6 +505,14 @@ pub struct StoredPeerCard {
     pub updated_at_ms: i64,
 }
 
+#[derive(Clone, Debug, PartialEq, Eq)]
+pub struct StoredAuthOp {
+    pub op_id: String,
+    pub resource_id: String,
+    pub op_json: String,
+    pub created_at_ms: i64,
+}
+
 #[derive(Clone, Debug, PartialEq, Eq)]
 pub struct StoredSshCertRequest {
     pub request_id: String,
@@ -589,4 +626,31 @@ mod tests {
         );
         assert_eq!(store.list_peer_cards().expect("list"), vec![peer_card]);
     }
+
+    #[test]
+    fn auth_ops_roundtrip_by_resource() {
+        let store = Store::open_memory().expect("open");
+        let first = StoredAuthOp {
+            op_id: "op:auth:1".to_owned(),
+            resource_id: "resource:notes".to_owned(),
+            op_json: r#"{"id":"op:auth:1"}"#.to_owned(),
+            created_at_ms: 1,
+        };
+        let second = StoredAuthOp {
+            op_id: "op:auth:2".to_owned(),
+            resource_id: "resource:other".to_owned(),
+            op_json: r#"{"id":"op:auth:2"}"#.to_owned(),
+            created_at_ms: 2,
+        };
+
+        store.insert_auth_op(&second).expect("insert second");
+        store.insert_auth_op(&first).expect("insert first");
+
+        assert_eq!(
+            store
+                .list_auth_ops_for_resource("resource:notes")
+                .expect("list auth ops"),
+            vec![first]
+        );
+    }
 }