Struct RedisStore 

pub struct RedisStore { /* private fields */ }

Redis-backed store. Connections are pooled internally (r2d2 for both single-node and cluster; the redis crate implements r2d2::ManageConnection for ClusterClient directly).

Implementations

impl RedisStore

pub fn connect(url: &str) -> Result<Self, StateError>

Connect to url (e.g. redis://127.0.0.1:6379). Comma-separated URLs select Redis Cluster mode.

Trait Implementations

impl StateStore for RedisStore

fn refund(&self, key: &str, amount: u64)

Round-33 F1: saturating refund via DECRBY + a MAX(0) clamp. Best-effort — errors are silently swallowed so a Redis blip on the compensation path can never turn a lost-race response into a 5xx.

Round-34 F1: NEVER resurrect a key that was already DEL’d by a concurrent remove_prefix. The prior implementation called DECRBY on the raw key: Redis initialises a missing key to 0 first, so DECRBY returned -amount and the MAX(0) clamp branch did SET key 0 (no EX), producing a permanent TTL-less key. Under the round-33 lost-claim- plus-idle-close ordering (mcp_call sandbox-gate debit races with the reconciler’s clear_budget_state), the refund path leaked one-to-three TTL-less keys per session — attacker-choosable memory growth against the exact class reconciler.rs:341-343 documents as impossible. Fix: gate the whole DECRBY on EXISTS. If the session was cleared, the budget is already gone and there is nothing to compensate; the refund is a silent no-op. If the session is alive, we DECRBY-clamp AND refresh the 24 h TTL to match TRY_SPEND_LUA (a plain DECRBY does not refresh).

fn add(&self, key: &str, delta: u64) -> Result<u64, StateError>

Add delta to key, returning the new value.

fn get(&self, key: &str) -> Result<u64, StateError>

Read the current value of key (0 if absent).

fn try_spend( &self, key: &str, amount: u64, limit: u64, ) -> Result<bool, StateError>

Atomically spend amount from the remaining budget limit - spent(key). Returns Ok(true) and records the spend if the full amount fits, Ok(false) (recording nothing) otherwise.

fn try_spend_many(&self, spends: &[Spend]) -> Result<Option<usize>, StateError>

Atomically validate and commit every spend, or commit none. Returns the index of the first dimension that would exceed its limit.

fn remove(&self, key: &str)

Remove a key (session cleanup).

fn remove_prefix(&self, prefix: &str)

Remove every key beginning with prefix (whole-session cleanup at finalization). Backends with native expiry (e.g. Redis TTLs) may leave this as the default no-op; in-process backends must implement it or session-keyed counters accumulate for the process lifetime.