wursor/docs/decisions/0012-in-memory-user-store.md

12. In-memory user store behind a UserStore interface; Postgres deferred

• Status: Accepted
• Date: 2026-08-15

Context

IMPLEMENTATION §1 names PostgreSQL for Wursor's own data. Sprint 1's first slice needed working sign-up/auth without standing up a database, migrations, or a connection pool on day one.

Decision

Define a UserStore interface and ship InMemoryUserStore behind it. Passwords are hashed with node:crypto scrypt; session tokens are crypto.randomBytes(32) hex.

Options considered

• Stand up Postgres now.
• In-memory store behind an interface (chosen).

Rejected

• Postgres now — adds infrastructure friction to the first slice for no behavioral gain; the interface confines the swap to services/user-store.ts.

Consequences

• Auth data is not durable until Postgres lands; restarting the API clears users and sessions.
• The Postgres swap is a drop-in replacement of InMemoryUserStore implementing the same UserStore contract.