8 files changed, 67 insertions, 11 deletions
diff --git a/src/login/app.rs b/src/login/app.rs
index f1dffb9..8ea0a91 100644
--- a/src/login/app.rs
+++ b/src/login/app.rs
@@ -6,7 +6,9 @@ use futures::{
 };
 use sqlx::sqlite::SqlitePool;
 
-use super::{broadcaster::Broadcaster, extract::IdentitySecret, repo::auth::Provider as _, types};
+use super::{
+    broadcaster::Broadcaster, extract::IdentitySecret, repo::auth::Provider as _, token, types,
+};
 use crate::{
     clock::DateTime,
     password::Password,
@@ -14,7 +16,7 @@ use crate::{
         error::NotFound as _,
         login::{Login, Provider as _},
         sequence::{Provider as _, Sequence},
-        token::{self, Provider as _},
+        token::Provider as _,
     },
 };
 
diff --git a/src/login/extract.rs b/src/login/extract.rs
index bfdbe8d..39dd9e4 100644
--- a/src/login/extract.rs
+++ b/src/login/extract.rs
@@ -11,8 +11,8 @@ use crate::{
     app::App,
     clock::RequestedAt,
     error::{Internal, Unauthorized},
-    login::app::ValidateError,
-    repo::{login::Login, token},
+    login::{app::ValidateError, token},
+    repo::login::Login,
 };
 
 // The usage pattern here - receive the extractor as an argument, return it in
diff --git a/src/login/id.rs b/src/login/id.rs
new file mode 100644
index 0000000..c46d697
--- /dev/null
+++ b/src/login/id.rs
@@ -0,0 +1,24 @@
+use crate::id::Id as BaseId;
+
+// Stable identifier for a [Login]. Prefixed with `L`.
+#[derive(Clone, Debug, Eq, PartialEq, sqlx::Type, serde::Serialize)]
+#[sqlx(transparent)]
+pub struct Id(BaseId);
+
+impl From<BaseId> for Id {
+    fn from(id: BaseId) -> Self {
+        Self(id)
+    }
+}
+
+impl Id {
+    pub fn generate() -> Self {
+        BaseId::generate("L")
+    }
+}
+
+impl std::fmt::Display for Id {
+    fn fmt(&self, f: &mut std::fmt::Formatter<'_>) -> std::fmt::Result {
+        self.0.fmt(f)
+    }
+}
diff --git a/src/login/mod.rs b/src/login/mod.rs
index 6ae82ac..0430f4b 100644
--- a/src/login/mod.rs
+++ b/src/login/mod.rs
@@ -1,8 +1,11 @@
-pub use self::routes::router;
-
 pub mod app;
 pub mod broadcaster;
 pub mod extract;
+mod id;
 mod repo;
 mod routes;
+pub mod token;
 pub mod types;
+
+pub use self::id::Id;
+pub use self::routes::router;
diff --git a/src/login/repo/auth.rs b/src/login/repo/auth.rs
index 3033c8f..9816c5c 100644
--- a/src/login/repo/auth.rs
+++ b/src/login/repo/auth.rs
@@ -1,9 +1,6 @@
 use sqlx::{sqlite::Sqlite, SqliteConnection, Transaction};
 
-use crate::{
-    password::StoredHash,
-    repo::login::{self, Login},
-};
+use crate::{login, password::StoredHash, repo::login::Login};
 
 pub trait Provider {
     fn auth(&mut self) -> Auth;
diff --git a/src/login/token/id.rs b/src/login/token/id.rs
new file mode 100644
index 0000000..9ef063c
--- /dev/null
+++ b/src/login/token/id.rs
@@ -0,0 +1,27 @@
+use std::fmt;
+
+use crate::id::Id as BaseId;
+
+// Stable identifier for a token. Prefixed with `T`.
+#[derive(Clone, Debug, Eq, Hash, PartialEq, sqlx::Type, serde::Deserialize, serde::Serialize)]
+#[sqlx(transparent)]
+#[serde(transparent)]
+pub struct Id(BaseId);
+
+impl From<BaseId> for Id {
+    fn from(id: BaseId) -> Self {
+        Self(id)
+    }
+}
+
+impl Id {
+    pub fn generate() -> Self {
+        BaseId::generate("T")
+    }
+}
+
+impl fmt::Display for Id {
+    fn fmt(&self, f: &mut fmt::Formatter<'_>) -> fmt::Result {
+        self.0.fmt(f)
+    }
+}
diff --git a/src/login/token/mod.rs b/src/login/token/mod.rs
new file mode 100644
index 0000000..d563a88
--- /dev/null
+++ b/src/login/token/mod.rs
@@ -0,0 +1,3 @@
+mod id;
+
+pub use self::id::Id;
diff --git a/src/login/types.rs b/src/login/types.rs
index 7c7cbf9..a210977 100644
--- a/src/login/types.rs
+++ b/src/login/types.rs
@@ -1,4 +1,4 @@
-use crate::repo::token;
+use crate::login::token;
 
 #[derive(Clone, Debug)]
 pub struct TokenRevoked {