diff --git a/.github/workflows/rust.yml b/.github/workflows/rust.yml
index 465bb75..916623d 100644
--- a/.github/workflows/rust.yml
+++ b/.github/workflows/rust.yml
@@ -60,7 +60,7 @@ jobs:
       - name: Clippy
         shell: bash
         run: >-
-          cargo clippy -q --all-targets --all-features --message-format=json
+          cargo clippy -q --all-targets --message-format=json
           | jq -r 'select(.reason == "compiler-message")
             | .message
             | . as $message
diff --git a/.gitignore b/.gitignore
index ea8c4bf..2f480eb 100644
--- a/.gitignore
+++ b/.gitignore
@@ -1 +1,7 @@
 /target
+
+.idea
+
+.env
+
+/migrations/.diesel_lock
diff --git a/.idea/runConfigurations/build.xml b/.idea/runConfigurations/build.xml
index 32483de..29955ad 100644
--- a/.idea/runConfigurations/build.xml
+++ b/.idea/runConfigurations/build.xml
@@ -1,5 +1,6 @@
 <component name="ProjectRunConfigurationManager">
   <configuration default="false" name="build" type="CargoCommandRunConfiguration" factoryName="Cargo Command">
+    <option name="buildProfileId" value="dev" />
     <option name="command" value="build" />
     <option name="workingDirectory" value="file://$PROJECT_DIR$" />
     <envs />
diff --git a/Cargo.lock b/Cargo.lock
index e4435bd..9f5c57b 100644
--- a/Cargo.lock
+++ b/Cargo.lock
@@ -11,11 +11,20 @@ dependencies = [
  "memchr",
 ]
 
+[[package]]
+name = "android_system_properties"
+version = "0.1.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "819e7219dbd41043ac279b19830f2efc897156490d7fd6ea916720117ee66311"
+dependencies = [
+ "libc",
+]
+
 [[package]]
 name = "anyhow"
-version = "1.0.101"
+version = "1.0.102"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "5f0e0fee31ef5ed1ba1316088939cea399010ed7731dba877ed44aeb407a75ea"
+checksum = "7f202df86484c868dbad7eaa557ef785d5c66295e41b460ef922eca0723b842c"
 
 [[package]]
 name = "argon2"
@@ -45,6 +54,12 @@ version = "1.1.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "1505bd5d3d116872e7271a6d4e16d81d0c8570876c8de68093a09ac269d8aac0"
 
+[[package]]
+name = "autocfg"
+version = "1.5.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "c08606f8c3cbf4ce6ec8e28fb0014a2c086708fe954eaa885384a6165172e7e8"
+
 [[package]]
 name = "axum"
 version = "0.8.9"
@@ -179,12 +194,42 @@ version = "1.11.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "1e748733b7cbc798e1434b6ac524f0c1ff2ab456fe201501e6497c8417a4fc33"
 
+[[package]]
+name = "cc"
+version = "1.2.61"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d16d90359e986641506914ba71350897565610e87ce0ad9e6f28569db3dd5c6d"
+dependencies = [
+ "find-msvc-tools",
+ "shlex",
+]
+
 [[package]]
 name = "cfg-if"
 version = "1.0.4"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "9330f8b2ff13f34540b44e946ef35111825727b38d33286ef986142615121801"
 
+[[package]]
+name = "chrono"
+version = "0.4.44"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "c673075a2e0e5f4a1dde27ce9dee1ea4558c7ffe648f576438a20ca1d2acc4b0"
+dependencies = [
+ "iana-time-zone",
+ "js-sys",
+ "num-traits",
+ "serde",
+ "wasm-bindgen",
+ "windows-link",
+]
+
+[[package]]
+name = "core-foundation-sys"
+version = "0.8.7"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "773648b94d0e5d620f64f280777445740e61fe701025087ec8b57f45c791888b"
+
 [[package]]
 name = "cpufeatures"
 version = "0.2.17"
@@ -204,6 +249,130 @@ dependencies = [
  "typenum",
 ]
 
+[[package]]
+name = "darling"
+version = "0.21.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "9cdf337090841a411e2a7f3deb9187445851f91b309c0c0a29e05f74a00a48c0"
+dependencies = [
+ "darling_core",
+ "darling_macro",
+]
+
+[[package]]
+name = "darling_core"
+version = "0.21.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "1247195ecd7e3c85f83c8d2a366e4210d588e802133e1e355180a9870b517ea4"
+dependencies = [
+ "fnv",
+ "ident_case",
+ "proc-macro2",
+ "quote",
+ "strsim",
+ "syn",
+]
+
+[[package]]
+name = "darling_macro"
+version = "0.21.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d38308df82d1080de0afee5d069fa14b0326a88c14f15c5ccda35b4a6c414c81"
+dependencies = [
+ "darling_core",
+ "quote",
+ "syn",
+]
+
+[[package]]
+name = "deadpool"
+version = "0.13.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "883466cb8db62725aee5f4a6011e8a5d42912b42632df32aad57fc91127c6e04"
+dependencies = [
+ "deadpool-runtime",
+ "num_cpus",
+ "tokio",
+]
+
+[[package]]
+name = "deadpool-runtime"
+version = "0.3.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "2657f61fb1dd8bf37a8d51093cc7cee4e77125b22f7753f49b289f831bec2bae"
+
+[[package]]
+name = "deranged"
+version = "0.5.8"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "7cd812cc2bc1d69d4764bd80df88b4317eaef9e773c75226407d9bc0876b211c"
+dependencies = [
+ "powerfmt",
+]
+
+[[package]]
+name = "diesel"
+version = "2.3.9"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "9940fb8467a0a06312218ed384185cb8536aa10d8ec017d0ce7fad2c1bd882d5"
+dependencies = [
+ "chrono",
+ "diesel_derives",
+ "downcast-rs",
+ "libsqlite3-sys",
+ "serde_json",
+ "sqlite-wasm-rs",
+ "time",
+]
+
+[[package]]
+name = "diesel-async"
+version = "0.9.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "9c20ddcc6737cecdaef3dfecb2796bdfe3002456521189d30be8e4c5a1bc821d"
+dependencies = [
+ "deadpool",
+ "diesel",
+ "diesel_migrations",
+ "futures-core",
+ "futures-util",
+ "pin-project-lite",
+ "tokio",
+]
+
+[[package]]
+name = "diesel_derives"
+version = "2.3.9"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d1817b7f4279b947fc4cafddec12b0e5f8727141706561ce3ac94a60bddd1cf5"
+dependencies = [
+ "diesel_table_macro_syntax",
+ "dsl_auto_type",
+ "proc-macro2",
+ "quote",
+ "syn",
+]
+
+[[package]]
+name = "diesel_migrations"
+version = "2.3.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "28d0f4a98124ba6d4ca75da535f65984badec16a003b6e2f94a01e31a79490b8"
+dependencies = [
+ "diesel",
+ "migrations_internals",
+ "migrations_macros",
+]
+
+[[package]]
+name = "diesel_table_macro_syntax"
+version = "0.3.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "fe2444076b48641147115697648dc743c2c00b61adade0f01ce67133c7babe8c"
+dependencies = [
+ "syn",
+]
+
 [[package]]
 name = "digest"
 version = "0.10.7"
@@ -215,6 +384,32 @@ dependencies = [
  "subtle",
 ]
 
+[[package]]
+name = "downcast-rs"
+version = "2.0.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "117240f60069e65410b3ae1bb213295bd828f707b5bec6596a1afc8793ce0cbc"
+
+[[package]]
+name = "dsl_auto_type"
+version = "0.2.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "dd122633e4bef06db27737f21d3738fb89c8f6d5360d6d9d7635dda142a7757e"
+dependencies = [
+ "darling",
+ "either",
+ "heck",
+ "proc-macro2",
+ "quote",
+ "syn",
+]
+
+[[package]]
+name = "either"
+version = "1.15.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "48c757948c5ede0e46177b7add2e67155f70e33c07fea8284df6576da70b3719"
+
 [[package]]
 name = "equivalent"
 version = "1.0.2"
@@ -231,12 +426,30 @@ dependencies = [
  "windows-sys",
 ]
 
+[[package]]
+name = "find-msvc-tools"
+version = "0.1.9"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "5baebc0774151f905a1a2cc41989300b1e6fbb29aff0ceffa1064fdd3088d582"
+
+[[package]]
+name = "fnv"
+version = "1.0.7"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "3f9eec918d3f24069decb9af1554cad7c880e2da24a9afd88aca000531ab82c1"
+
 [[package]]
 name = "foldhash"
 version = "0.1.5"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "d9c4f5dac5e15c24eb999c26181a6ca40b39fe946cbe4c263c7209467bc83af2"
 
+[[package]]
+name = "foldhash"
+version = "0.2.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "77ce24cb58228fbb8aa041425bb1050850ac19177686ea6e0f41a70416f56fdb"
+
 [[package]]
 name = "form_urlencoded"
 version = "1.2.2"
@@ -261,6 +474,12 @@ version = "0.3.31"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "05f29059c0c2090612e8d742178b0580d2dc940c837851ad723096f87af6663e"
 
+[[package]]
+name = "futures-sink"
+version = "0.3.32"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "c39754e157331b013978ec91992bde1ac089843443c49cbc7f46150b0fad0893"
+
 [[package]]
 name = "futures-task"
 version = "0.3.31"
@@ -274,6 +493,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "9fa08315bb612088cc391249efdc3bc77536f16c91f6cf495e6fbe85b20a4a81"
 dependencies = [
  "futures-core",
+ "futures-sink",
  "futures-task",
  "pin-project-lite",
  "pin-utils",
@@ -308,7 +528,7 @@ version = "0.15.5"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "9229cfe53dfd69f0609a49f65461bd93001ea1ef889cd5529dd176593f5338a1"
 dependencies = [
- "foldhash",
+ "foldhash 0.1.5",
 ]
 
 [[package]]
@@ -316,6 +536,9 @@ name = "hashbrown"
 version = "0.16.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "841d1cc9bed7f9236f321df977030373f4a4163ae1a7dbfe1a51a2c1a51d9100"
+dependencies = [
+ "foldhash 0.2.0",
+]
 
 [[package]]
 name = "headers"
@@ -347,6 +570,12 @@ version = "0.5.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "2304e00983f87ffb38b55b444b5e3b60a884b5d30c0fca7d82fe33449bbe55ea"
 
+[[package]]
+name = "hermit-abi"
+version = "0.5.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "fc0fef456e4baa96da950455cd02c081ca953b141298e41db3fc7e36b1da849c"
+
 [[package]]
 name = "http"
 version = "1.4.0"
@@ -428,12 +657,42 @@ dependencies = [
  "tower-service",
 ]
 
+[[package]]
+name = "iana-time-zone"
+version = "0.1.65"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e31bc9ad994ba00e440a8aa5c9ef0ec67d5cb5e5cb0cc7f8b744a35b389cc470"
+dependencies = [
+ "android_system_properties",
+ "core-foundation-sys",
+ "iana-time-zone-haiku",
+ "js-sys",
+ "log",
+ "wasm-bindgen",
+ "windows-core",
+]
+
+[[package]]
+name = "iana-time-zone-haiku"
+version = "0.1.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f31827a206f56af32e590ba56d5d2d085f558508192593743f16b2306495269f"
+dependencies = [
+ "cc",
+]
+
 [[package]]
 name = "id-arena"
 version = "2.3.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "3d3067d79b975e8844ca9eb072e16b31c3c1c36928edf9c6789548c524d0d954"
 
+[[package]]
+name = "ident_case"
+version = "1.0.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b9e0384b61958566e926dc50660321d12159025e767c18e043daf26b70104c39"
+
 [[package]]
 name = "indexmap"
 version = "2.13.0"
@@ -474,6 +733,17 @@ version = "0.2.186"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "68ab91017fe16c622486840e4c83c9a37afeff978bd239b5293d61ece587de66"
 
+[[package]]
+name = "libsqlite3-sys"
+version = "0.30.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "2e99fb7a497b1e3339bc746195567ed8d3e24945ecd636e3619d20b9de9e9149"
+dependencies = [
+ "cc",
+ "pkg-config",
+ "vcpkg",
+]
+
 [[package]]
 name = "log"
 version = "0.4.29"
@@ -492,6 +762,27 @@ version = "2.8.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "f8ca58f447f06ed17d5fc4043ce1b10dd205e060fb3ce5b979b8ed8e59ff3f79"
 
+[[package]]
+name = "migrations_internals"
+version = "2.3.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "36c791ecdf977c99f45f23280405d7723727470f6689a5e6dbf513ac547ae10d"
+dependencies = [
+ "serde",
+ "toml",
+]
+
+[[package]]
+name = "migrations_macros"
+version = "2.3.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "36fc5ac76be324cfd2d3f2cf0fdf5d5d3c4f14ed8aaebadb09e304ba42282703"
+dependencies = [
+ "migrations_internals",
+ "proc-macro2",
+ "quote",
+]
+
 [[package]]
 name = "mime"
 version = "0.3.17"
@@ -509,21 +800,56 @@ dependencies = [
  "windows-sys",
 ]
 
+[[package]]
+name = "num-conv"
+version = "0.2.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "c6673768db2d862beb9b39a78fdcb1a69439615d5794a1be50caa9bc92c81967"
+
+[[package]]
+name = "num-traits"
+version = "0.2.19"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "071dfc062690e90b734c0b2273ce72ad0ffa95f0c74596bc250dcfd960262841"
+dependencies = [
+ "autocfg",
+]
+
+[[package]]
+name = "num_cpus"
+version = "1.17.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "91df4bbde75afed763b708b7eee1e8e7651e02d97f6d5dd763e89367e957b23b"
+dependencies = [
+ "hermit-abi",
+ "libc",
+]
+
 [[package]]
 name = "oauth-api-rust"
 version = "0.1.0"
 dependencies = [
+ "anyhow",
  "argon2",
  "assertables",
  "axum",
  "axum-extra",
  "base64",
+ "chrono",
+ "diesel",
+ "diesel-async",
+ "diesel_migrations",
  "form_urlencoded",
  "http-body-util",
+ "libsqlite3-sys",
  "serde",
  "serde_json",
+ "strum",
+ "strum_macros",
+ "thiserror",
  "tokio",
  "tower",
+ "trait-variant",
  "uuid",
 ]
 
@@ -552,9 +878,9 @@ checksum = "9b4f627cb1b25917193a259e49bdad08f671f8d9708acfd5fe0a8c1455d87220"
 
 [[package]]
 name = "pin-project-lite"
-version = "0.2.16"
+version = "0.2.17"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "3b3cff922bd51709b605d9ead9aa71031d81447142d828eb4a6eba76fe619f9b"
+checksum = "a89322df9ebe1c1578d689c92318e070967d1042b512afbe49518723f4e6d5cd"
 
 [[package]]
 name = "pin-utils"
@@ -562,6 +888,18 @@ version = "0.1.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "8b870d8c151b6f2fb93e84a13146138f05d02ed11c7e7c54f8826aaaf7c9f184"
 
+[[package]]
+name = "pkg-config"
+version = "0.3.33"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "19f132c84eca552bf34cab8ec81f1c1dcc229b811638f9d283dceabe58c5569e"
+
+[[package]]
+name = "powerfmt"
+version = "0.2.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "439ee305def115ba05938db6eb1644ff94165c5ab5e9420d1c1bcedbba909391"
+
 [[package]]
 name = "prettyplease"
 version = "0.2.37"
@@ -631,6 +969,16 @@ version = "0.8.9"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "a96887878f22d7bad8a3b6dc5b7440e0ada9a245242924394987b21cf2210a4c"
 
+[[package]]
+name = "rsqlite-vfs"
+version = "0.1.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "a8a1f2315036ef6b1fbacd1972e8ee7688030b0a2121edfc2a6550febd41574d"
+dependencies = [
+ "hashbrown 0.16.1",
+ "thiserror",
+]
+
 [[package]]
 name = "rustversion"
 version = "1.0.22"
@@ -712,6 +1060,15 @@ dependencies = [
  "serde_core",
 ]
 
+[[package]]
+name = "serde_spanned"
+version = "1.1.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "6662b5879511e06e8999a8a235d848113e942c9124f211511b16466ee2995f26"
+dependencies = [
+ "serde_core",
+]
+
 [[package]]
 name = "serde_urlencoded"
 version = "0.7.1"
@@ -735,6 +1092,12 @@ dependencies = [
  "digest",
 ]
 
+[[package]]
+name = "shlex"
+version = "1.3.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "0fda2ff0d084019ba4d7c6f371c95d8fd75ce3524c3cb8fb653a3023f6323e64"
+
 [[package]]
 name = "signal-hook-registry"
 version = "1.4.8"
@@ -761,6 +1124,42 @@ dependencies = [
  "windows-sys",
 ]
 
+[[package]]
+name = "sqlite-wasm-rs"
+version = "0.5.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "1b2c760607300407ddeaee518acf28c795661b7108c75421303dbefb237d3a36"
+dependencies = [
+ "cc",
+ "js-sys",
+ "rsqlite-vfs",
+ "wasm-bindgen",
+]
+
+[[package]]
+name = "strsim"
+version = "0.11.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "7da8b5736845d9f2fcb837ea5d9e2628564b3b043a70948a3f0b778838c5fb4f"
+
+[[package]]
+name = "strum"
+version = "0.28.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "9628de9b8791db39ceda2b119bbe13134770b56c138ec1d3af810d045c04f9bd"
+
+[[package]]
+name = "strum_macros"
+version = "0.28.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ab85eea0270ee17587ed4156089e10b9e6880ee688791d45a905f5b1ca36f664"
+dependencies = [
+ "heck",
+ "proc-macro2",
+ "quote",
+ "syn",
+]
+
 [[package]]
 name = "subtle"
 version = "2.6.1"
@@ -784,6 +1183,57 @@ version = "1.0.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "0bf256ce5efdfa370213c1dabab5935a12e49f2c58d15e9eac2870d3b4f27263"
 
+[[package]]
+name = "thiserror"
+version = "2.0.18"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "4288b5bcbc7920c07a1149a35cf9590a2aa808e0bc1eafaade0b80947865fbc4"
+dependencies = [
+ "thiserror-impl",
+]
+
+[[package]]
+name = "thiserror-impl"
+version = "2.0.18"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ebc4ee7f67670e9b64d05fa4253e753e016c6c95ff35b89b7941d6b856dec1d5"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn",
+]
+
+[[package]]
+name = "time"
+version = "0.3.47"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "743bd48c283afc0388f9b8827b976905fb217ad9e647fae3a379a9283c4def2c"
+dependencies = [
+ "deranged",
+ "itoa",
+ "num-conv",
+ "powerfmt",
+ "serde_core",
+ "time-core",
+ "time-macros",
+]
+
+[[package]]
+name = "time-core"
+version = "0.1.8"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "7694e1cfe791f8d31026952abf09c69ca6f6fa4e1a1229e18988f06a04a12dca"
+
+[[package]]
+name = "time-macros"
+version = "0.2.27"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "2e70e4c5a0e0a8a4823ad65dfe1a6930e4f4d756dcd9dd7939022b5e8c501215"
+dependencies = [
+ "num-conv",
+ "time-core",
+]
+
 [[package]]
 name = "tokio"
 version = "1.52.1"
@@ -810,6 +1260,37 @@ dependencies = [
  "syn",
 ]
 
+[[package]]
+name = "toml"
+version = "0.9.12+spec-1.1.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "cf92845e79fc2e2def6a5d828f0801e29a2f8acc037becc5ab08595c7d5e9863"
+dependencies = [
+ "serde_core",
+ "serde_spanned",
+ "toml_datetime",
+ "toml_parser",
+ "winnow 0.7.15",
+]
+
+[[package]]
+name = "toml_datetime"
+version = "0.7.5+spec-1.1.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "92e1cfed4a3038bc5a127e35a2d360f145e1f4b971b551a2ba5fd7aedf7e1347"
+dependencies = [
+ "serde_core",
+]
+
+[[package]]
+name = "toml_parser"
+version = "1.1.2+spec-1.1.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "a2abe9b86193656635d2411dc43050282ca48aa31c2451210f4202550afb7526"
+dependencies = [
+ "winnow 1.0.2",
+]
+
 [[package]]
 name = "tower"
 version = "0.5.3"
@@ -858,6 +1339,17 @@ dependencies = [
  "once_cell",
 ]
 
+[[package]]
+name = "trait-variant"
+version = "0.1.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "70977707304198400eb4835a78f6a9f928bf41bba420deb8fdb175cd965d77a7"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn",
+]
+
 [[package]]
 name = "typenum"
 version = "1.19.0"
@@ -888,6 +1380,12 @@ dependencies = [
  "wasm-bindgen",
 ]
 
+[[package]]
+name = "vcpkg"
+version = "0.2.15"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "accd4ea62f7bb7a82fe23066fb0957d48ef677f6eeb8215f372f52e48bb32426"
+
 [[package]]
 name = "version_check"
 version = "0.9.5"
@@ -1016,12 +1514,65 @@ dependencies = [
  "windows-sys",
 ]
 
+[[package]]
+name = "windows-core"
+version = "0.62.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b8e83a14d34d0623b51dce9581199302a221863196a1dde71a7663a4c2be9deb"
+dependencies = [
+ "windows-implement",
+ "windows-interface",
+ "windows-link",
+ "windows-result",
+ "windows-strings",
+]
+
+[[package]]
+name = "windows-implement"
+version = "0.60.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "053e2e040ab57b9dc951b72c264860db7eb3b0200ba345b4e4c3b14f67855ddf"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn",
+]
+
+[[package]]
+name = "windows-interface"
+version = "0.59.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "3f316c4a2570ba26bbec722032c4099d8c8bc095efccdc15688708623367e358"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn",
+]
+
 [[package]]
 name = "windows-link"
 version = "0.2.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "f0805222e57f7521d6a62e36fa9163bc891acd422f971defe97d64e70d0a4fe5"
 
+[[package]]
+name = "windows-result"
+version = "0.4.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "7781fa89eaf60850ac3d2da7af8e5242a5ea78d1a11c49bf2910bb5a73853eb5"
+dependencies = [
+ "windows-link",
+]
+
+[[package]]
+name = "windows-strings"
+version = "0.5.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "7837d08f69c77cf6b07689544538e017c1bfcf57e34b4c0ff58e6c2cd3b37091"
+dependencies = [
+ "windows-link",
+]
+
 [[package]]
 name = "windows-sys"
 version = "0.61.2"
@@ -1031,6 +1582,18 @@ dependencies = [
  "windows-link",
 ]
 
+[[package]]
+name = "winnow"
+version = "0.7.15"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "df79d97927682d2fd8adb29682d1140b343be4ac0f08fd68b7765d9c059d3945"
+
+[[package]]
+name = "winnow"
+version = "1.0.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "2ee1708bef14716a11bae175f579062d4554d95be2c6829f518df847b7b3fdd0"
+
 [[package]]
 name = "wit-bindgen"
 version = "0.51.0"
diff --git a/Cargo.toml b/Cargo.toml
index 20b3f62..0d428c5 100644
--- a/Cargo.toml
+++ b/Cargo.toml
@@ -3,18 +3,31 @@ name = "oauth-api-rust"
 version = "0.1.0"
 edition = "2024"
 
+[features]
+default = []
+
 [dependencies]
 argon2 = "0.5.3"
 axum = { version = "0.8.9", features = ["macros"] }
 axum-extra = { version = "0.12.5", features = ["typed-header"] }
 serde = { version = "1.0.228", features = ["derive"] }
+serde_json = "1.0.149"
 tokio = { version = "1.52.1", features = ["macros", "rt-multi-thread", "signal"] }
 uuid = { version = "1.23.1", features = ["v4", "serde"] }
 form_urlencoded = "1.2.2"
 tower = "0.5.3"
+diesel = { version = "2.3.9", features = ["returning_clauses_for_sqlite_3_35", "chrono", "serde_json"] }
+diesel-async = { version = "0.9.0", features = ["sqlite", "deadpool", "migrations"] }
+diesel_migrations = { version = "2.3.2" }
+libsqlite3-sys = { version = "*", features = ["bundled"] }
+chrono = { version = "0.4.44", features = ["serde"] }
+anyhow = "1.0.102"
+thiserror = "2.0.18"
+trait-variant = "0.1.2"
+strum = "0.28.0"
+strum_macros = "0.28.0"
 
 [dev-dependencies]
 assertables = "9.9.0"
 base64 = "0.22.1"
 http-body-util = "0.1.3"
-serde_json = "1.0.149"
diff --git a/README.md b/README.md
index 511e412..1b6675c 100644
--- a/README.md
+++ b/README.md
@@ -61,9 +61,14 @@ cargo run
 
 ### Checking its running
 
-Hit the token exchange endpoint with a password grant _(yeah its deprecated; but it's a quick lazy way to start)_.
+Hit the token exchange endpoint with a password grant _(yeah, it's deprecated; but it's a quick lazy way to start)_.
 ```bash
-curl -vvv -X POST -H 'Content-Type: application/x-www-form-urlencoded' -u 'aardvark:badger' -d 'grant_type=password&scope=basic&username=aardvark&password=P%4055w0rd' http://127.0.0.1:8080/token
+curl -v -X POST -H 'Content-Type: application/x-www-form-urlencoded' -u 'aardvark:badger' -d 'grant_type=password&scope=basic&username=aardvark&password=P%4055w0rd' http://127.0.0.1:8080/token
+```
+
+Hit the token introspection endpoint with the token just issued.
+```bash
+curl -v -X POST -H 'Content-Type: application/x-www-form-urlencoded' -u 'aardvark:badger' -d 'token=483d83dd-92a2-4d73-817f-8fd0e7203cb3' http://127.0.0.1:8080/introspect
 ```
 
 ## Reading materials
@@ -73,3 +78,7 @@ curl -vvv -X POST -H 'Content-Type: application/x-www-form-urlencoded' -u 'aardv
 * https://docs.rs/axum/latest/axum/middleware/index.html
 * https://docs.rs/axum/latest/axum/error_handling/index.html
 * https://docs.rs/tower/latest/tower
+* https://crates.io/crates/anyhow
+* https://crates.io/crates/thiserror
+* https://docs.diesel.rs/2.0.x/diesel/index.html
+* https://obito.fr/posts/2022/12/use-uuid-in-sqlite-database-with-rust-diesel.rs/
diff --git a/diesel.toml b/diesel.toml
new file mode 100644
index 0000000..a0d61bf
--- /dev/null
+++ b/diesel.toml
@@ -0,0 +1,9 @@
+# For documentation on how to configure this file,
+# see https://diesel.rs/guides/configuring-diesel-cli
+
+[print_schema]
+file = "src/schema.rs"
+custom_type_derives = ["diesel::query_builder::QueryId", "Clone"]
+
+[migrations_directory]
+dir = "migrations"
diff --git a/migrations/2026-05-11-094743-0000_create_access_tokens/down.sql b/migrations/2026-05-11-094743-0000_create_access_tokens/down.sql
new file mode 100644
index 0000000..6a8d853
--- /dev/null
+++ b/migrations/2026-05-11-094743-0000_create_access_tokens/down.sql
@@ -0,0 +1 @@
+DROP TABLE access_tokens;
\ No newline at end of file
diff --git a/migrations/2026-05-11-094743-0000_create_access_tokens/up.sql b/migrations/2026-05-11-094743-0000_create_access_tokens/up.sql
new file mode 100644
index 0000000..7ca48a2
--- /dev/null
+++ b/migrations/2026-05-11-094743-0000_create_access_tokens/up.sql
@@ -0,0 +1,10 @@
+CREATE TABLE access_tokens
+(
+    id         BLOB(16) PRIMARY KEY NOT NULL CHECK (LENGTH(id) = 16),
+    username   VARCHAR(64)          NOT NULL CHECK (LENGTH(username) > 0 AND LENGTH(username) <= 64),
+    client_id  VARCHAR(64)          NOT NULL CHECK (LENGTH(client_id) > 0 AND LENGTH(client_id) <= 64),
+    scopes     VARCHAR(16)          NOT NULL CHECK (LENGTH(scopes) <= 16),
+    issued_at  TIMESTAMP            NOT NULL,
+    expires_at TIMESTAMP            NOT NULL,
+    not_before TIMESTAMP            NOT NULL
+);
diff --git a/migrations/2026-05-13-144941-0000_create_client_configurations/down.sql b/migrations/2026-05-13-144941-0000_create_client_configurations/down.sql
new file mode 100644
index 0000000..b82e6ea
--- /dev/null
+++ b/migrations/2026-05-13-144941-0000_create_client_configurations/down.sql
@@ -0,0 +1 @@
+DROP TABLE IF EXISTS client_configurations;
diff --git a/migrations/2026-05-13-144941-0000_create_client_configurations/up.sql b/migrations/2026-05-13-144941-0000_create_client_configurations/up.sql
new file mode 100644
index 0000000..5f8e9c1
--- /dev/null
+++ b/migrations/2026-05-13-144941-0000_create_client_configurations/up.sql
@@ -0,0 +1,9 @@
+CREATE TABLE client_configurations
+(
+    client_id           VARCHAR(64) NOT NULL PRIMARY KEY CHECK (LENGTH(client_id) > 0 AND LENGTH(client_id) <= 64),
+    client_type         VARCHAR(12) NOT NULL CHECK (client_type IN ('confidential', 'public')),
+    redirect_uris       BINARY      NOT NULL CHECK (json_valid(redirect_uris) AND json_type(redirect_uris) = 'array'),
+    allowed_scopes      BINARY      NOT NULL CHECK (json_valid(allowed_scopes) AND json_type(allowed_scopes) = 'array'),
+    allowed_actions     BINARY      NOT NULL CHECK (json_valid(allowed_actions) AND json_type(allowed_actions) = 'array'),
+    allowed_grant_types BINARY      NOT NULL CHECK (json_valid(allowed_grant_types) AND json_type(allowed_grant_types) = 'array')
+);
diff --git a/migrations/2026-05-14-103409-0000_add_client_id_fk_to_access_tokens/down.sql b/migrations/2026-05-14-103409-0000_add_client_id_fk_to_access_tokens/down.sql
new file mode 100644
index 0000000..9dc1e69
--- /dev/null
+++ b/migrations/2026-05-14-103409-0000_add_client_id_fk_to_access_tokens/down.sql
@@ -0,0 +1,16 @@
+CREATE TABLE access_tokens_temp
+(
+    id         BLOB(16) PRIMARY KEY NOT NULL CHECK (LENGTH(id) = 16),
+    username   VARCHAR(64)          NOT NULL CHECK (LENGTH(username) > 0 AND LENGTH(username) <= 64),
+    client_id  VARCHAR(64)          NOT NULL CHECK (LENGTH(client_id) > 0 AND LENGTH(client_id) <= 64),
+    scopes     VARCHAR(16)          NOT NULL CHECK (LENGTH(scopes) <= 16),
+    issued_at  TIMESTAMP            NOT NULL,
+    expires_at TIMESTAMP            NOT NULL,
+    not_before TIMESTAMP            NOT NULL
+);
+
+INSERT INTO access_tokens_temp SELECT * FROM access_tokens;
+
+DROP TABLE access_tokens;
+
+ALTER TABLE access_tokens_temp RENAME TO access_tokens;
\ No newline at end of file
diff --git a/migrations/2026-05-14-103409-0000_add_client_id_fk_to_access_tokens/up.sql b/migrations/2026-05-14-103409-0000_add_client_id_fk_to_access_tokens/up.sql
new file mode 100644
index 0000000..4355aaf
--- /dev/null
+++ b/migrations/2026-05-14-103409-0000_add_client_id_fk_to_access_tokens/up.sql
@@ -0,0 +1,16 @@
+CREATE TABLE access_tokens_temp
+(
+    id         BLOB(16) PRIMARY KEY NOT NULL CHECK (LENGTH(id) = 16),
+    username   VARCHAR(64)          NOT NULL CHECK (LENGTH(username) > 0 AND LENGTH(username) <= 64),
+    client_id  VARCHAR(64)          NOT NULL REFERENCES client_configurations (client_id) ON DELETE CASCADE,
+    scopes     VARCHAR(16)          NOT NULL CHECK (LENGTH(scopes) <= 16),
+    issued_at  TIMESTAMP            NOT NULL,
+    expires_at TIMESTAMP            NOT NULL,
+    not_before TIMESTAMP            NOT NULL
+);
+
+INSERT INTO access_tokens_temp SELECT * FROM access_tokens;
+
+DROP TABLE access_tokens;
+
+ALTER TABLE access_tokens_temp RENAME TO access_tokens;
\ No newline at end of file
diff --git a/migrations/2026-05-14-140202-0000_insert_dummy_client_configurations/down.sql b/migrations/2026-05-14-140202-0000_insert_dummy_client_configurations/down.sql
new file mode 100644
index 0000000..16b1781
--- /dev/null
+++ b/migrations/2026-05-14-140202-0000_insert_dummy_client_configurations/down.sql
@@ -0,0 +1 @@
+DELETE FROM client_configurations WHERE client_id in ('aardvark', 'badger');
\ No newline at end of file
diff --git a/migrations/2026-05-14-140202-0000_insert_dummy_client_configurations/up.sql b/migrations/2026-05-14-140202-0000_insert_dummy_client_configurations/up.sql
new file mode 100644
index 0000000..81ed487
--- /dev/null
+++ b/migrations/2026-05-14-140202-0000_insert_dummy_client_configurations/up.sql
@@ -0,0 +1,4 @@
+-- TODO - Remove if this is used in a production setting
+INSERT INTO client_configurations (client_id, client_type, redirect_uris, allowed_scopes, allowed_actions, allowed_grant_types)
+VALUES ('aardvark', 'confidential', '[]', '["basic", "read", "write"]', '["introspect"]', '["password"]'),
+       ('badger', 'public', '[]', '["basic"]', '[]', '[]');
diff --git a/migrations/2026-05-18-090442-0000_migrate_access_token_scopes_to_json_array/down.sql b/migrations/2026-05-18-090442-0000_migrate_access_token_scopes_to_json_array/down.sql
new file mode 100644
index 0000000..103e0d0
--- /dev/null
+++ b/migrations/2026-05-18-090442-0000_migrate_access_token_scopes_to_json_array/down.sql
@@ -0,0 +1,24 @@
+CREATE TABLE access_tokens_temp
+(
+    id         BLOB(16) PRIMARY KEY NOT NULL CHECK (LENGTH(id) = 16),
+    username   VARCHAR(64)          NOT NULL CHECK (LENGTH(username) > 0 AND LENGTH(username) <= 64),
+    client_id  VARCHAR(64)          NOT NULL REFERENCES client_configurations (client_id) ON DELETE CASCADE,
+    scopes     VARCHAR(16)          NOT NULL CHECK (LENGTH(scopes) <= 16),
+    issued_at  TIMESTAMP            NOT NULL,
+    expires_at TIMESTAMP            NOT NULL,
+    not_before TIMESTAMP            NOT NULL
+);
+
+INSERT INTO access_tokens_temp
+SELECT id,
+       username,
+       client_id,
+       (SELECT group_concat(value, ' ') FROM json_each(at.scopes)) as scopes,
+       issued_at,
+       expires_at,
+       not_before
+FROM access_tokens at;
+
+DROP TABLE access_tokens;
+
+ALTER TABLE access_tokens_temp RENAME TO access_tokens;
\ No newline at end of file
diff --git a/migrations/2026-05-18-090442-0000_migrate_access_token_scopes_to_json_array/up.sql b/migrations/2026-05-18-090442-0000_migrate_access_token_scopes_to_json_array/up.sql
new file mode 100644
index 0000000..c3c3445
--- /dev/null
+++ b/migrations/2026-05-18-090442-0000_migrate_access_token_scopes_to_json_array/up.sql
@@ -0,0 +1,45 @@
+CREATE TABLE access_tokens_temp
+(
+    id         BLOB(16) PRIMARY KEY NOT NULL CHECK (LENGTH(id) = 16),
+    username   VARCHAR(64)          NOT NULL CHECK (LENGTH(username) > 0 AND LENGTH(username) <= 64),
+    client_id  VARCHAR(64)          NOT NULL REFERENCES client_configurations (client_id) ON DELETE CASCADE,
+    scopes     BINARY               NOT NULL CHECK (json_valid(scopes) AND json_type(scopes) = 'array'),
+    issued_at  TIMESTAMP            NOT NULL,
+    expires_at TIMESTAMP            NOT NULL,
+    not_before TIMESTAMP            NOT NULL
+);
+
+INSERT INTO access_tokens_temp
+SELECT
+    id,
+    username,
+    client_id,
+    (
+        WITH RECURSIVE split(word, rest) AS (
+            SELECT
+                CASE WHEN instr(trim(at.scopes), ' ') > 0
+                         THEN substr(trim(at.scopes), 1, instr(trim(at.scopes), ' ') - 1)
+                     ELSE trim(at.scopes) END,
+                CASE WHEN instr(trim(at.scopes), ' ') > 0
+                         THEN substr(trim(at.scopes), instr(trim(at.scopes), ' ') + 1)
+                     ELSE '' END
+            UNION ALL
+            SELECT
+                CASE WHEN instr(trim(rest), ' ') > 0
+                         THEN substr(trim(rest), 1, instr(trim(rest), ' ') - 1)
+                     ELSE trim(rest) END,
+                CASE WHEN instr(trim(rest), ' ') > 0
+                         THEN substr(trim(rest), instr(trim(rest), ' ') + 1)
+                     ELSE '' END
+            FROM split WHERE rest != ''
+        )
+        SELECT json_group_array(word) FROM split
+    ) as scopes,
+    issued_at,
+    expires_at,
+    not_before
+FROM access_tokens at;
+
+DROP TABLE access_tokens;
+
+ALTER TABLE access_tokens_temp RENAME TO access_tokens;
\ No newline at end of file
diff --git a/migrations/2026-05-18-130649-0000_create_client_secrets/down.sql b/migrations/2026-05-18-130649-0000_create_client_secrets/down.sql
new file mode 100644
index 0000000..ef260e0
--- /dev/null
+++ b/migrations/2026-05-18-130649-0000_create_client_secrets/down.sql
@@ -0,0 +1 @@
+DROP TABLE IF EXISTS client_secrets;
\ No newline at end of file
diff --git a/migrations/2026-05-18-130649-0000_create_client_secrets/up.sql b/migrations/2026-05-18-130649-0000_create_client_secrets/up.sql
new file mode 100644
index 0000000..c2c922a
--- /dev/null
+++ b/migrations/2026-05-18-130649-0000_create_client_secrets/up.sql
@@ -0,0 +1,6 @@
+CREATE TABLE client_secrets
+(
+    id        BLOB(16) PRIMARY KEY NOT NULL CHECK (LENGTH(id) = 16),
+    client_id VARCHAR(64)          NOT NULL REFERENCES client_configurations (client_id) ON DELETE CASCADE,
+    hash      VARCHAR(128)         NOT NULL CHECK (LENGTH(hash) >= 50 AND LENGTH(hash) <= 128)
+);
\ No newline at end of file
diff --git a/migrations/2026-05-18-132216-0000_insert_dummy_client_secrets/down.sql b/migrations/2026-05-18-132216-0000_insert_dummy_client_secrets/down.sql
new file mode 100644
index 0000000..ff1bb3a
--- /dev/null
+++ b/migrations/2026-05-18-132216-0000_insert_dummy_client_secrets/down.sql
@@ -0,0 +1 @@
+DELETE FROM client_secrets WHERE id in (X'a9747e2e34c64870b792fc7c004baef7');
\ No newline at end of file
diff --git a/migrations/2026-05-18-132216-0000_insert_dummy_client_secrets/up.sql b/migrations/2026-05-18-132216-0000_insert_dummy_client_secrets/up.sql
new file mode 100644
index 0000000..ef65db4
--- /dev/null
+++ b/migrations/2026-05-18-132216-0000_insert_dummy_client_secrets/up.sql
@@ -0,0 +1,5 @@
+-- TODO - Remove if this is used in a production setting;
+INSERT INTO client_secrets (id, client_id, hash)
+VALUES (X'a9747e2e34c64870b792fc7c004baef7',
+        'aardvark',
+        '$argon2id$v=19$m=19456,t=2,p=1$AAAAAAAAAAAAAAAAAAAAAA$H95jwDvk045Fb8JUntQP8pIQWj9WA4ETxG4jMUvf7wA');
\ No newline at end of file
diff --git a/src/client/authentication.rs b/src/client/authentication.rs
index 4e3705c..4ba2c3e 100644
--- a/src/client/authentication.rs
+++ b/src/client/authentication.rs
@@ -1,11 +1,14 @@
+use anyhow::Result;
 use argon2::{Argon2, PasswordHash, PasswordVerifier};
 use crate::client::{ClientType, ConfidentialClient, PublicClient};
 use crate::client::configuration::ClientConfigurationRepository;
 use crate::client::secret::ClientSecretRepository;
 
+// TODO - Bubble up low level DB errors don't report them as unauthorised
+#[trait_variant::make(Send)]
 pub trait ClientAuthenticator: Send + Sync + Clone {
-    fn authenticate_as_public_client(&self, client_id: &str) -> Option<PublicClient>;
-    fn authenticate_as_confidential_client(&self, client_id: &str, client_secret: &[u8]) -> Option<ConfidentialClient>;
+    async fn authenticate_as_public_client(&self, client_id: &str) -> Option<PublicClient>;
+    async fn authenticate_as_confidential_client(&self, client_id: &str, client_secret: &[u8]) -> Result<Option<ConfidentialClient>>;
 }
 
 #[derive(Clone)]
@@ -28,10 +31,10 @@ where
     S: ClientSecretRepository,
     C: ClientConfigurationRepository,
 {
-    fn authenticate_as_public_client(&self, client_id: &str) -> Option<PublicClient> {
+    async fn authenticate_as_public_client(&self, client_id: &str) -> Option<PublicClient> {
 
-        match self.client_configuration_repository.find_by_client_id(client_id) {
-            Some(configuration) if configuration.client_type == ClientType::Public => {
+        match self.client_configuration_repository.find_by_client_id(client_id).await {
+            Ok(Some(configuration)) if configuration.client_type == ClientType::Public => {
                 Some(PublicClient { configuration })
             },
             _ => None
@@ -39,29 +42,28 @@ where
     }
 
     // TODO - Do we flip to the lookup from config first, then credential checks?
-    fn authenticate_as_confidential_client(&self, client_id: &str, client_secret: &[u8]) -> Option<ConfidentialClient> {
+    async fn authenticate_as_confidential_client(&self, client_id: &str, client_secret: &[u8]) -> Result<Option<ConfidentialClient>> {
 
-        let secrets = self.secret_repository.find_all_by_client_id(client_id);
+        let secrets = self.secret_repository.find_all_by_client_id(client_id).await?;
 
         let maybe_secret = secrets.iter()
             .find(|secret| {
-                let hash = match PasswordHash::new(&secret.hashed_secret) {
-                    Err(_) => return false,
-                    Ok(hash) => hash,
-                };
+                let Ok(hash) = PasswordHash::new(&secret.hash) else { return false };
                 Argon2::default().verify_password(client_secret, &hash).is_ok()
             });
 
         let client_id = match maybe_secret {
-            None => return None,
+            None => return Ok(None),
             Some(secret) => &secret.client_id,
         };
 
-        match self.client_configuration_repository.find_by_id(client_id) {
-            Some(configuration) if configuration.client_type == ClientType::Confidential => {
+        let maybe_client = match self.client_configuration_repository.find_by_id(client_id).await {
+            Ok(Some(configuration)) if configuration.client_type == ClientType::Confidential => {
                 Some(ConfidentialClient { configuration })
             },
             _ => None
-        }
+        };
+
+        Ok(maybe_client)
     }
 }
diff --git a/src/client/client_principal.rs b/src/client/client_principal.rs
index 02071b3..328dd7f 100644
--- a/src/client/client_principal.rs
+++ b/src/client/client_principal.rs
@@ -42,29 +42,30 @@ macro_rules! define_principal {
             configuration: crate::client::configuration::ClientConfiguration,
         }
 
+        #[allow(dead_code)] // TODO - Remove once more is implemented
         impl $struct_name {
 
-            // pub fn id(&self) -> &crate::client::ClientId {
-            //     &self.configuration.client_id
-            // }
+            pub fn id(&self) -> &crate::client::ClientId {
+                &self.configuration.client_id
+            }
 
             pub fn can_perform_action(&self, action: &crate::client::ClientAction) -> bool {
-                self.configuration.allowed_actions.contains(action)
+                self.configuration.allowed_actions.0.contains(action)
             }
 
             pub fn can_perform_grant_type(&self, grant_type: &crate::client::GrantType) -> bool {
-                self.configuration.allowed_grant_types.contains(grant_type)
+                self.configuration.allowed_grant_types.0.contains(grant_type)
             }
 
             pub fn can_be_issued(&self, scope: &crate::scope::Scope) -> bool {
-                self.configuration.allowed_scopes.contains(scope)
+                self.configuration.allowed_scopes.0.contains(scope)
             }
 
-            // pub fn has_redirect_uri(&self, redirect_uri: &str) -> bool {
-            //     self.configuration.redirect_uris.contains(redirect_uri)
-            // }
+            pub fn has_redirect_uri(&self, redirect_uri: &str) -> bool {
+                self.configuration.redirect_uris.0.contains(redirect_uri)
+            }
         }
 
-        disable_deserialization!($struct_name);
+        $crate::disable_deserialization!($struct_name);
     };
 }
diff --git a/src/client/configuration.rs b/src/client/configuration.rs
index c62c4c1..efbe9a0 100644
--- a/src/client/configuration.rs
+++ b/src/client/configuration.rs
@@ -1,66 +1,149 @@
-use std::collections::{HashMap, HashSet};
-use std::sync::{Arc, Mutex, MutexGuard};
 use crate::client::{ClientAction, ClientId, ClientType, GrantType};
+use crate::schema::client_configurations::dsl;
 use crate::scope::Scope;
+use crate::util::diesel_types::AsyncSqlitePool;
+use crate::{diesel_from_sql_for_json_fields, value_struct};
+use anyhow::{Context, Result};
+use diesel::prelude::*;
+use diesel::{AsExpression, FromSqlRow, Queryable, Selectable};
+use diesel_async::RunQueryDsl;
+use std::collections::HashSet;
 
-#[derive(Clone, Eq, PartialEq)]
-#[cfg_attr(test, derive(Debug))]
+value_struct! {
+    #[derive(FromSqlRow, AsExpression)]
+    #[diesel(sql_type = diesel::sql_types::Binary)]
+    pub struct RedirectUris(pub HashSet<String>);
+}
+
+value_struct! {
+    #[derive(FromSqlRow, AsExpression)]
+    #[diesel(sql_type = diesel::sql_types::Binary)]
+    pub struct AllowedScopes(pub HashSet<Scope>);
+}
+
+value_struct! {
+    #[derive(FromSqlRow, AsExpression)]
+    #[diesel(sql_type = diesel::sql_types::Binary)]
+    pub struct AllowedActions(pub HashSet<ClientAction>);
+}
+
+value_struct! {
+    #[derive(FromSqlRow, AsExpression)]
+    #[diesel(sql_type = diesel::sql_types::Binary)]
+    pub struct AllowedGrantTypes(pub HashSet<GrantType>);
+}
+
+diesel_from_sql_for_json_fields! {
+    RedirectUris(HashSet<String>);
+    AllowedScopes(HashSet<Scope>);
+    AllowedActions(HashSet<ClientAction>);
+    AllowedGrantTypes(HashSet<GrantType>);
+}
+
+#[derive(Debug, Clone, Eq, PartialEq)]
+#[derive(Queryable, Selectable)]
+#[diesel(table_name = crate::schema::client_configurations)]
+#[diesel(check_for_backend(diesel::sqlite::Sqlite))]
 pub struct ClientConfiguration {
     pub client_id: ClientId,
     pub client_type: ClientType,
-    pub redirect_uris: HashSet<String>,
-    pub allowed_scopes: HashSet<Scope>,
-    pub allowed_actions: HashSet<ClientAction>,
-    pub allowed_grant_types: HashSet<GrantType>,
+    pub redirect_uris: RedirectUris,
+    pub allowed_scopes: AllowedScopes,
+    pub allowed_actions: AllowedActions,
+    pub allowed_grant_types: AllowedGrantTypes,
 }
 
+#[trait_variant::make(Send)]
 pub trait ClientConfigurationRepository: Send + Sync + Clone {
-    fn find_by_id(&self, client_id: &ClientId) -> Option<ClientConfiguration>;
-    fn find_by_client_id(&self, client_id: &str) -> Option<ClientConfiguration>;
+    async fn find_by_id(&self, client_id: &ClientId) -> Result<Option<ClientConfiguration>>;
+    async fn find_by_client_id(&self, client_id: &str) -> Result<Option<ClientConfiguration>>;
 }
 
-#[derive(Clone, Default)]
-pub struct InMemoryClientConfigurationRepository {
-    store: Arc<Mutex<HashMap<ClientId, ClientConfiguration>>>,
+#[derive(Clone)]
+pub struct DieselClientConfigurationRepository {
+    pool: AsyncSqlitePool,
 }
 
-impl InMemoryClientConfigurationRepository {
-    pub fn new() -> Self {
-        Self {
-            store: Arc::new(Mutex::new(HashMap::from([
-                // TODO - Remove once we've got a means of creating new clients
-                Self::create_entry(ClientConfiguration {
-                    client_id: ClientId(String::from("aardvark")),
-                    client_type: ClientType::Confidential,
-                    redirect_uris: HashSet::from([]),
-                    allowed_scopes: HashSet::from([Scope::Basic]),
-                    allowed_actions: HashSet::from([ClientAction::Introspect]),
-                    allowed_grant_types: HashSet::from([GrantType::Password]),
-                }),
-                Self::create_entry(ClientConfiguration {
-                    client_id: ClientId(String::from("badger")),
-                    client_type: ClientType::Public,
-                    redirect_uris: HashSet::from([]),
-                    allowed_scopes: HashSet::from([Scope::Basic]),
-                    allowed_actions: HashSet::from([]),
-                    allowed_grant_types: HashSet::from([]),
-                })
-            ])))
-        }
+impl DieselClientConfigurationRepository {
+    pub fn new(pool: AsyncSqlitePool) -> DieselClientConfigurationRepository {
+        Self { pool }
     }
-    fn create_entry(configuration: ClientConfiguration) -> (ClientId, ClientConfiguration) {
-        (configuration.client_id.clone(), configuration)
+}
+
+impl ClientConfigurationRepository for DieselClientConfigurationRepository {
+    async fn find_by_id(&self, client_id: &ClientId) -> Result<Option<ClientConfiguration>> {
+        let connection = &mut self.pool.get()
+            .await
+            .with_context(|| "Failed to get connection from pool")?;
+
+        let result = dsl::client_configurations
+            .filter(dsl::client_id.eq(client_id))
+            .first::<ClientConfiguration>(connection)
+            .await
+            .optional()
+            .with_context(|| "Error querying client configuration database")?;
+
+        Ok(result)
     }
-    fn lock_store(&self) -> MutexGuard<'_, HashMap<ClientId, ClientConfiguration>> {
-        self.store.lock().unwrap_or_else(|poisoned| poisoned.into_inner())
+    async fn find_by_client_id(&self, client_id: &str) -> Result<Option<ClientConfiguration>> {
+        self.find_by_id(&ClientId(String::from(client_id))).await
     }
 }
 
-impl ClientConfigurationRepository for InMemoryClientConfigurationRepository {
-    fn find_by_id(&self, client_id: &ClientId) -> Option<ClientConfiguration> {
-        self.lock_store().get(client_id).cloned()
+#[cfg(test)]
+pub mod test_support {
+    use super::*;
+    use crate::util::diesel_migrations::run_diesel_migrations;
+    impl DieselClientConfigurationRepository {
+        pub async fn new_in_memory() -> Result<DieselClientConfigurationRepository> {
+            let pool = crate::util::diesel_pool::create_pool(":memory:")?;
+            run_diesel_migrations(&pool).await?;
+            Ok(DieselClientConfigurationRepository::new(pool))
+        }
     }
-    fn find_by_client_id(&self, client_id: &str) -> Option<ClientConfiguration> {
-        self.find_by_id(&ClientId(String::from(client_id)))
+    impl std::fmt::Debug for DieselClientConfigurationRepository {
+        fn fmt(&self, f: &mut std::fmt::Formatter<'_>) -> std::fmt::Result {
+            f.debug_struct("DieselClientConfigurationRepository")
+                .field("pool.manager", &self.pool.manager())
+                .finish()
+        }
     }
 }
+
+#[cfg(test)]
+mod integration_tests {
+    use super::*;
+    use assertables::*;
+
+    #[tokio::test(flavor = "multi_thread")]
+    async fn should_be_able_to_retrieve_configuration_by_id() {
+        let under_test = assert_ok!(DieselClientConfigurationRepository::new_in_memory().await);
+        let client_id = ClientId("aardvark".into());
+        let result = assert_some!(assert_ok!(under_test.find_by_id(&client_id).await));
+        assert_eq!(result.client_id, client_id);
+        assert_eq!(result.client_type, ClientType::Confidential);
+        assert_is_empty!(result.redirect_uris.0);
+        assert_contains!(result.allowed_actions.0, &ClientAction::Introspect);
+        assert_len_eq_x!(result.allowed_actions.0, 1);
+        assert_contains!(result.allowed_scopes.0, &Scope::Basic);
+        assert_contains!(result.allowed_scopes.0, &Scope::Read);
+        assert_contains!(result.allowed_scopes.0, &Scope::Write);
+        assert_len_eq_x!(result.allowed_scopes.0, 3);
+        assert_contains!(result.allowed_grant_types.0, &GrantType::Password);
+        assert_len_eq_x!(result.allowed_grant_types.0, 1);
+    }
+
+    #[tokio::test(flavor = "multi_thread")]
+    async fn should_be_able_to_retrieve_configuration_by_client_id() {
+        let under_test = assert_ok!(DieselClientConfigurationRepository::new_in_memory().await);
+        let client_id = ClientId("badger".into());
+        let result = assert_some!(assert_ok!(under_test.find_by_id(&client_id).await));
+        assert_eq!(result.client_id, client_id);
+        assert_eq!(result.client_type, ClientType::Public);
+        assert_is_empty!(result.redirect_uris.0);
+        assert_is_empty!(result.allowed_actions.0);
+        assert_is_empty!(result.allowed_grant_types.0);
+        assert_contains!(result.allowed_scopes.0, &Scope::Basic);
+        assert_len_eq_x!(result.allowed_scopes.0, 1);
+    }
+}
\ No newline at end of file
diff --git a/src/client/middleware.rs b/src/client/middleware.rs
index 26624fa..c7954db 100644
--- a/src/client/middleware.rs
+++ b/src/client/middleware.rs
@@ -20,7 +20,8 @@ pub async fn require_confidential_client_authentication<C: ClientAuthenticator>(
         None => return Err(StatusCode::UNAUTHORIZED),
         Some(TypedHeader(Authorization(basic))) => {
             authenticator.authenticate_as_confidential_client(basic.username(), basic.password().as_bytes())
-                //.map_err(|_| StatusCode::INTERNAL_SERVER_ERROR)?
+                .await
+                .map_err(|_| StatusCode::INTERNAL_SERVER_ERROR)? // TODO - Add error logging
                 .ok_or(StatusCode::UNAUTHORIZED)?
         },
     };
@@ -51,23 +52,22 @@ pub async fn require_client_authentication<C: ClientAuthenticator>(
         .map(|(_, v)| v.into_owned());
 
     let principal = match (maybe_basic_auth, maybe_client_id) {
-        // Both are present → reject per RFC 6749 §2.3
-        (Some(_), Some(_)) => return Err(StatusCode::UNAUTHORIZED),
-
-        // Neither is present → reject
-        (None, None) => return Err(StatusCode::UNAUTHORIZED),
+        // Both are present → reject per RFC 6749 §2.3; or neither is present → reject
+        (Some(_), Some(_)) | (None, None) => return Err(StatusCode::UNAUTHORIZED),
 
         // Confidential client via Basic auth
         (Some(TypedHeader(Authorization(basic))), None) => {
             authenticator.authenticate_as_confidential_client(basic.username(), basic.password().as_bytes())
-                //.map_err(|_| StatusCode::INTERNAL_SERVER_ERROR)?
+                .await
+                .map_err(|_| StatusCode::INTERNAL_SERVER_ERROR)? // TODO - Add error logging
                 .map(ClientPrincipal::Confidential)
         },
 
         // Public client via body client_id
         (None, Some(client_id)) => {
             authenticator.authenticate_as_public_client(&client_id)
-                //.map_err(|_| StatusCode::INTERNAL_SERVER_ERROR)?
+                .await
+                //.map_err(|_| StatusCode::INTERNAL_SERVER_ERROR)? // TODO - Add error logging
                 .map(ClientPrincipal::Public)
         },
     };
diff --git a/src/client/mod.rs b/src/client/mod.rs
index 9959b40..eb96a9a 100644
--- a/src/client/mod.rs
+++ b/src/client/mod.rs
@@ -6,37 +6,57 @@ pub mod configuration;
 pub mod middleware;
 
 use crate::value_struct;
-use crate::disable_deserialization;
-use crate::enum_with_from_str;
+use crate::{diesel_from_sql_for_enum_strings, diesel_from_sql_for_value_structs, diesel_to_sql_for_value_structs};
+use diesel::sql_types::Text;
+use diesel::{AsExpression, FromSqlRow};
+use serde::{Deserialize, Serialize};
+use strum_macros::{Display, EnumString};
 
 value_struct! {
+    #[derive(Hash, FromSqlRow, AsExpression)]
+    #[diesel(sql_type = diesel::sql_types::Text)]
     pub struct ClientId(String);
 }
 
-disable_deserialization!(ClientId);
+diesel_from_sql_for_value_structs! {
+    #[sql_type(Text)]
+    ClientId(String);
+}
+
+diesel_to_sql_for_value_structs! {
+    #[sql_type(Text)]
+    ClientId(String);
+}
 
-#[derive(Hash, Eq, PartialEq, Clone)]
-#[cfg_attr(test, derive(Debug))]
+#[derive(EnumString, Display, Debug, Hash, Eq, PartialEq, Clone)]
+#[strum(serialize_all = "snake_case")]
+#[derive(FromSqlRow, AsExpression)]
+#[diesel(sql_type = Text)]
 pub enum ClientType {
     Confidential,
     Public,
 }
 
-#[derive(Hash, Eq, PartialEq, Clone)]
-#[cfg_attr(test, derive(Debug))]
+diesel_from_sql_for_enum_strings! {
+    ClientType
+}
+
+#[derive(EnumString, Display, Serialize, Deserialize, Debug, Hash, Eq, PartialEq, Clone)]
+#[strum(serialize_all = "snake_case")]
+#[serde(rename_all = "snake_case")]
 pub enum ClientAction {
     // Authorize,
     Introspect,
     // ProofKeyForCodeExchange,
 }
 
-enum_with_from_str! {
-    #[derive(Debug, Hash, Eq, PartialEq, Clone)]
-    pub enum GrantType {
-        // AuthorizationCode: "authorization_code",
-        Password: "password",
-        // RefreshToken: "refresh_token",
-    }
+#[derive(EnumString, Display, Serialize, Deserialize, Debug, Hash, Eq, PartialEq, Clone)]
+#[strum(serialize_all = "snake_case")]
+#[serde(rename_all = "snake_case")]
+pub enum GrantType {
+    // AuthorizationCode,
+    Password,
+    // RefreshToken
 }
 
 principal! {
@@ -48,10 +68,10 @@ principal! {
 
 #[cfg(test)]
 pub mod test_support {
-    use std::collections::HashSet;
+    use crate::client::configuration::{AllowedActions, AllowedGrantTypes, AllowedScopes, ClientConfiguration, RedirectUris};
     use crate::client::{ClientId, ClientPrincipal, ClientType, ConfidentialClient, GrantType, PublicClient};
-    use crate::client::configuration::ClientConfiguration;
     use crate::scope::Scope;
+    use std::collections::HashSet;
 
     impl ClientPrincipal {
         pub fn new_principal(configuration: ClientConfiguration) -> ClientPrincipal {
@@ -84,10 +104,10 @@ pub mod test_support {
             ClientConfiguration {
                 client_id: ClientId(client_id.into()),
                 client_type,
-                redirect_uris: Default::default(),
-                allowed_scopes: HashSet::from([Scope::Basic, Scope::Read, Scope::Write]),
-                allowed_actions: Default::default(),
-                allowed_grant_types: HashSet::from([GrantType::Password]),
+                redirect_uris: RedirectUris(HashSet::default()),
+                allowed_scopes: AllowedScopes(HashSet::from([Scope::Basic, Scope::Read, Scope::Write])),
+                allowed_actions: AllowedActions(HashSet::default()),
+                allowed_grant_types: AllowedGrantTypes(HashSet::from([GrantType::Password])),
             }
         }
     }
diff --git a/src/client/secret.rs b/src/client/secret.rs
index 5a6ebc4..d567c45 100644
--- a/src/client/secret.rs
+++ b/src/client/secret.rs
@@ -1,74 +1,91 @@
-use std::collections::HashMap;
-use std::sync::{Arc, Mutex, MutexGuard};
-use uuid::Uuid;
+use anyhow::{Context, Result};
+use diesel::prelude::*;
+use diesel_async::RunQueryDsl;
 use crate::client::ClientId;
-use crate::util::value_struct::ValueStruct;
+use crate::schema::client_secrets::dsl;
+use crate::util::diesel_types::AsyncSqlitePool;
+use crate::util::uuid_wrapper::UuidWrapper;
 
-#[derive(Clone)]
+#[derive(Queryable, Selectable)]
+#[cfg_attr(test, derive(Debug))]
+#[diesel(table_name = crate::schema::client_secrets)]
+#[diesel(check_for_backend(diesel::sqlite::Sqlite))]
 pub struct ClientSecret {
-    pub id: Uuid,
+    #[allow(dead_code)]
+    pub id: UuidWrapper,
     pub client_id: ClientId,
-    pub hashed_secret: String,
+    pub hash: String,
 }
 
+#[trait_variant::make(Send)]
 pub trait ClientSecretRepository: Send + Sync + Clone {
-    fn find_by_id(&self, id: &Uuid) -> Option<ClientSecret>;
-    fn find_all_by_client(&self, client_id: &ClientId) -> Vec<ClientSecret>;
-    fn find_all_by_client_id(&self, client_id: &str) -> Vec<ClientSecret>;
+    async fn find_all_by_client_id(&self, client_id: &str) -> Result<Vec<ClientSecret>>;
 }
 
-#[derive(Clone, Default)]
-pub struct InMemoryClientSecretRepository {
-    store: Arc<Mutex<HashMap<Uuid, ClientSecret>>>,
+#[derive(Clone)]
+pub struct DieselClientSecretRepository {
+    pool: AsyncSqlitePool,
 }
 
-impl InMemoryClientSecretRepository {
-    pub fn new() -> Self {
-        Self {
-            store: Arc::new(Mutex::new(HashMap::from([
-                Self::create_hashed_entry("aardvark", b"badger"),
-            ])))
-        }
+impl DieselClientSecretRepository {
+    pub fn new(pool: AsyncSqlitePool) -> DieselClientSecretRepository {
+        DieselClientSecretRepository { pool }
     }
+}
 
-    // TODO - Remove once we've got a means of creating new clients
-    fn create_hashed_entry(client_id: &str, client_secret: &[u8]) -> (Uuid, ClientSecret) {
-
-        // Allowed because this isn't intended to be production used code
-        #![allow(clippy::unwrap_used)]
-
-        use argon2::Argon2;
-        use argon2::password_hash::Salt;
-        use argon2::password_hash::SaltString;
-        use argon2::password_hash::PasswordHasher;
-
-        let argon2 = Argon2::default();
-        let salt = vec![0u8; Salt::RECOMMENDED_LENGTH];
-        let salt_string = SaltString::encode_b64(&salt).unwrap();
-        let hashed = argon2.hash_password(client_secret, &salt_string).unwrap().to_string();
-
-        let client_secret_id = Uuid::new_v4();
+impl ClientSecretRepository for DieselClientSecretRepository {
+    async fn find_all_by_client_id(&self, client_id: &str) -> Result<Vec<ClientSecret>> {
+        let connection = &mut self.pool.get()
+            .await
+            .with_context(|| "Failed to get connection from pool")?;
 
-        (client_secret_id, ClientSecret {
-            id: client_secret_id,
-            client_id: ClientId(String::from(client_id)),
-            hashed_secret: hashed
-        })
+        dsl::client_secrets
+            .filter(dsl::client_id.eq(client_id))
+            .load(connection)
+            .await
+            .with_context(|| "Error querying client secret database")
     }
+}
 
-    fn lock_store(&self) -> MutexGuard<'_, HashMap<Uuid, ClientSecret>> {
-        self.store.lock().unwrap_or_else(|poisoned| poisoned.into_inner())
+#[cfg(test)]
+pub mod test_support {
+    use super::*;
+    use crate::util::diesel_migrations::run_diesel_migrations;
+    impl DieselClientSecretRepository {
+        pub async fn new_in_memory() -> Result<DieselClientSecretRepository> {
+            let pool = crate::util::diesel_pool::create_pool(":memory:")?;
+            run_diesel_migrations(&pool).await?;
+            Ok(DieselClientSecretRepository::new(pool))
+        }
+    }
+    impl std::fmt::Debug for DieselClientSecretRepository {
+        fn fmt(&self, f: &mut std::fmt::Formatter<'_>) -> std::fmt::Result {
+            f.debug_struct("DieselClientSecretRepository")
+                .field("pool.manager", &self.pool.manager())
+                .finish()
+        }
     }
 }
 
-impl ClientSecretRepository for InMemoryClientSecretRepository {
-    fn find_by_id(&self, id: &Uuid) -> Option<ClientSecret> {
-        self.lock_store().get(id).cloned()
-    }
-    fn find_all_by_client(&self, client_id: &ClientId) -> Vec<ClientSecret> {
-        self.lock_store().values().filter(|secret| &secret.client_id == client_id).cloned().collect()
+#[cfg(test)]
+mod integration_tests {
+    use super::*;
+    use assertables::*;
+
+    #[tokio::test(flavor = "multi_thread")]
+    async fn should_be_able_to_retrieve_all_secrets_for_a_client() {
+        let under_test = assert_ok!(DieselClientSecretRepository::new_in_memory().await);
+        let result = assert_ok!(under_test.find_all_by_client_id("aardvark").await);
+        assert_len_eq_x!(&result, 1);
+        assert_eq!(result[0].id, "a9747e2e-34c6-4870-b792-fc7c004baef7".into());
+        assert_eq!(result[0].client_id, ClientId("aardvark".into()));
+        assert_eq!(result[0].hash, "$argon2id$v=19$m=19456,t=2,p=1$AAAAAAAAAAAAAAAAAAAAAA$H95jwDvk045Fb8JUntQP8pIQWj9WA4ETxG4jMUvf7wA");
     }
-    fn find_all_by_client_id(&self, client_id: &str) -> Vec<ClientSecret> {
-        self.lock_store().values().filter(|secret| secret.client_id.value() == client_id).cloned().collect()
+
+    #[tokio::test(flavor = "multi_thread")]
+    async fn should_return_empty_vector_for_a_client_id_with_no_secrets() {
+        let under_test = assert_ok!(DieselClientSecretRepository::new_in_memory().await);
+        let result = assert_ok!(under_test.find_all_by_client_id("badger").await);
+        assert_is_empty!(result);
     }
-}
+}
\ No newline at end of file
diff --git a/src/graceful_shutdown.rs b/src/graceful_shutdown.rs
index 473b28c..7dc05f3 100644
--- a/src/graceful_shutdown.rs
+++ b/src/graceful_shutdown.rs
@@ -1,5 +1,5 @@
 #![allow(
-    // Allowed because we need to panic if we cannot register the signal handler at start up
+    // Allowed because we need to panic if we cannot register the signal handler at startup
     clippy::expect_used,
 )]
 
@@ -35,7 +35,7 @@ pub async fn signal() {
     let terminate = std::future::pending::<()>();
 
     tokio::select! {
-        _ = ctrl_c => {},
-        _ = terminate => {},
+        () = ctrl_c => {},
+        () = terminate => {},
     }
 }
diff --git a/src/main.rs b/src/main.rs
index 7a1a273..62806ca 100644
--- a/src/main.rs
+++ b/src/main.rs
@@ -5,7 +5,9 @@
     clippy::expect_used,
     clippy::panic,
 )]
-
+#![warn(
+    clippy::pedantic,
+)]
 mod scope;
 mod token;
 mod token_exchange;
@@ -13,23 +15,24 @@ mod token_introspection;
 mod graceful_shutdown;
 mod client;
 mod util;
+mod schema;
 
+use crate::util::diesel_migrations::run_diesel_migrations;
+use crate::util::diesel_pool::create_pool;
+use anyhow::{Context, Result};
 use axum::{serve, Router};
-use std::io;
-use tokio::net::TcpListener;
 use client::authentication::ClientAuthenticationService;
-use client::configuration::InMemoryClientConfigurationRepository;
-use client::secret::InMemoryClientSecretRepository;
-use token::AccessToken;
-use token::repository::InMemoryTokenRepository;
+use client::configuration::DieselClientConfigurationRepository;
+use client::secret::DieselClientSecretRepository;
+use token::repository::DieselAccessTokenRepository;
 use token_exchange::TokenExchangeState;
 use token_introspection::TokenIntrospectionState;
+use tokio::net::TcpListener;
 
 // TODO List:
 //  - Token endpoint
 //  - Client authentication
 //  - User authentication
-//  - Access token repository
 //  - Introspection endpoint
 //  - Logging
 //  - Metrics
@@ -41,14 +44,22 @@ use token_introspection::TokenIntrospectionState;
 //  - CORS
 //  - Sessions [authenticate/authenticated]
 //  - Access Log
-//  - Database support
+//  - Error handling, including 500s
 #[tokio::main]
-async fn main() -> io::Result<()> {
+async fn main() -> Result<()> {
+
+    // TODO - Do we bother with services?
+    //        or just continue with passing the repositories directly?
+    //        or do we just pass connection pools and do await with services and repositories?
 
-    // TODO - Do we bother with services, or just continue with passing the repositories directly?
-    let access_token_repository = InMemoryTokenRepository::<AccessToken>::new();
-    let client_secret_repository = InMemoryClientSecretRepository::new();
-    let client_configuration_repository = InMemoryClientConfigurationRepository::new();
+    let pool = create_pool("file:target/db/diesel.sqlite3")?;
+
+    run_diesel_migrations(&pool).await?;
+
+    let access_token_repository = DieselAccessTokenRepository::new(pool.clone());
+
+    let client_secret_repository = DieselClientSecretRepository::new(pool.clone());
+    let client_configuration_repository = DieselClientConfigurationRepository::new(pool.clone());
 
     let client_authenticator = ClientAuthenticationService::new(
         client_secret_repository.clone(),
@@ -67,10 +78,15 @@ async fn main() -> io::Result<()> {
 
     // TODO - Extract into configuration
     let tcp_listener = TcpListener::bind("127.0.0.1:8080") // Change :8080 to :0 for a random port number
-        .await?;
+        .await
+        .with_context(|| "Failed to bind to TCP listener")?;
+
+    let local_address = tcp_listener
+        .local_addr()
+        .with_context(|| "Failed to get local tcp address")?;
 
     println!();
-    println!("Listening on http://{}", tcp_listener.local_addr()?);
+    println!("Listening on http://{local_address}");
     println!();
 
     serve(tcp_listener, application)
diff --git a/src/schema.rs b/src/schema.rs
new file mode 100644
index 0000000..87373bf
--- /dev/null
+++ b/src/schema.rs
@@ -0,0 +1,37 @@
+// @generated automatically by Diesel CLI.
+
+diesel::table! {
+    access_tokens (id) {
+        id -> Binary,
+        username -> Text,
+        client_id -> Text,
+        scopes -> Binary,
+        issued_at -> Timestamp,
+        expires_at -> Timestamp,
+        not_before -> Timestamp,
+    }
+}
+
+diesel::table! {
+    client_configurations (client_id) {
+        client_id -> Text,
+        client_type -> Text,
+        redirect_uris -> Binary,
+        allowed_scopes -> Binary,
+        allowed_actions -> Binary,
+        allowed_grant_types -> Binary,
+    }
+}
+
+diesel::table! {
+    client_secrets (id) {
+        id -> Binary,
+        client_id -> Text,
+        hash -> Text,
+    }
+}
+
+diesel::joinable!(access_tokens -> client_configurations (client_id));
+diesel::joinable!(client_secrets -> client_configurations (client_id));
+
+diesel::allow_tables_to_appear_in_same_query!(access_tokens, client_configurations, client_secrets,);
diff --git a/src/scope/mod.rs b/src/scope/mod.rs
index 8949562..1966950 100644
--- a/src/scope/mod.rs
+++ b/src/scope/mod.rs
@@ -1,29 +1,39 @@
 pub mod parser;
 
+use crate::{diesel_from_sql_for_json_fields, diesel_to_sql_for_json_fields, disable_deserialization};
+use diesel::{AsExpression, FromSqlRow};
+use serde::{Deserialize, Serialize, Serializer};
 use std::collections::HashSet;
-use serde::{Serialize, Serializer};
-use crate::disable_deserialization;
-use crate::enum_with_from_str;
+use strum_macros::Display;
+use strum_macros::EnumIter;
+use strum_macros::EnumString;
 
-enum_with_from_str! {
-    #[derive(Hash, Eq, PartialEq, Clone)]
-    #[cfg_attr(test, derive(Debug))]
-    pub enum Scope {
-        Basic: "basic",
-        Read: "read",
-        Write: "write",
-    }
+#[derive(EnumString, EnumIter, Display, Serialize, Deserialize, Debug, Hash, Eq, PartialEq, Clone)]
+#[strum(serialize_all = "snake_case")]
+#[serde(rename_all = "snake_case")]
+pub enum Scope {
+    Basic,
+    Read,
+    Write,
 }
 
-#[derive(Eq, PartialEq)]
-#[cfg_attr(test, derive(Debug))]
+#[derive(FromSqlRow, AsExpression, Default, Debug, Eq, PartialEq, Clone)]
+#[diesel(sql_type = diesel::sql_types::Binary)]
 pub struct Scopes(pub HashSet<Scope>);
 
+diesel_from_sql_for_json_fields! {
+    Scopes(HashSet<Scope>);
+}
+
+diesel_to_sql_for_json_fields! {
+    Scopes(HashSet<Scope>);
+}
+
 impl Serialize for Scopes {
     // Serialize scopes as a space delimited list
     fn serialize<S: Serializer>(&self, serializer: S) -> Result<S::Ok, S::Error> {
         self.0.iter()
-            .map(|scope| scope.to_string())
+            .map(ToString::to_string)
             .collect::<Vec<String>>()
             .join(" ")
             .serialize(serializer)
@@ -31,5 +41,4 @@ impl Serialize for Scopes {
 }
 
 // To enable us to trust Scope is valid, we don't allow direct deserialization of Scope.
-disable_deserialization!(Scope);
 disable_deserialization!(Scopes);
diff --git a/src/scope/parser.rs b/src/scope/parser.rs
index 4afca10..397bb4b 100644
--- a/src/scope/parser.rs
+++ b/src/scope/parser.rs
@@ -11,8 +11,8 @@ pub fn parse_scopes(maybe_space_delimited_scopes: Option<&String>) -> Result<Opt
             }
 
             let raw_scopes = space_delimited_scopes
-                .split(" ")
-                .map(|s| s.trim())
+                .split(' ')
+                .map(str::trim)
                 .filter(|s| !s.is_empty())
                 .map(String::from)
                 .collect::<Vec<String>>();
diff --git a/src/token/mod.rs b/src/token/mod.rs
index 84ae2ff..cf9412d 100644
--- a/src/token/mod.rs
+++ b/src/token/mod.rs
@@ -1,27 +1,53 @@
 pub mod repository;
 
+use crate::client::ClientId;
+use crate::scope::Scopes;
+use crate::util::uuid_wrapper::UuidWrapper;
+use chrono::NaiveDateTime;
+use diesel::prelude::*;
 use serde::Serialize;
-use uuid::Uuid;
+use strum_macros::{Display, EnumString};
 
-pub trait Token {
-    fn id(&self) -> Uuid;
-}
-
-#[cfg_attr(test, derive(Debug))]
-#[derive(Serialize, Eq, PartialEq)]
+#[derive(Serialize, EnumString, Display, Debug, Eq, PartialEq)]
+#[strum(serialize_all = "snake_case")]
 #[serde(rename_all = "snake_case")]
 pub enum TokenType {
     // https://www.rfc-editor.org/rfc/rfc6750
     Bearer,
 }
 
-#[derive(Serialize, Clone)]
+#[derive(Serialize, Clone, Eq, PartialEq)]
+#[cfg_attr(test, derive(Debug))]
+#[derive(Queryable, Selectable, Insertable)]
+#[diesel(table_name = crate::schema::access_tokens)]
+#[diesel(check_for_backend(diesel::sqlite::Sqlite))]
 pub struct AccessToken {
-    pub id: Uuid
+    pub id: UuidWrapper,
+    pub username: String,                   // TODO - Use AuthenticatedUser
+    pub client_id: ClientId,
+    pub scopes: Scopes,
+    pub issued_at: NaiveDateTime,
+    pub expires_at: NaiveDateTime,
+    pub not_before: NaiveDateTime,
 }
 
-impl Token for AccessToken {
-    fn id(&self) -> Uuid {
-        self.id
+#[cfg(test)]
+pub mod test_support {
+    use super::*;
+    use crate::scope::Scope;
+    use chrono::Utc;
+    use std::collections::HashSet;
+    impl AccessToken {
+        pub fn new() -> AccessToken {
+            AccessToken {
+                id: UuidWrapper::random(),
+                username: "aardvark".to_string(),
+                client_id: "badger".to_string().into(),
+                scopes: Scopes(HashSet::from([Scope::Basic])),
+                issued_at: Utc::now().naive_utc(),
+                expires_at: Utc::now().naive_utc(),
+                not_before: Utc::now().naive_utc(),
+            }
+        }
     }
-}
+}
\ No newline at end of file
diff --git a/src/token/repository.rs b/src/token/repository.rs
index 0fd3e40..9c071f9 100644
--- a/src/token/repository.rs
+++ b/src/token/repository.rs
@@ -1,34 +1,150 @@
-use crate::token::Token;
-use std::collections::HashMap;
-use std::sync::{Arc, Mutex, MutexGuard};
-use uuid::Uuid;
-
-pub trait TokenRepository<T: Token + Clone + Send>: Send + Sync + Clone {
-    fn get_token(&self, id: Uuid) -> Option<T>;
-    fn save_token(&self, token: &T);
+use crate::schema::access_tokens::dsl::access_tokens;
+use crate::schema::access_tokens::dsl::id;
+use crate::token::AccessToken;
+use crate::util::diesel_types::AsyncSqlitePool;
+use crate::util::uuid_wrapper::UuidWrapper;
+use anyhow::{Context, Result};
+use diesel::prelude::*;
+use diesel_async::{AsyncConnection, RunQueryDsl};
+
+#[trait_variant::make(Send)]
+pub trait TokenRepository<T>: Sync + Clone {
+    async fn get_token(&self, id: UuidWrapper) -> Result<Option<T>>;
+    async fn save_token(&self, token: &T) -> Result<()>;
+    #[allow(dead_code)] // TODO - Remove after we implement token revocation.
+    async fn delete_token(&self, id: UuidWrapper) -> Result<()>;
+}
+
+#[derive(Clone)]
+pub struct DieselAccessTokenRepository {
+    pool: AsyncSqlitePool,
+}
+
+impl DieselAccessTokenRepository {
+    pub fn new(pool: AsyncSqlitePool) -> DieselAccessTokenRepository {
+        Self { pool }
+    }
 }
 
-#[derive(Clone, Default)]
-pub struct InMemoryTokenRepository<T: Token> {
-    store: Arc<Mutex<HashMap<Uuid, T>>>,
+impl TokenRepository<AccessToken> for DieselAccessTokenRepository {
+
+    async fn get_token(&self, token: UuidWrapper) -> Result<Option<AccessToken>> {
+        let connection = &mut self.pool.get()
+            .await
+            .with_context(|| "Failed to get connection from pool")?;
+
+        let result = access_tokens
+            .filter(id.eq(token))
+            .first::<AccessToken>(connection)
+            .await
+            .optional()
+            .with_context(|| "Error querying access token database")?;
+
+        Ok(result)
+    }
+
+    async fn save_token(&self, token: &AccessToken) -> Result<()> {
+        let connection = &mut self.pool.get()
+            .await
+            .with_context(|| "Failed to get connection from pool")?;
+
+        diesel::insert_into(access_tokens)
+            .values(token)
+            .execute(connection)
+            .await
+            .with_context(|| "Error saving access token to database")?;
+
+        Ok(())
+    }
+
+    async fn delete_token(&self, token: UuidWrapper) -> Result<()> {
+        let connection = &mut self.pool.get()
+            .await
+            .with_context(|| "Failed to get connection from pool")?;
+
+        connection.transaction(async |connection| {
+            diesel::delete(access_tokens)
+                .filter(id.eq(token))
+                .execute(connection)
+                .await
+                .and_then(|deleted_rows| {
+                    if deleted_rows == 1 || deleted_rows == 0 {
+                        Ok(())
+                    } else {
+                        Err(diesel::result::Error::RollbackTransaction)
+                    }
+                })
+        })
+            .await
+            .with_context(|| "Error deleting access token from database")
+    }
 }
 
-impl<T: Token> InMemoryTokenRepository<T> {
-    pub fn new() -> Self {
-        Self { store: Arc::new(Mutex::new(HashMap::new())) }
+#[cfg(test)]
+pub mod test_support {
+    use super::*;
+    use crate::util::diesel_migrations::run_diesel_migrations;
+    impl DieselAccessTokenRepository {
+        pub async fn new_in_memory() -> Result<DieselAccessTokenRepository> {
+            let pool = crate::util::diesel_pool::create_pool(":memory:")?;
+            run_diesel_migrations(&pool).await?;
+            Ok(DieselAccessTokenRepository::new(pool))
+        }
     }
-    fn lock_store(&self) -> MutexGuard<'_, HashMap<Uuid, T>> {
-        self.store.lock().unwrap_or_else(|poisoned| poisoned.into_inner())
+    impl std::fmt::Debug for DieselAccessTokenRepository {
+        fn fmt(&self, f: &mut std::fmt::Formatter<'_>) -> std::fmt::Result {
+            f.debug_struct("DieselSqliteAccessTokenRepository")
+                .field("pool.manager", &self.pool.manager())
+                .finish()
+        }
     }
 }
 
-impl<T: Token + Clone + Send> TokenRepository<T> for InMemoryTokenRepository<T>
-{
-    fn get_token(&self, id: Uuid) -> Option<T> {
-        self.lock_store().get(&id).cloned()
+#[cfg(test)]
+mod integration_tests {
+    use super::*;
+    use crate::scope::{Scope, Scopes};
+    use assertables::*;
+    use std::collections::HashSet;
+    use strum::IntoEnumIterator;
+
+    #[tokio::test(flavor = "multi_thread")]
+    async fn should_be_able_to_save_and_retrieve_a_token() {
+        let under_test = assert_ok!(DieselAccessTokenRepository::new_in_memory().await);
+        let token = AccessToken::new();
+        assert_ok!(under_test.save_token(&token).await);
+        assert_eq!(assert_some!(assert_ok!(under_test.get_token(token.id).await)), token);
+    }
+
+    #[tokio::test(flavor = "multi_thread")]
+    async fn should_be_able_to_delete_a_token() {
+        let under_test = assert_ok!(DieselAccessTokenRepository::new_in_memory().await);
+        let token = AccessToken::new();
+        assert_ok!(under_test.save_token(&token).await);
+        assert_ok!(under_test.delete_token(token.id).await);
+        assert_none!(assert_ok!(under_test.get_token(token.id).await));
+    }
+
+    #[tokio::test(flavor = "multi_thread")]
+    async fn should_be_able_to_delete_a_token_when_non_existent() {
+        let under_test = assert_ok!(DieselAccessTokenRepository::new_in_memory().await);
+        assert_ok!(under_test.delete_token(UuidWrapper::random()).await);
+    }
+
+    #[tokio::test(flavor = "multi_thread")]
+    async fn should_be_able_to_clone_but_share_storage() {
+        let first = assert_ok!(DieselAccessTokenRepository::new_in_memory().await);
+        let second = first.clone();
+        let token = AccessToken::new();
+        assert_ok!(first.save_token(&token).await);
+        assert_eq!(assert_some!(assert_ok!(second.get_token(token.id).await)), token);
     }
 
-    fn save_token(&self, token: &T) {
-        self.lock_store().insert(token.id(), token.clone());
+    #[tokio::test(flavor = "multi_thread")]
+    async fn should_be_able_to_save_a_token_with_all_scopes_assigned() {
+        let under_test = assert_ok!(DieselAccessTokenRepository::new_in_memory().await);
+        let mut token = AccessToken::new();
+        token.scopes = Scopes(Scope::iter().collect::<HashSet<_>>());
+        assert_ok!(under_test.save_token(&token).await);
     }
 }
diff --git a/src/token_exchange/grant/authorization_code.rs b/src/token_exchange/grant/authorization_code.rs
index 416f0d9..ea94830 100644
--- a/src/token_exchange/grant/authorization_code.rs
+++ b/src/token_exchange/grant/authorization_code.rs
@@ -1,9 +1,9 @@
-use serde::Deserialize;
-
-#[derive(Deserialize, Eq, PartialEq)]
-#[cfg_attr(test, derive(Debug))]
-pub struct AuthorizationCodeGrantRequest {
-    pub code: String,
-    pub redirect_uri: String,
-    pub code_verifier: Option<String>,
-}
+// use serde::Deserialize;
+//
+// #[derive(Deserialize, Eq, PartialEq)]
+// #[cfg_attr(test, derive(Debug))]
+// pub struct AuthorizationCodeGrantRequest {
+//     pub code: String,
+//     pub redirect_uri: String,
+//     pub code_verifier: Option<String>,
+// }
diff --git a/src/token_exchange/grant/password.rs b/src/token_exchange/grant/password.rs
index eb558b5..af61867 100644
--- a/src/token_exchange/grant/password.rs
+++ b/src/token_exchange/grant/password.rs
@@ -1,15 +1,18 @@
-use std::collections::HashMap;
-use serde::Deserialize;
-use ClientPrincipal::Confidential;
-use GrantType::Password;
 use crate::client::authentication::ClientAuthenticator;
 use crate::client::{ClientPrincipal, ConfidentialClient, GrantType};
-use crate::token::{AccessToken, TokenType};
+use crate::scope::parser::parse_scopes;
+use crate::scope::Scopes;
 use crate::token::repository::TokenRepository;
+use crate::token::{AccessToken, TokenType};
 use crate::token_exchange::response::{ErrorType, TokenExchangeResponse};
 use crate::token_exchange::route::TokenExchangeState;
-use crate::scope::Scopes;
-use crate::scope::parser::parse_scopes;
+use crate::util::uuid_wrapper::UuidWrapper;
+use anyhow::Result;
+use chrono::{Duration, Utc};
+use serde::Deserialize;
+use std::collections::HashMap;
+use ClientPrincipal::Confidential;
+use GrantType::Password;
 
 #[derive(Deserialize, Eq, PartialEq)]
 #[cfg_attr(test, derive(Debug))]
@@ -23,36 +26,46 @@ pub struct PasswordGrantRequest {
 pub async fn handle_password_grant<A, C>(
     state: TokenExchangeState<A, C>,
     request: PasswordGrantRequest
-) -> TokenExchangeResponse
+) -> Result<TokenExchangeResponse>
 where
     A: TokenRepository<AccessToken>,
     C: ClientAuthenticator,
 {
 
     // TODO - Implement it...
+    
+    let issued_at = Utc::now();
 
     let access_token = AccessToken {
-        id: uuid::Uuid::new_v4(),
+        id: UuidWrapper::random(),
+        username: request.username,
+        client_id: request.principal.id().clone(),
+        scopes: request.scopes.unwrap_or_default(),
+        issued_at: issued_at.naive_utc(),
+        expires_at: (issued_at + Duration::hours(2)).naive_utc(),
+        not_before: (issued_at - Duration::minutes(1)).naive_utc(),
     };
 
-    state.access_token_repository.save_token(&access_token);
+    state.access_token_repository.save_token(&access_token).await?;
 
-    TokenExchangeResponse::Success {
-        access_token: access_token.id,
-        token_type: TokenType::Bearer,
-        expires_in: 7200,
-        refresh_token: Some(uuid::Uuid::new_v4()),
-        scope: request.scopes,
-        state: None,
-    }
+    Ok(
+        TokenExchangeResponse::Success {
+            access_token: access_token.id,
+            token_type: TokenType::Bearer,
+            expires_in: 7200,
+            refresh_token: Some(UuidWrapper::random()),
+            scope: Some(access_token.scopes),
+            state: None,
+        }
+    )
 }
 
-pub fn validate_password_grant(principal: ClientPrincipal, request: HashMap<String, String>) -> Result<PasswordGrantRequest, TokenExchangeResponse> {
+pub fn validate_password_grant(principal: ClientPrincipal, request: &HashMap<String, String>) -> Result<PasswordGrantRequest, TokenExchangeResponse> {
     let client = match principal {
         Confidential(client) if client.can_perform_grant_type(&Password) => client,
         _ => Err(TokenExchangeResponse::Failure {
             error: ErrorType::UnauthorizedClient,
-            error_description: Some(format!("not authorized to: {:?}", Password)),
+            error_description: Some(format!("not authorized to: {Password:?}")),
         })?,
     };
 
@@ -95,22 +108,23 @@ mod unit_tests {
     // See: https://github.com/beercanx/oauth-api/blob/main/api/token/src/test/kotlin/uk/co/baconi/oauth/api/token/PasswordValidationTest.kt
 
     use super::*;
-    use assertables::*;
-    use std::collections::HashSet;
-    use crate::client::ClientType;
     use crate::client::configuration::ClientConfiguration;
+    use crate::client::ClientType;
+    use crate::map_of;
     use crate::scope::Scope;
     use crate::token_exchange::response::ErrorType;
-    use crate::map_of;
+    use assertables::*;
+    use std::collections::HashSet;
 
     mod client {
         use super::*;
+        use crate::client::configuration::{AllowedActions, AllowedGrantTypes, AllowedScopes, RedirectUris};
 
         #[test]
         fn should_return_invalid_request_for_a_public_client() {
             let result = validate_password_grant(
                 ClientPrincipal::new_public_principal("aardvark"),
-                map_of! {
+                &map_of! {
                     "username" => "aardvark",
                     "password" => "<REDACTED>",
                     "scope" => "read write",
@@ -131,12 +145,12 @@ mod unit_tests {
                 ClientPrincipal::new_principal(ClientConfiguration {
                     client_id: String::from("unauthorised").into(),
                     client_type: ClientType::Confidential,
-                    redirect_uris: Default::default(),
-                    allowed_scopes: Default::default(),
-                    allowed_actions: Default::default(),
-                    allowed_grant_types: Default::default(),
+                    redirect_uris: RedirectUris(HashSet::default()),
+                    allowed_scopes: AllowedScopes(HashSet::default()),
+                    allowed_actions: AllowedActions(HashSet::default()),
+                    allowed_grant_types: AllowedGrantTypes(HashSet::default()),
                 }),
-                map_of! {
+                &map_of! {
                     "username" => "aardvark",
                     "password" => "<REDACTED>",
                     "scope" => "read write",
@@ -155,7 +169,7 @@ mod unit_tests {
         fn should_return_invalid_request_on_missing_username() {
             let result = validate_password_grant(
                 ClientPrincipal::new_confidential_principal("aardvark"),
-                map_of! {
+                &map_of! {
                     "password" => "<REDACTED>",
                     "scope" => "read write",
                 },
@@ -177,7 +191,7 @@ mod unit_tests {
         fn should_return_invalid_request_on_blank_username() {
             let result = validate_password_grant(
                 ClientPrincipal::new_confidential_principal("aardvark"),
-                map_of! {
+                &map_of! {
                     "username" => " ",
                     "password" => "<REDACTED>",
                     "scope" => "read write",
@@ -196,7 +210,7 @@ mod unit_tests {
         fn should_return_invalid_request_on_missing_password() {
             let result = validate_password_grant(
                 ClientPrincipal::new_confidential_principal("aardvark"),
-                map_of! {
+                &map_of! {
                     "username" => "aardvark",
                     "scope" => "read write",
                 },
@@ -213,12 +227,13 @@ mod unit_tests {
 
     mod scope {
         use super::*;
+        use crate::client::configuration::{AllowedActions, AllowedGrantTypes, AllowedScopes, RedirectUris};
 
         #[test]
         fn should_return_invalid_request_on_blank_scope() {
             let result = validate_password_grant(
                 ClientPrincipal::new_confidential_principal("aardvark"),
-                map_of! {
+                &map_of! {
                     "username" => "aardvark",
                     "password" => "<REDACTED>",
                     "scope" => " ",
@@ -239,12 +254,12 @@ mod unit_tests {
                 ClientPrincipal::new_principal(ClientConfiguration {
                     client_id: String::from("aardvark").into(),
                     client_type: ClientType::Confidential,
-                    redirect_uris: Default::default(),
-                    allowed_scopes: Default::default(),
-                    allowed_actions: Default::default(),
-                    allowed_grant_types: HashSet::from([Password]),
+                    redirect_uris: RedirectUris(HashSet::default()),
+                    allowed_scopes: AllowedScopes(HashSet::default()),
+                    allowed_actions: AllowedActions(HashSet::default()),
+                    allowed_grant_types: AllowedGrantTypes(HashSet::from([Password])),
                 }),
-                map_of! {
+                &map_of! {
                     "username" => "aardvark",
                     "password" => "<REDACTED>",
                     "scope" => "invalid",
@@ -263,7 +278,7 @@ mod unit_tests {
         fn should_return_invalid_request_with_an_invalid_scope_and_a_valid_scope() {
             let result = validate_password_grant(
                 ClientPrincipal::new_confidential_principal("aardvark"),
-                map_of! { "username" => "aardvark",
+                &map_of! { "username" => "aardvark",
                     "password" => "<REDACTED>",
                     "scope" => "basic cicada",
                 },
@@ -281,7 +296,7 @@ mod unit_tests {
         fn should_return_invalid_request_with_an_duplicated_valid_scopes() {
             let result = validate_password_grant(
                 ClientPrincipal::new_confidential_principal("aardvark"),
-                map_of! {
+                &map_of! {
                     "username" => "aardvark",
                     "password" => "<REDACTED>",
                     "scope" => "basic basic",
@@ -302,12 +317,12 @@ mod unit_tests {
                 ClientPrincipal::new_principal(ClientConfiguration {
                     client_id: String::from("aardvark").into(),
                     client_type: ClientType::Confidential,
-                    redirect_uris: Default::default(),
-                    allowed_scopes: HashSet::from([Scope::Read]),
-                    allowed_actions: Default::default(),
-                    allowed_grant_types: HashSet::from([Password]),
+                    redirect_uris: RedirectUris(HashSet::default()),
+                    allowed_scopes: AllowedScopes(HashSet::from([Scope::Read])),
+                    allowed_actions: AllowedActions(HashSet::default()),
+                    allowed_grant_types: AllowedGrantTypes(HashSet::from([Password])),
                 }),
-                map_of! {
+                &map_of! {
                     "username" => "aardvark",
                     "password" => "<REDACTED>",
                     "scope" => "write",
@@ -330,7 +345,7 @@ mod unit_tests {
         fn should_return_valid_request_if_only_scope_is_not_provided() {
             let result = validate_password_grant(
                 ClientPrincipal::new_confidential_principal("aardvark"),
-                map_of! {
+                &map_of! {
                     "username" => "aardvark",
                     "password" => "<REDACTED>",
                 },
@@ -350,7 +365,7 @@ mod unit_tests {
         fn should_return_valid_request_if_only_one_scope_is_provided() {
             let result = validate_password_grant(
                 ClientPrincipal::new_confidential_principal("aardvark"),
-                map_of! {
+                &map_of! {
                     "username" => "aardvark",
                     "password" => "<REDACTED>",
                     "scope" => "basic",
@@ -371,7 +386,7 @@ mod unit_tests {
         fn should_return_valid_request_if_multiple_scopes_are_provided() {
             let result = validate_password_grant(
                 ClientPrincipal::new_confidential_principal("aardvark"),
-                map_of! {
+                &map_of! {
                     "username" => "aardvark",
                     "password" => "<REDACTED>",
                     "scope" => "basic read write",
diff --git a/src/token_exchange/request.rs b/src/token_exchange/request.rs
index ba07f4a..0a8ece2 100644
--- a/src/token_exchange/request.rs
+++ b/src/token_exchange/request.rs
@@ -1,14 +1,14 @@
-use std::collections::HashMap;
-use axum::extract::{FromRequest, Request};
-use axum::extract::rejection::FormRejection;
-use axum::{Form, Json};
-use axum::http::StatusCode;
-use axum::response::{IntoResponse, Response};
-use serde::Deserialize;
 use crate::client::{ClientPrincipal, GrantType};
 use crate::token_exchange::grant::password::{validate_password_grant, PasswordGrantRequest};
 use crate::token_exchange::request::TokenExchangeRequest::Password;
 use crate::token_exchange::response::{ErrorType, TokenExchangeResponse};
+use axum::extract::rejection::FormRejection;
+use axum::extract::{FromRequest, Request};
+use axum::http::StatusCode;
+use axum::response::{IntoResponse, Response};
+use axum::{Form, Json};
+use serde::Deserialize;
+use std::collections::HashMap;
 
 #[derive(Deserialize, Eq, PartialEq)]
 #[cfg_attr(test, derive(Debug))]
@@ -40,8 +40,8 @@ where
             }))?;
 
         match Form::<HashMap<String, String>>::from_request(req, state).await {
-            Err(rejection) => Err(handle_form_rejection(rejection)),
-            Ok(Form(request)) => match validate_grant_type(principal, request) {
+            Err(rejection) => Err(handle_form_rejection(&rejection)),
+            Ok(Form(request)) => match validate_grant_type(principal, &request) {
                 Err(failure) => Err(handle_validation_failure(failure)),
                 Ok(valid) => Ok(valid),
             }
@@ -49,28 +49,26 @@ where
     }
 }
 
-pub fn validate_grant_type(principal: ClientPrincipal, request: HashMap<String, String>) -> Result<TokenExchangeForm, TokenExchangeResponse> {
-    match request.get("grant_type").map(|s| s.parse::<GrantType>()) {
-
+pub fn validate_grant_type(principal: ClientPrincipal, request: &HashMap<String, String>) -> Result<TokenExchangeForm, TokenExchangeResponse> {
+    match request.get("grant_type") {
         None => Err(TokenExchangeResponse::missing_parameter("grant_type")),
-
-        Some(Err(error_message)) => Err(
-            TokenExchangeResponse::Failure {
-                error: ErrorType::UnsupportedGrantType,
-                error_description: Some(error_message),
-            }
-        ),
-
-        Some(Ok(grant_type)) if !principal.can_perform_grant_type(&grant_type) => Err(
-            TokenExchangeResponse::Failure {
-                error: ErrorType::UnauthorizedClient,
-                error_description: Some(format!("not authorized to: {:?}", grant_type)),
-            }
-        ),
-
-        Some(Ok(GrantType::Password)) => Ok(TokenExchangeForm(
-            Password(validate_password_grant(principal, request)?)
-        )),
+        Some(raw_grant_type) => match raw_grant_type.parse::<GrantType>() {
+            Err(_) => Err(
+                TokenExchangeResponse::Failure {
+                    error: ErrorType::UnsupportedGrantType,
+                    error_description: Some(format!("unsupported: {raw_grant_type}")),
+                }
+            ),
+            Ok(grant_type) if !principal.can_perform_grant_type(&grant_type) => Err(
+                TokenExchangeResponse::Failure {
+                    error: ErrorType::UnauthorizedClient,
+                    error_description: Some(format!("not authorized to: {grant_type:?}")),
+                }
+            ),
+            Ok(GrantType::Password) => Ok(TokenExchangeForm(
+                Password(validate_password_grant(principal, request)?)
+            )),
+        }
     }
 }
 
@@ -78,7 +76,7 @@ fn handle_validation_failure(failure: TokenExchangeResponse) -> Response {
     (StatusCode::BAD_REQUEST, Json(failure)).into_response()
 }
 
-fn handle_form_rejection(rejection: FormRejection) -> Response {
+fn handle_form_rejection(rejection: &FormRejection) -> Response {
     (rejection.status(), Json(TokenExchangeResponse::Failure {
         error: ErrorType::InvalidRequest,
         error_description: Some(rejection.body_text()),
@@ -91,10 +89,11 @@ mod unit_tests {
     // See: https://github.com/beercanx/oauth-api/blob/main/api/token/src/test/kotlin/uk/co/baconi/oauth/api/token/TokenRequestValidationTest.kt
 
     use super::*;
-    use assertables::*;
+    use crate::client::configuration::{AllowedActions, AllowedGrantTypes, AllowedScopes, ClientConfiguration, RedirectUris};
     use crate::client::ClientType;
-    use crate::client::configuration::ClientConfiguration;
     use crate::token_exchange::request::validate_grant_type;
+    use assertables::*;
+    use std::collections::HashSet;
 
     macro_rules! input_parameters {
         ($($k:expr => $v:expr),* $(,)?) => {{
@@ -123,14 +122,14 @@ mod unit_tests {
     validate_err! {
         should_return_invalid_request_on_missing_grant_type,
         ClientPrincipal::new_confidential_principal("aardvark"),
-        input_parameters! {},
+        &input_parameters! {},
         TokenExchangeResponse::missing_parameter("grant_type")
     }
 
     validate_err! {
         should_return_invalid_request_on_blank_grant_type,
         ClientPrincipal::new_confidential_principal("aardvark"),
-        input_parameters! { "grant_type" => " " },
+        &input_parameters! { "grant_type" => " " },
         TokenExchangeResponse::Failure {
             error: ErrorType::UnsupportedGrantType,
             error_description: Some("unsupported:  ".into())
@@ -140,7 +139,7 @@ mod unit_tests {
     validate_err! {
         should_return_invalid_request_on_unsupported_grant_type,
         ClientPrincipal::new_confidential_principal("aardvark"),
-        input_parameters! { "grant_type" => "aardvark" },
+        &input_parameters! { "grant_type" => "aardvark" },
         TokenExchangeResponse::Failure {
             error: ErrorType::UnsupportedGrantType,
             error_description: Some("unsupported: aardvark".into())
@@ -152,12 +151,12 @@ mod unit_tests {
         ClientPrincipal::new_principal(ClientConfiguration {
             client_id: String::from("invalid").into(),
             client_type: ClientType::Confidential,
-            redirect_uris: Default::default(),
-            allowed_scopes: Default::default(),
-            allowed_actions: Default::default(),
-            allowed_grant_types: Default::default(),
+            redirect_uris: RedirectUris(HashSet::default()),
+            allowed_scopes: AllowedScopes(HashSet::default()),
+            allowed_actions: AllowedActions(HashSet::default()),
+            allowed_grant_types: AllowedGrantTypes(HashSet::default()),
         }),
-        input_parameters! { "grant_type" => "password" },
+        &input_parameters! { "grant_type" => "password" },
         TokenExchangeResponse::Failure {
             error: ErrorType::UnauthorizedClient,
             error_description: Some("not authorized to: Password".into())
@@ -167,11 +166,11 @@ mod unit_tests {
     validate_ok! {
         should_return_valid_request_for_password_grant_type,
         ClientPrincipal::new_confidential_principal("aardvark"),
-        input_parameters! { "grant_type" => "password", "username" => "aardvark", "password" => "" },
+        &input_parameters! { "grant_type" => "password", "username" => "aardvark", "password" => "" },
         TokenExchangeForm(Password(PasswordGrantRequest {
             principal: ClientPrincipal::new_confidential_client("aardvark"),
             username: "aardvark".into(),
-            password: "".into(),
+            password: String::new(),
             scopes: None,
         }))
     }
diff --git a/src/token_exchange/response.rs b/src/token_exchange/response.rs
index ca0e53b..84d80e5 100644
--- a/src/token_exchange/response.rs
+++ b/src/token_exchange/response.rs
@@ -1,6 +1,7 @@
-use serde::Serialize;
 use crate::scope::Scopes;
 use crate::token::TokenType;
+use crate::util::uuid_wrapper::UuidWrapper;
+use serde::Serialize;
 
 #[cfg_attr(test, derive(Debug))]
 #[derive(Serialize, Eq, PartialEq)]
@@ -10,7 +11,7 @@ pub enum TokenExchangeResponse {
     Success {
 
         // The access token issued by the authorization server.
-        access_token: uuid::Uuid,
+        access_token: UuidWrapper,
 
         // The type of the token issued as described in
         // https://www.rfc-editor.org/rfc/rfc6749#section-7.1
@@ -26,7 +27,7 @@ pub enum TokenExchangeResponse {
         // access tokens using the same authorization grant as described in
         // https://www.rfc-editor.org/rfc/rfc6749#section-6
         #[serde(skip_serializing_if = "Option::is_none")]
-        refresh_token: Option<uuid::Uuid>,
+        refresh_token: Option<UuidWrapper>,
 
         // OPTIONAL if identical to the scope requested by the client; otherwise,
         // REQUIRED. The scope of the access token as described by
@@ -68,8 +69,7 @@ impl TokenExchangeResponse {
     }
 }
 
-#[cfg_attr(test, derive(Debug))]
-#[derive(Serialize, Eq, PartialEq)]
+#[derive(Serialize, Debug, Eq, PartialEq)]
 #[serde(rename_all = "snake_case")]
 pub enum ErrorType {
 
@@ -87,13 +87,13 @@ pub enum ErrorType {
     // authorization server MUST respond with an HTTP 401 (Unauthorized) status code
     // and include the "WWW-Authenticate" response header field matching the
     // authentication scheme used by the client.
-    InvalidClient,
+    // TODO - InvalidClient,
 
     // The provided authorization grant (e.g., authorization code,
     // resource owner credentials) or refresh token is invalid, expired, revoked,
     // does not match the redirection URI used in the authorization request, or was
     // issued to another client.
-    InvalidGrant,
+    // TODO - InvalidGrant,
 
     // The requested scope is invalid, unknown, malformed, or exceeds
     // the scope granted by the resource owner.
diff --git a/src/token_exchange/route.rs b/src/token_exchange/route.rs
index f8661e7..35b7d57 100644
--- a/src/token_exchange/route.rs
+++ b/src/token_exchange/route.rs
@@ -1,3 +1,4 @@
+use anyhow::Result;
 use axum::extract::State;
 use axum::http::StatusCode;
 use axum::{middleware, Router};
@@ -33,11 +34,14 @@ pub struct TokenExchangeState<A: TokenRepository<AccessToken>, C: ClientAuthenti
 async fn token_exchange_handler<A: TokenRepository<AccessToken>, C: ClientAuthenticator>(
     State(state): State<TokenExchangeState<A, C>>,
     TokenExchangeForm(request): TokenExchangeForm,
-) -> (StatusCode, Json<TokenExchangeResponse>) {
+) -> Result<(StatusCode, Json<TokenExchangeResponse>), StatusCode> {
 
     let result = match request {
         TokenExchangeRequest::Password(password_grant_request) => {
-            handle_password_grant(state, password_grant_request).await
+            match handle_password_grant(state, password_grant_request).await { 
+                Ok(response) => response,
+                Err(_) => Err(StatusCode::INTERNAL_SERVER_ERROR)?,  // TODO - Add error logging
+            }
         },
     };
 
@@ -46,7 +50,7 @@ async fn token_exchange_handler<A: TokenRepository<AccessToken>, C: ClientAuthen
         TokenExchangeResponse::Success { .. } => StatusCode::OK,
     };
 
-    (status, Json(result))
+    Ok((status, Json(result)))
 }
 
 #[cfg(test)]
@@ -63,6 +67,10 @@ mod integration_tests {
     use base64::prelude::*;
     use serde_json::Value;
     use tower::ServiceExt;
+    use crate::client::authentication::ClientAuthenticationService;
+    use crate::client::configuration::DieselClientConfigurationRepository;
+    use crate::client::secret::DieselClientSecretRepository;
+    use crate::token::repository::DieselAccessTokenRepository;
 
     // See: https://github.com/beercanx/oauth-api/blob/main/api/token/src/test/kotlin/uk/co/baconi/oauth/api/token/TokenRouteIntegrationTests.kt
 
@@ -71,16 +79,14 @@ mod integration_tests {
     const TEST_CLIENT_USERNAME: &str = "aardvark";
     const TEST_CLIENT_PASSWORD: &str = "badger";
 
-    macro_rules! under_test {
-        () => {
-            route(TokenExchangeState {
-                access_token_repository: crate::token::repository::InMemoryTokenRepository::new(),
-                client_authenticator: crate::client::authentication::ClientAuthenticationService::new(
-                    crate::client::secret::InMemoryClientSecretRepository::new(),
-                    crate::client::configuration::InMemoryClientConfigurationRepository::new(),
-                ),
-            })
-        };
+    async fn under_test() -> Router<()> {
+        route(TokenExchangeState {
+            access_token_repository: assert_ok!(DieselAccessTokenRepository::new_in_memory().await),
+            client_authenticator: ClientAuthenticationService::new(
+                assert_ok!(DieselClientSecretRepository::new_in_memory().await),
+                assert_ok!(DieselClientConfigurationRepository::new_in_memory().await),
+            ),
+        })
     }
 
     async fn extract_json_body(response: Response<Body>) -> HashMap<String, Value> {
@@ -89,7 +95,7 @@ mod integration_tests {
     }
 
     fn basic_auth(username: &str, password: &str) -> String {
-        format!("Basic {}", BASE64_STANDARD.encode(format!("{}:{}", username, password)))
+        format!("Basic {}", BASE64_STANDARD.encode(format!("{username}:{password}")))
     }
 
     mod invalid_http_request {
@@ -98,9 +104,9 @@ mod integration_tests {
         macro_rules! http_method_test {
             ($($name:ident: $method:expr,)*) => {
             $(
-                #[tokio::test]
+                #[tokio::test(flavor = "multi_thread")]
                 async fn $name() {
-                    let router = under_test!();
+                    let router = under_test().await;
 
                     let request = assert_ok!(Request::builder()
                         .method($method)
@@ -128,9 +134,9 @@ mod integration_tests {
             should_not_support_http_method_connect: Method::CONNECT,
         }
 
-        #[tokio::test]
+        #[tokio::test(flavor = "multi_thread")]
         async fn should_require_client_authentication_on_missing_authorization_header() {
-            let router = under_test!();
+            let router = under_test().await;
 
             let request = assert_ok!(
                 Request::builder()
@@ -145,9 +151,9 @@ mod integration_tests {
             assert_eq!(response.status(), StatusCode::UNAUTHORIZED);
         }
 
-        #[tokio::test]
+        #[tokio::test(flavor = "multi_thread")]
         async fn should_require_client_authentication_on_invalid_confidential_client_credentials() {
-            let router = under_test!();
+            let router = under_test().await;
 
             let request = assert_ok!(
                 Request::builder()
@@ -163,9 +169,9 @@ mod integration_tests {
             assert_eq!(response.status(), StatusCode::UNAUTHORIZED);
         }
 
-        #[tokio::test]
+        #[tokio::test(flavor = "multi_thread")]
         async fn should_require_client_authentication_on_invalid_public_client_credentials() {
-            let router = under_test!();
+            let router = under_test().await;
 
             let request = assert_ok!(
                 Request::builder()
@@ -180,9 +186,9 @@ mod integration_tests {
             assert_eq!(response.status(), StatusCode::UNAUTHORIZED);
         }
 
-        #[tokio::test]
+        #[tokio::test(flavor = "multi_thread")]
         async fn should_require_client_authentication_via_only_one_method() {
-            let router = under_test!();
+            let router = under_test().await;
 
             let request = assert_ok!(
                 Request::builder()
@@ -201,9 +207,9 @@ mod integration_tests {
         macro_rules! content_type_test {
             ($($name:ident: $value:expr,)*) => {
             $(
-                #[tokio::test]
+                #[tokio::test(flavor = "multi_thread")]
                 async fn $name() {
-                    let router = under_test!();
+                    let router = under_test().await;
 
                     let (content_type, body) = $value;
 
@@ -225,7 +231,7 @@ mod integration_tests {
         }
 
         content_type_test! {
-            should_not_support_application_xml: ("xml", r#"<grantType>aardvark</grantType>"#),
+            should_not_support_application_xml: ("xml", r"<grantType>aardvark</grantType>"),
             should_not_support_application_json: ("json", r#"{"grant_type":"aardvark"}"#),
         }
     }
@@ -233,10 +239,10 @@ mod integration_tests {
     mod invalid_token_request {
         use super::*;
 
-        #[tokio::test]
+        #[tokio::test(flavor = "multi_thread")]
         async fn should_return_bad_request_for_invalid_token_exchange_requests() {
 
-            let router = under_test!();
+            let router = under_test().await;
 
             let request = assert_ok!(
                 Request::builder()
@@ -260,9 +266,9 @@ mod integration_tests {
     mod success_token_request {
         use super::*;
 
-        #[tokio::test]
+        #[tokio::test(flavor = "multi_thread")]
         async fn should_return_ok_for_valid_password_grants() {
-            let router = under_test!();
+            let router = under_test().await;
 
             let request = assert_ok!(Request::builder()
                 .method(Method::POST)
@@ -284,10 +290,10 @@ mod integration_tests {
             assert_none!(body.get("state"));
         }
 
-        #[tokio::test]
+        #[tokio::test(flavor = "multi_thread")]
         #[ignore = "authorization code not yet implemented"] // TODO - Re-enable once implemented
         async fn should_return_ok_for_valid_authorization_code_grants() {
-            let router = under_test!();
+            let router = under_test().await;
 
             let request = assert_ok!(Request::builder()
                 .method(Method::POST)
@@ -308,10 +314,10 @@ mod integration_tests {
             assert_some_eq_x!(body.get("scope"), "basic");
         }
 
-        #[tokio::test]
+        #[tokio::test(flavor = "multi_thread")]
         #[ignore = "refresh grant not yet implemented"] // TODO - Re-enable once implemented
         async fn should_return_ok_for_valid_refresh_token_grant() {
-            let router = under_test!();
+            let router = under_test().await;
 
             let request = assert_ok!(Request::builder()
                 .method(Method::POST)
@@ -332,10 +338,10 @@ mod integration_tests {
             assert_some_eq_x!(body.get("scope"), "basic");
         }
 
-        #[tokio::test]
+        #[tokio::test(flavor = "multi_thread")]
         #[ignore = "assertion grant not yet implemented"] // TODO - Re-enable once implemented
         async fn should_return_ok_for_valid_assertion_grant() {
-            let router = under_test!();
+            let router = under_test().await;
 
             let request = assert_ok!(
                 Request::builder()
diff --git a/src/token_introspection/mod.rs b/src/token_introspection/mod.rs
index 029a400..a5ff9f1 100644
--- a/src/token_introspection/mod.rs
+++ b/src/token_introspection/mod.rs
@@ -1,4 +1,6 @@
 mod route;
 mod middleware;
+mod request;
+mod response;
 
 pub use route::*;
diff --git a/src/token_introspection/request.rs b/src/token_introspection/request.rs
new file mode 100644
index 0000000..c71f9ca
--- /dev/null
+++ b/src/token_introspection/request.rs
@@ -0,0 +1,46 @@
+use std::collections::HashMap;
+use axum::extract::{FromRequest, Request};
+use axum::extract::rejection::FormRejection;
+use axum::{Form, Json};
+use axum::http::StatusCode;
+use axum::response::{IntoResponse, Response};
+use uuid::Uuid;
+use crate::token_introspection::response::{ErrorType, TokenIntrospectionResponse};
+
+pub struct TokenIntrospectionRequest {
+    pub(crate) token: Uuid,
+}
+
+pub struct TokenIntrospectionForm(pub TokenIntrospectionRequest);
+
+impl<S: Send + Sync> FromRequest<S> for TokenIntrospectionForm {
+    type Rejection = Response;
+    async fn from_request(req: Request, state: &S) -> Result<Self, Self::Rejection> {
+        match Form::<HashMap<String, String>>::from_request(req, state).await {
+            Err(rejection) => Err(handle_form_rejection(&rejection)),
+            Ok(Form(request)) => match validate_request(&request) {
+                Err(failure) => Err(handle_validation_failure(*failure)),
+                Ok(valid) => Ok(valid),
+            }
+        }
+    }
+}
+
+fn validate_request(request: &HashMap<String, String>) -> Result<TokenIntrospectionForm, Box<TokenIntrospectionResponse>> {
+    match request.get("token").map(|s| Uuid::parse_str(s)) {
+        None => Err(Box::new(TokenIntrospectionResponse::missing_parameter("token"))),
+        Some(Err(_)) => Err(Box::new(TokenIntrospectionResponse::invalid_parameter("token"))),
+        Some(Ok(token)) => Ok(TokenIntrospectionForm(TokenIntrospectionRequest { token })),
+    }
+}
+
+fn handle_validation_failure(failure: TokenIntrospectionResponse) -> Response {
+    (StatusCode::BAD_REQUEST, Json(failure)).into_response()
+}
+
+fn handle_form_rejection(rejection: &FormRejection) -> Response {
+    (rejection.status(), Json(TokenIntrospectionResponse::Invalid {
+        error: ErrorType::InvalidRequest,
+        error_description: Some(rejection.body_text()),
+    })).into_response()
+}
\ No newline at end of file
diff --git a/src/token_introspection/response.rs b/src/token_introspection/response.rs
new file mode 100644
index 0000000..1ccdcbd
--- /dev/null
+++ b/src/token_introspection/response.rs
@@ -0,0 +1,115 @@
+use crate::client::ClientId;
+use crate::scope::Scopes;
+use crate::token::TokenType;
+use serde::Serialize;
+
+#[cfg_attr(test, derive(Debug))]
+#[derive(Serialize)]
+#[serde(untagged)]
+pub enum TokenIntrospectionResponse {
+    Active {
+        /**
+         * Boolean indicator of whether the presented token is currently active.
+         *
+         * The specifics of a token's "active" state will vary depending on the implementation of
+         * the authorization server and the information it keeps about its tokens, but a "true"
+         * value return for the "active" property will generally indicate that a given token has
+         * been issued by this authorization server, has not been revoked by the resource owner,
+         * and is within its given time window of validity (e.g., after its issuance time and before
+         * its expiration time).
+         *
+         * See Section 4 for information on implementation of such checks <https://www.rfc-editor.org/rfc/rfc7662#section-4>.
+         */
+        active: bool,
+
+        /**
+         * A JSON string containing a space-separated list of scopes associated with this token,
+         * in the format described in Section 3.3 of OAuth 2.0 <https://www.rfc-editor.org/rfc/rfc6749#section-3.3>.
+         */
+        #[serde(skip_serializing_if = "Option::is_none")]
+        scope: Option<Scopes>,
+
+        /**
+         * Client identifier for the OAuth 2.0 client that requested this token.
+         */
+        #[serde(skip_serializing_if = "Option::is_none")]
+        client_id: Option<ClientId>,
+
+        /**
+         * Human-readable identifier for the resource owner who authorized this token.
+         */
+        #[serde(skip_serializing_if = "Option::is_none")]
+        username: Option<String>, // TODO - Use an internal value struct AuthenticatedUsername
+
+        /**
+         * Type of the token as defined in Section 5.1 of OAuth 2.0 <https://www.rfc-editor.org/rfc/rfc6749#section-5.1>.
+         */
+        #[serde(skip_serializing_if = "Option::is_none")]
+        token_type: Option<TokenType>,
+
+        /**
+         * Integer timestamp, measured in the number of seconds since January 1 1970 UTC,
+         * indicating when this token will expire, as defined in JWT <https://www.rfc-editor.org/rfc/rfc7519>
+         */
+        #[serde(rename = "exp", skip_serializing_if = "Option::is_none")]
+        expires_at: Option<i64>,
+
+        /**
+         * Integer timestamp, measured in the number of seconds since January 1 1970 UTC,
+         * indicating when this token was originally issued, as defined in JWT <https://www.rfc-editor.org/rfc/rfc7519>
+         */
+        #[serde(rename = "iat", skip_serializing_if = "Option::is_none")]
+        issued_at: Option<i64>,
+
+        /**
+         * Integer timestamp, measured in the number of seconds since January 1 1970 UTC,
+         * indicating when this token is not to be used before, as defined in JWT <https://www.rfc-editor.org/rfc/rfc7519>
+         */
+        #[serde(rename = "nbf", skip_serializing_if = "Option::is_none")]
+        not_before: Option<i64>,
+
+    },
+    Inactive {
+        /**
+         * Boolean indicator of whether the presented token is currently active.
+         */
+        active: bool,
+    },
+    Invalid {
+        /**
+         * A single ASCII error code from the defined list.
+         */
+        error: ErrorType,
+
+        /**
+         * Human-readable ASCII text providing additional information, used
+         * to assist the client developer in understanding the error that occurred.
+         */
+        #[serde(skip_serializing_if = "Option::is_none")]
+        error_description: Option<String>,
+    },
+}
+
+#[cfg_attr(test, derive(Debug))]
+#[derive(Serialize)]
+#[serde(rename_all = "snake_case")]
+pub enum ErrorType {
+    InvalidRequest,
+    //UnauthorizedClient,
+}
+
+impl TokenIntrospectionResponse {
+    pub fn missing_parameter(parameter: &str) -> Self {
+        TokenIntrospectionResponse::Invalid {
+            error: ErrorType::InvalidRequest,
+            error_description: Some(format!("missing parameter: {parameter}")),
+        }
+    }
+
+    pub fn invalid_parameter(parameter: &str) -> Self {
+        TokenIntrospectionResponse::Invalid {
+            error: ErrorType::InvalidRequest,
+            error_description: Some(format!("invalid parameter: {parameter}")),
+        }
+    }
+}
\ No newline at end of file
diff --git a/src/token_introspection/route.rs b/src/token_introspection/route.rs
index 1392bd8..5caaed9 100644
--- a/src/token_introspection/route.rs
+++ b/src/token_introspection/route.rs
@@ -1,28 +1,37 @@
-use axum::http::StatusCode;
-use axum::{middleware, Extension, Json, Router};
-use axum::extract::State;
-use axum::routing::post;
-use middleware::from_fn_with_state;
-use serde::Serialize;
-use tower::ServiceBuilder;
 use crate::client::authentication::ClientAuthenticator;
-use crate::client::{ClientAction, ConfidentialClient};
 use crate::client::middleware::require_confidential_client_authentication;
-use crate::token::AccessToken;
+use crate::client::{ClientAction, ConfidentialClient};
 use crate::token::repository::TokenRepository;
+use crate::token::{AccessToken, TokenType};
 use crate::token_introspection::middleware::require_confidential_client_action;
+use crate::token_introspection::request::TokenIntrospectionForm;
+use crate::token_introspection::response::TokenIntrospectionResponse;
+use anyhow::Result;
+use axum::extract::State;
+use axum::http::StatusCode;
+use axum::response::IntoResponse;
+use axum::routing::post;
+use axum::{middleware, Extension, Json, Router};
+use middleware::from_fn_with_state;
+use tower::ServiceBuilder;
 
 pub fn route<S, A, C>(state: TokenIntrospectionState<A, C>) -> Router<S>
 where
     A: TokenRepository<AccessToken> + 'static,
-    C: ClientAuthenticator + 'static
+    C: ClientAuthenticator + 'static,
 {
     Router::new()
         .route("/introspect", post(token_introspection_handler))
         .route_layer(
             ServiceBuilder::new()
-                .layer(from_fn_with_state(state.client_authenticator.clone(), require_confidential_client_authentication::<C>))
-                .layer(from_fn_with_state(ClientAction::Introspect, require_confidential_client_action))
+                .layer(from_fn_with_state(
+                    state.client_authenticator.clone(),
+                    require_confidential_client_authentication::<C>,
+                ))
+                .layer(from_fn_with_state(
+                    ClientAction::Introspect,
+                    require_confidential_client_action,
+                )),
         )
         .with_state(state)
 }
@@ -33,21 +42,35 @@ pub struct TokenIntrospectionState<A: TokenRepository<AccessToken>, C: ClientAut
     pub client_authenticator: C,
 }
 
-async fn token_introspection_handler<A : TokenRepository<AccessToken>, C: ClientAuthenticator>(
+async fn token_introspection_handler<A: TokenRepository<AccessToken>, C: ClientAuthenticator>(
     State(state): State<TokenIntrospectionState<A, C>>,
-    Extension(client) : Extension<ConfidentialClient>,
-) -> (StatusCode, Json<TokenIntrospectionResponse>) {
+    Extension(_client): Extension<ConfidentialClient>,
+    TokenIntrospectionForm(request): TokenIntrospectionForm,
+) -> Result<impl IntoResponse, StatusCode> {
 
     // TODO - Validate request
     // TODO - Actually implement
+    // TODO - Check for expired
+    // TODO - Check for not valid yet
 
-    match state.access_token_repository.get_token(uuid::Uuid::new_v4()) {
-        Some(_) => (StatusCode::OK, Json(TokenIntrospectionResponse { active: true })),
-        None => (StatusCode::OK, Json(TokenIntrospectionResponse { active: false })),
+    match state
+        .access_token_repository
+        .get_token(request.token.into())
+        .await
+    {
+        Err(_) => Err(StatusCode::INTERNAL_SERVER_ERROR), // TODO - Add error logging
+        Ok(None) => Ok(Json(TokenIntrospectionResponse::Inactive {
+            active: false,
+        })),
+        Ok(Some(token)) => Ok(Json(TokenIntrospectionResponse::Active {
+            active: true,
+            scope: Some(token.scopes),
+            client_id: Some(token.client_id),
+            username: Some(token.username),
+            token_type: Some(TokenType::Bearer),
+            expires_at: Some(token.expires_at.and_utc().timestamp()),
+            issued_at: Some(token.issued_at.and_utc().timestamp()),
+            not_before: Some(token.not_before.and_utc().timestamp()),
+        })),
     }
 }
-
-#[derive(Serialize)]
-struct TokenIntrospectionResponse {
-    active: bool,
-}
diff --git a/src/util/diesel_from_sql_for_enum_strings.rs b/src/util/diesel_from_sql_for_enum_strings.rs
new file mode 100644
index 0000000..0928ca7
--- /dev/null
+++ b/src/util/diesel_from_sql_for_enum_strings.rs
@@ -0,0 +1,19 @@
+#[macro_export]
+macro_rules! diesel_from_sql_for_enum_strings {
+    ($($enum_type:ident)+) => {
+        $(
+            impl<B: diesel::backend::Backend> diesel::deserialize::FromSql<diesel::sql_types::Text, B> for $enum_type
+            where
+                String: diesel::deserialize::FromSql<diesel::sql_types::Text, B>,
+                $enum_type: std::str::FromStr + std::fmt::Display,
+            {
+                fn from_sql(raw: <B as diesel::backend::Backend>::RawValue<'_>) -> diesel::deserialize::Result<$enum_type> {
+                    use std::str::FromStr;
+                    $enum_type::from_str(String::from_sql(raw)?.as_str()).map_err(|e| {
+                        anyhow::anyhow!("Invalid {} Type: {}", stringify!($enum_type), e).into()
+                    })
+                }
+            }
+        )+
+    };
+}
\ No newline at end of file
diff --git a/src/util/diesel_from_sql_for_json_fields.rs b/src/util/diesel_from_sql_for_json_fields.rs
new file mode 100644
index 0000000..32cd791
--- /dev/null
+++ b/src/util/diesel_from_sql_for_json_fields.rs
@@ -0,0 +1,37 @@
+#[macro_export]
+macro_rules! diesel_from_sql_for_json_fields {
+    (
+        $($struct_name:ident($field_type:ty));+
+        $(;)?
+    ) => {
+        $(
+            impl diesel::deserialize::FromSql<diesel::sql_types::Binary, diesel::sqlite::Sqlite> for $struct_name {
+                fn from_sql(mut value: diesel::sqlite::SqliteValue<'_, '_, '_>) -> diesel::deserialize::Result<$struct_name> {
+                    serde_json::from_slice::<$field_type>(value.read_blob())
+                        .map(|field| $struct_name(field))
+                        .map_err(|error| anyhow::anyhow!("Invalid {}: {error}", stringify!($field_type)).into())
+                }
+            }
+        )+
+    }
+}
+
+#[cfg(test)]
+#[allow(dead_code)]
+mod test {
+    use crate::value_struct;
+    use std::collections::HashSet;
+
+    value_struct! {
+        struct FirstFromJson(HashSet<String>);
+    }
+
+    value_struct! {
+        struct SecondFromJson(HashSet<i32>);
+    }
+
+    diesel_from_sql_for_json_fields! {
+        FirstFromJson(HashSet<String>);
+        SecondFromJson(HashSet<i32>);
+    }
+}
\ No newline at end of file
diff --git a/src/util/diesel_from_sql_for_value_structs.rs b/src/util/diesel_from_sql_for_value_structs.rs
new file mode 100644
index 0000000..facbf63
--- /dev/null
+++ b/src/util/diesel_from_sql_for_value_structs.rs
@@ -0,0 +1,45 @@
+#[macro_export]
+macro_rules! diesel_from_sql_for_value_structs {
+    (
+        $(
+            #[sql_type($sql_type:ty)]
+            $struct_name:ident($field_type:ident)
+        );+
+        $(;)?
+    ) => {
+        $(
+            impl<B: diesel::backend::Backend> diesel::deserialize::FromSql<$sql_type, B> for $struct_name
+            where
+                $field_type: diesel::deserialize::FromSql<$sql_type, B>,
+                $struct_name: $crate::util::value_struct::ValueStruct,
+            {
+                fn from_sql(raw: <B as diesel::backend::Backend>::RawValue<'_>) -> diesel::deserialize::Result<$struct_name> {
+                    $field_type::from_sql(raw).map($struct_name)
+                }
+            }
+        )+
+    };
+}
+
+#[cfg(test)]
+#[allow(dead_code)]
+mod test {
+    use crate::value_struct;
+
+    value_struct! {
+        struct First(String);
+    }
+
+    value_struct! {
+        struct Second(i32);
+    }
+
+    diesel_from_sql_for_value_structs! {
+
+        #[sql_type(diesel::sql_types::Text)]
+        First(String);
+
+        #[sql_type(diesel::sql_types::BigInt)]
+        Second(i32);
+    }
+}
\ No newline at end of file
diff --git a/src/util/diesel_migrations.rs b/src/util/diesel_migrations.rs
new file mode 100644
index 0000000..8041248
--- /dev/null
+++ b/src/util/diesel_migrations.rs
@@ -0,0 +1,20 @@
+use crate::util::diesel_types::AsyncSqlitePool;
+use anyhow::anyhow;
+use anyhow::Context;
+use anyhow::Result;
+use diesel_async::AsyncMigrationHarness;
+use diesel_migrations::{embed_migrations, EmbeddedMigrations, MigrationHarness};
+
+const MIGRATIONS: EmbeddedMigrations = embed_migrations!("migrations");
+
+pub async fn run_diesel_migrations(pool: &AsyncSqlitePool) -> Result<()> {
+    let connection = pool
+        .get()
+        .await
+        .with_context(|| "Failed to get connection from pool")?;
+
+    match AsyncMigrationHarness::new(connection).run_pending_migrations(MIGRATIONS) {
+        Ok(_) => Ok(()),
+        Err(e) => Err(anyhow!("Failed to run pending diesel migrations: {e}")),
+    }
+}
diff --git a/src/util/diesel_pool.rs b/src/util/diesel_pool.rs
new file mode 100644
index 0000000..453963c
--- /dev/null
+++ b/src/util/diesel_pool.rs
@@ -0,0 +1,50 @@
+use crate::util::diesel_types::{AsyncSqliteConnectionManager, AsyncSqlitePool};
+use anyhow::Context;
+use anyhow::Result;
+
+pub fn create_pool(database_url: &str) -> Result<AsyncSqlitePool> {
+    AsyncSqlitePool::builder(AsyncSqliteConnectionManager::new(database_url))
+        // Example of how we might have had to enable foreign key constraints on SQLite: https://sqlite.org/foreignkeys.html#fk_enable
+        // .post_create(Hook::async_fn(|connection: &mut AsyncSqliteConnection, _| {
+        //     Box::pin(async move {
+        //         match sql_query("PRAGMA foreign_keys = ON;").execute(connection).await {
+        //             Ok(_) => Ok(()),
+        //             Err(err) => Err(HookError::Backend(PoolError::QueryError(err))),
+        //         }
+        //     })
+        // }))
+        // TODO - Add configuration options?
+        //.max_size(cpu_core_count * 2)
+        //.create_timeout(Some(std::time::Duration::from_secs(x)))
+        //.recycle_timeout(Some(std::time::Duration::from_secs(y)))
+        //.wait_timeout(Some(std::time::Duration::from_secs(z)))
+        .build()
+        .with_context(|| format!("Failed to create sqlite database pool: {database_url}"))
+}
+
+#[cfg(test)]
+mod integration_tests {
+    use super::*;
+    use diesel::sql_query;
+    use diesel::sql_types::Integer;
+    use diesel::QueryableByName;
+    use diesel_async::RunQueryDsl;
+
+    #[derive(QueryableByName)]
+    struct FkPragma {
+        #[diesel(sql_type = Integer)]
+        foreign_keys: i32,
+    }
+
+    #[allow(clippy::unwrap_used)]
+    #[tokio::test(flavor = "multi_thread")]
+    async fn should_have_foreign_key_support_enabled() {
+        let pool = create_pool(":memory:").unwrap();
+        let mut connection = pool.get().await.unwrap();
+        let result = sql_query("PRAGMA foreign_keys;")
+            .get_result::<FkPragma>(&mut connection)
+            .await
+            .unwrap();
+        assert_eq!(result.foreign_keys, 1);
+    }
+}
diff --git a/src/util/diesel_to_sql_for_json_fields.rs b/src/util/diesel_to_sql_for_json_fields.rs
new file mode 100644
index 0000000..301c40e
--- /dev/null
+++ b/src/util/diesel_to_sql_for_json_fields.rs
@@ -0,0 +1,36 @@
+#[macro_export]
+macro_rules! diesel_to_sql_for_json_fields {
+    (
+        $($struct_name:ident($field_type:ty));+
+        $(;)?
+    ) => {
+        $(
+            impl diesel::serialize::ToSql<diesel::sql_types::Binary, diesel::sqlite::Sqlite> for $struct_name {
+                fn to_sql<'b>(&'b self, out: &mut diesel::serialize::Output<'b, '_, diesel::sqlite::Sqlite>) -> diesel::serialize::Result {
+                    out.set_value(serde_json::to_vec::<$field_type>(&self.0)?);
+                    Ok(diesel::serialize::IsNull::No)
+                }
+            }
+        )+
+    }
+}
+
+#[cfg(test)]
+#[allow(dead_code)]
+mod test {
+    use crate::value_struct;
+    use std::collections::HashSet;
+
+    value_struct! {
+        struct FirstToJson(HashSet<String>);
+    }
+
+    value_struct! {
+        struct SecondToJson(HashSet<i32>);
+    }
+
+    diesel_to_sql_for_json_fields! {
+        FirstToJson(HashSet<String>);
+        SecondToJson(HashSet<i32>);
+    }
+}
\ No newline at end of file
diff --git a/src/util/diesel_to_sql_for_value_structs.rs b/src/util/diesel_to_sql_for_value_structs.rs
new file mode 100644
index 0000000..20ace36
--- /dev/null
+++ b/src/util/diesel_to_sql_for_value_structs.rs
@@ -0,0 +1,46 @@
+#[macro_export]
+macro_rules! diesel_to_sql_for_value_structs {
+    (
+        $(
+            #[sql_type($sql_type:ty)]
+            $struct_name:ident($field_type:ident)
+        );+
+        $(;)?
+    ) => {
+        $(
+            impl<B: diesel::backend::Backend> diesel::serialize::ToSql<$sql_type, B> for $struct_name
+            where
+                $field_type: diesel::serialize::ToSql<$sql_type, B>,
+                $struct_name: $crate::util::value_struct::ValueStruct,
+            {
+                fn to_sql<'b>(&'b self, out: &mut diesel::serialize::Output<'b, '_, B>) -> diesel::serialize::Result {
+                    use $crate::util::value_struct::ValueStruct;
+                    $field_type::to_sql(self.value(), out)
+                }
+            }
+        )+
+    };
+}
+
+#[cfg(test)]
+#[allow(dead_code)]
+mod test {
+    use crate::value_struct;
+
+    value_struct! {
+        struct First(String);
+    }
+
+    value_struct! {
+        struct Second(i32);
+    }
+
+    diesel_to_sql_for_value_structs! {
+
+        #[sql_type(diesel::sql_types::Text)]
+        First(String);
+
+        #[sql_type(diesel::sql_types::BigInt)]
+        Second(i32);
+    }
+}
\ No newline at end of file
diff --git a/src/util/diesel_types.rs b/src/util/diesel_types.rs
new file mode 100644
index 0000000..16a2023
--- /dev/null
+++ b/src/util/diesel_types.rs
@@ -0,0 +1,8 @@
+use diesel::SqliteConnection;
+use diesel_async::pooled_connection::deadpool::Pool;
+use diesel_async::pooled_connection::AsyncDieselConnectionManager;
+use diesel_async::sync_connection_wrapper::SyncConnectionWrapper;
+
+pub type AsyncSqliteConnection = SyncConnectionWrapper<SqliteConnection>;
+pub type AsyncSqliteConnectionManager = AsyncDieselConnectionManager<AsyncSqliteConnection>;
+pub type AsyncSqlitePool = Pool<AsyncSqliteConnection>;
diff --git a/src/util/enum_with_from_str.rs b/src/util/enum_with_from_str.rs
deleted file mode 100644
index 02d0719..0000000
--- a/src/util/enum_with_from_str.rs
+++ /dev/null
@@ -1,85 +0,0 @@
-#[macro_export]
-macro_rules! enum_with_from_str {
-    (
-        $(#[$m:meta])*
-        $vis:vis enum $enum_name:ident {
-            $($enum_value:ident: $enum_string_value:expr),+
-            $(,)?
-        }
-    ) => {
-        $(#[$m])*
-        $vis enum $enum_name {
-            $($enum_value),+
-        }
-        impl std::str::FromStr for $enum_name {
-            type Err = String;
-            fn from_str(value: &str) -> Result<Self, Self::Err> {
-                match value {
-                    $($enum_string_value => Ok(Self::$enum_value),)+
-                    _ => Err(format!("unsupported: {value}")),
-                }
-            }
-        }
-        impl std::fmt::Display for $enum_name {
-            fn fmt(&self, f: &mut std::fmt::Formatter<'_>) -> std::fmt::Result {
-                match self {
-                    $(Self::$enum_value => f.write_str($enum_string_value),)+
-                }
-            }
-        }
-    }
-}
-
-#[cfg(test)]
-mod test {
-    use std::str::FromStr;
-    use assertables::*;
-
-    enum_with_from_str! {
-        #[derive(Debug, Eq, PartialEq, Copy, Clone)]
-        pub enum TestEnum {
-            TestValue1: "test1",
-            TestValue2: "test_2",
-        }
-    }
-
-    mod from_str {
-        use super::*;
-
-        #[test]
-        fn should_return_ok_on_supported_values() {
-            assert_ok_eq_x!("test1".parse::<TestEnum>(), TestEnum::TestValue1);
-            assert_ok_eq_x!(TestEnum::from_str("test1"), TestEnum::TestValue1);
-            assert_ok_eq_x!("test_2".parse::<TestEnum>(), TestEnum::TestValue2);
-            assert_ok_eq_x!(TestEnum::from_str("test_2"), TestEnum::TestValue2);
-        }
-
-        #[test]
-        fn should_return_err_on_unsupported_values() {
-            assert_eq!(assert_err!("aardvark".parse::<TestEnum>()), "unsupported: aardvark");
-            assert_eq!(assert_err!(TestEnum::from_str("aardvark")), "unsupported: aardvark");
-        }
-    }
-
-    mod to_string {
-        use super::*;
-
-        #[test]
-        fn should_return_expected_string() {
-            assert_eq!(TestEnum::TestValue1.to_string(), "test1");
-            assert_eq!(TestEnum::TestValue2.to_string(), "test_2");
-        }
-
-        #[test]
-        fn should_format_expected_display_string() {
-            assert_eq!(format!("{}", TestEnum::TestValue1), "test1");
-            assert_eq!(format!("{}", TestEnum::TestValue2), "test_2");
-        }
-
-        #[test]
-        fn should_format_expected_debug_string() {
-            assert_eq!(format!("{:?}", TestEnum::TestValue1), "TestValue1");
-            assert_eq!(format!("{:?}", TestEnum::TestValue2), "TestValue2");
-        }
-    }
-}
\ No newline at end of file
diff --git a/src/util/map_of.rs b/src/util/map_of.rs
index 8d93d8a..6e1f9eb 100644
--- a/src/util/map_of.rs
+++ b/src/util/map_of.rs
@@ -34,6 +34,7 @@ mod test {
 
     #[test]
     fn should_be_able_to_create_a_string_to_enum_map() {
+        #[allow(clippy::zero_sized_map_values)]
         let map: HashMap<String, GrantType> = map_of! {
             "password" => GrantType::Password,
         };
diff --git a/src/util/mod.rs b/src/util/mod.rs
index 98ba953..461b500 100644
--- a/src/util/mod.rs
+++ b/src/util/mod.rs
@@ -1,5 +1,13 @@
+pub mod diesel_from_sql_for_enum_strings;
+pub mod diesel_from_sql_for_json_fields;
+pub mod diesel_from_sql_for_value_structs;
+pub mod diesel_migrations;
+pub mod diesel_pool;
+pub mod diesel_to_sql_for_json_fields;
+pub mod diesel_to_sql_for_value_structs;
+pub mod diesel_types;
 pub mod disable_deserialization;
 pub mod disable_serialization;
-pub mod enum_with_from_str;
 pub mod map_of;
-pub mod value_struct;
+pub mod uuid_wrapper;
+pub mod value_struct;
\ No newline at end of file
diff --git a/src/util/uuid_wrapper.rs b/src/util/uuid_wrapper.rs
new file mode 100644
index 0000000..2dbab9d
--- /dev/null
+++ b/src/util/uuid_wrapper.rs
@@ -0,0 +1,59 @@
+use diesel::backend::Backend;
+use diesel::deserialize::FromSql;
+use diesel::serialize::{Output, ToSql};
+use diesel::sql_types::Binary;
+use diesel::sqlite::Sqlite;
+use uuid::Uuid;
+
+#[derive(Debug, Clone, Copy, Hash, Eq, PartialEq)]
+#[derive(serde::Serialize)]
+#[serde(transparent)]
+#[derive(diesel::FromSqlRow, diesel::AsExpression)]
+#[diesel(sql_type = Binary)]
+pub struct UuidWrapper(pub Uuid);
+
+impl UuidWrapper {
+    pub fn new(uuid: Uuid) -> Self {
+        Self(uuid)
+    }
+    pub fn random() -> Self {
+        Self(Uuid::new_v4())
+    }
+}
+
+impl From<UuidWrapper> for Uuid {
+    fn from(uuid: UuidWrapper) -> Self {
+        uuid.0
+    }
+}
+
+impl From<Uuid> for UuidWrapper {
+    fn from(uuid: Uuid) -> Self {
+        Self(uuid)
+    }
+}
+
+impl ToSql<Binary, Sqlite> for UuidWrapper {
+    fn to_sql<'b>(&'b self, out: &mut Output<'b, '_, Sqlite>) -> diesel::serialize::Result {
+        <[u8] as ToSql<Binary, Sqlite>>::to_sql(self.0.as_bytes(), out)
+    }
+}
+
+impl FromSql<Binary, Sqlite> for UuidWrapper {
+    fn from_sql(bytes: <Sqlite as Backend>::RawValue<'_>) -> diesel::deserialize::Result<Self> {
+        let raw = <Vec<u8> as FromSql<Binary, Sqlite>>::from_sql(bytes)?;
+        let uuid = Uuid::from_slice(&raw).map(Self)?;
+        Ok(uuid)
+    }
+}
+
+#[cfg(test)]
+pub mod test_support {
+    use super::*;
+    use assertables::*;
+    impl From<&str> for UuidWrapper {
+        fn from(uuid: &str) -> UuidWrapper {
+            UuidWrapper(assert_ok!(Uuid::parse_str(uuid)))
+        }
+    }
+}
\ No newline at end of file
diff --git a/src/util/value_struct.rs b/src/util/value_struct.rs
index 1532b5b..90180e3 100644
--- a/src/util/value_struct.rs
+++ b/src/util/value_struct.rs
@@ -1,33 +1,28 @@
 pub trait ValueStruct {
     type ValueType;
     fn value(&self) -> &Self::ValueType;
-    fn into_value(self) -> Self::ValueType;
 }
 
 #[macro_export]
 macro_rules! value_struct {
     (
         $(#[$m:meta])*
-        $vis:vis struct $struct_name:ident($field_type:ident);
+        $vis:vis struct $struct_name:ident($field_vis:vis $field_type:ty);
     ) => {
         $(#[$m])*
         #[non_exhaustive]
-        #[derive(Clone, Hash, Eq, PartialEq)]
-        #[cfg_attr(test, derive(Debug))]
-        $vis struct $struct_name($field_type);
+        #[derive(Debug, Clone, Eq, PartialEq)]
+        #[derive(serde::Serialize)]
+        #[serde(transparent)]
+        $vis struct $struct_name($field_vis $field_type);
 
-        impl crate::util::value_struct::ValueStruct for $struct_name {
+        impl $crate::util::value_struct::ValueStruct for $struct_name {
             type ValueType = $field_type;
 
             #[inline]
             fn value(&self) -> &Self::ValueType {
                 &self.0
             }
-
-            #[inline]
-            fn into_value(self) -> Self::ValueType {
-                self.0
-            }
         }
 
         impl std::convert::From<$field_type> for $struct_name {
@@ -41,12 +36,41 @@ macro_rules! value_struct {
                 $struct_name(value.clone())
             }
         }
-
-        // TODO - Rethink this as it'll break once ValueType is not a string
-        impl serde::Serialize for $struct_name {
-            fn serialize<S: serde::Serializer>(&self, serializer: S) -> Result<S::Ok, S::Error> {
-                serializer.serialize_str(&self.0)
-            }
-        }
     };
 }
+
+#[cfg(test)]
+mod unit_tests {
+    use super::*;
+    use std::collections::HashSet;
+
+    value_struct! {
+        struct TestStruct(i32);
+    }
+
+    value_struct! {
+        #[allow(dead_code)]
+        struct AllowedStrings(HashSet<String>);
+    }
+
+    #[test]
+    fn test_value_struct() {
+        let test_value = 42;
+        let test_struct = TestStruct(test_value);
+        assert_eq!(test_struct.value(), &test_value);
+    }
+
+    #[test]
+    fn test_value_struct_from_value() {
+        let test_value = 616;
+        let test_struct: TestStruct = test_value.into();
+        assert_eq!(test_struct, TestStruct(616));
+    }
+
+    #[test]
+    fn test_value_struct_from_value_ref() {
+        let test_value = &666;
+        let test_struct: TestStruct = test_value.into();
+        assert_eq!(test_struct, TestStruct(*test_value));
+    }
+}
\ No newline at end of file