@0x0501/mystack 0.0.0-stage → 0.1.0-bootstrap.0

package/template/src/components/shells.tsx

@@ -0,0 +1,201 @@
+import { Link } from "@tanstack/react-router";
+import type { ComponentProps, ReactNode } from "react";
+import { LocaleSwitcher } from "@/components/LocaleSwitcher";
+import { ThemeToggle } from "@/components/ThemeToggle";
+import * as m from "@/paraglide/messages";
+import { cn } from "@/utils/cn";
+import { cardClass, labelClass, mutedTextClass } from "./ui/styles";
+
+export {
+	buttonClass,
+	buttonPrimaryClass,
+	buttonSecondaryClass,
+	cardClass,
+	inputClass,
+	labelClass,
+	linkClass,
+	mutedTextClass,
+} from "./ui/styles";
+
+type ShellProps = ComponentProps<"div"> & { title: string };
+
+/** Auth flow layout; presentation is replaceable through CSS and className. */
+export function AuthShell({
+	title,
+	children,
+	className,
+	...props
+}: ShellProps) {
+	return (
+		<div {...props} className={cn("page page--narrow auth-shell", className)}>
+			<div className="auth-shell__header">
+				<Link to="/" className={cn(mutedTextClass, "hover:text-foreground")}>
+					← {m.nav_home()}
+				</Link>
+				<div className="flex items-center gap-2">
+					<LocaleSwitcher variant="bare" />
+					<ThemeToggle />
+				</div>
+			</div>
+			<h1 className="shell-title auth-shell__title">{title}</h1>
+			<div
+				className={cn(cardClass, "auth-shell__content")}
+				data-testid="auth-card"
+			>
+				{children}
+			</div>
+		</div>
+	);
+}
+
+/** Signed-in member layout. */
+export function DashboardShell({
+	title,
+	children,
+	className,
+	...props
+}: ShellProps) {
+	return (
+		<div
+			{...props}
+			className={cn("page app-shell", className)}
+			data-testid="dashboard-shell"
+		>
+			<header className="app-shell__header">
+				<div>
+					<p className="text-xs text-muted-foreground">{m.dashboard_title()}</p>
+					<h1 className="shell-title">{title}</h1>
+				</div>
+				<div className="flex flex-wrap items-center gap-3">
+					<nav
+						className="flex flex-wrap gap-3 text-sm"
+						aria-label={m.dashboard_title()}
+					>
+						<ShellNavLink to="/dashboard">{m.nav_overview()}</ShellNavLink>
+						<ShellNavLink to="/dashboard/account">
+							{m.nav_account()}
+						</ShellNavLink>
+						<ShellNavLink to="/" muted>
+							{m.nav_home()}
+						</ShellNavLink>
+					</nav>
+					<LocaleSwitcher />
+					<ThemeToggle />
+				</div>
+			</header>
+			{children}
+		</div>
+	);
+}
+
+/** Administrator layout. */
+export function AdminShell({
+	title,
+	children,
+	className,
+	...props
+}: ShellProps) {
+	return (
+		<div
+			{...props}
+			className={cn("page page--wide app-shell", className)}
+			data-testid="admin-shell"
+		>
+			<header className="app-shell__header">
+				<div>
+					<p className="text-xs text-muted-foreground">{m.admin_title()}</p>
+					<h1 className="shell-title">{title}</h1>
+				</div>
+				<div className="flex flex-wrap items-center gap-3">
+					<nav
+						className="flex flex-wrap gap-3 text-sm"
+						aria-label={m.admin_title()}
+					>
+						<ShellNavLink to="/admin/users">{m.nav_users()}</ShellNavLink>
+						<ShellNavLink to="/admin/audit">{m.nav_audit()}</ShellNavLink>
+						<ShellNavLink to="/admin/oauth-apps">
+							{m.nav_oauth_apps()}
+						</ShellNavLink>
+						<ShellNavLink to="/dashboard" muted>
+							{m.nav_dashboard()}
+						</ShellNavLink>
+					</nav>
+					<LocaleSwitcher />
+					<ThemeToggle />
+				</div>
+			</header>
+			{children}
+		</div>
+	);
+}
+
+function ShellNavLink({
+	to,
+	children,
+	muted = false,
+}: {
+	to:
+		| "/"
+		| "/dashboard"
+		| "/dashboard/account"
+		| "/admin/users"
+		| "/admin/audit"
+		| "/admin/oauth-apps";
+	children: ReactNode;
+	muted?: boolean;
+}) {
+	return (
+		<Link
+			to={to}
+			activeOptions={{ exact: true }}
+			activeProps={{ "aria-current": "page" }}
+			className={cn(
+				"shell-nav-link",
+				muted ? "text-muted-foreground" : "text-foreground",
+			)}
+		>
+			{children}
+		</Link>
+	);
+}
+
+export function Field({
+	label,
+	children,
+	hint,
+}: {
+	label: string;
+	children: ReactNode;
+	hint?: string;
+}) {
+	return (
+		// biome-ignore lint/a11y/noLabelWithoutControl: control is provided via children
+		<label className="mb-4 block">
+			<span className={labelClass}>{label}</span>
+			{children}
+			{hint ? (
+				<span className={cn(mutedTextClass, "mt-1 block text-xs")}>{hint}</span>
+			) : null}
+		</label>
+	);
+}
+
+export function PageAlert({
+	children,
+	tone = "error",
+}: {
+	children: ReactNode;
+	tone?: "error" | "success" | "info";
+}) {
+	const toneClass =
+		tone === "success"
+			? "text-success"
+			: tone === "info"
+				? "text-muted-foreground"
+				: "text-destructive";
+	return (
+		<p className={cn("mb-3 text-sm", toneClass)} role="alert">
+			{children}
+		</p>
+	);
+}

package/template/src/components/ui/styles.ts

@@ -0,0 +1,9 @@
+/** Opt-in presentation hooks. Definitions live in styles/ui.css. */
+export const buttonPrimaryClass = "ui-button ui-button--primary";
+export const buttonSecondaryClass = "ui-button ui-button--secondary";
+export const cardClass = "ui-card";
+export const labelClass = "ui-label";
+export const mutedTextClass = "ui-muted";
+export const linkClass = "ui-link";
+export const buttonClass = `${buttonPrimaryClass} w-full`;
+export const inputClass = "ui-input";

package/template/src/db/auth.schema.ts

@@ -0,0 +1,455 @@
+import { relations } from "drizzle-orm";
+import {
+	boolean,
+	index,
+	integer,
+	jsonb,
+	pgTable,
+	text,
+	timestamp,
+	uniqueIndex,
+} from "drizzle-orm/pg-core";
+
+export const user = pgTable("user", {
+	id: text("id").primaryKey(),
+	name: text("name").notNull(),
+	email: text("email").notNull().unique(),
+	emailVerified: boolean("email_verified").default(false).notNull(),
+	image: text("image"),
+	createdAt: timestamp("created_at").defaultNow().notNull(),
+	updatedAt: timestamp("updated_at")
+		.defaultNow()
+		.$onUpdate(() => /* @__PURE__ */ new Date())
+		.notNull(),
+	role: text("role"),
+	banned: boolean("banned").default(false),
+	banReason: text("ban_reason"),
+	banExpires: timestamp("ban_expires"),
+	twoFactorEnabled: boolean("two_factor_enabled").default(false),
+	tokensRevokedAt: timestamp("tokens_revoked_at"),
+	locale: text("locale"),
+});
+
+export const session = pgTable(
+	"session",
+	{
+		id: text("id").primaryKey(),
+		expiresAt: timestamp("expires_at").notNull(),
+		token: text("token").notNull().unique(),
+		createdAt: timestamp("created_at").defaultNow().notNull(),
+		updatedAt: timestamp("updated_at")
+			.$onUpdate(() => /* @__PURE__ */ new Date())
+			.notNull(),
+		ipAddress: text("ip_address"),
+		userAgent: text("user_agent"),
+		userId: text("user_id")
+			.notNull()
+			.references(() => user.id, { onDelete: "cascade" }),
+		impersonatedBy: text("impersonated_by"),
+	},
+	(table) => [index("session_userId_idx").on(table.userId)],
+);
+
+export const account = pgTable(
+	"account",
+	{
+		id: text("id").primaryKey(),
+		accountId: text("account_id").notNull(),
+		providerId: text("provider_id").notNull(),
+		userId: text("user_id")
+			.notNull()
+			.references(() => user.id, { onDelete: "cascade" }),
+		accessToken: text("access_token"),
+		refreshToken: text("refresh_token"),
+		idToken: text("id_token"),
+		accessTokenExpiresAt: timestamp("access_token_expires_at"),
+		refreshTokenExpiresAt: timestamp("refresh_token_expires_at"),
+		scope: text("scope"),
+		password: text("password"),
+		createdAt: timestamp("created_at").defaultNow().notNull(),
+		updatedAt: timestamp("updated_at")
+			.$onUpdate(() => /* @__PURE__ */ new Date())
+			.notNull(),
+	},
+	(table) => [index("account_userId_idx").on(table.userId)],
+);
+
+export const verification = pgTable(
+	"verification",
+	{
+		id: text("id").primaryKey(),
+		identifier: text("identifier").notNull(),
+		value: text("value").notNull(),
+		expiresAt: timestamp("expires_at").notNull(),
+		createdAt: timestamp("created_at").defaultNow().notNull(),
+		updatedAt: timestamp("updated_at")
+			.defaultNow()
+			.$onUpdate(() => /* @__PURE__ */ new Date())
+			.notNull(),
+	},
+	(table) => [index("verification_identifier_idx").on(table.identifier)],
+);
+
+export const jwks = pgTable("jwks", {
+	id: text("id").primaryKey(),
+	publicKey: text("public_key").notNull(),
+	privateKey: text("private_key").notNull(),
+	createdAt: timestamp("created_at").notNull(),
+	expiresAt: timestamp("expires_at"),
+	alg: text("alg"),
+	crv: text("crv"),
+});
+
+export const oauthClient = pgTable(
+	"oauth_client",
+	{
+		id: text("id").primaryKey(),
+		clientId: text("client_id").notNull().unique(),
+		clientSecret: text("client_secret"),
+		clientDiscoveryId: text("client_discovery_id"),
+		disabled: boolean("disabled").default(false),
+		skipConsent: boolean("skip_consent"),
+		enableEndSession: boolean("enable_end_session"),
+		subjectType: text("subject_type"),
+		scopes: text("scopes").array(),
+		clientCredentialsScopes: text("client_credentials_scopes")
+			.array()
+			.default([]),
+		userId: text("user_id").references(() => user.id, { onDelete: "cascade" }),
+		createdAt: timestamp("created_at"),
+		updatedAt: timestamp("updated_at"),
+		name: text("name"),
+		uri: text("uri"),
+		icon: text("icon"),
+		contacts: text("contacts").array(),
+		tos: text("tos"),
+		policy: text("policy"),
+		softwareId: text("software_id"),
+		softwareVersion: text("software_version"),
+		softwareStatement: text("software_statement"),
+		redirectUris: text("redirect_uris").array().notNull(),
+		postLogoutRedirectUris: text("post_logout_redirect_uris").array(),
+		backchannelLogoutUri: text("backchannel_logout_uri"),
+		backchannelLogoutSessionRequired: boolean(
+			"backchannel_logout_session_required",
+		),
+		tokenEndpointAuthMethod: text("token_endpoint_auth_method"),
+		applicationType: text("application_type"),
+		jwks: text("jwks"),
+		jwksUri: text("jwks_uri"),
+		grantTypes: text("grant_types").array(),
+		responseTypes: text("response_types").array(),
+		requirePKCE: boolean("require_pkce"),
+		dpopBoundAccessTokens: boolean("dpop_bound_access_tokens").default(false),
+		referenceId: text("reference_id"),
+		metadata: jsonb("metadata"),
+	},
+	(table) => [index("oauthClient_userId_idx").on(table.userId)],
+);
+
+export const oauthResource = pgTable("oauth_resource", {
+	id: text("id").primaryKey(),
+	identifier: text("identifier").notNull().unique(),
+	name: text("name").notNull(),
+	accessTokenTtl: integer("access_token_ttl"),
+	refreshTokenTtl: integer("refresh_token_ttl"),
+	signingAlgorithm: text("signing_algorithm"),
+	signingKeyId: text("signing_key_id"),
+	allowedScopes: text("allowed_scopes").array(),
+	customClaims: jsonb("custom_claims"),
+	dpopBoundAccessTokensRequired: boolean(
+		"dpop_bound_access_tokens_required",
+	).default(false),
+	disabled: boolean("disabled").default(false),
+	createdAt: timestamp("created_at"),
+	updatedAt: timestamp("updated_at"),
+	policyVersion: integer("policy_version").default(1),
+	metadata: jsonb("metadata"),
+});
+
+export const oauthClientResource = pgTable(
+	"oauth_client_resource",
+	{
+		id: text("id").primaryKey(),
+		clientId: text("client_id")
+			.notNull()
+			.references(() => oauthClient.clientId, { onDelete: "cascade" }),
+		resourceId: text("resource_id")
+			.notNull()
+			.references(() => oauthResource.identifier, { onDelete: "cascade" }),
+		metadata: jsonb("metadata"),
+		createdAt: timestamp("created_at"),
+	},
+	(table) => [
+		uniqueIndex("oauthClientResource_clientId_resourceId_uidx").on(
+			table.clientId,
+			table.resourceId,
+		),
+		index("oauthClientResource_clientId_idx").on(table.clientId),
+		index("oauthClientResource_resourceId_idx").on(table.resourceId),
+	],
+);
+
+export const oauthRefreshToken = pgTable(
+	"oauth_refresh_token",
+	{
+		id: text("id").primaryKey(),
+		token: text("token").notNull().unique(),
+		clientId: text("client_id")
+			.notNull()
+			.references(() => oauthClient.clientId, { onDelete: "cascade" }),
+		sessionId: text("session_id").references(() => session.id, {
+			onDelete: "set null",
+		}),
+		userId: text("user_id")
+			.notNull()
+			.references(() => user.id, { onDelete: "cascade" }),
+		referenceId: text("reference_id"),
+		authorizationCodeId: text("authorization_code_id"),
+		resources: text("resources").array(),
+		requestedUserInfoClaims: text("requested_user_info_claims").array(),
+		expiresAt: timestamp("expires_at").notNull(),
+		createdAt: timestamp("created_at").notNull(),
+		revoked: timestamp("revoked"),
+		rotatedAt: timestamp("rotated_at"),
+		rotationReplayResponse: text("rotation_replay_response"),
+		rotationReplayExpiresAt: timestamp("rotation_replay_expires_at"),
+		authTime: timestamp("auth_time"),
+		confirmation: jsonb("confirmation"),
+		scopes: text("scopes").array().notNull(),
+	},
+	(table) => [
+		index("oauthRefreshToken_clientId_idx").on(table.clientId),
+		index("oauthRefreshToken_sessionId_idx").on(table.sessionId),
+		index("oauthRefreshToken_userId_idx").on(table.userId),
+		index("oauthRefreshToken_authorizationCodeId_idx").on(
+			table.authorizationCodeId,
+		),
+	],
+);
+
+export const oauthAccessToken = pgTable(
+	"oauth_access_token",
+	{
+		id: text("id").primaryKey(),
+		token: text("token").notNull().unique(),
+		clientId: text("client_id")
+			.notNull()
+			.references(() => oauthClient.clientId, { onDelete: "cascade" }),
+		sessionId: text("session_id").references(() => session.id, {
+			onDelete: "set null",
+		}),
+		userId: text("user_id").references(() => user.id, { onDelete: "cascade" }),
+		referenceId: text("reference_id"),
+		authorizationCodeId: text("authorization_code_id"),
+		resources: text("resources").array(),
+		requestedUserInfoClaims: text("requested_user_info_claims").array(),
+		refreshId: text("refresh_id").references(() => oauthRefreshToken.id, {
+			onDelete: "cascade",
+		}),
+		expiresAt: timestamp("expires_at").notNull(),
+		createdAt: timestamp("created_at").notNull(),
+		revoked: timestamp("revoked"),
+		confirmation: jsonb("confirmation"),
+		scopes: text("scopes").array().notNull(),
+	},
+	(table) => [
+		index("oauthAccessToken_clientId_idx").on(table.clientId),
+		index("oauthAccessToken_sessionId_idx").on(table.sessionId),
+		index("oauthAccessToken_userId_idx").on(table.userId),
+		index("oauthAccessToken_authorizationCodeId_idx").on(
+			table.authorizationCodeId,
+		),
+		index("oauthAccessToken_refreshId_idx").on(table.refreshId),
+	],
+);
+
+export const oauthConsent = pgTable(
+	"oauth_consent",
+	{
+		id: text("id").primaryKey(),
+		clientId: text("client_id")
+			.notNull()
+			.references(() => oauthClient.clientId, { onDelete: "cascade" }),
+		userId: text("user_id").references(() => user.id, { onDelete: "cascade" }),
+		referenceId: text("reference_id"),
+		resources: text("resources").array(),
+		requestedUserInfoClaims: text("requested_user_info_claims").array(),
+		scopes: text("scopes").array().notNull(),
+		createdAt: timestamp("created_at").notNull(),
+		updatedAt: timestamp("updated_at").notNull(),
+	},
+	(table) => [
+		index("oauthConsent_clientId_idx").on(table.clientId),
+		index("oauthConsent_userId_idx").on(table.userId),
+	],
+);
+
+export const oauthClientAssertion = pgTable("oauth_client_assertion", {
+	id: text("id").primaryKey(),
+	expiresAt: timestamp("expires_at").notNull(),
+});
+
+export const twoFactor = pgTable(
+	"two_factor",
+	{
+		id: text("id").primaryKey(),
+		secret: text("secret").notNull(),
+		backupCodes: text("backup_codes").notNull(),
+		userId: text("user_id")
+			.notNull()
+			.references(() => user.id, { onDelete: "cascade" }),
+		verified: boolean("verified").default(true),
+		failedVerificationCount: integer("failed_verification_count").default(0),
+		lockedUntil: timestamp("locked_until"),
+	},
+	(table) => [
+		index("twoFactor_secret_idx").on(table.secret),
+		index("twoFactor_userId_idx").on(table.userId),
+	],
+);
+
+export const passkey = pgTable(
+	"passkey",
+	{
+		id: text("id").primaryKey(),
+		name: text("name"),
+		publicKey: text("public_key").notNull(),
+		userId: text("user_id")
+			.notNull()
+			.references(() => user.id, { onDelete: "cascade" }),
+		credentialID: text("credential_id").notNull(),
+		counter: integer("counter").notNull(),
+		deviceType: text("device_type").notNull(),
+		backedUp: boolean("backed_up").notNull(),
+		transports: text("transports"),
+		createdAt: timestamp("created_at"),
+		aaguid: text("aaguid"),
+	},
+	(table) => [
+		index("passkey_userId_idx").on(table.userId),
+		index("passkey_credentialID_idx").on(table.credentialID),
+	],
+);
+
+export const userRelations = relations(user, ({ many }) => ({
+	sessions: many(session),
+	accounts: many(account),
+	oauthClients: many(oauthClient),
+	oauthRefreshTokens: many(oauthRefreshToken),
+	oauthAccessTokens: many(oauthAccessToken),
+	oauthConsents: many(oauthConsent),
+	twoFactors: many(twoFactor),
+	passkeys: many(passkey),
+}));
+
+export const sessionRelations = relations(session, ({ one, many }) => ({
+	user: one(user, {
+		fields: [session.userId],
+		references: [user.id],
+	}),
+	oauthRefreshTokens: many(oauthRefreshToken),
+	oauthAccessTokens: many(oauthAccessToken),
+}));
+
+export const accountRelations = relations(account, ({ one }) => ({
+	user: one(user, {
+		fields: [account.userId],
+		references: [user.id],
+	}),
+}));
+
+export const oauthClientRelations = relations(oauthClient, ({ one, many }) => ({
+	user: one(user, {
+		fields: [oauthClient.userId],
+		references: [user.id],
+	}),
+	oauthClientResources: many(oauthClientResource),
+	oauthRefreshTokens: many(oauthRefreshToken),
+	oauthAccessTokens: many(oauthAccessToken),
+	oauthConsents: many(oauthConsent),
+}));
+
+export const oauthResourceRelations = relations(oauthResource, ({ many }) => ({
+	oauthClientResources: many(oauthClientResource),
+}));
+
+export const oauthClientResourceRelations = relations(
+	oauthClientResource,
+	({ one }) => ({
+		oauthClient: one(oauthClient, {
+			fields: [oauthClientResource.clientId],
+			references: [oauthClient.clientId],
+		}),
+		oauthResource: one(oauthResource, {
+			fields: [oauthClientResource.resourceId],
+			references: [oauthResource.identifier],
+		}),
+	}),
+);
+
+export const oauthRefreshTokenRelations = relations(
+	oauthRefreshToken,
+	({ one, many }) => ({
+		oauthClient: one(oauthClient, {
+			fields: [oauthRefreshToken.clientId],
+			references: [oauthClient.clientId],
+		}),
+		session: one(session, {
+			fields: [oauthRefreshToken.sessionId],
+			references: [session.id],
+		}),
+		user: one(user, {
+			fields: [oauthRefreshToken.userId],
+			references: [user.id],
+		}),
+		oauthAccessTokens: many(oauthAccessToken),
+	}),
+);
+
+export const oauthAccessTokenRelations = relations(
+	oauthAccessToken,
+	({ one }) => ({
+		oauthClient: one(oauthClient, {
+			fields: [oauthAccessToken.clientId],
+			references: [oauthClient.clientId],
+		}),
+		session: one(session, {
+			fields: [oauthAccessToken.sessionId],
+			references: [session.id],
+		}),
+		user: one(user, {
+			fields: [oauthAccessToken.userId],
+			references: [user.id],
+		}),
+		oauthRefreshToken: one(oauthRefreshToken, {
+			fields: [oauthAccessToken.refreshId],
+			references: [oauthRefreshToken.id],
+		}),
+	}),
+);
+
+export const oauthConsentRelations = relations(oauthConsent, ({ one }) => ({
+	oauthClient: one(oauthClient, {
+		fields: [oauthConsent.clientId],
+		references: [oauthClient.clientId],
+	}),
+	user: one(user, {
+		fields: [oauthConsent.userId],
+		references: [user.id],
+	}),
+}));
+
+export const twoFactorRelations = relations(twoFactor, ({ one }) => ({
+	user: one(user, {
+		fields: [twoFactor.userId],
+		references: [user.id],
+	}),
+}));
+
+export const passkeyRelations = relations(passkey, ({ one }) => ({
+	user: one(user, {
+		fields: [passkey.userId],
+		references: [user.id],
+	}),
+}));

package/template/src/db/helper.ts

@@ -0,0 +1,38 @@
+import { sql } from "drizzle-orm";
+import type { Database, DatabaseTx } from ".";
+
+export async function setRlsUserId(
+	tx: DatabaseTx,
+	userId: string,
+): Promise<void> {
+	await tx.execute(sql`SELECT set_config('app.user_id', ${userId}, true)`);
+}
+
+// SECURITY: `app.service` is a USERSET GUC that is_admin() and the RLS bypass
+// trust. The app role is NOBYPASSRLS, so a SQL injection that can SET this GUC
+// could escalate. Mitigate with parameterized queries only; a dedicated
+// BYPASSRLS service role is a later hardening step.
+export async function setRlsService(tx: DatabaseTx): Promise<void> {
+	await tx.execute(sql`SELECT set_config('app.service', 'true', true)`);
+}
+
+export function withRlsUser<T>(
+	db: Database,
+	userId: string,
+	fn: (tx: Database) => T | Promise<T>,
+): Promise<T> {
+	return db.transaction(async (tx) => {
+		await setRlsUserId(tx, userId);
+		return fn(tx as unknown as Database);
+	});
+}
+
+export function withRlsService<T>(
+	db: Database,
+	fn: (tx: Database) => T | Promise<T>,
+): Promise<T> {
+	return db.transaction(async (tx) => {
+		await setRlsService(tx);
+		return fn(tx as unknown as Database);
+	});
+}