@1auth/store-sql 0.0.0-alpha.8 → 0.0.0-rc.0

package/README.md

@@ -0,0 +1,44 @@
+<div align="center">
+  <h1>@1auth/store-sql</h1>
+  <!--<img alt="1auth logo" src="https://raw.githubusercontent.com/willfarrell/1auth/main/docs/img/logo.svg"/>-->
+  <p><strong>Generic SQL storage implementation for any client exposing a query method</strong></p>
+<p>
+  <a href="https://github.com/willfarrell/1auth/actions/workflows/test-unit.yml"><img src="https://github.com/willfarrell/1auth/actions/workflows/test-unit.yml/badge.svg" alt="GitHub Actions unit test status"></a>
+  <a href="https://github.com/willfarrell/1auth/actions/workflows/test-dast.yml"><img src="https://github.com/willfarrell/1auth/actions/workflows/test-dast.yml/badge.svg" alt="GitHub Actions dast test status"></a>
+  <a href="https://github.com/willfarrell/1auth/actions/workflows/test-perf.yml"><img src="https://github.com/willfarrell/1auth/actions/workflows/test-perf.yml/badge.svg" alt="GitHub Actions perf test status"></a>
+  <a href="https://github.com/willfarrell/1auth/actions/workflows/test-sast.yml"><img src="https://github.com/willfarrell/1auth/actions/workflows/test-sast.yml/badge.svg" alt="GitHub Actions SAST test status"></a>
+  <a href="https://github.com/willfarrell/1auth/actions/workflows/test-lint.yml"><img src="https://github.com/willfarrell/1auth/actions/workflows/test-lint.yml/badge.svg" alt="GitHub Actions lint test status"></a>
+  <br/>
+  <a href="https://www.npmjs.com/package/@1auth/store-sql"><img alt="npm version" src="https://img.shields.io/npm/v/@1auth/store-sql.svg"></a>
+  <a href="https://packagephobia.com/result?p=@1auth/store-sql"><img src="https://packagephobia.com/badge?p=@1auth/store-sql" alt="npm install size"></a>
+  <a href="https://www.npmjs.com/package/@1auth/store-sql">
+  <img alt="npm weekly downloads" src="https://img.shields.io/npm/dw/@1auth/store-sql.svg"></a>
+  <a href="https://www.npmjs.com/package/@1auth/store-sql#provenance">
+  <img alt="npm provenance" src="https://img.shields.io/badge/provenance-Yes-brightgreen"></a>
+  <br/>
+  <a href="https://scorecard.dev/viewer/?uri=github.com/willfarrell/1auth"><img src="https://api.scorecard.dev/projects/github.com/willfarrell/1auth/badge" alt="Open Source Security Foundation (OpenSSF) Scorecard"></a>
+  <a href="https://slsa.dev"><img src="https://slsa.dev/images/gh-badge-level3.svg" alt="SLSA 3"></a>
+  <a href="https://github.com/willfarrell/1auth/blob/main/docs/CODE_OF_CONDUCT.md"><img src="https://img.shields.io/badge/Contributor%20Covenant-2.1-4baaaa.svg"></a>
+  <a href="https://biomejs.dev"><img alt="Checked with Biome" src="https://img.shields.io/badge/Checked_with-Biome-60a5fa?style=flat&logo=biome"></a>
+  <a href="https://conventionalcommits.org"><img alt="Conventional Commits" src="https://img.shields.io/badge/Conventional%20Commits-1.0.0-%23FE5196?logo=conventionalcommits&logoColor=white"></a>
+</p>
+<p>You can read the documentation at: <a href="https://1auth.js.org">https://1auth.js.org</a></p>
+</div>
+
+## Install
+
+```bash
+npm install @1auth/store-sql
+```
+
+## Documentation and examples
+
+For documentation and examples, refer to the main [1auth monorepo on GitHub](https://github.com/willfarrell/1auth) or the [1auth website](https://1auth.js.org).
+
+## Contributing
+
+Everyone is very welcome to contribute to this repository. Feel free to [raise issues](https://github.com/willfarrell/1auth/issues) or to [submit Pull Requests](https://github.com/willfarrell/1auth/pulls).
+
+## License
+
+Licensed under [MIT License](LICENSE). Copyright (c) 2020-2026 [will Farrell](https://github.com/willfarrell) and [contributors](https://github.com/willfarrell/1auth/graphs/contributors).

package/index.js

@@ -1,101 +1,262 @@
+// Copyright 2003 - 2026 will Farrell, and 1Auth contributors.
+// SPDX-License-Identifier: MIT
+
+// Generic SQL store, usable on its own against any client exposing
+//   query(sql, parameters) -> rows[]
+// The dialect-specific backends (@1auth/store-postgres, @1auth/store-sqlite,
+// @1auth/store-d1) each carry their own copy of this, customized for their
+// placeholder style and client shape, so none of them depend on this package.
+
 const options = {
-  log: false,
-  useGeneratedIdentityAsId: false, // aka SERIAL
-  query: (sql, parameters) => {
-    console.log('sql', sql, parameters)
-    return {}
-  }
-}
-
-export default (params) => {
-  Object.assign(options, params)
-}
+	id: "sql",
+	// Stryker disable next-line BooleanLiteral: overwritten by default() before observation
+	log: false,
+	// Stryker disable next-line ObjectLiteral: overwritten by default() before observation
+	client: { query: undefined }, // async (sql, parameters) => rows[]
+	// number of seconds after expire before removal
+	// 10d chosen based on EFF DNT Policy
+	timeToLiveExpireOffset: 10 * 24 * 60 * 60,
+	timeToLiveKey: "remove",
+	placeholder: "?",
+};
+
+export default (opt = {}) => {
+	Object.assign(options, opt);
+};
 
 export const exists = async (table, filters) => {
-  const item = await select(table, filters)
-  return item?.sub
-}
+	log(options, "exists", table, filters);
+	const { select, where, parameters } = makeSqlParts(filters, {}, ["sub"]);
+	const sql = `SELECT ${select} FROM ${table} ${where} LIMIT 1`;
+	const res = await options.client.query(sql, parameters);
+	return res?.[0]?.sub;
+};
 
-export const selectList = async (table, filters = {}, fields = []) => {
-  const { select, where, parameters } = makeSqlParts(filters, {}, fields)
-  const sql = `SELECT ${select} FROM ${table} ${where}`
-  return await options.query(sql, parameters)
-}
+export const count = async (table, filters = {}) => {
+	log(options, "count", table, filters);
+	const { where, parameters } = makeSqlParts(filters, {});
+	const sql = `SELECT COUNT(*) AS count FROM ${table} ${where}`;
+	const res = await options.client.query(sql, parameters);
+	return Number(res[0].count);
+};
 
 export const select = async (table, filters = {}, fields = []) => {
-  const { select, where, parameters } = makeSqlParts(filters, {}, fields)
-  const sql = `SELECT ${select} FROM ${table} ${where} LIMIT 1`
-  return await options.query(sql, parameters).then((res) => res[0])
-}
-
-export const insert = async (table, values = {}) => {
-  if (options.useGeneratedIdentityAsId) {
-    delete values.id
-  }
-  normalizeValues(values)
-  const { insert, parameters } = makeSqlParts({}, values)
-  const sql = `INSERT INTO ${table} ${insert}`
-  return await options.query(sql, parameters)
-}
-
-export const update = async (table, filters = {}, values = {}) => {
-  normalizeValues(values)
-  const { update, where, parameters } = makeSqlParts(filters, values)
-  const sql = `UPDATE ${table} SET ${update} ${where}`
-  await options.query(sql, parameters)
-}
+	log(options, "select", table, filters, fields);
+	const { select, where, parameters } = makeSqlParts(filters, {}, fields);
+	const sql = `SELECT ${select} FROM ${table} ${where} LIMIT 1`;
+	const res = await options.client.query(sql, parameters);
+	const row = res?.[0];
+	// Workaround because an expire filter doesn't exist yet
+	parseValues(row);
+	return row;
+};
+
+export const selectList = async (table, filters = {}, fields = []) => {
+	log(options, "selectList", table, filters, fields);
+	const { select, where, parameters } = makeSqlParts(filters, {}, fields);
+	const sql = `SELECT ${select} FROM ${table} ${where}`;
+	const rows = await options.client.query(sql, parameters);
+	// Workaround because an expire filter doesn't exist yet
+	return rows.map((row) => {
+		parseValues(row);
+		return row;
+	});
+};
+
+export const insert = async (table, inputValues = {}) => {
+	const values = makeValues(inputValues, options);
+	log(options, "insert", table, values);
+	const { insert, parameters } = makeSqlParts({}, values);
+	const sql = `INSERT INTO ${table} ${insert} RETURNING id`;
+	const res = await options.client.query(sql, parameters);
+	return res[0].id;
+};
+
+export const insertList = async (table, rows = []) => {
+	log(options, "insertList", table, rows);
+	if (!rows.length) return [];
+	const { insert, parameters } = makeInsertList(
+		options.placeholder,
+		rows.map((row) => makeValues(row, options)),
+	);
+	const sql = `INSERT INTO ${table} ${insert} RETURNING id`;
+	return await options.client.query(sql, parameters);
+};
+
+export const update = async (table, filters = {}, inputValues = {}) => {
+	const values = makeValues(inputValues, options);
+	log(options, "update", table, filters, values);
+	const { update, where, parameters } = makeSqlParts(filters, values);
+	const sql = `UPDATE ${table} SET ${update} ${where}`;
+	await options.client.query(sql, parameters);
+};
+
+export const updateList = async (table, filtersList = [], values = {}) => {
+	log(options, "updateList", table, filtersList, values);
+	return await Promise.allSettled(
+		filtersList.map((filters) => update(table, filters, values)),
+	);
+};
 
 export const remove = async (table, filters = {}) => {
-  const { where, parameters } = makeSqlParts(filters)
-  const sql = `DELETE FROM ${table} ${where}`
-  await options.query(sql, parameters)
-}
-
-const normalizeValues = (values) => {
-  values.create &&= new Date(values.create * 1000).toISOString()
-  values.update &&= new Date(values.update * 1000).toISOString()
-  values.verify &&= new Date(values.verify * 1000).toISOString()
-  values.expire &&= new Date(values.expire * 1000).toISOString()
-}
+	log(options, "remove", table, filters);
+	const { where, parameters } = makeSqlParts(filters);
+	const sql = `DELETE FROM ${table} ${where} RETURNING id`;
+	const res = await options.client.query(sql, parameters);
+	return !!res?.[0]?.id;
+};
+
+export const removeList = remove;
+
+// --- builders -------------------------------------------------------------
+// The `*For` variants take the placeholder explicitly; the bound pair at the
+// bottom reads this store's options.
+
+export const log = (options, method, ...args) => {
+	if (options.log) {
+		options.log(`@1auth/store-${options.id} ${method}(`, ...args, ")");
+	}
+};
+
+export const getPlaceholderFor = (placeholder, idx) => {
+	return placeholder === "$" ? `$${idx}` : placeholder;
+};
+
+export const makeSqlPartsFor = (
+	placeholder,
+	filters = {},
+	values = {},
+	fields = [],
+	idxStart = 1,
+) => {
+	let idx = idxStart;
+	let parameters = [];
+	const keys = Object.keys(values);
+
+	const select = fields.length ? `"${fields.join('", "')}"` : "*";
+
+	const insertParts = [];
+	const updateParts = [];
+	for (const key of keys) {
+		insertParts.push(getPlaceholderFor(placeholder, idx));
+		updateParts.push(`"${key}" = ${getPlaceholderFor(placeholder, idx)}`);
+		idx++;
+	}
+	const insert = `("${keys.join('", "')}") VALUES (${insertParts.join(",")})`;
+	const update = updateParts.join(", ");
+	parameters = parameters.concat(Object.values(values));
+
+	let where = Object.keys(filters)
+		.map((key) => {
+			const value = filters[key];
+			if (typeof value === "undefined") {
+				return null;
+			}
+			if (Array.isArray(value)) {
+				let sql = value
+					.map(() => getPlaceholderFor(placeholder, idx++))
+					.join(",");
+				sql &&= `"${key}" IN (${sql})`;
+				parameters = parameters.concat(value);
+				return sql;
+			}
+			const sql = `"${key}" = ${getPlaceholderFor(placeholder, idx++)}`;
+			parameters.push(value);
+			return sql;
+		})
+		.filter((v) => v)
+		.join(" AND ");
+	where &&= `WHERE ${where}`;
+
+	return { select, insert, update, where, parameters };
+};
+
+// Single multi-row `("a", "b") VALUES (?,?),(?,?)` for drivers that batch in one statement
+export const makeInsertList = (placeholder, valuesList) => {
+	const insertValues = [];
+	let insertParameters = [];
+	for (let i = 0, l = valuesList.length; i < l; i++) {
+		const values = valuesList[i];
+		const { insert, parameters } = makeSqlPartsFor(
+			placeholder,
+			{},
+			values,
+			undefined, // no fields: `select` is unused here
+			i * Object.keys(values).length + 1,
+		);
+		if (i) {
+			insertValues.push(insert.split("VALUES")[1]); // (?)
+		} else {
+			insertValues.push(insert); // (name) VALUES (?)
+		}
+
+		insertParameters = insertParameters.concat(parameters);
+	}
+
+	return { insert: insertValues.join(","), parameters: insertParameters };
+};
+
+export const withTimeToLive = (values, options) => {
+	if (
+		values.expire &&
+		options.timeToLiveKey &&
+		values[options.timeToLiveKey] == null
+	) {
+		values[options.timeToLiveKey] =
+			values.expire + options.timeToLiveExpireOffset;
+	}
+	return values;
+};
+
+// structuredClone + timeToLive + normalize, applied to each row of a write
+export const makeValues = (inputValues, options) => {
+	const values = structuredClone(inputValues);
+	withTimeToLive(values, options);
+	normalizeValues(values);
+	return values;
+};
+
+export const normalizeValues = (values) => {
+	if (!values) return;
+	if (Object.hasOwn(values, "otp")) {
+		values.otp = values.otp ? 1 : 0;
+	}
+	values.create &&= new Date(values.create * 1000).toISOString();
+	values.update &&= new Date(values.update * 1000).toISOString();
+	values.verify &&= new Date(values.verify * 1000).toISOString();
+	values.lastused &&= new Date(values.lastused * 1000).toISOString();
+	values.expire &&= new Date(values.expire * 1000).toISOString();
+	values.remove &&= new Date(values.remove * 1000).toISOString();
+	for (const [key, v] of Object.entries(values)) {
+		// Stryker disable next-line ConditionalExpression,StringLiteral: dropping the
+		// string guard is an equivalent mutant -- strings then fall through to
+		// String(v), which returns them unchanged.
+		if (v !== null && typeof v !== "string" && typeof v !== "number") {
+			values[key] =
+				v === undefined
+					? null
+					: typeof v === "object"
+						? JSON.stringify(v)
+						: String(v);
+		}
+	}
+};
+
+export const parseValues = (values) => {
+	if (!values) return;
+	if (typeof values.otp === "number") {
+		values.otp = !!values.otp;
+	}
+	values.create &&= Date.parse(values.create) / 1000;
+	values.update &&= Date.parse(values.update) / 1000;
+	values.verify &&= Date.parse(values.verify) / 1000;
+	values.lastused &&= Date.parse(values.lastused) / 1000;
+	values.expire &&= Date.parse(values.expire) / 1000;
+	values.remove &&= Date.parse(values.remove) / 1000;
+};
 
 // export for testing
-export const makeSqlParts = (filters = {}, values = {}, fields = []) => {
-  let parameters = []
-  let idx = 1
-  const keys = Object.keys(values)
-
-  const select = fields.length ? fields.join(', ') : '*'
-
-  const insertParts = []
-  const updateParts = []
-  for (const key of keys) {
-    insertParts.push('$' + idx)
-    updateParts.push(key + ' = $' + idx)
-    idx++
-  }
-
-  const insert =
-    '("' + keys.join('", "') + '") VALUES (' + insertParts.join(', ') + ')'
-
-  const update = updateParts.join(', ')
-
-  parameters = parameters.concat(Object.values(values))
-
-  let where = Object.keys(filters)
-  where = where
-    .map((key) => {
-      if (Array.isArray(filters[key])) {
-        let sql = filters[key].map((v, vidx) => '$' + idx++).join(',')
-        sql = key + ' IN (' + sql + ')'
-        parameters = parameters.concat(filters[key])
-        return sql
-      }
-      const sql = key + ' = $' + idx++
-      parameters.push(filters[key])
-      return sql
-    })
-    .join(' AND ')
-  where &&= `WHERE ${where}`
-
-  return { select, insert, update, where, parameters }
-}
+export const getPlaceholder = (idx) =>
+	getPlaceholderFor(options.placeholder, idx);
+export const makeSqlParts = (filters, values, fields, idxStart) =>
+	makeSqlPartsFor(options.placeholder, filters, values, fields, idxStart);

package/package.json

@@ -1,57 +1,58 @@
 {
-  "name": "@1auth/store-sql",
-  "version": "0.0.0-alpha.8",
-  "description": "",
-  "type": "module",
-  "engines": {
-    "node": ">=16"
-  },
-  "engineStrict": true,
-  "publishConfig": {
-    "access": "public"
-  },
-  "main": "./index.js",
-  "module": "./index.js",
-  "exports": {
-    ".": {
-      "import": {
-        "types": "./index.d.ts",
-        "default": "./index.js"
-      }
-    }
-  },
-  "types": "index.d.ts",
-  "files": [
-    "index.js",
-    "index.d.ts"
-  ],
-  "scripts": {
-    "test": "npm run test:unit",
-    "test:unit": "ava"
-  },
-  "license": "MIT",
-  "funding": {
-    "type": "github",
-    "url": "https://github.com/sponsors/willfarrell"
-  },
-  "keywords": [],
-  "author": {
-    "name": "1auth contributors",
-    "url": "https://github.com/willfarrell/1auth/graphs/contributors"
-  },
-  "repository": {
-    "type": "git",
-    "url": "github:willfarrell/1auth",
-    "directory": "packages/store-dynamodb"
-  },
-  "bugs": {
-    "url": "https://github.com/willfarrell/1auth/issues"
-  },
-  "homepage": "https://github.com/willfarrell/1auth",
-  "gitHead": "d21e1013f55ed05af4daf980bc4dfdfd52538792",
-  "peerDependencies": {
-    "@aws-sdk/client-dynamodb": "^3.0.0",
-    "@aws-sdk/util-dynamodb": "^3.0.0",
-    "uuid": "9.0.0"
-  }
+	"name": "@1auth/store-sql",
+	"version": "0.0.0-rc.0",
+	"description": "Generic SQL storage implementation for any client exposing a query method",
+	"type": "module",
+	"engines": {
+		"node": ">=24"
+	},
+	"engineStrict": true,
+	"publishConfig": {
+		"access": "public"
+	},
+	"main": "./index.js",
+	"module": "./index.js",
+	"sideEffects": false,
+	"exports": {
+		".": {
+			"import": "./index.js"
+		},
+		"./table/*": {
+			"import": "./table/*"
+		}
+	},
+	"files": [
+		"index.js",
+		"table"
+	],
+	"scripts": {
+		"test": "npm run test:unit",
+		"test:unit": "node --test"
+	},
+	"license": "MIT",
+	"funding": {
+		"type": "github",
+		"url": "https://github.com/sponsors/willfarrell"
+	},
+	"keywords": [
+		"1auth",
+		"OWASP",
+		"ASVS",
+		"SQL",
+		"database"
+	],
+	"author": {
+		"name": "1auth contributors",
+		"url": "https://github.com/willfarrell/1auth/graphs/contributors"
+	},
+	"repository": {
+		"type": "git",
+		"url": "git+https://github.com/willfarrell/1auth.git",
+		"directory": "packages/store-sql"
+	},
+	"bugs": {
+		"url": "https://github.com/willfarrell/1auth/issues"
+	},
+	"homepage": "https://github.com/willfarrell/1auth",
+	"dependencies": {}
 }

package/table/sql.js

@@ -0,0 +1,53 @@
+// Copyright 2003 - 2026 will Farrell, and 1Auth contributors.
+// SPDX-License-Identifier: MIT
+export const name = "test";
+export const timeToLiveKey = "remove";
+export const create = async (client, table = name) => {
+	const sql = `
+  CREATE TABLE IF NOT EXISTS ${table}
+  (
+    "id"     INTEGER PRIMARY KEY AUTOINCREMENT,
+    "sub"    VARCHAR(15)              NOT NULL,
+    "value"  VARCHAR(256)             NOT NULL,
+    "digest" VARCHAR(256)             DEFAULT NULL,
+    "otp"    INTEGER                  DEFAULT NULL,
+
+    "create"           TIMESTAMP WITH TIME ZONE DEFAULT NULL,
+    "update"           TIMESTAMP WITH TIME ZONE DEFAULT NULL,
+    "verify"           TIMESTAMP WITH TIME ZONE DEFAULT NULL,
+    "lastused"         TIMESTAMP WITH TIME ZONE DEFAULT NULL,
+    "expire"           TIMESTAMP WITH TIME ZONE DEFAULT NULL,
+    "${timeToLiveKey}" TIMESTAMP WITH TIME ZONE DEFAULT NULL
+  )
+  `;
+	return await client.query(sql);
+};
+
+export const truncate = async (client, table = name) => {
+	const sql = `
+    DELETE FROM ${table};
+  `;
+	return await client.query(sql);
+};
+
+export const drop = async (client, table = name) => {
+	const sql = `
+    DROP TABLE IF EXISTS ${table};
+  `;
+	return await client.query(sql);
+};
+
+export const emptyRow = () =>
+	Object.assign(Object.create(null), {
+		id: 0,
+		sub: null,
+		value: null,
+		digest: null,
+		otp: null,
+		create: null,
+		update: null,
+		verify: null,
+		lastused: null,
+		expire: null,
+		remove: null,
+	});

package/LICENSE

@@ -1,21 +0,0 @@
-MIT License
-
-Copyright (c) 2023 will Farrell
-
-Permission is hereby granted, free of charge, to any person obtaining a copy
-of this software and associated documentation files (the "Software"), to deal
-in the Software without restriction, including without limitation the rights
-to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
-copies of the Software, and to permit persons to whom the Software is
-furnished to do so, subject to the following conditions:
-
-The above copyright notice and this permission notice shall be included in all
-copies or substantial portions of the Software.
-
-THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
-IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
-FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
-AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
-LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
-OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
-SOFTWARE.