@_mustachio/openauth 0.9.2 → 0.11.0

package/src/adapters/postgres/migrations.ts

@@ -0,0 +1,131 @@
+/**
+ * Postgres schema for the IdP adapters. One migration; future schema changes
+ * append new migrations and a small migrate-from-version routine.
+ *
+ * Tables are prefixed `openauth_` so the IdP can share a database with the
+ * application that consumes it. The schema is intentionally narrow — JSONB
+ * blobs carry the bulk of the data (auth-code ciphertext, refresh payload,
+ * tenant config) so that adding fields in later phases is non-breaking.
+ *
+ * Timestamps are `bigint` (epoch ms) rather than `timestamptz` so that the
+ * adapter's injectable clock works seamlessly in tests and so that
+ * comparisons are simple integer math.
+ */
+import type { PostgresExecutor } from "./executor"
+
+export const INITIAL_SCHEMA_SQL = `
+CREATE TABLE IF NOT EXISTS openauth_tenants (
+  id text PRIMARY KEY,
+  config jsonb NOT NULL,
+  updated_at bigint NOT NULL
+);
+
+CREATE TABLE IF NOT EXISTS openauth_methods (
+  tenant_id text NOT NULL,
+  method_id text NOT NULL,
+  config jsonb NOT NULL,
+  updated_at bigint NOT NULL,
+  PRIMARY KEY (tenant_id, method_id)
+);
+
+CREATE TABLE IF NOT EXISTS openauth_signing_keys (
+  kid text PRIMARY KEY,
+  alg text NOT NULL,
+  crv text,
+  public_jwk jsonb NOT NULL,
+  private_jwk jsonb NOT NULL,
+  private_jwk_wrapped boolean NOT NULL DEFAULT false,
+  status text NOT NULL,
+  created_at bigint NOT NULL,
+  rotated_at bigint
+);
+
+ALTER TABLE openauth_signing_keys
+  ADD COLUMN IF NOT EXISTS private_jwk_wrapped boolean NOT NULL DEFAULT false;
+
+CREATE TABLE IF NOT EXISTS openauth_encryption_keys (
+  kid text PRIMARY KEY,
+  alg text NOT NULL,
+  key_material bytea NOT NULL,
+  key_material_wrapped boolean NOT NULL DEFAULT false,
+  status text NOT NULL,
+  created_at bigint NOT NULL,
+  rotated_at bigint
+);
+
+ALTER TABLE openauth_encryption_keys
+  ADD COLUMN IF NOT EXISTS key_material_wrapped boolean NOT NULL DEFAULT false;
+
+CREATE TABLE IF NOT EXISTS openauth_codes (
+  code text PRIMARY KEY,
+  ciphertext text NOT NULL,
+  expires_at bigint NOT NULL
+);
+
+CREATE TABLE IF NOT EXISTS openauth_refresh_tokens (
+  token text PRIMARY KEY,
+  tenant_id text NOT NULL,
+  client_id text NOT NULL,
+  subject_id text NOT NULL,
+  family text NOT NULL,
+  expires_at bigint NOT NULL,
+  consumed_at bigint,
+  payload jsonb NOT NULL
+);
+CREATE INDEX IF NOT EXISTS openauth_refresh_family_idx
+  ON openauth_refresh_tokens (family);
+CREATE INDEX IF NOT EXISTS openauth_refresh_subject_idx
+  ON openauth_refresh_tokens (tenant_id, subject_id);
+
+CREATE TABLE IF NOT EXISTS openauth_flows (
+  flow_id text PRIMARY KEY,
+  payload jsonb NOT NULL,
+  expires_at bigint NOT NULL
+);
+
+CREATE TABLE IF NOT EXISTS openauth_sessions (
+  session_id text PRIMARY KEY,
+  payload jsonb NOT NULL,
+  expires_at bigint NOT NULL
+);
+
+CREATE TABLE IF NOT EXISTS openauth_audit_events (
+  id bigserial PRIMARY KEY,
+  ts bigint NOT NULL,
+  kind text NOT NULL,
+  payload jsonb NOT NULL
+);
+CREATE INDEX IF NOT EXISTS openauth_audit_kind_idx
+  ON openauth_audit_events (kind);
+CREATE INDEX IF NOT EXISTS openauth_audit_ts_idx
+  ON openauth_audit_events (ts);
+
+CREATE TABLE IF NOT EXISTS openauth_passkey_credentials (
+  tenant_id text NOT NULL,
+  credential_id text NOT NULL,
+  user_id text NOT NULL,
+  public_key text NOT NULL,
+  counter bigint NOT NULL DEFAULT 0,
+  transports jsonb,
+  created_at bigint NOT NULL,
+  PRIMARY KEY (tenant_id, credential_id)
+);
+CREATE INDEX IF NOT EXISTS openauth_passkey_user_idx
+  ON openauth_passkey_credentials (tenant_id, user_id);
+`
+
+/**
+ * Apply the initial schema. Idempotent — uses `CREATE TABLE IF NOT EXISTS`.
+ * Deployments using a real migration tool can apply the SQL above directly
+ * and skip this helper.
+ */
+export async function migrate(exec: PostgresExecutor): Promise<void> {
+  // Some drivers reject a single multi-statement string; PGlite accepts it.
+  // Split on the blank line separator + semicolon to handle either case.
+  const statements = INITIAL_SCHEMA_SQL.split(/;\s*\n/).filter(
+    (s) => s.trim().length > 0,
+  )
+  for (const stmt of statements) {
+    await exec.query(stmt + ";")
+  }
+}

package/src/adapters/postgres/passkey-credential-store.ts

@@ -0,0 +1,150 @@
+/**
+ * Postgres `PasskeyCredentialStore`.
+ *
+ * Schema (created by `migrate()` in `./migrations.ts`):
+ *
+ *   openauth_passkey_credentials
+ *     tenant_id   text  NOT NULL
+ *     credential_id text NOT NULL
+ *     user_id     text  NOT NULL
+ *     public_key  text  NOT NULL
+ *     counter     bigint NOT NULL DEFAULT 0
+ *     transports  jsonb
+ *     created_at  bigint NOT NULL
+ *     PRIMARY KEY (tenant_id, credential_id)
+ *     INDEX (tenant_id, user_id)   -- findByUsername path
+ *
+ * The reference adapter treats `userId` as the username lookup key —
+ * matching the bundled `passkeyMethod` which sets `userId =
+ * parsed.data.username` at registration. Hosts that want a separate
+ * username dimension implement `PasskeyCredentialStore` directly
+ * against their own user table.
+ */
+import type {
+  PasskeyCredentialStore,
+  StoredCredential,
+} from "../../methods/passkey"
+
+import type { PostgresExecutor } from "./executor"
+
+export type PostgresPasskeyCredentialStoreOptions = {
+  exec: PostgresExecutor
+  clock?: () => number
+}
+
+type Row = {
+  credential_id: string
+  user_id: string
+  public_key: string
+  counter: string | number
+  transports: unknown
+}
+
+export class PostgresPasskeyCredentialStore implements PasskeyCredentialStore {
+  #exec: PostgresExecutor
+  #clock: () => number
+
+  constructor(opts: PostgresPasskeyCredentialStoreOptions) {
+    this.#exec = opts.exec
+    this.#clock = opts.clock ?? (() => Date.now())
+  }
+
+  async findByUsername(
+    username: string,
+    tenantId: string,
+  ): Promise<{ userId: string; credentials: StoredCredential[] } | null> {
+    const result = await this.#exec.query<Row>(
+      `SELECT credential_id, user_id, public_key, counter, transports
+         FROM openauth_passkey_credentials
+        WHERE tenant_id = $1 AND user_id = $2`,
+      [tenantId, username],
+    )
+    if (result.rows.length === 0) return null
+    return {
+      userId: username,
+      credentials: result.rows.map(rowToCredential),
+    }
+  }
+
+  async findById(
+    credentialId: string,
+    tenantId: string,
+  ): Promise<StoredCredential | null> {
+    const result = await this.#exec.query<Row>(
+      `SELECT credential_id, user_id, public_key, counter, transports
+         FROM openauth_passkey_credentials
+        WHERE tenant_id = $1 AND credential_id = $2`,
+      [tenantId, credentialId],
+    )
+    const row = result.rows[0]
+    if (!row) return null
+    return rowToCredential(row)
+  }
+
+  async updateCounter(input: {
+    credentialId: string
+    counter: number
+    tenantId: string
+  }): Promise<void> {
+    await this.#exec.query(
+      `UPDATE openauth_passkey_credentials
+          SET counter = $1
+        WHERE tenant_id = $2 AND credential_id = $3`,
+      [input.counter, input.tenantId, input.credentialId],
+    )
+  }
+
+  async create(input: {
+    userId: string
+    credential: StoredCredential
+    tenantId: string
+  }): Promise<void> {
+    await this.#exec.query(
+      `INSERT INTO openauth_passkey_credentials
+         (tenant_id, credential_id, user_id, public_key, counter, transports, created_at)
+       VALUES ($1, $2, $3, $4, $5, $6::jsonb, $7)
+       ON CONFLICT (tenant_id, credential_id) DO UPDATE
+         SET public_key = EXCLUDED.public_key,
+             counter = EXCLUDED.counter,
+             transports = EXCLUDED.transports,
+             user_id = EXCLUDED.user_id`,
+      [
+        input.tenantId,
+        input.credential.credentialId,
+        input.userId,
+        input.credential.publicKey,
+        input.credential.counter,
+        input.credential.transports
+          ? JSON.stringify(input.credential.transports)
+          : null,
+        this.#clock(),
+      ],
+    )
+  }
+}
+
+function rowToCredential(row: Row): StoredCredential {
+  const credential: StoredCredential = {
+    credentialId: row.credential_id,
+    publicKey: row.public_key,
+    counter: Number(row.counter),
+    userId: row.user_id,
+  }
+  if (row.transports != null) {
+    credential.transports = parseTransports(row.transports)
+  }
+  return credential
+}
+
+function parseTransports(raw: unknown): string[] {
+  if (Array.isArray(raw)) return raw.map(String)
+  if (typeof raw === "string") {
+    try {
+      const parsed: unknown = JSON.parse(raw)
+      return Array.isArray(parsed) ? parsed.map(String) : []
+    } catch {
+      return []
+    }
+  }
+  return []
+}

package/src/adapters/postgres/session-store.ts

@@ -0,0 +1,216 @@
+/**
+ * Postgres `SessionStore` — flow records + optional long-lived sessions.
+ *
+ * `consumeFlow` is `DELETE … RETURNING payload, expires_at` — atomic
+ * single-winner, returns the full record so the framework can snapshot
+ * fields into the auth-code payload before disposal.
+ *
+ * `updateFlowMethodState` merges new state into the existing JSONB blob via
+ * a single UPDATE (no read-modify-write race).
+ */
+import { authError } from "../../types/error"
+import type { FlowRecord } from "../../types/flow"
+import type { SessionRecord, SessionStore } from "../../ports/session-store"
+import type { Result } from "../../types/result"
+import { err, ok } from "../../types/result"
+
+import type { PostgresExecutor } from "./executor"
+
+export type PostgresSessionStoreOptions = {
+  exec: PostgresExecutor
+  clock?: () => number
+}
+
+export class PostgresSessionStore implements SessionStore {
+  #exec: PostgresExecutor
+  #clock: () => number
+
+  constructor(opts: PostgresSessionStoreOptions) {
+    this.#exec = opts.exec
+    this.#clock = opts.clock ?? (() => Date.now())
+  }
+
+  async saveFlow(
+    flowId: string,
+    payload: FlowRecord,
+    ttl: number,
+  ): Promise<Result<void>> {
+    if (ttl <= 0) {
+      return err(
+        authError.internalError(`saveFlow: ttl must be positive, got ${ttl}`),
+      )
+    }
+    const expiresAt = this.#clock() + ttl
+    try {
+      await this.#exec.query(
+        `INSERT INTO openauth_flows (flow_id, payload, expires_at)
+         VALUES ($1, $2::jsonb, $3)`,
+        [flowId, JSON.stringify(payload), expiresAt],
+      )
+    } catch (e) {
+      return err(authError.internalError("saveFlow: insert failed", e))
+    }
+    return ok(undefined)
+  }
+
+  async updateFlowMethodState(
+    flowId: string,
+    methodState: unknown,
+  ): Promise<Result<void>> {
+    const now = this.#clock()
+    let row: { exists: boolean } | undefined
+    try {
+      // jsonb_set patches the nested key without a read-modify-write race.
+      const result = await this.#exec.query<{ exists: boolean }>(
+        `UPDATE openauth_flows
+            SET payload = jsonb_set(payload, '{methodState}', $1::jsonb, true)
+          WHERE flow_id = $2 AND expires_at > $3
+          RETURNING true AS exists`,
+        [JSON.stringify(methodState), flowId, now],
+      )
+      row = result.rows[0]
+    } catch (e) {
+      return err(
+        authError.internalError("updateFlowMethodState: update failed", e),
+      )
+    }
+    if (!row) {
+      return err(authError.unknownState(`flow "${flowId}" unknown or expired`))
+    }
+    return ok(undefined)
+  }
+
+  async readFlow(flowId: string): Promise<Result<FlowRecord>> {
+    let row: { payload: unknown; expires_at: string | number } | undefined
+    try {
+      const result = await this.#exec.query<{
+        payload: unknown
+        expires_at: string | number
+      }>(`SELECT payload, expires_at FROM openauth_flows WHERE flow_id = $1`, [
+        flowId,
+      ])
+      row = result.rows[0]
+    } catch (e) {
+      return err(authError.internalError("readFlow: query failed", e))
+    }
+    if (!row) {
+      return err(authError.unknownState(`flow "${flowId}" unknown`))
+    }
+    if (this.#clock() >= Number(row.expires_at)) {
+      // Lazy GC — best-effort delete, don't fail the read if the delete races.
+      try {
+        await this.#exec.query(
+          `DELETE FROM openauth_flows WHERE flow_id = $1`,
+          [flowId],
+        )
+      } catch {}
+      return err(authError.unknownState(`flow "${flowId}" expired`))
+    }
+    return ok(parseFlowRecord(row.payload))
+  }
+
+  async consumeFlow(flowId: string): Promise<Result<FlowRecord>> {
+    let row: { payload: unknown; expires_at: string | number } | undefined
+    try {
+      // Atomic delete-on-read — single-winner under concurrent presentations.
+      const result = await this.#exec.query<{
+        payload: unknown
+        expires_at: string | number
+      }>(
+        `DELETE FROM openauth_flows
+          WHERE flow_id = $1
+          RETURNING payload, expires_at`,
+        [flowId],
+      )
+      row = result.rows[0]
+    } catch (e) {
+      return err(authError.internalError("consumeFlow: query failed", e))
+    }
+    if (!row) {
+      return err(
+        authError.unknownState(`flow "${flowId}" unknown or already consumed`),
+      )
+    }
+    if (this.#clock() >= Number(row.expires_at)) {
+      return err(authError.unknownState(`flow "${flowId}" expired`))
+    }
+    return ok(parseFlowRecord(row.payload))
+  }
+
+  async createSession(
+    sessionId: string,
+    payload: SessionRecord,
+    ttl: number,
+  ): Promise<Result<void>> {
+    if (ttl <= 0) {
+      return err(
+        authError.internalError(
+          `createSession: ttl must be positive, got ${ttl}`,
+        ),
+      )
+    }
+    const expiresAt = this.#clock() + ttl
+    try {
+      await this.#exec.query(
+        `INSERT INTO openauth_sessions (session_id, payload, expires_at)
+         VALUES ($1, $2::jsonb, $3)
+         ON CONFLICT (session_id) DO UPDATE SET payload = EXCLUDED.payload, expires_at = EXCLUDED.expires_at`,
+        [sessionId, JSON.stringify(payload), expiresAt],
+      )
+    } catch (e) {
+      return err(authError.internalError("createSession: insert failed", e))
+    }
+    return ok(undefined)
+  }
+
+  async readSession(sessionId: string): Promise<Result<SessionRecord>> {
+    let row: { payload: unknown; expires_at: string | number } | undefined
+    try {
+      const result = await this.#exec.query<{
+        payload: unknown
+        expires_at: string | number
+      }>(
+        `SELECT payload, expires_at FROM openauth_sessions WHERE session_id = $1`,
+        [sessionId],
+      )
+      row = result.rows[0]
+    } catch (e) {
+      return err(authError.internalError("readSession: query failed", e))
+    }
+    if (!row) {
+      return err(authError.invalidRequest(`session "${sessionId}" unknown`))
+    }
+    if (this.#clock() >= Number(row.expires_at)) {
+      try {
+        await this.#exec.query(
+          `DELETE FROM openauth_sessions WHERE session_id = $1`,
+          [sessionId],
+        )
+      } catch {}
+      return err(authError.invalidRequest(`session "${sessionId}" expired`))
+    }
+    return ok(parseSession(row.payload))
+  }
+
+  async revokeSession(sessionId: string): Promise<Result<void>> {
+    try {
+      await this.#exec.query(
+        `DELETE FROM openauth_sessions WHERE session_id = $1`,
+        [sessionId],
+      )
+    } catch (e) {
+      return err(authError.internalError("revokeSession: delete failed", e))
+    }
+    return ok(undefined)
+  }
+}
+
+function parseFlowRecord(raw: unknown): FlowRecord {
+  if (typeof raw === "string") return JSON.parse(raw) as FlowRecord
+  return raw as FlowRecord
+}
+
+function parseSession(raw: unknown): SessionRecord {
+  if (typeof raw === "string") return JSON.parse(raw) as SessionRecord
+  return raw as SessionRecord
+}