@ambushsoftworks/nestjs-auth-graphql 0.17.1 → 0.19.0

package/examples/guest-sessions/prisma-guest-session.repository.ts

@@ -0,0 +1,86 @@
+import { Injectable } from '@nestjs/common';
+import { PrismaClient } from '@prisma/client';
+import {
+  GuestGrantRecord,
+  GuestSessionRecord,
+  GuestSessionWithGrants,
+  IGuestSessionRepository,
+} from '@ambushsoftworks/nestjs-auth-graphql';
+
+/**
+ * IGuestSessionRepository on Prisma, for the models in ./schema.prisma.
+ *
+ * Verified against PostgreSQL 16 with `assertGuestSessionRepositoryContract`
+ * from `@ambushsoftworks/nestjs-auth-graphql/testing`, with and without
+ * realms. Run that contract against your copy, too, on your real database:
+ *
+ *   await assertGuestSessionRepositoryContract(() => new PrismaGuestSessionRepository(prisma), {
+ *     cleanup: async ({ sessionIds, grantIds }) => {
+ *       await prisma.guestGrant.deleteMany({ where: { id: { in: grantIds } } });
+ *       await prisma.guestSession.deleteMany({ where: { id: { in: sessionIds } } });
+ *     },
+ *   });
+ *
+ * Inject your own PrismaService in place of PrismaClient if you have one.
+ */
+@Injectable()
+export class PrismaGuestSessionRepository implements IGuestSessionRepository {
+  constructor(private readonly prisma: PrismaClient) {}
+
+  async createSession(session: GuestSessionRecord, grant: GuestGrantRecord): Promise<void> {
+    const { sessionId: _sessionId, ...firstGrant } = grant;
+    await this.prisma.guestSession.create({
+      data: { ...session, grants: { create: firstGrant } },
+    });
+  }
+
+  /** Every grant, whatever its state: the package decides what revoked and expired mean. */
+  async findSessionByTokenHash(tokenHash: string): Promise<GuestSessionWithGrants | null> {
+    return this.prisma.guestSession.findUnique({ where: { tokenHash }, include: { grants: true } });
+  }
+
+  async addGrant(grant: GuestGrantRecord): Promise<void> {
+    await this.prisma.guestGrant.create({ data: grant });
+  }
+
+  /** One conditional update: never a read followed by a write. */
+  async rotateToken(sessionId: string, oldHash: string, newHash: string): Promise<boolean> {
+    const { count } = await this.prisma.guestSession.updateMany({
+      where: { id: sessionId, tokenHash: oldHash, revokedAt: null },
+      data: { tokenHash: newHash },
+    });
+    return count === 1;
+  }
+
+  async revokeSession(sessionId: string): Promise<boolean> {
+    const { count } = await this.prisma.guestSession.updateMany({
+      where: { id: sessionId, revokedAt: null },
+      data: { revokedAt: new Date() },
+    });
+    return count === 1;
+  }
+
+  async revokeGrant(grantRecordId: string): Promise<boolean> {
+    const { count } = await this.prisma.guestGrant.updateMany({
+      where: { id: grantRecordId, revokedAt: null },
+      data: { revokedAt: new Date() },
+    });
+    return count === 1;
+  }
+
+  async revokeGrants(filter: { kind: string; grantId: string; realm: string | null }): Promise<number> {
+    const { count } = await this.prisma.guestGrant.updateMany({
+      // `realm` goes through as given. null means "no realm" here; turning it
+      // into undefined would drop the condition and match every realm.
+      where: { kind: filter.kind, grantId: filter.grantId, realm: filter.realm, revokedAt: null },
+      data: { revokedAt: new Date() },
+    });
+    return count;
+  }
+
+  async deleteExpired(): Promise<number> {
+    const grants = await this.prisma.guestGrant.deleteMany({ where: { expiresAt: { lt: new Date() } } });
+    const sessions = await this.prisma.guestSession.deleteMany({ where: { grants: { none: {} } } });
+    return grants.count + sessions.count;
+  }
+}

package/examples/guest-sessions/schema.prisma

@@ -0,0 +1,33 @@
+// Reference schema for IGuestSessionRepository, as in the README ("Guest
+// Sessions"). Verified against PostgreSQL 16 with
+// `assertGuestSessionRepositoryContract`, with and without realms.
+//
+// Merge these two models into your schema. Neither relates to your User model,
+// on purpose: a guest is not a user.
+
+model GuestSession {
+  id          String       @id               // generated by the package
+  tokenHash   String       @unique           // looked up on every guest request
+  principalId String                         // your own id for the person
+  email       String
+  realm       String?                        // set when realms are enabled
+  revokedAt   DateTime?
+  createdAt   DateTime
+  grants      GuestGrant[]
+}
+
+model GuestGrant {
+  id        String       @id                 // generated by the package
+  sessionId String
+  kind      String                           // what routes opt in by: 'translation-job'
+  grantId   String                           // your id for the thing granted
+  realm     String?                          // copied from the session
+  expiresAt DateTime
+  revokedAt DateTime?
+  createdAt DateTime
+  session   GuestSession @relation(fields: [sessionId], references: [id], onDelete: Cascade)
+
+  @@index([sessionId])
+  @@index([kind, grantId])
+  @@index([expiresAt])
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@ambushsoftworks/nestjs-auth-graphql",
-  "version": "0.17.1",
+  "version": "0.19.0",
   "description": "Production-grade authentication package for NestJS with GraphQL, supporting JWT, OAuth, email/SMS verification, and biometric auth",
   "main": "dist/index.js",
   "types": "dist/index.d.ts",