@authhero/drizzle 1.4.2 → 1.6.0

package/drizzle/0006_refresh_token_session_id.sql

@@ -0,0 +1,16 @@
+-- Reparent refresh tokens onto sessions (stage 2).
+--
+-- `session_id` is Auth0's field of the same name: the authenticated session a
+-- token was issued under. Deliberately NOT a foreign key — a refresh token is
+-- expected to outlive its session, so cleanup removes the session row first
+-- and this pointer is left to dangle rather than cascading.
+--
+-- The rest are auth-event facts denormalised from the login session at mint
+-- time, so the refresh grant stops resolving them through a short-lived row
+-- that may already have been cleaned up.
+ALTER TABLE `refresh_tokens` ADD `session_id` text(26);--> statement-breakpoint
+ALTER TABLE `refresh_tokens` ADD `organization` text(191);--> statement-breakpoint
+ALTER TABLE `refresh_tokens` ADD `auth_connection` text(255);--> statement-breakpoint
+ALTER TABLE `refresh_tokens` ADD `auth_strategy_strategy` text(64);--> statement-breakpoint
+ALTER TABLE `refresh_tokens` ADD `auth_strategy_strategy_type` text(64);--> statement-breakpoint
+CREATE INDEX `idx_refresh_tokens_session_id` ON `refresh_tokens` (`tenant_id`,`session_id`);

package/drizzle/0007_refresh_token_session_id_backfill.sql

@@ -0,0 +1,52 @@
+-- Backfill the auth-event columns added by 0006, for refresh tokens minted
+-- before that release started populating them at write time.
+--
+-- Values come from the token's parent `login_sessions` row. Tokens whose
+-- parent has already been cleaned up are left null, which is correct: they are
+-- indistinguishable from a token that never had a session, and Auth0
+-- represents the same state with a null `session_id`.
+--
+-- IMPORTANT: all four facts are written together, or none are. The refresh
+-- grant uses `session_id` as the marker for "this row carries its own facts"
+-- and skips the login-session read when it is set — so setting `session_id`
+-- alone would make the grant stop looking up the organization and connection
+-- it still needs. The `ls.session_id IS NOT NULL` predicate keeps the marker
+-- from ever running ahead of the data.
+--
+-- Single statement rather than batched: these are per-tenant D1 databases, so
+-- the row counts are small. The PlanetScale equivalent batches, in
+-- packages/kysely/migrate/migrations/2026-08-21T12:00:00_*_backfill.ts.
+UPDATE `refresh_tokens`
+SET
+  `session_id` = (
+    SELECT `ls`.`session_id` FROM `login_sessions` `ls`
+    WHERE `ls`.`id` = `refresh_tokens`.`login_id`
+      AND `ls`.`tenant_id` = `refresh_tokens`.`tenant_id`
+  ),
+  `organization` = (
+    SELECT json_extract(`ls`.`auth_params`, '$.organization') FROM `login_sessions` `ls`
+    WHERE `ls`.`id` = `refresh_tokens`.`login_id`
+      AND `ls`.`tenant_id` = `refresh_tokens`.`tenant_id`
+  ),
+  `auth_connection` = (
+    SELECT `ls`.`auth_connection` FROM `login_sessions` `ls`
+    WHERE `ls`.`id` = `refresh_tokens`.`login_id`
+      AND `ls`.`tenant_id` = `refresh_tokens`.`tenant_id`
+  ),
+  `auth_strategy_strategy` = (
+    SELECT `ls`.`auth_strategy_strategy` FROM `login_sessions` `ls`
+    WHERE `ls`.`id` = `refresh_tokens`.`login_id`
+      AND `ls`.`tenant_id` = `refresh_tokens`.`tenant_id`
+  ),
+  `auth_strategy_strategy_type` = (
+    SELECT `ls`.`auth_strategy_strategy_type` FROM `login_sessions` `ls`
+    WHERE `ls`.`id` = `refresh_tokens`.`login_id`
+      AND `ls`.`tenant_id` = `refresh_tokens`.`tenant_id`
+  )
+WHERE `refresh_tokens`.`session_id` IS NULL
+  AND EXISTS (
+    SELECT 1 FROM `login_sessions` `ls`
+    WHERE `ls`.`id` = `refresh_tokens`.`login_id`
+      AND `ls`.`tenant_id` = `refresh_tokens`.`tenant_id`
+      AND `ls`.`session_id` IS NOT NULL
+  );