@authhero/drizzle 1.7.0 → 1.7.1

package/dist/drizzle-adapter.mjs

@@ -431,10 +431,14 @@ var Ie = Object.defineProperty, Le = (e, t) => {
 	authorization_details_types: T("authorization_details_types").default("[]"),
 	created_at: T("created_at", { length: 35 }).notNull(),
 	updated_at: T("updated_at", { length: 35 }).notNull()
-}, (e) => [C({
-	columns: [e.tenant_id, e.id],
-	name: "pk_client_grants"
-}), x("idx_client_grants_audience").on(e.audience)]), z = w("grants", {
+}, (e) => [
+	C({
+		columns: [e.tenant_id, e.id],
+		name: "pk_client_grants"
+	}),
+	x("idx_client_grants_audience").on(e.audience),
+	re("uq_client_grants_tenant_client_audience").on(e.tenant_id, e.client_id, e.audience)
+]), z = w("grants", {
 	id: T("id", { length: 21 }).primaryKey(),
 	tenant_id: T("tenant_id", { length: 255 }).notNull().references(() => O.id, { onDelete: "cascade" }),
 	user_id: T("user_id", { length: 255 }).notNull(),
@@ -1705,7 +1709,7 @@ function Bt(e) {
 			if (d?.sort_by) {
 				let e = R[d.sort_by];
 				e && (h = h.orderBy(d.sort_order === "desc" ? i(e) : n(e)));
-			} else h = h.orderBy(n(R.created_at));
+			} else h = h.orderBy(i(R.created_at), i(R.id));
 			let g = (await h.offset(c * l).limit(l)).map(zt);
 			if (!u) return { client_grants: g };
 			let [_] = await e.select({ count: r() }).from(R).where(m);

package/drizzle/0008_client_grants_unique_audience.sql

@@ -0,0 +1,18 @@
+-- One client grant per (tenant_id, client_id, audience) — the constraint
+-- kysely has always enforced (same index name), which drizzle was missing
+-- (#1360). Without it a duplicate pair is silently accepted and scope
+-- resolution picks an arbitrary row.
+--
+-- Existing databases may already hold duplicates, so dedupe first: keep the
+-- newest row per pair (latest created_at, then highest rowid).
+DELETE FROM `client_grants` WHERE `rowid` IN (
+	SELECT `rowid` FROM (
+		SELECT `rowid`, ROW_NUMBER() OVER (
+			PARTITION BY `tenant_id`, `client_id`, `audience`
+			ORDER BY `created_at` DESC, `rowid` DESC
+		) AS `rn`
+		FROM `client_grants`
+	)
+	WHERE `rn` > 1
+);--> statement-breakpoint
+CREATE UNIQUE INDEX `uq_client_grants_tenant_client_audience` ON `client_grants` (`tenant_id`,`client_id`,`audience`);