@axiom-lattice/pg-stores 5.0.3 → 5.1.0

package/src/migrations/oidc_provider_config_migration.ts

@@ -0,0 +1,27 @@
+import type { Migration } from "./migration";
+
+export const createOidcProviderConfigsTable: Migration = {
+  version: 211,
+  name: "create_oidc_provider_configs",
+  up: async (client) => {
+    await client.query(`
+      CREATE TABLE IF NOT EXISTS lattice_oidc_provider_configs (
+        id VARCHAR(64) PRIMARY KEY,
+        display_name TEXT NOT NULL,
+        issuer TEXT NOT NULL,
+        client_id TEXT NOT NULL,
+        client_secret TEXT NOT NULL,
+        scopes TEXT NOT NULL,
+        enabled BOOLEAN NOT NULL DEFAULT TRUE,
+        jit_provisioning BOOLEAN NOT NULL DEFAULT FALSE,
+        auto_link_email BOOLEAN NOT NULL DEFAULT FALSE,
+        default_tenant_id TEXT,
+        created_at TIMESTAMPTZ NOT NULL DEFAULT NOW(),
+        updated_at TIMESTAMPTZ NOT NULL DEFAULT NOW()
+      )
+    `);
+  },
+  down: async (client) => {
+    await client.query("DROP TABLE IF EXISTS lattice_oidc_provider_configs");
+  },
+};

package/src/migrations/platform_invitation_migration.ts

@@ -0,0 +1,22 @@
+import type { Migration } from "./migration";
+
+/** Creates the platform invitation table keyed by normalized email. */
+export const createPlatformInvitationsTable: Migration = {
+  version: 213,
+  name: "create_platform_invitations",
+  up: async (client) => {
+    await client.query(`
+      CREATE TABLE IF NOT EXISTS lattice_platform_invitations (
+        email VARCHAR(320) PRIMARY KEY,
+        role VARCHAR(16) NOT NULL,
+        invited_by VARCHAR(255),
+        created_at TIMESTAMPTZ NOT NULL DEFAULT NOW(),
+        expires_at TIMESTAMPTZ,
+        consumed_at TIMESTAMPTZ
+      )
+    `);
+  },
+  down: async (client) => {
+    await client.query("DROP TABLE IF EXISTS lattice_platform_invitations");
+  },
+};

package/src/migrations/platform_member_migration.ts

@@ -0,0 +1,21 @@
+import type { Migration } from "./migration";
+
+/** Creates the platform member table keyed by user id. */
+export const createPlatformMembersTable: Migration = {
+  version: 212,
+  name: "create_platform_members",
+  up: async (client) => {
+    await client.query(`
+      CREATE TABLE IF NOT EXISTS lattice_platform_members (
+        user_id VARCHAR(255) PRIMARY KEY,
+        role VARCHAR(16) NOT NULL,
+        granted_by VARCHAR(255),
+        granted_at TIMESTAMPTZ NOT NULL DEFAULT NOW(),
+        updated_at TIMESTAMPTZ NOT NULL DEFAULT NOW()
+      )
+    `);
+  },
+  down: async (client) => {
+    await client.query("DROP TABLE IF EXISTS lattice_platform_members");
+  },
+};

package/src/migrations/platform_settings_migration.ts

@@ -0,0 +1,21 @@
+import type { Migration } from "./migration";
+
+/** Creates the single-row durable platform settings table. */
+export const createPlatformSettingsTable: Migration = {
+  version: 217,
+  name: "create_platform_settings",
+  up: async (client) => {
+    await client.query(`
+      CREATE TABLE IF NOT EXISTS lattice_platform_settings (
+        id VARCHAR(32) PRIMARY KEY,
+        document JSONB NOT NULL,
+        version INTEGER NOT NULL,
+        updated_by VARCHAR(255),
+        updated_at TIMESTAMPTZ NOT NULL DEFAULT NOW()
+      )
+    `);
+  },
+  down: async (client) => {
+    await client.query("DROP TABLE IF EXISTS lattice_platform_settings");
+  },
+};

package/src/migrations/user_email_lower_unique_migration.ts

@@ -0,0 +1,22 @@
+import type { Migration } from "./migration";
+
+/**
+ * Enforce case-insensitive email uniqueness.
+ *
+ * `lower(email)` is the lookup identity used by every UserStore, so the
+ * database must reject rows that differ only by case. This migration fails
+ * closed on an existing database that still has duplicate lower(email) rows.
+ */
+export const createUserEmailLowerUniqueIndex: Migration = {
+  version: 210,
+  name: "create_user_email_lower_unique_index",
+  up: async (client) => {
+    await client.query(`
+      CREATE UNIQUE INDEX IF NOT EXISTS idx_lattice_users_email_lower
+      ON lattice_users (lower(email))
+    `);
+  },
+  down: async (client) => {
+    await client.query("DROP INDEX IF EXISTS idx_lattice_users_email_lower");
+  },
+};

package/src/migrations/user_external_identity_migration.ts

@@ -0,0 +1,27 @@
+import type { Migration } from "./migration";
+
+export const createUserExternalIdentityTable: Migration = {
+  version: 209,
+  name: "create_user_external_identity",
+  up: async (client) => {
+    await client.query(`
+      CREATE TABLE IF NOT EXISTS lattice_user_identities (
+        user_id VARCHAR(255) NOT NULL,
+        provider_id VARCHAR(255) NOT NULL,
+        issuer TEXT NOT NULL,
+        subject TEXT NOT NULL,
+        email TEXT,
+        linked_at TIMESTAMPTZ NOT NULL DEFAULT NOW(),
+        PRIMARY KEY (provider_id, issuer, subject)
+      )
+    `);
+    await client.query(`
+      CREATE INDEX IF NOT EXISTS idx_lattice_user_identities_user
+      ON lattice_user_identities (user_id)
+    `);
+  },
+  down: async (client) => {
+    await client.query("DROP INDEX IF EXISTS idx_lattice_user_identities_user");
+    await client.query("DROP TABLE IF EXISTS lattice_user_identities");
+  },
+};

package/src/stores/PostgreSQLInviteLinkStore.ts

@@ -0,0 +1,134 @@
+import { encrypt, safeDecrypt } from "@axiom-lattice/core";
+import {
+  normalizeInviteLinkEmail,
+  type CreateInviteLinkInput,
+  type InviteLink,
+  type InviteLinkScope,
+  type InviteLinkStore,
+} from "@axiom-lattice/protocols";
+import type { PlatformRole, UserTenantRole } from "@axiom-lattice/protocols";
+import type { Pool } from "pg";
+
+const TABLE = "lattice_invite_links";
+
+interface LinkRow {
+  id: string;
+  scope: InviteLinkScope;
+  token_hash: string;
+  token_encrypted: string;
+  email: string | null;
+  platform_role: PlatformRole | null;
+  tenant_id: string | null;
+  tenant_role: UserTenantRole | null;
+  created_by: string | null;
+  created_at: Date;
+  updated_at: Date;
+  expires_at: Date;
+  max_uses: number;
+  used_count: number;
+  revoked_at: Date | null;
+}
+
+function mapRow(row: LinkRow): InviteLink {
+  return {
+    id: row.id,
+    scope: row.scope,
+    token: safeDecrypt(row.token_encrypted, `Invite link "${row.id}" token`),
+    tokenHash: row.token_hash,
+    ...(row.email !== null ? { email: row.email } : {}),
+    ...(row.platform_role !== null ? { platformRole: row.platform_role } : {}),
+    ...(row.tenant_id !== null ? { tenantId: row.tenant_id } : {}),
+    ...(row.tenant_role !== null ? { tenantRole: row.tenant_role } : {}),
+    ...(row.created_by !== null ? { createdBy: row.created_by } : {}),
+    createdAt: row.created_at,
+    updatedAt: row.updated_at,
+    expiresAt: row.expires_at,
+    maxUses: Number(row.max_uses),
+    usedCount: Number(row.used_count),
+    ...(row.revoked_at !== null ? { revokedAt: row.revoked_at } : {}),
+  };
+}
+
+/** PostgreSQL implementation of {@link InviteLinkStore}. */
+export class PostgreSQLInviteLinkStore implements InviteLinkStore {
+  constructor(private readonly options: { pool: Pool }) {}
+
+  private get pool(): Pool {
+    return this.options.pool;
+  }
+
+  async list(): Promise<InviteLink[]> {
+    const result = await this.pool.query<LinkRow>(
+      `SELECT * FROM ${TABLE} ORDER BY created_at DESC, id DESC`,
+    );
+    return result.rows.map(mapRow);
+  }
+
+  async get(id: string): Promise<InviteLink | null> {
+    const result = await this.pool.query<LinkRow>(
+      `SELECT * FROM ${TABLE} WHERE id = $1`,
+      [id],
+    );
+    return result.rows[0] ? mapRow(result.rows[0]) : null;
+  }
+
+  async getByTokenHash(tokenHash: string): Promise<InviteLink | null> {
+    const result = await this.pool.query<LinkRow>(
+      `SELECT * FROM ${TABLE} WHERE token_hash = $1`,
+      [tokenHash],
+    );
+    return result.rows[0] ? mapRow(result.rows[0]) : null;
+  }
+
+  async create(input: CreateInviteLinkInput): Promise<InviteLink> {
+    const now = new Date();
+    const result = await this.pool.query<LinkRow>(
+      `INSERT INTO ${TABLE}
+       (id, scope, token_hash, token_encrypted, email, platform_role,
+        tenant_id, tenant_role, created_by, created_at, updated_at,
+        expires_at, max_uses, used_count)
+       VALUES ($1, $2, $3, $4, $5, $6, $7, $8, $9, $10, $10, $11, $12, 0)
+       RETURNING *`,
+      [
+        input.id,
+        input.scope,
+        input.tokenHash,
+        encrypt(input.token),
+        input.email ? normalizeInviteLinkEmail(input.email) : null,
+        input.platformRole ?? null,
+        input.tenantId ?? null,
+        input.tenantRole ?? null,
+        input.createdBy ?? null,
+        now,
+        input.expiresAt,
+        input.maxUses,
+      ],
+    );
+    return mapRow(result.rows[0]);
+  }
+
+  async consume(tokenHash: string, now: Date): Promise<InviteLink | null> {
+    const result = await this.pool.query<LinkRow>(
+      `UPDATE ${TABLE}
+       SET used_count = used_count + 1, updated_at = $1
+       WHERE token_hash = $2
+         AND revoked_at IS NULL
+         AND expires_at > $1
+         AND used_count < max_uses
+       RETURNING *`,
+      [now, tokenHash],
+    );
+    return result.rows[0] ? mapRow(result.rows[0]) : null;
+  }
+
+  async revoke(id: string, now: Date): Promise<InviteLink | null> {
+    const result = await this.pool.query<LinkRow>(
+      `UPDATE ${TABLE}
+       SET revoked_at = COALESCE(revoked_at, $1), updated_at = $1
+       WHERE id = $2
+       RETURNING *`,
+      [now, id],
+    );
+    return result.rows[0] ? mapRow(result.rows[0]) : null;
+  }
+}

package/src/stores/PostgreSQLOidcIdentityClaimStore.ts

@@ -0,0 +1,251 @@
+import {
+  normalizeOidcIdentityEmail,
+  OidcIdentityClaimConflictError,
+  type CreateOidcIdentityClaimInput,
+  type OidcIdentityClaim,
+  type OidcIdentityClaimApproval,
+  type OidcIdentityClaimStatus,
+  type OidcIdentityClaimStore,
+  type UpdateOidcIdentityClaimInput,
+} from "@axiom-lattice/protocols";
+import type { Pool } from "pg";
+
+const TABLE = "lattice_oidc_identity_claims";
+
+interface ClaimRow {
+  id: string;
+  provider_id: string;
+  issuer: string;
+  subject: string;
+  email: string;
+  name: string | null;
+  picture: string | null;
+  status: OidcIdentityClaimStatus;
+  created_at: Date;
+  updated_at: Date;
+  expires_at: Date;
+  reviewed_by: string | null;
+  reviewed_at: Date | null;
+  linked_user_id: string | null;
+  source: "email_completion" | "invite_link" | null;
+  invite_link_id: string | null;
+  requested_user_id: string | null;
+  requested_platform_role: string | null;
+  requested_tenant_id: string | null;
+  requested_tenant_role: string | null;
+}
+
+function mapRow(row: ClaimRow): OidcIdentityClaim {
+  return {
+    id: row.id,
+    providerId: row.provider_id,
+    issuer: row.issuer,
+    subject: row.subject,
+    email: row.email,
+    ...(row.name !== null ? { name: row.name } : {}),
+    ...(row.picture !== null ? { picture: row.picture } : {}),
+    status: row.status,
+    createdAt: row.created_at,
+    updatedAt: row.updated_at,
+    expiresAt: row.expires_at,
+    ...(row.reviewed_by !== null ? { reviewedBy: row.reviewed_by } : {}),
+    ...(row.reviewed_at !== null ? { reviewedAt: row.reviewed_at } : {}),
+    ...(row.linked_user_id !== null
+      ? { linkedUserId: row.linked_user_id }
+      : {}),
+    ...(row.source !== null ? { source: row.source } : {}),
+    ...(row.invite_link_id !== null
+      ? { inviteLinkId: row.invite_link_id }
+      : {}),
+    ...(row.requested_user_id !== null
+      ? { requestedUserId: row.requested_user_id }
+      : {}),
+    ...(row.requested_platform_role !== null
+      ? { requestedPlatformRole: row.requested_platform_role as never }
+      : {}),
+    ...(row.requested_tenant_id !== null
+      ? { requestedTenantId: row.requested_tenant_id }
+      : {}),
+    ...(row.requested_tenant_role !== null
+      ? { requestedTenantRole: row.requested_tenant_role as never }
+      : {}),
+  };
+}
+
+function isUniqueViolation(error: unknown): boolean {
+  return (
+    typeof error === "object" &&
+    error !== null &&
+    (error as { code?: unknown }).code === "23505"
+  );
+}
+
+/** PostgreSQL implementation of {@link OidcIdentityClaimStore}. */
+export class PostgreSQLOidcIdentityClaimStore
+  implements OidcIdentityClaimStore
+{
+  private readonly pool: Pool;
+
+  constructor(options: { pool: Pool }) {
+    this.pool = options.pool;
+  }
+
+  async list(status?: OidcIdentityClaimStatus): Promise<OidcIdentityClaim[]> {
+    const result = status
+      ? await this.pool.query<ClaimRow>(
+          `SELECT * FROM ${TABLE} WHERE status = $1
+           ORDER BY created_at ASC, id ASC`,
+          [status],
+        )
+      : await this.pool.query<ClaimRow>(
+          `SELECT * FROM ${TABLE} ORDER BY created_at ASC, id ASC`,
+        );
+    return result.rows.map(mapRow);
+  }
+
+  async get(id: string): Promise<OidcIdentityClaim | null> {
+    const result = await this.pool.query<ClaimRow>(
+      `SELECT * FROM ${TABLE} WHERE id = $1`,
+      [id],
+    );
+    return result.rows[0] ? mapRow(result.rows[0]) : null;
+  }
+
+  async getPendingBySubject(
+    providerId: string,
+    issuer: string,
+    subject: string,
+    now: Date,
+  ): Promise<OidcIdentityClaim | null> {
+    const result = await this.pool.query<ClaimRow>(
+      `SELECT * FROM ${TABLE}
+       WHERE provider_id = $1 AND issuer = $2 AND subject = $3
+         AND status = 'pending' AND expires_at > $4`,
+      [providerId, issuer, subject, now],
+    );
+    return result.rows[0] ? mapRow(result.rows[0]) : null;
+  }
+
+  async create(input: CreateOidcIdentityClaimInput): Promise<OidcIdentityClaim> {
+    const now = new Date();
+    await this.pool.query(
+      `UPDATE ${TABLE}
+       SET status = 'expired', updated_at = $1
+       WHERE provider_id = $2 AND issuer = $3 AND subject = $4
+         AND status = 'pending' AND expires_at <= $1`,
+      [now, input.providerId, input.issuer, input.subject],
+    );
+
+    try {
+      const result = await this.pool.query<ClaimRow>(
+        `INSERT INTO ${TABLE}
+         (id, provider_id, issuer, subject, email, name, picture, status,
+          created_at, updated_at, expires_at, source, invite_link_id,
+          requested_user_id, requested_platform_role, requested_tenant_id,
+          requested_tenant_role)
+         VALUES ($1, $2, $3, $4, $5, $6, $7, 'pending', $8, $8, $9,
+                 $10, $11, $12, $13, $14, $15)
+         RETURNING *`,
+        [
+          input.id,
+          input.providerId,
+          input.issuer,
+          input.subject,
+          normalizeOidcIdentityEmail(input.email),
+          input.name ?? null,
+          input.picture ?? null,
+          now,
+          input.expiresAt,
+          input.source ?? null,
+          input.inviteLinkId ?? null,
+          input.requestedUserId ?? null,
+          input.requestedPlatformRole ?? null,
+          input.requestedTenantId ?? null,
+          input.requestedTenantRole ?? null,
+        ],
+      );
+      return mapRow(result.rows[0]);
+    } catch (error) {
+      if (isUniqueViolation(error)) {
+        throw new OidcIdentityClaimConflictError(
+          input.providerId,
+          input.issuer,
+          input.subject,
+        );
+      }
+      throw error;
+    }
+  }
+
+  async updatePending(
+    id: string,
+    updates: UpdateOidcIdentityClaimInput,
+    now: Date,
+  ): Promise<OidcIdentityClaim | null> {
+    const sets: string[] = [];
+    const params: unknown[] = [];
+    if (updates.email !== undefined) {
+      params.push(normalizeOidcIdentityEmail(updates.email));
+      sets.push(`email = $${params.length}`);
+    }
+    if (updates.name !== undefined) {
+      params.push(updates.name);
+      sets.push(`name = $${params.length}`);
+    }
+    if (updates.picture !== undefined) {
+      params.push(updates.picture);
+      sets.push(`picture = $${params.length}`);
+    }
+    if (sets.length === 0) return this.get(id);
+    params.push(now);
+    sets.push(`updated_at = $${params.length}`);
+    params.push(id);
+    const result = await this.pool.query<ClaimRow>(
+      `UPDATE ${TABLE} SET ${sets.join(", ")}
+       WHERE id = $${params.length} AND status = 'pending'
+       RETURNING *`,
+      params,
+    );
+    return result.rows[0] ? mapRow(result.rows[0]) : null;
+  }
+
+  async approve(
+    id: string,
+    approval: OidcIdentityClaimApproval,
+    now: Date,
+  ): Promise<OidcIdentityClaim | null> {
+    const result = await this.pool.query<ClaimRow>(
+      `UPDATE ${TABLE}
+       SET status = 'approved', reviewed_by = $1, reviewed_at = $2,
+           linked_user_id = $3, updated_at = $2
+       WHERE id = $4 AND status = 'pending'
+       RETURNING *`,
+      [approval.reviewedBy, now, approval.linkedUserId, id],
+    );
+    return result.rows[0] ? mapRow(result.rows[0]) : null;
+  }
+
+  async reject(
+    id: string,
+    reviewedBy: string,
+    now: Date,
+  ): Promise<OidcIdentityClaim | null> {
+    const result = await this.pool.query<ClaimRow>(
+      `UPDATE ${TABLE}
+       SET status = 'rejected', reviewed_by = $1, reviewed_at = $2,
+           updated_at = $2
+       WHERE id = $3 AND status = 'pending'
+       RETURNING *`,
+      [reviewedBy, now, id],
+    );
+    return result.rows[0] ? mapRow(result.rows[0]) : null;
+  }
+
+  async delete(id: string): Promise<boolean> {
+    const result = await this.pool.query(
+      `DELETE FROM ${TABLE} WHERE id = $1`,
+      [id],
+    );
+    return (result.rowCount ?? 0) > 0;
+  }
+}