@betterportal/tunnels 1.0.0

package/prisma/migrations/20260701000000_add_client_auth/migration.sql

@@ -0,0 +1,46 @@
+CREATE TYPE "AuthSessionStatus" AS ENUM ('pending', 'approved', 'consumed', 'expired', 'denied');
+
+CREATE TABLE "ClientAuthSession" (
+    "id" TEXT NOT NULL,
+    "browserKeyHash" TEXT NOT NULL,
+    "pollSecretHash" TEXT NOT NULL,
+    "status" "AuthSessionStatus" NOT NULL DEFAULT 'pending',
+    "tenantId" TEXT,
+    "appId" TEXT,
+    "bpUserSubject" TEXT,
+    "bpUserEmail" TEXT,
+    "clientIpHash" TEXT,
+    "userAgentHash" TEXT,
+    "expiresAt" TIMESTAMP(3) NOT NULL,
+    "approvedAt" TIMESTAMP(3),
+    "consumedAt" TIMESTAMP(3),
+    "createdAt" TIMESTAMP(3) NOT NULL DEFAULT CURRENT_TIMESTAMP,
+
+    CONSTRAINT "ClientAuthSession_pkey" PRIMARY KEY ("id")
+);
+
+CREATE TABLE "ClientDeviceToken" (
+    "id" TEXT NOT NULL,
+    "accountId" TEXT,
+    "tenantId" TEXT NOT NULL,
+    "bpUserSubject" TEXT NOT NULL,
+    "tokenHash" TEXT NOT NULL,
+    "name" TEXT,
+    "ipRangeHash" TEXT NOT NULL,
+    "ipFamily" TEXT NOT NULL,
+    "userAgentHash" TEXT,
+    "expiresAt" TIMESTAMP(3) NOT NULL,
+    "revokedAt" TIMESTAMP(3),
+    "lastUsedAt" TIMESTAMP(3),
+    "createdAt" TIMESTAMP(3) NOT NULL DEFAULT CURRENT_TIMESTAMP,
+
+    CONSTRAINT "ClientDeviceToken_pkey" PRIMARY KEY ("id")
+);
+
+CREATE INDEX "ClientAuthSession_status_expiresAt_idx" ON "ClientAuthSession"("status", "expiresAt");
+
+CREATE UNIQUE INDEX "ClientDeviceToken_tokenHash_key" ON "ClientDeviceToken"("tokenHash");
+
+CREATE INDEX "ClientDeviceToken_tenantId_bpUserSubject_idx" ON "ClientDeviceToken"("tenantId", "bpUserSubject");
+
+CREATE INDEX "ClientDeviceToken_expiresAt_idx" ON "ClientDeviceToken"("expiresAt");

package/prisma/migrations/migration_lock.toml

@@ -0,0 +1,3 @@
+# Please do not edit this file manually
+# It should be added in your version-control system (e.g., Git)
+provider = "postgresql"

package/prisma/schema.prisma

@@ -0,0 +1,141 @@
+generator client {
+  provider = "prisma-client-js"
+  output   = "../src/generated/prisma"
+}
+
+datasource db {
+  provider = "postgresql"
+}
+
+model Account {
+  id                 String      @id @default(cuid())
+  email              String?     @unique
+  plan               AccountPlan @default(anonymous)
+  verificationBypass Boolean     @default(false)
+  ipVerification     Boolean     @default(false)
+  createdAt          DateTime    @default(now())
+  tunnels            Tunnel[]
+}
+
+model ClientSession {
+  id        String   @id @default(cuid())
+  accountId String?
+  ipHash    String?
+  userAgent String?
+  createdAt DateTime @default(now())
+  expiresAt DateTime?
+  tunnels   Tunnel[]
+}
+
+model Tunnel {
+  id            String        @id @default(cuid())
+  accountId     String?
+  sessionId     String
+  subdomain     String        @unique
+  ownerServerId String?
+  targetHost    String
+  targetPort    Int
+  authenticated Boolean       @default(false)
+  status        TunnelStatus  @default(created)
+  createdAt     DateTime      @default(now())
+  expiresAt     DateTime
+  account       Account?      @relation(fields: [accountId], references: [id])
+  session       ClientSession @relation(fields: [sessionId], references: [id])
+  validations   VisitorValidation[]
+  usage         UsageCounter?
+
+  @@index([sessionId])
+  @@index([expiresAt])
+}
+
+model VisitorValidation {
+  id                   String   @id @default(cuid())
+  tunnelId             String
+  visitorIpHash         String
+  userAgentHash         String
+  validationCookieHash  String
+  validatedAt           DateTime @default(now())
+  expiresAt             DateTime
+  tunnel               Tunnel   @relation(fields: [tunnelId], references: [id])
+
+  @@index([tunnelId, visitorIpHash, userAgentHash])
+}
+
+model UsageCounter {
+  tunnelId      String   @id
+  requests      Int      @default(0)
+  bytesIn       BigInt   @default(0)
+  bytesOut      BigInt   @default(0)
+  updatedAt     DateTime @updatedAt
+  tunnel        Tunnel   @relation(fields: [tunnelId], references: [id])
+}
+
+model AuditEvent {
+  id        String   @id @default(cuid())
+  event     String
+  subjectId String?
+  data      Json?
+  createdAt DateTime @default(now())
+}
+
+model ClientAuthSession {
+  id              String            @id @default(cuid())
+  browserKeyHash  String
+  pollSecretHash  String
+  status          AuthSessionStatus @default(pending)
+  tenantId        String?
+  appId           String?
+  bpUserSubject   String?
+  bpUserEmail     String?
+  clientIpHash    String?
+  userAgentHash   String?
+  expiresAt       DateTime
+  approvedAt      DateTime?
+  consumedAt      DateTime?
+  createdAt       DateTime          @default(now())
+
+  @@index([status, expiresAt])
+}
+
+model ClientDeviceToken {
+  id             String    @id @default(cuid())
+  accountId      String?
+  tenantId       String
+  bpUserSubject  String
+  tokenHash      String    @unique
+  name           String?
+  ipRangeHash    String
+  ipFamily       String
+  userAgentHash  String?
+  expiresAt      DateTime
+  revokedAt      DateTime?
+  lastUsedAt     DateTime?
+  createdAt      DateTime  @default(now())
+
+  @@index([tenantId, bpUserSubject])
+  @@index([expiresAt])
+}
+
+enum TunnelStatus {
+  created
+  active
+  draining
+  disconnected
+  expired
+  closed
+}
+
+enum AccountPlan {
+  anonymous
+  free
+  paid
+  admin
+}
+
+enum AuthSessionStatus {
+  pending
+  approved
+  consumed
+  expired
+  denied
+}