@camstack/system 1.2.460 → 1.2.462

package/dist/builtins/local-auth/local-auth.addon.js

@@ -3,11 +3,11 @@ Object.defineProperties(exports, {
 	[Symbol.toStringTag]: { value: "Module" }
 });
 const require_chunk = require("../../chunk-Cek0wNdY.js");
-const require_dist = require("../../dist-Bn-RNanh.js");
+const require_dist = require("../../dist-Ct-4tTeX.js");
 const require_read_all_rows$1 = require("../../read-all-rows-CVoO1ONM.js");
 const require_safe_buffer$1 = require("../../safe-buffer-D3aoa-7X.js");
 const require_ms$1 = require("../../ms-LB3giGoU.js");
-const require_device_ca = require("../../device-ca-CPTDs--d.js");
+const require_device_ca = require("../../device-ca-CUEx7sti.js");
 let zod = require("zod");
 let node_crypto = require("node:crypto");
 node_crypto = require_chunk.__toESM(node_crypto);
@@ -7224,16 +7224,6 @@ var API_KEYS_COLLECTION = "api_keys";
 */
 var SCOPED_TOKENS_COLLECTION = "scoped_tokens";
 /**
-* @durable class=ledger owner=local-auth
-*   write="one row per redeemed OAuth code — every completed account link through
-*     `oauthExchangeCode`; `touch` rewrites `lastUsedAt` on each refresh"
-*   retention="ONLY revoked rows are pruned: the daily sweep deletes sessions
-*     revoked more than OAUTH_REVOKED_RETENTION_MS (30 d) ago. An ACTIVE session
-*     has `revokedAt` NULL, never expires and is never swept — the table grows one
-*     row per login until an operator revokes the link."
-*/
-var OAUTH_SESSIONS_COLLECTION = "oauth_sessions";
-/**
 * TOTP enrollment table — split off from `users` to avoid the
 * destructive drop-+-recreate migration `ensureTable` performs when a
 * new column is added to a typed schema (see `sqlite-settings-backend.ts`).
@@ -7465,47 +7455,6 @@ var SCOPED_TOKENS_COLUMNS = [
 		notNull: true
 	}
 ];
-var OAUTH_SESSIONS_COLUMNS = [
-	{
-		name: "id",
-		type: "TEXT",
-		primaryKey: true,
-		notNull: true
-	},
-	{
-		name: "userId",
-		type: "TEXT",
-		notNull: true
-	},
-	{
-		name: "username",
-		type: "TEXT",
-		notNull: true
-	},
-	{
-		name: "integrationId",
-		type: "TEXT",
-		notNull: true
-	},
-	{
-		name: "scopes",
-		type: "JSON"
-	},
-	{
-		name: "createdAt",
-		type: "INTEGER",
-		notNull: true
-	},
-	{
-		name: "lastUsedAt",
-		type: "INTEGER",
-		notNull: true
-	},
-	{
-		name: "revokedAt",
-		type: "INTEGER"
-	}
-];
 /**
 * Declare every auth collection with the typed schema. Called by
 * `LocalAuthAddon.onInitialize` before constructing the per-collection
@@ -7546,14 +7495,6 @@ async function declareAuthSchema(store, options) {
 			columns: ["userId"]
 		}]
 	});
-	if (!skip.has("oauth_sessions")) await store.declareCollection.mutate({
-		collection: OAUTH_SESSIONS_COLLECTION,
-		columns: OAUTH_SESSIONS_COLUMNS,
-		indexes: [{
-			name: "idx_oauth_sessions_user_id",
-			columns: ["userId"]
-		}]
-	});
 	if (!skip.has("login_sessions")) await store.declareCollection.mutate({
 		collection: LOGIN_SESSIONS_COLLECTION,
 		columns: LOGIN_SESSIONS_COLUMNS,
@@ -7597,7 +7538,7 @@ async function declareAuthSchema(store, options) {
 * Record kinds owned by `local-auth` (records plan phase 6 / §2.8).
 *
 * Operator-only legacy drop: auth tables are NEVER removed by the orphan job —
-* use `storageAdmin.dropCollection` with `expectRows` after verify (see
+* the operator drops a legacy table by hand, offline (D902; see
 * `docs/design/records-phase-6-auth-migration.md`).
 *
 * Before hub restart: mint and test an admin token (`auth.mintToken` with `'*'`); snapshot every kind.
@@ -7768,16 +7709,19 @@ var _localAuthRecordKinds = require_dist.defineRecordKinds({
 	"oauth-sessions": {
 		schema: OauthSessionBodySchema,
 		class: "ledger",
-		writeTrigger: "OAuth code exchange; refresh touches lastUsedAt",
+		writeTrigger: "OAuth code exchange; refresh touches lastUsedAt; revoke stamps revokedAt",
 		device: "none",
 		at: "none",
 		indexes: [{
 			name: "user",
 			fields: ["userId"]
+		}, {
+			name: "revoked",
+			fields: ["revokedAt"]
 		}],
 		retention: {
 			owner: "local-auth",
-			reason: "daily reap deletes revoked sessions older than 30 days; active rows never expire"
+			reason: "daily reap deletes sessions revoked more than 30 days ago; an active session has no lifetime, so no engine TTL"
 		}
 	},
 	"user-totp": {
@@ -7858,7 +7802,6 @@ var LOCAL_AUTH_RECORDS_LEGACY_COLLECTIONS = [
 	ADMIN_TOKENS_COLLECTION,
 	LOGIN_SESSIONS_COLLECTION,
 	LOGIN_SESSION_CUTOFFS_COLLECTION,
-	OAUTH_SESSIONS_COLLECTION,
 	USER_TOTP_COLLECTION,
 	USER_EXTERNAL_IDENTITIES_COLLECTION,
 	DEVICE_CREDENTIALS_COLLECTION,
@@ -8063,7 +8006,7 @@ function num(data, key) {
 	const value = data[key];
 	return typeof value === "number" && Number.isFinite(value) ? value : null;
 }
-function parseSession$1(data) {
+function parseSession(data) {
 	const id = str(data, "id");
 	const userId = str(data, "userId");
 	const createdAt = num(data, "createdAt");
@@ -8126,7 +8069,7 @@ var LoginSessionManager = class {
 		if (sessionsKind !== null) {
 			const rows = await (0, import_read_all_rows.readAllRows)(sessionsKind);
 			for (const row of rows) {
-				const record = parseSession$1({
+				const record = parseSession({
 					id: row.id,
 					...row.data
 				});
@@ -8138,7 +8081,7 @@ var LoginSessionManager = class {
 		}
 		const rows = await this.store.query.query({ collection: LOGIN_SESSIONS_COLLECTION });
 		for (const row of rows) {
-			const record = parseSession$1(row.data);
+			const record = parseSession(row.data);
 			if (record !== null) this.remember(record);
 		}
 		const cutoffs = await this.store.query.query({ collection: LOGIN_SESSION_CUTOFFS_COLLECTION });
@@ -12045,33 +11988,6 @@ function createOauthGrants(ssoBridge, sessionManager) {
 }
 //#endregion
 //#region src/builtins/local-auth/oauth-session-manager.ts
-function parseSession(data) {
-	const id = data["id"];
-	const userId = data["userId"];
-	const username = data["username"];
-	const integrationId = data["integrationId"];
-	const scopes = data["scopes"];
-	const createdAt = data["createdAt"];
-	const lastUsedAt = data["lastUsedAt"];
-	const revokedAt = data["revokedAt"];
-	if (typeof id !== "string") throw new Error("oauth_sessions row: missing id");
-	if (typeof userId !== "string") throw new Error("oauth_sessions row: missing userId");
-	if (typeof username !== "string") throw new Error("oauth_sessions row: missing username");
-	if (typeof integrationId !== "string") throw new Error("oauth_sessions row: missing integrationId");
-	if (!Array.isArray(scopes)) throw new Error("oauth_sessions row: scopes must be an array");
-	if (typeof createdAt !== "number") throw new Error("oauth_sessions row: missing createdAt");
-	if (typeof lastUsedAt !== "number") throw new Error("oauth_sessions row: missing lastUsedAt");
-	return {
-		id,
-		userId,
-		username,
-		integrationId,
-		scopes,
-		createdAt,
-		lastUsedAt,
-		revokedAt: typeof revokedAt === "number" ? revokedAt : null
-	};
-}
 function sessionToBody(session) {
 	return {
 		userId: session.userId,
@@ -12084,22 +12000,34 @@ function sessionToBody(session) {
 	};
 }
 function rowToSession(id, body) {
-	return parseSession({
+	return {
 		id,
-		...body
-	});
+		userId: body.userId,
+		username: body.username,
+		integrationId: body.integrationId,
+		scopes: body.scopes,
+		createdAt: body.createdAt,
+		lastUsedAt: body.lastUsedAt,
+		revokedAt: typeof body.revokedAt === "number" ? body.revokedAt : null
+	};
 }
+/**
+* The OAuth account links (one row per redeemed code), kept in local-auth's
+* `oauth-sessions` records kind (D881, D902). There is no table: the
+* `oauth_sessions` collection and its settings-store path are gone.
+*/
 var OauthSessionManager = class {
 	kind;
-	store;
 	constructor(deps) {
-		if ("oauthSessionsKind" in deps) {
-			this.kind = deps.oauthSessionsKind;
-			this.store = deps.legacyStore ?? null;
-		} else {
-			this.kind = null;
-			this.store = deps;
-		}
+		this.kind = deps.oauthSessionsKind;
+	}
+	async write(session) {
+		const parsed = localAuthRecordKinds["oauth-sessions"].schema.safeParse(sessionToBody(session));
+		if (!parsed.success) throw new Error(parsed.error.message);
+		await this.kind.put({
+			id: session.id,
+			data: parsed.data
+		});
 	}
 	async create(input) {
 		const now = Date.now();
@@ -12113,117 +12041,53 @@ var OauthSessionManager = class {
 			lastUsedAt: now,
 			revokedAt: null
 		};
-		const kind = this.kind;
-		if (kind !== null) {
-			const parsed = localAuthRecordKinds["oauth-sessions"].schema.safeParse(sessionToBody(session));
-			if (!parsed.success) throw new Error(parsed.error.message);
-			await kind.put({
-				id: session.id,
-				data: parsed.data
-			});
-			return session;
-		}
-		await this.store.insert.mutate({
-			collection: OAUTH_SESSIONS_COLLECTION,
-			record: {
-				id: session.id,
-				data: { ...session }
-			}
-		});
+		await this.write(session);
 		return session;
 	}
 	async list() {
-		const kind = this.kind;
-		if (kind !== null) return (await (0, import_read_all_rows.readAllRows)(kind)).map((row) => rowToSession(row.id, row.data));
-		return (await this.store.query.query({
-			collection: OAUTH_SESSIONS_COLLECTION,
-			filter: {}
-		})).map((r) => parseSession(r.data));
+		return (await (0, import_read_all_rows.readAllRows)(this.kind)).map((row) => rowToSession(row.id, row.data));
 	}
 	async getById(id) {
-		const kind = this.kind;
-		if (kind !== null) {
-			const row = await kind.get(id);
-			return row === null ? null : rowToSession(row.id, row.data);
-		}
-		const results = await this.store.query.query({
-			collection: OAUTH_SESSIONS_COLLECTION,
-			filter: { where: { id } }
-		});
-		if (results.length === 0) return null;
-		return parseSession(results[0].data);
+		const row = await this.kind.get(id);
+		return row === null ? null : rowToSession(row.id, row.data);
 	}
 	async markRevoked(id) {
 		const existing = await this.getById(id);
 		if (existing === null) return false;
 		if (existing.revokedAt !== null) return true;
-		const updated = {
+		await this.write({
 			...existing,
 			revokedAt: Date.now()
-		};
-		const kind = this.kind;
-		if (kind !== null) {
-			const parsed = localAuthRecordKinds["oauth-sessions"].schema.safeParse(sessionToBody(updated));
-			if (!parsed.success) throw new Error(parsed.error.message);
-			await kind.put({
-				id,
-				data: parsed.data
-			});
-			return true;
-		}
-		await this.store.update.mutate({
-			collection: OAUTH_SESSIONS_COLLECTION,
-			id,
-			data: { ...updated }
 		});
 		return true;
 	}
 	async remove(id) {
 		if (await this.getById(id) === null) return false;
-		const kind = this.kind;
-		if (kind !== null) {
-			await kind.delete(id);
-			return true;
-		}
-		await this.store.delete.mutate({
-			collection: OAUTH_SESSIONS_COLLECTION,
-			key: id
-		});
+		await this.kind.delete(id);
 		return true;
 	}
+	/**
+	* Delete the sessions revoked at or before `horizonMs`. An active session
+	* (`revokedAt` null) is never matched: it has no lifetime of its own, which
+	* is why this is the owner's sweep and not an engine TTL.
+	*/
 	async reapRevoked(horizonMs) {
-		const kind = this.kind;
-		if (kind !== null) return kind.deleteWhere({ where: { revokedAt: {
+		return this.kind.deleteWhere({ where: { revokedAt: {
 			gte: 1,
 			lte: horizonMs
 		} } });
-		const { deleted } = await this.store.deleteWhere.mutate({
-			collection: OAUTH_SESSIONS_COLLECTION,
-			filter: { whereBetween: { revokedAt: [1, horizonMs] } }
-		});
-		return deleted;
 	}
 	async touch(id) {
 		const existing = await this.getById(id);
 		if (existing === null) return;
-		const updated = {
+		const parsed = localAuthRecordKinds["oauth-sessions"].schema.safeParse(sessionToBody({
 			...existing,
 			lastUsedAt: Date.now()
-		};
-		const kind = this.kind;
-		if (kind !== null) {
-			const parsed = localAuthRecordKinds["oauth-sessions"].schema.safeParse(sessionToBody(updated));
-			if (!parsed.success) return;
-			await kind.put({
-				id,
-				data: parsed.data
-			});
-			return;
-		}
-		await this.store.update.mutate({
-			collection: OAUTH_SESSIONS_COLLECTION,
+		}));
+		if (!parsed.success) return;
+		await this.kind.put({
 			id,
-			data: { ...updated }
+			data: parsed.data
 		});
 	}
 };
@@ -12308,10 +12172,7 @@ var LocalAuthAddon = class extends require_dist.BaseAddon {
 				apiKeysKind: authStores.apiKeys,
 				legacyStore: store
 			});
-			this.oauthSessionManager = new OauthSessionManager({
-				oauthSessionsKind: authStores.oauthSessions,
-				legacyStore: store
-			});
+			this.oauthSessionManager = new OauthSessionManager({ oauthSessionsKind: authStores.oauthSessions });
 			this.totpManager = new TotpManager({
 				userTotpKind: authStores.userTotp,
 				legacyStore: store