@cloudauth/adapter-drizzle 0.1.0

package/src/adapter.ts

@@ -0,0 +1,227 @@
+import { eq, sql, and } from 'drizzle-orm'
+import type { AuthAdapter } from '@cloudauth/core'
+import type {
+  CreateUserInput,
+  UpdateUserInput,
+  CreateAccountInput,
+  CreateSessionInput,
+  UpdateSessionInput,
+  CreateOAuthStateInput,
+  User,
+  Account,
+  Session,
+  OAuthState,
+  SessionWithUser,
+} from '@cloudauth/core'
+import * as schema from './schema.js'
+import type { LibSQLDatabase } from 'drizzle-orm/libsql'
+
+type Database = LibSQLDatabase<typeof schema>
+
+function now(): Date {
+  return new Date()
+}
+
+function assertRow<T>(row: T | undefined): T {
+  if (!row) {
+    throw new Error('Expected a row to be returned from the database')
+  }
+  return row
+}
+
+export function drizzleAdapter(db: Database): AuthAdapter {
+  const adapter: AuthAdapter = {
+    // --- User operations ---
+
+    async createUser(data: CreateUserInput): Promise<User> {
+      const [row] = await db
+        .insert(schema.users)
+        .values({
+          id: crypto.randomUUID(),
+          email: data.email,
+          emailVerified: data.emailVerified,
+          name: data.name,
+          image: data.image,
+          createdAt: now(),
+          updatedAt: now(),
+        })
+        .returning()
+      return assertRow(row)
+    },
+
+    async getUserById(id: string): Promise<User | null> {
+      const [row] = await db.select().from(schema.users).where(eq(schema.users.id, id))
+      return row ?? null
+    },
+
+    async getUserByEmail(email: string): Promise<User | null> {
+      if (!email) return null
+      const [row] = await db.select().from(schema.users).where(eq(schema.users.email, email))
+      return row ?? null
+    },
+
+    async updateUser(id: string, data: UpdateUserInput): Promise<User> {
+      const [row] = await db
+        .update(schema.users)
+        .set({
+          ...data,
+          updatedAt: now(),
+        })
+        .where(eq(schema.users.id, id))
+        .returning()
+      return assertRow(row)
+    },
+
+    // --- Account operations ---
+
+    async createAccount(data: CreateAccountInput): Promise<Account> {
+      const [row] = await db
+        .insert(schema.accounts)
+        .values({
+          id: crypto.randomUUID(),
+          userId: data.userId,
+          provider: data.provider,
+          providerAccountId: data.providerAccountId,
+          accessToken: data.accessToken ?? null,
+          refreshToken: data.refreshToken ?? null,
+          idToken: data.idToken ?? null,
+          scope: data.scope ?? null,
+          tokenType: data.tokenType ?? null,
+          expiresAt: data.expiresAt ?? null,
+          createdAt: now(),
+          updatedAt: now(),
+        })
+        .returning()
+      return assertRow(row)
+    },
+
+    async getAccount(provider: string, providerAccountId: string): Promise<Account | null> {
+      const [row] = await db
+        .select()
+        .from(schema.accounts)
+        .where(
+          and(
+            eq(schema.accounts.provider, provider),
+            eq(schema.accounts.providerAccountId, providerAccountId),
+          ),
+        )
+      return row ?? null
+    },
+
+    async getAccountsByUserId(userId: string): Promise<Account[]> {
+      return db.select().from(schema.accounts).where(eq(schema.accounts.userId, userId))
+    },
+
+    async linkAccount(userId: string, data: CreateAccountInput): Promise<Account> {
+      const [row] = await db
+        .insert(schema.accounts)
+        .values({
+          id: crypto.randomUUID(),
+          userId,
+          provider: data.provider,
+          providerAccountId: data.providerAccountId,
+          accessToken: data.accessToken ?? null,
+          refreshToken: data.refreshToken ?? null,
+          idToken: data.idToken ?? null,
+          scope: data.scope ?? null,
+          tokenType: data.tokenType ?? null,
+          expiresAt: data.expiresAt ?? null,
+          createdAt: now(),
+          updatedAt: now(),
+        })
+        .returning()
+      return assertRow(row)
+    },
+
+    async deleteAccount(accountId: string): Promise<void> {
+      await db.delete(schema.accounts).where(eq(schema.accounts.id, accountId))
+    },
+
+    // --- Session operations ---
+
+    async createSession(data: CreateSessionInput): Promise<Session> {
+      const [row] = await db
+        .insert(schema.sessions)
+        .values({
+          id: crypto.randomUUID(),
+          userId: data.userId,
+          tokenHash: data.tokenHash,
+          expiresAt: data.expiresAt,
+          ipAddress: data.ipAddress ?? null,
+          userAgent: data.userAgent ?? null,
+          createdAt: now(),
+          updatedAt: now(),
+        })
+        .returning()
+      return assertRow(row)
+    },
+
+    async getSessionByTokenHash(tokenHash: string): Promise<SessionWithUser | null> {
+      const [row] = await db
+        .select()
+        .from(schema.sessions)
+        .where(eq(schema.sessions.tokenHash, tokenHash))
+        .leftJoin(schema.users, eq(schema.sessions.userId, schema.users.id))
+
+      if (!row) return null
+
+      const user = row.users
+      if (!user) return null
+
+      return {
+        session: row.sessions,
+        user,
+      }
+    },
+
+    async updateSession(id: string, data: UpdateSessionInput): Promise<Session> {
+      const [row] = await db
+        .update(schema.sessions)
+        .set({
+          ...data,
+          updatedAt: now(),
+        })
+        .where(eq(schema.sessions.id, id))
+        .returning()
+      return assertRow(row)
+    },
+
+    async deleteSession(tokenHash: string): Promise<void> {
+      await db.delete(schema.sessions).where(eq(schema.sessions.tokenHash, tokenHash))
+    },
+
+    async deleteExpiredSessions(): Promise<void> {
+      await db.delete(schema.sessions).where(sql`expires_at < ${Date.now()}`)
+    },
+
+    // --- OAuth state operations ---
+
+    async createOAuthState(data: CreateOAuthStateInput): Promise<void> {
+      await db.insert(schema.oauthStates).values({
+        id: crypto.randomUUID(),
+        stateHash: data.stateHash,
+        codeVerifier: data.codeVerifier,
+        provider: data.provider,
+        callbackUrl: data.callbackUrl ?? null,
+        errorUrl: data.errorUrl ?? null,
+        expiresAt: data.expiresAt,
+        createdAt: now(),
+      })
+    },
+
+    async consumeOAuthState(stateHash: string): Promise<OAuthState | null> {
+      const [state] = await db
+        .select()
+        .from(schema.oauthStates)
+        .where(eq(schema.oauthStates.stateHash, stateHash))
+
+      if (!state) return null
+
+      await db.delete(schema.oauthStates).where(eq(schema.oauthStates.stateHash, stateHash))
+
+      return state
+    },
+  }
+
+  return adapter
+}

package/src/index.ts

@@ -0,0 +1,3 @@
+export { drizzleAdapter } from './adapter.js'
+export * as schema from './schema.js'
+export * as schemaPg from './schema-pg.js'

package/src/schema-pg.ts

@@ -0,0 +1,62 @@
+import { pgTable, text, boolean, timestamp, uniqueIndex } from 'drizzle-orm/pg-core'
+
+export const users = pgTable('users', {
+  id: text('id').primaryKey(),
+  email: text('email'),
+  emailVerified: boolean('email_verified').default(false).notNull(),
+  name: text('name'),
+  image: text('image'),
+  createdAt: timestamp('created_at').notNull(),
+  updatedAt: timestamp('updated_at').notNull(),
+})
+
+// eslint-disable-next-line @typescript-eslint/no-deprecated
+export const accounts = pgTable(
+  'accounts',
+  {
+    id: text('id').primaryKey(),
+    userId: text('user_id')
+      .notNull()
+      .references(() => users.id),
+    provider: text('provider').notNull(),
+    providerAccountId: text('provider_account_id').notNull(),
+    accessToken: text('access_token'),
+    refreshToken: text('refresh_token'),
+    idToken: text('id_token'),
+    scope: text('scope'),
+    tokenType: text('token_type'),
+    expiresAt: timestamp('expires_at'),
+    createdAt: timestamp('created_at').notNull(),
+    updatedAt: timestamp('updated_at').notNull(),
+  },
+  (table) => ({
+    providerAccountUnique: uniqueIndex('unique_provider_account').on(
+      table.provider,
+      table.providerAccountId,
+    ),
+  }),
+)
+
+export const sessions = pgTable('sessions', {
+  id: text('id').primaryKey(),
+  userId: text('user_id')
+    .notNull()
+    .references(() => users.id),
+  tokenHash: text('token_hash').unique().notNull(),
+  expiresAt: timestamp('expires_at').notNull(),
+  ipAddress: text('ip_address'),
+  userAgent: text('user_agent'),
+  createdAt: timestamp('created_at').notNull(),
+  updatedAt: timestamp('updated_at').notNull(),
+})
+
+export const oauthStates = pgTable('oauth_states', {
+  id: text('id').primaryKey(),
+  stateHash: text('state_hash').unique().notNull(),
+  codeVerifier: text('code_verifier').notNull(),
+  provider: text('provider').notNull(),
+  callbackUrl: text('callback_url'),
+  errorUrl: text('error_url'),
+  expiresAt: timestamp('expires_at').notNull(),
+  createdAt: timestamp('created_at').notNull(),
+})

package/src/schema.ts

@@ -0,0 +1,62 @@
+import { sqliteTable, text, integer, uniqueIndex } from 'drizzle-orm/sqlite-core'
+
+export const users = sqliteTable('users', {
+  id: text('id').primaryKey(),
+  email: text('email'),
+  emailVerified: integer('email_verified', { mode: 'boolean' }).default(false).notNull(),
+  name: text('name'),
+  image: text('image'),
+  createdAt: integer('created_at', { mode: 'timestamp_ms' }).notNull(),
+  updatedAt: integer('updated_at', { mode: 'timestamp_ms' }).notNull(),
+})
+
+// eslint-disable-next-line @typescript-eslint/no-deprecated
+export const accounts = sqliteTable(
+  'accounts',
+  {
+    id: text('id').primaryKey(),
+    userId: text('user_id')
+      .notNull()
+      .references(() => users.id),
+    provider: text('provider').notNull(),
+    providerAccountId: text('provider_account_id').notNull(),
+    accessToken: text('access_token'),
+    refreshToken: text('refresh_token'),
+    idToken: text('id_token'),
+    scope: text('scope'),
+    tokenType: text('token_type'),
+    expiresAt: integer('expires_at', { mode: 'timestamp_ms' }),
+    createdAt: integer('created_at', { mode: 'timestamp_ms' }).notNull(),
+    updatedAt: integer('updated_at', { mode: 'timestamp_ms' }).notNull(),
+  },
+  (table) => ({
+    providerAccountUnique: uniqueIndex('unique_provider_account').on(
+      table.provider,
+      table.providerAccountId,
+    ),
+  }),
+)
+
+export const sessions = sqliteTable('sessions', {
+  id: text('id').primaryKey(),
+  userId: text('user_id')
+    .notNull()
+    .references(() => users.id),
+  tokenHash: text('token_hash').unique().notNull(),
+  expiresAt: integer('expires_at', { mode: 'timestamp_ms' }).notNull(),
+  ipAddress: text('ip_address'),
+  userAgent: text('user_agent'),
+  createdAt: integer('created_at', { mode: 'timestamp_ms' }).notNull(),
+  updatedAt: integer('updated_at', { mode: 'timestamp_ms' }).notNull(),
+})
+
+export const oauthStates = sqliteTable('oauth_states', {
+  id: text('id').primaryKey(),
+  stateHash: text('state_hash').unique().notNull(),
+  codeVerifier: text('code_verifier').notNull(),
+  provider: text('provider').notNull(),
+  callbackUrl: text('callback_url'),
+  errorUrl: text('error_url'),
+  expiresAt: integer('expires_at', { mode: 'timestamp_ms' }).notNull(),
+  createdAt: integer('created_at', { mode: 'timestamp_ms' }).notNull(),
+})

package/src/test/adapter.test.ts

@@ -0,0 +1,93 @@
+import { describe, beforeAll, afterAll, beforeEach } from 'vitest'
+import { createClient } from '@libsql/client'
+import { runAdapterConformanceTests } from '@cloudauth/core/test'
+import { drizzleAdapter } from '../adapter.js'
+import * as schema from '../schema.js'
+import { drizzle } from 'drizzle-orm/libsql'
+
+describe('Drizzle SQLite adapter', () => {
+  let client: ReturnType<typeof createClient>
+
+  beforeAll(async () => {
+    client = createClient({
+      url: ':memory:',
+    })
+
+    // Create tables once
+    await client.execute(`
+      CREATE TABLE IF NOT EXISTS users (
+        id text PRIMARY KEY,
+        email text,
+        email_verified integer DEFAULT 0 NOT NULL,
+        name text,
+        image text,
+        created_at integer NOT NULL,
+        updated_at integer NOT NULL
+      )
+    `)
+    await client.execute(`
+      CREATE TABLE IF NOT EXISTS accounts (
+        id text PRIMARY KEY,
+        user_id text NOT NULL REFERENCES users(id),
+        provider text NOT NULL,
+        provider_account_id text NOT NULL,
+        access_token text,
+        refresh_token text,
+        id_token text,
+        scope text,
+        token_type text,
+        expires_at integer,
+        created_at integer NOT NULL,
+        updated_at integer NOT NULL
+      )
+    `)
+    await client.execute(`
+      CREATE UNIQUE INDEX IF NOT EXISTS unique_provider_account
+      ON accounts(provider, provider_account_id)
+    `)
+    await client.execute(`
+      CREATE TABLE IF NOT EXISTS sessions (
+        id text PRIMARY KEY,
+        user_id text NOT NULL REFERENCES users(id),
+        token_hash text UNIQUE NOT NULL,
+        expires_at integer NOT NULL,
+        ip_address text,
+        user_agent text,
+        created_at integer NOT NULL,
+        updated_at integer NOT NULL
+      )
+    `)
+    await client.execute(`
+      CREATE TABLE IF NOT EXISTS oauth_states (
+        id text PRIMARY KEY,
+        state_hash text UNIQUE NOT NULL,
+        code_verifier text NOT NULL,
+        provider text NOT NULL,
+        callback_url text,
+        error_url text,
+        expires_at integer NOT NULL,
+        created_at integer NOT NULL
+      )
+    `)
+  })
+
+  beforeEach(async () => {
+    // Clean data between tests to ensure test isolation
+    await client.execute('DELETE FROM accounts')
+    await client.execute('DELETE FROM sessions')
+    await client.execute('DELETE FROM oauth_states')
+    await client.execute('DELETE FROM users')
+  })
+
+  afterAll(() => {
+    client.close()
+  })
+
+  runAdapterConformanceTests({
+    name: 'SQLite (libsql)',
+    createAdapter: () => {
+      const db = drizzle(client, { schema })
+      return drizzleAdapter(db)
+    },
+  })
+})

package/src/test/auth.test.ts

@@ -0,0 +1,211 @@
+import { describe, it, expect, beforeAll, beforeEach, afterAll } from 'vitest'
+import { createClient } from '@libsql/client'
+import { drizzle } from 'drizzle-orm/libsql'
+import { drizzleAdapter } from '../adapter.js'
+import * as schema from '../schema.js'
+import { cloudAuth } from '@cloudauth/core'
+import type {
+  AuthProvider,
+  AuthorizationParams,
+  ExchangeCodeParams,
+  TokenSet,
+  ProviderProfile,
+} from '@cloudauth/core'
+
+// A mock provider for testing
+const mockProvider: AuthProvider = {
+  id: 'mock',
+  type: 'oauth',
+  authorizationUrl(params: AuthorizationParams): URL {
+    const url = new URL('https://mock.provider/oauth/authorize')
+    url.searchParams.set('state', params.state)
+    url.searchParams.set('code_challenge', params.codeVerifier)
+    url.searchParams.set('redirect_uri', params.redirectUri)
+    return url
+  },
+  exchangeCode(_params: ExchangeCodeParams): Promise<TokenSet> {
+    return Promise.resolve({
+      accessToken: 'mock_access_token',
+      refreshToken: 'mock_refresh_token',
+      scope: 'email profile',
+      tokenType: 'Bearer',
+      expiresAt: 3600,
+    })
+  },
+  getProfile(_tokens: TokenSet): Promise<ProviderProfile> {
+    return Promise.resolve({
+      provider: 'mock',
+      providerAccountId: 'mock_user_123',
+      email: 'mock@example.com',
+      emailVerified: true,
+      name: 'Mock User',
+      image: 'https://example.com/avatar.png',
+    })
+  },
+}
+
+function getCookieValue(cookieHeader: string): string | null {
+  const firstPart = cookieHeader.split(';')[0]
+  if (!firstPart) return null
+  const eqIndex = firstPart.indexOf('=')
+  if (eqIndex === -1) return null
+  return firstPart.slice(eqIndex + 1)
+}
+
+describe('cloudAuth integration', () => {
+  let client: ReturnType<typeof createClient>
+  let auth: ReturnType<typeof cloudAuth>
+
+  beforeAll(async () => {
+    client = createClient({ url: ':memory:' })
+
+    await client.execute(`
+      CREATE TABLE IF NOT EXISTS users (
+        id text PRIMARY KEY, email text, email_verified integer DEFAULT 0 NOT NULL,
+        name text, image text, created_at integer NOT NULL, updated_at integer NOT NULL
+      )
+    `)
+    await client.execute(`
+      CREATE TABLE IF NOT EXISTS accounts (
+        id text PRIMARY KEY, user_id text NOT NULL REFERENCES users(id),
+        provider text NOT NULL, provider_account_id text NOT NULL,
+        access_token text, refresh_token text, id_token text,
+        scope text, token_type text, expires_at integer,
+        created_at integer NOT NULL, updated_at integer NOT NULL
+      )
+    `)
+    await client.execute(`
+      CREATE UNIQUE INDEX IF NOT EXISTS unique_provider_account
+      ON accounts(provider, provider_account_id)
+    `)
+    await client.execute(`
+      CREATE TABLE IF NOT EXISTS sessions (
+        id text PRIMARY KEY, user_id text NOT NULL REFERENCES users(id),
+        token_hash text UNIQUE NOT NULL, expires_at integer NOT NULL,
+        ip_address text, user_agent text,
+        created_at integer NOT NULL, updated_at integer NOT NULL
+      )
+    `)
+    await client.execute(`
+      CREATE TABLE IF NOT EXISTS oauth_states (
+        id text PRIMARY KEY, state_hash text UNIQUE NOT NULL,
+        code_verifier text NOT NULL, provider text NOT NULL,
+        callback_url text, error_url text,
+        expires_at integer NOT NULL, created_at integer NOT NULL
+      )
+    `)
+  })
+
+  beforeEach(async () => {
+    await client.execute('DELETE FROM accounts')
+    await client.execute('DELETE FROM sessions')
+    await client.execute('DELETE FROM oauth_states')
+    await client.execute('DELETE FROM users')
+
+    const db = drizzle(client, { schema })
+    auth = cloudAuth({
+      appName: 'TestApp',
+      baseURL: 'https://test.example.com',
+      providers: [mockProvider],
+      database: drizzleAdapter(db),
+      security: { secret: 'test-secret-that-is-at-least-32-characters!!' },
+    })
+  })
+
+  afterAll(() => {
+    client.close()
+  })
+
+  it('should create an authorization URL', async () => {
+    const url = await auth.createAuthUrl('mock')
+    expect(url).toBeInstanceOf(URL)
+    expect(url.hostname).toBe('mock.provider')
+    expect(url.searchParams.has('state')).toBe(true)
+    expect(url.searchParams.has('code_challenge')).toBe(true)
+    expect(url.searchParams.has('redirect_uri')).toBe(true)
+  })
+
+  it('should handle a full sign-in callback', async () => {
+    const authUrl = await auth.createAuthUrl('mock')
+    const stateParam = authUrl.searchParams.get('state')
+    expect(stateParam).toBeTruthy()
+
+    const callbackUrl = `https://test.example.com/auth/mock/callback?code=mock_code&state=${String(stateParam)}`
+    const result = await auth.handleCallback('mock', new Request(callbackUrl))
+
+    expect(result.user).toBeDefined()
+    expect(result.user.email).toBe('mock@example.com')
+    expect(result.session).toBeDefined()
+    expect(result.cookieHeader).toContain('cloud_auth_session')
+    expect(result.cookieHeader).toContain('HttpOnly')
+  })
+
+  it('should get a valid session after sign-in', async () => {
+    const authUrl = await auth.createAuthUrl('mock')
+    const stateParam = authUrl.searchParams.get('state')
+    expect(stateParam).toBeTruthy()
+    const callbackUrl = `https://test.example.com/auth/mock/callback?code=mock_code&state=${String(stateParam)}`
+    const result = await auth.handleCallback('mock', new Request(callbackUrl))
+
+    const cookieValue = getCookieValue(result.cookieHeader)
+    expect(cookieValue).toBeTruthy()
+
+    const sessionRequest = new Request('https://test.example.com/dashboard', {
+      headers: { cookie: `cloud_auth_session=${String(cookieValue)}` },
+    })
+
+    const session = await auth.getSession(sessionRequest)
+    expect(session).not.toBeNull()
+    if (session) {
+      expect(session.user.email).toBe('mock@example.com')
+    }
+  })
+
+  it('should return null for unauthenticated requests', async () => {
+    const req = new Request('https://test.example.com/protected')
+    const session = await auth.getSession(req)
+    expect(session).toBeNull()
+  })
+
+  it('should sign out and clear the session', async () => {
+    const authUrl = await auth.createAuthUrl('mock')
+    const stateParam = authUrl.searchParams.get('state')
+    expect(stateParam).toBeTruthy()
+    const callbackUrl = `https://test.example.com/auth/mock/callback?code=mock_code&state=${String(stateParam)}`
+    const result = await auth.handleCallback('mock', new Request(callbackUrl))
+    const cookieValue = getCookieValue(result.cookieHeader)
+    expect(cookieValue).toBeTruthy()
+
+    const signOutReq = new Request('https://test.example.com/logout', {
+      headers: { cookie: `cloud_auth_session=${String(cookieValue)}` },
+    })
+    const clearCookie = await auth.signOut(signOutReq)
+
+    expect(clearCookie).toContain('Max-Age=0')
+
+    const checkReq = new Request('https://test.example.com/dashboard', {
+      headers: { cookie: `cloud_auth_session=${String(cookieValue)}` },
+    })
+    const session = await auth.getSession(checkReq)
+    expect(session).toBeNull()
+  })
+
+  it('should throw on invalid state', async () => {
+    const callbackUrl = 'https://test.example.com/auth/mock/callback?code=bad&state=invalid'
+    await expect(auth.handleCallback('mock', new Request(callbackUrl))).rejects.toThrow()
+  })
+
+  it('should throw on missing security secret', async () => {
+    const db = drizzle(client, { schema })
+    const badAuth = cloudAuth({
+      appName: 'Test',
+      baseURL: 'https://test.com',
+      providers: [mockProvider],
+      database: drizzleAdapter(db),
+    })
+
+    await expect(badAuth.getSession(new Request('https://test.com'))).rejects.toThrow(
+      'security.secret is required',
+    )
+  })
+})