@coffer-org/server 7.2.0 → 7.4.0

package/dist/auth-api.d.ts

@@ -7,6 +7,10 @@ declare module 'fastify' {
 }
 export declare const PUBLIC_API_PATHS: string[];
 export declare function startPasswordSession(reply: FastifyReply, login: string, password: string): Promise<AuthUser | null>;
+export declare function parseBasicCredential(header: string | undefined): {
+    login: string;
+    secret: string;
+} | null;
 export declare function resolveRequestUser(req: FastifyRequest): Promise<AuthUser | null>;
 export declare function requireAdmin(req: FastifyRequest, reply: FastifyReply): boolean;
 export declare function registerAuthApi(app: FastifyInstance): Promise<void>;

package/dist/auth-api.js

@@ -2,6 +2,7 @@ import { field } from '@coffer-org/sdk/fields';
 import { materializeTree } from '@coffer-org/sdk/materialize/pipeline';
 import { countUsers, createUser, findUserByLogin, findUserById, getPasswordHash, listUsers, updateUser, deleteUser, countAdmins, createSession, resolveSession, deleteSession, createApiToken, resolveApiToken, listApiTokens, revokeApiToken, } from "./auth-store.js";
 import { resolveAccessToken } from "./oauth-store.js";
+import { listIdentityProviders, getIdentityProvider } from "./identity-providers.js";
 import { mcpResource } from "./public-url.js";
 import { verifyPassword } from "./auth-crypto.js";
 import { maskSecrets, preserveSecrets } from "./field-masking.js";
@@ -37,12 +38,32 @@ export async function startPasswordSession(reply, login, password) {
     setCookie(reply, raw, SESSION_TTL_MS / 1000);
     return row;
 }
+export function parseBasicCredential(header) {
+    if (!header?.startsWith('Basic '))
+        return null;
+    let decoded;
+    try {
+        decoded = Buffer.from(header.slice('Basic '.length).trim(), 'base64').toString('utf8');
+    }
+    catch {
+        return null;
+    }
+    const at = decoded.indexOf(':');
+    if (at <= 0)
+        return null;
+    return { login: decoded.slice(0, at), secret: decoded.slice(at + 1) };
+}
 export async function resolveRequestUser(req) {
     const auth = req.headers.authorization;
     if (auth?.startsWith('Bearer ')) {
         const raw = auth.slice('Bearer '.length);
         return (await resolveApiToken(raw)) ?? (await resolveAccessToken(raw, await mcpResource(req)));
     }
+    const basic = parseBasicCredential(auth);
+    if (basic) {
+        const user = await resolveApiToken(basic.secret);
+        return user && user.login === basic.login ? user : null;
+    }
     const sid = readCookie(req, COOKIE_NAME);
     if (!sid)
         return null;
@@ -208,4 +229,35 @@ export async function registerAuthApi(app) {
             return reply.code(404).send({ error: 'not_found' });
         return { ok: true };
     });
+    app.get('/api/auth/links', async (req, reply) => {
+        if (!req.user)
+            return reply.code(401).send({ error: 'unauthorized' });
+        const providers = listIdentityProviders();
+        const links = (await Promise.all(providers.map(async (p) => (await p.listLinks(req.user.id)).map((l) => ({ provider: p.id, ...l }))))).flat();
+        return { providers: providers.map(({ id, label, icon }) => ({ id, label, icon })), links };
+    });
+    app.post('/api/auth/links/:provider', async (req, reply) => {
+        if (!req.user)
+            return reply.code(401).send({ error: 'unauthorized' });
+        const { provider } = req.params;
+        const p = getIdentityProvider(provider);
+        if (!p)
+            return reply.code(404).send({ error: 'not_found' });
+        const started = await p.beginLink(req.user.id);
+        if (!started)
+            return reply.code(503).send({ error: 'unavailable' });
+        return started;
+    });
+    app.delete('/api/auth/links/:provider/:externalId', async (req, reply) => {
+        if (!req.user)
+            return reply.code(401).send({ error: 'unauthorized' });
+        const { provider, externalId } = req.params;
+        const p = getIdentityProvider(provider);
+        if (!p)
+            return reply.code(404).send({ error: 'not_found' });
+        const ok = await p.unlink(req.user.id, externalId);
+        if (!ok)
+            return reply.code(404).send({ error: 'not_found' });
+        return { ok: true };
+    });
 }

package/dist/auth-store.d.ts

@@ -1,3 +1,5 @@
+import { generateToken, hashToken } from './auth-crypto.ts';
+export { generateToken, hashToken };
 export interface AuthUser {
     id: number;
     login: string;

package/dist/auth-store.js

@@ -1,5 +1,6 @@
 import { getEm } from "./db.js";
 import { hashPassword, generateToken, hashToken } from "./auth-crypto.js";
+export { generateToken, hashToken };
 function toAuthUser(row) {
     return {
         id: row.id,

package/dist/compute-unit.js

@@ -1,5 +1,4 @@
 import { hasChildren, isNamedField, isCollectionGroup, isEmbeddedGroup, isStorageGroup, } from '@coffer-org/sdk/fields';
-import { mandatedClientParts } from '@coffer-org/sdk/parts';
 import { PartContractError } from "./part-errors.js";
 import { createRefLoader } from "./part-ref.js";
 import { wholeClockColumn, partClockColumn } from "./cache-clock.js";
@@ -267,8 +266,6 @@ export function materializable(fm) {
     const parts = fm.parts ?? [];
     if (!parts.some((p) => p.mode === 'computedStored'))
         return false;
-    if (mandatedClientParts(fm.required, parts).length > 0)
-        return false;
     return true;
 }
 export function storedFilled(fm, value) {

package/dist/conversation-store.d.ts

@@ -0,0 +1,61 @@
+export declare const HIDDEN_ROLES: readonly ["reasoning", "suggestions", "context"];
+export declare const SIDECAR_ROLES: readonly ["reasoning", "suggestions"];
+export declare const TITLE_MAX = 60;
+export declare const DEFAULT_MAX_DEPTH = 40;
+export declare const conversationEmitter: EventTarget;
+export interface PutMessageInput {
+    conversationId: string;
+    msgId: string;
+    role: string;
+    sender?: string | null;
+    text: string;
+    attachments?: StoredAttachment[];
+    ts: number;
+    replyToId?: string | null;
+}
+export declare function onMessage(cb: (m: PutMessageInput) => void | Promise<void>): () => void;
+export interface StoredMsg {
+    msgId: string;
+    role: string;
+    sender: string | null;
+    text: string;
+    attachments?: StoredAttachment[];
+    ts: number;
+    replyToId: string | null;
+}
+export interface StoredAttachment {
+    name: string;
+    mime?: string;
+    size?: number;
+    label?: string;
+}
+export interface Conversation {
+    id: string;
+    owner: string | null;
+    title: string | null;
+    agentId: string | null;
+    presetId: string | null;
+    visibility: 'private' | null;
+    updatedAt: string;
+}
+export interface ConversationSummary extends Conversation {
+    lastTs: number;
+    count: number;
+    firstUserText: string;
+}
+export declare function newConversationId(): string;
+export declare function newMessageId(): string;
+export declare function getConversation(id: string): Promise<Conversation>;
+export declare function setConversation(id: string, patch: Partial<Omit<Conversation, 'id' | 'updatedAt'>>): Promise<void>;
+export declare function readAndTouchConversation(id: string): Promise<Conversation>;
+export declare function listConversations(viewerId: string): Promise<ConversationSummary[]>;
+export declare function putMessage(m: PutMessageInput): Promise<void>;
+export declare const insertMessage: typeof putMessage;
+export declare function getMessage(conversationId: string, msgId: string): Promise<StoredMsg | null>;
+export declare function readConversation(conversationId: string, opts?: {
+    limit?: number;
+}): Promise<StoredMsg[]>;
+export declare function readAll(conversationId: string): Promise<StoredMsg[]>;
+export declare function countUserMessages(conversationId: string): Promise<number>;
+export declare function lastMessageId(conversationId: string): Promise<string | null>;
+export declare function pruneConversations(cutoffTs: number, cutoffIso: string): Promise<void>;

package/dist/conversation-store.js

@@ -0,0 +1,223 @@
+import { randomUUID } from 'node:crypto';
+import { getEm } from "./db.js";
+import { mayRead } from "./orchestrator/conversation-access.js";
+export const HIDDEN_ROLES = ['reasoning', 'suggestions', 'context'];
+export const SIDECAR_ROLES = ['reasoning', 'suggestions'];
+export const TITLE_MAX = 60;
+export const DEFAULT_MAX_DEPTH = 40;
+export const conversationEmitter = new EventTarget();
+export function onMessage(cb) {
+    const handler = (e) => {
+        if (e instanceof CustomEvent) {
+            void cb(e.detail);
+        }
+    };
+    conversationEmitter.addEventListener('message', handler);
+    return () => {
+        conversationEmitter.removeEventListener('message', handler);
+    };
+}
+function capTitle(title) {
+    const t = title.trim();
+    return t.length <= TITLE_MAX ? t : `${t.slice(0, TITLE_MAX - 1)}…`;
+}
+function emptyConversation(id) {
+    return {
+        id,
+        owner: null,
+        title: null,
+        agentId: null,
+        presetId: null,
+        visibility: null,
+        updatedAt: '',
+    };
+}
+function toConversation(row) {
+    return {
+        id: row.id,
+        owner: row.owner,
+        title: row.title,
+        agentId: row.agent_id,
+        presetId: row.preset_id,
+        visibility: row.visibility === 'private' ? 'private' : null,
+        updatedAt: row.updated_at,
+    };
+}
+function toStored(r) {
+    let attachments;
+    if (r.attachments) {
+        try {
+            const parsed = JSON.parse(r.attachments);
+            if (Array.isArray(parsed)) {
+                const valid = parsed.filter((v) => typeof v === 'object' && v !== null && typeof v.name === 'string');
+                if (valid.length)
+                    attachments = valid;
+            }
+        }
+        catch {
+        }
+    }
+    return {
+        msgId: r.msg_id,
+        role: r.role,
+        sender: r.sender,
+        text: r.text,
+        ...(attachments ? { attachments } : {}),
+        ts: r.ts,
+        replyToId: r.reply_to_id,
+    };
+}
+export function newConversationId() {
+    return randomUUID();
+}
+export function newMessageId() {
+    return randomUUID();
+}
+export async function getConversation(id) {
+    const em = getEm().fork();
+    const row = (await em.findOne('_Conversation', { id }));
+    if (!row)
+        return emptyConversation(id);
+    return toConversation(row);
+}
+export async function setConversation(id, patch) {
+    const em = getEm().fork();
+    const data = { updated_at: new Date().toISOString() };
+    if ('agentId' in patch)
+        data['agent_id'] = patch.agentId ?? null;
+    if ('presetId' in patch)
+        data['preset_id'] = patch.presetId ?? null;
+    if ('title' in patch)
+        data['title'] = patch.title ? capTitle(patch.title) : null;
+    if ('owner' in patch)
+        data['owner'] = patch.owner ?? null;
+    if ('visibility' in patch)
+        data['visibility'] = patch.visibility ?? null;
+    const existing = (await em.findOne('_Conversation', { id }));
+    if (existing) {
+        em.assign(existing, data);
+    }
+    else {
+        em.persist(em.create('_Conversation', {
+            id,
+            agent_id: data['agent_id'] ?? null,
+            preset_id: data['preset_id'] ?? null,
+            title: data['title'] ?? null,
+            owner: data['owner'] ?? null,
+            visibility: data['visibility'] ?? null,
+            updated_at: data['updated_at'],
+        }));
+    }
+    await em.flush();
+    conversationEmitter.dispatchEvent(new CustomEvent('conversation', { detail: { id, patch } }));
+}
+export async function readAndTouchConversation(id) {
+    const em = getEm().fork();
+    const row = (await em.findOne('_Conversation', { id }));
+    if (!row)
+        return emptyConversation(id);
+    const now = new Date().toISOString();
+    em.assign(row, { updated_at: now });
+    await em.flush();
+    return toConversation(row);
+}
+export async function listConversations(viewerId) {
+    const em = getEm().fork();
+    const convRows = (await em.find('_Conversation', {}));
+    const msgRows = (await em.find('_ConversationMessage', {}, { orderBy: { ts: 'asc', msg_id: 'asc' } }));
+    const msgSummaries = new Map();
+    for (const r of msgRows) {
+        if (HIDDEN_ROLES.includes(r.role))
+            continue;
+        const cur = msgSummaries.get(r.conversation_id);
+        if (!cur) {
+            msgSummaries.set(r.conversation_id, {
+                lastTs: r.ts,
+                count: 1,
+                firstUserText: r.role === 'user' ? r.text : '',
+            });
+            continue;
+        }
+        cur.count += 1;
+        if (r.ts > cur.lastTs)
+            cur.lastTs = r.ts;
+        if (!cur.firstUserText && r.role === 'user')
+            cur.firstUserText = r.text;
+    }
+    const convMap = new Map();
+    for (const r of convRows) {
+        convMap.set(r.id, toConversation(r));
+    }
+    const allIds = new Set([...convMap.keys(), ...msgSummaries.keys()]);
+    const out = [];
+    for (const id of allIds) {
+        const conv = convMap.get(id) ?? emptyConversation(id);
+        if (!mayRead(conv, viewerId))
+            continue;
+        const summary = msgSummaries.get(id);
+        out.push({
+            ...conv,
+            lastTs: summary?.lastTs ?? 0,
+            count: summary?.count ?? 0,
+            firstUserText: summary?.firstUserText ?? '',
+        });
+    }
+    return out.sort((a, b) => {
+        if (b.lastTs !== a.lastTs)
+            return b.lastTs - a.lastTs;
+        return (b.updatedAt || '').localeCompare(a.updatedAt || '') || b.id.localeCompare(a.id);
+    });
+}
+export async function putMessage(m) {
+    const em = getEm().fork();
+    await em.upsert('_ConversationMessage', {
+        conversation_id: m.conversationId,
+        msg_id: m.msgId,
+        role: m.role,
+        sender: m.sender ?? null,
+        attachments: m.attachments?.length ? JSON.stringify(m.attachments) : null,
+        text: m.text,
+        ts: m.ts,
+        reply_to_id: m.replyToId ?? null,
+    });
+    await em.flush();
+    conversationEmitter.dispatchEvent(new CustomEvent('message', { detail: m }));
+}
+export const insertMessage = putMessage;
+export async function getMessage(conversationId, msgId) {
+    const em = getEm().fork();
+    const row = (await em.findOne('_ConversationMessage', { conversation_id: conversationId, msg_id: msgId }));
+    return row ? toStored(row) : null;
+}
+export async function readConversation(conversationId, opts) {
+    const limit = opts?.limit ?? DEFAULT_MAX_DEPTH;
+    const em = getEm().fork();
+    const visible = (await em.find('_ConversationMessage', { conversation_id: conversationId, role: { $nin: HIDDEN_ROLES } }, { orderBy: { ts: 'desc', msg_id: 'desc' }, limit }));
+    const oldest = visible.at(-1)?.ts;
+    const sidecars = oldest === undefined
+        ? []
+        : (await em.find('_ConversationMessage', { conversation_id: conversationId, role: { $in: SIDECAR_ROLES }, ts: { $gte: oldest - 1 } }, { orderBy: { ts: 'desc', msg_id: 'desc' } }));
+    return [...visible, ...sidecars]
+        .sort((a, b) => b.ts - a.ts || (a.msg_id < b.msg_id ? 1 : a.msg_id > b.msg_id ? -1 : 0))
+        .reverse()
+        .map(toStored);
+}
+export async function readAll(conversationId) {
+    const em = getEm().fork();
+    const rows = (await em.find('_ConversationMessage', { conversation_id: conversationId }, { orderBy: { ts: 'asc', msg_id: 'asc' } }));
+    return rows.map(toStored);
+}
+export async function countUserMessages(conversationId) {
+    const em = getEm().fork();
+    return em.count('_ConversationMessage', { conversation_id: conversationId, role: 'user' });
+}
+export async function lastMessageId(conversationId) {
+    const em = getEm().fork();
+    const row = (await em.findOne('_ConversationMessage', { conversation_id: conversationId, role: { $nin: HIDDEN_ROLES } }, { orderBy: { ts: 'desc', msg_id: 'desc' } }));
+    return row ? row.msg_id : null;
+}
+export async function pruneConversations(cutoffTs, cutoffIso) {
+    const em = getEm().fork();
+    await em.nativeDelete('_ConversationMessage', { ts: { $lt: cutoffTs } });
+    await em.nativeDelete('_Conversation', { updated_at: { $lt: cutoffIso }, owner: null, visibility: null });
+}

package/dist/entity-schema.d.ts

@@ -3,10 +3,13 @@ import type { ShelfDef } from '@coffer-org/sdk/shelf';
 import type { ExtendDef } from '@coffer-org/sdk/extend';
 import type { SettingsDef } from '@coffer-org/sdk/settings';
 import type { PluginManifest } from '@coffer-org/sdk/plugin';
+import type { PrivateTableDef } from './plugin-hooks.ts';
 export declare function shelfTableName(library: string, shelf: string): string;
 export declare function buildEntitySchema(m: ShelfDef): EntitySchema;
 export declare function buildExtendEntitySchema(e: ExtendDef): EntitySchema;
 export declare function buildSettingsEntitySchema(pluginId: string, settings: SettingsDef): EntitySchema;
+export declare function privateTableName(pluginId: string, name: string): string;
+export declare function buildPrivateTableEntity(pluginId: string, t: PrivateTableDef): EntitySchema;
 export declare function childTableName(library: string, shelf: string, key: string): string;
 export declare function buildCollectionEntities(m: ShelfDef): EntitySchema[];
 export declare function buildExtendCollectionEntities(e: ExtendDef): EntitySchema[];
@@ -18,8 +21,8 @@ export declare const SeedRowSchema: EntitySchema<any, never, import("@mikro-orm/
 export declare const EmbeddingSchema: EntitySchema<any, never, import("@mikro-orm/core").EntityCtor<any>>;
 export declare const PluginStateSchema: EntitySchema<any, never, import("@mikro-orm/core").EntityCtor<any>>;
 export declare const RecordActivitySchema: EntitySchema<any, never, import("@mikro-orm/core").EntityCtor<any>>;
-export declare const ThreadMessageSchema: EntitySchema<any, never, import("@mikro-orm/core").EntityCtor<any>>;
-export declare const ThreadStateSchema: EntitySchema<any, never, import("@mikro-orm/core").EntityCtor<any>>;
+export declare const ConversationMessageSchema: EntitySchema<any, never, import("@mikro-orm/core").EntityCtor<any>>;
+export declare const ConversationSchema: EntitySchema<any, never, import("@mikro-orm/core").EntityCtor<any>>;
 export declare function buildPluginEntities(plugins: PluginManifest[]): EntitySchema[];
 export declare const MsgLogSchema: EntitySchema<any, never, import("@mikro-orm/core").EntityCtor<any>>;
 export declare const UserSchema: EntitySchema<any, never, import("@mikro-orm/core").EntityCtor<any>>;

package/dist/entity-schema.js

@@ -23,14 +23,14 @@ function columnProp(field, nullable) {
         p['default'] = field.default;
     return p;
 }
-function addFieldProps(properties, fields, plainNullable) {
+function addFieldProps(properties, fields) {
     for (const [key, field] of fieldEntries(fields)) {
         if (field.columns) {
             for (const [col, type] of storageColumns(key, field))
                 properties[col] = { type: mikroType(type), nullable: true };
         }
         else {
-            properties[key] = columnProp(field, plainNullable(field));
+            properties[key] = columnProp(field, true);
         }
     }
     for (const col of cacheClockColumns(fields))
@@ -46,7 +46,7 @@ export function buildEntitySchema(m) {
         updated_at: { type: 'text' },
         deleted_at: { type: 'text', nullable: true },
     };
-    addFieldProps(properties, m.fields, (f) => !f.required);
+    addFieldProps(properties, m.fields);
     const name = shelfTableName(m.library, m.shelf);
     return new EntitySchema({ name, tableName: name, properties });
 }
@@ -54,7 +54,7 @@ export function buildExtendEntitySchema(e) {
     const properties = {
         base_id: { type: 'integer', primary: true },
     };
-    addFieldProps(properties, e.fields, () => true);
+    addFieldProps(properties, e.fields);
     const name = `extend__${e.id}`;
     return new EntitySchema({ name, tableName: name, properties });
 }
@@ -62,10 +62,26 @@ export function buildSettingsEntitySchema(pluginId, settings) {
     const properties = {
         plugin_id: { type: 'text', primary: true },
     };
-    addFieldProps(properties, settings.fields, (f) => !f.required);
+    addFieldProps(properties, settings.fields);
     const name = `_settings__${pluginId}`;
     return new EntitySchema({ name, tableName: name, properties });
 }
+export function privateTableName(pluginId, name) {
+    return `_${pluginId}__${name}`;
+}
+export function buildPrivateTableEntity(pluginId, t) {
+    const properties = {
+        id: { type: 'integer', primary: true, autoincrement: true },
+    };
+    addFieldProps(properties, t.fields);
+    const name = privateTableName(pluginId, t.name);
+    return new EntitySchema({
+        name,
+        tableName: name,
+        properties,
+        uniques: (t.unique ?? []).map((properties) => ({ properties })),
+    });
+}
 export function childTableName(library, shelf, key) {
     return `${library}__${shelf}__${key}`;
 }
@@ -75,7 +91,7 @@ function buildChildSchemaAt(prefix, c) {
         parent_id: { type: 'integer', index: true },
         position: { type: 'integer' },
     };
-    addFieldProps(properties, c.group.fields, (f) => !f.required);
+    addFieldProps(properties, c.group.fields);
     const name = `${prefix}__${c.key}`;
     return new EntitySchema({ name, tableName: name, properties });
 }
@@ -186,12 +202,11 @@ export const RecordActivitySchema = new EntitySchema({
         last_viewed_at: { type: 'text', nullable: true },
     },
 });
-export const ThreadMessageSchema = new EntitySchema({
-    name: '_ThreadMessage',
-    tableName: '_thread_message',
+export const ConversationMessageSchema = new EntitySchema({
+    name: '_ConversationMessage',
+    tableName: '_conversation_message',
     properties: {
-        connector: { type: 'text', primary: true },
-        chat_id: { type: 'text', primary: true },
+        conversation_id: { type: 'text', primary: true },
         msg_id: { type: 'text', primary: true },
         role: { type: 'text' },
         sender: { type: 'text', nullable: true },
@@ -201,14 +216,16 @@ export const ThreadMessageSchema = new EntitySchema({
         reply_to_id: { type: 'text', nullable: true },
     },
 });
-export const ThreadStateSchema = new EntitySchema({
-    name: '_ThreadState',
-    tableName: '_thread_state',
+export const ConversationSchema = new EntitySchema({
+    name: '_Conversation',
+    tableName: '_conversation',
     properties: {
-        connector: { type: 'text', primary: true },
-        chat_id: { type: 'text', primary: true },
+        id: { type: 'text', primary: true },
         agent_id: { type: 'text', nullable: true },
         preset_id: { type: 'text', nullable: true },
+        title: { type: 'text', nullable: true },
+        owner: { type: 'text', nullable: true },
+        visibility: { type: 'text', nullable: true },
         updated_at: { type: 'text' },
     },
 });
@@ -329,7 +346,7 @@ export const systemEntities = [
     OAuthClientSchema,
     OAuthCodeSchema,
     OAuthTokenSchema,
-    ThreadMessageSchema,
-    ThreadStateSchema,
+    ConversationMessageSchema,
+    ConversationSchema,
     buildSettingsEntitySchema(SYSTEM_SETTINGS_ID, SYSTEM_SETTINGS),
 ];

package/dist/identity-link.d.ts

@@ -0,0 +1,15 @@
+export interface IdentityLink {
+    connector: string;
+    externalId: string;
+    userId: number;
+    linkedAt: string;
+}
+export declare function findLinkedUser(connector: string, externalId: string): Promise<number | null>;
+export declare function listLinks(userId: number): Promise<IdentityLink[]>;
+export declare function unlink(connector: string, externalId: string): Promise<boolean>;
+export declare function mintLinkCode(userId: number, ttlMs: number): Promise<{
+    raw: string;
+    expiresAt: string;
+}>;
+export declare function redeemLinkCode(raw: string, connector: string, externalId: string): Promise<number | null>;
+export declare function pruneLinkCodes(): Promise<void>;

package/dist/identity-link.js

@@ -0,0 +1,76 @@
+import { getEm } from "./db.js";
+import { generateToken, hashToken, findUserById } from "./auth-store.js";
+export async function findLinkedUser(connector, externalId) {
+    const em = getEm().fork();
+    const row = (await em.findOne('_IdentityLink', {
+        connector,
+        external_id: externalId,
+    }));
+    if (!row)
+        return null;
+    const user = await findUserById(row.user_id);
+    return user && !user.disabled ? row.user_id : null;
+}
+export async function listLinks(userId) {
+    const em = getEm().fork();
+    const rows = (await em.find('_IdentityLink', { user_id: userId }));
+    return rows.map((r) => ({
+        connector: r.connector,
+        externalId: r.external_id,
+        userId: r.user_id,
+        linkedAt: r.linked_at,
+    }));
+}
+export async function unlink(connector, externalId) {
+    const em = getEm().fork();
+    const deleted = await em.nativeDelete('_IdentityLink', { connector, external_id: externalId });
+    return deleted > 0;
+}
+export async function mintLinkCode(userId, ttlMs) {
+    const em = getEm().fork();
+    const raw = generateToken();
+    const expiresAt = new Date(Date.now() + ttlMs).toISOString();
+    em.create('_LinkCode', {
+        code_hash: hashToken(raw),
+        user_id: userId,
+        expires_at: expiresAt,
+        created_at: new Date().toISOString(),
+    });
+    await em.flush();
+    return { raw, expiresAt };
+}
+async function setLink(em, connector, externalId, userId) {
+    const existing = (await em.findOne('_IdentityLink', {
+        connector,
+        external_id: externalId,
+    }));
+    const linkedAt = new Date().toISOString();
+    if (existing) {
+        em.assign(existing, { user_id: userId, linked_at: linkedAt });
+    }
+    else {
+        em.create('_IdentityLink', { connector, external_id: externalId, user_id: userId, linked_at: linkedAt });
+    }
+    await em.flush();
+}
+export async function redeemLinkCode(raw, connector, externalId) {
+    const em = getEm().fork();
+    const hash = hashToken(raw);
+    const row = (await em.findOne('_LinkCode', { code_hash: hash }));
+    if (!row)
+        return null;
+    const deleted = await em.nativeDelete('_LinkCode', { code_hash: hash });
+    if (deleted === 0)
+        return null;
+    if (row.expires_at < new Date().toISOString())
+        return null;
+    const owner = await findUserById(row.user_id);
+    if (!owner || owner.disabled)
+        return null;
+    await setLink(em, connector, externalId, row.user_id);
+    return row.user_id;
+}
+export async function pruneLinkCodes() {
+    const em = getEm().fork();
+    await em.nativeDelete('_LinkCode', { expires_at: { $lt: new Date().toISOString() } });
+}

package/dist/identity-providers.d.ts

@@ -0,0 +1,17 @@
+export interface IdentityProvider {
+    id: string;
+    label: string;
+    icon: string;
+    beginLink(userId: number): Promise<{
+        url?: string;
+        code?: string;
+    } | null>;
+    listLinks(userId: number): Promise<{
+        externalId: string;
+        linkedAt: string;
+    }[]>;
+    unlink(userId: number, externalId: string): Promise<boolean>;
+}
+export declare function registerIdentityProvider(p: IdentityProvider): () => void;
+export declare function listIdentityProviders(): IdentityProvider[];
+export declare function getIdentityProvider(id: string): IdentityProvider | undefined;

package/dist/identity-providers.js

@@ -0,0 +1,14 @@
+const providers = new Map();
+export function registerIdentityProvider(p) {
+    providers.set(p.id, p);
+    return () => {
+        if (providers.get(p.id) === p)
+            providers.delete(p.id);
+    };
+}
+export function listIdentityProviders() {
+    return [...providers.values()].sort((a, b) => a.id.localeCompare(b.id));
+}
+export function getIdentityProvider(id) {
+    return providers.get(id);
+}