@enderworld/onlyapi 1.5.1

package/src/infrastructure/database/mssql/mssql-oauth-accounts.ts

@@ -0,0 +1,118 @@
+/**
+ * SQL Server OAuth account repository adapter.
+ */
+
+import type sql from "mssql";
+import { conflict, internal, notFound } from "../../../core/errors/app-error.js";
+import type { AppError } from "../../../core/errors/app-error.js";
+import type { OAuthAccount, OAuthAccountRepository } from "../../../core/ports/oauth.js";
+import type { UserId } from "../../../core/types/brand.js";
+import { brand } from "../../../core/types/brand.js";
+import { type Result, err, ok } from "../../../core/types/result.js";
+import { generateId } from "../../../shared/utils/id.js";
+
+const toOAuthAccount = (row: Record<string, unknown>): OAuthAccount => ({
+  id: row["id"] as string,
+  userId: brand<string, "UserId">(row["user_id"] as string),
+  provider: row["provider"] as string,
+  providerUserId: row["provider_user_id"] as string,
+  email: (row["email"] as string) ?? null,
+  createdAt: Number(row["created_at"]),
+});
+
+export const createMssqlOAuthAccountRepo = (pool: sql.ConnectionPool): OAuthAccountRepository => ({
+  async link(
+    userId: UserId,
+    provider: string,
+    providerUserId: string,
+    email: string | null,
+  ): Promise<Result<OAuthAccount, AppError>> {
+    try {
+      const id = generateId();
+      const now = Date.now();
+
+      try {
+        await pool
+          .request()
+          .input("id", id)
+          .input("userId", userId as string)
+          .input("provider", provider)
+          .input("providerUserId", providerUserId)
+          .input("email", email)
+          .input("createdAt", now)
+          .query(`
+            INSERT INTO oauth_accounts (id, user_id, provider, provider_user_id, email, created_at)
+            VALUES (@id, @userId, @provider, @providerUserId, @email, @createdAt)
+          `);
+      } catch (e: unknown) {
+        if (
+          e instanceof Error &&
+          (e.message.includes("duplicate key") || e.message.includes("UNIQUE"))
+        ) {
+          return err(conflict("OAuth account already linked"));
+        }
+        throw e;
+      }
+
+      return ok({
+        id,
+        userId,
+        provider,
+        providerUserId,
+        email,
+        createdAt: now,
+      });
+    } catch (e: unknown) {
+      return err(internal("Database error", e));
+    }
+  },
+
+  async findByProvider(
+    provider: string,
+    providerUserId: string,
+  ): Promise<Result<OAuthAccount | null, AppError>> {
+    try {
+      const result = await pool
+        .request()
+        .input("provider", provider)
+        .input("providerUserId", providerUserId)
+        .query(`
+          SELECT * FROM oauth_accounts
+          WHERE provider = @provider AND provider_user_id = @providerUserId
+        `);
+      if (result.recordset.length === 0) return ok(null);
+      return ok(toOAuthAccount(result.recordset[0] as Record<string, unknown>));
+    } catch (e: unknown) {
+      return err(internal("Database error", e));
+    }
+  },
+
+  async listByUser(userId: UserId): Promise<Result<readonly OAuthAccount[], AppError>> {
+    try {
+      const result = await pool
+        .request()
+        .input("userId", userId as string)
+        .query("SELECT * FROM oauth_accounts WHERE user_id = @userId ORDER BY created_at DESC");
+      return ok(result.recordset.map((r: Record<string, unknown>) => toOAuthAccount(r)));
+    } catch (e: unknown) {
+      return err(internal("Database error", e));
+    }
+  },
+
+  async unlink(id: string, userId: UserId): Promise<Result<void, AppError>> {
+    try {
+      const result = await pool
+        .request()
+        .input("id", id)
+        .input("userId", userId as string)
+        .query("SELECT id FROM oauth_accounts WHERE id = @id AND user_id = @userId");
+
+      if (result.recordset.length === 0) return err(notFound("OAuth account"));
+
+      await pool.request().input("id", id).query("DELETE FROM oauth_accounts WHERE id = @id");
+      return ok(undefined);
+    } catch (e: unknown) {
+      return err(internal("Database error", e));
+    }
+  },
+});

package/src/infrastructure/database/mssql/mssql-password-history.ts

@@ -0,0 +1,71 @@
+/**
+ * SQL Server password history adapter.
+ */
+
+import type sql from "mssql";
+import { internal } from "../../../core/errors/app-error.js";
+import type { AppError } from "../../../core/errors/app-error.js";
+import type { PasswordHistory } from "../../../core/ports/password-history.js";
+import type { UserId } from "../../../core/types/brand.js";
+import { type Result, err, ok } from "../../../core/types/result.js";
+import { generateId } from "../../../shared/utils/id.js";
+
+export const createMssqlPasswordHistory = (pool: sql.ConnectionPool): PasswordHistory => ({
+  async add(userId: UserId, passwordHash: string): Promise<Result<void, AppError>> {
+    try {
+      const id = generateId();
+      await pool
+        .request()
+        .input("id", id)
+        .input("userId", userId as string)
+        .input("passwordHash", passwordHash)
+        .input("createdAt", Date.now())
+        .query(`
+          INSERT INTO password_history (id, user_id, password_hash, created_at)
+          VALUES (@id, @userId, @passwordHash, @createdAt)
+        `);
+      return ok(undefined);
+    } catch (e: unknown) {
+      return err(internal("Database error", e));
+    }
+  },
+
+  async getRecent(userId: UserId, count: number): Promise<Result<readonly string[], AppError>> {
+    try {
+      const result = await pool
+        .request()
+        .input("userId", userId as string)
+        .input("count", count)
+        .query(`
+          SELECT TOP (@count) password_hash FROM password_history
+          WHERE user_id = @userId
+          ORDER BY created_at DESC
+        `);
+      return ok(result.recordset.map((r: { password_hash: string }) => r.password_hash));
+    } catch (e: unknown) {
+      return err(internal("Database error", e));
+    }
+  },
+
+  async prune(userId: UserId, keepCount: number): Promise<Result<void, AppError>> {
+    try {
+      // Delete all but the most recent `keepCount` entries
+      await pool
+        .request()
+        .input("userId", userId as string)
+        .input("keepCount", keepCount)
+        .query(`
+          DELETE FROM password_history
+          WHERE user_id = @userId
+          AND id NOT IN (
+            SELECT TOP (@keepCount) id FROM password_history
+            WHERE user_id = @userId
+            ORDER BY created_at DESC
+          )
+        `);
+      return ok(undefined);
+    } catch (e: unknown) {
+      return err(internal("Database error", e));
+    }
+  },
+});

package/src/infrastructure/database/mssql/mssql-refresh-token-store.ts

@@ -0,0 +1,144 @@
+/**
+ * SQL Server refresh token store adapter.
+ */
+
+import type sql from "mssql";
+import { conflict, internal, notFound } from "../../../core/errors/app-error.js";
+import type { AppError } from "../../../core/errors/app-error.js";
+import type {
+  RefreshTokenFamily,
+  RefreshTokenStore,
+} from "../../../core/ports/refresh-token-store.js";
+import type { UserId } from "../../../core/types/brand.js";
+import { brand } from "../../../core/types/brand.js";
+import { type Result, err, ok } from "../../../core/types/result.js";
+import { generateId } from "../../../shared/utils/id.js";
+
+const toFamily = (row: Record<string, unknown>): RefreshTokenFamily => ({
+  id: row["id"] as string,
+  userId: brand<string, "UserId">(row["user_id"] as string),
+  currentTokenHash: row["current_token_hash"] as string,
+  revoked: Boolean(row["revoked"]),
+  createdAt: Number(row["created_at"]),
+  updatedAt: Number(row["updated_at"]),
+});
+
+export const createMssqlRefreshTokenStore = (pool: sql.ConnectionPool): RefreshTokenStore => ({
+  async createFamily(userId: UserId, tokenHash: string): Promise<Result<string, AppError>> {
+    try {
+      const id = generateId();
+      const now = Date.now();
+      await pool
+        .request()
+        .input("id", id)
+        .input("userId", userId as string)
+        .input("tokenHash", tokenHash)
+        .input("now", now)
+        .query(`
+          INSERT INTO refresh_token_families (id, user_id, current_token_hash, revoked, created_at, updated_at)
+          VALUES (@id, @userId, @tokenHash, 0, @now, @now)
+        `);
+      return ok(id);
+    } catch (e: unknown) {
+      return err(internal("Database error", e));
+    }
+  },
+
+  async rotate(
+    familyId: string,
+    oldTokenHash: string,
+    newTokenHash: string,
+  ): Promise<Result<void, AppError>> {
+    try {
+      const result = await pool
+        .request()
+        .input("familyId", familyId)
+        .query("SELECT * FROM refresh_token_families WHERE id = @familyId AND revoked = 0");
+
+      if (result.recordset.length === 0) return err(notFound("Refresh token family"));
+
+      const family = result.recordset[0];
+      if (family.current_token_hash !== oldTokenHash) {
+        // Reuse detected — revoke entire family
+        await pool
+          .request()
+          .input("now", Date.now())
+          .input("familyId", familyId)
+          .query(
+            "UPDATE refresh_token_families SET revoked = 1, updated_at = @now WHERE id = @familyId",
+          );
+        return err(conflict("Token reuse detected"));
+      }
+
+      await pool
+        .request()
+        .input("newTokenHash", newTokenHash)
+        .input("now", Date.now())
+        .input("familyId", familyId)
+        .query(`
+          UPDATE refresh_token_families
+          SET current_token_hash = @newTokenHash, updated_at = @now
+          WHERE id = @familyId
+        `);
+      return ok(undefined);
+    } catch (e: unknown) {
+      return err(internal("Database error", e));
+    }
+  },
+
+  async findByTokenHash(tokenHash: string): Promise<Result<RefreshTokenFamily | null, AppError>> {
+    try {
+      const result = await pool
+        .request()
+        .input("tokenHash", tokenHash)
+        .query("SELECT * FROM refresh_token_families WHERE current_token_hash = @tokenHash");
+      if (result.recordset.length === 0) return ok(null);
+      return ok(toFamily(result.recordset[0] as Record<string, unknown>));
+    } catch (e: unknown) {
+      return err(internal("Database error", e));
+    }
+  },
+
+  async revokeFamily(familyId: string): Promise<Result<void, AppError>> {
+    try {
+      await pool
+        .request()
+        .input("now", Date.now())
+        .input("familyId", familyId)
+        .query(
+          "UPDATE refresh_token_families SET revoked = 1, updated_at = @now WHERE id = @familyId",
+        );
+      return ok(undefined);
+    } catch (e: unknown) {
+      return err(internal("Database error", e));
+    }
+  },
+
+  async revokeAllForUser(userId: UserId): Promise<Result<void, AppError>> {
+    try {
+      await pool
+        .request()
+        .input("now", Date.now())
+        .input("userId", userId as string)
+        .query(
+          "UPDATE refresh_token_families SET revoked = 1, updated_at = @now WHERE user_id = @userId",
+        );
+      return ok(undefined);
+    } catch (e: unknown) {
+      return err(internal("Database error", e));
+    }
+  },
+
+  async prune(maxAgeMs: number): Promise<Result<number, AppError>> {
+    try {
+      const cutoff = Date.now() - maxAgeMs;
+      const result = await pool
+        .request()
+        .input("cutoff", cutoff)
+        .query("DELETE FROM refresh_token_families WHERE revoked = 1 AND updated_at < @cutoff");
+      return ok(result.rowsAffected[0] ?? 0);
+    } catch (e: unknown) {
+      return err(internal("Database error", e));
+    }
+  },
+});

package/src/infrastructure/database/mssql/mssql-token-blacklist.ts

@@ -0,0 +1,54 @@
+/**
+ * SQL Server token blacklist adapter.
+ */
+
+import type sql from "mssql";
+import { internal } from "../../../core/errors/app-error.js";
+import type { AppError } from "../../../core/errors/app-error.js";
+import type { TokenBlacklist } from "../../../core/ports/token-blacklist.js";
+import { type Result, err, ok } from "../../../core/types/result.js";
+
+export const createMssqlTokenBlacklist = (pool: sql.ConnectionPool): TokenBlacklist => ({
+  async add(tokenHash: string, expiresAt: number): Promise<Result<void, AppError>> {
+    try {
+      await pool
+        .request()
+        .input("tokenHash", tokenHash)
+        .input("expiresAt", expiresAt)
+        .input("createdAt", Date.now())
+        .query(`
+          IF NOT EXISTS (SELECT 1 FROM token_blacklist WHERE token_hash = @tokenHash)
+            INSERT INTO token_blacklist (token_hash, expires_at, created_at)
+            VALUES (@tokenHash, @expiresAt, @createdAt)
+        `);
+      return ok(undefined);
+    } catch (e: unknown) {
+      return err(internal("Database error", e));
+    }
+  },
+
+  async isBlacklisted(tokenHash: string): Promise<Result<boolean, AppError>> {
+    try {
+      const result = await pool
+        .request()
+        .input("tokenHash", tokenHash)
+        .input("now", Date.now())
+        .query("SELECT 1 FROM token_blacklist WHERE token_hash = @tokenHash AND expires_at > @now");
+      return ok(result.recordset.length > 0);
+    } catch (e: unknown) {
+      return err(internal("Database error", e));
+    }
+  },
+
+  async prune(): Promise<Result<number, AppError>> {
+    try {
+      const result = await pool
+        .request()
+        .input("now", Date.now())
+        .query("DELETE FROM token_blacklist WHERE expires_at <= @now");
+      return ok(result.rowsAffected[0] ?? 0);
+    } catch (e: unknown) {
+      return err(internal("Database error", e));
+    }
+  },
+});

package/src/infrastructure/database/mssql/mssql-user.repository.ts

@@ -0,0 +1,263 @@
+/**
+ * SQL Server user repository — uses the `mssql` npm package.
+ *
+ * Drop-in replacement for the Postgres/SQLite adapters, implements the same UserRepository port.
+ * Uses parameterized queries to prevent SQL injection.
+ */
+
+import type sql from "mssql";
+import type { User, UserRole } from "../../../core/entities/user.entity.js";
+import { type AppError, conflict, internal, notFound } from "../../../core/errors/app-error.js";
+import type {
+  CreateUserData,
+  UpdateUserData,
+  UserListOptions,
+  UserRepository,
+} from "../../../core/ports/user.repository.js";
+import type { UserId } from "../../../core/types/brand.js";
+import { brand } from "../../../core/types/brand.js";
+import { decodeCursor, encodeCursor } from "../../../core/types/pagination.js";
+import { type Result, err, ok } from "../../../core/types/result.js";
+import { generateId } from "../../../shared/utils/id.js";
+
+interface UserRow {
+  id: string;
+  email: string;
+  password_hash: string;
+  role: string;
+  email_verified: boolean;
+  mfa_secret: string | null;
+  mfa_enabled: boolean;
+  password_changed_at: number | null;
+  failed_login_attempts: number;
+  locked_until: number | null;
+  created_at: number;
+  updated_at: number;
+}
+
+const rowToUser = (row: UserRow): User => ({
+  id: brand<string, "UserId">(row.id),
+  email: row.email,
+  passwordHash: row.password_hash,
+  role: row.role as UserRole,
+  emailVerified: Boolean(row.email_verified),
+  mfaEnabled: Boolean(row.mfa_enabled),
+  mfaSecret: row.mfa_secret,
+  passwordChangedAt:
+    row.password_changed_at !== null ? brand<number, "Timestamp">(row.password_changed_at) : null,
+  createdAt: brand<number, "Timestamp">(row.created_at),
+  updatedAt: brand<number, "Timestamp">(row.updated_at),
+});
+
+const isUniqueViolation = (e: unknown): boolean =>
+  e instanceof Error &&
+  (e.message.includes("duplicate key") ||
+    e.message.includes("unique") ||
+    e.message.includes("UNIQUE") ||
+    e.message.includes("Violation of UNIQUE KEY"));
+
+/** Map UpdateUserData fields to their SQL column names and mssql types */
+const UPDATE_FIELD_MAP: ReadonlyArray<[keyof UpdateUserData, string]> = [
+  ["email", "email"],
+  ["passwordHash", "password_hash"],
+  ["role", "role"],
+  ["emailVerified", "email_verified"],
+  ["mfaEnabled", "mfa_enabled"],
+  ["mfaSecret", "mfa_secret"],
+  ["passwordChangedAt", "password_changed_at"],
+];
+
+export const createMssqlUserRepository = (pool: sql.ConnectionPool): UserRepository => {
+  return {
+    async findById(id: UserId): Promise<Result<User, AppError>> {
+      try {
+        const result = await pool
+          .request()
+          .input("id", id as string)
+          .query("SELECT * FROM users WHERE id = @id");
+        if (result.recordset.length === 0) return err(notFound("User"));
+        return ok(rowToUser(result.recordset[0] as UserRow));
+      } catch (e: unknown) {
+        return err(internal("Database error", e));
+      }
+    },
+
+    async findByEmail(email: string): Promise<Result<User, AppError>> {
+      try {
+        const result = await pool
+          .request()
+          .input("email", email)
+          .query("SELECT * FROM users WHERE email = @email");
+        if (result.recordset.length === 0) return err(notFound("User"));
+        return ok(rowToUser(result.recordset[0] as UserRow));
+      } catch (e: unknown) {
+        return err(internal("Database error", e));
+      }
+    },
+
+    async create(data: CreateUserData): Promise<Result<User, AppError>> {
+      try {
+        const id = generateId();
+        const now = Date.now();
+
+        try {
+          await pool
+            .request()
+            .input("id", id)
+            .input("email", data.email)
+            .input("passwordHash", data.passwordHash)
+            .input("role", data.role)
+            .input("now", now)
+            .query(`
+              INSERT INTO users (id, email, password_hash, role, email_verified, mfa_enabled, failed_login_attempts, created_at, updated_at)
+              VALUES (@id, @email, @passwordHash, @role, 0, 0, 0, @now, @now)
+            `);
+        } catch (e: unknown) {
+          if (isUniqueViolation(e)) return err(conflict("Email already exists"));
+          throw e;
+        }
+
+        const user: User = {
+          id: brand<string, "UserId">(id),
+          email: data.email,
+          passwordHash: data.passwordHash,
+          role: data.role,
+          emailVerified: false,
+          mfaEnabled: false,
+          mfaSecret: null,
+          passwordChangedAt: null,
+          createdAt: brand<number, "Timestamp">(now),
+          updatedAt: brand<number, "Timestamp">(now),
+        };
+
+        return ok(user);
+      } catch (e: unknown) {
+        return err(internal("Database error", e));
+      }
+    },
+
+    // biome-ignore lint/complexity/noExcessiveCognitiveComplexity: SQL builder with dynamic SET clauses needs branching
+    async update(id: UserId, data: UpdateUserData): Promise<Result<User, AppError>> {
+      try {
+        // Check existence first
+        const existing = await pool
+          .request()
+          .input("id", id as string)
+          .query("SELECT id FROM users WHERE id = @id");
+        if (existing.recordset.length === 0) return err(notFound("User"));
+
+        // Build dynamic SET clause
+        const sets: string[] = [];
+        const req = pool.request();
+        let paramIdx = 0;
+
+        for (const [field, column] of UPDATE_FIELD_MAP) {
+          if (data[field] !== undefined) {
+            const paramName = `p${paramIdx++}`;
+            sets.push(`${column} = @${paramName}`);
+            req.input(paramName, data[field] as string | number | boolean | null);
+          }
+        }
+
+        const updatedAtParam = `p${paramIdx}`;
+        sets.push(`updated_at = @${updatedAtParam}`);
+        req.input(updatedAtParam, Date.now());
+        req.input("updateId", id as string);
+
+        try {
+          await req.query(`UPDATE users SET ${sets.join(", ")} WHERE id = @updateId`);
+        } catch (e: unknown) {
+          if (isUniqueViolation(e)) return err(conflict("Email already exists"));
+          throw e;
+        }
+
+        const updated = await pool
+          .request()
+          .input("id", id as string)
+          .query("SELECT * FROM users WHERE id = @id");
+        if (updated.recordset.length === 0) return err(internal("User disappeared after update"));
+        return ok(rowToUser(updated.recordset[0] as UserRow));
+      } catch (e: unknown) {
+        if (isUniqueViolation(e)) return err(conflict("Email already exists"));
+        return err(internal("Database error", e));
+      }
+    },
+
+    async delete(id: UserId): Promise<Result<void, AppError>> {
+      try {
+        const existing = await pool
+          .request()
+          .input("id", id as string)
+          .query("SELECT id FROM users WHERE id = @id");
+        if (existing.recordset.length === 0) return err(notFound("User"));
+
+        await pool
+          .request()
+          .input("id", id as string)
+          .query("DELETE FROM users WHERE id = @id");
+        return ok(undefined);
+      } catch (e: unknown) {
+        return err(internal("Database error", e));
+      }
+    },
+
+    // biome-ignore lint/complexity/noExcessiveCognitiveComplexity: SQL builder with cursor/filter/search needs branching
+    async list(options: UserListOptions) {
+      try {
+        const conditions: string[] = [];
+        const req = pool.request();
+        let paramIdx = 0;
+
+        if (options.cursor !== undefined) {
+          const decoded = decodeCursor(options.cursor);
+          if (decoded !== null) {
+            const paramName = `p${paramIdx++}`;
+            conditions.push(`created_at < @${paramName}`);
+            req.input(paramName, Number(decoded));
+          }
+        }
+
+        if (options.role !== undefined) {
+          const paramName = `p${paramIdx++}`;
+          conditions.push(`role = @${paramName}`);
+          req.input(paramName, options.role);
+        }
+
+        if (options.search !== undefined) {
+          const paramName = `p${paramIdx++}`;
+          conditions.push(`email LIKE @${paramName}`);
+          req.input(paramName, `%${options.search}%`);
+        }
+
+        const where = conditions.length > 0 ? `WHERE ${conditions.join(" AND ")}` : "";
+        const limit = Math.min(options.limit, 100);
+        const limitParam = `p${paramIdx}`;
+        req.input(limitParam, limit + 1);
+
+        const query = `SELECT TOP (@${limitParam}) * FROM users ${where} ORDER BY created_at DESC`;
+        const result = await req.query(query);
+        const rows = result.recordset as UserRow[];
+
+        const hasMore = rows.length > limit;
+        const items = (hasMore ? rows.slice(0, limit) : rows).map(rowToUser);
+
+        const lastItem = items[items.length - 1];
+        const nextCursor =
+          hasMore && lastItem !== undefined ? encodeCursor(String(lastItem.createdAt)) : null;
+
+        return ok({ items, nextCursor, hasMore });
+      } catch (e: unknown) {
+        return err(internal("Database error", e));
+      }
+    },
+
+    async count() {
+      try {
+        const result = await pool.request().query("SELECT COUNT(*) as cnt FROM users");
+        return ok(Number(result.recordset[0].cnt));
+      } catch (e: unknown) {
+        return err(internal("Database error", e));
+      }
+    },
+  };
+};