@enderworld/onlyapi 1.5.1

package/src/infrastructure/database/mssql/mssql-verification-tokens.ts

@@ -0,0 +1,120 @@
+/**
+ * SQL Server verification token repository adapter.
+ */
+
+import type sql from "mssql";
+import { internal, notFound } from "../../../core/errors/app-error.js";
+import type { AppError } from "../../../core/errors/app-error.js";
+import type {
+  VerificationTokenRepository,
+  VerificationTokenType,
+} from "../../../core/ports/verification-token.js";
+import type { UserId } from "../../../core/types/brand.js";
+import { brand } from "../../../core/types/brand.js";
+import { type Result, err, ok } from "../../../core/types/result.js";
+import { generateId } from "../../../shared/utils/id.js";
+
+export const createMssqlVerificationTokenRepo = (
+  pool: sql.ConnectionPool,
+): VerificationTokenRepository => ({
+  async create(
+    userId: UserId,
+    type: VerificationTokenType,
+    ttlMs: number,
+  ): Promise<Result<string, AppError>> {
+    try {
+      const id = generateId();
+      const rawToken = generateId();
+      const encoder = new TextEncoder();
+      const hashBuffer = await crypto.subtle.digest("SHA-256", encoder.encode(rawToken));
+      const tokenHash = [...new Uint8Array(hashBuffer)]
+        .map((b) => b.toString(16).padStart(2, "0"))
+        .join("");
+
+      const now = Date.now();
+      const expiresAt = now + ttlMs;
+
+      await pool
+        .request()
+        .input("id", id)
+        .input("userId", userId as string)
+        .input("type", type)
+        .input("tokenHash", tokenHash)
+        .input("expiresAt", expiresAt)
+        .input("createdAt", now)
+        .query(`
+          INSERT INTO verification_tokens (id, user_id, type, token_hash, expires_at, created_at)
+          VALUES (@id, @userId, @type, @tokenHash, @expiresAt, @createdAt)
+        `);
+
+      return ok(rawToken);
+    } catch (e: unknown) {
+      return err(internal("Database error", e));
+    }
+  },
+
+  async verify(rawToken: string, type: VerificationTokenType): Promise<Result<UserId, AppError>> {
+    try {
+      const encoder = new TextEncoder();
+      const hashBuffer = await crypto.subtle.digest("SHA-256", encoder.encode(rawToken));
+      const tokenHash = [...new Uint8Array(hashBuffer)]
+        .map((b) => b.toString(16).padStart(2, "0"))
+        .join("");
+
+      const result = await pool
+        .request()
+        .input("tokenHash", tokenHash)
+        .input("type", type)
+        .input("now", Date.now())
+        .query(`
+          SELECT * FROM verification_tokens
+          WHERE token_hash = @tokenHash AND type = @type AND used_at IS NULL AND expires_at > @now
+        `);
+
+      if (result.recordset.length === 0) return err(notFound("Verification token"));
+
+      const row = result.recordset[0];
+      await pool
+        .request()
+        .input("usedAt", Date.now())
+        .input("id", row.id)
+        .query("UPDATE verification_tokens SET used_at = @usedAt WHERE id = @id");
+
+      return ok(brand<string, "UserId">(row.user_id as string));
+    } catch (e: unknown) {
+      return err(internal("Database error", e));
+    }
+  },
+
+  async invalidateAll(
+    userId: UserId,
+    type: VerificationTokenType,
+  ): Promise<Result<void, AppError>> {
+    try {
+      await pool
+        .request()
+        .input("usedAt", Date.now())
+        .input("userId", userId as string)
+        .input("type", type)
+        .query(`
+          UPDATE verification_tokens SET used_at = @usedAt
+          WHERE user_id = @userId AND type = @type AND used_at IS NULL
+        `);
+      return ok(undefined);
+    } catch (e: unknown) {
+      return err(internal("Database error", e));
+    }
+  },
+
+  async prune(): Promise<Result<number, AppError>> {
+    try {
+      const result = await pool
+        .request()
+        .input("now", Date.now())
+        .query("DELETE FROM verification_tokens WHERE expires_at <= @now OR used_at IS NOT NULL");
+      return ok(result.rowsAffected[0] ?? 0);
+    } catch (e: unknown) {
+      return err(internal("Database error", e));
+    }
+  },
+});

package/src/infrastructure/database/postgres/index.ts

@@ -0,0 +1,14 @@
+/**
+ * PostgreSQL adapters — barrel export.
+ */
+
+export { createPgUserRepository } from "./pg-user.repository.js";
+export { createPgTokenBlacklist } from "./pg-token-blacklist.js";
+export { createPgAccountLockout } from "./pg-account-lockout.js";
+export { createPgAuditLog } from "./pg-audit-log.js";
+export { createPgVerificationTokenRepo } from "./pg-verification-tokens.js";
+export { createPgRefreshTokenStore } from "./pg-refresh-token-store.js";
+export { createPgApiKeyRepository } from "./pg-api-keys.js";
+export { createPgPasswordHistory } from "./pg-password-history.js";
+export { createPgOAuthAccountRepo } from "./pg-oauth-accounts.js";
+export { pgMigrateUp, pgMigrateDown } from "./migrations.js";

package/src/infrastructure/database/postgres/migrations.ts

@@ -0,0 +1,235 @@
+/**
+ * Postgres migration runner — uses Bun.sql (zero external deps).
+ *
+ * Mirrors the SQLite migration runner pattern but uses PostgreSQL DDL.
+ * Migrations are idempotent and wrapped in transactions.
+ */
+
+import type { Logger } from "../../../core/ports/logger.js";
+
+interface PgMigration {
+  readonly version: string;
+  readonly name: string;
+  readonly up: string; // raw SQL
+  readonly down: string;
+}
+
+/**
+ * All Postgres migrations — inlined SQL strings.
+ * PostgreSQL uses BIGINT for timestamps (ms since epoch), TEXT for IDs,
+ * BOOLEAN instead of INTEGER 0/1.
+ */
+const migrations: readonly PgMigration[] = [
+  {
+    version: "001",
+    name: "create_users",
+    up: `
+      CREATE TABLE IF NOT EXISTS users (
+        id                    TEXT PRIMARY KEY,
+        email                 TEXT NOT NULL UNIQUE,
+        password_hash         TEXT NOT NULL,
+        role                  TEXT NOT NULL DEFAULT 'user',
+        email_verified        BOOLEAN NOT NULL DEFAULT FALSE,
+        mfa_secret            TEXT,
+        mfa_enabled           BOOLEAN NOT NULL DEFAULT FALSE,
+        password_changed_at   BIGINT,
+        failed_login_attempts INTEGER NOT NULL DEFAULT 0,
+        locked_until          BIGINT,
+        created_at            BIGINT NOT NULL,
+        updated_at            BIGINT NOT NULL
+      );
+      CREATE UNIQUE INDEX IF NOT EXISTS idx_users_email ON users(email);
+    `,
+    down: `
+      DROP INDEX IF EXISTS idx_users_email;
+      DROP TABLE IF EXISTS users;
+    `,
+  },
+  {
+    version: "002",
+    name: "create_token_blacklist",
+    up: `
+      CREATE TABLE IF NOT EXISTS token_blacklist (
+        token_hash  TEXT PRIMARY KEY,
+        expires_at  BIGINT NOT NULL,
+        created_at  BIGINT NOT NULL
+      );
+      CREATE INDEX IF NOT EXISTS idx_token_blacklist_expires ON token_blacklist(expires_at);
+    `,
+    down: `
+      DROP INDEX IF EXISTS idx_token_blacklist_expires;
+      DROP TABLE IF EXISTS token_blacklist;
+    `,
+  },
+  {
+    version: "003",
+    name: "create_audit_log",
+    up: `
+      CREATE TABLE IF NOT EXISTS audit_log (
+        id          TEXT PRIMARY KEY,
+        user_id     TEXT,
+        action      TEXT NOT NULL,
+        resource    TEXT NOT NULL,
+        resource_id TEXT,
+        detail      TEXT,
+        ip          TEXT NOT NULL,
+        timestamp   BIGINT NOT NULL
+      );
+      CREATE INDEX IF NOT EXISTS idx_audit_log_user ON audit_log(user_id);
+      CREATE INDEX IF NOT EXISTS idx_audit_log_action ON audit_log(action);
+      CREATE INDEX IF NOT EXISTS idx_audit_log_timestamp ON audit_log(timestamp);
+    `,
+    down: `
+      DROP INDEX IF EXISTS idx_audit_log_timestamp;
+      DROP INDEX IF EXISTS idx_audit_log_action;
+      DROP INDEX IF EXISTS idx_audit_log_user;
+      DROP TABLE IF EXISTS audit_log;
+    `,
+  },
+  {
+    version: "004",
+    name: "auth_platform",
+    up: `
+      CREATE TABLE IF NOT EXISTS verification_tokens (
+        id          TEXT PRIMARY KEY,
+        user_id     TEXT NOT NULL REFERENCES users(id) ON DELETE CASCADE,
+        type        TEXT NOT NULL CHECK (type IN ('email_verification', 'password_reset')),
+        token_hash  TEXT NOT NULL UNIQUE,
+        expires_at  BIGINT NOT NULL,
+        used_at     BIGINT,
+        created_at  BIGINT NOT NULL
+      );
+      CREATE INDEX IF NOT EXISTS idx_verification_tokens_hash ON verification_tokens(token_hash);
+      CREATE INDEX IF NOT EXISTS idx_verification_tokens_user ON verification_tokens(user_id, type);
+
+      CREATE TABLE IF NOT EXISTS refresh_token_families (
+        id                  TEXT PRIMARY KEY,
+        user_id             TEXT NOT NULL REFERENCES users(id) ON DELETE CASCADE,
+        current_token_hash  TEXT NOT NULL,
+        revoked             BOOLEAN NOT NULL DEFAULT FALSE,
+        created_at          BIGINT NOT NULL,
+        updated_at          BIGINT NOT NULL
+      );
+      CREATE INDEX IF NOT EXISTS idx_refresh_families_user ON refresh_token_families(user_id);
+      CREATE INDEX IF NOT EXISTS idx_refresh_families_token ON refresh_token_families(current_token_hash);
+
+      CREATE TABLE IF NOT EXISTS api_keys (
+        id          TEXT PRIMARY KEY,
+        user_id     TEXT NOT NULL REFERENCES users(id) ON DELETE CASCADE,
+        name        TEXT NOT NULL,
+        key_hash    TEXT NOT NULL UNIQUE,
+        key_prefix  TEXT NOT NULL,
+        scopes      TEXT NOT NULL DEFAULT '[]',
+        expires_at  BIGINT,
+        last_used_at BIGINT,
+        created_at  BIGINT NOT NULL
+      );
+      CREATE INDEX IF NOT EXISTS idx_api_keys_hash ON api_keys(key_hash);
+      CREATE INDEX IF NOT EXISTS idx_api_keys_user ON api_keys(user_id);
+
+      CREATE TABLE IF NOT EXISTS password_history (
+        id              TEXT PRIMARY KEY,
+        user_id         TEXT NOT NULL REFERENCES users(id) ON DELETE CASCADE,
+        password_hash   TEXT NOT NULL,
+        created_at      BIGINT NOT NULL
+      );
+      CREATE INDEX IF NOT EXISTS idx_password_history_user ON password_history(user_id);
+
+      CREATE TABLE IF NOT EXISTS oauth_accounts (
+        id                TEXT PRIMARY KEY,
+        user_id           TEXT NOT NULL REFERENCES users(id) ON DELETE CASCADE,
+        provider          TEXT NOT NULL,
+        provider_user_id  TEXT NOT NULL,
+        email             TEXT,
+        created_at        BIGINT NOT NULL,
+        UNIQUE(provider, provider_user_id)
+      );
+      CREATE INDEX IF NOT EXISTS idx_oauth_accounts_user ON oauth_accounts(user_id);
+      CREATE INDEX IF NOT EXISTS idx_oauth_accounts_provider ON oauth_accounts(provider, provider_user_id);
+    `,
+    down: `
+      DROP TABLE IF EXISTS oauth_accounts;
+      DROP TABLE IF EXISTS password_history;
+      DROP TABLE IF EXISTS api_keys;
+      DROP TABLE IF EXISTS refresh_token_families;
+      DROP TABLE IF EXISTS verification_tokens;
+    `,
+  },
+];
+
+// biome-ignore lint/suspicious/noExplicitAny: Bun.sql returns generic tagged template type
+type PgClient = any;
+
+const ensureMigrationsTable = async (sql: PgClient): Promise<void> => {
+  await sql`
+    CREATE TABLE IF NOT EXISTS _migrations (
+      version     TEXT PRIMARY KEY,
+      name        TEXT NOT NULL,
+      applied_at  BIGINT NOT NULL
+    )
+  `;
+};
+
+const getAppliedVersions = async (sql: PgClient): Promise<Set<string>> => {
+  const rows = await sql`SELECT version FROM _migrations ORDER BY version`;
+  return new Set(rows.map((r: { version: string }) => r.version));
+};
+
+export const pgMigrateUp = async (sql: PgClient, logger: Logger): Promise<number> => {
+  await ensureMigrationsTable(sql);
+  const applied = await getAppliedVersions(sql);
+  let count = 0;
+
+  for (const migration of migrations) {
+    if (applied.has(migration.version)) continue;
+
+    await sql.begin(async (tx: PgClient) => {
+      // Execute raw SQL statements
+      for (const stmt of migration.up.split(";").filter((s: string) => s.trim())) {
+        await tx.unsafe(stmt.trim());
+      }
+      await tx`
+        INSERT INTO _migrations (version, name, applied_at)
+        VALUES (${migration.version}, ${migration.name}, ${Date.now()})
+      `;
+    });
+
+    logger.info("Migration applied", {
+      version: migration.version,
+      name: migration.name,
+    });
+    count++;
+  }
+
+  if (count > 0) {
+    logger.info("Postgres migrations complete", { applied: count });
+  }
+
+  return count;
+};
+
+export const pgMigrateDown = async (sql: PgClient, logger: Logger): Promise<string | null> => {
+  await ensureMigrationsTable(sql);
+  const applied = await getAppliedVersions(sql);
+
+  // Find the highest applied migration
+  const reversed = [...migrations].reverse();
+  for (const migration of reversed) {
+    if (!applied.has(migration.version)) continue;
+
+    await sql.begin(async (tx: PgClient) => {
+      for (const stmt of migration.down.split(";").filter((s: string) => s.trim())) {
+        await tx.unsafe(stmt.trim());
+      }
+      await tx`DELETE FROM _migrations WHERE version = ${migration.version}`;
+    });
+
+    logger.info("Migration rolled back", {
+      version: migration.version,
+      name: migration.name,
+    });
+    return migration.version;
+  }
+
+  return null;
+};

package/src/infrastructure/database/postgres/pg-account-lockout.ts

@@ -0,0 +1,75 @@
+/**
+ * PostgreSQL account lockout adapter.
+ */
+
+import { internal } from "../../../core/errors/app-error.js";
+import type { AppError } from "../../../core/errors/app-error.js";
+import type { AccountLockout } from "../../../core/ports/account-lockout.js";
+import { type Result, err, ok } from "../../../core/types/result.js";
+
+// biome-ignore lint/suspicious/noExplicitAny: Bun.sql tagged template type
+type PgClient = any;
+
+interface LockoutOptions {
+  readonly maxAttempts: number;
+  readonly lockoutDurationMs: number;
+}
+
+export const createPgAccountLockout = (sql: PgClient, options: LockoutOptions): AccountLockout => ({
+  async recordFailedAttempt(email: string): Promise<Result<boolean, AppError>> {
+    try {
+      await sql`
+        UPDATE users SET failed_login_attempts = failed_login_attempts + 1 WHERE email = ${email}
+      `;
+      const rows = await sql`
+        SELECT failed_login_attempts FROM users WHERE email = ${email}
+      `;
+      if (rows.length === 0) return ok(false);
+
+      const attempts = Number(rows[0].failed_login_attempts);
+      if (attempts >= options.maxAttempts) {
+        const lockUntil = Date.now() + options.lockoutDurationMs;
+        await sql`
+          UPDATE users SET locked_until = ${lockUntil}, failed_login_attempts = ${attempts} WHERE email = ${email}
+        `;
+        return ok(true);
+      }
+      return ok(false);
+    } catch (e: unknown) {
+      return err(internal("Database error", e));
+    }
+  },
+
+  async resetAttempts(email: string): Promise<Result<void, AppError>> {
+    try {
+      await sql`
+        UPDATE users SET failed_login_attempts = 0, locked_until = NULL WHERE email = ${email}
+      `;
+      return ok(undefined);
+    } catch (e: unknown) {
+      return err(internal("Database error", e));
+    }
+  },
+
+  async isLocked(email: string): Promise<Result<number | null, AppError>> {
+    try {
+      const rows = await sql`
+        SELECT locked_until FROM users WHERE email = ${email}
+      `;
+      if (rows.length === 0) return ok(null);
+
+      const lockedUntil = rows[0].locked_until;
+      if (lockedUntil === null || lockedUntil === undefined) return ok(null);
+      if (Number(lockedUntil) <= Date.now()) {
+        // Lock expired — clear it
+        await sql`
+          UPDATE users SET locked_until = NULL, failed_login_attempts = 0 WHERE email = ${email}
+        `;
+        return ok(null);
+      }
+      return ok(Number(lockedUntil));
+    } catch (e: unknown) {
+      return err(internal("Database error", e));
+    }
+  },
+});

package/src/infrastructure/database/postgres/pg-api-keys.ts

@@ -0,0 +1,126 @@
+/**
+ * PostgreSQL API key repository adapter.
+ */
+
+import { internal, notFound } from "../../../core/errors/app-error.js";
+import type { AppError } from "../../../core/errors/app-error.js";
+import type { ApiKey, ApiKeyRepository } from "../../../core/ports/api-key.js";
+import type { UserId } from "../../../core/types/brand.js";
+import { brand } from "../../../core/types/brand.js";
+import { type Result, err, ok } from "../../../core/types/result.js";
+import { generateId } from "../../../shared/utils/id.js";
+
+// biome-ignore lint/suspicious/noExplicitAny: Bun.sql tagged template type
+type PgClient = any;
+
+const KEY_PREFIX = "oapi_";
+
+const rowToApiKey = (row: Record<string, unknown>): ApiKey => ({
+  id: row["id"] as string,
+  userId: brand<string, "UserId">(row["user_id"] as string),
+  name: row["name"] as string,
+  keyPrefix: row["key_prefix"] as string,
+  scopes: JSON.parse((row["scopes"] as string) || "[]") as readonly string[],
+  expiresAt: row["expires_at"] !== null ? Number(row["expires_at"]) : null,
+  lastUsedAt: row["last_used_at"] !== null ? Number(row["last_used_at"]) : null,
+  createdAt: Number(row["created_at"]),
+});
+
+export const createPgApiKeyRepository = (sql: PgClient): ApiKeyRepository => ({
+  async create(
+    userId: UserId,
+    name: string,
+    scopes: readonly string[],
+    expiresAt?: number,
+  ): Promise<Result<{ key: ApiKey; rawKey: string }, AppError>> {
+    try {
+      const id = generateId();
+      const rawKey = `${KEY_PREFIX}${generateId()}${generateId()}`;
+      const prefix = rawKey.substring(0, KEY_PREFIX.length + 8);
+
+      const encoder = new TextEncoder();
+      const hashBuffer = await crypto.subtle.digest("SHA-256", encoder.encode(rawKey));
+      const keyHash = [...new Uint8Array(hashBuffer)]
+        .map((b) => b.toString(16).padStart(2, "0"))
+        .join("");
+
+      const now = Date.now();
+
+      await sql`
+        INSERT INTO api_keys (id, user_id, name, key_hash, key_prefix, scopes, expires_at, created_at)
+        VALUES (${id}, ${userId as string}, ${name}, ${keyHash}, ${prefix}, ${JSON.stringify(scopes)}, ${expiresAt ?? null}, ${now})
+      `;
+
+      const key: ApiKey = {
+        id,
+        userId,
+        name,
+        keyPrefix: prefix,
+        scopes,
+        expiresAt: expiresAt ?? null,
+        lastUsedAt: null,
+        createdAt: now,
+      };
+
+      return ok({ key, rawKey });
+    } catch (e: unknown) {
+      return err(internal("Database error", e));
+    }
+  },
+
+  async verify(rawKey: string): Promise<Result<ApiKey, AppError>> {
+    try {
+      const encoder = new TextEncoder();
+      const hashBuffer = await crypto.subtle.digest("SHA-256", encoder.encode(rawKey));
+      const keyHash = [...new Uint8Array(hashBuffer)]
+        .map((b) => b.toString(16).padStart(2, "0"))
+        .join("");
+
+      const rows = await sql`SELECT * FROM api_keys WHERE key_hash = ${keyHash}`;
+      if (rows.length === 0) return err(notFound("API key"));
+
+      const key = rowToApiKey(rows[0] as Record<string, unknown>);
+      if (key.expiresAt !== null && key.expiresAt < Date.now()) {
+        return err(notFound("API key"));
+      }
+
+      return ok(key);
+    } catch (e: unknown) {
+      return err(internal("Database error", e));
+    }
+  },
+
+  async listByUser(userId: UserId): Promise<Result<readonly ApiKey[], AppError>> {
+    try {
+      const rows = await sql`
+        SELECT * FROM api_keys WHERE user_id = ${userId as string} ORDER BY created_at DESC
+      `;
+      return ok(rows.map((r: Record<string, unknown>) => rowToApiKey(r)));
+    } catch (e: unknown) {
+      return err(internal("Database error", e));
+    }
+  },
+
+  async revoke(id: string, userId: UserId): Promise<Result<void, AppError>> {
+    try {
+      const rows = await sql`
+        SELECT id FROM api_keys WHERE id = ${id} AND user_id = ${userId as string}
+      `;
+      if (rows.length === 0) return err(notFound("API key"));
+
+      await sql`DELETE FROM api_keys WHERE id = ${id}`;
+      return ok(undefined);
+    } catch (e: unknown) {
+      return err(internal("Database error", e));
+    }
+  },
+
+  async touch(id: string): Promise<Result<void, AppError>> {
+    try {
+      await sql`UPDATE api_keys SET last_used_at = ${Date.now()} WHERE id = ${id}`;
+      return ok(undefined);
+    } catch (e: unknown) {
+      return err(internal("Database error", e));
+    }
+  },
+});

package/src/infrastructure/database/postgres/pg-audit-log.ts

@@ -0,0 +1,74 @@
+/**
+ * PostgreSQL audit log adapter.
+ */
+
+import { internal } from "../../../core/errors/app-error.js";
+import type { AppError } from "../../../core/errors/app-error.js";
+import type { AuditEntry, AuditLog, AuditQueryOptions } from "../../../core/ports/audit-log.js";
+import { type Result, err, ok } from "../../../core/types/result.js";
+import { generateId } from "../../../shared/utils/id.js";
+
+// biome-ignore lint/suspicious/noExplicitAny: Bun.sql tagged template type
+type PgClient = any;
+
+export const createPgAuditLog = (sql: PgClient): AuditLog => ({
+  async append(entry: Omit<AuditEntry, "id" | "timestamp">): Promise<Result<void, AppError>> {
+    try {
+      const id = generateId();
+      const timestamp = Date.now();
+      await sql`
+        INSERT INTO audit_log (id, user_id, action, resource, resource_id, detail, ip, timestamp)
+        VALUES (${id}, ${entry.userId}, ${entry.action}, ${entry.resource}, ${entry.resourceId}, ${entry.detail}, ${entry.ip}, ${timestamp})
+      `;
+      return ok(undefined);
+    } catch (e: unknown) {
+      return err(internal("Database error", e));
+    }
+  },
+
+  async query(options: AuditQueryOptions): Promise<Result<readonly AuditEntry[], AppError>> {
+    try {
+      const conditions: string[] = [];
+      const params: unknown[] = [];
+      let idx = 1;
+
+      if (options.userId !== undefined) {
+        conditions.push(`user_id = $${idx++}`);
+        params.push(options.userId);
+      }
+      if (options.action !== undefined) {
+        conditions.push(`action = $${idx++}`);
+        params.push(options.action);
+      }
+      if (options.since !== undefined) {
+        conditions.push(`timestamp >= $${idx++}`);
+        params.push(options.since);
+      }
+
+      const where = conditions.length > 0 ? `WHERE ${conditions.join(" AND ")}` : "";
+      const limit = options.limit ?? 50;
+      params.push(limit);
+
+      const query = `SELECT * FROM audit_log ${where} ORDER BY timestamp DESC LIMIT $${idx}`;
+      const rows = await sql.unsafe(query, params);
+
+      return ok(
+        rows.map(
+          (r: Record<string, unknown>) =>
+            ({
+              id: r["id"] as string,
+              userId: (r["user_id"] as string) ?? null,
+              action: r["action"],
+              resource: r["resource"] as string,
+              resourceId: (r["resource_id"] as string) ?? null,
+              detail: (r["detail"] as string) ?? null,
+              ip: r["ip"] as string,
+              timestamp: Number(r["timestamp"]),
+            }) as AuditEntry,
+        ),
+      );
+    } catch (e: unknown) {
+      return err(internal("Database error", e));
+    }
+  },
+});