@everystack/auth 0.1.0 → 0.2.1

package/src/sql.ts

@@ -1,19 +1,28 @@
 /**
- * @everystack/auth/sql — Generate SQL for PostgreSQL auth functions.
+ * @everystack/auth/sql — Composable SQL generators for PostgreSQL auth functions.
  *
- * Creates 7 functions in the `auth` schema using pgcrypto:
- * - auth.hash_password — bcrypt via crypt()/gen_salt()
- * - auth.verify_password — bcrypt verification
- * - auth.sign_jwt — HMAC-SHA256 JWT signing
- * - auth.verify_jwt — JWT verification
- * - auth.generate_refresh_token — opaque token with SHA-256 hash storage
- * - auth.validate_refresh_token — one-time-use rotation
- * - auth.revoke_refresh_tokens — delete all tokens for a user
+ * Generators (composable, independent):
+ *   generateCoreSQL()            — pgcrypto + hash/verify/sign/verify_jwt
+ *   generateRefreshTokenSQL()    — issue/validate/revoke/cleanup refresh tokens
+ *   generateAccessorSQL()        — auth.uid(), auth.role(), auth.jwt() (Supabase-compatible)
+ *   generateOneTimeTokenSQL()    — create/verify one-time tokens (email confirm, password reset)
+ *   generateDefaultAuthSQL()     — auth.sign_in, auth.sign_up, auth.oauth_sign_in
+ *   generateJwtWrappersSQL()     — sign_in_jwt, sign_up_jwt, oauth_sign_in_jwt
+ *
+ * Main entry point:
+ *   generateAuthSQL(options?)    — composes all of the above
+ *
+ * Apps that replace the schema keep core + refresh + accessors,
+ * replace the auth functions. The function signatures are the stable API.
  *
  * Usage:
  *   import { generateAuthSQL } from '@everystack/auth/sql';
  *   const sql = generateAuthSQL();
  *   // Write to a migration file
+ *
+ *   // Or pick just what you need:
+ *   import { generateCoreSQL, generateAccessorSQL } from '@everystack/auth/sql';
+ *   const sql = generateCoreSQL() + '\n' + generateAccessorSQL();
  */
 
 const PGCRYPTO = `CREATE EXTENSION IF NOT EXISTS pgcrypto;`;
@@ -145,117 +154,750 @@ BEGIN
 END;
 $$;`;
 
-const GENERATE_REFRESH_TOKEN = `\
-CREATE OR REPLACE FUNCTION auth.generate_refresh_token(p_user_id UUID)
-RETURNS TEXT
+// =============================================================================
+// REFRESH TOKEN FUNCTIONS (RFC 6819)
+// =============================================================================
+
+const ISSUE_REFRESH_TOKEN = `\
+CREATE OR REPLACE FUNCTION auth.issue_refresh_token(
+  p_user_id UUID,
+  p_family_id UUID DEFAULT NULL,
+  p_ip_address TEXT DEFAULT NULL,
+  p_user_agent TEXT DEFAULT NULL,
+  p_device_id UUID DEFAULT NULL,
+  p_repository_id UUID DEFAULT NULL,
+  p_ttl INTERVAL DEFAULT '30 days'
+)
+RETURNS JSONB
 LANGUAGE plpgsql
 SECURITY DEFINER
+SET search_path = auth, public, pg_temp
 AS $$
 DECLARE
-  v_token TEXT;
-  v_hash TEXT;
-  v_family TEXT;
+  v_raw_token TEXT;
+  v_token_hash TEXT;
+  v_family_id UUID;
+  v_expires_at TIMESTAMPTZ;
+  v_family_count INTEGER;
+  v_oldest_family UUID;
 BEGIN
-  -- Clean up expired tokens for this user
+  -- Clean up expired tokens for this user (scoped by repository)
   DELETE FROM auth.refresh_tokens
-  WHERE user_id = p_user_id AND expires_at < now();
+  WHERE user_id = p_user_id
+    AND repository_id IS NOT DISTINCT FROM p_repository_id
+    AND expires_at < now();
+
+  -- Enforce per-user family ceiling (only for new families)
+  IF p_family_id IS NULL THEN
+    SELECT count(DISTINCT family_id) INTO v_family_count
+    FROM auth.refresh_tokens
+    WHERE user_id = p_user_id
+      AND repository_id IS NOT DISTINCT FROM p_repository_id
+      AND status = 'active';
+
+    IF v_family_count >= 10 THEN
+      -- Revoke the oldest family
+      SELECT family_id INTO v_oldest_family
+      FROM auth.refresh_tokens
+      WHERE user_id = p_user_id
+        AND repository_id IS NOT DISTINCT FROM p_repository_id
+        AND status = 'active'
+      GROUP BY family_id
+      ORDER BY MIN(created_at) ASC
+      LIMIT 1;
+
+      DELETE FROM auth.refresh_tokens
+      WHERE user_id = p_user_id AND family_id = v_oldest_family;
+    END IF;
+  END IF;
 
-  -- Generate random token (32 bytes, base64url encoded)
-  v_token := rtrim(translate(
+  -- Generate 32 random bytes, base64url encoded
+  v_raw_token := rtrim(translate(
     encode(gen_random_bytes(32), 'base64'),
     '+/=', '-_ '
   ));
 
   -- Store SHA-256 hash, not the raw token
-  v_hash := encode(digest(v_token, 'sha256'), 'hex');
-  v_family := gen_random_uuid()::text;
-
-  INSERT INTO auth.refresh_tokens (user_id, token_hash, family_id, expires_at)
-  VALUES (p_user_id, v_hash, v_family, now() + interval '7 days');
+  v_token_hash := encode(digest(v_raw_token, 'sha256'), 'hex');
+  v_family_id := COALESCE(p_family_id, gen_random_uuid());
+  v_expires_at := now() + p_ttl;
+
+  INSERT INTO auth.refresh_tokens (
+    repository_id, user_id, token_hash, family_id, status,
+    ip_address, user_agent, device_id, expires_at
+  )
+  VALUES (
+    p_repository_id, p_user_id, v_token_hash, v_family_id, 'active',
+    p_ip_address, p_user_agent, p_device_id, v_expires_at
+  );
 
-  RETURN v_token;
+  RETURN jsonb_build_object(
+    'token', v_raw_token,
+    'familyId', v_family_id,
+    'expiresAt', v_expires_at
+  );
 END;
-$$;`;
+$$;
+
+REVOKE EXECUTE ON FUNCTION auth.issue_refresh_token FROM PUBLIC;`;
 
 const VALIDATE_REFRESH_TOKEN = `\
-CREATE OR REPLACE FUNCTION auth.validate_refresh_token(p_token TEXT)
+CREATE OR REPLACE FUNCTION auth.validate_refresh_token(
+  p_token TEXT,
+  p_device_id UUID DEFAULT NULL,
+  p_ip_address TEXT DEFAULT NULL,
+  p_user_agent TEXT DEFAULT NULL,
+  p_ttl INTERVAL DEFAULT '30 days'
+)
 RETURNS JSONB
 LANGUAGE plpgsql
 SECURITY DEFINER
+SET search_path = auth, public, pg_temp
 AS $$
 DECLARE
-  v_hash TEXT;
-  v_existing RECORD;
-  v_new_token TEXT;
-  v_new_hash TEXT;
+  v_token_hash TEXT;
+  v_row RECORD;
+  v_user_deleted TIMESTAMPTZ;
+  v_new_token JSONB;
 BEGIN
-  v_hash := encode(digest(p_token, 'sha256'), 'hex');
+  -- 1. Hash the input token
+  v_token_hash := encode(digest(p_token, 'sha256'), 'hex');
 
-  SELECT * INTO v_existing
+  -- 2. Look up with row lock (prevents concurrent refresh races)
+  SELECT id, user_id, family_id, status, expires_at, device_id, repository_id
+  INTO v_row
   FROM auth.refresh_tokens
-  WHERE token_hash = v_hash
-  FOR UPDATE
-  LIMIT 1;
+  WHERE token_hash = v_token_hash
+  FOR UPDATE;
 
-  IF v_existing IS NULL THEN
-    RAISE EXCEPTION 'invalid_token';
+  IF NOT FOUND THEN
+    RAISE EXCEPTION 'invalid_token' USING ERRCODE = 'P0001';
   END IF;
 
-  IF v_existing.expires_at < now() THEN
-    DELETE FROM auth.refresh_tokens WHERE id = v_existing.id;
-    RAISE EXCEPTION 'token_expired';
+  -- 3. Consumed token reuse = theft detected -> revoke entire family
+  --    Return error as JSONB instead of RAISE because PostgreSQL rolls back
+  --    the DELETE when an exception propagates. Returning normally lets the
+  --    family deletion commit. The caller checks for result.error.
+  IF v_row.status = 'consumed' THEN
+    DELETE FROM auth.refresh_tokens WHERE family_id = v_row.family_id;
+    RETURN jsonb_build_object('error', 'token_reused');
+  END IF;
+
+  -- 4. Check expiry
+  IF v_row.expires_at < now() THEN
+    DELETE FROM auth.refresh_tokens WHERE id = v_row.id;
+    RAISE EXCEPTION 'token_expired' USING ERRCODE = 'P0003';
+  END IF;
+
+  -- 5. Check user is not deleted
+  SELECT deleted_at INTO v_user_deleted
+  FROM auth.users
+  WHERE id = v_row.user_id;
+
+  IF v_user_deleted IS NOT NULL THEN
+    DELETE FROM auth.refresh_tokens WHERE user_id = v_row.user_id;
+    RAISE EXCEPTION 'user_disabled' USING ERRCODE = 'P0004';
+  END IF;
+
+  -- 6. Device binding: if token was issued to a specific device, verify it
+  IF v_row.device_id IS NOT NULL AND p_device_id IS NOT NULL
+     AND v_row.device_id IS DISTINCT FROM p_device_id THEN
+    DELETE FROM auth.refresh_tokens WHERE family_id = v_row.family_id;
+    RAISE EXCEPTION 'device_mismatch' USING ERRCODE = 'P0005';
+  END IF;
+
+  -- 7. Rotate: mark consumed, issue new token in same family
+  UPDATE auth.refresh_tokens
+  SET status = 'consumed'
+  WHERE id = v_row.id;
+
+  -- Inherit repository_id from the original token
+  v_new_token := auth.issue_refresh_token(
+    v_row.user_id,
+    v_row.family_id,
+    p_ip_address,
+    p_user_agent,
+    v_row.device_id,
+    v_row.repository_id,
+    p_ttl
+  );
+
+  RETURN v_new_token || jsonb_build_object('userId', v_row.user_id);
+END;
+$$;
+
+REVOKE EXECUTE ON FUNCTION auth.validate_refresh_token FROM PUBLIC;`;
+
+const REVOKE_REFRESH_TOKENS = `\
+CREATE OR REPLACE FUNCTION auth.revoke_refresh_tokens(
+  p_user_id UUID,
+  p_family_id UUID DEFAULT NULL,
+  p_repository_id UUID DEFAULT NULL
+)
+RETURNS INTEGER
+LANGUAGE plpgsql
+SECURITY DEFINER
+SET search_path = auth, public, pg_temp
+AS $$
+DECLARE
+  v_count INTEGER;
+BEGIN
+  IF p_family_id IS NOT NULL THEN
+    DELETE FROM auth.refresh_tokens
+    WHERE user_id = p_user_id AND family_id = p_family_id;
+  ELSIF p_repository_id IS NOT NULL THEN
+    DELETE FROM auth.refresh_tokens
+    WHERE user_id = p_user_id AND repository_id = p_repository_id;
+  ELSE
+    DELETE FROM auth.refresh_tokens
+    WHERE user_id = p_user_id;
   END IF;
 
-  -- Delete old token (one-time use)
-  DELETE FROM auth.refresh_tokens WHERE id = v_existing.id;
+  GET DIAGNOSTICS v_count = ROW_COUNT;
+  RETURN v_count;
+END;
+$$;
+
+REVOKE EXECUTE ON FUNCTION auth.revoke_refresh_tokens FROM PUBLIC;`;
+
+const CLEANUP_REFRESH_TOKENS = `\
+CREATE OR REPLACE FUNCTION auth.cleanup_refresh_tokens(
+  p_consumed_retention INTERVAL DEFAULT '7 days'
+)
+RETURNS INTEGER
+LANGUAGE plpgsql
+SECURITY DEFINER
+SET search_path = auth, public, pg_temp
+AS $$
+DECLARE
+  v_count INTEGER;
+BEGIN
+  DELETE FROM auth.refresh_tokens
+  WHERE expires_at < now()
+     OR (status = 'consumed' AND created_at < now() - p_consumed_retention);
+
+  GET DIAGNOSTICS v_count = ROW_COUNT;
+  RETURN v_count;
+END;
+$$;
+
+REVOKE EXECUTE ON FUNCTION auth.cleanup_refresh_tokens FROM PUBLIC;`;
+
+// =============================================================================
+// SUPABASE-COMPATIBLE ACCESSOR FUNCTIONS
+// =============================================================================
 
-  -- Generate new token in same family
-  v_new_token := rtrim(translate(
+const AUTH_UID = `\
+CREATE OR REPLACE FUNCTION auth.uid()
+RETURNS uuid
+LANGUAGE sql STABLE
+AS $$
+  SELECT COALESCE(
+    (nullif(current_setting('request.jwt.claims', true), '')::jsonb ->> 'sub')::uuid,
+    NULL
+  );
+$$;`;
+
+const AUTH_ROLE = `\
+CREATE OR REPLACE FUNCTION auth.role()
+RETURNS text
+LANGUAGE sql STABLE
+AS $$
+  SELECT COALESCE(
+    nullif(current_setting('request.jwt.claims', true), '')::jsonb ->> 'role',
+    'anon'
+  );
+$$;`;
+
+const AUTH_JWT = `\
+CREATE OR REPLACE FUNCTION auth.jwt()
+RETURNS jsonb
+LANGUAGE sql STABLE
+AS $$
+  SELECT COALESCE(
+    nullif(current_setting('request.jwt.claims', true), '')::jsonb,
+    '{}'::jsonb
+  );
+$$;`;
+
+// =============================================================================
+// ONE-TIME TOKEN FUNCTIONS
+// =============================================================================
+
+const CREATE_ONE_TIME_TOKEN = `\
+CREATE OR REPLACE FUNCTION auth.create_one_time_token(
+  p_user_id UUID,
+  p_token_type TEXT,
+  p_relates_to TEXT
+)
+RETURNS TEXT
+LANGUAGE plpgsql
+SECURITY DEFINER
+SET search_path = auth, public, pg_temp
+AS $$
+DECLARE
+  v_raw_token TEXT;
+  v_token_hash TEXT;
+BEGIN
+  -- Delete any existing token of this type for this user
+  DELETE FROM auth.one_time_tokens
+  WHERE user_id = p_user_id AND token_type = p_token_type;
+
+  -- Generate 32 random bytes, base64url encoded
+  v_raw_token := rtrim(translate(
     encode(gen_random_bytes(32), 'base64'),
     '+/=', '-_ '
   ));
-  v_new_hash := encode(digest(v_new_token, 'sha256'), 'hex');
 
-  INSERT INTO auth.refresh_tokens (user_id, token_hash, family_id, expires_at)
-  VALUES (v_existing.user_id, v_new_hash, v_existing.family_id, now() + interval '7 days');
+  v_token_hash := encode(digest(v_raw_token, 'sha256'), 'hex');
+
+  INSERT INTO auth.one_time_tokens (user_id, token_type, token_hash, relates_to)
+  VALUES (p_user_id, p_token_type, v_token_hash, p_relates_to);
+
+  RETURN v_raw_token;
+END;
+$$;
+
+REVOKE EXECUTE ON FUNCTION auth.create_one_time_token FROM PUBLIC;`;
+
+const VERIFY_ONE_TIME_TOKEN = `\
+CREATE OR REPLACE FUNCTION auth.verify_one_time_token(
+  p_token TEXT,
+  p_token_type TEXT
+)
+RETURNS JSONB
+LANGUAGE plpgsql
+SECURITY DEFINER
+SET search_path = auth, public, pg_temp
+AS $$
+DECLARE
+  v_token_hash TEXT;
+  v_row RECORD;
+BEGIN
+  v_token_hash := encode(digest(p_token, 'sha256'), 'hex');
+
+  SELECT user_id, relates_to INTO v_row
+  FROM auth.one_time_tokens
+  WHERE token_hash = v_token_hash
+    AND token_type = p_token_type
+  FOR UPDATE;
+
+  IF NOT FOUND THEN
+    RAISE EXCEPTION 'invalid_token' USING ERRCODE = 'P0001';
+  END IF;
+
+  -- Delete the token (one-time use)
+  DELETE FROM auth.one_time_tokens
+  WHERE token_hash = v_token_hash AND token_type = p_token_type;
 
   RETURN jsonb_build_object(
-    'userId', v_existing.user_id,
-    'token', v_new_token,
-    'familyId', v_existing.family_id
+    'userId', v_row.user_id,
+    'relatesTo', v_row.relates_to
   );
 END;
-$$;`;
+$$;
 
-const REVOKE_REFRESH_TOKENS = `\
-CREATE OR REPLACE FUNCTION auth.revoke_refresh_tokens(p_user_id UUID)
-RETURNS VOID
+REVOKE EXECUTE ON FUNCTION auth.verify_one_time_token FROM PUBLIC;`;
+
+// =============================================================================
+// DEFAULT AUTH FUNCTIONS (work against default auth.users schema)
+// =============================================================================
+
+const SIGN_UP = `\
+CREATE OR REPLACE FUNCTION auth.sign_up(
+  p_email TEXT,
+  p_password TEXT,
+  p_user_meta_data JSONB DEFAULT '{}'
+)
+RETURNS JSONB
 LANGUAGE plpgsql
 SECURITY DEFINER
+SET search_path = auth, public, pg_temp
 AS $$
+DECLARE
+  v_user RECORD;
+  v_encrypted TEXT;
 BEGIN
-  DELETE FROM auth.refresh_tokens WHERE user_id = p_user_id;
+  -- Check if email already exists
+  SELECT id INTO v_user FROM auth.users
+  WHERE email = lower(trim(p_email)) AND deleted_at IS NULL;
+
+  IF FOUND THEN
+    RAISE EXCEPTION 'email_exists' USING ERRCODE = 'P0001';
+  END IF;
+
+  v_encrypted := auth.hash_password(p_password);
+
+  INSERT INTO auth.users (
+    email, encrypted_password, role, aud,
+    raw_user_meta_data, raw_app_meta_data
+  )
+  VALUES (
+    lower(trim(p_email)), v_encrypted, 'authenticated', 'authenticated',
+    p_user_meta_data, jsonb_build_object('provider', 'email', 'providers', jsonb_build_array('email'))
+  )
+  RETURNING * INTO v_user;
+
+  -- Create email identity
+  INSERT INTO auth.identities (user_id, provider, provider_id, identity_data, email)
+  VALUES (v_user.id, 'email', v_user.id::text, p_user_meta_data, v_user.email);
+
+  RETURN jsonb_build_object(
+    'sub', v_user.id,
+    'email', v_user.email,
+    'role', v_user.role
+  );
 END;
-$$;`;
+$$;
 
-export function generateAuthSQL(): string {
-  const parts = [
-    PGCRYPTO,
-    '',
-    HASH_PASSWORD,
-    '',
-    VERIFY_PASSWORD,
-    '',
-    SIGN_JWT,
-    '',
-    VERIFY_JWT,
-    '',
-    GENERATE_REFRESH_TOKEN,
-    '',
-    VALIDATE_REFRESH_TOKEN,
+REVOKE EXECUTE ON FUNCTION auth.sign_up FROM PUBLIC;`;
+
+const SIGN_IN = `\
+CREATE OR REPLACE FUNCTION auth.sign_in(
+  p_email TEXT,
+  p_password TEXT
+)
+RETURNS JSONB
+LANGUAGE plpgsql
+SECURITY DEFINER
+SET search_path = auth, public, pg_temp
+AS $$
+DECLARE
+  v_user RECORD;
+  v_valid BOOLEAN;
+BEGIN
+  SELECT * INTO v_user FROM auth.users
+  WHERE email = lower(trim(p_email)) AND deleted_at IS NULL;
+
+  IF NOT FOUND THEN
+    -- Timing-safe: still run bcrypt to prevent user enumeration
+    PERFORM auth.verify_password(p_password,
+      '$2a$10$abcdefghijklmnopqrstuuABCDEFGHIJKLMNOPQRSTUVWXYZ012345');
+    RAISE EXCEPTION 'invalid_credentials' USING ERRCODE = 'P0001';
+  END IF;
+
+  -- Check banned
+  IF v_user.banned_until IS NOT NULL AND v_user.banned_until > now() THEN
+    RAISE EXCEPTION 'user_banned' USING ERRCODE = 'P0006';
+  END IF;
+
+  v_valid := auth.verify_password(p_password, v_user.encrypted_password);
+  IF NOT v_valid THEN
+    RAISE EXCEPTION 'invalid_credentials' USING ERRCODE = 'P0001';
+  END IF;
+
+  -- Update last sign in
+  UPDATE auth.users SET last_sign_in_at = now(), updated_at = now()
+  WHERE id = v_user.id;
+
+  RETURN jsonb_build_object(
+    'sub', v_user.id,
+    'email', v_user.email,
+    'role', v_user.role
+  );
+END;
+$$;
+
+REVOKE EXECUTE ON FUNCTION auth.sign_in FROM PUBLIC;`;
+
+const OAUTH_SIGN_IN = `\
+CREATE OR REPLACE FUNCTION auth.oauth_sign_in(
+  p_provider TEXT,
+  p_provider_id TEXT,
+  p_email TEXT,
+  p_identity_data JSONB DEFAULT '{}'
+)
+RETURNS JSONB
+LANGUAGE plpgsql
+SECURITY DEFINER
+SET search_path = auth, public, pg_temp
+AS $$
+DECLARE
+  v_identity RECORD;
+  v_user RECORD;
+  v_providers JSONB;
+BEGIN
+  -- Look up existing identity
+  SELECT * INTO v_identity FROM auth.identities
+  WHERE provider = p_provider AND provider_id = p_provider_id;
+
+  IF FOUND THEN
+    -- Existing user, update identity data and sign in
+    SELECT * INTO v_user FROM auth.users WHERE id = v_identity.user_id AND deleted_at IS NULL;
+    IF NOT FOUND THEN
+      RAISE EXCEPTION 'user_disabled' USING ERRCODE = 'P0004';
+    END IF;
+
+    UPDATE auth.identities
+    SET identity_data = p_identity_data, last_sign_in_at = now(), updated_at = now()
+    WHERE id = v_identity.id;
+
+    UPDATE auth.users SET last_sign_in_at = now(), updated_at = now()
+    WHERE id = v_user.id;
+
+    RETURN jsonb_build_object(
+      'sub', v_user.id,
+      'email', v_user.email,
+      'role', v_user.role,
+      'isNewUser', false
+    );
+  END IF;
+
+  -- Check if a user with this email already exists (link account)
+  SELECT * INTO v_user FROM auth.users
+  WHERE email = lower(trim(p_email)) AND deleted_at IS NULL;
+
+  IF FOUND THEN
+    -- Link the new provider to existing user
+    v_providers := COALESCE(v_user.raw_app_meta_data->'providers', '[]'::jsonb);
+    IF NOT v_providers ? p_provider THEN
+      v_providers := v_providers || to_jsonb(p_provider);
+    END IF;
+
+    UPDATE auth.users
+    SET raw_app_meta_data = COALESCE(raw_app_meta_data, '{}'::jsonb)
+        || jsonb_build_object('providers', v_providers),
+        last_sign_in_at = now(),
+        updated_at = now()
+    WHERE id = v_user.id;
+
+    INSERT INTO auth.identities (user_id, provider, provider_id, identity_data, email)
+    VALUES (v_user.id, p_provider, p_provider_id, p_identity_data, lower(trim(p_email)));
+
+    RETURN jsonb_build_object(
+      'sub', v_user.id,
+      'email', v_user.email,
+      'role', v_user.role,
+      'isNewUser', false
+    );
+  END IF;
+
+  -- New user: create auth.users + auth.identities
+  INSERT INTO auth.users (
+    email, role, aud, raw_user_meta_data, raw_app_meta_data,
+    email_confirmed_at, last_sign_in_at
+  )
+  VALUES (
+    lower(trim(p_email)), 'authenticated', 'authenticated',
+    p_identity_data,
+    jsonb_build_object('provider', p_provider, 'providers', jsonb_build_array(p_provider)),
+    now(), now()
+  )
+  RETURNING * INTO v_user;
+
+  INSERT INTO auth.identities (user_id, provider, provider_id, identity_data, email)
+  VALUES (v_user.id, p_provider, p_provider_id, p_identity_data, v_user.email);
+
+  RETURN jsonb_build_object(
+    'sub', v_user.id,
+    'email', v_user.email,
+    'role', v_user.role,
+    'isNewUser', true
+  );
+END;
+$$;
+
+REVOKE EXECUTE ON FUNCTION auth.oauth_sign_in FROM PUBLIC;`;
+
+// =============================================================================
+// JWT CONVENIENCE WRAPPERS
+// =============================================================================
+
+const SIGN_IN_JWT = `\
+CREATE OR REPLACE FUNCTION auth.sign_in_jwt(p_email TEXT, p_password TEXT)
+RETURNS JSONB
+LANGUAGE plpgsql
+SECURITY DEFINER
+SET search_path = auth, public, pg_temp
+AS $$
+DECLARE
+  v_payload JSONB;
+  v_claims JSONB;
+  v_token TEXT;
+  v_refresh JSONB;
+BEGIN
+  v_payload := auth.sign_in(p_email, p_password);
+
+  v_claims := v_payload || jsonb_build_object(
+    'iat', extract(epoch FROM now())::bigint,
+    'exp', (extract(epoch FROM now()) + 3600)::bigint
+  );
+  v_token := auth.sign_jwt(v_claims);
+
+  v_refresh := auth.issue_refresh_token((v_payload->>'sub')::uuid);
+
+  RETURN jsonb_build_object(
+    'access_token', v_token,
+    'refresh_token', v_refresh->>'token',
+    'user', v_payload
+  );
+END;
+$$;
+
+REVOKE EXECUTE ON FUNCTION auth.sign_in_jwt FROM PUBLIC;`;
+
+const SIGN_UP_JWT = `\
+CREATE OR REPLACE FUNCTION auth.sign_up_jwt(
+  p_email TEXT,
+  p_password TEXT,
+  p_user_meta_data JSONB DEFAULT '{}'
+)
+RETURNS JSONB
+LANGUAGE plpgsql
+SECURITY DEFINER
+SET search_path = auth, public, pg_temp
+AS $$
+DECLARE
+  v_payload JSONB;
+  v_claims JSONB;
+  v_token TEXT;
+  v_refresh JSONB;
+BEGIN
+  v_payload := auth.sign_up(p_email, p_password, p_user_meta_data);
+
+  v_claims := v_payload || jsonb_build_object(
+    'iat', extract(epoch FROM now())::bigint,
+    'exp', (extract(epoch FROM now()) + 3600)::bigint
+  );
+  v_token := auth.sign_jwt(v_claims);
+
+  v_refresh := auth.issue_refresh_token((v_payload->>'sub')::uuid);
+
+  RETURN jsonb_build_object(
+    'access_token', v_token,
+    'refresh_token', v_refresh->>'token',
+    'user', v_payload
+  );
+END;
+$$;
+
+REVOKE EXECUTE ON FUNCTION auth.sign_up_jwt FROM PUBLIC;`;
+
+const OAUTH_SIGN_IN_JWT = `\
+CREATE OR REPLACE FUNCTION auth.oauth_sign_in_jwt(
+  p_provider TEXT,
+  p_provider_id TEXT,
+  p_email TEXT,
+  p_identity_data JSONB DEFAULT '{}'
+)
+RETURNS JSONB
+LANGUAGE plpgsql
+SECURITY DEFINER
+SET search_path = auth, public, pg_temp
+AS $$
+DECLARE
+  v_payload JSONB;
+  v_claims JSONB;
+  v_token TEXT;
+  v_refresh JSONB;
+BEGIN
+  v_payload := auth.oauth_sign_in(p_provider, p_provider_id, p_email, p_identity_data);
+
+  v_claims := v_payload || jsonb_build_object(
+    'iat', extract(epoch FROM now())::bigint,
+    'exp', (extract(epoch FROM now()) + 3600)::bigint
+  );
+  v_token := auth.sign_jwt(v_claims);
+
+  v_refresh := auth.issue_refresh_token((v_payload->>'sub')::uuid);
+
+  RETURN jsonb_build_object(
+    'access_token', v_token,
+    'refresh_token', v_refresh->>'token',
+    'user', v_payload
+  );
+END;
+$$;
+
+REVOKE EXECUTE ON FUNCTION auth.oauth_sign_in_jwt FROM PUBLIC;`;
+
+// =============================================================================
+// COMPOSABLE GENERATORS
+// =============================================================================
+
+/** pgcrypto + hash_password + verify_password + sign_jwt + verify_jwt */
+export function generateCoreSQL(): string {
+  return [PGCRYPTO, '', HASH_PASSWORD, '', VERIFY_PASSWORD, '', SIGN_JWT, '', VERIFY_JWT]
+    .join('\n')
+    .trimEnd() + '\n';
+}
+
+/** issue + validate + revoke + cleanup refresh tokens (RFC 6819) */
+export function generateRefreshTokenSQL(): string {
+  return [ISSUE_REFRESH_TOKEN, '', VALIDATE_REFRESH_TOKEN, '', REVOKE_REFRESH_TOKENS, '', CLEANUP_REFRESH_TOKENS]
+    .join('\n')
+    .trimEnd() + '\n';
+}
+
+/** auth.uid(), auth.role(), auth.jwt() — Supabase-compatible RLS accessors */
+export function generateAccessorSQL(): string {
+  return [AUTH_UID, '', AUTH_ROLE, '', AUTH_JWT]
+    .join('\n')
+    .trimEnd() + '\n';
+}
+
+/** auth.create_one_time_token, auth.verify_one_time_token */
+export function generateOneTimeTokenSQL(): string {
+  return [CREATE_ONE_TIME_TOKEN, '', VERIFY_ONE_TIME_TOKEN]
+    .join('\n')
+    .trimEnd() + '\n';
+}
+
+/** auth.sign_in, auth.sign_up, auth.oauth_sign_in (work against default schema) */
+export function generateDefaultAuthSQL(): string {
+  return [SIGN_UP, '', SIGN_IN, '', OAUTH_SIGN_IN]
+    .join('\n')
+    .trimEnd() + '\n';
+}
+
+/** auth.sign_in_jwt, auth.sign_up_jwt, auth.oauth_sign_in_jwt */
+export function generateJwtWrappersSQL(): string {
+  return [SIGN_IN_JWT, '', SIGN_UP_JWT, '', OAUTH_SIGN_IN_JWT]
+    .join('\n')
+    .trimEnd() + '\n';
+}
+
+// =============================================================================
+// MAIN ENTRY POINT
+// =============================================================================
+
+export interface AuthSQLOptions {
+  /** Include Supabase-compatible accessor functions (default: true) */
+  accessors?: boolean;
+  /** Include one-time token functions (default: true) */
+  oneTimeTokens?: boolean;
+  /** Include default sign_in/sign_up/oauth_sign_in functions (default: true) */
+  defaultAuthFunctions?: boolean;
+  /** Include JWT convenience wrappers (default: false) */
+  jwtWrappers?: boolean;
+}
+
+/**
+ * Generate all auth SQL functions. Composable via options.
+ *
+ * Always includes: core (pgcrypto, hash, verify, JWT) + refresh tokens.
+ * Toggle the rest with options. Apps that replace the schema typically call
+ * generateAuthSQL({ defaultAuthFunctions: false }) and provide their own.
+ */
+export function generateAuthSQL(options?: AuthSQLOptions): string {
+  const parts: string[] = [
+    generateCoreSQL(),
     '',
-    REVOKE_REFRESH_TOKENS,
+    generateRefreshTokenSQL(),
   ];
 
+  if (options?.accessors !== false) {
+    parts.push('', generateAccessorSQL());
+  }
+  if (options?.oneTimeTokens !== false) {
+    parts.push('', generateOneTimeTokenSQL());
+  }
+  if (options?.defaultAuthFunctions !== false) {
+    parts.push('', generateDefaultAuthSQL());
+  }
+  if (options?.jwtWrappers) {
+    parts.push('', generateJwtWrappersSQL());
+  }
+
   return parts.join('\n').trimEnd() + '\n';
 }