@everystack/auth 0.1.0

package/src/sql.ts

@@ -0,0 +1,261 @@
+/**
+ * @everystack/auth/sql — Generate SQL for PostgreSQL auth functions.
+ *
+ * Creates 7 functions in the `auth` schema using pgcrypto:
+ * - auth.hash_password — bcrypt via crypt()/gen_salt()
+ * - auth.verify_password — bcrypt verification
+ * - auth.sign_jwt — HMAC-SHA256 JWT signing
+ * - auth.verify_jwt — JWT verification
+ * - auth.generate_refresh_token — opaque token with SHA-256 hash storage
+ * - auth.validate_refresh_token — one-time-use rotation
+ * - auth.revoke_refresh_tokens — delete all tokens for a user
+ *
+ * Usage:
+ *   import { generateAuthSQL } from '@everystack/auth/sql';
+ *   const sql = generateAuthSQL();
+ *   // Write to a migration file
+ */
+
+const PGCRYPTO = `CREATE EXTENSION IF NOT EXISTS pgcrypto;`;
+
+const HASH_PASSWORD = `\
+CREATE OR REPLACE FUNCTION auth.hash_password(p_password TEXT)
+RETURNS TEXT
+LANGUAGE plpgsql
+SECURITY DEFINER
+AS $$
+BEGIN
+  RETURN crypt(p_password, gen_salt('bf', 10));
+END;
+$$;`;
+
+const VERIFY_PASSWORD = `\
+CREATE OR REPLACE FUNCTION auth.verify_password(p_password TEXT, p_hash TEXT)
+RETURNS BOOLEAN
+LANGUAGE plpgsql
+SECURITY DEFINER
+AS $$
+DECLARE
+  v_normalized TEXT;
+BEGIN
+  -- pgcrypto crypt() only supports $2a$ prefix; bcryptjs produces $2b$.
+  -- $2a$ and $2b$ are byte-identical algorithms — normalize prefix for compat.
+  v_normalized := regexp_replace(p_hash, '^\\$2[by]\\$', '$2a$');
+  RETURN crypt(p_password, v_normalized) = v_normalized;
+END;
+$$;`;
+
+const SIGN_JWT = `\
+CREATE OR REPLACE FUNCTION auth.sign_jwt(p_payload JSONB)
+RETURNS TEXT
+LANGUAGE plpgsql
+SECURITY DEFINER
+AS $$
+DECLARE
+  v_header TEXT;
+  v_payload TEXT;
+  v_signing_input TEXT;
+  v_signature TEXT;
+  v_secret TEXT;
+BEGIN
+  v_secret := current_setting('app.jwt_secret', true);
+  IF v_secret IS NULL OR v_secret = '' THEN
+    RAISE EXCEPTION 'app.jwt_secret not set'
+      USING HINT = 'Call SET LOCAL app.jwt_secret before auth.sign_jwt';
+  END IF;
+
+  -- Base64url encode header (replace strips MIME newlines from encode())
+  v_header := rtrim(translate(
+    replace(encode(convert_to('{"alg":"HS256","typ":"JWT"}', 'utf8'), 'base64'), E'\\n', ''),
+    '+/=', '-_ '
+  ));
+
+  -- Base64url encode payload
+  v_payload := rtrim(translate(
+    replace(encode(convert_to(p_payload::text, 'utf8'), 'base64'), E'\\n', ''),
+    '+/=', '-_ '
+  ));
+
+  v_signing_input := v_header || '.' || v_payload;
+
+  -- HMAC-SHA256 signature via pgcrypto
+  v_signature := rtrim(translate(
+    replace(encode(hmac(v_signing_input, v_secret, 'sha256'), 'base64'), E'\\n', ''),
+    '+/=', '-_ '
+  ));
+
+  RETURN v_signing_input || '.' || v_signature;
+END;
+$$;`;
+
+const VERIFY_JWT = `\
+CREATE OR REPLACE FUNCTION auth.verify_jwt(p_token TEXT)
+RETURNS JSONB
+LANGUAGE plpgsql
+SECURITY DEFINER
+AS $$
+DECLARE
+  v_parts TEXT[];
+  v_signing_input TEXT;
+  v_expected_sig TEXT;
+  v_payload_json JSONB;
+  v_exp BIGINT;
+  v_secret TEXT;
+BEGIN
+  v_secret := current_setting('app.jwt_secret', true);
+  IF v_secret IS NULL OR v_secret = '' THEN
+    RAISE EXCEPTION 'app.jwt_secret not set'
+      USING HINT = 'Call SET LOCAL app.jwt_secret before auth.verify_jwt';
+  END IF;
+
+  v_parts := string_to_array(p_token, '.');
+  IF array_length(v_parts, 1) != 3 THEN
+    RETURN NULL;
+  END IF;
+
+  v_signing_input := v_parts[1] || '.' || v_parts[2];
+
+  -- Recompute expected signature (replace strips MIME newlines)
+  v_expected_sig := rtrim(translate(
+    replace(encode(hmac(v_signing_input, v_secret, 'sha256'), 'base64'), E'\\n', ''),
+    '+/=', '-_ '
+  ));
+
+  IF v_parts[3] != v_expected_sig THEN
+    RETURN NULL;
+  END IF;
+
+  -- Decode payload: base64url -> base64 -> bytes -> text -> jsonb
+  v_payload_json := convert_from(
+    decode(
+      translate(v_parts[2], '-_', '+/') ||
+      repeat('=', (4 - length(v_parts[2]) % 4) % 4),
+      'base64'
+    ),
+    'utf8'
+  )::jsonb;
+
+  -- Check expiration
+  v_exp := (v_payload_json->>'exp')::bigint;
+  IF v_exp IS NOT NULL AND v_exp < extract(epoch FROM now())::bigint THEN
+    RETURN NULL;
+  END IF;
+
+  RETURN v_payload_json;
+END;
+$$;`;
+
+const GENERATE_REFRESH_TOKEN = `\
+CREATE OR REPLACE FUNCTION auth.generate_refresh_token(p_user_id UUID)
+RETURNS TEXT
+LANGUAGE plpgsql
+SECURITY DEFINER
+AS $$
+DECLARE
+  v_token TEXT;
+  v_hash TEXT;
+  v_family TEXT;
+BEGIN
+  -- Clean up expired tokens for this user
+  DELETE FROM auth.refresh_tokens
+  WHERE user_id = p_user_id AND expires_at < now();
+
+  -- Generate random token (32 bytes, base64url encoded)
+  v_token := rtrim(translate(
+    encode(gen_random_bytes(32), 'base64'),
+    '+/=', '-_ '
+  ));
+
+  -- Store SHA-256 hash, not the raw token
+  v_hash := encode(digest(v_token, 'sha256'), 'hex');
+  v_family := gen_random_uuid()::text;
+
+  INSERT INTO auth.refresh_tokens (user_id, token_hash, family_id, expires_at)
+  VALUES (p_user_id, v_hash, v_family, now() + interval '7 days');
+
+  RETURN v_token;
+END;
+$$;`;
+
+const VALIDATE_REFRESH_TOKEN = `\
+CREATE OR REPLACE FUNCTION auth.validate_refresh_token(p_token TEXT)
+RETURNS JSONB
+LANGUAGE plpgsql
+SECURITY DEFINER
+AS $$
+DECLARE
+  v_hash TEXT;
+  v_existing RECORD;
+  v_new_token TEXT;
+  v_new_hash TEXT;
+BEGIN
+  v_hash := encode(digest(p_token, 'sha256'), 'hex');
+
+  SELECT * INTO v_existing
+  FROM auth.refresh_tokens
+  WHERE token_hash = v_hash
+  FOR UPDATE
+  LIMIT 1;
+
+  IF v_existing IS NULL THEN
+    RAISE EXCEPTION 'invalid_token';
+  END IF;
+
+  IF v_existing.expires_at < now() THEN
+    DELETE FROM auth.refresh_tokens WHERE id = v_existing.id;
+    RAISE EXCEPTION 'token_expired';
+  END IF;
+
+  -- Delete old token (one-time use)
+  DELETE FROM auth.refresh_tokens WHERE id = v_existing.id;
+
+  -- Generate new token in same family
+  v_new_token := rtrim(translate(
+    encode(gen_random_bytes(32), 'base64'),
+    '+/=', '-_ '
+  ));
+  v_new_hash := encode(digest(v_new_token, 'sha256'), 'hex');
+
+  INSERT INTO auth.refresh_tokens (user_id, token_hash, family_id, expires_at)
+  VALUES (v_existing.user_id, v_new_hash, v_existing.family_id, now() + interval '7 days');
+
+  RETURN jsonb_build_object(
+    'userId', v_existing.user_id,
+    'token', v_new_token,
+    'familyId', v_existing.family_id
+  );
+END;
+$$;`;
+
+const REVOKE_REFRESH_TOKENS = `\
+CREATE OR REPLACE FUNCTION auth.revoke_refresh_tokens(p_user_id UUID)
+RETURNS VOID
+LANGUAGE plpgsql
+SECURITY DEFINER
+AS $$
+BEGIN
+  DELETE FROM auth.refresh_tokens WHERE user_id = p_user_id;
+END;
+$$;`;
+
+export function generateAuthSQL(): string {
+  const parts = [
+    PGCRYPTO,
+    '',
+    HASH_PASSWORD,
+    '',
+    VERIFY_PASSWORD,
+    '',
+    SIGN_JWT,
+    '',
+    VERIFY_JWT,
+    '',
+    GENERATE_REFRESH_TOKEN,
+    '',
+    VALIDATE_REFRESH_TOKEN,
+    '',
+    REVOKE_REFRESH_TOKENS,
+  ];
+
+  return parts.join('\n').trimEnd() + '\n';
+}