@everystack/auth 0.2.5 → 0.2.6

package/src/sql.ts

@@ -32,6 +32,7 @@ CREATE OR REPLACE FUNCTION auth.hash_password(p_password TEXT)
 RETURNS TEXT
 LANGUAGE plpgsql
 SECURITY DEFINER
+SET search_path = auth, public, pg_temp
 AS $$
 BEGIN
   RETURN crypt(p_password, gen_salt('bf', 10));
@@ -43,6 +44,7 @@ CREATE OR REPLACE FUNCTION auth.verify_password(p_password TEXT, p_hash TEXT)
 RETURNS BOOLEAN
 LANGUAGE plpgsql
 SECURITY DEFINER
+SET search_path = auth, public, pg_temp
 AS $$
 DECLARE
   v_normalized TEXT;
@@ -59,6 +61,7 @@ CREATE OR REPLACE FUNCTION auth.sign_jwt(p_payload JSONB)
 RETURNS TEXT
 LANGUAGE plpgsql
 SECURITY DEFINER
+SET search_path = auth, public, pg_temp
 AS $$
 DECLARE
   v_header TEXT;
@@ -102,6 +105,7 @@ CREATE OR REPLACE FUNCTION auth.verify_jwt(p_token TEXT)
 RETURNS JSONB
 LANGUAGE plpgsql
 SECURITY DEFINER
+SET search_path = auth, public, pg_temp
 AS $$
 DECLARE
   v_parts TEXT[];
@@ -499,6 +503,118 @@ $$;
 
 REVOKE EXECUTE ON FUNCTION auth.verify_one_time_token FROM PUBLIC;`;
 
+// =============================================================================
+// TOKEN-GATED ACTION WRAPPERS
+//
+// These are the anon-safe entry points for the password-reset and email-confirm
+// flows. They are SECURITY DEFINER (they update auth.users — a locked table), but the
+// CALLER must already hold a valid one-time token, so they are credential-gated the
+// same way auth.sign_in is password-gated: there is nothing to abuse without the token.
+// The token-MINTING function (auth.create_one_time_token) is never granted to anon and
+// runs only on the privileged worker path. These wrappers touch ONLY auth.users — auth
+// columns. Public profile data lives in its own table and is never mixed in here.
+// =============================================================================
+
+const CONFIRM_EMAIL = `\
+CREATE OR REPLACE FUNCTION auth.confirm_email(p_token TEXT)
+RETURNS JSONB
+LANGUAGE plpgsql
+SECURITY DEFINER
+SET search_path = auth, public, pg_temp
+AS $$
+DECLARE
+  v_result JSONB;
+  v_user_id UUID;
+BEGIN
+  -- Raises on an invalid/expired/consumed token (fails closed). One-time use.
+  v_result := auth.verify_one_time_token(p_token, 'confirmation');
+  v_user_id := (v_result->>'userId')::uuid;
+
+  UPDATE auth.users
+  SET email_confirmed_at = now(), updated_at = now()
+  WHERE id = v_user_id;
+
+  RETURN jsonb_build_object('confirmed', true, 'userId', v_user_id);
+END;
+$$;
+
+REVOKE EXECUTE ON FUNCTION auth.confirm_email FROM PUBLIC;`;
+
+const RESET_PASSWORD = `\
+CREATE OR REPLACE FUNCTION auth.reset_password(p_token TEXT, p_new_password TEXT)
+RETURNS JSONB
+LANGUAGE plpgsql
+SECURITY DEFINER
+SET search_path = auth, public, pg_temp
+AS $$
+DECLARE
+  v_result JSONB;
+  v_user_id UUID;
+BEGIN
+  -- Raises on an invalid/expired/consumed token (fails closed). One-time use.
+  v_result := auth.verify_one_time_token(p_token, 'recovery');
+  v_user_id := (v_result->>'userId')::uuid;
+
+  UPDATE auth.users
+  SET encrypted_password = auth.hash_password(p_new_password), updated_at = now()
+  WHERE id = v_user_id;
+
+  -- A password reset invalidates every existing session — force re-login everywhere.
+  PERFORM auth.revoke_refresh_tokens(v_user_id);
+
+  RETURN jsonb_build_object('reset', true, 'userId', v_user_id);
+END;
+$$;
+
+REVOKE EXECUTE ON FUNCTION auth.reset_password FROM PUBLIC;`;
+
+// auth.change_password — the authenticated self-service password change. Not token-gated
+// but credential-gated: the caller must be authenticated (auth.uid() from the verified
+// JWT) AND prove the current password before the new one is set. SECURITY DEFINER because
+// verifying the current password requires reading encrypted_password, which authenticated
+// must never be granted. Granted to authenticated (not anon); called via withRole.
+const CHANGE_PASSWORD = `\
+CREATE OR REPLACE FUNCTION auth.change_password(p_current_password TEXT, p_new_password TEXT)
+RETURNS JSONB
+LANGUAGE plpgsql
+SECURITY DEFINER
+SET search_path = auth, public, pg_temp
+AS $$
+DECLARE
+  v_user_id UUID;
+  v_hash TEXT;
+BEGIN
+  -- The caller is authenticated; their verified subject claim identifies them.
+  -- Read the claim inline so this wrapper has no dependency on the accessor functions.
+  v_user_id := (nullif(current_setting('request.jwt.claims', true), '')::jsonb->>'sub')::uuid;
+  IF v_user_id IS NULL THEN
+    RAISE EXCEPTION 'not_authenticated' USING ERRCODE = 'P0001';
+  END IF;
+
+  SELECT encrypted_password INTO v_hash FROM auth.users
+  WHERE id = v_user_id AND deleted_at IS NULL;
+  IF NOT FOUND OR v_hash IS NULL THEN
+    RAISE EXCEPTION 'invalid_credentials' USING ERRCODE = 'P0001';
+  END IF;
+
+  -- Verify the current password before changing it (the gate).
+  IF NOT auth.verify_password(p_current_password, v_hash) THEN
+    RAISE EXCEPTION 'invalid_credentials' USING ERRCODE = 'P0001';
+  END IF;
+
+  UPDATE auth.users
+  SET encrypted_password = auth.hash_password(p_new_password), updated_at = now()
+  WHERE id = v_user_id;
+
+  -- A password change invalidates every existing session — force re-login everywhere.
+  PERFORM auth.revoke_refresh_tokens(v_user_id);
+
+  RETURN jsonb_build_object('changed', true, 'userId', v_user_id);
+END;
+$$;
+
+REVOKE EXECUTE ON FUNCTION auth.change_password FROM PUBLIC;`;
+
 // =============================================================================
 // DEFAULT AUTH FUNCTIONS (work against default auth.users schema)
 // =============================================================================
@@ -811,6 +927,76 @@ $$;
 
 REVOKE EXECUTE ON FUNCTION auth.oauth_sign_in_jwt FROM PUBLIC;`;
 
+// =============================================================================
+// SESSION WRAPPERS — the anon-safe login/signup entry points for a least-priv API
+//
+// Each is credential-gated (sign_in raises on a bad password; sign_up raises on a dup
+// email), so the caller proves the credential before anything is minted. They verify or
+// create the user AND issue the refresh token internally (as the definer/owner), so the
+// raw minters — issue_refresh_token, sign_jwt — never need a grant to anon and stay
+// REVOKE'd. They return only the caller's OWN identity plus the refresh token; the ACCESS
+// JWT is minted by the handler in JS (so app-level enrichClaims, e.g. the `aud` claim,
+// is preserved). They touch only auth.users; the public profile is created by a trigger.
+// =============================================================================
+
+const SIGN_IN_SESSION = `\
+CREATE OR REPLACE FUNCTION auth.sign_in_session(
+  p_email TEXT,
+  p_password TEXT,
+  p_ip_address TEXT DEFAULT NULL,
+  p_user_agent TEXT DEFAULT NULL,
+  p_device_id UUID DEFAULT NULL
+)
+RETURNS JSONB
+LANGUAGE plpgsql
+SECURITY DEFINER
+SET search_path = auth, public, pg_temp
+AS $$
+DECLARE
+  v_user JSONB;
+  v_refresh JSONB;
+BEGIN
+  -- Raises invalid_credentials (timing-safe) on a bad email/password — fails closed.
+  v_user := auth.sign_in(p_email, p_password);
+  v_refresh := auth.issue_refresh_token(
+    (v_user->>'sub')::uuid, NULL, p_ip_address, p_user_agent, p_device_id
+  );
+  RETURN v_user || jsonb_build_object('refresh_token', v_refresh->>'token');
+END;
+$$;
+
+REVOKE EXECUTE ON FUNCTION auth.sign_in_session FROM PUBLIC;`;
+
+const SIGN_UP_SESSION = `\
+CREATE OR REPLACE FUNCTION auth.sign_up_session(
+  p_email TEXT,
+  p_password TEXT,
+  p_user_meta_data JSONB DEFAULT '{}',
+  p_ip_address TEXT DEFAULT NULL,
+  p_user_agent TEXT DEFAULT NULL,
+  p_device_id UUID DEFAULT NULL
+)
+RETURNS JSONB
+LANGUAGE plpgsql
+SECURITY DEFINER
+SET search_path = auth, public, pg_temp
+AS $$
+DECLARE
+  v_user JSONB;
+  v_refresh JSONB;
+BEGIN
+  -- Raises email_exists on a duplicate. Creates auth.users only; the caller creates
+  -- the public profile as the authenticated user (invoker INSERT under RLS).
+  v_user := auth.sign_up(p_email, p_password, p_user_meta_data);
+  v_refresh := auth.issue_refresh_token(
+    (v_user->>'sub')::uuid, NULL, p_ip_address, p_user_agent, p_device_id
+  );
+  RETURN v_user || jsonb_build_object('refresh_token', v_refresh->>'token');
+END;
+$$;
+
+REVOKE EXECUTE ON FUNCTION auth.sign_up_session FROM PUBLIC;`;
+
 // =============================================================================
 // COMPOSABLE GENERATORS
 // =============================================================================
@@ -843,6 +1029,17 @@ export function generateOneTimeTokenSQL(): string {
     .trimEnd() + '\n';
 }
 
+/**
+ * auth.confirm_email, auth.reset_password — token-gated action wrappers. The anon-safe
+ * entry points for the email-confirm and password-reset flows (the caller holds a valid
+ * one-time token; the token-minting function stays owner-only on the worker path).
+ */
+export function generateTokenActionsSQL(): string {
+  return [CONFIRM_EMAIL, '', RESET_PASSWORD, '', CHANGE_PASSWORD]
+    .join('\n')
+    .trimEnd() + '\n';
+}
+
 /** auth.sign_in, auth.sign_up, auth.oauth_sign_in (work against default schema) */
 export function generateDefaultAuthSQL(): string {
   return [SIGN_UP, '', SIGN_IN, '', OAUTH_SIGN_IN]
@@ -857,6 +1054,18 @@ export function generateJwtWrappersSQL(): string {
     .trimEnd() + '\n';
 }
 
+/**
+ * auth.sign_in_session, auth.sign_up_session — the anon-safe, credential-gated login/signup
+ * entry points for a least-privilege API. They verify/create the user and issue the refresh
+ * token internally (the raw minters stay owner-only); the handler mints the access JWT in JS
+ * so enrichClaims is preserved.
+ */
+export function generateSessionWrappersSQL(): string {
+  return [SIGN_IN_SESSION, '', SIGN_UP_SESSION]
+    .join('\n')
+    .trimEnd() + '\n';
+}
+
 // =============================================================================
 // MAIN ENTRY POINT
 // =============================================================================
@@ -866,6 +1075,10 @@ export interface AuthSQLOptions {
   accessors?: boolean;
   /** Include one-time token functions (default: true) */
   oneTimeTokens?: boolean;
+  /** Include the token-gated action wrappers confirm_email/reset_password (default: true) */
+  tokenActions?: boolean;
+  /** Include the anon-safe session wrappers sign_in_session/sign_up_session (default: true) */
+  sessionWrappers?: boolean;
   /** Include default sign_in/sign_up/oauth_sign_in functions (default: true) */
   defaultAuthFunctions?: boolean;
   /** Include JWT convenience wrappers (default: false) */
@@ -892,6 +1105,12 @@ export function generateAuthSQL(options?: AuthSQLOptions): string {
   if (options?.oneTimeTokens !== false) {
     parts.push('', generateOneTimeTokenSQL());
   }
+  if (options?.tokenActions !== false) {
+    parts.push('', generateTokenActionsSQL());
+  }
+  if (options?.sessionWrappers !== false) {
+    parts.push('', generateSessionWrappersSQL());
+  }
   if (options?.defaultAuthFunctions !== false) {
     parts.push('', generateDefaultAuthSQL());
   }