@eyoben/auth-postgres 0.0.0-stage → 1.0.0

package/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 Ebenezer Seyoum
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/README.md

@@ -1,3 +1,44 @@
-# Temporary Holding Version
-
-This version is a temporary placeholder for this package. An operational version to replace this has been submitted for review and is awaiting a staged release.
+# @eyoben/auth-postgres
+
+PostgreSQL and Neon storage adapter for `@eyoben/auth`. The application owns the `postgres` client and connection string.
+
+```ts
+import postgres from "postgres";
+import { createPostgresAuth, postgresMigration } from "@eyoben/auth-postgres";
+
+const sql = postgres(process.env.DATABASE_URL!);
+await sql.unsafe(postgresMigration);
+
+export const auth = createPostgresAuth({
+  sql,
+  baseURL: process.env.APP_URL!,
+});
+```
+
+`createPostgresAuth` wires the normal authentication adapter together with the
+tenant, identity, membership, verification, and invitation repositories. To
+customize only the domain storage, pass `domain.repositories` in the options.
+
+Run `await auth.domain?.cleanupExpiredInvitations()` from your application's
+cron worker. It deletes only expired invitations that have not been accepted.
+
+For installations created before nullable email support, run
+`postgresNullableEmailMigration` once before enabling phone-only signup.
+
+Do not put connection strings or migrations inside a reusable application package.
+
+## Live test
+
+Use a disposable PostgreSQL or Neon database. In PowerShell, set the connection
+string for the current terminal session without committing it:
+
+```powershell
+$env:DATABASE_URL = "postgres://user:password@host/database?sslmode=require"
+npm run test:live --workspace=@eyoben/auth-postgres
+Remove-Item Env:DATABASE_URL
+```
+
+The live test creates the Eyoben tables, inserts a uniquely named test user,
+creates and reads a session, deletes the session, and removes the test user.
+Without `DATABASE_URL`, it is skipped. Use a disposable database because the
+migration creates shared tables in the selected database.

package/dist/index.d.ts

@@ -0,0 +1,18 @@
+import { AuthDomainRepositories, Adapter, CreateAuthConfig, Auth } from '@eyoben/auth';
+
+declare function createPostgresDomainRepositories(sql: PostgresClient): AuthDomainRepositories;
+
+type PostgresClient = {
+    unsafe<T>(query: string, values?: unknown[]): Promise<T[]>;
+    begin?<T>(callback: (sql: PostgresClient) => Promise<T>): Promise<T>;
+};
+
+declare const postgresMigration = "\nCREATE TABLE IF NOT EXISTS \"user\" (\n  id text PRIMARY KEY, email text UNIQUE, email_verified boolean NOT NULL DEFAULT false,\n  name text, password_hash text, two_factor_enabled boolean NOT NULL DEFAULT false,\n  created_at timestamptz NOT NULL, updated_at timestamptz NOT NULL\n);\nCREATE TABLE IF NOT EXISTS session (\n  id text PRIMARY KEY, user_id text NOT NULL REFERENCES \"user\"(id) ON DELETE CASCADE,\n  token_hash text NOT NULL UNIQUE, expires_at timestamptz NOT NULL, created_at timestamptz NOT NULL,\n  ip_address text, user_agent text\n);\nCREATE TABLE IF NOT EXISTS account (\n  id text PRIMARY KEY, user_id text NOT NULL REFERENCES \"user\"(id) ON DELETE CASCADE,\n  provider_id text NOT NULL, account_id text NOT NULL, created_at timestamptz NOT NULL,\n  UNIQUE(provider_id, account_id)\n);\nCREATE TABLE IF NOT EXISTS verification (\n  id text PRIMARY KEY, identifier text NOT NULL, token_hash text NOT NULL UNIQUE,\n  type text NOT NULL CHECK (type IN ('email-verification', 'password-reset')),\n  expires_at timestamptz NOT NULL, created_at timestamptz NOT NULL\n);\nCREATE TABLE IF NOT EXISTS passkey (\n  id text PRIMARY KEY, user_id text NOT NULL REFERENCES \"user\"(id) ON DELETE CASCADE,\n  credential_id text NOT NULL UNIQUE, public_key text NOT NULL, counter integer NOT NULL,\n  transports text, device_type text NOT NULL, backed_up boolean NOT NULL, name text,\n  created_at timestamptz NOT NULL, last_used_at timestamptz\n);\nCREATE TABLE IF NOT EXISTS two_factor_secret (\n  id text PRIMARY KEY, user_id text NOT NULL UNIQUE REFERENCES \"user\"(id) ON DELETE CASCADE,\n  encrypted_secret text NOT NULL, created_at timestamptz NOT NULL\n);\nCREATE TABLE IF NOT EXISTS recovery_code (\n  id text PRIMARY KEY, user_id text NOT NULL REFERENCES \"user\"(id) ON DELETE CASCADE,\n  code_hash text NOT NULL, used_at timestamptz, created_at timestamptz NOT NULL\n);\nCREATE TABLE IF NOT EXISTS organization (\n  id text PRIMARY KEY, name text NOT NULL, slug text NOT NULL UNIQUE, created_at timestamptz NOT NULL\n);\nCREATE TABLE IF NOT EXISTS organization_member (\n  id text PRIMARY KEY, organization_id text NOT NULL REFERENCES organization(id) ON DELETE CASCADE,\n  user_id text NOT NULL REFERENCES \"user\"(id) ON DELETE CASCADE,\n  role text NOT NULL CHECK (role IN ('owner', 'admin', 'member')), created_at timestamptz NOT NULL,\n  UNIQUE(organization_id, user_id)\n);\nCREATE INDEX IF NOT EXISTS session_token_hash_idx ON session(token_hash);\nCREATE INDEX IF NOT EXISTS passkey_user_id_idx ON passkey(user_id);\nCREATE TABLE IF NOT EXISTS auth_identity (id text PRIMARY KEY,user_id text NOT NULL REFERENCES \"user\"(id) ON DELETE CASCADE,kind text NOT NULL,value text NOT NULL,provider text,verified_at timestamptz,created_at timestamptz NOT NULL,UNIQUE(kind,value,provider));\nCREATE TABLE IF NOT EXISTS auth_tenant (id text PRIMARY KEY,name text NOT NULL,slug text NOT NULL UNIQUE,active boolean NOT NULL DEFAULT true,created_at timestamptz NOT NULL);\nCREATE TABLE IF NOT EXISTS auth_membership (id text PRIMARY KEY,tenant_id text NOT NULL REFERENCES auth_tenant(id) ON DELETE CASCADE,user_id text NOT NULL REFERENCES \"user\"(id) ON DELETE CASCADE,role text NOT NULL,status text NOT NULL DEFAULT 'active',suspended_at timestamptz,suspension_reason text,created_at timestamptz NOT NULL,UNIQUE(tenant_id,user_id));\nCREATE TABLE IF NOT EXISTS auth_challenge (id text PRIMARY KEY,purpose text NOT NULL,subject text NOT NULL,tenant_id text REFERENCES auth_tenant(id) ON DELETE CASCADE,token_hash text NOT NULL UNIQUE,expires_at timestamptz NOT NULL,attempts integer NOT NULL DEFAULT 0,max_attempts integer NOT NULL,consumed_at timestamptz,created_at timestamptz NOT NULL);\nCREATE TABLE IF NOT EXISTS auth_invitation (id text PRIMARY KEY,tenant_id text NOT NULL REFERENCES auth_tenant(id) ON DELETE CASCADE,identifier text NOT NULL,role text NOT NULL,token_hash text NOT NULL UNIQUE,expires_at timestamptz NOT NULL,accepted_at timestamptz,created_at timestamptz NOT NULL);\n";
+/** Apply after upgrading an installation created before phone-only accounts. */
+declare const postgresNullableEmailMigration = "ALTER TABLE \"user\" ALTER COLUMN email DROP NOT NULL;";
+declare function createPostgresAdapter(sql: PostgresClient): Adapter;
+declare function createPostgresAuth(config: Omit<CreateAuthConfig, "adapter" | "db"> & {
+    sql: PostgresClient;
+}): Auth;
+
+export { type PostgresClient, createPostgresAdapter, createPostgresAuth, createPostgresDomainRepositories, postgresMigration, postgresNullableEmailMigration };

package/dist/index.js

@@ -0,0 +1,288 @@
+// src/index.ts
+import { createAuth } from "@eyoben/auth";
+
+// src/domain-adapter.ts
+var id = () => crypto.randomUUID();
+var now = () => /* @__PURE__ */ new Date();
+var first = (rows) => rows[0] ?? null;
+function createPostgresDomainRepositories(sql) {
+  const identities = {
+    async createIdentity(input) {
+      return first(await sql.unsafe(`INSERT INTO auth_identity(id,user_id,kind,value,provider,verified_at,created_at) VALUES($1,$2,$3,$4,$5,$6,$7) RETURNING id,user_id AS "userId",kind,value,provider,verified_at AS "verifiedAt",created_at AS "createdAt"`, [id(), input.userId, input.kind, input.value, input.provider ?? null, input.verifiedAt, now()]));
+    },
+    async findIdentity(kind, value, provider) {
+      return first(await sql.unsafe(`SELECT id,user_id AS "userId",kind,value,provider,verified_at AS "verifiedAt",created_at AS "createdAt" FROM auth_identity WHERE kind=$1 AND value=$2 AND provider IS NOT DISTINCT FROM $3 LIMIT 1`, [kind, value, provider ?? null]));
+    },
+    async listIdentities(userId) {
+      return sql.unsafe(`SELECT id,user_id AS "userId",kind,value,provider,verified_at AS "verifiedAt",created_at AS "createdAt" FROM auth_identity WHERE user_id=$1`, [userId]);
+    },
+    async markIdentityVerified(identityId, verifiedAt) {
+      await sql.unsafe(`UPDATE auth_identity SET verified_at=$2 WHERE id=$1`, [identityId, verifiedAt]);
+    },
+    async deleteIdentity(identityId, userId) {
+      await sql.unsafe(`DELETE FROM auth_identity WHERE id=$1 AND user_id=$2`, [identityId, userId]);
+    }
+  };
+  const tenants = {
+    async createTenant(input) {
+      return first(await sql.unsafe(`INSERT INTO auth_tenant(id,name,slug,active,created_at) VALUES($1,$2,$3,true,$4) RETURNING id,name,slug,active,created_at AS "createdAt"`, [id(), input.name, input.slug, now()]));
+    },
+    async getTenant(tenantId) {
+      return first(await sql.unsafe(`SELECT id,name,slug,active,created_at AS "createdAt" FROM auth_tenant WHERE id=$1`, [tenantId]));
+    },
+    async getTenantBySlug(slug) {
+      return first(await sql.unsafe(`SELECT id,name,slug,active,created_at AS "createdAt" FROM auth_tenant WHERE slug=$1`, [slug]));
+    },
+    async getMembership(tenantId, userId) {
+      return first(await sql.unsafe(`SELECT id,tenant_id AS "tenantId",user_id AS "userId",role,created_at AS "createdAt" FROM auth_membership WHERE tenant_id=$1 AND user_id=$2`, [tenantId, userId]));
+    },
+    async listMemberships(userId) {
+      return sql.unsafe(`SELECT id,tenant_id AS "tenantId",user_id AS "userId",role,created_at AS "createdAt" FROM auth_membership WHERE user_id=$1`, [userId]);
+    },
+    async listTenantMemberships(tenantId) {
+      return sql.unsafe(`SELECT id,tenant_id AS "tenantId",user_id AS "userId",role,created_at AS "createdAt" FROM auth_membership WHERE tenant_id=$1`, [tenantId]);
+    },
+    async addMembership(input) {
+      return first(await sql.unsafe(`INSERT INTO auth_membership(id,tenant_id,user_id,role,created_at) VALUES($1,$2,$3,$4,$5) RETURNING id,tenant_id AS "tenantId",user_id AS "userId",role,created_at AS "createdAt"`, [id(), input.tenantId, input.userId, input.role, now()]));
+    },
+    async changeMembershipRole(tenantId, userId, role) {
+      await sql.unsafe(`UPDATE auth_membership SET role=$3 WHERE tenant_id=$1 AND user_id=$2`, [tenantId, userId, role]);
+    },
+    async removeMembership(tenantId, userId) {
+      await sql.unsafe(`DELETE FROM auth_membership WHERE tenant_id=$1 AND user_id=$2`, [tenantId, userId]);
+    }
+  };
+  tenants.setMembershipStatus = async (t, u, status, d, reason) => {
+    await sql.unsafe(`UPDATE auth_membership SET status=$3,suspended_at=$4,suspension_reason=$5 WHERE tenant_id=$1 AND user_id=$2`, [t, u, status, d, reason]);
+  };
+  const verifications = {
+    async createChallenge(input) {
+      return first(await sql.unsafe(`INSERT INTO auth_challenge(id,purpose,subject,tenant_id,token_hash,expires_at,attempts,max_attempts,created_at) VALUES($1,$2,$3,$4,$5,$6,0,$7,$8) RETURNING id,purpose,subject,tenant_id AS "tenantId",token_hash AS "tokenHash",expires_at AS "expiresAt",attempts,max_attempts AS "maxAttempts",consumed_at AS "consumedAt",created_at AS "createdAt"`, [id(), input.purpose, input.subject, input.tenantId ?? null, input.tokenHash, input.expiresAt, input.maxAttempts, now()]));
+    },
+    async getChallenge(tokenHash, purpose) {
+      return first(await sql.unsafe(`SELECT id,purpose,subject,tenant_id AS "tenantId",token_hash AS "tokenHash",expires_at AS "expiresAt",attempts,max_attempts AS "maxAttempts",consumed_at AS "consumedAt",created_at AS "createdAt" FROM auth_challenge WHERE token_hash=$1 AND purpose=$2`, [tokenHash, purpose]));
+    },
+    async incrementAttempts(challengeId) {
+      const rows = await sql.unsafe(`UPDATE auth_challenge SET attempts=attempts+1 WHERE id=$1 RETURNING attempts`, [challengeId]);
+      return rows[0]?.attempts ?? 0;
+    },
+    async consumeChallenge(challengeId, consumedAt) {
+      await sql.unsafe(`UPDATE auth_challenge SET consumed_at=$2 WHERE id=$1`, [challengeId, consumedAt]);
+    }
+  };
+  const invitations = {
+    async createInvitation(input) {
+      return first(await sql.unsafe(`INSERT INTO auth_invitation(id,tenant_id,identifier,role,token_hash,expires_at,created_at) VALUES($1,$2,$3,$4,$5,$6,$7) RETURNING id,tenant_id AS "tenantId",identifier,role,token_hash AS "tokenHash",expires_at AS "expiresAt",accepted_at AS "acceptedAt",created_at AS "createdAt"`, [id(), input.tenantId, input.identifier, input.role, input.tokenHash, input.expiresAt, now()]));
+    },
+    async getInvitation(tokenHash) {
+      return first(await sql.unsafe(`SELECT id,tenant_id AS "tenantId",identifier,role,token_hash AS "tokenHash",expires_at AS "expiresAt",accepted_at AS "acceptedAt",created_at AS "createdAt" FROM auth_invitation WHERE token_hash=$1`, [tokenHash]));
+    },
+    async acceptInvitation(invitationId, acceptedAt) {
+      await sql.unsafe(`UPDATE auth_invitation SET accepted_at=$2 WHERE id=$1`, [invitationId, acceptedAt]);
+    },
+    async deleteInvitation(invitationId) {
+      await sql.unsafe(`DELETE FROM auth_invitation WHERE id=$1`, [invitationId]);
+    },
+    async deleteExpiredInvitations(expiry) {
+      const rows = await sql.unsafe(`DELETE FROM auth_invitation WHERE expires_at <= $1 AND accepted_at IS NULL RETURNING id`, [expiry]);
+      return rows.length;
+    }
+  };
+  const atomicAcceptInvitation = sql.begin ? async (input) => sql.begin(async (tx) => {
+    const claimed = await tx.unsafe(`UPDATE auth_invitation SET accepted_at=$2 WHERE id=$1 AND accepted_at IS NULL RETURNING id`, [input.invitationId, input.acceptedAt]);
+    if (!claimed.length) throw new Error("Invitation already accepted");
+    const rows = await tx.unsafe(`INSERT INTO auth_membership(id,tenant_id,user_id,role,created_at) VALUES($1,$2,$3,$4,$5) RETURNING id,tenant_id AS "tenantId",user_id AS "userId",role,created_at AS "createdAt"`, [id(), input.tenantId, input.userId, input.role, now()]);
+    return first(rows);
+  }) : void 0;
+  return { identities, tenants, verifications, invitations, atomicAcceptInvitation };
+}
+
+// src/index.ts
+var postgresMigration = `
+CREATE TABLE IF NOT EXISTS "user" (
+  id text PRIMARY KEY, email text UNIQUE, email_verified boolean NOT NULL DEFAULT false,
+  name text, password_hash text, two_factor_enabled boolean NOT NULL DEFAULT false,
+  created_at timestamptz NOT NULL, updated_at timestamptz NOT NULL
+);
+CREATE TABLE IF NOT EXISTS session (
+  id text PRIMARY KEY, user_id text NOT NULL REFERENCES "user"(id) ON DELETE CASCADE,
+  token_hash text NOT NULL UNIQUE, expires_at timestamptz NOT NULL, created_at timestamptz NOT NULL,
+  ip_address text, user_agent text
+);
+CREATE TABLE IF NOT EXISTS account (
+  id text PRIMARY KEY, user_id text NOT NULL REFERENCES "user"(id) ON DELETE CASCADE,
+  provider_id text NOT NULL, account_id text NOT NULL, created_at timestamptz NOT NULL,
+  UNIQUE(provider_id, account_id)
+);
+CREATE TABLE IF NOT EXISTS verification (
+  id text PRIMARY KEY, identifier text NOT NULL, token_hash text NOT NULL UNIQUE,
+  type text NOT NULL CHECK (type IN ('email-verification', 'password-reset')),
+  expires_at timestamptz NOT NULL, created_at timestamptz NOT NULL
+);
+CREATE TABLE IF NOT EXISTS passkey (
+  id text PRIMARY KEY, user_id text NOT NULL REFERENCES "user"(id) ON DELETE CASCADE,
+  credential_id text NOT NULL UNIQUE, public_key text NOT NULL, counter integer NOT NULL,
+  transports text, device_type text NOT NULL, backed_up boolean NOT NULL, name text,
+  created_at timestamptz NOT NULL, last_used_at timestamptz
+);
+CREATE TABLE IF NOT EXISTS two_factor_secret (
+  id text PRIMARY KEY, user_id text NOT NULL UNIQUE REFERENCES "user"(id) ON DELETE CASCADE,
+  encrypted_secret text NOT NULL, created_at timestamptz NOT NULL
+);
+CREATE TABLE IF NOT EXISTS recovery_code (
+  id text PRIMARY KEY, user_id text NOT NULL REFERENCES "user"(id) ON DELETE CASCADE,
+  code_hash text NOT NULL, used_at timestamptz, created_at timestamptz NOT NULL
+);
+CREATE TABLE IF NOT EXISTS organization (
+  id text PRIMARY KEY, name text NOT NULL, slug text NOT NULL UNIQUE, created_at timestamptz NOT NULL
+);
+CREATE TABLE IF NOT EXISTS organization_member (
+  id text PRIMARY KEY, organization_id text NOT NULL REFERENCES organization(id) ON DELETE CASCADE,
+  user_id text NOT NULL REFERENCES "user"(id) ON DELETE CASCADE,
+  role text NOT NULL CHECK (role IN ('owner', 'admin', 'member')), created_at timestamptz NOT NULL,
+  UNIQUE(organization_id, user_id)
+);
+CREATE INDEX IF NOT EXISTS session_token_hash_idx ON session(token_hash);
+CREATE INDEX IF NOT EXISTS passkey_user_id_idx ON passkey(user_id);
+CREATE TABLE IF NOT EXISTS auth_identity (id text PRIMARY KEY,user_id text NOT NULL REFERENCES "user"(id) ON DELETE CASCADE,kind text NOT NULL,value text NOT NULL,provider text,verified_at timestamptz,created_at timestamptz NOT NULL,UNIQUE(kind,value,provider));
+CREATE TABLE IF NOT EXISTS auth_tenant (id text PRIMARY KEY,name text NOT NULL,slug text NOT NULL UNIQUE,active boolean NOT NULL DEFAULT true,created_at timestamptz NOT NULL);
+CREATE TABLE IF NOT EXISTS auth_membership (id text PRIMARY KEY,tenant_id text NOT NULL REFERENCES auth_tenant(id) ON DELETE CASCADE,user_id text NOT NULL REFERENCES "user"(id) ON DELETE CASCADE,role text NOT NULL,status text NOT NULL DEFAULT 'active',suspended_at timestamptz,suspension_reason text,created_at timestamptz NOT NULL,UNIQUE(tenant_id,user_id));
+CREATE TABLE IF NOT EXISTS auth_challenge (id text PRIMARY KEY,purpose text NOT NULL,subject text NOT NULL,tenant_id text REFERENCES auth_tenant(id) ON DELETE CASCADE,token_hash text NOT NULL UNIQUE,expires_at timestamptz NOT NULL,attempts integer NOT NULL DEFAULT 0,max_attempts integer NOT NULL,consumed_at timestamptz,created_at timestamptz NOT NULL);
+CREATE TABLE IF NOT EXISTS auth_invitation (id text PRIMARY KEY,tenant_id text NOT NULL REFERENCES auth_tenant(id) ON DELETE CASCADE,identifier text NOT NULL,role text NOT NULL,token_hash text NOT NULL UNIQUE,expires_at timestamptz NOT NULL,accepted_at timestamptz,created_at timestamptz NOT NULL);
+`;
+var postgresNullableEmailMigration = `ALTER TABLE "user" ALTER COLUMN email DROP NOT NULL;`;
+var id2 = () => crypto.randomUUID();
+var now2 = () => /* @__PURE__ */ new Date();
+var first2 = (rows) => rows[0] ?? null;
+function createPostgresAdapter(sql) {
+  return {
+    async createUser(input) {
+      return first2(await sql.unsafe(`INSERT INTO "user" (id,email,password_hash,name,email_verified,created_at,updated_at) VALUES ($1,$2,$3,$4,$5,$6,$6) RETURNING id,email,password_hash,name,email_verified AS "emailVerified",two_factor_enabled AS "twoFactorEnabled",created_at AS "createdAt",updated_at AS "updatedAt"`, [id2(), input.email, input.passwordHash, input.name, input.emailVerified ?? false, now2()]));
+    },
+    async getUserByEmail(email) {
+      return first2(await sql.unsafe(`SELECT id,email,password_hash AS "passwordHash",name,email_verified AS "emailVerified",two_factor_enabled AS "twoFactorEnabled",created_at AS "createdAt",updated_at AS "updatedAt" FROM "user" WHERE email=$1 LIMIT 1`, [email]));
+    },
+    async getUserById(userId) {
+      return first2(await sql.unsafe(`SELECT id,email,password_hash AS "passwordHash",name,email_verified AS "emailVerified",two_factor_enabled AS "twoFactorEnabled",created_at AS "createdAt",updated_at AS "updatedAt" FROM "user" WHERE id=$1 LIMIT 1`, [userId]));
+    },
+    async markEmailVerified(userId) {
+      await sql.unsafe(`UPDATE "user" SET email_verified=true,updated_at=$2 WHERE id=$1`, [userId, now2()]);
+    },
+    async updateUserPassword(userId, passwordHash) {
+      await sql.unsafe(`UPDATE "user" SET password_hash=$2,updated_at=$3 WHERE id=$1`, [userId, passwordHash, now2()]);
+    },
+    async linkAccount(input) {
+      await sql.unsafe(`INSERT INTO account(id,user_id,provider_id,account_id,created_at) VALUES($1,$2,$3,$4,$5)`, [id2(), input.userId, input.providerId, input.accountId, now2()]);
+    },
+    async getAccountByProvider(providerId, accountId) {
+      return first2(await sql.unsafe(`SELECT id,user_id AS "userId",provider_id AS "providerId",account_id AS "accountId",created_at AS "createdAt" FROM account WHERE provider_id=$1 AND account_id=$2 LIMIT 1`, [providerId, accountId]));
+    },
+    async createSession(input) {
+      return first2(await sql.unsafe(`INSERT INTO session(id,user_id,token_hash,expires_at,created_at,ip_address,user_agent) VALUES($1,$2,$3,$4,$5,$6,$7) RETURNING id,user_id AS "userId",token_hash AS "tokenHash",expires_at AS "expiresAt",created_at AS "createdAt",ip_address AS "ipAddress",user_agent AS "userAgent"`, [input.id, input.userId, input.tokenHash, input.expiresAt, now2(), input.ipAddress, input.userAgent]));
+    },
+    async getSessionWithUser(tokenHash) {
+      return first2(await sql.unsafe(`SELECT json_build_object('id',s.id,'userId',s.user_id,'tokenHash',s.token_hash,'expiresAt',s.expires_at,'createdAt',s.created_at,'ipAddress',s.ip_address,'userAgent',s.user_agent) AS session,json_build_object('id',u.id,'email',u.email,'passwordHash',u.password_hash,'name',u.name,'emailVerified',u.email_verified,'twoFactorEnabled',u.two_factor_enabled,'createdAt',u.created_at,'updatedAt',u.updated_at) AS user FROM session s JOIN "user" u ON u.id=s.user_id WHERE s.token_hash=$1 LIMIT 1`, [tokenHash]));
+    },
+    async listUserSessions(userId, now3 = /* @__PURE__ */ new Date()) {
+      return sql.unsafe(`SELECT id,user_id AS "userId",token_hash AS "tokenHash",expires_at AS "expiresAt",created_at AS "createdAt",ip_address AS "ipAddress",user_agent AS "userAgent" FROM session WHERE user_id=$1 AND expires_at>$2 ORDER BY created_at DESC`, [userId, now3]);
+    },
+    async deleteSession(sessionId) {
+      await sql.unsafe(`DELETE FROM session WHERE id=$1`, [sessionId]);
+    },
+    async deleteAllUserSessions(userId) {
+      await sql.unsafe(`DELETE FROM session WHERE user_id=$1`, [userId]);
+    },
+    async createVerification(input) {
+      return first2(await sql.unsafe(`INSERT INTO verification(id,identifier,token_hash,type,expires_at,created_at) VALUES($1,$2,$3,$4,$5,$6) RETURNING id,identifier,token_hash AS "tokenHash",type,expires_at AS "expiresAt",created_at AS "createdAt"`, [id2(), input.identifier, input.tokenHash, input.type, input.expiresAt, now2()]));
+    },
+    async getVerification(tokenHash, type) {
+      return first2(await sql.unsafe(`SELECT id,identifier,token_hash AS "tokenHash",type,expires_at AS "expiresAt",created_at AS "createdAt" FROM verification WHERE token_hash=$1 AND type=$2 LIMIT 1`, [tokenHash, type]));
+    },
+    async deleteVerification(verificationId) {
+      await sql.unsafe(`DELETE FROM verification WHERE id=$1`, [verificationId]);
+    },
+    async createPasskey(input) {
+      return first2(await sql.unsafe(`INSERT INTO passkey(id,user_id,credential_id,public_key,counter,transports,device_type,backed_up,name,created_at) VALUES($1,$2,$3,$4,$5,$6,$7,$8,$9,$10) RETURNING id,user_id AS "userId",credential_id AS "credentialId",public_key AS "publicKey",counter,transports,device_type AS "deviceType",backed_up AS "backedUp",name,created_at AS "createdAt",last_used_at AS "lastUsedAt"`, [id2(), input.userId, input.credentialId, input.publicKey, input.counter, input.transports, input.deviceType, input.backedUp, input.name, now2()]));
+    },
+    async getPasskeyByCredentialId(credentialId) {
+      return first2(await sql.unsafe(`SELECT id,user_id AS "userId",credential_id AS "credentialId",public_key AS "publicKey",counter,transports,device_type AS "deviceType",backed_up AS "backedUp",name,created_at AS "createdAt",last_used_at AS "lastUsedAt" FROM passkey WHERE credential_id=$1 LIMIT 1`, [credentialId]));
+    },
+    async getPasskeysByUserId(userId) {
+      return sql.unsafe(`SELECT id,user_id AS "userId",credential_id AS "credentialId",public_key AS "publicKey",counter,transports,device_type AS "deviceType",backed_up AS "backedUp",name,created_at AS "createdAt",last_used_at AS "lastUsedAt" FROM passkey WHERE user_id=$1`, [userId]);
+    },
+    async updatePasskeyCounter(passkeyId, counter) {
+      await sql.unsafe(`UPDATE passkey SET counter=$2,last_used_at=$3 WHERE id=$1`, [passkeyId, counter, now2()]);
+    },
+    async deletePasskey(passkeyId, userId) {
+      await sql.unsafe(`DELETE FROM passkey WHERE id=$1 AND user_id=$2`, [passkeyId, userId]);
+    },
+    async setTwoFactorSecret(userId, encryptedSecret) {
+      await sql.unsafe(`INSERT INTO two_factor_secret(id,user_id,encrypted_secret,created_at) VALUES($1,$2,$3,$4) ON CONFLICT(user_id) DO UPDATE SET encrypted_secret=EXCLUDED.encrypted_secret,created_at=EXCLUDED.created_at`, [id2(), userId, encryptedSecret, now2()]);
+    },
+    async getTwoFactorSecret(userId) {
+      return first2(await sql.unsafe(`SELECT id,user_id AS "userId",encrypted_secret AS "encryptedSecret",created_at AS "createdAt" FROM two_factor_secret WHERE user_id=$1 LIMIT 1`, [userId]));
+    },
+    async deleteTwoFactorSecret(userId) {
+      await sql.unsafe(`DELETE FROM two_factor_secret WHERE user_id=$1`, [userId]);
+    },
+    async setTwoFactorEnabled(userId, enabled) {
+      await sql.unsafe(`UPDATE "user" SET two_factor_enabled=$2,updated_at=$3 WHERE id=$1`, [userId, enabled, now2()]);
+    },
+    async createRecoveryCodes(userId, codeHashes) {
+      if (codeHashes.length) await Promise.all(codeHashes.map((codeHash) => sql.unsafe(`INSERT INTO recovery_code(id,user_id,code_hash,created_at) VALUES($1,$2,$3,$4)`, [id2(), userId, codeHash, now2()])));
+    },
+    async getUnusedRecoveryCode(userId, codeHash) {
+      return first2(await sql.unsafe(`SELECT id,user_id AS "userId",code_hash AS "codeHash",used_at AS "usedAt",created_at AS "createdAt" FROM recovery_code WHERE user_id=$1 AND code_hash=$2 AND used_at IS NULL LIMIT 1`, [userId, codeHash]));
+    },
+    async markRecoveryCodeUsed(codeId) {
+      await sql.unsafe(`UPDATE recovery_code SET used_at=$2 WHERE id=$1`, [codeId, now2()]);
+    },
+    async deleteRecoveryCodes(userId) {
+      await sql.unsafe(`DELETE FROM recovery_code WHERE user_id=$1`, [userId]);
+    },
+    async createOrganization(input) {
+      const org = first2(await sql.unsafe(`INSERT INTO organization(id,name,slug,created_at) VALUES($1,$2,$3,$4) RETURNING id,name,slug,created_at AS "createdAt"`, [id2(), input.name, input.slug, now2()]));
+      await sql.unsafe(`INSERT INTO organization_member(id,organization_id,user_id,role,created_at) VALUES($1,$2,$3,'owner',$4)`, [id2(), org.id, input.ownerId, now2()]);
+      return org;
+    },
+    async getOrganizationById(orgId) {
+      return first2(await sql.unsafe(`SELECT id,name,slug,created_at AS "createdAt" FROM organization WHERE id=$1 LIMIT 1`, [orgId]));
+    },
+    async getOrganizationBySlug(slug) {
+      return first2(await sql.unsafe(`SELECT id,name,slug,created_at AS "createdAt" FROM organization WHERE slug=$1 LIMIT 1`, [slug]));
+    },
+    async getOrganizationsForUser(userId) {
+      return sql.unsafe(`SELECT json_build_object('id',o.id,'name',o.name,'slug',o.slug,'createdAt',o.created_at) AS organization,m.role FROM organization_member m JOIN organization o ON o.id=m.organization_id WHERE m.user_id=$1`, [userId]);
+    },
+    async addOrganizationMember(input) {
+      return first2(await sql.unsafe(`INSERT INTO organization_member(id,organization_id,user_id,role,created_at) VALUES($1,$2,$3,$4,$5) RETURNING id,organization_id AS "organizationId",user_id AS "userId",role,created_at AS "createdAt"`, [id2(), input.organizationId, input.userId, input.role, now2()]));
+    },
+    async getOrganizationMember(organizationId, userId) {
+      return first2(await sql.unsafe(`SELECT id,organization_id AS "organizationId",user_id AS "userId",role,created_at AS "createdAt" FROM organization_member WHERE organization_id=$1 AND user_id=$2 LIMIT 1`, [organizationId, userId]));
+    },
+    async getOrganizationMembers(organizationId) {
+      return sql.unsafe(`SELECT json_build_object('id',m.id,'organizationId',m.organization_id,'userId',m.user_id,'role',m.role,'createdAt',m.created_at) AS member,json_build_object('id',u.id,'email',u.email,'passwordHash',u.password_hash,'name',u.name,'emailVerified',u.email_verified,'twoFactorEnabled',u.two_factor_enabled,'createdAt',u.created_at,'updatedAt',u.updated_at) AS user FROM organization_member m JOIN "user" u ON u.id=m.user_id WHERE m.organization_id=$1`, [organizationId]);
+    },
+    async updateOrganizationMemberRole(organizationId, userId, role) {
+      await sql.unsafe(`UPDATE organization_member SET role=$3 WHERE organization_id=$1 AND user_id=$2`, [organizationId, userId, role]);
+    },
+    async removeOrganizationMember(organizationId, userId) {
+      await sql.unsafe(`DELETE FROM organization_member WHERE organization_id=$1 AND user_id=$2`, [organizationId, userId]);
+    },
+    async countOrganizationOwners(organizationId) {
+      const rows = await sql.unsafe(`SELECT count(*)::text AS count FROM organization_member WHERE organization_id=$1 AND role='owner'`, [organizationId]);
+      return Number(rows[0]?.count ?? 0);
+    }
+  };
+}
+function createPostgresAuth(config) {
+  const { sql, domain, ...authConfig } = config;
+  return createAuth({ ...authConfig, adapter: createPostgresAdapter(sql), domain: { ...domain, repositories: domain?.repositories ?? createPostgresDomainRepositories(sql) } });
+}
+export {
+  createPostgresAdapter,
+  createPostgresAuth,
+  createPostgresDomainRepositories,
+  postgresMigration,
+  postgresNullableEmailMigration
+};

package/package.json

@@ -1,6 +1,35 @@
-{
-  "name": "@eyoben/auth-postgres",
-  "version": "0.0.0-stage",
-  "stub": true,
-  "description": "Temporary package placeholder for staged publishing"
-}
+{
+  "name": "@eyoben/auth-postgres",
+  "version": "1.0.0",
+  "description": "PostgreSQL and Neon storage adapter for @eyoben/auth.",
+  "license": "MIT",
+  "type": "module",
+  "main": "./dist/index.js",
+  "module": "./dist/index.js",
+  "types": "./dist/index.d.ts",
+  "exports": {
+    ".": {
+      "types": "./dist/index.d.ts",
+      "import": "./dist/index.js"
+    }
+  },
+  "files": [
+    "dist",
+    "README.md",
+    "LICENSE"
+  ],
+  "scripts": {
+    "build": "tsup",
+    "pretest": "npm run build --workspace=@eyoben/auth",
+    "test": "vitest run",
+    "test:live": "vitest run src/live.test.ts",
+    "typecheck": "tsc --noEmit -p tsconfig.json"
+  },
+  "publishConfig": {
+    "access": "public"
+  },
+  "peerDependencies": {
+    "@eyoben/auth": ">=0.3.0",
+    "postgres": ">=3.4.0"
+  }
+}