@facilis.dev/auth 0.0.0-stage → 0.1.1

package/dist/sso/saml.d.ts

@@ -0,0 +1,44 @@
+import type { SamlConfig } from "@node-saml/node-saml";
+import type { IdentityClaims } from "./contracts.js";
+import type { SamlProviderConfig } from "./providers.js";
+export interface BuiltSamlRequest {
+    readonly requestId: string;
+    readonly redirectUrl: string;
+}
+/** The AuthnRequest XML (exported for tests; the IdP only ever sees the DEFLATE+base64 form). */
+export declare function buildAuthnRequestXml(provider: SamlProviderConfig, requestId: string, acsUrl: string, issueInstant: string): string;
+/** Builds the HTTP-Redirect URL carrying the deflated AuthnRequest and the RelayState. */
+export declare function buildSamlRedirect(provider: SamlProviderConfig, acsUrl: string, relayState: string, now?: number): Promise<BuiltSamlRequest>;
+export interface SamlProfileLike {
+    readonly nameID?: unknown;
+    readonly issuer?: unknown;
+    [attribute: string]: unknown;
+}
+export interface SamlValidator {
+    validatePostResponseAsync(container: Record<string, string>): Promise<{
+        profile: SamlProfileLike | null;
+        loggedOut: boolean;
+    }>;
+}
+export type SamlValidatorFactory = (config: SamlConfig) => SamlValidator | Promise<SamlValidator>;
+export interface ValidateSamlInput {
+    readonly provider: SamlProviderConfig;
+    /** The IdP signing certificate (PEM or base64 DER). Never logged. */
+    readonly certificate: string;
+    readonly callbackUrl: string;
+    /** The base64 `SAMLResponse` form field. */
+    readonly samlResponse: string;
+    /** The AuthnRequest id stored in the consumed state row. */
+    readonly requestId: string | null;
+    /** Test seam: replace the lazily imported validator. */
+    readonly validatorFactory?: SamlValidatorFactory;
+}
+/**
+ * Validates an ACS POST and returns the asserted identity.
+ *
+ * Signature, recipient, audience and time-window checks are node-saml's; a rejected response
+ * (unsigned, tampered, wrong recipient/audience, expired) becomes `sso_exchange_failed`, never
+ * a library message. A signed assertion is the IdP asserting the email, so SAML has no separate
+ * `email_verified` flag and treats the address as verified.
+ */
+export declare function validateSamlResponse(input: ValidateSamlInput): Promise<IdentityClaims>;

package/dist/sso/saml.js

@@ -0,0 +1,159 @@
+import { encodeBase64 } from "../crypto.js";
+import { SsoError } from "./errors.js";
+/**
+ * SAML 2.0 SP-initiated Web Browser SSO (D-120).
+ *
+ * The AuthnRequest is built here (HTTP-Redirect, DEFLATE+base64) so the framework owns the
+ * request id, the ACS URL and the RelayState. ACS validation is delegated to
+ * `@node-saml/node-saml`, imported LAZILY inside this path: a project without SAML never loads
+ * (or bundles) its CJS crypto tree. IdP-initiated assertions are not accepted: there is no
+ * unsolicited-response surface, and the single-use RelayState is mandatory.
+ */
+const CLOCK_SKEW_MS = 5000;
+const NAME_ID_FORMAT = "urn:oasis:names:tc:SAML:1.1:nameid-format:emailAddress";
+const PROTOCOL_BINDING_POST = "urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST";
+const EMAIL_PATTERN = /^[^\s@]+@[^\s@]+$/;
+function escapeXml(value) {
+    return value
+        .replaceAll("&", "&")
+        .replaceAll("<", "&lt;")
+        .replaceAll(">", "&gt;")
+        .replaceAll('"', "&quot;")
+        .replaceAll("'", "&apos;");
+}
+/** The AuthnRequest XML (exported for tests; the IdP only ever sees the DEFLATE+base64 form). */
+export function buildAuthnRequestXml(provider, requestId, acsUrl, issueInstant) {
+    return (`<samlp:AuthnRequest xmlns:samlp="urn:oasis:names:tc:SAML:2.0:protocol" ` +
+        `xmlns:saml="urn:oasis:names:tc:SAML:2.0:assertion" ID="${escapeXml(requestId)}" ` +
+        `Version="2.0" IssueInstant="${issueInstant}" Destination="${escapeXml(provider.entryPoint)}" ` +
+        `AssertionConsumerServiceURL="${escapeXml(acsUrl)}" ProtocolBinding="${PROTOCOL_BINDING_POST}">` +
+        `<saml:Issuer>${escapeXml(provider.issuer)}</saml:Issuer>` +
+        `<samlp:NameIDPolicy AllowCreate="true" Format="${NAME_ID_FORMAT}"/>` +
+        `</samlp:AuthnRequest>`);
+}
+async function deflateRaw(bytes) {
+    // node:zlib is a server-only builtin and is loaded with the SAML path, never at module load.
+    const { deflateRawSync } = await import("node:zlib");
+    return new Uint8Array(deflateRawSync(bytes));
+}
+/** Builds the HTTP-Redirect URL carrying the deflated AuthnRequest and the RelayState. */
+export async function buildSamlRedirect(provider, acsUrl, relayState, now = Date.now()) {
+    const requestId = `_${globalThis.crypto.randomUUID()}`;
+    const xml = buildAuthnRequestXml(provider, requestId, acsUrl, new Date(now).toISOString());
+    const compressed = await deflateRaw(new TextEncoder().encode(xml));
+    const url = new URL(provider.entryPoint);
+    url.searchParams.set("SAMLRequest", encodeBase64(compressed));
+    url.searchParams.set("RelayState", relayState);
+    return { requestId, redirectUrl: url.toString() };
+}
+/**
+ * A cache provider whose only entry is the request id of THIS attempt.
+ *
+ * `validateInResponseTo: "always"` (D-147) requires the response to carry the InResponseTo of the
+ * AuthnRequest this framework issued and to match the single-use state row; a response without
+ * it (IdP-initiated / unsolicited, or a replayed assertion) is rejected by node-saml.
+ */
+function singleUseRequestCache(requestId) {
+    let remaining = requestId;
+    const take = async (key) => {
+        if (key === null || remaining === null || key !== remaining)
+            return null;
+        const value = remaining;
+        remaining = null;
+        return value;
+    };
+    return {
+        async saveAsync() {
+            return null;
+        },
+        async getAsync(key) {
+            return key === remaining ? remaining : null;
+        },
+        async removeAsync(key) {
+            return take(key);
+        },
+        async consumeAsync(key) {
+            return take(key);
+        },
+        async saveIfAbsentAsync() {
+            return false;
+        },
+    };
+}
+function toSamlConfig(provider, certificate, callbackUrl, requestId) {
+    return {
+        callbackUrl,
+        entryPoint: provider.entryPoint,
+        issuer: provider.issuer,
+        audience: provider.issuer,
+        idpCert: certificate,
+        wantAssertionsSigned: provider.wantAssertionsSigned,
+        wantAuthnResponseSigned: provider.wantResponseSigned,
+        acceptedClockSkewMs: CLOCK_SKEW_MS,
+        // The library's enum is a runtime value; the string literal is the same member.
+        validateInResponseTo: "always",
+        cacheProvider: singleUseRequestCache(requestId),
+    };
+}
+async function defaultSamlFactory(config) {
+    const { SAML } = await import("@node-saml/node-saml");
+    return new SAML(config);
+}
+function asString(value) {
+    if (typeof value === "string" && value.trim().length > 0)
+        return value;
+    if (Array.isArray(value)) {
+        const first = value.find((entry) => typeof entry === "string" && entry.length > 0);
+        return typeof first === "string" ? first : undefined;
+    }
+    return undefined;
+}
+/** Case-insensitive attribute lookup; `nameid` means the NameID itself. */
+function readAttribute(profile, attribute) {
+    const wanted = attribute.toLowerCase();
+    if (wanted === "nameid")
+        return asString(profile.nameID);
+    for (const [key, value] of Object.entries(profile)) {
+        if (key.toLowerCase() !== wanted)
+            continue;
+        const found = asString(value);
+        if (found !== undefined)
+            return found;
+    }
+    for (const fallback of ["email", "mail", "emailaddress"]) {
+        const found = asString(profile[fallback]);
+        if (found !== undefined)
+            return found;
+    }
+    return undefined;
+}
+/**
+ * Validates an ACS POST and returns the asserted identity.
+ *
+ * Signature, recipient, audience and time-window checks are node-saml's; a rejected response
+ * (unsigned, tampered, wrong recipient/audience, expired) becomes `sso_exchange_failed`, never
+ * a library message. A signed assertion is the IdP asserting the email, so SAML has no separate
+ * `email_verified` flag and treats the address as verified.
+ */
+export async function validateSamlResponse(input) {
+    const config = toSamlConfig(input.provider, input.certificate, input.callbackUrl, input.requestId);
+    const factory = input.validatorFactory ?? defaultSamlFactory;
+    let result;
+    try {
+        const validator = await factory(config);
+        result = await validator.validatePostResponseAsync({ SAMLResponse: input.samlResponse });
+    }
+    catch (error) {
+        throw new SsoError("sso_exchange_failed", "SAML response rejected", { cause: error });
+    }
+    if (result.profile === null || result.loggedOut) {
+        throw new SsoError("sso_exchange_failed", "SAML response has no assertion");
+    }
+    const profile = result.profile;
+    const email = readAttribute(profile, input.provider.emailAttribute);
+    if (email === undefined || !EMAIL_PATTERN.test(email)) {
+        throw new SsoError("sso_identity_invalid", "SAML assertion has no email");
+    }
+    const subject = asString(profile.nameID) ?? email;
+    return { provider: input.provider.id, subject, email, emailVerified: true };
+}

package/dist/sso/state.d.ts

@@ -0,0 +1,34 @@
+import type { SystemRunner } from "./contracts.js";
+import { type AuthSsoStateRow } from "./tables.js";
+/** Contract cap on the post-login path (same-origin only; D-120). */
+export declare const MAX_REDIRECT_TO = 2048;
+/**
+ * Validates a post-login redirect: a same-origin absolute path only.
+ *
+ * Rejecting `//host`, a backslash and control characters closes the open-redirect hole: the value
+ * becomes the `Location` of a 302 and the user must never leave the application origin.
+ */
+export declare function normalizeRedirectTo(value: unknown): string | null;
+export interface CreateSsoStateInput {
+    /** Explicit token (SAML builds the AuthnRequest, whose RelayState is the state, before insert). */
+    readonly state?: string;
+    readonly provider: string;
+    /** `auth.sso.stateTtlMs`. */
+    readonly ttlMs: number;
+    readonly redirectTo: string | null;
+    readonly nonce?: string;
+    readonly codeVerifier?: string;
+    readonly requestId?: string;
+}
+/**
+ * Creates one single-use state row (32 random bytes, base64url) inside the audited system
+ * elevation. Expired rows are pruned on the same write, so a start request also cleans up.
+ */
+export declare function createSsoState(system: SystemRunner, input: CreateSsoStateInput, now?: number): Promise<AuthSsoStateRow>;
+/**
+ * Consumes a state row atomically (`DELETE ... RETURNING`) and returns it once.
+ *
+ * A missing row (already used, unknown, or never issued) and an expired row are both
+ * `sso_state_invalid`: the caller only learns "this attempt is not valid".
+ */
+export declare function consumeSsoState(system: SystemRunner, state: string, now?: number): Promise<AuthSsoStateRow>;

package/dist/sso/state.js

@@ -0,0 +1,91 @@
+import { eq, lt } from "drizzle-orm";
+import { randomToken } from "../crypto.js";
+import { SsoError } from "./errors.js";
+import { authSsoStates } from "./tables.js";
+/** Contract cap on the post-login path (same-origin only; D-120). */
+export const MAX_REDIRECT_TO = 2048;
+const STATE_TOKEN_PATTERN = /^[A-Za-z0-9_-]{20,256}$/;
+const STATE_TABLES = ["auth_sso_states"];
+/**
+ * Validates a post-login redirect: a same-origin absolute path only.
+ *
+ * Rejecting `//host`, a backslash and control characters closes the open-redirect hole: the value
+ * becomes the `Location` of a 302 and the user must never leave the application origin.
+ */
+export function normalizeRedirectTo(value) {
+    if (typeof value !== "string" || value.length === 0 || value.length > MAX_REDIRECT_TO)
+        return null;
+    if (!value.startsWith("/") || value.startsWith("//"))
+        return null;
+    if (value.includes("\\"))
+        return null;
+    // Whitespace and control characters have no business in an origin-relative path; browsers
+    // trim some of them, so refuse instead of relying on normalisation.
+    for (const character of value) {
+        const code = character.codePointAt(0) ?? 0;
+        if (code <= 0x20 || code === 0x7f)
+            return null;
+    }
+    return value;
+}
+function stateElevation(operation) {
+    return {
+        actor: "system:auth:sso",
+        operation,
+        reason: "The SSO login attempt is framework-owned state written before a session exists.",
+        tables: STATE_TABLES,
+    };
+}
+/**
+ * Creates one single-use state row (32 random bytes, base64url) inside the audited system
+ * elevation. Expired rows are pruned on the same write, so a start request also cleans up.
+ */
+export async function createSsoState(system, input, now = Date.now()) {
+    const state = input.state ?? randomToken(32);
+    if (!STATE_TOKEN_PATTERN.test(state))
+        throw new SsoError("sso_internal_error", "bad state token");
+    const createdAt = new Date(now);
+    const expiresAt = new Date(now + input.ttlMs);
+    const row = await system(stateElevation("auth:sso:state:create"), async (db) => {
+        await db.delete(authSsoStates).where(lt(authSsoStates.expiresAt, createdAt));
+        const inserted = await db
+            .insert(authSsoStates)
+            .values({
+            state,
+            provider: input.provider,
+            nonce: input.nonce ?? null,
+            codeVerifier: input.codeVerifier ?? null,
+            requestId: input.requestId ?? null,
+            redirectTo: input.redirectTo,
+            createdAt,
+            expiresAt,
+        })
+            .returning();
+        return inserted[0] ?? null;
+    });
+    if (row === null)
+        throw new SsoError("sso_internal_error");
+    return row;
+}
+/**
+ * Consumes a state row atomically (`DELETE ... RETURNING`) and returns it once.
+ *
+ * A missing row (already used, unknown, or never issued) and an expired row are both
+ * `sso_state_invalid`: the caller only learns "this attempt is not valid".
+ */
+export async function consumeSsoState(system, state, now = Date.now()) {
+    if (!STATE_TOKEN_PATTERN.test(state))
+        throw new SsoError("sso_state_invalid");
+    const row = await system(stateElevation("auth:sso:state:consume"), async (db) => {
+        const deleted = await db
+            .delete(authSsoStates)
+            .where(eq(authSsoStates.state, state))
+            .returning();
+        return deleted[0] ?? null;
+    });
+    if (row === null)
+        throw new SsoError("sso_state_invalid");
+    if (row.expiresAt.getTime() <= now)
+        throw new SsoError("sso_state_invalid");
+    return row;
+}

package/dist/sso/tables.d.ts

@@ -0,0 +1,306 @@
+/**
+ * SSO identity links (D-120, SPEC §5.3): one row per `(provider, subject)` pair.
+ *
+ * The identity key is the IdP's stable subject, never the email: a user who changes their email
+ * at the IdP keeps the link. `email` is the address reported at the last sign-in, for operators.
+ *
+ * RLS matches `users`: restrictive tenant isolation AND-ed with a permissive "tenant scope
+ * present" policy, because Postgres denies by default when no permissive policy applies.
+ */
+export declare const authIdentities: Omit<import("drizzle-orm/pg-core").PgTableWithColumns<{
+    name: "auth_identities";
+    schema: undefined;
+    columns: {
+        provider: import("drizzle-orm/pg-core").PgColumn<{
+            name: "provider";
+            tableName: "auth_identities";
+            dataType: "string";
+            columnType: "PgText";
+            data: string;
+            driverParam: string;
+            notNull: true;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: [string, ...string[]];
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {}>;
+        subject: import("drizzle-orm/pg-core").PgColumn<{
+            name: "subject";
+            tableName: "auth_identities";
+            dataType: "string";
+            columnType: "PgText";
+            data: string;
+            driverParam: string;
+            notNull: true;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: [string, ...string[]];
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {}>;
+        userId: import("drizzle-orm/pg-core").PgColumn<{
+            name: "user_id";
+            tableName: "auth_identities";
+            dataType: "string";
+            columnType: "PgUUID";
+            data: string;
+            driverParam: string;
+            notNull: true;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: undefined;
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {}>;
+        email: import("drizzle-orm/pg-core").PgColumn<{
+            name: "email";
+            tableName: "auth_identities";
+            dataType: "string";
+            columnType: "PgText";
+            data: string;
+            driverParam: string;
+            notNull: true;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: [string, ...string[]];
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {}>;
+        tenantId: import("drizzle-orm/pg-core").PgColumn<{
+            name: string;
+            tableName: "auth_identities";
+            dataType: "string";
+            columnType: "PgUUID";
+            data: string;
+            driverParam: string;
+            notNull: true;
+            hasDefault: true;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: undefined;
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {}>;
+        createdAt: import("drizzle-orm/pg-core").PgColumn<{
+            name: "created_at";
+            tableName: "auth_identities";
+            dataType: "date";
+            columnType: "PgTimestamp";
+            data: Date;
+            driverParam: string;
+            notNull: true;
+            hasDefault: true;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: undefined;
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {}>;
+        lastLoginAt: import("drizzle-orm/pg-core").PgColumn<{
+            name: "last_login_at";
+            tableName: "auth_identities";
+            dataType: "date";
+            columnType: "PgTimestamp";
+            data: Date;
+            driverParam: string;
+            notNull: true;
+            hasDefault: true;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: undefined;
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {}>;
+    };
+    dialect: 'pg';
+}>, "enableRLS">;
+/**
+ * One SSO login attempt (D-120): single-use state plus whatever the protocol needs to finish
+ * (`nonce`/`code_verifier` for OIDC, `request_id` for SAML, `redirect_to` for the browser).
+ *
+ * The row is written and consumed inside the audited `ctx.system` elevation, so RLS is not the
+ * load-bearing check here, but every scoped table ships the standard policies (SPEC §8.3).
+ */
+export declare const authSsoStates: Omit<import("drizzle-orm/pg-core").PgTableWithColumns<{
+    name: "auth_sso_states";
+    schema: undefined;
+    columns: {
+        state: import("drizzle-orm/pg-core").PgColumn<{
+            name: "state";
+            tableName: "auth_sso_states";
+            dataType: "string";
+            columnType: "PgText";
+            data: string;
+            driverParam: string;
+            notNull: true;
+            hasDefault: false;
+            isPrimaryKey: true;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: [string, ...string[]];
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {}>;
+        provider: import("drizzle-orm/pg-core").PgColumn<{
+            name: "provider";
+            tableName: "auth_sso_states";
+            dataType: "string";
+            columnType: "PgText";
+            data: string;
+            driverParam: string;
+            notNull: true;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: [string, ...string[]];
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {}>;
+        nonce: import("drizzle-orm/pg-core").PgColumn<{
+            name: "nonce";
+            tableName: "auth_sso_states";
+            dataType: "string";
+            columnType: "PgText";
+            data: string;
+            driverParam: string;
+            notNull: false;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: [string, ...string[]];
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {}>;
+        codeVerifier: import("drizzle-orm/pg-core").PgColumn<{
+            name: "code_verifier";
+            tableName: "auth_sso_states";
+            dataType: "string";
+            columnType: "PgText";
+            data: string;
+            driverParam: string;
+            notNull: false;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: [string, ...string[]];
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {}>;
+        requestId: import("drizzle-orm/pg-core").PgColumn<{
+            name: "request_id";
+            tableName: "auth_sso_states";
+            dataType: "string";
+            columnType: "PgText";
+            data: string;
+            driverParam: string;
+            notNull: false;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: [string, ...string[]];
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {}>;
+        redirectTo: import("drizzle-orm/pg-core").PgColumn<{
+            name: "redirect_to";
+            tableName: "auth_sso_states";
+            dataType: "string";
+            columnType: "PgText";
+            data: string;
+            driverParam: string;
+            notNull: false;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: [string, ...string[]];
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {}>;
+        createdAt: import("drizzle-orm/pg-core").PgColumn<{
+            name: "created_at";
+            tableName: "auth_sso_states";
+            dataType: "date";
+            columnType: "PgTimestamp";
+            data: Date;
+            driverParam: string;
+            notNull: true;
+            hasDefault: true;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: undefined;
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {}>;
+        expiresAt: import("drizzle-orm/pg-core").PgColumn<{
+            name: "expires_at";
+            tableName: "auth_sso_states";
+            dataType: "date";
+            columnType: "PgTimestamp";
+            data: Date;
+            driverParam: string;
+            notNull: true;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: undefined;
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {}>;
+        tenantId: import("drizzle-orm/pg-core").PgColumn<{
+            name: string;
+            tableName: "auth_sso_states";
+            dataType: "string";
+            columnType: "PgUUID";
+            data: string;
+            driverParam: string;
+            notNull: true;
+            hasDefault: true;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: undefined;
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {}>;
+    };
+    dialect: 'pg';
+}>, "enableRLS">;
+export type AuthIdentityRow = typeof authIdentities.$inferSelect;
+export type NewAuthIdentityRow = typeof authIdentities.$inferInsert;
+export type AuthSsoStateRow = typeof authSsoStates.$inferSelect;
+export type NewAuthSsoStateRow = typeof authSsoStates.$inferInsert;