@happyvertical/smrt-users 0.51.32 → 0.51.33

package/dist/__tests__/helpers/oidc-test-server.d.ts

@@ -0,0 +1,45 @@
+/**
+ * Shared OIDC test-IdP harness: a real HTTP server implementing discovery,
+ * JWKS, token, and userinfo endpoints with jose-signed ID tokens. Extracted
+ * from oidc-login-service.test.ts so the mobile handler suite (issue #1748)
+ * exercises the same provider-generic PKCE surface instead of inventing a
+ * second mock.
+ */
+import { type DatabaseInterface } from '@happyvertical/smrt-core/migrations';
+export interface OidcTestServerOptions {
+    authorizationResponseIssuerSupported?: boolean;
+    audience?: string | string[];
+    authorizedParty?: string;
+    idTokenEmailVerified?: boolean;
+    includeEmailInIdToken?: boolean;
+    userInfoEmailVerified?: boolean;
+}
+export interface OidcTestServer {
+    close: () => Promise<void>;
+    issuer: string;
+    /** Nonce stamped into subsequently issued ID tokens. */
+    setNonce: (value: string) => void;
+    tokenRequests: Array<{
+        authorization?: string;
+        params: URLSearchParams;
+    }>;
+    userinfoRequests: Array<{
+        authorization?: string;
+    }>;
+}
+/**
+ * Schema for the tables OIDC user provisioning touches
+ * (`UserCollection.getOrCreateFromOidc`): the smrt-profiles trio plus users
+ * and sessions. Extend with further DDL per suite as needed.
+ *
+ * Tenant-scoped tables (`profile_types`, `profiles`) key on
+ * `(tenant_id, slug, context, _meta_type)` since smrt#2360 — keep this DDL in
+ * step with the framework schema or `save()`'s ON CONFLICT cannot bind.
+ */
+export declare const OIDC_USERS_TEST_SCHEMA = "\nCREATE TABLE IF NOT EXISTS \"_smrt_backfills\" (\n  \"name\" TEXT PRIMARY KEY NOT NULL,\n  \"applied_at\" TIMESTAMP DEFAULT current_timestamp,\n  \"description\" TEXT,\n  \"package_name\" TEXT\n);\n\nCREATE TABLE IF NOT EXISTS \"profile_types\" (\n  \"id\" TEXT PRIMARY KEY NOT NULL,\n  \"slug\" TEXT NOT NULL,\n  \"context\" TEXT NOT NULL DEFAULT '',\n  \"_meta_type\" TEXT NOT NULL,\n  \"_meta_data\" JSON,\n  \"created_at\" TIMESTAMP NOT NULL DEFAULT current_timestamp,\n  \"updated_at\" TIMESTAMP NOT NULL DEFAULT current_timestamp,\n  \"tenant_id\" TEXT,\n  \"name\" TEXT DEFAULT '',\n  \"description\" TEXT\n);\nCREATE UNIQUE INDEX IF NOT EXISTS \"profile_types_slug_context_meta_type_idx\" ON \"profile_types\" (\"tenant_id\", \"slug\", \"context\", \"_meta_type\");\nCREATE INDEX IF NOT EXISTS \"profile_types_meta_type_idx\" ON \"profile_types\" (\"_meta_type\");\n\nCREATE TABLE IF NOT EXISTS \"profiles\" (\n  \"id\" TEXT PRIMARY KEY NOT NULL,\n  \"slug\" TEXT NOT NULL,\n  \"context\" TEXT NOT NULL DEFAULT '',\n  \"_meta_type\" TEXT NOT NULL,\n  \"_meta_data\" JSON,\n  \"created_at\" TIMESTAMP NOT NULL DEFAULT current_timestamp,\n  \"updated_at\" TIMESTAMP NOT NULL DEFAULT current_timestamp,\n  \"tenant_id\" TEXT,\n  \"type_id\" TEXT,\n  \"email\" TEXT,\n  \"email_key\" TEXT,\n  \"name\" TEXT DEFAULT '',\n  \"description\" TEXT\n);\nCREATE UNIQUE INDEX IF NOT EXISTS \"profiles_slug_context_meta_type_idx\" ON \"profiles\" (\"tenant_id\", \"slug\", \"context\", \"_meta_type\");\nCREATE INDEX IF NOT EXISTS \"profiles_meta_type_idx\" ON \"profiles\" (\"_meta_type\");\nCREATE INDEX IF NOT EXISTS \"profiles_email_key_idx\" ON \"profiles\" (\"email_key\");\n\nCREATE TABLE IF NOT EXISTS \"oidc_profile_email_reservations\" (\n  \"id\" TEXT PRIMARY KEY NOT NULL,\n  \"slug\" TEXT NOT NULL,\n  \"context\" TEXT NOT NULL DEFAULT '',\n  \"created_at\" TIMESTAMP NOT NULL DEFAULT current_timestamp,\n  \"updated_at\" TIMESTAMP NOT NULL DEFAULT current_timestamp,\n  \"profile_id\" TEXT NOT NULL,\n  \"email_key\" TEXT NOT NULL\n);\nCREATE UNIQUE INDEX IF NOT EXISTS \"oidc_profile_email_reservations_slug_context_idx\" ON \"oidc_profile_email_reservations\" (\"slug\", \"context\");\nCREATE UNIQUE INDEX IF NOT EXISTS \"oidc_profile_email_reservations_profile_id_idx\" ON \"oidc_profile_email_reservations\" (\"profile_id\");\nCREATE UNIQUE INDEX IF NOT EXISTS \"oidc_profile_email_reservations_email_key_idx\" ON \"oidc_profile_email_reservations\" (\"email_key\");\n\nCREATE TABLE IF NOT EXISTS \"oidc_identities\" (\n  \"id\" TEXT PRIMARY KEY NOT NULL,\n  \"slug\" TEXT NOT NULL,\n  \"context\" TEXT NOT NULL DEFAULT '',\n  \"created_at\" TIMESTAMP NOT NULL DEFAULT current_timestamp,\n  \"updated_at\" TIMESTAMP NOT NULL DEFAULT current_timestamp,\n  \"profile_id\" TEXT NOT NULL,\n  \"provider\" TEXT DEFAULT '',\n  \"issuer\" TEXT DEFAULT '',\n  \"subject\" TEXT DEFAULT '',\n  \"identity_key\" TEXT,\n  \"email\" TEXT DEFAULT '',\n  \"last_used_at\" TIMESTAMP\n);\nCREATE UNIQUE INDEX IF NOT EXISTS \"oidc_identities_slug_context_idx\" ON \"oidc_identities\" (\"slug\", \"context\");\nCREATE UNIQUE INDEX IF NOT EXISTS \"oidc_identities_identity_key_idx\" ON \"oidc_identities\" (\"identity_key\");\n\nCREATE TABLE IF NOT EXISTS \"users\" (\n  \"id\" TEXT PRIMARY KEY NOT NULL,\n  \"slug\" TEXT NOT NULL,\n  \"context\" TEXT NOT NULL DEFAULT '',\n  \"created_at\" TIMESTAMP NOT NULL DEFAULT current_timestamp,\n  \"updated_at\" TIMESTAMP NOT NULL DEFAULT current_timestamp,\n  \"profile_id\" TEXT DEFAULT '',\n  \"email\" TEXT DEFAULT '',\n  \"email_key\" TEXT,\n  \"status\" TEXT,\n  \"last_login_at\" TIMESTAMP\n);\nCREATE UNIQUE INDEX IF NOT EXISTS \"users_slug_context_idx\" ON \"users\" (\"slug\", \"context\");\nCREATE UNIQUE INDEX IF NOT EXISTS \"users_profile_id_idx\" ON \"users\" (\"profile_id\");\nCREATE UNIQUE INDEX IF NOT EXISTS \"users_email_key_idx\" ON \"users\" (\"email_key\");\n\nCREATE TABLE IF NOT EXISTS \"sessions\" (\n  \"id\" TEXT PRIMARY KEY NOT NULL,\n  \"slug\" TEXT NOT NULL,\n  \"context\" TEXT NOT NULL DEFAULT '',\n  \"created_at\" TIMESTAMP NOT NULL DEFAULT current_timestamp,\n  \"updated_at\" TIMESTAMP NOT NULL DEFAULT current_timestamp,\n  \"user_id\" TEXT DEFAULT '',\n  \"tenant_id\" TEXT,\n  \"status\" TEXT,\n  \"expires_at\" TIMESTAMP,\n  \"user_agent\" TEXT DEFAULT '',\n  \"ip_address\" TEXT DEFAULT '',\n  \"last_accessed_at\" TIMESTAMP,\n  \"data\" JSON DEFAULT '{}'\n);\nCREATE UNIQUE INDEX IF NOT EXISTS \"sessions_slug_context_idx\" ON \"sessions\" (\"slug\", \"context\");\n";
+/** Mark a freshly-created, empty test schema ready for indexed OIDC reads. */
+export declare function prepareOidcEmailKeyBackfills(db: DatabaseInterface): Promise<void>;
+/** Close every server started by this harness (call from `afterAll`). */
+export declare function closeAllOidcServers(): Promise<void>;
+export declare function startOidcServer(options?: OidcTestServerOptions): Promise<OidcTestServer>;
+//# sourceMappingURL=oidc-test-server.d.ts.map

package/dist/__tests__/helpers/oidc-test-server.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"oidc-test-server.d.ts","sourceRoot":"","sources":["../../../src/__tests__/helpers/oidc-test-server.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AASH,OAAO,EAEL,KAAK,iBAAiB,EACvB,MAAM,qCAAqC,CAAC;AAK7C,MAAM,WAAW,qBAAqB;IACpC,oCAAoC,CAAC,EAAE,OAAO,CAAC;IAC/C,QAAQ,CAAC,EAAE,MAAM,GAAG,MAAM,EAAE,CAAC;IAC7B,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,oBAAoB,CAAC,EAAE,OAAO,CAAC;IAC/B,qBAAqB,CAAC,EAAE,OAAO,CAAC;IAChC,qBAAqB,CAAC,EAAE,OAAO,CAAC;CACjC;AAED,MAAM,WAAW,cAAc;IAC7B,KAAK,EAAE,MAAM,OAAO,CAAC,IAAI,CAAC,CAAC;IAC3B,MAAM,EAAE,MAAM,CAAC;IACf,wDAAwD;IACxD,QAAQ,EAAE,CAAC,KAAK,EAAE,MAAM,KAAK,IAAI,CAAC;IAClC,aAAa,EAAE,KAAK,CAAC;QAAE,aAAa,CAAC,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,eAAe,CAAA;KAAE,CAAC,CAAC;IAC1E,gBAAgB,EAAE,KAAK,CAAC;QAAE,aAAa,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;CACrD;AAED;;;;;;;;GAQG;AACH,eAAO,MAAM,sBAAsB,w8IAwGlC,CAAC;AAEF,8EAA8E;AAC9E,wBAAsB,4BAA4B,CAChD,EAAE,EAAE,iBAAiB,GACpB,OAAO,CAAC,IAAI,CAAC,CAUf;AAaD,yEAAyE;AACzE,wBAAsB,mBAAmB,IAAI,OAAO,CAAC,IAAI,CAAC,CAEzD;AAiBD,wBAAsB,eAAe,CACnC,OAAO,GAAE,qBAA0B,GAClC,OAAO,CAAC,cAAc,CAAC,CAgIzB"}

package/dist/__tests__/helpers/postgres-rls-reset.d.ts

@@ -0,0 +1,15 @@
+import type { DatabaseInterface } from '@happyvertical/sql';
+/**
+ * Remove every row-level-security policy `applyPostgresPermissionPolicies()`
+ * installed in the current schema, and turn RLS back off on those tables.
+ *
+ * The policies are DDL: they commit on the shared per-package database and
+ * outlive the isolated transaction a suite rolls back. Left behind, they
+ * FORCE RLS onto every tenant-scoped table for each later suite in the
+ * package. Under a superuser connection that was invisible (superusers bypass
+ * RLS); under the CI lane's NOSUPERUSER/NOBYPASSRLS role it rejects ordinary
+ * writes in unrelated suites, e.g. `resource_grants` in
+ * `resource-grant-postgres.test.ts`.
+ */
+export declare function resetPostgresPermissionPolicies(db: DatabaseInterface): Promise<void>;
+//# sourceMappingURL=postgres-rls-reset.d.ts.map

package/dist/__tests__/helpers/postgres-rls-reset.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"postgres-rls-reset.d.ts","sourceRoot":"","sources":["../../../src/__tests__/helpers/postgres-rls-reset.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,oBAAoB,CAAC;AAE5D;;;;;;;;;;;GAWG;AACH,wBAAsB,+BAA+B,CACnD,EAAE,EAAE,iBAAiB,GACpB,OAAO,CAAC,IAAI,CAAC,CA2Bf"}

package/dist/app-contract.d.ts

@@ -1,4 +1,14 @@
-import { ResourceListResponseBody } from './sveltekit.js';
+/**
+ * Versioned discovery and cross-transport contracts for SMRT application
+ * surfaces.
+ *
+ * The artifact is intentionally data-only: downstream apps may persist its
+ * canonical JSON and pin the SHA-256 digest without parsing CLI help text or
+ * depending on a particular transport implementation.
+ *
+ * @packageDocumentation
+ */
+import type { ResourceListResponseBody } from './sveltekit.js';
 /** Immutable selector for this discovery artifact family. */
 export declare const SMRT_DISCOVERY_CONFORMANCE_SCHEMA = "https://smrt.dev/schemas/discovery-conformance/v1";
 /** Version of the discovery artifact payload. */