@hilbras/keystone 1.1.0

package/src/repositories/organization.ts

@@ -0,0 +1,167 @@
+import { eq, and, sql } from "drizzle-orm";
+import { db } from "../db/index.js";
+import { organizations, orgMemberships, users, type Organization, type OrgMembership } from "../db/schema.js";
+import type { CreateOrganizationInput, OrganizationRepository } from "./types.js";
+
+export type { OrganizationRepository } from "./types.js";
+
+export class DrizzleOrganizationRepository implements OrganizationRepository {
+  private slugify(name: string): string {
+    return name
+      .toLowerCase()
+      .trim()
+      .replace(/[^a-z0-9]+/g, "-")
+      .replace(/^-+|-+$/g, "")
+      .slice(0, 64);
+  }
+
+  async create(input: CreateOrganizationInput): Promise<Organization> {
+    const baseSlug = input.slug || this.slugify(input.name);
+    const slug = await this.ensureUniqueSlug(baseSlug);
+
+    const [org] = await db
+      .insert(organizations)
+      .values({
+        name: input.name,
+        slug,
+        plan: input.plan || "free",
+      })
+      .returning();
+    return org;
+  }
+
+  async findById(id: string): Promise<Organization | undefined> {
+    const [org] = await db.select().from(organizations).where(eq(organizations.id, id)).limit(1);
+    return org;
+  }
+
+  async findBySlug(slug: string): Promise<Organization | undefined> {
+    const [org] = await db.select().from(organizations).where(eq(organizations.slug, slug)).limit(1);
+    return org;
+  }
+
+  async listAll(): Promise<Organization[]> {
+    return db.select().from(organizations).orderBy(organizations.createdAt);
+  }
+
+  async update(id: string, input: { name?: string; branding?: Record<string, unknown> }): Promise<Organization | undefined> {
+    const [updated] = await db
+      .update(organizations)
+      .set({
+        ...(input.name !== undefined ? { name: input.name } : {}),
+        ...(input.branding !== undefined ? { branding: input.branding } : {}),
+        updatedAt: new Date(),
+      })
+      .where(eq(organizations.id, id))
+      .returning();
+    return updated;
+  }
+
+  async countMembers(orgId: string): Promise<number> {
+    const [countRow] = await db
+      .select({ count: sql<number>`count(*)`.mapWith(Number) })
+      .from(orgMemberships)
+      .where(eq(orgMemberships.orgId, orgId));
+    return countRow?.count ?? 0;
+  }
+
+  async listByUserId(userId: string): Promise<Organization[]> {
+    const rows = await db
+      .select({ org: organizations })
+      .from(orgMemberships)
+      .where(eq(orgMemberships.userId, userId))
+      .innerJoin(organizations, eq(orgMemberships.orgId, organizations.id));
+    return rows.map((r) => r.org);
+  }
+
+  async addMembership(input: { orgId: string; userId: string; role: string }): Promise<OrgMembership> {
+    const [membership] = await db
+      .insert(orgMemberships)
+      .values({
+        orgId: input.orgId,
+        userId: input.userId,
+        role: input.role,
+      })
+      .onConflictDoNothing({ target: [orgMemberships.orgId, orgMemberships.userId] })
+      .returning();
+
+    if (membership) return membership;
+
+    const [existing] = await db
+      .select()
+      .from(orgMemberships)
+      .where(and(eq(orgMemberships.orgId, input.orgId), eq(orgMemberships.userId, input.userId)))
+      .limit(1);
+    return existing;
+  }
+
+  async findMembership(orgId: string, userId: string): Promise<OrgMembership | undefined> {
+    const [membership] = await db
+      .select()
+      .from(orgMemberships)
+      .where(and(eq(orgMemberships.orgId, orgId), eq(orgMemberships.userId, userId)))
+      .limit(1);
+    return membership;
+  }
+
+  async updateMembershipRole(
+    orgId: string,
+    userId: string,
+    role: string
+  ): Promise<OrgMembership | undefined> {
+    const [updated] = await db
+      .update(orgMemberships)
+      .set({ role, updatedAt: sql`now()` })
+      .where(and(eq(orgMemberships.orgId, orgId), eq(orgMemberships.userId, userId)))
+      .returning();
+    return updated;
+  }
+
+  async removeMembership(orgId: string, userId: string): Promise<boolean> {
+    const deleted = await db
+      .delete(orgMemberships)
+      .where(and(eq(orgMemberships.orgId, orgId), eq(orgMemberships.userId, userId)))
+      .returning();
+    return deleted.length > 0;
+  }
+
+  async countOwners(orgId: string): Promise<number> {
+    const rows = await db
+      .select({ count: sql<number>`count(*)`.mapWith(Number) })
+      .from(orgMemberships)
+      .where(and(eq(orgMemberships.orgId, orgId), eq(orgMemberships.role, "owner")));
+    return rows[0]?.count ?? 0;
+  }
+
+  async listMembers(orgId: string) {
+    return db
+      .select({
+        membership: orgMemberships,
+        user: {
+          id: users.id,
+          email: users.email,
+          username: users.username,
+          name: users.name,
+          avatarUrl: users.avatarUrl,
+        },
+      })
+      .from(orgMemberships)
+      .where(eq(orgMemberships.orgId, orgId))
+      .innerJoin(users, eq(orgMemberships.userId, users.id));
+  }
+
+  private async ensureUniqueSlug(base: string): Promise<string> {
+    let slug = base || "org";
+    let counter = 2;
+    while (true) {
+      const existing = await db
+        .select({ id: organizations.id })
+        .from(organizations)
+        .where(eq(organizations.slug, slug))
+        .limit(1);
+      if (existing.length === 0) return slug;
+      slug = `${base}-${counter}`;
+      counter++;
+    }
+  }
+}

package/src/repositories/permission.ts

@@ -0,0 +1,153 @@
+import { eq, and } from "drizzle-orm";
+import { db } from "../db/index.js";
+import { permissions, rolePermissions, orgMemberships, type Permission } from "../db/schema.js";
+import type { PermissionRepository } from "./types.js";
+
+const DEFAULT_PERMISSIONS = [
+  { resource: "organization", action: "read" },
+  { resource: "organization", action: "update" },
+  { resource: "organization", action: "delete" },
+  { resource: "organization", action: "invite" },
+  { resource: "organization", action: "manage_members" },
+  { resource: "application", action: "read" },
+  { resource: "application", action: "create" },
+  { resource: "application", action: "update" },
+  { resource: "application", action: "delete" },
+  { resource: "service_account", action: "read" },
+  { resource: "service_account", action: "create" },
+  { resource: "service_account", action: "update" },
+  { resource: "service_account", action: "delete" },
+  { resource: "api_key", action: "read" },
+  { resource: "api_key", action: "create" },
+  { resource: "api_key", action: "revoke" },
+  { resource: "audit_log", action: "read" },
+];
+
+const DEFAULT_ROLE_PERMISSIONS: Record<string, string[]> = {
+  owner: DEFAULT_PERMISSIONS.map((p) => `${p.resource}:${p.action}`),
+  admin: [
+    "organization:read",
+    "organization:update",
+    "organization:invite",
+    "organization:manage_members",
+    "application:read",
+    "application:create",
+    "application:update",
+    "service_account:read",
+    "service_account:create",
+    "service_account:update",
+    "api_key:read",
+    "api_key:create",
+    "api_key:revoke",
+    "audit_log:read",
+  ],
+  member: [
+    "organization:read",
+    "application:read",
+    "service_account:read",
+    "api_key:read",
+  ],
+  viewer: ["organization:read", "application:read", "audit_log:read"],
+};
+
+function permissionKey(resource: string, action: string): string {
+  return `${resource}:${action}`;
+}
+
+export class DrizzlePermissionRepository implements PermissionRepository {
+  async ensureSeeded(): Promise<void> {
+    const existing = await db.select().from(permissions);
+    const existingKeys = new Set(existing.map((p) => permissionKey(p.resource, p.action)));
+
+    const toInsert = DEFAULT_PERMISSIONS.filter(
+      (p) => !existingKeys.has(permissionKey(p.resource, p.action))
+    );
+
+    if (toInsert.length > 0) {
+      await db.insert(permissions).values(toInsert);
+    }
+  }
+
+  async ensureRolePermissionsSeeded(): Promise<void> {
+    await this.ensureSeeded();
+    const allPermissions = await db.select().from(permissions);
+    const permissionByKey = new Map(allPermissions.map((p) => [permissionKey(p.resource, p.action), p.id]));
+
+    for (const [role, perms] of Object.entries(DEFAULT_ROLE_PERMISSIONS)) {
+      const permissionIds = perms
+        .map((key) => permissionByKey.get(key))
+        .filter((id): id is string => Boolean(id));
+
+      for (const permissionId of permissionIds) {
+        await db
+          .insert(rolePermissions)
+          .values({ role, permissionId })
+          .onConflictDoNothing({ target: [rolePermissions.role, rolePermissions.permissionId] });
+      }
+    }
+  }
+
+  async list(): Promise<Permission[]> {
+    return db.select().from(permissions).orderBy(permissions.resource, permissions.action);
+  }
+
+  async listDistinctRoles(): Promise<string[]> {
+    const rows = await db.selectDistinct({ role: rolePermissions.role }).from(rolePermissions);
+    const roles = new Set<string>(["owner", "admin", "member", ...rows.map((r) => r.role)]);
+    const memberships = await db.selectDistinct({ role: orgMemberships.role }).from(orgMemberships);
+    for (const m of memberships) roles.add(m.role);
+    return [...roles].sort();
+  }
+
+  async create(input: { resource: string; action: string; description?: string }): Promise<Permission> {
+    const [created] = await db
+      .insert(permissions)
+      .values({ resource: input.resource, action: input.action, description: input.description ?? null })
+      .onConflictDoNothing({ target: [permissions.resource, permissions.action] })
+      .returning();
+    return created;
+  }
+
+  async remove(id: string): Promise<Permission | undefined> {
+    const [removed] = await db.delete(permissions).where(eq(permissions.id, id)).returning();
+    return removed;
+  }
+
+  async listForRole(role: string): Promise<Permission[]> {
+    const rows = await db
+      .select({ permission: permissions })
+      .from(rolePermissions)
+      .where(eq(rolePermissions.role, role))
+      .innerJoin(permissions, eq(rolePermissions.permissionId, permissions.id));
+    return rows.map((r) => r.permission);
+  }
+
+  async listKeysForRole(role: string): Promise<Set<string>> {
+    const perms = await this.listForRole(role);
+    return new Set(perms.map((p) => permissionKey(p.resource, p.action)));
+  }
+
+  async assignToRole(role: string, permissionId: string): Promise<void> {
+    await db
+      .insert(rolePermissions)
+      .values({ role, permissionId })
+      .onConflictDoNothing({ target: [rolePermissions.role, rolePermissions.permissionId] });
+  }
+
+  async removeFromRole(role: string, permissionId: string): Promise<void> {
+    await db
+      .delete(rolePermissions)
+      .where(and(eq(rolePermissions.role, role), eq(rolePermissions.permissionId, permissionId)));
+  }
+
+  async hasPermission(role: string, resource: string, action: string): Promise<boolean> {
+    const key = permissionKey(resource, action);
+    const keys = await this.listKeysForRole(role);
+    return keys.has(key);
+  }
+
+  async hasAnyPermission(role: string, required: { resource: string; action: string }[]): Promise<boolean> {
+    const keys = await this.listKeysForRole(role);
+    return required.some((p) => keys.has(permissionKey(p.resource, p.action)));
+  }
+}

package/src/repositories/samlConnection.ts

@@ -0,0 +1,96 @@
+import { eq, and } from "drizzle-orm";
+import { db } from "../db/index.js";
+import { samlConnections, type SamlConnection } from "../db/schema.js";
+
+export type SamlConnectionListItem = {
+  id: string;
+  name: string;
+  idpEntityId: string | null;
+  idpSsoUrl: string | null;
+  spEntityId: string;
+  spAcsUrl: string;
+  isActive: boolean;
+  createdAt: Date;
+};
+
+export interface SamlConnectionRepository {
+  listByOrgId(orgId: string): Promise<SamlConnectionListItem[]>;
+  findById(id: string): Promise<SamlConnection | undefined>;
+  findActiveById(id: string): Promise<SamlConnection | undefined>;
+  create(input: {
+    orgId: string;
+    name: string;
+    idpEntityId?: string;
+    idpSsoUrl?: string;
+    idpCertificate?: string;
+    spEntityId: string;
+    spAcsUrl: string;
+    attributeMapping?: Record<string, unknown>;
+    isActive?: boolean;
+  }): Promise<SamlConnection>;
+  deleteByIdAndOrgId(id: string, orgId: string): Promise<SamlConnection | undefined>;
+}
+
+export class DrizzleSamlConnectionRepository implements SamlConnectionRepository {
+  async listByOrgId(orgId: string) {
+    return db
+      .select({
+        id: samlConnections.id,
+        name: samlConnections.name,
+        idpEntityId: samlConnections.idpEntityId,
+        idpSsoUrl: samlConnections.idpSsoUrl,
+        spEntityId: samlConnections.spEntityId,
+        spAcsUrl: samlConnections.spAcsUrl,
+        isActive: samlConnections.isActive,
+        createdAt: samlConnections.createdAt,
+      })
+      .from(samlConnections)
+      .where(eq(samlConnections.orgId, orgId));
+  }
+
+  async findById(id: string) {
+    const [connection] = await db.select().from(samlConnections).where(eq(samlConnections.id, id)).limit(1);
+    return connection;
+  }
+
+  async findActiveById(id: string) {
+    const [connection] = await db.select().from(samlConnections).where(and(eq(samlConnections.id, id), eq(samlConnections.isActive, true))).limit(1);
+    return connection;
+  }
+
+  async create(input: {
+    orgId: string;
+    name: string;
+    idpEntityId?: string;
+    idpSsoUrl?: string;
+    idpCertificate?: string;
+    spEntityId: string;
+    spAcsUrl: string;
+    attributeMapping?: Record<string, unknown>;
+    isActive?: boolean;
+  }) {
+    const [connection] = await db
+      .insert(samlConnections)
+      .values({
+        orgId: input.orgId,
+        name: input.name,
+        idpEntityId: input.idpEntityId,
+        idpSsoUrl: input.idpSsoUrl,
+        idpCertificate: input.idpCertificate,
+        spEntityId: input.spEntityId,
+        spAcsUrl: input.spAcsUrl,
+        attributeMapping: input.attributeMapping ?? {},
+        isActive: input.isActive ?? true,
+      })
+      .returning();
+    return connection;
+  }
+
+  async deleteByIdAndOrgId(id: string, orgId: string) {
+    const [record] = await db
+      .delete(samlConnections)
+      .where(and(eq(samlConnections.id, id), eq(samlConnections.orgId, orgId)))
+      .returning();
+    return record;
+  }
+}

package/src/repositories/session.ts

@@ -0,0 +1,86 @@
+import { db } from "../db/index.js";
+import { userSessions, refreshTokens } from "../db/schema.js";
+import { eq, and, lt, desc } from "drizzle-orm";
+
+export interface CreateSessionInput {
+  userId: string;
+  refreshTokenId: string;
+  deviceFingerprint?: string;
+  ipAddress?: string;
+  userAgent?: string;
+  expiresAt: Date;
+}
+
+export class SessionRepository {
+  async create(input: CreateSessionInput) {
+    const [session] = await db.insert(userSessions).values({
+      userId: input.userId,
+      refreshTokenId: input.refreshTokenId,
+      deviceFingerprint: input.deviceFingerprint ?? null,
+      ipAddress: input.ipAddress ?? null,
+      userAgent: input.userAgent ?? null,
+      expiresAt: input.expiresAt,
+    }).returning();
+    return session;
+  }
+
+  async listByUser(userId: string) {
+    return db.select().from(userSessions)
+      .where(eq(userSessions.userId, userId))
+      .orderBy(desc(userSessions.lastSeenAt));
+  }
+
+  async findByRefreshTokenId(refreshTokenId: string) {
+    const [session] = await db.select().from(userSessions)
+      .where(eq(userSessions.refreshTokenId, refreshTokenId))
+      .limit(1);
+    return session;
+  }
+
+  async findById(id: string) {
+    const [session] = await db.select().from(userSessions)
+      .where(eq(userSessions.id, id))
+      .limit(1);
+    return session;
+  }
+
+  async updateLastSeen(id: string) {
+    await db.update(userSessions)
+      .set({ lastSeenAt: new Date() })
+      .where(eq(userSessions.id, id));
+  }
+
+  async deleteById(id: string, userId: string) {
+    const result = await db.delete(userSessions)
+      .where(and(eq(userSessions.id, id), eq(userSessions.userId, userId)));
+    return result.count > 0;
+  }
+
+  async deleteByRefreshTokenId(refreshTokenId: string) {
+    await db.delete(userSessions)
+      .where(eq(userSessions.refreshTokenId, refreshTokenId));
+  }
+
+  async deleteExpired() {
+    await db.delete(userSessions)
+      .where(lt(userSessions.expiresAt, new Date()));
+  }
+
+  async deleteAllForUser(userId: string, exceptRefreshTokenId?: string) {
+    if (exceptRefreshTokenId) {
+      await db.delete(userSessions)
+        .where(and(eq(userSessions.userId, userId), lt(userSessions.refreshTokenId, exceptRefreshTokenId)));
+    } else {
+      await db.delete(userSessions).where(eq(userSessions.userId, userId));
+    }
+  }
+
+  async revokeRefreshToken(tokenId: string) {
+    await db.update(refreshTokens).set({ revokedAt: new Date() }).where(eq(refreshTokens.id, tokenId));
+  }
+
+  async findRefreshTokenByHash(tokenHash: string) {
+    const [row] = await db.select().from(refreshTokens).where(eq(refreshTokens.tokenHash, tokenHash)).limit(1);
+    return row;
+  }
+}

package/src/repositories/types.ts

@@ -0,0 +1,134 @@
+import type { User, Organization, OrgMembership, Application, auditLog, Permission } from "../db/schema.js";
+
+export interface CreateUserInput {
+  email: string;
+  username: string;
+  name: string;
+  passwordHash?: string | null;
+  provider?: string;
+  emailVerified?: boolean;
+  avatarUrl?: string | null;
+  zitadelUserId?: string | null;
+  metadata?: Record<string, unknown>;
+}
+
+export interface UpdateUserInput {
+  name?: string;
+  email?: string;
+  username?: string;
+  role?: string;
+  emailVerified?: boolean;
+  avatarUrl?: string | null;
+  phoneNumber?: string | null;
+  phoneVerified?: boolean;
+  metadata?: Record<string, unknown>;
+}
+
+export interface UserRepository {
+  findById(id: string): Promise<User | undefined>;
+  findByEmail(email: string): Promise<User | undefined>;
+  create(input: CreateUserInput): Promise<User>;
+  update(id: string, input: UpdateUserInput): Promise<User | undefined>;
+  deactivate(id: string): Promise<void>;
+  listByOrg(orgId: string): Promise<User[]>;
+  listAll(): Promise<User[]>;
+  updateLastSeen(id: string): Promise<void>;
+  ensureUniqueUsername(base: string, excludeId?: string): Promise<string>;
+  recordFailedLogin(id: string): Promise<User | undefined>;
+  resetFailedLogins(id: string): Promise<void>;
+  lockAccount(id: string, until: Date): Promise<void>;
+  setTotpSecret(userId: string, totpSecret: string): Promise<void>;
+  enableTotp(userId: string): Promise<void>;
+  disableTotp(userId: string): Promise<void>;
+  deleteById(userId: string): Promise<void>;
+}
+
+export interface CreateOrganizationInput {
+  name: string;
+  slug?: string;
+  plan?: string;
+}
+
+export interface OrganizationRepository {
+  create(input: CreateOrganizationInput): Promise<Organization>;
+  findById(id: string): Promise<Organization | undefined>;
+  findBySlug(slug: string): Promise<Organization | undefined>;
+  listByUserId(userId: string): Promise<Organization[]>;
+  listAll(): Promise<Organization[]>;
+  update(id: string, input: { name?: string; branding?: Record<string, unknown> }): Promise<Organization | undefined>;
+  countMembers(orgId: string): Promise<number>;
+  addMembership(input: { orgId: string; userId: string; role: string }): Promise<OrgMembership>;
+  findMembership(orgId: string, userId: string): Promise<OrgMembership | undefined>;
+  updateMembershipRole(orgId: string, userId: string, role: string): Promise<OrgMembership | undefined>;
+  removeMembership(orgId: string, userId: string): Promise<boolean>;
+  countOwners(orgId: string): Promise<number>;
+  listMembers(orgId: string): Promise<{ membership: OrgMembership; user: { id: string; email: string; username: string; name: string | null; avatarUrl: string | null } }[]>;
+}
+
+export interface IdentityLinkInput {
+  userId: string;
+  providerId: string;
+  providerType: string;
+  externalSub: string;
+  email?: string;
+  profile?: Record<string, unknown>;
+}
+
+export interface IdentityRepository {
+  link(input: IdentityLinkInput): Promise<void>;
+  findLinkedByExternalSub(providerId: string, externalSub: string): Promise<User | undefined>;
+  listByUserId(userId: string): Promise<{ identity: any; provider: { id: string; name: string; providerType: string } }[]>;
+}
+
+export interface AuditRepository {
+  list(opts: {
+    orgId?: string;
+    appId?: string;
+    userId?: string;
+    event?: string;
+    limit?: number;
+    offset?: number;
+  }): Promise<typeof auditLog.$inferSelect[]>;
+}
+
+export interface CreateApplicationInput {
+  orgId: string;
+  name: string;
+  redirectUris?: string[];
+  allowedOrigins?: string[];
+  clientId?: string;
+  clientSecret?: string;
+}
+
+export interface UpdateApplicationInput {
+  name?: string;
+  redirectUris?: string[];
+  allowedOrigins?: string[];
+  allowedIps?: string[];
+  blockedIps?: string[];
+  isActive?: boolean;
+  branding?: Record<string, unknown>;
+}
+
+export interface ApplicationRepository {
+  create(input: CreateApplicationInput): Promise<Application & { clientSecret: string }>;
+  findByClientId(clientId: string): Promise<Application | undefined>;
+  listByOrgId(orgId: string): Promise<Application[]>;
+  update(appId: string, orgId: string, input: UpdateApplicationInput): Promise<Application | undefined>;
+  verifyClientSecret(clientId: string, secret: string): Promise<Application | undefined>;
+}
+
+export interface PermissionRepository {
+  ensureSeeded(): Promise<void>;
+  ensureRolePermissionsSeeded(): Promise<void>;
+  list(): Promise<Permission[]>;
+  listForRole(role: string): Promise<Permission[]>;
+  listKeysForRole(role: string): Promise<Set<string>>;
+  listDistinctRoles(): Promise<string[]>;
+  create(input: { resource: string; action: string; description?: string }): Promise<Permission>;
+  remove(id: string): Promise<Permission | undefined>;
+  assignToRole(role: string, permissionId: string): Promise<void>;
+  removeFromRole(role: string, permissionId: string): Promise<void>;
+  hasPermission(role: string, resource: string, action: string): Promise<boolean>;
+  hasAnyPermission(role: string, required: { resource: string; action: string }[]): Promise<boolean>;
+}