@hilbras/keystone 1.6.0 → 1.9.0

package/src/repositories/organization.ts

@@ -1,167 +0,0 @@
-import { eq, and, sql } from "drizzle-orm";
-import { db } from "../db/index.js";
-import { organizations, orgMemberships, users, type Organization, type OrgMembership } from "../db/schema.js";
-import type { CreateOrganizationInput, OrganizationRepository } from "./types.js";
-
-export type { OrganizationRepository } from "./types.js";
-
-export class DrizzleOrganizationRepository implements OrganizationRepository {
-  private slugify(name: string): string {
-    return name
-      .toLowerCase()
-      .trim()
-      .replace(/[^a-z0-9]+/g, "-")
-      .replace(/^-+|-+$/g, "")
-      .slice(0, 64);
-  }
-
-  async create(input: CreateOrganizationInput): Promise<Organization> {
-    const baseSlug = input.slug || this.slugify(input.name);
-    const slug = await this.ensureUniqueSlug(baseSlug);
-
-    const [org] = await db
-      .insert(organizations)
-      .values({
-        name: input.name,
-        slug,
-        plan: input.plan || "free",
-      })
-      .returning();
-    return org;
-  }
-
-  async findById(id: string): Promise<Organization | undefined> {
-    const [org] = await db.select().from(organizations).where(eq(organizations.id, id)).limit(1);
-    return org;
-  }
-
-  async findBySlug(slug: string): Promise<Organization | undefined> {
-    const [org] = await db.select().from(organizations).where(eq(organizations.slug, slug)).limit(1);
-    return org;
-  }
-
-  async listAll(): Promise<Organization[]> {
-    return db.select().from(organizations).orderBy(organizations.createdAt);
-  }
-
-  async update(id: string, input: { name?: string; branding?: Record<string, unknown> }): Promise<Organization | undefined> {
-    const [updated] = await db
-      .update(organizations)
-      .set({
-        ...(input.name !== undefined ? { name: input.name } : {}),
-        ...(input.branding !== undefined ? { branding: input.branding } : {}),
-        updatedAt: new Date(),
-      })
-      .where(eq(organizations.id, id))
-      .returning();
-    return updated;
-  }
-
-  async countMembers(orgId: string): Promise<number> {
-    const [countRow] = await db
-      .select({ count: sql<number>`count(*)`.mapWith(Number) })
-      .from(orgMemberships)
-      .where(eq(orgMemberships.orgId, orgId));
-    return countRow?.count ?? 0;
-  }
-
-  async listByUserId(userId: string): Promise<Organization[]> {
-    const rows = await db
-      .select({ org: organizations })
-      .from(orgMemberships)
-      .where(eq(orgMemberships.userId, userId))
-      .innerJoin(organizations, eq(orgMemberships.orgId, organizations.id));
-    return rows.map((r) => r.org);
-  }
-
-  async addMembership(input: { orgId: string; userId: string; role: string }): Promise<OrgMembership> {
-    const [membership] = await db
-      .insert(orgMemberships)
-      .values({
-        orgId: input.orgId,
-        userId: input.userId,
-        role: input.role,
-      })
-      .onConflictDoNothing({ target: [orgMemberships.orgId, orgMemberships.userId] })
-      .returning();
-
-    if (membership) return membership;
-
-    const [existing] = await db
-      .select()
-      .from(orgMemberships)
-      .where(and(eq(orgMemberships.orgId, input.orgId), eq(orgMemberships.userId, input.userId)))
-      .limit(1);
-    return existing;
-  }
-
-  async findMembership(orgId: string, userId: string): Promise<OrgMembership | undefined> {
-    const [membership] = await db
-      .select()
-      .from(orgMemberships)
-      .where(and(eq(orgMemberships.orgId, orgId), eq(orgMemberships.userId, userId)))
-      .limit(1);
-    return membership;
-  }
-
-  async updateMembershipRole(
-    orgId: string,
-    userId: string,
-    role: string
-  ): Promise<OrgMembership | undefined> {
-    const [updated] = await db
-      .update(orgMemberships)
-      .set({ role, updatedAt: sql`now()` })
-      .where(and(eq(orgMemberships.orgId, orgId), eq(orgMemberships.userId, userId)))
-      .returning();
-    return updated;
-  }
-
-  async removeMembership(orgId: string, userId: string): Promise<boolean> {
-    const deleted = await db
-      .delete(orgMemberships)
-      .where(and(eq(orgMemberships.orgId, orgId), eq(orgMemberships.userId, userId)))
-      .returning();
-    return deleted.length > 0;
-  }
-
-  async countOwners(orgId: string): Promise<number> {
-    const rows = await db
-      .select({ count: sql<number>`count(*)`.mapWith(Number) })
-      .from(orgMemberships)
-      .where(and(eq(orgMemberships.orgId, orgId), eq(orgMemberships.role, "owner")));
-    return rows[0]?.count ?? 0;
-  }
-
-  async listMembers(orgId: string) {
-    return db
-      .select({
-        membership: orgMemberships,
-        user: {
-          id: users.id,
-          email: users.email,
-          username: users.username,
-          name: users.name,
-          avatarUrl: users.avatarUrl,
-        },
-      })
-      .from(orgMemberships)
-      .where(eq(orgMemberships.orgId, orgId))
-      .innerJoin(users, eq(orgMemberships.userId, users.id));
-  }
-
-  private async ensureUniqueSlug(base: string): Promise<string> {
-    let slug = base || "org";
-    let counter = 2;
-    while (true) {
-      const existing = await db
-        .select({ id: organizations.id })
-        .from(organizations)
-        .where(eq(organizations.slug, slug))
-        .limit(1);
-      if (existing.length === 0) return slug;
-      slug = `${base}-${counter}`;
-      counter++;
-    }
-  }
-}

package/src/repositories/permission.ts

@@ -1,153 +0,0 @@
-import { eq, and } from "drizzle-orm";
-import { db } from "../db/index.js";
-import { permissions, rolePermissions, orgMemberships, type Permission } from "../db/schema.js";
-import type { PermissionRepository } from "./types.js";
-
-const DEFAULT_PERMISSIONS = [
-  { resource: "organization", action: "read" },
-  { resource: "organization", action: "update" },
-  { resource: "organization", action: "delete" },
-  { resource: "organization", action: "invite" },
-  { resource: "organization", action: "manage_members" },
-  { resource: "application", action: "read" },
-  { resource: "application", action: "create" },
-  { resource: "application", action: "update" },
-  { resource: "application", action: "delete" },
-  { resource: "service_account", action: "read" },
-  { resource: "service_account", action: "create" },
-  { resource: "service_account", action: "update" },
-  { resource: "service_account", action: "delete" },
-  { resource: "api_key", action: "read" },
-  { resource: "api_key", action: "create" },
-  { resource: "api_key", action: "revoke" },
-  { resource: "audit_log", action: "read" },
-];
-
-const DEFAULT_ROLE_PERMISSIONS: Record<string, string[]> = {
-  owner: DEFAULT_PERMISSIONS.map((p) => `${p.resource}:${p.action}`),
-  admin: [
-    "organization:read",
-    "organization:update",
-    "organization:invite",
-    "organization:manage_members",
-    "application:read",
-    "application:create",
-    "application:update",
-    "service_account:read",
-    "service_account:create",
-    "service_account:update",
-    "api_key:read",
-    "api_key:create",
-    "api_key:revoke",
-    "audit_log:read",
-  ],
-  member: [
-    "organization:read",
-    "application:read",
-    "service_account:read",
-    "api_key:read",
-  ],
-  viewer: ["organization:read", "application:read", "audit_log:read"],
-};
-
-function permissionKey(resource: string, action: string): string {
-  return `${resource}:${action}`;
-}
-
-export class DrizzlePermissionRepository implements PermissionRepository {
-  async ensureSeeded(): Promise<void> {
-    const existing = await db.select().from(permissions);
-    const existingKeys = new Set(existing.map((p) => permissionKey(p.resource, p.action)));
-
-    const toInsert = DEFAULT_PERMISSIONS.filter(
-      (p) => !existingKeys.has(permissionKey(p.resource, p.action))
-    );
-
-    if (toInsert.length > 0) {
-      await db.insert(permissions).values(toInsert);
-    }
-  }
-
-  async ensureRolePermissionsSeeded(): Promise<void> {
-    await this.ensureSeeded();
-    const allPermissions = await db.select().from(permissions);
-    const permissionByKey = new Map(allPermissions.map((p) => [permissionKey(p.resource, p.action), p.id]));
-
-    for (const [role, perms] of Object.entries(DEFAULT_ROLE_PERMISSIONS)) {
-      const permissionIds = perms
-        .map((key) => permissionByKey.get(key))
-        .filter((id): id is string => Boolean(id));
-
-      for (const permissionId of permissionIds) {
-        await db
-          .insert(rolePermissions)
-          .values({ role, permissionId })
-          .onConflictDoNothing({ target: [rolePermissions.role, rolePermissions.permissionId] });
-      }
-    }
-  }
-
-  async list(): Promise<Permission[]> {
-    return db.select().from(permissions).orderBy(permissions.resource, permissions.action);
-  }
-
-  async listDistinctRoles(): Promise<string[]> {
-    const rows = await db.selectDistinct({ role: rolePermissions.role }).from(rolePermissions);
-    const roles = new Set<string>(["owner", "admin", "member", ...rows.map((r) => r.role)]);
-    const memberships = await db.selectDistinct({ role: orgMemberships.role }).from(orgMemberships);
-    for (const m of memberships) roles.add(m.role);
-    return [...roles].sort();
-  }
-
-  async create(input: { resource: string; action: string; description?: string }): Promise<Permission> {
-    const [created] = await db
-      .insert(permissions)
-      .values({ resource: input.resource, action: input.action, description: input.description ?? null })
-      .onConflictDoNothing({ target: [permissions.resource, permissions.action] })
-      .returning();
-    return created;
-  }
-
-  async remove(id: string): Promise<Permission | undefined> {
-    const [removed] = await db.delete(permissions).where(eq(permissions.id, id)).returning();
-    return removed;
-  }
-
-  async listForRole(role: string): Promise<Permission[]> {
-    const rows = await db
-      .select({ permission: permissions })
-      .from(rolePermissions)
-      .where(eq(rolePermissions.role, role))
-      .innerJoin(permissions, eq(rolePermissions.permissionId, permissions.id));
-    return rows.map((r) => r.permission);
-  }
-
-  async listKeysForRole(role: string): Promise<Set<string>> {
-    const perms = await this.listForRole(role);
-    return new Set(perms.map((p) => permissionKey(p.resource, p.action)));
-  }
-
-  async assignToRole(role: string, permissionId: string): Promise<void> {
-    await db
-      .insert(rolePermissions)
-      .values({ role, permissionId })
-      .onConflictDoNothing({ target: [rolePermissions.role, rolePermissions.permissionId] });
-  }
-
-  async removeFromRole(role: string, permissionId: string): Promise<void> {
-    await db
-      .delete(rolePermissions)
-      .where(and(eq(rolePermissions.role, role), eq(rolePermissions.permissionId, permissionId)));
-  }
-
-  async hasPermission(role: string, resource: string, action: string): Promise<boolean> {
-    const key = permissionKey(resource, action);
-    const keys = await this.listKeysForRole(role);
-    return keys.has(key);
-  }
-
-  async hasAnyPermission(role: string, required: { resource: string; action: string }[]): Promise<boolean> {
-    const keys = await this.listKeysForRole(role);
-    return required.some((p) => keys.has(permissionKey(p.resource, p.action)));
-  }
-}

package/src/repositories/samlConnection.ts

@@ -1,96 +0,0 @@
-import { eq, and } from "drizzle-orm";
-import { db } from "../db/index.js";
-import { samlConnections, type SamlConnection } from "../db/schema.js";
-
-export type SamlConnectionListItem = {
-  id: string;
-  name: string;
-  idpEntityId: string | null;
-  idpSsoUrl: string | null;
-  spEntityId: string;
-  spAcsUrl: string;
-  isActive: boolean;
-  createdAt: Date;
-};
-
-export interface SamlConnectionRepository {
-  listByOrgId(orgId: string): Promise<SamlConnectionListItem[]>;
-  findById(id: string): Promise<SamlConnection | undefined>;
-  findActiveById(id: string): Promise<SamlConnection | undefined>;
-  create(input: {
-    orgId: string;
-    name: string;
-    idpEntityId?: string;
-    idpSsoUrl?: string;
-    idpCertificate?: string;
-    spEntityId: string;
-    spAcsUrl: string;
-    attributeMapping?: Record<string, unknown>;
-    isActive?: boolean;
-  }): Promise<SamlConnection>;
-  deleteByIdAndOrgId(id: string, orgId: string): Promise<SamlConnection | undefined>;
-}
-
-export class DrizzleSamlConnectionRepository implements SamlConnectionRepository {
-  async listByOrgId(orgId: string) {
-    return db
-      .select({
-        id: samlConnections.id,
-        name: samlConnections.name,
-        idpEntityId: samlConnections.idpEntityId,
-        idpSsoUrl: samlConnections.idpSsoUrl,
-        spEntityId: samlConnections.spEntityId,
-        spAcsUrl: samlConnections.spAcsUrl,
-        isActive: samlConnections.isActive,
-        createdAt: samlConnections.createdAt,
-      })
-      .from(samlConnections)
-      .where(eq(samlConnections.orgId, orgId));
-  }
-
-  async findById(id: string) {
-    const [connection] = await db.select().from(samlConnections).where(eq(samlConnections.id, id)).limit(1);
-    return connection;
-  }
-
-  async findActiveById(id: string) {
-    const [connection] = await db.select().from(samlConnections).where(and(eq(samlConnections.id, id), eq(samlConnections.isActive, true))).limit(1);
-    return connection;
-  }
-
-  async create(input: {
-    orgId: string;
-    name: string;
-    idpEntityId?: string;
-    idpSsoUrl?: string;
-    idpCertificate?: string;
-    spEntityId: string;
-    spAcsUrl: string;
-    attributeMapping?: Record<string, unknown>;
-    isActive?: boolean;
-  }) {
-    const [connection] = await db
-      .insert(samlConnections)
-      .values({
-        orgId: input.orgId,
-        name: input.name,
-        idpEntityId: input.idpEntityId,
-        idpSsoUrl: input.idpSsoUrl,
-        idpCertificate: input.idpCertificate,
-        spEntityId: input.spEntityId,
-        spAcsUrl: input.spAcsUrl,
-        attributeMapping: input.attributeMapping ?? {},
-        isActive: input.isActive ?? true,
-      })
-      .returning();
-    return connection;
-  }
-
-  async deleteByIdAndOrgId(id: string, orgId: string) {
-    const [record] = await db
-      .delete(samlConnections)
-      .where(and(eq(samlConnections.id, id), eq(samlConnections.orgId, orgId)))
-      .returning();
-    return record;
-  }
-}

package/src/repositories/session.ts

@@ -1,86 +0,0 @@
-import { db } from "../db/index.js";
-import { userSessions, refreshTokens } from "../db/schema.js";
-import { eq, and, lt, desc } from "drizzle-orm";
-
-export interface CreateSessionInput {
-  userId: string;
-  refreshTokenId: string;
-  deviceFingerprint?: string;
-  ipAddress?: string;
-  userAgent?: string;
-  expiresAt: Date;
-}
-
-export class SessionRepository {
-  async create(input: CreateSessionInput) {
-    const [session] = await db.insert(userSessions).values({
-      userId: input.userId,
-      refreshTokenId: input.refreshTokenId,
-      deviceFingerprint: input.deviceFingerprint ?? null,
-      ipAddress: input.ipAddress ?? null,
-      userAgent: input.userAgent ?? null,
-      expiresAt: input.expiresAt,
-    }).returning();
-    return session;
-  }
-
-  async listByUser(userId: string) {
-    return db.select().from(userSessions)
-      .where(eq(userSessions.userId, userId))
-      .orderBy(desc(userSessions.lastSeenAt));
-  }
-
-  async findByRefreshTokenId(refreshTokenId: string) {
-    const [session] = await db.select().from(userSessions)
-      .where(eq(userSessions.refreshTokenId, refreshTokenId))
-      .limit(1);
-    return session;
-  }
-
-  async findById(id: string) {
-    const [session] = await db.select().from(userSessions)
-      .where(eq(userSessions.id, id))
-      .limit(1);
-    return session;
-  }
-
-  async updateLastSeen(id: string) {
-    await db.update(userSessions)
-      .set({ lastSeenAt: new Date() })
-      .where(eq(userSessions.id, id));
-  }
-
-  async deleteById(id: string, userId: string) {
-    const result = await db.delete(userSessions)
-      .where(and(eq(userSessions.id, id), eq(userSessions.userId, userId)));
-    return result.count > 0;
-  }
-
-  async deleteByRefreshTokenId(refreshTokenId: string) {
-    await db.delete(userSessions)
-      .where(eq(userSessions.refreshTokenId, refreshTokenId));
-  }
-
-  async deleteExpired() {
-    await db.delete(userSessions)
-      .where(lt(userSessions.expiresAt, new Date()));
-  }
-
-  async deleteAllForUser(userId: string, exceptRefreshTokenId?: string) {
-    if (exceptRefreshTokenId) {
-      await db.delete(userSessions)
-        .where(and(eq(userSessions.userId, userId), lt(userSessions.refreshTokenId, exceptRefreshTokenId)));
-    } else {
-      await db.delete(userSessions).where(eq(userSessions.userId, userId));
-    }
-  }
-
-  async revokeRefreshToken(tokenId: string) {
-    await db.update(refreshTokens).set({ revokedAt: new Date() }).where(eq(refreshTokens.id, tokenId));
-  }
-
-  async findRefreshTokenByHash(tokenHash: string) {
-    const [row] = await db.select().from(refreshTokens).where(eq(refreshTokens.tokenHash, tokenHash)).limit(1);
-    return row;
-  }
-}

package/src/repositories/types.ts

@@ -1,134 +0,0 @@
-import type { User, Organization, OrgMembership, Application, auditLog, Permission } from "../db/schema.js";
-
-export interface CreateUserInput {
-  email: string;
-  username: string;
-  name: string;
-  passwordHash?: string | null;
-  provider?: string;
-  emailVerified?: boolean;
-  avatarUrl?: string | null;
-  zitadelUserId?: string | null;
-  metadata?: Record<string, unknown>;
-}
-
-export interface UpdateUserInput {
-  name?: string;
-  email?: string;
-  username?: string;
-  role?: string;
-  emailVerified?: boolean;
-  avatarUrl?: string | null;
-  phoneNumber?: string | null;
-  phoneVerified?: boolean;
-  metadata?: Record<string, unknown>;
-}
-
-export interface UserRepository {
-  findById(id: string): Promise<User | undefined>;
-  findByEmail(email: string): Promise<User | undefined>;
-  create(input: CreateUserInput): Promise<User>;
-  update(id: string, input: UpdateUserInput): Promise<User | undefined>;
-  deactivate(id: string): Promise<void>;
-  listByOrg(orgId: string): Promise<User[]>;
-  listAll(): Promise<User[]>;
-  updateLastSeen(id: string): Promise<void>;
-  ensureUniqueUsername(base: string, excludeId?: string): Promise<string>;
-  recordFailedLogin(id: string): Promise<User | undefined>;
-  resetFailedLogins(id: string): Promise<void>;
-  lockAccount(id: string, until: Date): Promise<void>;
-  setTotpSecret(userId: string, totpSecret: string): Promise<void>;
-  enableTotp(userId: string): Promise<void>;
-  disableTotp(userId: string): Promise<void>;
-  deleteById(userId: string): Promise<void>;
-}
-
-export interface CreateOrganizationInput {
-  name: string;
-  slug?: string;
-  plan?: string;
-}
-
-export interface OrganizationRepository {
-  create(input: CreateOrganizationInput): Promise<Organization>;
-  findById(id: string): Promise<Organization | undefined>;
-  findBySlug(slug: string): Promise<Organization | undefined>;
-  listByUserId(userId: string): Promise<Organization[]>;
-  listAll(): Promise<Organization[]>;
-  update(id: string, input: { name?: string; branding?: Record<string, unknown> }): Promise<Organization | undefined>;
-  countMembers(orgId: string): Promise<number>;
-  addMembership(input: { orgId: string; userId: string; role: string }): Promise<OrgMembership>;
-  findMembership(orgId: string, userId: string): Promise<OrgMembership | undefined>;
-  updateMembershipRole(orgId: string, userId: string, role: string): Promise<OrgMembership | undefined>;
-  removeMembership(orgId: string, userId: string): Promise<boolean>;
-  countOwners(orgId: string): Promise<number>;
-  listMembers(orgId: string): Promise<{ membership: OrgMembership; user: { id: string; email: string; username: string; name: string | null; avatarUrl: string | null } }[]>;
-}
-
-export interface IdentityLinkInput {
-  userId: string;
-  providerId: string;
-  providerType: string;
-  externalSub: string;
-  email?: string;
-  profile?: Record<string, unknown>;
-}
-
-export interface IdentityRepository {
-  link(input: IdentityLinkInput): Promise<void>;
-  findLinkedByExternalSub(providerId: string, externalSub: string): Promise<User | undefined>;
-  listByUserId(userId: string): Promise<{ identity: any; provider: { id: string; name: string; providerType: string } }[]>;
-}
-
-export interface AuditRepository {
-  list(opts: {
-    orgId?: string;
-    appId?: string;
-    userId?: string;
-    event?: string;
-    limit?: number;
-    offset?: number;
-  }): Promise<typeof auditLog.$inferSelect[]>;
-}
-
-export interface CreateApplicationInput {
-  orgId: string;
-  name: string;
-  redirectUris?: string[];
-  allowedOrigins?: string[];
-  clientId?: string;
-  clientSecret?: string;
-}
-
-export interface UpdateApplicationInput {
-  name?: string;
-  redirectUris?: string[];
-  allowedOrigins?: string[];
-  allowedIps?: string[];
-  blockedIps?: string[];
-  isActive?: boolean;
-  branding?: Record<string, unknown>;
-}
-
-export interface ApplicationRepository {
-  create(input: CreateApplicationInput): Promise<Application & { clientSecret: string }>;
-  findByClientId(clientId: string): Promise<Application | undefined>;
-  listByOrgId(orgId: string): Promise<Application[]>;
-  update(appId: string, orgId: string, input: UpdateApplicationInput): Promise<Application | undefined>;
-  verifyClientSecret(clientId: string, secret: string): Promise<Application | undefined>;
-}
-
-export interface PermissionRepository {
-  ensureSeeded(): Promise<void>;
-  ensureRolePermissionsSeeded(): Promise<void>;
-  list(): Promise<Permission[]>;
-  listForRole(role: string): Promise<Permission[]>;
-  listKeysForRole(role: string): Promise<Set<string>>;
-  listDistinctRoles(): Promise<string[]>;
-  create(input: { resource: string; action: string; description?: string }): Promise<Permission>;
-  remove(id: string): Promise<Permission | undefined>;
-  assignToRole(role: string, permissionId: string): Promise<void>;
-  removeFromRole(role: string, permissionId: string): Promise<void>;
-  hasPermission(role: string, resource: string, action: string): Promise<boolean>;
-  hasAnyPermission(role: string, required: { resource: string; action: string }[]): Promise<boolean>;
-}