@hogsend/db 0.19.0 → 0.20.0

package/drizzle/meta/_journal.json

@@ -169,6 +169,13 @@
       "when": 1781164526837,
       "tag": "0023_semantic_tracked_links",
       "breakpoints": true
+    },
+    {
+      "idx": 24,
+      "version": "7",
+      "when": 1781282015159,
+      "tag": "0024_provider_credentials",
+      "breakpoints": true
     }
   ]
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@hogsend/db",
-  "version": "0.19.0",
+  "version": "0.20.0",
   "type": "module",
   "license": "MIT",
   "repository": {

package/src/schema/index.ts

@@ -17,6 +17,7 @@ export * from "./journey-configs.js";
 export * from "./journey-logs.js";
 export * from "./journey-states.js";
 export * from "./link-clicks.js";
+export * from "./provider-credentials.js";
 export * from "./relations.js";
 export * from "./tracked-links.js";
 export * from "./user-events.js";

package/src/schema/provider-credentials.ts

@@ -0,0 +1,33 @@
+import { pgTable, text, uniqueIndex, uuid } from "drizzle-orm/pg-core";
+import { timestamps } from "./_shared.js";
+
+/**
+ * Provider-neutral credential store (OAuth tokens today, API keys later).
+ * One row per (providerId, kind). `payload` is an AES-256-GCM blob
+ * (base64url, keyed off BETTER_AUTH_SECRET) produced by the engine's
+ * `lib/provider-credentials.ts` — NEVER plaintext JSON. It is `text`, not
+ * `jsonb`, precisely because the contents must not be queryable: tokens are
+ * opaque at the database layer by design.
+ */
+export const providerCredentials = pgTable(
+  "provider_credentials",
+  {
+    id: uuid("id").defaultRandom().primaryKey(),
+    // e.g. "posthog" — matches an AnalyticsProvider meta.id by convention,
+    // but deliberately NOT foreign-keyed: providers are code-defined.
+    providerId: text("provider_id").notNull(),
+    // "oauth" today; "api_key" is the anticipated future kind.
+    kind: text("kind").notNull().default("oauth"),
+    // Encrypted JSON: base64url(iv || ciphertext || gcmTag).
+    payload: text("payload").notNull(),
+    ...timestamps,
+  },
+  (table) => [
+    // unique-per-kind: one oauth credential per provider; a future api_key
+    // credential for the same provider coexists.
+    uniqueIndex("provider_credentials_provider_kind_idx").on(
+      table.providerId,
+      table.kind,
+    ),
+  ],
+);