@kromatv/sdk 0.1.40-canary.0

package/rust/kroma-db/src/accounts/resets.rs

@@ -0,0 +1,202 @@
+//! Credential resets: the token + code an admin mints for a locked-out user.
+
+use anyhow::Result;
+use rusqlite::{params, OptionalExtension, Row};
+
+use crate::{now_or_blank, Pool};
+
+pub const MAX_RESET_ATTEMPTS: i64 = 5;
+
+pub struct CredentialReset {
+    pub token: String,
+    pub user_id: String,
+    pub code_hash: String,
+    pub attempts: i64,
+    pub created_by: Option<String>,
+    pub created_at: String,
+    pub expires_at: i64,
+    pub used_at: Option<String>,
+}
+
+fn row_to_reset(r: &Row) -> rusqlite::Result<CredentialReset> {
+    Ok(CredentialReset {
+        token: r.get(0)?,
+        user_id: r.get(1)?,
+        code_hash: r.get(2)?,
+        attempts: r.get(3)?,
+        created_by: r.get(4)?,
+        created_at: r.get(5)?,
+        expires_at: r.get(6)?,
+        used_at: r.get(7)?,
+    })
+}
+
+/// Mint a reset for `user_id`, replacing any unused one. Returns the token.
+/// Minting also answers any reset the user asked for from the sign-in screen.
+pub fn create_reset(
+    pool: &Pool,
+    token: &str,
+    user_id: &str,
+    code_hash: &str,
+    created_by: &str,
+    expires_at: i64,
+) -> Result<()> {
+    let conn = pool.get()?;
+    conn.execute(
+        "DELETE FROM credential_resets WHERE user_id = ?1 AND used_at IS NULL",
+        params![user_id],
+    )?;
+    conn.execute(
+        "INSERT INTO credential_resets (token,user_id,code_hash,attempts,created_by,created_at,expires_at,used_at) \
+         VALUES (?1,?2,?3,0,?4,?5,?6,NULL)",
+        params![token, user_id, code_hash, created_by, now_or_blank(), expires_at],
+    )?;
+    conn.execute(
+        "DELETE FROM reset_requests WHERE user_id = ?1",
+        params![user_id],
+    )?;
+    Ok(())
+}
+
+/// Record (or refresh) that `user_id` asked for a reset from the sign-in
+/// screen. One open request per account: asking again just moves the date.
+pub fn request_reset(pool: &Pool, user_id: &str) -> Result<()> {
+    let conn = pool.get()?;
+    conn.execute(
+        "INSERT INTO reset_requests (user_id,created_at) VALUES (?1,?2) \
+         ON CONFLICT(user_id) DO UPDATE SET created_at = excluded.created_at",
+        params![user_id, now_or_blank()],
+    )?;
+    Ok(())
+}
+
+/// Fetch one reset by token, whatever its state.
+pub fn get_reset(pool: &Pool, token: &str) -> Result<Option<CredentialReset>> {
+    let conn = pool.get()?;
+    let reset = conn
+        .query_row(
+            "SELECT token,user_id,code_hash,attempts,created_by,created_at,expires_at,used_at \
+             FROM credential_resets WHERE token = ?1",
+            params![token],
+            row_to_reset,
+        )
+        .optional()?;
+    Ok(reset)
+}
+
+/// Atomically consume a valid (unused, unexpired, unlocked) reset → its user id.
+/// `None` if the token is unknown / used / expired / locked.
+pub fn consume_reset(pool: &Pool, token: &str) -> Result<Option<String>> {
+    let conn = pool.get()?;
+    let now = time::OffsetDateTime::now_utc().unix_timestamp();
+    let user_id: Option<String> = conn
+        .query_row(
+            "UPDATE credential_resets SET used_at = ?2 \
+             WHERE token = ?1 AND used_at IS NULL AND expires_at > ?3 AND attempts < ?4 \
+             RETURNING user_id",
+            params![token, now_or_blank(), now, MAX_RESET_ATTEMPTS],
+            |r| r.get(0),
+        )
+        .optional()?;
+    Ok(user_id)
+}
+
+/// Record a wrong code. Returns the new attempt count.
+pub fn bump_reset_attempts(pool: &Pool, token: &str) -> Result<i64> {
+    let conn = pool.get()?;
+    let attempts: i64 = conn.query_row(
+        "UPDATE credential_resets SET attempts = attempts + 1 WHERE token = ?1 RETURNING attempts",
+        params![token],
+        |r| r.get(0),
+    )?;
+    Ok(attempts)
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+    use crate::accounts::test_support::*;
+
+    #[test]
+    fn resets_create_get_consume_and_lock() {
+        let p = pool();
+        let owner = mk_user(&p, "o@b.c", "owner");
+        let user = mk_user(&p, "u@b.c", "user");
+        create_reset(&p, "tok1", &user.id, "code-hash", &owner.id, FUTURE).unwrap();
+
+        let got = get_reset(&p, "tok1").unwrap().unwrap();
+        assert_eq!(got.token, "tok1");
+        assert_eq!(got.user_id, user.id);
+        assert_eq!(got.attempts, 0);
+        assert!(got.used_at.is_none());
+
+        let uid = consume_reset(&p, "tok1").unwrap().unwrap();
+        assert_eq!(uid, user.id);
+        assert!(get_reset(&p, "tok1").unwrap().unwrap().used_at.is_some());
+        assert!(consume_reset(&p, "tok1").unwrap().is_none());
+    }
+
+    #[test]
+    fn a_new_reset_replaces_the_unused_one() {
+        let p = pool();
+        let owner = mk_user(&p, "o@b.c", "owner");
+        let user = mk_user(&p, "u@b.c", "user");
+        create_reset(&p, "tok1", &user.id, "h1", &owner.id, FUTURE).unwrap();
+        create_reset(&p, "tok2", &user.id, "h2", &owner.id, FUTURE).unwrap();
+
+        assert!(get_reset(&p, "tok1").unwrap().is_none());
+        assert!(get_reset(&p, "tok2").unwrap().is_some());
+    }
+
+    #[test]
+    fn expired_and_locked_resets_cannot_be_consumed() {
+        let p = pool();
+        let owner = mk_user(&p, "o@b.c", "owner");
+        let user = mk_user(&p, "u@b.c", "user");
+        create_reset(&p, "old", &user.id, "h", &owner.id, 1).unwrap();
+        assert!(consume_reset(&p, "old").unwrap().is_none());
+
+        create_reset(&p, "locked", &user.id, "h", &owner.id, FUTURE).unwrap();
+        for _ in 0..MAX_RESET_ATTEMPTS {
+            bump_reset_attempts(&p, "locked").unwrap();
+        }
+        assert!(consume_reset(&p, "locked").unwrap().is_none());
+    }
+
+    #[test]
+    fn bumping_attempts_counts_up() {
+        let p = pool();
+        let owner = mk_user(&p, "o@b.c", "owner");
+        let user = mk_user(&p, "u@b.c", "user");
+        create_reset(&p, "tok", &user.id, "h", &owner.id, FUTURE).unwrap();
+
+        assert_eq!(bump_reset_attempts(&p, "tok").unwrap(), 1);
+        assert_eq!(bump_reset_attempts(&p, "tok").unwrap(), 2);
+        assert_eq!(get_reset(&p, "tok").unwrap().unwrap().attempts, 2);
+    }
+
+    #[test]
+    fn a_reset_request_marks_the_member_until_a_reset_is_minted() {
+        let p = pool();
+        let owner = mk_user(&p, "o@b.c", "owner");
+        let user = mk_user(&p, "u@b.c", "user");
+        assert!(!requested(&p, &user.id));
+
+        request_reset(&p, &user.id).unwrap();
+        assert!(requested(&p, &user.id));
+        request_reset(&p, &user.id).unwrap();
+        assert!(requested(&p, &user.id));
+
+        create_reset(&p, "tok", &user.id, "h", &owner.id, FUTURE).unwrap();
+        assert!(!requested(&p, &user.id));
+    }
+
+    fn requested(p: &Pool, user_id: &str) -> bool {
+        crate::admin_users(p)
+            .unwrap()
+            .into_iter()
+            .find(|u| u.id == user_id)
+            .unwrap()
+            .reset_requested
+    }
+}

package/rust/kroma-db/src/accounts/sessions.rs

@@ -0,0 +1,182 @@
+//! A signed-in session, and revoking the ones that are not this device.
+
+use anyhow::Result;
+use rusqlite::{params, OptionalExtension};
+
+use kroma_domain::User;
+
+use crate::rows::row_to_user;
+use crate::{now_or_blank, Pool};
+
+/// `access_token` records the device credential this session was minted from,
+/// so the account's session list can flag the current device.
+pub fn create_session(
+    pool: &Pool,
+    token: &str,
+    user_id: &str,
+    expires_at: i64,
+    access_token: Option<&str>,
+) -> Result<()> {
+    let conn = pool.get()?;
+    conn.execute(
+        "INSERT INTO sessions (token,user_id,created_at,expires_at,access_token) VALUES (?1,?2,?3,?4,?5)",
+        params![token, user_id, now_or_blank(), expires_at, access_token],
+    )?;
+    Ok(())
+}
+
+/// The non-secret `short_hash` of the device credential a live session was
+/// minted from, so the handler never touches the raw token. `None` when the
+/// session predates parent-token tracking.
+pub fn session_device_id(pool: &Pool, token: &str) -> Result<Option<String>> {
+    let conn = pool.get()?;
+    let access = conn
+        .query_row(
+            "SELECT access_token FROM sessions WHERE token = ?1",
+            params![token],
+            |r| r.get::<_, Option<String>>(0),
+        )
+        .optional()?
+        .flatten();
+    Ok(access.map(|t| kroma_primitives::short_hash(&t)))
+}
+
+/// Resolve a session token to its user; expired sessions resolve to `None`.
+pub fn session_user(pool: &Pool, token: &str) -> Result<Option<User>> {
+    let conn = pool.get()?;
+    let now = time::OffsetDateTime::now_utc().unix_timestamp();
+    let mut stmt = conn.prepare(
+        "SELECT u.id,u.email,u.username,u.avatar_url,u.created_at,u.permissions,u.language,(u.pin_hash IS NOT NULL),u.audio_language,u.subtitle_language \
+         FROM sessions s JOIN users u ON u.id = s.user_id \
+         WHERE s.token = ?1 AND s.expires_at > ?2",
+    )?;
+    let mut rows = stmt.query_map(params![token, now], row_to_user)?;
+    match rows.next() {
+        Some(u) => Ok(Some(u?)),
+        None => Ok(None),
+    }
+}
+
+pub fn delete_session(pool: &Pool, token: &str) -> Result<()> {
+    let conn = pool.get()?;
+    conn.execute("DELETE FROM sessions WHERE token = ?1", params![token])?;
+    Ok(())
+}
+
+/// Drop every session and device token except `keep_token` and the device it
+/// was minted from, so a rotated password evicts any stolen credential while
+/// the caller stays signed in. An unknown `keep_token` revokes everything
+/// (fail-closed).
+pub fn revoke_other_sessions(pool: &Pool, user_id: &str, keep_token: &str) -> Result<()> {
+    let conn = pool.get()?;
+    let keep_device: Option<String> = conn
+        .query_row(
+            "SELECT access_token FROM sessions WHERE token = ?1",
+            params![keep_token],
+            |r| r.get::<_, Option<String>>(0),
+        )
+        .optional()?
+        .flatten();
+    conn.execute(
+        "DELETE FROM sessions WHERE user_id = ?1 AND token <> ?2",
+        params![user_id, keep_token],
+    )?;
+    match keep_device {
+        Some(dev) => conn.execute(
+            "DELETE FROM access_tokens WHERE user_id = ?1 AND token <> ?2",
+            params![user_id, dev],
+        )?,
+        None => conn.execute(
+            "DELETE FROM access_tokens WHERE user_id = ?1",
+            params![user_id],
+        )?,
+    };
+    Ok(())
+}
+
+/// Drop every session and device token for the user. A completed credential
+/// reset evicts everything, so a stolen credential dies with the old password.
+pub fn revoke_all_sessions(pool: &Pool, user_id: &str) -> Result<()> {
+    let conn = pool.get()?;
+    conn.execute("DELETE FROM sessions WHERE user_id = ?1", params![user_id])?;
+    conn.execute(
+        "DELETE FROM access_tokens WHERE user_id = ?1",
+        params![user_id],
+    )?;
+    Ok(())
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+    use crate::accounts::test_support::*;
+    use crate::accounts::{access_token_user, create_access_token, list_access_tokens};
+
+    #[test]
+    fn sessions_resolve_and_expire() {
+        let p = pool();
+        let u = mk_user(&p, "a@b.c", "alice");
+        create_session(&p, "sess-tok", &u.id, FUTURE, Some("acc-tok")).unwrap();
+        assert_eq!(session_user(&p, "sess-tok").unwrap().unwrap().id, u.id);
+        assert_eq!(
+            session_device_id(&p, "sess-tok").unwrap(),
+            Some(kroma_primitives::short_hash("acc-tok"))
+        );
+
+        create_session(&p, "old-sess", &u.id, 1, None).unwrap();
+        assert!(session_user(&p, "old-sess").unwrap().is_none());
+        assert!(session_device_id(&p, "old-sess").unwrap().is_none());
+
+        delete_session(&p, "sess-tok").unwrap();
+        assert!(session_user(&p, "sess-tok").unwrap().is_none());
+    }
+
+    #[test]
+    fn revoking_other_sessions_keeps_the_caller_and_the_device_it_came_from() {
+        let p = pool();
+        let user = mk_user(&p, "a@b.c", "alice");
+
+        create_access_token(&p, "dev-phone", &user.id, FUTURE, true, Some("iPhone")).unwrap();
+        create_access_token(&p, "dev-laptop", &user.id, FUTURE, true, Some("Mac")).unwrap();
+        create_session(&p, "sess-phone", &user.id, FUTURE, Some("dev-phone")).unwrap();
+        create_session(&p, "sess-laptop", &user.id, FUTURE, Some("dev-laptop")).unwrap();
+
+        revoke_other_sessions(&p, &user.id, "sess-phone").unwrap();
+
+        assert!(session_user(&p, "sess-phone").unwrap().is_some());
+        assert!(session_user(&p, "sess-laptop").unwrap().is_none());
+        assert!(access_token_user(&p, "dev-phone").unwrap().is_some());
+        assert!(access_token_user(&p, "dev-laptop").unwrap().is_none());
+    }
+
+    #[test]
+    fn an_unknown_keep_token_revokes_every_device_credential() {
+        let p = pool();
+        let user = mk_user(&p, "a@b.c", "alice");
+        create_access_token(&p, "dev-phone", &user.id, FUTURE, true, Some("iPhone")).unwrap();
+        create_session(&p, "sess-phone", &user.id, FUTURE, Some("dev-phone")).unwrap();
+
+        revoke_other_sessions(&p, &user.id, "sess-gone").unwrap();
+
+        assert!(session_user(&p, "sess-phone").unwrap().is_none());
+        assert!(access_token_user(&p, "dev-phone").unwrap().is_none());
+        assert!(list_access_tokens(&p, &user.id).unwrap().is_empty());
+    }
+
+    #[test]
+    fn revoke_all_sessions_evicts_everything() {
+        let p = pool();
+        let user = mk_user(&p, "a@b.c", "alice");
+        create_access_token(&p, "dev-phone", &user.id, FUTURE, true, Some("iPhone")).unwrap();
+        create_access_token(&p, "dev-laptop", &user.id, FUTURE, true, Some("Mac")).unwrap();
+        create_session(&p, "sess-phone", &user.id, FUTURE, Some("dev-phone")).unwrap();
+        create_session(&p, "sess-laptop", &user.id, FUTURE, Some("dev-laptop")).unwrap();
+
+        revoke_all_sessions(&p, &user.id).unwrap();
+
+        assert!(session_user(&p, "sess-phone").unwrap().is_none());
+        assert!(session_user(&p, "sess-laptop").unwrap().is_none());
+        assert!(access_token_user(&p, "dev-phone").unwrap().is_none());
+        assert!(access_token_user(&p, "dev-laptop").unwrap().is_none());
+    }
+}

package/rust/kroma-db/src/accounts/test_support.rs

@@ -0,0 +1,14 @@
+use super::create_user;
+use crate::testing::TempPool;
+use crate::Pool;
+use kroma_domain::{Permission, User};
+
+pub(super) const FUTURE: i64 = 9_999_999_999;
+
+pub(super) fn pool() -> TempPool {
+    crate::testing::temp_pool("acct")
+}
+
+pub(super) fn mk_user(pool: &Pool, email: &str, username: &str) -> User {
+    create_user(pool, email, username, "hash", &[Permission::Playback]).unwrap()
+}

package/rust/kroma-db/src/accounts/verifications.rs

@@ -0,0 +1,185 @@
+//! Email verifications: the single-use link an admin mints so an address proves
+//! its mailbox. Unlike a credential reset there is no code: reaching the mailbox
+//! is itself the proof, so the link alone suffices. The row pins the address it
+//! was minted for, and confirming verifies nothing once the account's address no
+//! longer matches it (ADMIN-87).
+
+use anyhow::Result;
+use rusqlite::{params, OptionalExtension, Row};
+
+use crate::{now_or_blank, Pool};
+
+pub struct EmailVerification {
+    pub token: String,
+    pub user_id: String,
+    pub email: String,
+    pub created_by: Option<String>,
+    pub created_at: String,
+    pub expires_at: i64,
+    pub used_at: Option<String>,
+}
+
+fn row_to_verification(r: &Row) -> rusqlite::Result<EmailVerification> {
+    Ok(EmailVerification {
+        token: r.get(0)?,
+        user_id: r.get(1)?,
+        email: r.get(2)?,
+        created_by: r.get(3)?,
+        created_at: r.get(4)?,
+        expires_at: r.get(5)?,
+        used_at: r.get(6)?,
+    })
+}
+
+/// Mint a verification for `user_id`'s current address, replacing any unused one.
+pub fn create_verification(
+    pool: &Pool,
+    token: &str,
+    user_id: &str,
+    email: &str,
+    created_by: &str,
+    expires_at: i64,
+) -> Result<()> {
+    let conn = pool.get()?;
+    conn.execute(
+        "DELETE FROM email_verifications WHERE user_id = ?1 AND used_at IS NULL",
+        params![user_id],
+    )?;
+    conn.execute(
+        "INSERT INTO email_verifications (token,user_id,email,created_by,created_at,expires_at,used_at) \
+         VALUES (?1,?2,?3,?4,?5,?6,NULL)",
+        params![token, user_id, email, created_by, now_or_blank(), expires_at],
+    )?;
+    Ok(())
+}
+
+/// Fetch one verification by token, whatever its state.
+pub fn get_verification(pool: &Pool, token: &str) -> Result<Option<EmailVerification>> {
+    let conn = pool.get()?;
+    let v = conn
+        .query_row(
+            "SELECT token,user_id,email,created_by,created_at,expires_at,used_at \
+             FROM email_verifications WHERE token = ?1",
+            params![token],
+            row_to_verification,
+        )
+        .optional()?;
+    Ok(v)
+}
+
+/// Confirm a verification: mark the address verified and the token used, only
+/// while the token is unused, unexpired and the account's address is still the
+/// one the link was minted for. Returns the verified user id, or `None`.
+pub fn confirm_verification(pool: &Pool, token: &str) -> Result<Option<String>> {
+    let conn = pool.get()?;
+    let now = time::OffsetDateTime::now_utc().unix_timestamp();
+    let user_id: Option<String> = conn
+        .query_row(
+            "UPDATE users SET email_verified_at = ?2 \
+             WHERE id = (SELECT user_id FROM email_verifications \
+                         WHERE token = ?1 AND used_at IS NULL AND expires_at > ?2) \
+               AND email = (SELECT email FROM email_verifications WHERE token = ?1) \
+             RETURNING id",
+            params![token, now],
+            |r| r.get(0),
+        )
+        .optional()?;
+    if user_id.is_some() {
+        conn.execute(
+            "UPDATE email_verifications SET used_at = ?2 WHERE token = ?1",
+            params![token, now_or_blank()],
+        )?;
+    }
+    Ok(user_id)
+}
+
+/// Set or clear the address's proof of ownership directly.
+pub fn set_email_verified(pool: &Pool, user_id: &str, verified: bool) -> Result<()> {
+    let conn = pool.get()?;
+    let at = verified.then(now_or_blank);
+    conn.execute(
+        "UPDATE users SET email_verified_at = ?2 WHERE id = ?1",
+        params![user_id, at],
+    )?;
+    Ok(())
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+    use crate::accounts::test_support::*;
+
+    #[test]
+    fn verifications_create_get_and_confirm() {
+        let p = pool();
+        let owner = mk_user(&p, "o@b.c", "owner");
+        let user = mk_user(&p, "u@b.c", "user");
+        create_verification(&p, "tok1", &user.id, "u@b.c", &owner.id, FUTURE).unwrap();
+
+        let got = get_verification(&p, "tok1").unwrap().unwrap();
+        assert_eq!(got.user_id, user.id);
+        assert_eq!(got.email, "u@b.c");
+        assert!(got.used_at.is_none());
+
+        let uid = confirm_verification(&p, "tok1").unwrap().unwrap();
+        assert_eq!(uid, user.id);
+        assert!(get_verification(&p, "tok1").unwrap().unwrap().used_at.is_some());
+        assert!(confirm_verification(&p, "tok1").unwrap().is_none());
+    }
+
+    #[test]
+    fn a_new_verification_replaces_the_unused_one() {
+        let p = pool();
+        let owner = mk_user(&p, "o@b.c", "owner");
+        let user = mk_user(&p, "u@b.c", "user");
+        create_verification(&p, "tok1", &user.id, "u@b.c", &owner.id, FUTURE).unwrap();
+        create_verification(&p, "tok2", &user.id, "u@b.c", &owner.id, FUTURE).unwrap();
+
+        assert!(get_verification(&p, "tok1").unwrap().is_none());
+        assert!(get_verification(&p, "tok2").unwrap().is_some());
+    }
+
+    #[test]
+    fn an_expired_verification_cannot_be_confirmed() {
+        let p = pool();
+        let owner = mk_user(&p, "o@b.c", "owner");
+        let user = mk_user(&p, "u@b.c", "user");
+        create_verification(&p, "old", &user.id, "u@b.c", &owner.id, 1).unwrap();
+
+        assert!(confirm_verification(&p, "old").unwrap().is_none());
+    }
+
+    #[test]
+    fn a_changed_address_verifies_nothing() {
+        let p = pool();
+        let owner = mk_user(&p, "o@b.c", "owner");
+        let user = mk_user(&p, "u@b.c", "user");
+        create_verification(&p, "tok", &user.id, "u@b.c", &owner.id, FUTURE).unwrap();
+        crate::accounts::set_user_email(&p, &user.id, "new@b.c").unwrap();
+
+        assert!(confirm_verification(&p, "tok").unwrap().is_none());
+        assert!(get_verification(&p, "tok").unwrap().unwrap().used_at.is_none());
+    }
+
+    #[test]
+    fn changing_the_address_clears_the_verified_state() {
+        let p = pool();
+        let user = mk_user(&p, "u@b.c", "user");
+        set_email_verified(&p, &user.id, true).unwrap();
+        assert!(email_verified(&p, &user.id));
+
+        crate::accounts::set_user_email(&p, &user.id, "new@b.c").unwrap();
+        assert!(!email_verified(&p, &user.id));
+    }
+
+    fn email_verified(p: &Pool, id: &str) -> bool {
+        p.get()
+            .unwrap()
+            .query_row(
+                "SELECT email_verified_at IS NOT NULL FROM users WHERE id = ?1",
+                params![id],
+                |r| r.get(0),
+            )
+            .unwrap()
+    }
+}