@kurdel/auth-db 0.1.0-beta.1

package/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2025-2026 Andrii Sorokin
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/README.md

@@ -0,0 +1,93 @@
+# @kurdel/auth-db
+
+Database-backed repository adapters for `@kurdel/auth`.
+
+The package keeps authentication strategies storage-agnostic while providing
+standard implementations over Kurdel's `IDatabase` contract.
+
+`DatabaseAuthUserRepository` resolves the current user and roles, while
+`DatabaseApiKeyRepository` resolves safe credential metadata including its
+stable ID. After a strategy succeeds, this data is available through
+`ctx.auth.user` and `ctx.auth.credential`; raw API keys are never exposed in the
+authentication context.
+
+The package also provides `DatabaseUserService` and `DatabaseApiKeyService` for
+administrative workflows. They create, list, update, and delete users, manage
+role assignments, and issue, list, or revoke API keys. `AuthDatabaseModule`
+registers both services as `AUTH_DB_TOKENS.UserService` and
+`AUTH_DB_TOKENS.ApiKeyService`.
+
+`DatabaseApiKeyUsageRecorder` updates `last_used_at` after successful
+authentication. `AuthDatabaseModule` exposes it through
+`AUTH_TOKENS.ApiKeyUsageRecorder`, ready to pass to `ApiKeyStrategy` as its
+`usage` option.
+
+Database audit persistence is opt-in because applications own their schema:
+
+```ts
+new AuthDatabaseModule({ audit: true });
+```
+
+This registers `DatabaseAuthEventStore` as `AUTH_DB_TOKENS.EventStore` and
+wires API-key issue and revoke events into the management service. Pass the
+same store to `AuthModule.events` to persist runtime authentication and
+authorization events. The application must provide the configured
+`auth_events` table; the runnable sample includes a migration with the expected
+columns and indexes.
+
+API-key issue or revocation and its database audit event run in the same
+`IDatabase.transaction` callback. If audit persistence fails, the credential
+mutation is rolled back and the service returns the original error. User
+creation, role replacement, profile updates, and deletion use the same
+transaction API for their multi-statement operations.
+
+```ts
+import { ApiKeyStrategy, AUTH_TOKENS, AuthModule } from '@kurdel/auth';
+import { AuthDatabaseModule } from '@kurdel/auth-db';
+
+const modules = [
+  new AuthDatabaseModule(),
+  new AuthModule({
+    strategies: [
+      {
+        name: 'api-key',
+        useFactory: ioc => new ApiKeyStrategy({
+          header: 'x-api-key',
+          credentials: ioc.get(AUTH_TOKENS.ApiKeyRepository),
+          users: ioc.get(AUTH_TOKENS.UserRepository),
+          usage: ioc.get(AUTH_TOKENS.ApiKeyUsageRecorder),
+        }),
+      },
+    ],
+  }),
+];
+```
+
+Custom table names and hashing implementations can be supplied through the
+module configuration:
+
+```ts
+new AuthDatabaseModule({
+  tables: {
+    users: 'application_users',
+    apiKeys: 'application_api_keys',
+  },
+  apiKeyHasher: customHasher,
+});
+```
+
+By default, the package expects `users`, `roles`, `user_roles`, and `api_keys`
+tables and uses SHA-256 for API-key lookup. Schema ownership remains with the
+application; see `sample/auth-db` for migrations and a runnable example.
+The management services expect the profile and credential metadata columns
+shown in those migrations, including user name, email, status and timestamps,
+plus API-key name, status, expiration and last-use timestamps.
+When audit persistence is enabled, the default event table is `auth_events`;
+it can be changed through `tables.authEvents`.
+
+See the [`@kurdel/auth` documentation](../auth/README.md) for route protection,
+authentication context, and custom strategy contracts.
+
+## License
+
+MIT © Andrii Sorokin

package/lib/api-key-hasher.d.ts

@@ -0,0 +1,6 @@
+export interface ApiKeyHasher {
+    hash(key: string): string;
+}
+export declare class Sha256ApiKeyHasher implements ApiKeyHasher {
+    hash(key: string): string;
+}

package/lib/api-key-hasher.js

@@ -0,0 +1,7 @@
+import crypto from 'node:crypto';
+export class Sha256ApiKeyHasher {
+    hash(key) {
+        return crypto.createHash('sha256').update(key).digest('hex');
+    }
+}
+//# sourceMappingURL=api-key-hasher.js.map

package/lib/api-key-hasher.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"api-key-hasher.js","sourceRoot":"","sources":["../src/api-key-hasher.ts"],"names":[],"mappings":"AAAA,OAAO,MAAM,MAAM,aAAa,CAAC;AAMjC,MAAM,OAAO,kBAAkB;IAC7B,IAAI,CAAC,GAAW;QACd,OAAO,MAAM,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IAC/D,CAAC;CACF"}

package/lib/auth-database-module.d.ts

@@ -0,0 +1,18 @@
+import { ModulePriority, type AppModule, type ProviderConfig } from '@kurdel/core/app';
+import { type ApiKeyHasher } from './api-key-hasher.js';
+import type { AuthDatabaseTables } from './auth-database-tables.js';
+export interface AuthDatabaseModuleConfig {
+    tables?: Partial<AuthDatabaseTables>;
+    apiKeyHasher?: ApiKeyHasher;
+    /** Enables persistence of sanitized authentication audit events. */
+    audit?: boolean;
+}
+export declare class AuthDatabaseModule implements AppModule {
+    readonly priority = ModulePriority.User;
+    readonly imports: {
+        db: symbol;
+    };
+    readonly exports: Record<string, symbol>;
+    readonly providers: ProviderConfig[];
+    constructor(config?: AuthDatabaseModuleConfig);
+}

package/lib/auth-database-module.js

@@ -0,0 +1,67 @@
+import { AUTH_TOKENS } from '@kurdel/auth';
+import { ModulePriority } from '@kurdel/core/app';
+import { IDatabase } from '@kurdel/db';
+import { Sha256ApiKeyHasher } from './api-key-hasher.js';
+import { DatabaseApiKeyRepository } from './database-api-key-repository.js';
+import { DatabaseApiKeyService } from './database-api-key-service.js';
+import { DatabaseApiKeyUsageRecorder } from './database-api-key-usage-recorder.js';
+import { DatabaseAuthUserRepository } from './database-auth-user-repository.js';
+import { DatabaseAuthEventStore } from './database-auth-event-store.js';
+import { DatabaseUserService } from './database-user-service.js';
+import { AUTH_DB_TOKENS } from './tokens.js';
+export class AuthDatabaseModule {
+    constructor(config = {}) {
+        this.priority = ModulePriority.User;
+        this.imports = { db: IDatabase };
+        const tables = config.tables ?? {};
+        const hasher = config.apiKeyHasher ?? new Sha256ApiKeyHasher();
+        this.exports = {
+            userRepository: AUTH_TOKENS.UserRepository,
+            apiKeyRepository: AUTH_TOKENS.ApiKeyRepository,
+            apiKeyUsageRecorder: AUTH_TOKENS.ApiKeyUsageRecorder,
+            apiKeyHasher: AUTH_DB_TOKENS.ApiKeyHasher,
+            userService: AUTH_DB_TOKENS.UserService,
+            apiKeyService: AUTH_DB_TOKENS.ApiKeyService,
+            ...(config.audit ? { eventStore: AUTH_DB_TOKENS.EventStore } : {}),
+        };
+        this.providers = [
+            {
+                provide: AUTH_DB_TOKENS.ApiKeyHasher,
+                useInstance: hasher,
+            },
+            {
+                provide: AUTH_TOKENS.UserRepository,
+                useFactory: ioc => new DatabaseAuthUserRepository(ioc.get(IDatabase), tables),
+                singleton: true,
+            },
+            {
+                provide: AUTH_TOKENS.ApiKeyRepository,
+                useFactory: ioc => new DatabaseApiKeyRepository(ioc.get(IDatabase), ioc.get(AUTH_DB_TOKENS.ApiKeyHasher), tables),
+                singleton: true,
+            },
+            {
+                provide: AUTH_TOKENS.ApiKeyUsageRecorder,
+                useFactory: ioc => new DatabaseApiKeyUsageRecorder(ioc.get(IDatabase), tables),
+                singleton: true,
+            },
+            {
+                provide: AUTH_DB_TOKENS.UserService,
+                useFactory: ioc => new DatabaseUserService(ioc.get(IDatabase), tables),
+                singleton: true,
+            },
+            ...(config.audit
+                ? [{
+                        provide: AUTH_DB_TOKENS.EventStore,
+                        useFactory: (ioc) => new DatabaseAuthEventStore(ioc.get(IDatabase), tables),
+                        singleton: true,
+                    }]
+                : []),
+            {
+                provide: AUTH_DB_TOKENS.ApiKeyService,
+                useFactory: ioc => new DatabaseApiKeyService(ioc.get(IDatabase), ioc.get(AUTH_DB_TOKENS.ApiKeyHasher), tables, config.audit ? ioc.get(AUTH_DB_TOKENS.EventStore) : undefined),
+                singleton: true,
+            },
+        ];
+    }
+}
+//# sourceMappingURL=auth-database-module.js.map

package/lib/auth-database-module.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth-database-module.js","sourceRoot":"","sources":["../src/auth-database-module.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,WAAW,EAAE,MAAM,cAAc,CAAC;AAC3C,OAAO,EAAE,cAAc,EAAuC,MAAM,kBAAkB,CAAC;AACvF,OAAO,EAAE,SAAS,EAAE,MAAM,YAAY,CAAC;AAGvC,OAAO,EAAE,kBAAkB,EAAqB,MAAM,qBAAqB,CAAC;AAE5E,OAAO,EAAE,wBAAwB,EAAE,MAAM,kCAAkC,CAAC;AAC5E,OAAO,EAAE,qBAAqB,EAAE,MAAM,+BAA+B,CAAC;AACtE,OAAO,EAAE,2BAA2B,EAAE,MAAM,sCAAsC,CAAC;AACnF,OAAO,EAAE,0BAA0B,EAAE,MAAM,oCAAoC,CAAC;AAChF,OAAO,EAAE,sBAAsB,EAAE,MAAM,gCAAgC,CAAC;AACxE,OAAO,EAAE,mBAAmB,EAAE,MAAM,4BAA4B,CAAC;AACjE,OAAO,EAAE,cAAc,EAAE,MAAM,aAAa,CAAC;AAS7C,MAAM,OAAO,kBAAkB;IAM7B,YAAY,SAAmC,EAAE;QALxC,aAAQ,GAAG,cAAc,CAAC,IAAI,CAAC;QAC/B,YAAO,GAAG,EAAE,EAAE,EAAE,SAAS,EAAE,CAAC;QAKnC,MAAM,MAAM,GAAG,MAAM,CAAC,MAAM,IAAI,EAAE,CAAC;QACnC,MAAM,MAAM,GAAG,MAAM,CAAC,YAAY,IAAI,IAAI,kBAAkB,EAAE,CAAC;QAC/D,IAAI,CAAC,OAAO,GAAG;YACb,cAAc,EAAE,WAAW,CAAC,cAAc;YAC1C,gBAAgB,EAAE,WAAW,CAAC,gBAAgB;YAC9C,mBAAmB,EAAE,WAAW,CAAC,mBAAmB;YACpD,YAAY,EAAE,cAAc,CAAC,YAAY;YACzC,WAAW,EAAE,cAAc,CAAC,WAAW;YACvC,aAAa,EAAE,cAAc,CAAC,aAAa;YAC3C,GAAG,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,cAAc,CAAC,UAAU,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SACnE,CAAC;QACF,IAAI,CAAC,SAAS,GAAG;YACf;gBACE,OAAO,EAAE,cAAc,CAAC,YAAY;gBACpC,WAAW,EAAE,MAAM;aACpB;YACD;gBACE,OAAO,EAAE,WAAW,CAAC,cAAc;gBACnC,UAAU,EAAE,GAAG,CAAC,EAAE,CAAC,IAAI,0BAA0B,CAAC,GAAG,CAAC,GAAG,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC;gBAC7E,SAAS,EAAE,IAAI;aAChB;YACD;gBACE,OAAO,EAAE,WAAW,CAAC,gBAAgB;gBACrC,UAAU,EAAE,GAAG,CAAC,EAAE,CAAC,IAAI,wBAAwB,CAC7C,GAAG,CAAC,GAAG,CAAC,SAAS,CAAC,EAClB,GAAG,CAAC,GAAG,CAAC,cAAc,CAAC,YAAY,CAAC,EACpC,MAAM,CACP;gBACD,SAAS,EAAE,IAAI;aAChB;YACD;gBACE,OAAO,EAAE,WAAW,CAAC,mBAAmB;gBACxC,UAAU,EAAE,GAAG,CAAC,EAAE,CAAC,IAAI,2BAA2B,CAAC,GAAG,CAAC,GAAG,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC;gBAC9E,SAAS,EAAE,IAAI;aAChB;YACD;gBACE,OAAO,EAAE,cAAc,CAAC,WAAW;gBACnC,UAAU,EAAE,GAAG,CAAC,EAAE,CAAC,IAAI,mBAAmB,CAAC,GAAG,CAAC,GAAG,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC;gBACtE,SAAS,EAAE,IAAI;aAChB;YACD,GAAG,CAAC,MAAM,CAAC,KAAK;gBACd,CAAC,CAAC,CAAC;wBACC,OAAO,EAAE,cAAc,CAAC,UAAU;wBAClC,UAAU,EAAE,CAAC,GAAc,EAAE,EAAE,CAAC,IAAI,sBAAsB,CAAC,GAAG,CAAC,GAAG,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC;wBACtF,SAAS,EAAE,IAAI;qBAChB,CAAC;gBACJ,CAAC,CAAC,EAAE,CAAC;YACP;gBACE,OAAO,EAAE,cAAc,CAAC,aAAa;gBACrC,UAAU,EAAE,GAAG,CAAC,EAAE,CAAC,IAAI,qBAAqB,CAC1C,GAAG,CAAC,GAAG,CAAC,SAAS,CAAC,EAClB,GAAG,CAAC,GAAG,CAAC,cAAc,CAAC,YAAY,CAAC,EACpC,MAAM,EACN,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,cAAc,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,SAAS,CAC9D;gBACD,SAAS,EAAE,IAAI;aAChB;SACF,CAAC;IACJ,CAAC;CACF"}

package/lib/auth-database-tables.d.ts

@@ -0,0 +1,9 @@
+export interface AuthDatabaseTables {
+    users: string;
+    roles: string;
+    userRoles: string;
+    apiKeys: string;
+    authEvents: string;
+}
+export declare const DEFAULT_AUTH_DATABASE_TABLES: Readonly<AuthDatabaseTables>;
+export declare function resolveAuthDatabaseTables(tables?: Partial<AuthDatabaseTables>): AuthDatabaseTables;

package/lib/auth-database-tables.js

@@ -0,0 +1,18 @@
+export const DEFAULT_AUTH_DATABASE_TABLES = {
+    users: 'users',
+    roles: 'roles',
+    userRoles: 'user_roles',
+    apiKeys: 'api_keys',
+    authEvents: 'auth_events',
+};
+export function resolveAuthDatabaseTables(tables = {}) {
+    const resolved = { ...DEFAULT_AUTH_DATABASE_TABLES, ...tables };
+    Object.values(resolved).forEach(assertSqlIdentifier);
+    return resolved;
+}
+function assertSqlIdentifier(identifier) {
+    if (!/^[A-Za-z_][A-Za-z0-9_]*$/.test(identifier)) {
+        throw new Error(`Invalid auth database table name '${identifier}'`);
+    }
+}
+//# sourceMappingURL=auth-database-tables.js.map

package/lib/auth-database-tables.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth-database-tables.js","sourceRoot":"","sources":["../src/auth-database-tables.ts"],"names":[],"mappings":"AAQA,MAAM,CAAC,MAAM,4BAA4B,GAAiC;IACxE,KAAK,EAAE,OAAO;IACd,KAAK,EAAE,OAAO;IACd,SAAS,EAAE,YAAY;IACvB,OAAO,EAAE,UAAU;IACnB,UAAU,EAAE,aAAa;CAC1B,CAAC;AAEF,MAAM,UAAU,yBAAyB,CACvC,SAAsC,EAAE;IAExC,MAAM,QAAQ,GAAG,EAAE,GAAG,4BAA4B,EAAE,GAAG,MAAM,EAAE,CAAC;IAChE,MAAM,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,OAAO,CAAC,mBAAmB,CAAC,CAAC;IACrD,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED,SAAS,mBAAmB,CAAC,UAAkB;IAC7C,IAAI,CAAC,0BAA0B,CAAC,IAAI,CAAC,UAAU,CAAC,EAAE,CAAC;QACjD,MAAM,IAAI,KAAK,CAAC,qCAAqC,UAAU,GAAG,CAAC,CAAC;IACtE,CAAC;AACH,CAAC"}

package/lib/database-api-key-repository.d.ts

@@ -0,0 +1,11 @@
+import type { ApiKeyCredential, ApiKeyRepository } from '@kurdel/auth';
+import type { IDatabase } from '@kurdel/db';
+import type { ApiKeyHasher } from './api-key-hasher.js';
+import { type AuthDatabaseTables } from './auth-database-tables.js';
+export declare class DatabaseApiKeyRepository implements ApiKeyRepository {
+    private readonly db;
+    private readonly hasher;
+    private readonly tables;
+    constructor(db: IDatabase, hasher: ApiKeyHasher, tables?: Partial<AuthDatabaseTables>);
+    findByKey(key: string): Promise<ApiKeyCredential | null>;
+}

package/lib/database-api-key-repository.js

@@ -0,0 +1,27 @@
+import { resolveAuthDatabaseTables, } from './auth-database-tables.js';
+export class DatabaseApiKeyRepository {
+    constructor(db, hasher, tables = {}) {
+        this.db = db;
+        this.hasher = hasher;
+        this.tables = resolveAuthDatabaseTables(tables);
+    }
+    async findByKey(key) {
+        const record = await this.db.get({
+            sql: [
+                'SELECT id, user_id, status, expires_at',
+                `FROM ${this.tables.apiKeys}`,
+                'WHERE key_hash = ?;',
+            ].join(' '),
+            params: [this.hasher.hash(key)],
+        });
+        if (!record)
+            return null;
+        return {
+            id: record.id,
+            userId: record.user_id,
+            revoked: record.status !== 'active',
+            expiresAt: record.expires_at ? new Date(record.expires_at) : undefined,
+        };
+    }
+}
+//# sourceMappingURL=database-api-key-repository.js.map

package/lib/database-api-key-repository.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"database-api-key-repository.js","sourceRoot":"","sources":["../src/database-api-key-repository.ts"],"names":[],"mappings":"AAIA,OAAO,EACL,yBAAyB,GAE1B,MAAM,2BAA2B,CAAC;AASnC,MAAM,OAAO,wBAAwB;IAGnC,YACmB,EAAa,EACb,MAAoB,EACrC,SAAsC,EAAE;QAFvB,OAAE,GAAF,EAAE,CAAW;QACb,WAAM,GAAN,MAAM,CAAc;QAGrC,IAAI,CAAC,MAAM,GAAG,yBAAyB,CAAC,MAAM,CAAC,CAAC;IAClD,CAAC;IAED,KAAK,CAAC,SAAS,CAAC,GAAW;QACzB,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,EAAE,CAAC,GAAG,CAAC;YAC/B,GAAG,EAAE;gBACH,wCAAwC;gBACxC,QAAQ,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE;gBAC7B,qBAAqB;aACtB,CAAC,IAAI,CAAC,GAAG,CAAC;YACX,MAAM,EAAE,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;SAChC,CAA6B,CAAC;QAC/B,IAAI,CAAC,MAAM;YAAE,OAAO,IAAI,CAAC;QAEzB,OAAO;YACL,EAAE,EAAE,MAAM,CAAC,EAAE;YACb,MAAM,EAAE,MAAM,CAAC,OAAO;YACtB,OAAO,EAAE,MAAM,CAAC,MAAM,KAAK,QAAQ;YACnC,SAAS,EAAE,MAAM,CAAC,UAAU,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,SAAS;SACvE,CAAC;IACJ,CAAC;CACF"}

package/lib/database-api-key-service.d.ts

@@ -0,0 +1,52 @@
+import type { AuthEvent, AuthEventSink } from '@kurdel/auth';
+import type { IDatabase, IDatabaseSession } from '@kurdel/db';
+import type { ApiKeyHasher } from './api-key-hasher.js';
+import { type AuthDatabaseTables } from './auth-database-tables.js';
+type TransactionalAuthEventSink = AuthEventSink & {
+    report(event: AuthEvent, database?: IDatabaseSession): Promise<void> | void;
+};
+export interface CreateApiKeyInput {
+    userId: number;
+    name: string;
+    expiresAt?: Date;
+}
+export interface CreatedApiKey {
+    id: string;
+    key: string;
+    name: string;
+    expiresAt: string | null;
+}
+export interface ApiKeyMetadata {
+    id: string;
+    name: string;
+    status: 'active' | 'revoked' | 'expired';
+    expiresAt: string | null;
+    lastUsedAt: string | null;
+    createdAt: string;
+}
+export declare class ActiveUserNotFoundError extends Error {
+    readonly userId: number;
+    constructor(userId: number);
+}
+export declare class ApiKeyUserNotFoundError extends Error {
+    readonly userId: number;
+    constructor(userId: number);
+}
+export declare class ApiKeyNotFoundError extends Error {
+    readonly userId: number;
+    readonly apiKeyId: string;
+    constructor(userId: number, apiKeyId: string);
+}
+export declare class DatabaseApiKeyService {
+    private readonly db;
+    private readonly hasher;
+    private readonly events?;
+    private readonly now;
+    private readonly tables;
+    constructor(db: IDatabase, hasher: ApiKeyHasher, tables?: Partial<AuthDatabaseTables>, events?: TransactionalAuthEventSink | undefined, now?: () => Date);
+    list(userId: number): Promise<ApiKeyMetadata[]>;
+    create(input: CreateApiKeyInput): Promise<CreatedApiKey>;
+    revoke(userId: number, apiKeyId: string): Promise<void>;
+    private effectiveStatus;
+}
+export {};

package/lib/database-api-key-service.js

@@ -0,0 +1,110 @@
+import crypto from 'node:crypto';
+import { resolveAuthDatabaseTables, } from './auth-database-tables.js';
+export class ActiveUserNotFoundError extends Error {
+    constructor(userId) {
+        super(`Active user '${userId}' was not found`);
+        this.userId = userId;
+    }
+}
+export class ApiKeyUserNotFoundError extends Error {
+    constructor(userId) {
+        super(`User '${userId}' was not found`);
+        this.userId = userId;
+    }
+}
+export class ApiKeyNotFoundError extends Error {
+    constructor(userId, apiKeyId) {
+        super(`API key '${apiKeyId}' was not found for user '${userId}'`);
+        this.userId = userId;
+        this.apiKeyId = apiKeyId;
+    }
+}
+export class DatabaseApiKeyService {
+    constructor(db, hasher, tables = {}, events, now = () => new Date()) {
+        this.db = db;
+        this.hasher = hasher;
+        this.events = events;
+        this.now = now;
+        this.tables = resolveAuthDatabaseTables(tables);
+    }
+    async list(userId) {
+        const user = (await this.db.get({
+            sql: `SELECT id, status FROM ${this.tables.users} WHERE id = ?;`,
+            params: [userId],
+        }));
+        if (!user)
+            throw new ApiKeyUserNotFoundError(userId);
+        const records = (await this.db.all({
+            sql: [
+                'SELECT id, name, status, expires_at, last_used_at, created_at',
+                `FROM ${this.tables.apiKeys} WHERE user_id = ? ORDER BY created_at DESC, id DESC;`,
+            ].join(' '),
+            params: [userId],
+        }));
+        return records.map(record => ({
+            id: record.id,
+            name: record.name,
+            status: this.effectiveStatus(record),
+            expiresAt: record.expires_at,
+            lastUsedAt: record.last_used_at,
+            createdAt: record.created_at,
+        }));
+    }
+    async create(input) {
+        const id = crypto.randomUUID();
+        const key = `kdl_${crypto.randomBytes(32).toString('base64url')}`;
+        const expiresAt = input.expiresAt?.toISOString() ?? null;
+        await this.db.transaction(async (transaction) => {
+            const user = (await transaction.get({
+                sql: `SELECT id, status FROM ${this.tables.users} WHERE id = ?;`,
+                params: [input.userId],
+            }));
+            if (!user || user.status !== 'active') {
+                throw new ActiveUserNotFoundError(input.userId);
+            }
+            await transaction.run({
+                sql: [
+                    `INSERT INTO ${this.tables.apiKeys}`,
+                    '(id, user_id, key_hash, name, status, expires_at)',
+                    'VALUES (?, ?, ?, ?, ?, ?);',
+                ].join(' '),
+                params: [id, input.userId, this.hasher.hash(key), input.name, 'active', expiresAt],
+            });
+            await this.events?.report({
+                type: 'api-key.issued',
+                occurredAt: this.now(),
+                userId: input.userId,
+                credential: { type: 'api-key', id },
+            }, transaction);
+        });
+        return { id, key, name: input.name, expiresAt };
+    }
+    async revoke(userId, apiKeyId) {
+        await this.db.transaction(async (transaction) => {
+            const apiKey = (await transaction.get({
+                sql: `SELECT id FROM ${this.tables.apiKeys} WHERE id = ? AND user_id = ?;`,
+                params: [apiKeyId, userId],
+            }));
+            if (!apiKey)
+                throw new ApiKeyNotFoundError(userId, apiKeyId);
+            await transaction.run({
+                sql: `UPDATE ${this.tables.apiKeys} SET status = 'revoked' WHERE id = ? AND user_id = ?;`,
+                params: [apiKeyId, userId],
+            });
+            await this.events?.report({
+                type: 'api-key.revoked',
+                occurredAt: this.now(),
+                userId,
+                credential: { type: 'api-key', id: apiKeyId },
+            }, transaction);
+        });
+    }
+    effectiveStatus(record) {
+        if (record.status === 'revoked')
+            return 'revoked';
+        if (record.expires_at && new Date(record.expires_at).getTime() <= Date.now())
+            return 'expired';
+        return 'active';
+    }
+}
+//# sourceMappingURL=database-api-key-service.js.map

package/lib/database-api-key-service.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"database-api-key-service.js","sourceRoot":"","sources":["../src/database-api-key-service.ts"],"names":[],"mappings":"AAAA,OAAO,MAAM,MAAM,aAAa,CAAC;AAMjC,OAAO,EACL,yBAAyB,GAE1B,MAAM,2BAA2B,CAAC;AA0CnC,MAAM,OAAO,uBAAwB,SAAQ,KAAK;IAChD,YAAqB,MAAc;QACjC,KAAK,CAAC,gBAAgB,MAAM,iBAAiB,CAAC,CAAC;QAD5B,WAAM,GAAN,MAAM,CAAQ;IAEnC,CAAC;CACF;AAED,MAAM,OAAO,uBAAwB,SAAQ,KAAK;IAChD,YAAqB,MAAc;QACjC,KAAK,CAAC,SAAS,MAAM,iBAAiB,CAAC,CAAC;QADrB,WAAM,GAAN,MAAM,CAAQ;IAEnC,CAAC;CACF;AAED,MAAM,OAAO,mBAAoB,SAAQ,KAAK;IAC5C,YACW,MAAc,EACd,QAAgB;QAEzB,KAAK,CAAC,YAAY,QAAQ,6BAA6B,MAAM,GAAG,CAAC,CAAC;QAHzD,WAAM,GAAN,MAAM,CAAQ;QACd,aAAQ,GAAR,QAAQ,CAAQ;IAG3B,CAAC;CACF;AAED,MAAM,OAAO,qBAAqB;IAGhC,YACmB,EAAa,EACb,MAAoB,EACrC,SAAsC,EAAE,EACvB,MAAmC,EACnC,MAAkB,GAAG,EAAE,CAAC,IAAI,IAAI,EAAE;QAJlC,OAAE,GAAF,EAAE,CAAW;QACb,WAAM,GAAN,MAAM,CAAc;QAEpB,WAAM,GAAN,MAAM,CAA6B;QACnC,QAAG,GAAH,GAAG,CAA+B;QAEnD,IAAI,CAAC,MAAM,GAAG,yBAAyB,CAAC,MAAM,CAAC,CAAC;IAClD,CAAC;IAED,KAAK,CAAC,IAAI,CAAC,MAAc;QACvB,MAAM,IAAI,GAAG,CAAC,MAAM,IAAI,CAAC,EAAE,CAAC,GAAG,CAAC;YAC9B,GAAG,EAAE,0BAA0B,IAAI,CAAC,MAAM,CAAC,KAAK,gBAAgB;YAChE,MAAM,EAAE,CAAC,MAAM,CAAC;SACjB,CAAC,CAA2B,CAAC;QAC9B,IAAI,CAAC,IAAI;YAAE,MAAM,IAAI,uBAAuB,CAAC,MAAM,CAAC,CAAC;QAErD,MAAM,OAAO,GAAG,CAAC,MAAM,IAAI,CAAC,EAAE,CAAC,GAAG,CAAC;YACjC,GAAG,EAAE;gBACH,+DAA+D;gBAC/D,QAAQ,IAAI,CAAC,MAAM,CAAC,OAAO,uDAAuD;aACnF,CAAC,IAAI,CAAC,GAAG,CAAC;YACX,MAAM,EAAE,CAAC,MAAM,CAAC;SACjB,CAAC,CAAmB,CAAC;QACtB,OAAO,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;YAC5B,EAAE,EAAE,MAAM,CAAC,EAAE;YACb,IAAI,EAAE,MAAM,CAAC,IAAI;YACjB,MAAM,EAAE,IAAI,CAAC,eAAe,CAAC,MAAM,CAAC;YACpC,SAAS,EAAE,MAAM,CAAC,UAAU;YAC5B,UAAU,EAAE,MAAM,CAAC,YAAY;YAC/B,SAAS,EAAE,MAAM,CAAC,UAAU;SAC7B,CAAC,CAAC,CAAC;IACN,CAAC;IAED,KAAK,CAAC,MAAM,CAAC,KAAwB;QACnC,MAAM,EAAE,GAAG,MAAM,CAAC,UAAU,EAAE,CAAC;QAC/B,MAAM,GAAG,GAAG,OAAO,MAAM,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,EAAE,CAAC;QAClE,MAAM,SAAS,GAAG,KAAK,CAAC,SAAS,EAAE,WAAW,EAAE,IAAI,IAAI,CAAC;QAEzD,MAAM,IAAI,CAAC,EAAE,CAAC,WAAW,CAAC,KAAK,EAAC,WAAW,EAAC,EAAE;YAC5C,MAAM,IAAI,GAAG,CAAC,MAAM,WAAW,CAAC,GAAG,CAAC;gBAClC,GAAG,EAAE,0BAA0B,IAAI,CAAC,MAAM,CAAC,KAAK,gBAAgB;gBAChE,MAAM,EAAE,CAAC,KAAK,CAAC,MAAM,CAAC;aACvB,CAAC,CAA2B,CAAC;YAC9B,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,MAAM,KAAK,QAAQ,EAAE,CAAC;gBACtC,MAAM,IAAI,uBAAuB,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;YAClD,CAAC;YAED,MAAM,WAAW,CAAC,GAAG,CAAC;gBACpB,GAAG,EAAE;oBACH,eAAe,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE;oBACpC,mDAAmD;oBACnD,4BAA4B;iBAC7B,CAAC,IAAI,CAAC,GAAG,CAAC;gBACX,MAAM,EAAE,CAAC,EAAE,EAAE,KAAK,CAAC,MAAM,EAAE,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,KAAK,CAAC,IAAI,EAAE,QAAQ,EAAE,SAAS,CAAC;aACnF,CAAC,CAAC;YAEH,MAAM,IAAI,CAAC,MAAM,EAAE,MAAM,CAAC;gBACxB,IAAI,EAAE,gBAAgB;gBACtB,UAAU,EAAE,IAAI,CAAC,GAAG,EAAE;gBACtB,MAAM,EAAE,KAAK,CAAC,MAAM;gBACpB,UAAU,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,EAAE,EAAE;aACpC,EAAE,WAAW,CAAC,CAAC;QAClB,CAAC,CAAC,CAAC;QAEH,OAAO,EAAE,EAAE,EAAE,GAAG,EAAE,IAAI,EAAE,KAAK,CAAC,IAAI,EAAE,SAAS,EAAE,CAAC;IAClD,CAAC;IAED,KAAK,CAAC,MAAM,CAAC,MAAc,EAAE,QAAgB;QAC3C,MAAM,IAAI,CAAC,EAAE,CAAC,WAAW,CAAC,KAAK,EAAC,WAAW,EAAC,EAAE;YAC5C,MAAM,MAAM,GAAG,CAAC,MAAM,WAAW,CAAC,GAAG,CAAC;gBACpC,GAAG,EAAE,kBAAkB,IAAI,CAAC,MAAM,CAAC,OAAO,gCAAgC;gBAC1E,MAAM,EAAE,CAAC,QAAQ,EAAE,MAAM,CAAC;aAC3B,CAAC,CAA+B,CAAC;YAClC,IAAI,CAAC,MAAM;gBAAE,MAAM,IAAI,mBAAmB,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC;YAE7D,MAAM,WAAW,CAAC,GAAG,CAAC;gBACpB,GAAG,EAAE,UAAU,IAAI,CAAC,MAAM,CAAC,OAAO,uDAAuD;gBACzF,MAAM,EAAE,CAAC,QAAQ,EAAE,MAAM,CAAC;aAC3B,CAAC,CAAC;YAEH,MAAM,IAAI,CAAC,MAAM,EAAE,MAAM,CAAC;gBACxB,IAAI,EAAE,iBAAiB;gBACvB,UAAU,EAAE,IAAI,CAAC,GAAG,EAAE;gBACtB,MAAM;gBACN,UAAU,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,EAAE,EAAE,QAAQ,EAAE;aAC9C,EAAE,WAAW,CAAC,CAAC;QAClB,CAAC,CAAC,CAAC;IACL,CAAC;IAEO,eAAe,CAAC,MAAoB;QAC1C,IAAI,MAAM,CAAC,MAAM,KAAK,SAAS;YAAE,OAAO,SAAS,CAAC;QAClD,IAAI,MAAM,CAAC,UAAU,IAAI,IAAI,IAAI,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC,OAAO,EAAE,IAAI,IAAI,CAAC,GAAG,EAAE;YAAE,OAAO,SAAS,CAAC;QAC/F,OAAO,QAAQ,CAAC;IAClB,CAAC;CACF"}

package/lib/database-api-key-usage-recorder.d.ts

@@ -0,0 +1,10 @@
+import type { ApiKeyUsageRecorder } from '@kurdel/auth';
+import type { IDatabase } from '@kurdel/db';
+import { type AuthDatabaseTables } from './auth-database-tables.js';
+/** Records the most recent successful use of a database-backed API key. */
+export declare class DatabaseApiKeyUsageRecorder implements ApiKeyUsageRecorder {
+    private readonly db;
+    private readonly tables;
+    constructor(db: IDatabase, tables?: Partial<AuthDatabaseTables>);
+    recordUsage(credentialId: string, usedAt: Date): Promise<void>;
+}

package/lib/database-api-key-usage-recorder.js

@@ -0,0 +1,15 @@
+import { resolveAuthDatabaseTables, } from './auth-database-tables.js';
+/** Records the most recent successful use of a database-backed API key. */
+export class DatabaseApiKeyUsageRecorder {
+    constructor(db, tables = {}) {
+        this.db = db;
+        this.tables = resolveAuthDatabaseTables(tables);
+    }
+    async recordUsage(credentialId, usedAt) {
+        await this.db.run({
+            sql: `UPDATE ${this.tables.apiKeys} SET last_used_at = ? WHERE id = ?;`,
+            params: [usedAt.toISOString(), credentialId],
+        });
+    }
+}
+//# sourceMappingURL=database-api-key-usage-recorder.js.map

package/lib/database-api-key-usage-recorder.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"database-api-key-usage-recorder.js","sourceRoot":"","sources":["../src/database-api-key-usage-recorder.ts"],"names":[],"mappings":"AAGA,OAAO,EACL,yBAAyB,GAE1B,MAAM,2BAA2B,CAAC;AAEnC,2EAA2E;AAC3E,MAAM,OAAO,2BAA2B;IAGtC,YACmB,EAAa,EAC9B,SAAsC,EAAE;QADvB,OAAE,GAAF,EAAE,CAAW;QAG9B,IAAI,CAAC,MAAM,GAAG,yBAAyB,CAAC,MAAM,CAAC,CAAC;IAClD,CAAC;IAED,KAAK,CAAC,WAAW,CAAC,YAAoB,EAAE,MAAY;QAClD,MAAM,IAAI,CAAC,EAAE,CAAC,GAAG,CAAC;YAChB,GAAG,EAAE,UAAU,IAAI,CAAC,MAAM,CAAC,OAAO,qCAAqC;YACvE,MAAM,EAAE,CAAC,MAAM,CAAC,WAAW,EAAE,EAAE,YAAY,CAAC;SAC7C,CAAC,CAAC;IACL,CAAC;CACF"}

package/lib/database-auth-event-store.d.ts

@@ -0,0 +1,27 @@
+import type { AuthEvent, AuthEventSink } from '@kurdel/auth';
+import type { IDatabase, IDatabaseSession } from '@kurdel/db';
+import { type AuthDatabaseTables } from './auth-database-tables.js';
+export type StoredAuthEvent = {
+    id: number;
+    type: AuthEvent['type'];
+    occurredAt: string;
+    strategy: string | null;
+    userId: string | null;
+    credentialType: string | null;
+    credentialId: string | null;
+    reason: string | null;
+    policy: string | null;
+};
+export type ListAuthEventsInput = {
+    userId?: string | number;
+    type?: AuthEvent['type'];
+    limit?: number;
+};
+/** Persists and queries sanitized authentication audit events. */
+export declare class DatabaseAuthEventStore implements AuthEventSink {
+    private readonly db;
+    private readonly tables;
+    constructor(db: IDatabase, tables?: Partial<AuthDatabaseTables>);
+    report(event: AuthEvent, database?: IDatabaseSession): Promise<void>;
+    list(input?: ListAuthEventsInput): Promise<StoredAuthEvent[]>;
+}

package/lib/database-auth-event-store.js

@@ -0,0 +1,62 @@
+import { resolveAuthDatabaseTables, } from './auth-database-tables.js';
+/** Persists and queries sanitized authentication audit events. */
+export class DatabaseAuthEventStore {
+    constructor(db, tables = {}) {
+        this.db = db;
+        this.tables = resolveAuthDatabaseTables(tables);
+    }
+    async report(event, database = this.db) {
+        await database.run({
+            sql: [
+                `INSERT INTO ${this.tables.authEvents}`,
+                '(type, occurred_at, strategy, user_id, credential_type, credential_id, reason, policy)',
+                'VALUES (?, ?, ?, ?, ?, ?, ?, ?);',
+            ].join(' '),
+            params: [
+                event.type,
+                event.occurredAt.toISOString(),
+                'strategy' in event ? event.strategy ?? null : null,
+                event.userId === undefined ? null : String(event.userId),
+                event.credential?.type ?? null,
+                event.credential?.id ?? null,
+                'reason' in event ? event.reason : null,
+                'policy' in event ? event.policy ?? null : null,
+            ],
+        });
+    }
+    async list(input = {}) {
+        const conditions = [];
+        const params = [];
+        if (input.userId !== undefined) {
+            conditions.push('user_id = ?');
+            params.push(String(input.userId));
+        }
+        if (input.type) {
+            conditions.push('type = ?');
+            params.push(input.type);
+        }
+        const where = conditions.length > 0 ? `WHERE ${conditions.join(' AND ')}` : '';
+        const limit = Math.min(Math.max(input.limit ?? 50, 1), 100);
+        const records = await this.db.all({
+            sql: [
+                'SELECT id, type, occurred_at, strategy, user_id,',
+                'credential_type, credential_id, reason, policy',
+                `FROM ${this.tables.authEvents} ${where}`,
+                'ORDER BY occurred_at DESC, id DESC LIMIT ?;',
+            ].join(' '),
+            params: [...params, limit],
+        });
+        return records.map(record => ({
+            id: record.id,
+            type: record.type,
+            occurredAt: record.occurred_at,
+            strategy: record.strategy,
+            userId: record.user_id,
+            credentialType: record.credential_type,
+            credentialId: record.credential_id,
+            reason: record.reason,
+            policy: record.policy,
+        }));
+    }
+}
+//# sourceMappingURL=database-auth-event-store.js.map

package/lib/database-auth-event-store.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"database-auth-event-store.js","sourceRoot":"","sources":["../src/database-auth-event-store.ts"],"names":[],"mappings":"AAGA,OAAO,EACL,yBAAyB,GAE1B,MAAM,2BAA2B,CAAC;AAgCnC,kEAAkE;AAClE,MAAM,OAAO,sBAAsB;IAGjC,YACmB,EAAa,EAC9B,SAAsC,EAAE;QADvB,OAAE,GAAF,EAAE,CAAW;QAG9B,IAAI,CAAC,MAAM,GAAG,yBAAyB,CAAC,MAAM,CAAC,CAAC;IAClD,CAAC;IAED,KAAK,CAAC,MAAM,CAAC,KAAgB,EAAE,WAA6B,IAAI,CAAC,EAAE;QACjE,MAAM,QAAQ,CAAC,GAAG,CAAC;YACjB,GAAG,EAAE;gBACH,eAAe,IAAI,CAAC,MAAM,CAAC,UAAU,EAAE;gBACvC,wFAAwF;gBACxF,kCAAkC;aACnC,CAAC,IAAI,CAAC,GAAG,CAAC;YACX,MAAM,EAAE;gBACN,KAAK,CAAC,IAAI;gBACV,KAAK,CAAC,UAAU,CAAC,WAAW,EAAE;gBAC9B,UAAU,IAAI,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,QAAQ,IAAI,IAAI,CAAC,CAAC,CAAC,IAAI;gBACnD,KAAK,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC;gBACxD,KAAK,CAAC,UAAU,EAAE,IAAI,IAAI,IAAI;gBAC9B,KAAK,CAAC,UAAU,EAAE,EAAE,IAAI,IAAI;gBAC5B,QAAQ,IAAI,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI;gBACvC,QAAQ,IAAI,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,MAAM,IAAI,IAAI,CAAC,CAAC,CAAC,IAAI;aAChD;SACF,CAAC,CAAC;IACL,CAAC;IAED,KAAK,CAAC,IAAI,CAAC,QAA6B,EAAE;QACxC,MAAM,UAAU,GAAa,EAAE,CAAC;QAChC,MAAM,MAAM,GAAc,EAAE,CAAC;QAC7B,IAAI,KAAK,CAAC,MAAM,KAAK,SAAS,EAAE,CAAC;YAC/B,UAAU,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC;YAC/B,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC;QACpC,CAAC;QACD,IAAI,KAAK,CAAC,IAAI,EAAE,CAAC;YACf,UAAU,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;YAC5B,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;QAC1B,CAAC;QACD,MAAM,KAAK,GAAG,UAAU,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,SAAS,UAAU,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC/E,MAAM,KAAK,GAAG,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,KAAK,IAAI,EAAE,EAAE,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;QAC5D,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,EAAE,CAAC,GAAG,CAAC;YAChC,GAAG,EAAE;gBACH,kDAAkD;gBAClD,gDAAgD;gBAChD,QAAQ,IAAI,CAAC,MAAM,CAAC,UAAU,IAAI,KAAK,EAAE;gBACzC,6CAA6C;aAC9C,CAAC,IAAI,CAAC,GAAG,CAAC;YACX,MAAM,EAAE,CAAC,GAAG,MAAM,EAAE,KAAK,CAAC;SAC3B,CAAsB,CAAC;QAExB,OAAO,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;YAC5B,EAAE,EAAE,MAAM,CAAC,EAAE;YACb,IAAI,EAAE,MAAM,CAAC,IAAI;YACjB,UAAU,EAAE,MAAM,CAAC,WAAW;YAC9B,QAAQ,EAAE,MAAM,CAAC,QAAQ;YACzB,MAAM,EAAE,MAAM,CAAC,OAAO;YACtB,cAAc,EAAE,MAAM,CAAC,eAAe;YACtC,YAAY,EAAE,MAAM,CAAC,aAAa;YAClC,MAAM,EAAE,MAAM,CAAC,MAAM;YACrB,MAAM,EAAE,MAAM,CAAC,MAAM;SACtB,CAAC,CAAC,CAAC;IACN,CAAC;CACF"}

package/lib/database-auth-user-repository.d.ts

@@ -0,0 +1,10 @@
+import type { AuthUserRepository } from '@kurdel/auth';
+import type { AuthUser } from '@kurdel/common';
+import type { IDatabase } from '@kurdel/db';
+import { type AuthDatabaseTables } from './auth-database-tables.js';
+export declare class DatabaseAuthUserRepository implements AuthUserRepository {
+    private readonly db;
+    private readonly tables;
+    constructor(db: IDatabase, tables?: Partial<AuthDatabaseTables>);
+    findById(id: string | number): Promise<AuthUser | null>;
+}

package/lib/database-auth-user-repository.js

@@ -0,0 +1,28 @@
+import { resolveAuthDatabaseTables, } from './auth-database-tables.js';
+export class DatabaseAuthUserRepository {
+    constructor(db, tables = {}) {
+        this.db = db;
+        this.tables = resolveAuthDatabaseTables(tables);
+    }
+    async findById(id) {
+        const user = await this.db.get({
+            sql: `SELECT id, status FROM ${this.tables.users} WHERE id = ?;`,
+            params: [id],
+        });
+        if (!user || user.status !== 'active')
+            return null;
+        const roles = await this.db.all({
+            sql: [
+                `SELECT ${this.tables.roles}.name`,
+                `FROM ${this.tables.roles}`,
+                `INNER JOIN ${this.tables.userRoles}`,
+                `ON ${this.tables.userRoles}.role_id = ${this.tables.roles}.id`,
+                `WHERE ${this.tables.userRoles}.user_id = ?`,
+                `ORDER BY ${this.tables.roles}.name;`,
+            ].join(' '),
+            params: [user.id],
+        });
+        return { id: user.id, roles: roles.map(role => role.name) };
+    }
+}
+//# sourceMappingURL=database-auth-user-repository.js.map

package/lib/database-auth-user-repository.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"database-auth-user-repository.js","sourceRoot":"","sources":["../src/database-auth-user-repository.ts"],"names":[],"mappings":"AAIA,OAAO,EACL,yBAAyB,GAE1B,MAAM,2BAA2B,CAAC;AAKnC,MAAM,OAAO,0BAA0B;IAGrC,YACmB,EAAa,EAC9B,SAAsC,EAAE;QADvB,OAAE,GAAF,EAAE,CAAW;QAG9B,IAAI,CAAC,MAAM,GAAG,yBAAyB,CAAC,MAAM,CAAC,CAAC;IAClD,CAAC;IAED,KAAK,CAAC,QAAQ,CAAC,EAAmB;QAChC,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,EAAE,CAAC,GAAG,CAAC;YAC7B,GAAG,EAAE,0BAA0B,IAAI,CAAC,MAAM,CAAC,KAAK,gBAAgB;YAChE,MAAM,EAAE,CAAC,EAAE,CAAC;SACb,CAA2B,CAAC;QAC7B,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,MAAM,KAAK,QAAQ;YAAE,OAAO,IAAI,CAAC;QAEnD,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,EAAE,CAAC,GAAG,CAAC;YAC9B,GAAG,EAAE;gBACH,UAAU,IAAI,CAAC,MAAM,CAAC,KAAK,OAAO;gBAClC,QAAQ,IAAI,CAAC,MAAM,CAAC,KAAK,EAAE;gBAC3B,cAAc,IAAI,CAAC,MAAM,CAAC,SAAS,EAAE;gBACrC,MAAM,IAAI,CAAC,MAAM,CAAC,SAAS,cAAc,IAAI,CAAC,MAAM,CAAC,KAAK,KAAK;gBAC/D,SAAS,IAAI,CAAC,MAAM,CAAC,SAAS,cAAc;gBAC5C,YAAY,IAAI,CAAC,MAAM,CAAC,KAAK,QAAQ;aACtC,CAAC,IAAI,CAAC,GAAG,CAAC;YACX,MAAM,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC;SAClB,CAAiB,CAAC;QAEnB,OAAO,EAAE,EAAE,EAAE,IAAI,CAAC,EAAE,EAAE,KAAK,EAAE,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;IAC9D,CAAC;CACF"}

package/lib/database-user-service.d.ts

@@ -0,0 +1,64 @@
+import type { IDatabase } from '@kurdel/db';
+import { type AuthDatabaseTables } from './auth-database-tables.js';
+export type UserStatus = 'active' | 'disabled';
+export interface CreateUserInput {
+    name: string;
+    email: string;
+    roles: string[];
+}
+export interface UpdateUserInput {
+    name?: string;
+    email?: string;
+    status?: UserStatus;
+    roles?: string[];
+}
+export interface ListUsersInput {
+    limit: number;
+    offset: number;
+    status?: UserStatus;
+}
+export interface ManagedUser {
+    id: number;
+    name: string;
+    email: string;
+    status: UserStatus;
+    roles: string[];
+    createdAt: string;
+    updatedAt: string;
+}
+export interface UserList {
+    users: ManagedUser[];
+    total: number;
+    limit: number;
+    offset: number;
+}
+export declare class UnknownRolesError extends Error {
+    readonly roles: string[];
+    constructor(roles: string[]);
+}
+export declare class UserNotFoundError extends Error {
+    readonly userId: number;
+    constructor(userId: number);
+}
+export declare class DuplicateUserEmailError extends Error {
+    readonly email: string;
+    constructor(email: string);
+}
+export declare class DatabaseUserService {
+    private readonly db;
+    private readonly tables;
+    constructor(db: IDatabase, tables?: Partial<AuthDatabaseTables>);
+    listRoles(): Promise<string[]>;
+    create(input: CreateUserInput): Promise<ManagedUser>;
+    list(input: ListUsersInput): Promise<UserList>;
+    findById(userId: number): Promise<ManagedUser>;
+    update(userId: number, input: UpdateUserInput): Promise<ManagedUser>;
+    delete(userId: number): Promise<void>;
+    private findRecord;
+    private resolveRoles;
+    private replaceRoles;
+    private loadRoles;
+    private mapUser;
+    private normalizeEmail;
+    private rethrowEmailConflict;
+}

package/lib/database-user-service.js

@@ -0,0 +1,214 @@
+import { resolveAuthDatabaseTables, } from './auth-database-tables.js';
+export class UnknownRolesError extends Error {
+    constructor(roles) {
+        super(`Unknown roles: ${roles.join(', ')}`);
+        this.roles = roles;
+    }
+}
+export class UserNotFoundError extends Error {
+    constructor(userId) {
+        super(`User ${userId} not found`);
+        this.userId = userId;
+    }
+}
+export class DuplicateUserEmailError extends Error {
+    constructor(email) {
+        super(`A user with email ${email} already exists`);
+        this.email = email;
+    }
+}
+export class DatabaseUserService {
+    constructor(db, tables = {}) {
+        this.db = db;
+        this.tables = resolveAuthDatabaseTables(tables);
+    }
+    async listRoles() {
+        const roles = (await this.db.all({
+            sql: `SELECT name FROM ${this.tables.roles} ORDER BY name;`,
+            params: [],
+        }));
+        return roles.map(role => role.name);
+    }
+    async create(input) {
+        const email = this.normalizeEmail(input.email);
+        const roles = await this.resolveRoles(input.roles);
+        try {
+            return await this.db.transaction(async (transaction) => {
+                const user = (await transaction.get({
+                    sql: [
+                        `INSERT INTO ${this.tables.users} (name, email, status)`,
+                        "VALUES (?, ?, 'active')",
+                        'RETURNING id, name, email, status, created_at, updated_at;',
+                    ].join(' '),
+                    params: [input.name, email],
+                }));
+                await this.replaceRoles(transaction, user.id, roles);
+                return this.mapUser(user, roles.map(role => role.name));
+            });
+        }
+        catch (error) {
+            this.rethrowEmailConflict(error, email);
+        }
+    }
+    async list(input) {
+        const where = input.status ? 'WHERE status = ?' : '';
+        const params = input.status ? [input.status] : [];
+        const records = (await this.db.all({
+            sql: [
+                'SELECT id, name, email, status, created_at, updated_at',
+                `FROM ${this.tables.users} ${where}`,
+                'ORDER BY id DESC LIMIT ? OFFSET ?;',
+            ].join(' '),
+            params: [...params, input.limit, input.offset],
+        }));
+        const count = (await this.db.get({
+            sql: `SELECT COUNT(*) AS count FROM ${this.tables.users} ${where};`,
+            params,
+        }));
+        const roles = await this.loadRoles(records.map(user => user.id));
+        return {
+            users: records.map(user => this.mapUser(user, roles.get(user.id) ?? [])),
+            total: count.count,
+            limit: input.limit,
+            offset: input.offset,
+        };
+    }
+    async findById(userId) {
+        const user = await this.findRecord(userId);
+        if (!user)
+            throw new UserNotFoundError(userId);
+        const roles = await this.loadRoles([userId]);
+        return this.mapUser(user, roles.get(userId) ?? []);
+    }
+    async update(userId, input) {
+        const existing = await this.findRecord(userId);
+        if (!existing)
+            throw new UserNotFoundError(userId);
+        const roles = input.roles ? await this.resolveRoles(input.roles) : undefined;
+        const email = input.email ? this.normalizeEmail(input.email) : undefined;
+        try {
+            await this.db.transaction(async (transaction) => {
+                const updates = [];
+                const params = [];
+                for (const [column, value] of [
+                    ['name', input.name],
+                    ['email', email],
+                    ['status', input.status],
+                ]) {
+                    if (value !== undefined) {
+                        updates.push(`${column} = ?`);
+                        params.push(value);
+                    }
+                }
+                if (updates.length > 0 || roles) {
+                    updates.push('updated_at = CURRENT_TIMESTAMP');
+                    await transaction.run({
+                        sql: `UPDATE ${this.tables.users} SET ${updates.join(', ')} WHERE id = ?;`,
+                        params: [...params, userId],
+                    });
+                }
+                if (roles)
+                    await this.replaceRoles(transaction, userId, roles);
+            });
+        }
+        catch (error) {
+            this.rethrowEmailConflict(error, email);
+        }
+        return this.findById(userId);
+    }
+    async delete(userId) {
+        const existing = await this.findRecord(userId);
+        if (!existing)
+            throw new UserNotFoundError(userId);
+        await this.db.transaction(async (transaction) => {
+            await transaction.run({
+                sql: `DELETE FROM ${this.tables.apiKeys} WHERE user_id = ?;`,
+                params: [userId],
+            });
+            await transaction.run({
+                sql: `DELETE FROM ${this.tables.userRoles} WHERE user_id = ?;`,
+                params: [userId],
+            });
+            await transaction.run({
+                sql: `DELETE FROM ${this.tables.users} WHERE id = ?;`,
+                params: [userId],
+            });
+        });
+    }
+    async findRecord(userId) {
+        return (await this.db.get({
+            sql: [
+                'SELECT id, name, email, status, created_at, updated_at',
+                `FROM ${this.tables.users} WHERE id = ?;`,
+            ].join(' '),
+            params: [userId],
+        }));
+    }
+    async resolveRoles(names) {
+        const uniqueNames = [...new Set(names)];
+        const placeholders = uniqueNames.map(() => '?').join(', ');
+        const records = (await this.db.all({
+            sql: `SELECT id, name FROM ${this.tables.roles} WHERE name IN (${placeholders});`,
+            params: uniqueNames,
+        }));
+        const found = new Set(records.map(role => role.name));
+        const unknown = uniqueNames.filter(role => !found.has(role));
+        if (unknown.length > 0)
+            throw new UnknownRolesError(unknown);
+        const byName = new Map(records.map(role => [role.name, role]));
+        return uniqueNames.map(name => byName.get(name));
+    }
+    async replaceRoles(database, userId, roles) {
+        await database.run({
+            sql: `DELETE FROM ${this.tables.userRoles} WHERE user_id = ?;`,
+            params: [userId],
+        });
+        for (const role of roles) {
+            await database.run({
+                sql: `INSERT INTO ${this.tables.userRoles} (user_id, role_id) VALUES (?, ?);`,
+                params: [userId, role.id],
+            });
+        }
+    }
+    async loadRoles(userIds) {
+        const result = new Map();
+        if (userIds.length === 0)
+            return result;
+        const records = (await this.db.all({
+            sql: [
+                `SELECT ${this.tables.userRoles}.user_id, ${this.tables.roles}.name`,
+                `FROM ${this.tables.userRoles}`,
+                `INNER JOIN ${this.tables.roles}`,
+                `ON ${this.tables.roles}.id = ${this.tables.userRoles}.role_id`,
+                `WHERE ${this.tables.userRoles}.user_id IN (${userIds.map(() => '?').join(', ')})`,
+                `ORDER BY ${this.tables.roles}.name;`,
+            ].join(' '),
+            params: userIds,
+        }));
+        for (const role of records) {
+            result.set(role.user_id, [...(result.get(role.user_id) ?? []), role.name]);
+        }
+        return result;
+    }
+    mapUser(user, roles) {
+        return {
+            id: user.id,
+            name: user.name,
+            email: user.email,
+            status: user.status,
+            roles,
+            createdAt: user.created_at,
+            updatedAt: user.updated_at,
+        };
+    }
+    normalizeEmail(email) {
+        return email.toLowerCase();
+    }
+    rethrowEmailConflict(error, email) {
+        if (email && error instanceof Error && error.message.includes(`${this.tables.users}.email`)) {
+            throw new DuplicateUserEmailError(email);
+        }
+        throw error;
+    }
+}
+//# sourceMappingURL=database-user-service.js.map

package/lib/database-user-service.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"database-user-service.js","sourceRoot":"","sources":["../src/database-user-service.ts"],"names":[],"mappings":"AAEA,OAAO,EACL,yBAAyB,GAE1B,MAAM,2BAA2B,CAAC;AAwDnC,MAAM,OAAO,iBAAkB,SAAQ,KAAK;IAC1C,YAAqB,KAAe;QAClC,KAAK,CAAC,kBAAkB,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QADzB,UAAK,GAAL,KAAK,CAAU;IAEpC,CAAC;CACF;AAED,MAAM,OAAO,iBAAkB,SAAQ,KAAK;IAC1C,YAAqB,MAAc;QACjC,KAAK,CAAC,QAAQ,MAAM,YAAY,CAAC,CAAC;QADf,WAAM,GAAN,MAAM,CAAQ;IAEnC,CAAC;CACF;AAED,MAAM,OAAO,uBAAwB,SAAQ,KAAK;IAChD,YAAqB,KAAa;QAChC,KAAK,CAAC,qBAAqB,KAAK,iBAAiB,CAAC,CAAC;QADhC,UAAK,GAAL,KAAK,CAAQ;IAElC,CAAC;CACF;AAED,MAAM,OAAO,mBAAmB;IAG9B,YACmB,EAAa,EAC9B,SAAsC,EAAE;QADvB,OAAE,GAAF,EAAE,CAAW;QAG9B,IAAI,CAAC,MAAM,GAAG,yBAAyB,CAAC,MAAM,CAAC,CAAC;IAClD,CAAC;IAED,KAAK,CAAC,SAAS;QACb,MAAM,KAAK,GAAG,CAAC,MAAM,IAAI,CAAC,EAAE,CAAC,GAAG,CAAC;YAC/B,GAAG,EAAE,oBAAoB,IAAI,CAAC,MAAM,CAAC,KAAK,iBAAiB;YAC3D,MAAM,EAAE,EAAE;SACX,CAAC,CAA4B,CAAC;QAC/B,OAAO,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACtC,CAAC;IAED,KAAK,CAAC,MAAM,CAAC,KAAsB;QACjC,MAAM,KAAK,GAAG,IAAI,CAAC,cAAc,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;QAC/C,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,YAAY,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;QAEnD,IAAI,CAAC;YACH,OAAO,MAAM,IAAI,CAAC,EAAE,CAAC,WAAW,CAAC,KAAK,EAAC,WAAW,EAAC,EAAE;gBACnD,MAAM,IAAI,GAAG,CAAC,MAAM,WAAW,CAAC,GAAG,CAAC;oBAClC,GAAG,EAAE;wBACH,eAAe,IAAI,CAAC,MAAM,CAAC,KAAK,wBAAwB;wBACxD,yBAAyB;wBACzB,4DAA4D;qBAC7D,CAAC,IAAI,CAAC,GAAG,CAAC;oBACX,MAAM,EAAE,CAAC,KAAK,CAAC,IAAI,EAAE,KAAK,CAAC;iBAC5B,CAAC,CAAe,CAAC;gBAClB,MAAM,IAAI,CAAC,YAAY,CAAC,WAAW,EAAE,IAAI,CAAC,EAAE,EAAE,KAAK,CAAC,CAAC;gBACrD,OAAO,IAAI,CAAC,OAAO,CACjB,IAAI,EACJ,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,CAC7B,CAAC;YACJ,CAAC,CAAC,CAAC;QACL,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,CAAC,oBAAoB,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC;QAC1C,CAAC;IACH,CAAC;IAED,KAAK,CAAC,IAAI,CAAC,KAAqB;QAC9B,MAAM,KAAK,GAAG,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,kBAAkB,CAAC,CAAC,CAAC,EAAE,CAAC;QACrD,MAAM,MAAM,GAAG,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;QAClD,MAAM,OAAO,GAAG,CAAC,MAAM,IAAI,CAAC,EAAE,CAAC,GAAG,CAAC;YACjC,GAAG,EAAE;gBACH,wDAAwD;gBACxD,QAAQ,IAAI,CAAC,MAAM,CAAC,KAAK,IAAI,KAAK,EAAE;gBACpC,oCAAoC;aACrC,CAAC,IAAI,CAAC,GAAG,CAAC;YACX,MAAM,EAAE,CAAC,GAAG,MAAM,EAAE,KAAK,CAAC,KAAK,EAAE,KAAK,CAAC,MAAM,CAAC;SAC/C,CAAC,CAAiB,CAAC;QACpB,MAAM,KAAK,GAAG,CAAC,MAAM,IAAI,CAAC,EAAE,CAAC,GAAG,CAAC;YAC/B,GAAG,EAAE,iCAAiC,IAAI,CAAC,MAAM,CAAC,KAAK,IAAI,KAAK,GAAG;YACnE,MAAM;SACP,CAAC,CAAgB,CAAC;QACnB,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC;QAEjE,OAAO;YACL,KAAK,EAAE,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,EAAE,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,IAAI,EAAE,CAAC,CAAC;YACxE,KAAK,EAAE,KAAK,CAAC,KAAK;YAClB,KAAK,EAAE,KAAK,CAAC,KAAK;YAClB,MAAM,EAAE,KAAK,CAAC,MAAM;SACrB,CAAC;IACJ,CAAC;IAED,KAAK,CAAC,QAAQ,CAAC,MAAc;QAC3B,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC;QAC3C,IAAI,CAAC,IAAI;YAAE,MAAM,IAAI,iBAAiB,CAAC,MAAM,CAAC,CAAC;QAC/C,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,SAAS,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC;QAC7C,OAAO,IAAI,CAAC,OAAO,CAAC,IAAI,EAAE,KAAK,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC;IACrD,CAAC;IAED,KAAK,CAAC,MAAM,CAAC,MAAc,EAAE,KAAsB;QACjD,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC;QAC/C,IAAI,CAAC,QAAQ;YAAE,MAAM,IAAI,iBAAiB,CAAC,MAAM,CAAC,CAAC;QACnD,MAAM,KAAK,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,IAAI,CAAC,YAAY,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;QAC7E,MAAM,KAAK,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,cAAc,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;QAEzE,IAAI,CAAC;YACH,MAAM,IAAI,CAAC,EAAE,CAAC,WAAW,CAAC,KAAK,EAAC,WAAW,EAAC,EAAE;gBAC5C,MAAM,OAAO,GAAa,EAAE,CAAC;gBAC7B,MAAM,MAAM,GAAc,EAAE,CAAC;gBAC7B,KAAK,MAAM,CAAC,MAAM,EAAE,KAAK,CAAC,IAAI;oBAC5B,CAAC,MAAM,EAAE,KAAK,CAAC,IAAI,CAAC;oBACpB,CAAC,OAAO,EAAE,KAAK,CAAC;oBAChB,CAAC,QAAQ,EAAE,KAAK,CAAC,MAAM,CAAC;iBAChB,EAAE,CAAC;oBACX,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;wBACxB,OAAO,CAAC,IAAI,CAAC,GAAG,MAAM,MAAM,CAAC,CAAC;wBAC9B,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;oBACrB,CAAC;gBACH,CAAC;gBACD,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC,IAAI,KAAK,EAAE,CAAC;oBAChC,OAAO,CAAC,IAAI,CAAC,gCAAgC,CAAC,CAAC;oBAC/C,MAAM,WAAW,CAAC,GAAG,CAAC;wBACpB,GAAG,EAAE,UAAU,IAAI,CAAC,MAAM,CAAC,KAAK,QAAQ,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,gBAAgB;wBAC1E,MAAM,EAAE,CAAC,GAAG,MAAM,EAAE,MAAM,CAAC;qBAC5B,CAAC,CAAC;gBACL,CAAC;gBACD,IAAI,KAAK;oBAAE,MAAM,IAAI,CAAC,YAAY,CAAC,WAAW,EAAE,MAAM,EAAE,KAAK,CAAC,CAAC;YACjE,CAAC,CAAC,CAAC;QACL,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,CAAC,oBAAoB,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC;QAC1C,CAAC;QACD,OAAO,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;IAC/B,CAAC;IAED,KAAK,CAAC,MAAM,CAAC,MAAc;QACzB,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC;QAC/C,IAAI,CAAC,QAAQ;YAAE,MAAM,IAAI,iBAAiB,CAAC,MAAM,CAAC,CAAC;QAEnD,MAAM,IAAI,CAAC,EAAE,CAAC,WAAW,CAAC,KAAK,EAAC,WAAW,EAAC,EAAE;YAC5C,MAAM,WAAW,CAAC,GAAG,CAAC;gBACpB,GAAG,EAAE,eAAe,IAAI,CAAC,MAAM,CAAC,OAAO,qBAAqB;gBAC5D,MAAM,EAAE,CAAC,MAAM,CAAC;aACjB,CAAC,CAAC;YACH,MAAM,WAAW,CAAC,GAAG,CAAC;gBACpB,GAAG,EAAE,eAAe,IAAI,CAAC,MAAM,CAAC,SAAS,qBAAqB;gBAC9D,MAAM,EAAE,CAAC,MAAM,CAAC;aACjB,CAAC,CAAC;YACH,MAAM,WAAW,CAAC,GAAG,CAAC;gBACpB,GAAG,EAAE,eAAe,IAAI,CAAC,MAAM,CAAC,KAAK,gBAAgB;gBACrD,MAAM,EAAE,CAAC,MAAM,CAAC;aACjB,CAAC,CAAC;QACL,CAAC,CAAC,CAAC;IACL,CAAC;IAEO,KAAK,CAAC,UAAU,CAAC,MAAc;QACrC,OAAO,CAAC,MAAM,IAAI,CAAC,EAAE,CAAC,GAAG,CAAC;YACxB,GAAG,EAAE;gBACH,wDAAwD;gBACxD,QAAQ,IAAI,CAAC,MAAM,CAAC,KAAK,gBAAgB;aAC1C,CAAC,IAAI,CAAC,GAAG,CAAC;YACX,MAAM,EAAE,CAAC,MAAM,CAAC;SACjB,CAAC,CAA2B,CAAC;IAChC,CAAC;IAEO,KAAK,CAAC,YAAY,CAAC,KAAe;QACxC,MAAM,WAAW,GAAG,CAAC,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC;QACxC,MAAM,YAAY,GAAG,WAAW,CAAC,GAAG,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAC3D,MAAM,OAAO,GAAG,CAAC,MAAM,IAAI,CAAC,EAAE,CAAC,GAAG,CAAC;YACjC,GAAG,EAAE,wBAAwB,IAAI,CAAC,MAAM,CAAC,KAAK,mBAAmB,YAAY,IAAI;YACjF,MAAM,EAAE,WAAW;SACpB,CAAC,CAAiB,CAAC;QACpB,MAAM,KAAK,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC;QACtD,MAAM,OAAO,GAAG,WAAW,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC;QAC7D,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC;YAAE,MAAM,IAAI,iBAAiB,CAAC,OAAO,CAAC,CAAC;QAC7D,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC,CAAC,CAAC;QAC/D,OAAO,WAAW,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,MAAM,CAAC,GAAG,CAAC,IAAI,CAAE,CAAC,CAAC;IACpD,CAAC;IAEO,KAAK,CAAC,YAAY,CACxB,QAA0B,EAC1B,MAAc,EACd,KAAmB;QAEnB,MAAM,QAAQ,CAAC,GAAG,CAAC;YACjB,GAAG,EAAE,eAAe,IAAI,CAAC,MAAM,CAAC,SAAS,qBAAqB;YAC9D,MAAM,EAAE,CAAC,MAAM,CAAC;SACjB,CAAC,CAAC;QACH,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;YACzB,MAAM,QAAQ,CAAC,GAAG,CAAC;gBACjB,GAAG,EAAE,eAAe,IAAI,CAAC,MAAM,CAAC,SAAS,oCAAoC;gBAC7E,MAAM,EAAE,CAAC,MAAM,EAAE,IAAI,CAAC,EAAE,CAAC;aAC1B,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IAEO,KAAK,CAAC,SAAS,CAAC,OAAiB;QACvC,MAAM,MAAM,GAAG,IAAI,GAAG,EAAoB,CAAC;QAC3C,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO,MAAM,CAAC;QACxC,MAAM,OAAO,GAAG,CAAC,MAAM,IAAI,CAAC,EAAE,CAAC,GAAG,CAAC;YACjC,GAAG,EAAE;gBACH,UAAU,IAAI,CAAC,MAAM,CAAC,SAAS,aAAa,IAAI,CAAC,MAAM,CAAC,KAAK,OAAO;gBACpE,QAAQ,IAAI,CAAC,MAAM,CAAC,SAAS,EAAE;gBAC/B,cAAc,IAAI,CAAC,MAAM,CAAC,KAAK,EAAE;gBACjC,MAAM,IAAI,CAAC,MAAM,CAAC,KAAK,SAAS,IAAI,CAAC,MAAM,CAAC,SAAS,UAAU;gBAC/D,SAAS,IAAI,CAAC,MAAM,CAAC,SAAS,gBAAgB,OAAO,CAAC,GAAG,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG;gBAClF,YAAY,IAAI,CAAC,MAAM,CAAC,KAAK,QAAQ;aACtC,CAAC,IAAI,CAAC,GAAG,CAAC;YACX,MAAM,EAAE,OAAO;SAChB,CAAC,CAA6C,CAAC;QAChD,KAAK,MAAM,IAAI,IAAI,OAAO,EAAE,CAAC;YAC3B,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,OAAO,EAAE,CAAC,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC;QAC7E,CAAC;QACD,OAAO,MAAM,CAAC;IAChB,CAAC;IAEO,OAAO,CAAC,IAAgB,EAAE,KAAe;QAC/C,OAAO;YACL,EAAE,EAAE,IAAI,CAAC,EAAE;YACX,IAAI,EAAE,IAAI,CAAC,IAAI;YACf,KAAK,EAAE,IAAI,CAAC,KAAK;YACjB,MAAM,EAAE,IAAI,CAAC,MAAM;YACnB,KAAK;YACL,SAAS,EAAE,IAAI,CAAC,UAAU;YAC1B,SAAS,EAAE,IAAI,CAAC,UAAU;SAC3B,CAAC;IACJ,CAAC;IAEO,cAAc,CAAC,KAAa;QAClC,OAAO,KAAK,CAAC,WAAW,EAAE,CAAC;IAC7B,CAAC;IAEO,oBAAoB,CAAC,KAAc,EAAE,KAAc;QACzD,IAAI,KAAK,IAAI,KAAK,YAAY,KAAK,IAAI,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC,GAAG,IAAI,CAAC,MAAM,CAAC,KAAK,QAAQ,CAAC,EAAE,CAAC;YAC5F,MAAM,IAAI,uBAAuB,CAAC,KAAK,CAAC,CAAC;QAC3C,CAAC;QACD,MAAM,KAAK,CAAC;IACd,CAAC;CACF"}

package/lib/index.d.ts

@@ -0,0 +1,10 @@
+export * from './api-key-hasher.js';
+export * from './auth-database-module.js';
+export * from './auth-database-tables.js';
+export * from './database-api-key-repository.js';
+export * from './database-api-key-service.js';
+export * from './database-api-key-usage-recorder.js';
+export * from './database-auth-user-repository.js';
+export * from './database-auth-event-store.js';
+export * from './database-user-service.js';
+export * from './tokens.js';

package/lib/index.js

@@ -0,0 +1,11 @@
+export * from './api-key-hasher.js';
+export * from './auth-database-module.js';
+export * from './auth-database-tables.js';
+export * from './database-api-key-repository.js';
+export * from './database-api-key-service.js';
+export * from './database-api-key-usage-recorder.js';
+export * from './database-auth-user-repository.js';
+export * from './database-auth-event-store.js';
+export * from './database-user-service.js';
+export * from './tokens.js';
+//# sourceMappingURL=index.js.map

package/lib/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,cAAc,qBAAqB,CAAC;AACpC,cAAc,2BAA2B,CAAC;AAC1C,cAAc,2BAA2B,CAAC;AAC1C,cAAc,kCAAkC,CAAC;AACjD,cAAc,+BAA+B,CAAC;AAC9C,cAAc,sCAAsC,CAAC;AACrD,cAAc,oCAAoC,CAAC;AACnD,cAAc,gCAAgC,CAAC;AAC/C,cAAc,4BAA4B,CAAC;AAC3C,cAAc,aAAa,CAAC"}

package/lib/tokens.d.ts

@@ -0,0 +1,6 @@
+export declare const AUTH_DB_TOKENS: {
+    ApiKeyHasher: symbol;
+    UserService: symbol;
+    ApiKeyService: symbol;
+    EventStore: symbol;
+};

package/lib/tokens.js

@@ -0,0 +1,7 @@
+export const AUTH_DB_TOKENS = {
+    ApiKeyHasher: Symbol('AuthDbApiKeyHasher'),
+    UserService: Symbol('AuthDbUserService'),
+    ApiKeyService: Symbol('AuthDbApiKeyService'),
+    EventStore: Symbol('AuthDbEventStore'),
+};
+//# sourceMappingURL=tokens.js.map

package/lib/tokens.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"tokens.js","sourceRoot":"","sources":["../src/tokens.ts"],"names":[],"mappings":"AAAA,MAAM,CAAC,MAAM,cAAc,GAAG;IAC5B,YAAY,EAAE,MAAM,CAAC,oBAAoB,CAAC;IAC1C,WAAW,EAAE,MAAM,CAAC,mBAAmB,CAAC;IACxC,aAAa,EAAE,MAAM,CAAC,qBAAqB,CAAC;IAC5C,UAAU,EAAE,MAAM,CAAC,kBAAkB,CAAC;CACvC,CAAC"}

package/package.json

@@ -0,0 +1,49 @@
+{
+  "name": "@kurdel/auth-db",
+  "version": "0.1.0-beta.1",
+  "description": "Database-backed authentication adapters for @kurdel/auth",
+  "type": "module",
+  "exports": {
+    ".": "./lib/index.js"
+  },
+  "main": "./lib/index.js",
+  "types": "./lib/index.d.ts",
+  "files": ["lib"],
+  "scripts": {
+    "prepack": "npm run build",
+    "test": "vitest run",
+    "test:watch": "vitest",
+    "clean": "rimraf lib ../../.cache/tsconfig.auth-db.build.tsbuildinfo",
+    "build": "tsc -p tsconfig.build.json && tsc-alias -p tsconfig.build.json",
+    "build:force": "npm run clean && tsc -p tsconfig.build.json --force && tsc-alias -p tsconfig.build.json"
+  },
+  "keywords": ["kurdel", "authentication", "database", "api-key", "framework"],
+  "author": "Andrii Sorokin",
+  "license": "MIT",
+  "engines": {
+    "node": "^20.19.0 || ^22.12.0 || >=24.0.0"
+  },
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/ignorantic/kurdel.git",
+    "directory": "packages/auth-db"
+  },
+  "homepage": "https://github.com/ignorantic/kurdel/tree/main/packages/auth-db#readme",
+  "bugs": {
+    "url": "https://github.com/ignorantic/kurdel/issues"
+  },
+  "publishConfig": {
+    "access": "public",
+    "tag": "beta"
+  },
+  "dependencies": {
+    "@kurdel/auth": "0.1.0-beta.1",
+    "@kurdel/common": "0.1.0-beta.1",
+    "@kurdel/core": "0.1.0-beta.1",
+    "@kurdel/db": "0.1.0-beta.1"
+  },
+  "devDependencies": {
+    "rimraf": "^6.0.1",
+    "tsc-alias": "^1.8.16"
+  }
+}