@materializecms/db 0.0.0-stage → 0.1.0

package/src/auth.js

@@ -0,0 +1,337 @@
+import { createHash, randomBytes, randomUUID } from 'node:crypto';
+import { and, asc, count, eq, gt, lt, ne, sql } from 'drizzle-orm';
+import { apiTokens, invites, loginAttempts, sessions, users } from './tables.js';
+const toUser = (row) => ({
+    id: row.id,
+    email: row.email,
+    name: row.name,
+    role: row.role,
+    twoFactor: !!row.totpSecret,
+});
+/** Prefix of every personal access token, so they are easy to recognise (and to scan for if leaked). */
+export const TOKEN_PREFIX = 'mzp_';
+/** Raised when an email already belongs to someone. */
+export class EmailTakenError extends Error {
+    constructor(email) {
+        super(`${email} already has an account`);
+        this.name = 'EmailTakenError';
+    }
+}
+const hashToken = (token) => createHash('sha256').update(token).digest('base64url');
+/** Recovery codes are compared without dashes, spaces or case. */
+const hashCode = (code) => hashToken(code.replace(/[\s-]/g, '').toLowerCase());
+export function createAuthStore(db) {
+    return {
+        async countUsers() {
+            const [row] = await db.select({ n: count() }).from(users);
+            return row?.n ?? 0;
+        },
+        async createUser(input) {
+            const user = {
+                id: randomUUID(),
+                email: input.email.trim().toLowerCase(),
+                name: input.name.trim(),
+                role: input.role,
+            };
+            await db.insert(users).values({ ...user, passwordHash: input.passwordHash, createdAt: new Date() });
+            return { ...user, twoFactor: false };
+        },
+        async findForLogin(email) {
+            const row = await db.query.users.findFirst({ where: eq(users.email, email.trim().toLowerCase()) });
+            return row ? { ...toUser(row), passwordHash: row.passwordHash } : null;
+        },
+        /** Returns the raw token for the cookie; only its hash is stored. */
+        async createSession(userId, ttlMs, device = {}) {
+            const token = randomBytes(32).toString('base64url');
+            const expiresAt = new Date(Date.now() + ttlMs);
+            const now = new Date();
+            await db.insert(sessions).values({
+                id: hashToken(token),
+                userId,
+                expiresAt,
+                createdAt: now,
+                lastSeenAt: now,
+                userAgent: device.userAgent?.slice(0, 300) ?? null,
+                ip: device.ip ?? null,
+            });
+            await db.update(users).set({ lastSeenAt: now }).where(eq(users.id, userId));
+            return { token, expiresAt };
+        },
+        /**
+         * Who a session belongs to. It ends when it expires or when it has not been used for
+         * `idleMs`; use is noted at most every few minutes.
+         */
+        async userForSession(token, idleMs = Number.POSITIVE_INFINITY) {
+            const session = await db.query.sessions.findFirst({ where: eq(sessions.id, hashToken(token)) });
+            if (!session)
+                return null;
+            const now = Date.now();
+            const seen = (session.lastSeenAt ?? session.createdAt).getTime();
+            if (session.expiresAt.getTime() < now || now - seen > idleMs) {
+                await db.delete(sessions).where(eq(sessions.id, session.id));
+                return null;
+            }
+            if (now - seen > 5 * 60_000)
+                await db
+                    .update(sessions)
+                    .set({ lastSeenAt: new Date(now) })
+                    .where(eq(sessions.id, session.id));
+            const user = await db.query.users.findFirst({ where: eq(users.id, session.userId) });
+            return user ? toUser(user) : null;
+        },
+        /** The id under which a session is listed. */
+        sessionId: (token) => hashToken(token),
+        async listSessions(userId) {
+            const rows = await db.query.sessions.findMany({
+                where: and(eq(sessions.userId, userId), gt(sessions.expiresAt, new Date())),
+            });
+            return rows
+                .map((r) => ({
+                id: r.id,
+                userAgent: r.userAgent ?? null,
+                ip: r.ip ?? null,
+                createdAt: r.createdAt,
+                lastSeenAt: r.lastSeenAt ?? r.createdAt,
+            }))
+                .sort((a, b) => b.lastSeenAt.getTime() - a.lastSeenAt.getTime());
+        },
+        /** Signs one device out; only its owner can. */
+        async endSession(userId, id) {
+            const res = await db.delete(sessions).where(and(eq(sessions.id, id), eq(sessions.userId, userId)));
+            return res.rowsAffected > 0;
+        },
+        /** Signs every device out, except the session given. */
+        async endOtherSessions(userId, keepToken) {
+            const res = await db
+                .delete(sessions)
+                .where(and(eq(sessions.userId, userId), keepToken ? ne(sessions.id, hashToken(keepToken)) : undefined));
+            return res.rowsAffected;
+        },
+        // ---------- two-step verification ----------
+        async twoFactorOf(userId) {
+            const row = await db.query.users.findFirst({ where: eq(users.id, userId) });
+            return row
+                ? {
+                    secret: row.totpSecret ?? null,
+                    pending: row.totpPending ?? null,
+                    lastStep: row.totpLastStep ?? null,
+                    recoveryLeft: row.recoveryCodes?.length ?? 0,
+                }
+                : null;
+        },
+        /** A new secret during setup, not in use until a first code confirms it. */
+        async setPendingSecret(userId, secret) {
+            await db.update(users).set({ totpPending: secret }).where(eq(users.id, userId));
+        },
+        /** The pending secret becomes the one in use, with fresh recovery codes (stored as hashes). */
+        async enableTwoFactor(userId, step, recoveryCodes) {
+            const row = await db.query.users.findFirst({ where: eq(users.id, userId) });
+            if (!row?.totpPending)
+                return;
+            await db
+                .update(users)
+                .set({
+                totpSecret: row.totpPending,
+                totpPending: null,
+                totpLastStep: step,
+                recoveryCodes: recoveryCodes.map(hashCode),
+            })
+                .where(eq(users.id, userId));
+        },
+        async disableTwoFactor(userId) {
+            await db
+                .update(users)
+                .set({ totpSecret: null, totpPending: null, totpLastStep: null, recoveryCodes: null })
+                .where(eq(users.id, userId));
+        },
+        /** Notes the time step of an accepted code, so the same code cannot be used again. */
+        async useStep(userId, step) {
+            await db.update(users).set({ totpLastStep: step }).where(eq(users.id, userId));
+        },
+        async setRecoveryCodes(userId, codes) {
+            await db
+                .update(users)
+                .set({ recoveryCodes: codes.map(hashCode) })
+                .where(eq(users.id, userId));
+        },
+        /** A recovery code works once: true when it was valid (and is now spent). */
+        async useRecoveryCode(userId, code) {
+            const row = await db.query.users.findFirst({ where: eq(users.id, userId) });
+            const hash = hashCode(code);
+            if (!row?.recoveryCodes?.includes(hash))
+                return false;
+            await db
+                .update(users)
+                .set({ recoveryCodes: row.recoveryCodes.filter((h) => h !== hash) })
+                .where(eq(users.id, userId));
+            return true;
+        },
+        // ---------- failed sign-ins ----------
+        /** Until when a key (an email, an address) is locked, if it is. */
+        async lockedUntil(key) {
+            const row = await db.query.loginAttempts.findFirst({ where: eq(loginAttempts.key, key) });
+            return row?.lockedUntil && row.lockedUntil.getTime() > Date.now() ? row.lockedUntil : null;
+        },
+        /**
+         * Counts a failure. From `threshold` failures on, the key is locked for a time that doubles
+         * with each further failure (1, 2, 4… minutes, at most an hour). Failures are forgotten
+         * after a day without any.
+         */
+        async recordFailure(key, threshold) {
+            const now = Date.now();
+            const row = await db.query.loginAttempts.findFirst({ where: eq(loginAttempts.key, key) });
+            const fresh = !row || now - row.updatedAt.getTime() > 24 * 60 * 60_000;
+            const failures = fresh ? 1 : row.failures + 1;
+            const lockedUntil = failures >= threshold ? new Date(now + Math.min(60, 2 ** (failures - threshold)) * 60_000) : null;
+            await db
+                .insert(loginAttempts)
+                .values({ key, failures, lockedUntil, updatedAt: new Date(now) })
+                .onConflictDoUpdate({ target: loginAttempts.key, set: { failures, lockedUntil, updatedAt: new Date(now) } });
+            return { failures, lockedUntil };
+        },
+        async clearFailures(key) {
+            await db.delete(loginAttempts).where(eq(loginAttempts.key, key));
+        },
+        /** A new personal access token for someone: returns the secret, which is never stored. */
+        async createToken(userId, name) {
+            const token = `${TOKEN_PREFIX}${randomBytes(32).toString('base64url')}`;
+            const record = {
+                id: randomUUID(),
+                name: name.trim(),
+                hint: token.slice(-4),
+                createdAt: new Date(),
+                lastUsedAt: null,
+            };
+            await db.insert(apiTokens).values({ ...record, userId, tokenHash: hashToken(token) });
+            return { token, record };
+        },
+        async listTokens(userId) {
+            const rows = await db.query.apiTokens.findMany({
+                where: eq(apiTokens.userId, userId),
+                orderBy: asc(apiTokens.createdAt),
+            });
+            return rows.map(({ id, name, hint, createdAt, lastUsedAt }) => ({ id, name, hint, createdAt, lastUsedAt }));
+        },
+        /** Only the owner can revoke a token. */
+        async revokeToken(id, userId) {
+            const res = await db.delete(apiTokens).where(and(eq(apiTokens.id, id), eq(apiTokens.userId, userId)));
+            return res.rowsAffected > 0;
+        },
+        /** Who a token belongs to; notes when it was last used (at most once a minute). */
+        async userForToken(token) {
+            if (!token.startsWith(TOKEN_PREFIX))
+                return null;
+            const row = await db.query.apiTokens.findFirst({ where: eq(apiTokens.tokenHash, hashToken(token)) });
+            if (!row)
+                return null;
+            const user = await db.query.users.findFirst({ where: eq(users.id, row.userId) });
+            if (!user)
+                return null;
+            const now = Date.now();
+            if (!row.lastUsedAt || now - row.lastUsedAt.getTime() > 60_000)
+                await db
+                    .update(apiTokens)
+                    .set({ lastUsedAt: new Date(now) })
+                    .where(eq(apiTokens.id, row.id));
+            return toUser(user);
+        },
+        async deleteSession(token) {
+            await db.delete(sessions).where(eq(sessions.id, hashToken(token)));
+        },
+        async purgeExpiredSessions() {
+            await db.delete(sessions).where(lt(sessions.expiresAt, new Date()));
+        },
+        // ---------- people ----------
+        async listUsers() {
+            const rows = await db.select().from(users).orderBy(asc(users.createdAt), asc(sql `rowid`));
+            return rows.map((r) => ({ ...toUser(r), createdAt: r.createdAt, lastSeenAt: r.lastSeenAt ?? null }));
+        },
+        async getUser(id) {
+            const row = await db.query.users.findFirst({ where: eq(users.id, id) });
+            return row ? toUser(row) : null;
+        },
+        async getPasswordHash(id) {
+            return (await db.query.users.findFirst({ where: eq(users.id, id) }))?.passwordHash ?? null;
+        },
+        async countAdmins() {
+            const [row] = await db.select({ n: count() }).from(users).where(eq(users.role, 'admin'));
+            return row?.n ?? 0;
+        },
+        /** Changes name, role or email; an email someone else already uses raises EmailTakenError. */
+        async updateUser(id, input) {
+            const change = {};
+            if (input.name !== undefined)
+                change.name = input.name.trim();
+            if (input.role !== undefined)
+                change.role = input.role;
+            if (input.email !== undefined) {
+                const email = input.email.trim().toLowerCase();
+                const owner = await db.query.users.findFirst({ where: eq(users.email, email) });
+                if (owner && owner.id !== id)
+                    throw new EmailTakenError(email);
+                change.email = email;
+            }
+            if (Object.keys(change).length)
+                await db.update(users).set(change).where(eq(users.id, id));
+            return this.getUser(id);
+        },
+        async deleteUser(id) {
+            return (await db.delete(users).where(eq(users.id, id))).rowsAffected > 0;
+        },
+        /** Sets a new password and signs the user out everywhere, except the session given. */
+        async setPassword(id, passwordHash, keepSession) {
+            await db.update(users).set({ passwordHash }).where(eq(users.id, id));
+            await db
+                .delete(sessions)
+                .where(and(eq(sessions.userId, id), keepSession ? ne(sessions.id, hashToken(keepSession)) : undefined));
+        },
+        async emailTaken(email) {
+            return !!(await db.query.users.findFirst({ where: eq(users.email, email.trim().toLowerCase()) }));
+        },
+        // ---------- invitations and resets ----------
+        /** Returns the raw token for the link; only its hash is stored. Replaces earlier links of the same kind. */
+        async createInvite(input) {
+            const email = input.email.trim().toLowerCase();
+            if (input.kind === 'invite' && (await this.emailTaken(email)))
+                throw new EmailTakenError(email);
+            await db.delete(invites).where(and(eq(invites.email, email), eq(invites.kind, input.kind)));
+            const token = randomBytes(32).toString('base64url');
+            const invite = {
+                id: hashToken(token),
+                kind: input.kind,
+                email,
+                name: input.name?.trim() ?? '',
+                role: input.role,
+                userId: input.userId ?? null,
+                createdBy: input.createdBy ?? null,
+                createdAt: new Date(),
+                expiresAt: new Date(Date.now() + input.ttlMs),
+            };
+            await db.insert(invites).values(invite);
+            const { createdBy: _, ...publicInvite } = invite;
+            return { token, invite: publicInvite };
+        },
+        async pendingInvites() {
+            const rows = await db
+                .select()
+                .from(invites)
+                .where(and(eq(invites.kind, 'invite'), gt(invites.expiresAt, new Date())))
+                .orderBy(asc(invites.createdAt));
+            return rows.map(({ createdBy: _, ...r }) => r);
+        },
+        async findInvite(token) {
+            const row = await db.query.invites.findFirst({ where: eq(invites.id, hashToken(token)) });
+            if (!row || row.expiresAt.getTime() < Date.now())
+                return null;
+            const { createdBy: _, ...invite } = row;
+            return invite;
+        },
+        async revokeInvite(id) {
+            return (await db.delete(invites).where(eq(invites.id, id))).rowsAffected > 0;
+        },
+        /** A link works once. */
+        async consumeInvite(token) {
+            await db.delete(invites).where(eq(invites.id, hashToken(token)));
+        },
+    };
+}

package/src/comments.d.ts

@@ -0,0 +1,26 @@
+import type { Db } from './database.ts';
+export interface Comment {
+    id: string;
+    documentId: string;
+    nodeId: string | null;
+    authorId: string | null;
+    authorName: string;
+    body: string;
+    resolved: boolean;
+    createdAt: Date;
+}
+/** Comments on a page, in the order they were written. */
+export declare function createCommentStore(db: Db): {
+    list(documentId: string): Promise<Comment[]>;
+    get(id: string): Promise<Comment | null>;
+    add(input: {
+        documentId: string;
+        nodeId: string | null;
+        authorId: string;
+        authorName: string;
+        body: string;
+    }): Promise<Comment>;
+    resolve(id: string, resolved: boolean): Promise<void>;
+    remove(id: string): Promise<void>;
+};
+export type CommentStore = ReturnType<typeof createCommentStore>;

package/src/comments.js

@@ -0,0 +1,25 @@
+import { randomUUID } from 'node:crypto';
+import { asc, eq } from 'drizzle-orm';
+import { comments } from './tables.js';
+/** Comments on a page, in the order they were written. */
+export function createCommentStore(db) {
+    return {
+        async list(documentId) {
+            return db.select().from(comments).where(eq(comments.documentId, documentId)).orderBy(asc(comments.createdAt));
+        },
+        async get(id) {
+            return (await db.select().from(comments).where(eq(comments.id, id)))[0] ?? null;
+        },
+        async add(input) {
+            const row = { id: randomUUID(), ...input, resolved: false, createdAt: new Date() };
+            await db.insert(comments).values(row);
+            return row;
+        },
+        async resolve(id, resolved) {
+            await db.update(comments).set({ resolved }).where(eq(comments.id, id));
+        },
+        async remove(id) {
+            await db.delete(comments).where(eq(comments.id, id));
+        },
+    };
+}

package/src/content.d.ts

@@ -0,0 +1,115 @@
+import type { Db } from './database.ts';
+export type DocumentStatus = 'draft' | 'published' | 'changed';
+export interface StoredDocument {
+    id: string;
+    collection: string;
+    locale: string;
+    slug: string | null;
+    title: string;
+    status: DocumentStatus;
+    data: Record<string, unknown>;
+    publishedData: Record<string, unknown> | null;
+    createdAt: Date;
+    updatedAt: Date;
+    publishedAt: Date | null;
+    /** The original this document translates; null for originals. */
+    sourceId: string | null;
+}
+/** One language version of a document. */
+export interface Translation {
+    id: string;
+    locale: string;
+    title: string;
+    status: DocumentStatus;
+    sourceId: string | null;
+}
+export interface DocumentSummary {
+    id: string;
+    title: string;
+    slug: string | null;
+    status: DocumentStatus;
+    updatedAt: Date;
+    publishedAt: Date | null;
+    /** The first image in the document, for thumbnails in lists. */
+    image: string | null;
+    /** The other languages it exists in. */
+    locales: string[];
+}
+export interface Revision {
+    id: string;
+    kind: 'save' | 'publish' | 'restore';
+    data: Record<string, unknown>;
+    createdAt: Date;
+    authorId: string | null;
+}
+/** Raised when a slug is already used in the same collection and locale. */
+export declare class SlugTakenError extends Error {
+    constructor(slug: string);
+}
+/** The first image found in a document's data (fields first, then blocks, in order). */
+export declare function firstImage(value: unknown, depth?: number): string | null;
+export interface ListOptions {
+    locale: string;
+    limit?: number;
+    offset?: number;
+    search?: string;
+    /** Only documents that have a published version. */
+    publishedOnly?: boolean;
+}
+export declare function createContentStore(db: Db): {
+    list(collection: string, options: ListOptions): Promise<{
+        items: DocumentSummary[];
+        total: number;
+    }>;
+    /** Every language version of a document, itself included: the original and its translations. */
+    translations(id: string): Promise<Translation[]>;
+    /** Counts per collection and the latest changes across all of them: the panel's home. */
+    overview(locale: string, recent?: number): Promise<{
+        counts: {
+            collection: string;
+            total: number;
+            drafts: number;
+            changed: number;
+        }[];
+        recent: {
+            id: string;
+            collection: string;
+            title: string;
+            slug: string | null;
+            status: DocumentStatus;
+            updatedAt: Date;
+            publishedAt: Date | null;
+            image: string | null;
+            updatedBy: string | null;
+        }[];
+    }>;
+    get(id: string): Promise<StoredDocument | null>;
+    getMany(ids: string[]): Promise<StoredDocument[]>;
+    /** Every published document of a collection (all locales unless one is given), oldest first. */
+    published(collection: string, locale?: string): Promise<StoredDocument[]>;
+    getBySlug(collection: string, slug: string, locale: string): Promise<StoredDocument | null>;
+    create(input: {
+        collection: string;
+        locale: string;
+        title: string;
+        slug: string | null;
+        data: Record<string, unknown>;
+        userId?: string;
+        sourceId?: string | null;
+    }): Promise<StoredDocument>;
+    update(id: string, input: {
+        title: string;
+        slug: string | null;
+        data: Record<string, unknown>;
+        userId?: string;
+    }): Promise<StoredDocument | null>;
+    /** Makes the current draft live; `data` is the validated form of the draft, when the caller has one. */
+    publish(id: string, userId?: string, data?: Record<string, unknown>): Promise<StoredDocument | null>;
+    /** Takes the document off the live site; the draft stays. */
+    unpublish(id: string, userId?: string): Promise<StoredDocument | null>;
+    remove(id: string): Promise<boolean>;
+    revisions(documentId: string): Promise<Revision[]>;
+    /** Copies an old version back into the draft, recorded as a new revision. */
+    restore(documentId: string, revisionId: string, userId?: string): Promise<StoredDocument | null>;
+};
+export type ContentStore = ReturnType<typeof createContentStore>;