@minion-stack/db 0.2.0 → 0.3.0

package/src/pg/crypto.ts

@@ -0,0 +1,44 @@
+import { createCipheriv, createDecipheriv, randomBytes, scryptSync } from 'node:crypto';
+
+const ALGORITHM = 'aes-256-gcm';
+const IV_BYTES = 12;
+const AUTH_TAG_BYTES = 16;
+
+// MUST match minion_hub/src/server/auth/crypto.ts so hub + site interoperate:
+//   key = scryptSync(ENCRYPTION_KEY, 'minion-hub-salt', 32)
+//   ciphertext (hex) = encrypted || authTag   (16-byte tag LAST)
+//   iv (hex) = 12 random bytes, stored separately
+let cachedKey: Buffer | null = null;
+function key(): Buffer {
+  if (cachedKey) return cachedKey;
+  const raw = process.env.ENCRYPTION_KEY;
+  if (!raw) {
+    if (process.env.NODE_ENV === 'production') {
+      throw new Error('ENCRYPTION_KEY environment variable must be set in production');
+    }
+    cachedKey = scryptSync('minion-hub-dev-key', 'minion-hub-salt', 32);
+    return cachedKey;
+  }
+  cachedKey = scryptSync(raw, 'minion-hub-salt', 32);
+  return cachedKey;
+}
+
+/** Seal plaintext → { ciphertext, iv }. ciphertext = hex(encrypted || authTag). */
+export function sealSecret(plaintext: string): { ciphertext: string; iv: string } {
+  const iv = randomBytes(IV_BYTES);
+  const cipher = createCipheriv(ALGORITHM, key(), iv);
+  const encrypted = Buffer.concat([cipher.update(plaintext, 'utf8'), cipher.final()]);
+  const authTag = cipher.getAuthTag();
+  const combined = Buffer.concat([encrypted, authTag]);
+  return { ciphertext: combined.toString('hex'), iv: iv.toString('hex') };
+}
+
+/** Open hex(encrypted || authTag) + hex(iv) → plaintext. Throws on auth failure. */
+export function openSecret(ciphertext: string, iv: string): string {
+  const combined = Buffer.from(ciphertext, 'hex');
+  const encrypted = combined.subarray(0, combined.length - AUTH_TAG_BYTES);
+  const authTag = combined.subarray(combined.length - AUTH_TAG_BYTES);
+  const decipher = createDecipheriv(ALGORITHM, key(), Buffer.from(iv, 'hex'));
+  decipher.setAuthTag(authTag);
+  return decipher.update(encrypted) + decipher.final('utf8');
+}

package/src/pg/identity-mapper.test.ts

@@ -0,0 +1,35 @@
+import { describe, it, expect } from 'vitest';
+import { mapGoogleIdentity, type GoTrueUserLike } from './identity-mapper.js';
+
+const gotrueUser: GoTrueUserLike = {
+  id: '11111111-1111-1111-1111-111111111111',
+  email: 'nik@example.com',
+  user_metadata: { full_name: 'Nik P', provider_id: 'google-sub-123' },
+  app_metadata: { provider: 'google' },
+};
+
+describe('mapGoogleIdentity', () => {
+  it('produces a profile row from the GoTrue user', () => {
+    const { profile } = mapGoogleIdentity(gotrueUser, { refreshToken: 'rt', scope: 'email profile' });
+    expect(profile).toEqual({
+      id: '11111111-1111-1111-1111-111111111111',
+      email: 'nik@example.com',
+      displayName: 'Nik P',
+    });
+  });
+
+  it('produces a google oauth identity keyed by email as externalId', () => {
+    const { identity } = mapGoogleIdentity(gotrueUser, { refreshToken: 'rt', scope: 'email profile' });
+    expect(identity.provider).toBe('google');
+    expect(identity.kind).toBe('oauth');
+    expect(identity.externalId).toBe('nik@example.com');
+    expect(identity.userId).toBe(gotrueUser.id);
+    expect(identity.scope).toBe('email profile');
+    expect(identity.hasSecret).toBe(true);
+  });
+
+  it('marks hasSecret false when no refresh token present', () => {
+    const { identity } = mapGoogleIdentity(gotrueUser, { refreshToken: null, scope: null });
+    expect(identity.hasSecret).toBe(false);
+  });
+});

package/src/pg/identity-mapper.ts

@@ -0,0 +1,48 @@
+export interface GoTrueUserLike {
+  id: string;
+  email: string | null;
+  user_metadata?: { full_name?: string; name?: string; provider_id?: string } | null;
+  app_metadata?: { provider?: string } | null;
+}
+
+export interface GoogleGrant {
+  refreshToken: string | null;
+  scope: string | null;
+}
+
+export interface MappedProfile {
+  id: string;
+  email: string;
+  displayName: string | null;
+}
+
+export interface MappedIdentity {
+  userId: string;
+  provider: 'google';
+  kind: 'oauth';
+  externalId: string; // google email
+  displayName: string | null;
+  scope: string | null;
+  hasSecret: boolean;
+}
+
+/** Pure mapping — no DB, no crypto. Caller seals the secret and upserts. */
+export function mapGoogleIdentity(
+  user: GoTrueUserLike,
+  grant: GoogleGrant,
+): { profile: MappedProfile; identity: MappedIdentity } {
+  const email = user.email ?? '';
+  const displayName = user.user_metadata?.full_name ?? user.user_metadata?.name ?? null;
+  return {
+    profile: { id: user.id, email, displayName },
+    identity: {
+      userId: user.id,
+      provider: 'google',
+      kind: 'oauth',
+      externalId: email,
+      displayName,
+      scope: grant.scope,
+      hasSecret: Boolean(grant.refreshToken),
+    },
+  };
+}

package/src/pg/schema/index.ts

@@ -0,0 +1,12 @@
+export { profiles } from './profiles.js';
+export { userIdentities } from './user-identities.js';
+
+// Identity helpers (consumed by minion_site auth path)
+export { mapGoogleIdentity } from '../identity-mapper.js';
+export type {
+  GoTrueUserLike,
+  GoogleGrant,
+  MappedProfile,
+  MappedIdentity,
+} from '../identity-mapper.js';
+export { sealSecret, openSecret } from '../crypto.js';

package/src/pg/schema/profiles.ts

@@ -0,0 +1,20 @@
+import { pgTable, uuid, text, timestamp } from 'drizzle-orm/pg-core';
+
+/**
+ * Canonical app-level user. 1:1 with GoTrue `auth.users` (id is the same uuid).
+ * GoTrue owns auth.users; this row is created post-signup by identity-sync.
+ * We intentionally do NOT add a Drizzle FK to auth.users (auth schema is
+ * GoTrue-managed); the FK is declared in the hand-written RLS/constraints
+ * migration instead.
+ */
+export const profiles = pgTable('profiles', {
+  id: uuid('id').primaryKey(), // == auth.users.id
+  email: text('email').notNull(),
+  displayName: text('display_name'),
+  role: text('role', { enum: ['user', 'admin'] })
+    .notNull()
+    .default('user'),
+  personalAgentId: text('personal_agent_id'),
+  createdAt: timestamp('created_at', { withTimezone: true }).notNull().defaultNow(),
+  updatedAt: timestamp('updated_at', { withTimezone: true }).notNull().defaultNow(),
+});

package/src/pg/schema/user-identities.ts

@@ -0,0 +1,35 @@
+import { pgTable, uuid, text, timestamp, bigint, uniqueIndex, index } from 'drizzle-orm/pg-core';
+import { profiles } from './profiles.js';
+
+/**
+ * Canonical per-user identity row linking a user to BOTH OAuth providers
+ * (kind='oauth', e.g. google) AND channel identities (kind='channel',
+ * e.g. whatsapp/telegram/discord/signal/slack). This is the single link
+ * table replacing the SQLite channel_identities + the oauth side of account.
+ * Secret material (OAuth refresh-token ADC blob) is app-level AES-256-GCM
+ * sealed into secretCiphertext/secretIv; null for channel identities.
+ */
+export const userIdentities = pgTable(
+  'user_identities',
+  {
+    id: uuid('id').primaryKey().defaultRandom(),
+    userId: uuid('user_id')
+      .notNull()
+      .references(() => profiles.id, { onDelete: 'cascade' }),
+    provider: text('provider').notNull(), // 'google'|'whatsapp'|'telegram'|'discord'|'signal'|'slack'
+    kind: text('kind', { enum: ['oauth', 'channel'] }).notNull(),
+    externalId: text('external_id').notNull(),
+    displayName: text('display_name'),
+    scope: text('scope'),
+    secretCiphertext: text('secret_ciphertext'),
+    secretIv: text('secret_iv'),
+    expiresAt: bigint('expires_at', { mode: 'number' }),
+    verifiedAt: bigint('verified_at', { mode: 'number' }),
+    createdAt: timestamp('created_at', { withTimezone: true }).notNull().defaultNow(),
+    updatedAt: timestamp('updated_at', { withTimezone: true }).notNull().defaultNow(),
+  },
+  (t) => [
+    uniqueIndex('idx_user_identity_unique').on(t.provider, t.externalId),
+    index('idx_user_identity_user').on(t.userId),
+  ],
+);

package/src/schema/index.ts

@@ -44,6 +44,7 @@ export { serverBackups } from './server-backups.js';
 export { agentGroups, agentGroupMembers } from './agent-groups.js';
 export { unifiedEvents } from './unified-events.js';
 export { channelIdentities } from './channel-identities.js';
+export { userIdentities } from './user-identities.js';
 export { personalAgents } from './personal-agents.js';
 export {
   builtSkills,
@@ -57,3 +58,5 @@ export {
   agentBuiltSkills,
 } from './builder.js';
 export { userPreferences } from './user-preferences.js';
+export { workspaceMembership } from './workspace-membership.js';
+export type { WorkspaceMembership, NewWorkspaceMembership } from './workspace-membership.js';

package/src/schema/user-identities.ts

@@ -0,0 +1,34 @@
+import { sqliteTable, text, integer, uniqueIndex, index } from 'drizzle-orm/sqlite-core';
+import { user } from './auth/index.js';
+
+/**
+ * Canonical per-user identity row. Covers OAuth providers (kind='oauth',
+ * e.g. google) and channel identities (kind='channel', e.g. whatsapp/telegram).
+ * Secret material (OAuth ADC blob) is stored app-level-encrypted as hex text
+ * in secretCiphertext/secretIv (same scheme as servers.token); null for
+ * channel identities that carry no secret.
+ */
+export const userIdentities = sqliteTable(
+  'user_identities',
+  {
+    id: text('id').primaryKey(),
+    userId: text('user_id')
+      .notNull()
+      .references(() => user.id, { onDelete: 'cascade' }),
+    provider: text('provider').notNull(), // 'google' | 'whatsapp' | 'telegram' | 'discord' | 'signal' | 'slack'
+    kind: text('kind').notNull(), // 'oauth' | 'channel'
+    externalId: text('external_id').notNull(),
+    displayName: text('display_name'),
+    scope: text('scope'),
+    secretCiphertext: text('secret_ciphertext'),
+    secretIv: text('secret_iv'),
+    expiresAt: integer('expires_at'),
+    verifiedAt: integer('verified_at'),
+    createdAt: integer('created_at').notNull(),
+    updatedAt: integer('updated_at').notNull(),
+  },
+  (t) => [
+    uniqueIndex('idx_user_identity_unique').on(t.provider, t.externalId),
+    index('idx_user_identity_user').on(t.userId),
+  ],
+);

package/src/schema/workspace-membership.ts

@@ -0,0 +1,31 @@
+import { sqliteTable, text, integer, index, primaryKey } from 'drizzle-orm/sqlite-core';
+import { user } from './auth/index.js';
+
+/**
+ * workspace_membership — bridge between hub identity and Paperclip company tenancy.
+ *
+ * Each row means "user X holds role Y in Paperclip company Z".
+ * Composite PK: a user may belong to many Paperclip companies.
+ *
+ * Used by:
+ *   - CompanySwitcher (Task 10): lists rows for the current user
+ *   - JWT mint (Task 8): uses the selected row's paperclipCompanyId as the JWT companyId claim
+ */
+export const workspaceMembership = sqliteTable(
+  'workspace_membership',
+  {
+    userId: text('user_id')
+      .notNull()
+      .references(() => user.id, { onDelete: 'cascade' }),
+    paperclipCompanyId: text('paperclip_company_id').notNull(),
+    role: text('role').notNull().default('admin'),
+    createdAt: integer('created_at', { mode: 'timestamp' }).notNull(),
+  },
+  (t) => [
+    primaryKey({ columns: [t.userId, t.paperclipCompanyId] }),
+    index('idx_workspace_membership_user').on(t.userId),
+  ],
+);
+
+export type WorkspaceMembership = typeof workspaceMembership.$inferSelect;
+export type NewWorkspaceMembership = typeof workspaceMembership.$inferInsert;