@oaath/server 0.1.0

package/dist/postgres.js

@@ -0,0 +1,401 @@
+import { b as relayFailure, d as parseAuthorizationRequestRecord, f as parseCapabilityInvalidationRecord, l as parseAuthorizationCodeRecord, p as parseEncryptedArtifactRecord, u as parseAuthorizationDecisionRecord } from "./records-Bgr-9PUh.js";
+import pg from "pg";
+//#region src/store/postgres/schema.ts
+/**
+* The current relay schema. There is no migration runner and no reader for any
+* older schema: an obsolete database is dropped and recreated.
+*
+* Constraints that the database can own are owned by the database — one decision
+* per request, one code and one artifact per request, monotonic timestamps.
+*
+* @author taek <leekt216@gmail.com>
+*/
+const OAATH_RELAY_POSTGRES_SCHEMA_VERSION = "oaath.relay-postgres-schema/v1";
+const MAX_SAFE_INTEGER = Number.MAX_SAFE_INTEGER;
+const OAATH_RELAY_POSTGRES_SCHEMA_STATEMENTS = Object.freeze([
+	`CREATE TABLE oaath_relay_schema_v1 (
+    schema_id text PRIMARY KEY CHECK (schema_id = 'oaath'),
+    version text NOT NULL
+  )`,
+	`INSERT INTO oaath_relay_schema_v1 (schema_id, version)
+   VALUES ('oaath', '${OAATH_RELAY_POSTGRES_SCHEMA_VERSION}')`,
+	`CREATE TABLE oaath_relay_authorization_request_v1 (
+    request_id text PRIMARY KEY,
+    record_version text NOT NULL,
+    client_id text NOT NULL,
+    subject text NOT NULL,
+    redirect_uri text NOT NULL,
+    code_challenge text NOT NULL,
+    requested_scope text NOT NULL,
+    created_at bigint NOT NULL CHECK (created_at >= 0 AND created_at <= ${MAX_SAFE_INTEGER}),
+    expires_at bigint NOT NULL CHECK (expires_at >= created_at AND expires_at <= ${MAX_SAFE_INTEGER})
+  )`,
+	`CREATE TABLE oaath_relay_authorization_decision_v1 (
+    request_id text PRIMARY KEY
+      REFERENCES oaath_relay_authorization_request_v1 (request_id),
+    record_version text NOT NULL,
+    outcome text NOT NULL CHECK (outcome IN ('approved', 'rejected')),
+    decided_at bigint NOT NULL CHECK (decided_at >= 0 AND decided_at <= ${MAX_SAFE_INTEGER}),
+    code_ref text,
+    code_expires_at bigint CHECK (code_expires_at >= 0 AND code_expires_at <= ${MAX_SAFE_INTEGER}),
+    CHECK ((outcome = 'approved') = (code_ref IS NOT NULL)),
+    CHECK ((code_ref IS NULL) = (code_expires_at IS NULL))
+  )`,
+	`CREATE TABLE oaath_relay_capability_invalidation_v1 (
+    grant_id text PRIMARY KEY,
+    record_version text NOT NULL,
+    client_id text NOT NULL,
+    capability_hash text NOT NULL,
+    invalidated_at bigint NOT NULL CHECK (invalidated_at >= 0 AND invalidated_at <= ${MAX_SAFE_INTEGER})
+  )`,
+	`CREATE TABLE oaath_relay_authorization_code_v1 (
+    code_hash text PRIMARY KEY,
+    record_version text NOT NULL,
+    request_id text NOT NULL UNIQUE
+      REFERENCES oaath_relay_authorization_request_v1 (request_id),
+    client_id text NOT NULL,
+    redirect_uri text NOT NULL,
+    code_challenge text NOT NULL,
+    artifact_id text NOT NULL UNIQUE,
+    created_at bigint NOT NULL CHECK (created_at >= 0 AND created_at <= ${MAX_SAFE_INTEGER}),
+    expires_at bigint NOT NULL CHECK (expires_at >= created_at AND expires_at <= ${MAX_SAFE_INTEGER}),
+    consumed_at bigint CHECK (consumed_at >= created_at AND consumed_at <= ${MAX_SAFE_INTEGER})
+  )`,
+	`CREATE TABLE oaath_relay_encrypted_artifact_v1 (
+    artifact_id text PRIMARY KEY,
+    record_version text NOT NULL,
+    request_id text NOT NULL UNIQUE
+      REFERENCES oaath_relay_authorization_request_v1 (request_id),
+    client_id text NOT NULL,
+    ciphertext_ref text NOT NULL,
+    created_at bigint NOT NULL CHECK (created_at >= 0 AND created_at <= ${MAX_SAFE_INTEGER}),
+    claimed_at bigint CHECK (claimed_at >= created_at AND claimed_at <= ${MAX_SAFE_INTEGER})
+  )`
+]);
+/**
+* Creates the current schema in the executor's `search_path`. It is not a
+* migration: it fails if the objects already exist.
+*/
+async function createPostgresRelaySchema(executor) {
+	for (const statement of OAATH_RELAY_POSTGRES_SCHEMA_STATEMENTS) await executor.query(statement);
+}
+//#endregion
+//#region src/store/postgres/queries.ts
+/**
+* Relay SQL. Text only: no state-machine decision lives in this file.
+*
+* Names are unqualified so a deployment (or a disposable test schema) selects
+* them with `search_path`.
+*
+* @author taek <leekt216@gmail.com>
+*/
+const REQUEST_COLUMNS = `
+  request_id, record_version, client_id, subject, redirect_uri,
+  code_challenge, requested_scope, created_at, expires_at
+`;
+const CODE_COLUMNS = `
+  code_hash, record_version, request_id, client_id, redirect_uri,
+  code_challenge, artifact_id, created_at, expires_at, consumed_at
+`;
+const ARTIFACT_COLUMNS = `
+  artifact_id, record_version, request_id, client_id, ciphertext_ref,
+  created_at, claimed_at
+`;
+const LOCK_AUTHORIZATION_REQUEST = `
+  SELECT ${REQUEST_COLUMNS}
+  FROM oaath_relay_authorization_request_v1
+  WHERE request_id = $1
+  FOR UPDATE
+`;
+const INSERT_AUTHORIZATION_REQUEST = `
+  INSERT INTO oaath_relay_authorization_request_v1 (${REQUEST_COLUMNS})
+  VALUES ($1, $2, $3, $4, $5, $6, $7, $8, $9)
+  ON CONFLICT (request_id) DO NOTHING
+`;
+const LOCK_AUTHORIZATION_DECISION = `
+  SELECT request_id, record_version, outcome, decided_at, code_ref, code_expires_at
+  FROM oaath_relay_authorization_decision_v1
+  WHERE request_id = $1
+  FOR UPDATE
+`;
+const INSERT_AUTHORIZATION_DECISION = `
+  INSERT INTO oaath_relay_authorization_decision_v1 (
+    request_id, record_version, outcome, decided_at, code_ref, code_expires_at
+  ) VALUES ($1, $2, $3, $4, $5, $6)
+  ON CONFLICT (request_id) DO NOTHING
+`;
+const LOCK_CAPABILITY_INVALIDATION = `
+  SELECT grant_id, record_version, client_id, capability_hash, invalidated_at
+  FROM oaath_relay_capability_invalidation_v1
+  WHERE grant_id = $1
+  FOR UPDATE
+`;
+const INSERT_CAPABILITY_INVALIDATION = `
+  INSERT INTO oaath_relay_capability_invalidation_v1 (
+    grant_id, record_version, client_id, capability_hash, invalidated_at
+  ) VALUES ($1, $2, $3, $4, $5)
+  ON CONFLICT (grant_id) DO NOTHING
+`;
+const LOCK_AUTHORIZATION_CODE = `
+  SELECT ${CODE_COLUMNS}
+  FROM oaath_relay_authorization_code_v1
+  WHERE code_hash = $1
+  FOR UPDATE
+`;
+const INSERT_AUTHORIZATION_CODE = `
+  INSERT INTO oaath_relay_authorization_code_v1 (${CODE_COLUMNS})
+  VALUES ($1, $2, $3, $4, $5, $6, $7, $8, $9, $10)
+  ON CONFLICT DO NOTHING
+`;
+/** One-shot: the guard makes a second consume affect zero rows. */
+const CONSUME_AUTHORIZATION_CODE = `
+  UPDATE oaath_relay_authorization_code_v1
+  SET consumed_at = $2
+  WHERE code_hash = $1 AND consumed_at IS NULL
+`;
+const LOCK_ENCRYPTED_ARTIFACT = `
+  SELECT ${ARTIFACT_COLUMNS}
+  FROM oaath_relay_encrypted_artifact_v1
+  WHERE artifact_id = $1
+  FOR UPDATE
+`;
+const INSERT_ENCRYPTED_ARTIFACT = `
+  INSERT INTO oaath_relay_encrypted_artifact_v1 (${ARTIFACT_COLUMNS})
+  VALUES ($1, $2, $3, $4, $5, $6, $7)
+  ON CONFLICT DO NOTHING
+`;
+/** One-shot: the guard makes a second claim affect zero rows. */
+const CLAIM_ENCRYPTED_ARTIFACT = `
+  UPDATE oaath_relay_encrypted_artifact_v1
+  SET claimed_at = $2
+  WHERE artifact_id = $1 AND claimed_at IS NULL
+`;
+//#endregion
+//#region src/store/postgres/store.ts
+/** `bigint` arrives as a decimal string; the record parser validates the result. */
+function sqlTimestamp(value) {
+	if (typeof value !== "string") return value;
+	const parsed = Number(value);
+	return Number.isFinite(parsed) ? parsed : value;
+}
+function requestRecord(row) {
+	return parseAuthorizationRequestRecord({
+		version: row.record_version,
+		requestId: row.request_id,
+		clientId: row.client_id,
+		subject: row.subject,
+		redirectUri: row.redirect_uri,
+		codeChallenge: row.code_challenge,
+		requestedScope: row.requested_scope,
+		createdAt: sqlTimestamp(row.created_at),
+		expiresAt: sqlTimestamp(row.expires_at)
+	});
+}
+function decisionRecord(row) {
+	return parseAuthorizationDecisionRecord({
+		version: row.record_version,
+		requestId: row.request_id,
+		outcome: row.outcome,
+		decidedAt: sqlTimestamp(row.decided_at),
+		codeRef: row.code_ref,
+		codeExpiresAt: row.code_expires_at === null ? null : sqlTimestamp(row.code_expires_at)
+	});
+}
+function invalidationRecord(row) {
+	return parseCapabilityInvalidationRecord({
+		version: row.record_version,
+		grantId: row.grant_id,
+		clientId: row.client_id,
+		capabilityHash: row.capability_hash,
+		invalidatedAt: sqlTimestamp(row.invalidated_at)
+	});
+}
+function codeRecord(row) {
+	return parseAuthorizationCodeRecord({
+		version: row.record_version,
+		codeHash: row.code_hash,
+		requestId: row.request_id,
+		clientId: row.client_id,
+		redirectUri: row.redirect_uri,
+		codeChallenge: row.code_challenge,
+		artifactId: row.artifact_id,
+		createdAt: sqlTimestamp(row.created_at),
+		expiresAt: sqlTimestamp(row.expires_at),
+		consumedAt: sqlTimestamp(row.consumed_at)
+	});
+}
+function artifactRecord(row) {
+	return parseEncryptedArtifactRecord({
+		version: row.record_version,
+		artifactId: row.artifact_id,
+		requestId: row.request_id,
+		clientId: row.client_id,
+		ciphertextRef: row.ciphertext_ref,
+		createdAt: sqlTimestamp(row.created_at),
+		claimedAt: sqlTimestamp(row.claimed_at)
+	});
+}
+function createTransaction(client) {
+	let settled = false;
+	async function run(sql, parameters) {
+		if (settled) relayFailure("relay_internal", "relay transaction already settled");
+		try {
+			const result = await client.query(sql, [...parameters]);
+			return {
+				rows: result.rows,
+				rowCount: result.rowCount ?? 0
+			};
+		} catch {
+			return relayFailure("relay_store_unavailable", "relay statement failed");
+		}
+	}
+	async function first(sql, parameters, map) {
+		const { rows } = await run(sql, parameters);
+		if (rows.length === 0) return void 0;
+		if (rows.length > 1) return relayFailure("relay_record_unreadable", "relay key matched multiple rows");
+		const row = rows[0];
+		return row === void 0 ? void 0 : map(row);
+	}
+	async function inserted(sql, parameters) {
+		return (await run(sql, parameters)).rowCount === 1;
+	}
+	return {
+		lockAuthorizationRequest(requestId) {
+			return first(LOCK_AUTHORIZATION_REQUEST, [requestId], requestRecord);
+		},
+		insertAuthorizationRequest(record) {
+			return inserted(INSERT_AUTHORIZATION_REQUEST, [
+				record.requestId,
+				record.version,
+				record.clientId,
+				record.subject,
+				record.redirectUri,
+				record.codeChallenge,
+				record.requestedScope,
+				record.createdAt,
+				record.expiresAt
+			]);
+		},
+		lockAuthorizationDecision(requestId) {
+			return first(LOCK_AUTHORIZATION_DECISION, [requestId], decisionRecord);
+		},
+		insertAuthorizationDecision(record) {
+			return inserted(INSERT_AUTHORIZATION_DECISION, [
+				record.requestId,
+				record.version,
+				record.outcome,
+				record.decidedAt,
+				record.codeRef,
+				record.codeExpiresAt
+			]);
+		},
+		lockCapabilityInvalidation(grantId) {
+			return first(LOCK_CAPABILITY_INVALIDATION, [grantId], invalidationRecord);
+		},
+		insertCapabilityInvalidation(record) {
+			return inserted(INSERT_CAPABILITY_INVALIDATION, [
+				record.grantId,
+				record.version,
+				record.clientId,
+				record.capabilityHash,
+				record.invalidatedAt
+			]);
+		},
+		lockAuthorizationCode(codeHash) {
+			return first(LOCK_AUTHORIZATION_CODE, [codeHash], codeRecord);
+		},
+		insertAuthorizationCode(record) {
+			return inserted(INSERT_AUTHORIZATION_CODE, [
+				record.codeHash,
+				record.version,
+				record.requestId,
+				record.clientId,
+				record.redirectUri,
+				record.codeChallenge,
+				record.artifactId,
+				record.createdAt,
+				record.expiresAt,
+				record.consumedAt
+			]);
+		},
+		consumeAuthorizationCode(codeHash, consumedAt) {
+			return inserted(CONSUME_AUTHORIZATION_CODE, [codeHash, consumedAt]);
+		},
+		lockEncryptedArtifact(artifactId) {
+			return first(LOCK_ENCRYPTED_ARTIFACT, [artifactId], artifactRecord);
+		},
+		insertEncryptedArtifact(record) {
+			return inserted(INSERT_ENCRYPTED_ARTIFACT, [
+				record.artifactId,
+				record.version,
+				record.requestId,
+				record.clientId,
+				record.ciphertextRef,
+				record.createdAt,
+				record.claimedAt
+			]);
+		},
+		claimEncryptedArtifact(artifactId, claimedAt) {
+			return inserted(CLAIM_ENCRYPTED_ARTIFACT, [artifactId, claimedAt]);
+		},
+		async commit() {
+			if (settled) relayFailure("relay_internal", "relay transaction already settled");
+			settled = true;
+			let command;
+			try {
+				command = (await client.query("COMMIT")).command;
+			} catch {
+				client.release(true);
+				return relayFailure("relay_state_ambiguous", "relay commit outcome is unproven");
+			}
+			if (command !== "COMMIT") {
+				client.release(true);
+				return relayFailure("relay_state_ambiguous", "relay commit did not commit");
+			}
+			client.release();
+		},
+		async rollback() {
+			if (settled) return;
+			settled = true;
+			try {
+				await client.query("ROLLBACK");
+				client.release();
+			} catch {
+				client.release(true);
+			}
+		}
+	};
+}
+function createPostgresRelayStore(options) {
+	const owned = !("pool" in options);
+	const pool = "pool" in options ? options.pool : new pg.Pool({ connectionString: options.connectionString });
+	return {
+		async begin() {
+			let client;
+			try {
+				client = await pool.connect();
+			} catch {
+				return relayFailure("relay_store_unavailable", "relay connection is unavailable");
+			}
+			try {
+				await client.query("BEGIN");
+			} catch {
+				client.release(true);
+				return relayFailure("relay_store_unavailable", "relay transaction could not start");
+			}
+			return createTransaction(client);
+		},
+		async close() {
+			if (!owned) return;
+			try {
+				await pool.end();
+			} catch {
+				relayFailure("relay_store_unavailable", "relay pool could not be closed");
+			}
+		}
+	};
+}
+//#endregion
+export { OAATH_RELAY_POSTGRES_SCHEMA_STATEMENTS, OAATH_RELAY_POSTGRES_SCHEMA_VERSION, createPostgresRelaySchema, createPostgresRelayStore };
+
+//# sourceMappingURL=postgres.js.map

package/dist/postgres.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"postgres.js","names":[],"sources":["../src/store/postgres/schema.ts","../src/store/postgres/queries.ts","../src/store/postgres/store.ts"],"sourcesContent":["/**\n * The current relay schema. There is no migration runner and no reader for any\n * older schema: an obsolete database is dropped and recreated.\n *\n * Constraints that the database can own are owned by the database — one decision\n * per request, one code and one artifact per request, monotonic timestamps.\n *\n * @author taek <leekt216@gmail.com>\n */\n\nexport const OAATH_RELAY_POSTGRES_SCHEMA_VERSION = \"oaath.relay-postgres-schema/v1\" as const;\n\nconst MAX_SAFE_INTEGER = Number.MAX_SAFE_INTEGER;\n\nexport const OAATH_RELAY_POSTGRES_SCHEMA_STATEMENTS: readonly string[] = Object.freeze([\n  `CREATE TABLE oaath_relay_schema_v1 (\n    schema_id text PRIMARY KEY CHECK (schema_id = 'oaath'),\n    version text NOT NULL\n  )`,\n  `INSERT INTO oaath_relay_schema_v1 (schema_id, version)\n   VALUES ('oaath', '${OAATH_RELAY_POSTGRES_SCHEMA_VERSION}')`,\n  `CREATE TABLE oaath_relay_authorization_request_v1 (\n    request_id text PRIMARY KEY,\n    record_version text NOT NULL,\n    client_id text NOT NULL,\n    subject text NOT NULL,\n    redirect_uri text NOT NULL,\n    code_challenge text NOT NULL,\n    requested_scope text NOT NULL,\n    created_at bigint NOT NULL CHECK (created_at >= 0 AND created_at <= ${MAX_SAFE_INTEGER}),\n    expires_at bigint NOT NULL CHECK (expires_at >= created_at AND expires_at <= ${MAX_SAFE_INTEGER})\n  )`,\n  `CREATE TABLE oaath_relay_authorization_decision_v1 (\n    request_id text PRIMARY KEY\n      REFERENCES oaath_relay_authorization_request_v1 (request_id),\n    record_version text NOT NULL,\n    outcome text NOT NULL CHECK (outcome IN ('approved', 'rejected')),\n    decided_at bigint NOT NULL CHECK (decided_at >= 0 AND decided_at <= ${MAX_SAFE_INTEGER}),\n    code_ref text,\n    code_expires_at bigint CHECK (code_expires_at >= 0 AND code_expires_at <= ${MAX_SAFE_INTEGER}),\n    CHECK ((outcome = 'approved') = (code_ref IS NOT NULL)),\n    CHECK ((code_ref IS NULL) = (code_expires_at IS NULL))\n  )`,\n  `CREATE TABLE oaath_relay_capability_invalidation_v1 (\n    grant_id text PRIMARY KEY,\n    record_version text NOT NULL,\n    client_id text NOT NULL,\n    capability_hash text NOT NULL,\n    invalidated_at bigint NOT NULL CHECK (invalidated_at >= 0 AND invalidated_at <= ${MAX_SAFE_INTEGER})\n  )`,\n  `CREATE TABLE oaath_relay_authorization_code_v1 (\n    code_hash text PRIMARY KEY,\n    record_version text NOT NULL,\n    request_id text NOT NULL UNIQUE\n      REFERENCES oaath_relay_authorization_request_v1 (request_id),\n    client_id text NOT NULL,\n    redirect_uri text NOT NULL,\n    code_challenge text NOT NULL,\n    artifact_id text NOT NULL UNIQUE,\n    created_at bigint NOT NULL CHECK (created_at >= 0 AND created_at <= ${MAX_SAFE_INTEGER}),\n    expires_at bigint NOT NULL CHECK (expires_at >= created_at AND expires_at <= ${MAX_SAFE_INTEGER}),\n    consumed_at bigint CHECK (consumed_at >= created_at AND consumed_at <= ${MAX_SAFE_INTEGER})\n  )`,\n  `CREATE TABLE oaath_relay_encrypted_artifact_v1 (\n    artifact_id text PRIMARY KEY,\n    record_version text NOT NULL,\n    request_id text NOT NULL UNIQUE\n      REFERENCES oaath_relay_authorization_request_v1 (request_id),\n    client_id text NOT NULL,\n    ciphertext_ref text NOT NULL,\n    created_at bigint NOT NULL CHECK (created_at >= 0 AND created_at <= ${MAX_SAFE_INTEGER}),\n    claimed_at bigint CHECK (claimed_at >= created_at AND claimed_at <= ${MAX_SAFE_INTEGER})\n  )`,\n]);\n\nexport interface RelaySchemaExecutor {\n  query(sql: string): Promise<unknown>;\n}\n\n/**\n * Creates the current schema in the executor's `search_path`. It is not a\n * migration: it fails if the objects already exist.\n */\nexport async function createPostgresRelaySchema(executor: RelaySchemaExecutor): Promise<void> {\n  for (const statement of OAATH_RELAY_POSTGRES_SCHEMA_STATEMENTS) {\n    await executor.query(statement);\n  }\n}\n","/**\n * Relay SQL. Text only: no state-machine decision lives in this file.\n *\n * Names are unqualified so a deployment (or a disposable test schema) selects\n * them with `search_path`.\n *\n * @author taek <leekt216@gmail.com>\n */\n\nconst REQUEST_COLUMNS = `\n  request_id, record_version, client_id, subject, redirect_uri,\n  code_challenge, requested_scope, created_at, expires_at\n`;\n\nconst CODE_COLUMNS = `\n  code_hash, record_version, request_id, client_id, redirect_uri,\n  code_challenge, artifact_id, created_at, expires_at, consumed_at\n`;\n\nconst ARTIFACT_COLUMNS = `\n  artifact_id, record_version, request_id, client_id, ciphertext_ref,\n  created_at, claimed_at\n`;\n\nexport const LOCK_AUTHORIZATION_REQUEST = `\n  SELECT ${REQUEST_COLUMNS}\n  FROM oaath_relay_authorization_request_v1\n  WHERE request_id = $1\n  FOR UPDATE\n`;\n\nexport const INSERT_AUTHORIZATION_REQUEST = `\n  INSERT INTO oaath_relay_authorization_request_v1 (${REQUEST_COLUMNS})\n  VALUES ($1, $2, $3, $4, $5, $6, $7, $8, $9)\n  ON CONFLICT (request_id) DO NOTHING\n`;\n\nexport const LOCK_AUTHORIZATION_DECISION = `\n  SELECT request_id, record_version, outcome, decided_at, code_ref, code_expires_at\n  FROM oaath_relay_authorization_decision_v1\n  WHERE request_id = $1\n  FOR UPDATE\n`;\n\nexport const INSERT_AUTHORIZATION_DECISION = `\n  INSERT INTO oaath_relay_authorization_decision_v1 (\n    request_id, record_version, outcome, decided_at, code_ref, code_expires_at\n  ) VALUES ($1, $2, $3, $4, $5, $6)\n  ON CONFLICT (request_id) DO NOTHING\n`;\n\nexport const LOCK_CAPABILITY_INVALIDATION = `\n  SELECT grant_id, record_version, client_id, capability_hash, invalidated_at\n  FROM oaath_relay_capability_invalidation_v1\n  WHERE grant_id = $1\n  FOR UPDATE\n`;\n\nexport const INSERT_CAPABILITY_INVALIDATION = `\n  INSERT INTO oaath_relay_capability_invalidation_v1 (\n    grant_id, record_version, client_id, capability_hash, invalidated_at\n  ) VALUES ($1, $2, $3, $4, $5)\n  ON CONFLICT (grant_id) DO NOTHING\n`;\n\nexport const LOCK_AUTHORIZATION_CODE = `\n  SELECT ${CODE_COLUMNS}\n  FROM oaath_relay_authorization_code_v1\n  WHERE code_hash = $1\n  FOR UPDATE\n`;\n\nexport const INSERT_AUTHORIZATION_CODE = `\n  INSERT INTO oaath_relay_authorization_code_v1 (${CODE_COLUMNS})\n  VALUES ($1, $2, $3, $4, $5, $6, $7, $8, $9, $10)\n  ON CONFLICT DO NOTHING\n`;\n\n/** One-shot: the guard makes a second consume affect zero rows. */\nexport const CONSUME_AUTHORIZATION_CODE = `\n  UPDATE oaath_relay_authorization_code_v1\n  SET consumed_at = $2\n  WHERE code_hash = $1 AND consumed_at IS NULL\n`;\n\nexport const LOCK_ENCRYPTED_ARTIFACT = `\n  SELECT ${ARTIFACT_COLUMNS}\n  FROM oaath_relay_encrypted_artifact_v1\n  WHERE artifact_id = $1\n  FOR UPDATE\n`;\n\nexport const INSERT_ENCRYPTED_ARTIFACT = `\n  INSERT INTO oaath_relay_encrypted_artifact_v1 (${ARTIFACT_COLUMNS})\n  VALUES ($1, $2, $3, $4, $5, $6, $7)\n  ON CONFLICT DO NOTHING\n`;\n\n/** One-shot: the guard makes a second claim affect zero rows. */\nexport const CLAIM_ENCRYPTED_ARTIFACT = `\n  UPDATE oaath_relay_encrypted_artifact_v1\n  SET claimed_at = $2\n  WHERE artifact_id = $1 AND claimed_at IS NULL\n`;\n","/**\n * PostgreSQL relay store.\n *\n * Every transition reads its row with `SELECT ... FOR UPDATE` and writes through\n * a guarded statement, so concurrent workers cannot both perform a one-shot\n * transition. A `COMMIT` whose outcome cannot be proven is reported as\n * `relay_state_ambiguous`: the caller neither assumes the transition applied nor\n * retries it.\n *\n * @author taek <leekt216@gmail.com>\n */\n\nimport type { Pool, PoolClient } from \"pg\";\nimport pg from \"pg\";\nimport { relayFailure } from \"../../relay/errors.js\";\nimport type { RelayStore, RelayTransaction } from \"../interface.js\";\nimport {\n  type AuthorizationCodeRecord,\n  type AuthorizationDecisionRecord,\n  type AuthorizationRequestRecord,\n  type CapabilityInvalidationRecord,\n  type EncryptedArtifactRecord,\n  parseAuthorizationCodeRecord,\n  parseAuthorizationDecisionRecord,\n  parseAuthorizationRequestRecord,\n  parseCapabilityInvalidationRecord,\n  parseEncryptedArtifactRecord,\n} from \"../records.js\";\nimport {\n  CLAIM_ENCRYPTED_ARTIFACT,\n  CONSUME_AUTHORIZATION_CODE,\n  INSERT_AUTHORIZATION_CODE,\n  INSERT_AUTHORIZATION_DECISION,\n  INSERT_AUTHORIZATION_REQUEST,\n  INSERT_CAPABILITY_INVALIDATION,\n  INSERT_ENCRYPTED_ARTIFACT,\n  LOCK_AUTHORIZATION_CODE,\n  LOCK_AUTHORIZATION_DECISION,\n  LOCK_AUTHORIZATION_REQUEST,\n  LOCK_CAPABILITY_INVALIDATION,\n  LOCK_ENCRYPTED_ARTIFACT,\n} from \"./queries.js\";\n\nexport type PostgresRelayStoreOptions =\n  /** The deployment owns the pool: credentials, TLS, limits, and shutdown. */\n  | Readonly<{ pool: Pool }>\n  /** The store owns a pool created from this connection string. */\n  | Readonly<{ connectionString: string }>;\n\ntype Row = Record<string, unknown>;\n\n/** `bigint` arrives as a decimal string; the record parser validates the result. */\nfunction sqlTimestamp(value: unknown): unknown {\n  if (typeof value !== \"string\") return value;\n  const parsed = Number(value);\n  return Number.isFinite(parsed) ? parsed : value;\n}\n\nfunction requestRecord(row: Row): AuthorizationRequestRecord {\n  return parseAuthorizationRequestRecord({\n    version: row.record_version,\n    requestId: row.request_id,\n    clientId: row.client_id,\n    subject: row.subject,\n    redirectUri: row.redirect_uri,\n    codeChallenge: row.code_challenge,\n    requestedScope: row.requested_scope,\n    createdAt: sqlTimestamp(row.created_at),\n    expiresAt: sqlTimestamp(row.expires_at),\n  });\n}\n\nfunction decisionRecord(row: Row): AuthorizationDecisionRecord {\n  return parseAuthorizationDecisionRecord({\n    version: row.record_version,\n    requestId: row.request_id,\n    outcome: row.outcome,\n    decidedAt: sqlTimestamp(row.decided_at),\n    codeRef: row.code_ref,\n    codeExpiresAt: row.code_expires_at === null ? null : sqlTimestamp(row.code_expires_at),\n  });\n}\n\nfunction invalidationRecord(row: Row): CapabilityInvalidationRecord {\n  return parseCapabilityInvalidationRecord({\n    version: row.record_version,\n    grantId: row.grant_id,\n    clientId: row.client_id,\n    capabilityHash: row.capability_hash,\n    invalidatedAt: sqlTimestamp(row.invalidated_at),\n  });\n}\n\nfunction codeRecord(row: Row): AuthorizationCodeRecord {\n  return parseAuthorizationCodeRecord({\n    version: row.record_version,\n    codeHash: row.code_hash,\n    requestId: row.request_id,\n    clientId: row.client_id,\n    redirectUri: row.redirect_uri,\n    codeChallenge: row.code_challenge,\n    artifactId: row.artifact_id,\n    createdAt: sqlTimestamp(row.created_at),\n    expiresAt: sqlTimestamp(row.expires_at),\n    consumedAt: sqlTimestamp(row.consumed_at),\n  });\n}\n\nfunction artifactRecord(row: Row): EncryptedArtifactRecord {\n  return parseEncryptedArtifactRecord({\n    version: row.record_version,\n    artifactId: row.artifact_id,\n    requestId: row.request_id,\n    clientId: row.client_id,\n    ciphertextRef: row.ciphertext_ref,\n    createdAt: sqlTimestamp(row.created_at),\n    claimedAt: sqlTimestamp(row.claimed_at),\n  });\n}\n\nfunction createTransaction(client: PoolClient): RelayTransaction {\n  let settled = false;\n\n  async function run(\n    sql: string,\n    parameters: readonly unknown[],\n  ): Promise<{ readonly rows: readonly Row[]; readonly rowCount: number }> {\n    if (settled) relayFailure(\"relay_internal\", \"relay transaction already settled\");\n    try {\n      const result = await client.query(sql, [...parameters]);\n      return { rows: result.rows, rowCount: result.rowCount ?? 0 };\n    } catch {\n      // Nothing has committed, so nothing is ambiguous yet.\n      return relayFailure(\"relay_store_unavailable\", \"relay statement failed\");\n    }\n  }\n\n  async function first<Value>(\n    sql: string,\n    parameters: readonly unknown[],\n    map: (row: Row) => Value,\n  ): Promise<Value | undefined> {\n    const { rows } = await run(sql, parameters);\n    if (rows.length === 0) return undefined;\n    if (rows.length > 1) {\n      return relayFailure(\"relay_record_unreadable\", \"relay key matched multiple rows\");\n    }\n    const row = rows[0];\n    return row === undefined ? undefined : map(row);\n  }\n\n  async function inserted(sql: string, parameters: readonly unknown[]): Promise<boolean> {\n    return (await run(sql, parameters)).rowCount === 1;\n  }\n\n  return {\n    lockAuthorizationRequest(requestId) {\n      return first(LOCK_AUTHORIZATION_REQUEST, [requestId], requestRecord);\n    },\n    insertAuthorizationRequest(record) {\n      return inserted(INSERT_AUTHORIZATION_REQUEST, [\n        record.requestId,\n        record.version,\n        record.clientId,\n        record.subject,\n        record.redirectUri,\n        record.codeChallenge,\n        record.requestedScope,\n        record.createdAt,\n        record.expiresAt,\n      ]);\n    },\n    lockAuthorizationDecision(requestId) {\n      return first(LOCK_AUTHORIZATION_DECISION, [requestId], decisionRecord);\n    },\n    insertAuthorizationDecision(record) {\n      return inserted(INSERT_AUTHORIZATION_DECISION, [\n        record.requestId,\n        record.version,\n        record.outcome,\n        record.decidedAt,\n        record.codeRef,\n        record.codeExpiresAt,\n      ]);\n    },\n    lockCapabilityInvalidation(grantId) {\n      return first(LOCK_CAPABILITY_INVALIDATION, [grantId], invalidationRecord);\n    },\n    insertCapabilityInvalidation(record) {\n      return inserted(INSERT_CAPABILITY_INVALIDATION, [\n        record.grantId,\n        record.version,\n        record.clientId,\n        record.capabilityHash,\n        record.invalidatedAt,\n      ]);\n    },\n    lockAuthorizationCode(codeHash) {\n      return first(LOCK_AUTHORIZATION_CODE, [codeHash], codeRecord);\n    },\n    insertAuthorizationCode(record) {\n      return inserted(INSERT_AUTHORIZATION_CODE, [\n        record.codeHash,\n        record.version,\n        record.requestId,\n        record.clientId,\n        record.redirectUri,\n        record.codeChallenge,\n        record.artifactId,\n        record.createdAt,\n        record.expiresAt,\n        record.consumedAt,\n      ]);\n    },\n    consumeAuthorizationCode(codeHash, consumedAt) {\n      return inserted(CONSUME_AUTHORIZATION_CODE, [codeHash, consumedAt]);\n    },\n    lockEncryptedArtifact(artifactId) {\n      return first(LOCK_ENCRYPTED_ARTIFACT, [artifactId], artifactRecord);\n    },\n    insertEncryptedArtifact(record) {\n      return inserted(INSERT_ENCRYPTED_ARTIFACT, [\n        record.artifactId,\n        record.version,\n        record.requestId,\n        record.clientId,\n        record.ciphertextRef,\n        record.createdAt,\n        record.claimedAt,\n      ]);\n    },\n    claimEncryptedArtifact(artifactId, claimedAt) {\n      return inserted(CLAIM_ENCRYPTED_ARTIFACT, [artifactId, claimedAt]);\n    },\n    async commit() {\n      if (settled) relayFailure(\"relay_internal\", \"relay transaction already settled\");\n      settled = true;\n      let command: unknown;\n      try {\n        command = (await client.query(\"COMMIT\")).command;\n      } catch {\n        // A COMMIT that did not answer never proves its own outcome.\n        client.release(true);\n        return relayFailure(\"relay_state_ambiguous\", \"relay commit outcome is unproven\");\n      }\n      if (command !== \"COMMIT\") {\n        // PostgreSQL answers an aborted transaction's COMMIT with ROLLBACK.\n        client.release(true);\n        return relayFailure(\"relay_state_ambiguous\", \"relay commit did not commit\");\n      }\n      client.release();\n    },\n    async rollback() {\n      if (settled) return;\n      settled = true;\n      try {\n        await client.query(\"ROLLBACK\");\n        client.release();\n      } catch {\n        // Cleanup is secondary; discard the connection instead of reusing it.\n        client.release(true);\n      }\n    },\n  };\n}\n\nexport function createPostgresRelayStore(options: PostgresRelayStoreOptions): RelayStore {\n  const owned = !(\"pool\" in options);\n  const pool: Pool =\n    \"pool\" in options ? options.pool : new pg.Pool({ connectionString: options.connectionString });\n\n  return {\n    async begin(): Promise<RelayTransaction> {\n      let client: PoolClient;\n      try {\n        client = await pool.connect();\n      } catch {\n        return relayFailure(\"relay_store_unavailable\", \"relay connection is unavailable\");\n      }\n      try {\n        await client.query(\"BEGIN\");\n      } catch {\n        client.release(true);\n        return relayFailure(\"relay_store_unavailable\", \"relay transaction could not start\");\n      }\n      return createTransaction(client);\n    },\n    async close(): Promise<void> {\n      // A borrowed pool belongs to the deployment.\n      if (!owned) return;\n      try {\n        await pool.end();\n      } catch {\n        relayFailure(\"relay_store_unavailable\", \"relay pool could not be closed\");\n      }\n    },\n  };\n}\n"],"mappings":";;;;;;;;;;;;AAUA,MAAa,sCAAsC;AAEnD,MAAM,mBAAmB,OAAO;AAEhC,MAAa,yCAA4D,OAAO,OAAO;CACrF;;;;CAIA;uBACqB,oCAAoC;CACzD;;;;;;;;0EAQwE,iBAAiB;mFACR,iBAAiB;;CAElG;;;;;0EAKwE,iBAAiB;;gFAEX,iBAAiB;;;;CAI/F;;;;;sFAKoF,iBAAiB;;CAErG;;;;;;;;;0EASwE,iBAAiB;mFACR,iBAAiB;6EACvB,iBAAiB;;CAE5F;;;;;;;0EAOwE,iBAAiB;0EACjB,iBAAiB;;AAE3F,CAAC;;;;;AAUD,eAAsB,0BAA0B,UAA8C;CAC5F,KAAK,MAAM,aAAa,wCACtB,MAAM,SAAS,MAAM,SAAS;AAElC;;;;;;;;;;;AC9EA,MAAM,kBAAkB;;;;AAKxB,MAAM,eAAe;;;;AAKrB,MAAM,mBAAmB;;;;AAKzB,MAAa,6BAA6B;WAC/B,gBAAgB;;;;;AAM3B,MAAa,+BAA+B;sDACU,gBAAgB;;;;AAKtE,MAAa,8BAA8B;;;;;;AAO3C,MAAa,gCAAgC;;;;;;AAO7C,MAAa,+BAA+B;;;;;;AAO5C,MAAa,iCAAiC;;;;;;AAO9C,MAAa,0BAA0B;WAC5B,aAAa;;;;;AAMxB,MAAa,4BAA4B;mDACU,aAAa;;;;;AAMhE,MAAa,6BAA6B;;;;;AAM1C,MAAa,0BAA0B;WAC5B,iBAAiB;;;;;AAM5B,MAAa,4BAA4B;mDACU,iBAAiB;;;;;AAMpE,MAAa,2BAA2B;;;;;;;;AC/CxC,SAAS,aAAa,OAAyB;CAC7C,IAAI,OAAO,UAAU,UAAU,OAAO;CACtC,MAAM,SAAS,OAAO,KAAK;CAC3B,OAAO,OAAO,SAAS,MAAM,IAAI,SAAS;AAC5C;AAEA,SAAS,cAAc,KAAsC;CAC3D,OAAO,gCAAgC;EACrC,SAAS,IAAI;EACb,WAAW,IAAI;EACf,UAAU,IAAI;EACd,SAAS,IAAI;EACb,aAAa,IAAI;EACjB,eAAe,IAAI;EACnB,gBAAgB,IAAI;EACpB,WAAW,aAAa,IAAI,UAAU;EACtC,WAAW,aAAa,IAAI,UAAU;CACxC,CAAC;AACH;AAEA,SAAS,eAAe,KAAuC;CAC7D,OAAO,iCAAiC;EACtC,SAAS,IAAI;EACb,WAAW,IAAI;EACf,SAAS,IAAI;EACb,WAAW,aAAa,IAAI,UAAU;EACtC,SAAS,IAAI;EACb,eAAe,IAAI,oBAAoB,OAAO,OAAO,aAAa,IAAI,eAAe;CACvF,CAAC;AACH;AAEA,SAAS,mBAAmB,KAAwC;CAClE,OAAO,kCAAkC;EACvC,SAAS,IAAI;EACb,SAAS,IAAI;EACb,UAAU,IAAI;EACd,gBAAgB,IAAI;EACpB,eAAe,aAAa,IAAI,cAAc;CAChD,CAAC;AACH;AAEA,SAAS,WAAW,KAAmC;CACrD,OAAO,6BAA6B;EAClC,SAAS,IAAI;EACb,UAAU,IAAI;EACd,WAAW,IAAI;EACf,UAAU,IAAI;EACd,aAAa,IAAI;EACjB,eAAe,IAAI;EACnB,YAAY,IAAI;EAChB,WAAW,aAAa,IAAI,UAAU;EACtC,WAAW,aAAa,IAAI,UAAU;EACtC,YAAY,aAAa,IAAI,WAAW;CAC1C,CAAC;AACH;AAEA,SAAS,eAAe,KAAmC;CACzD,OAAO,6BAA6B;EAClC,SAAS,IAAI;EACb,YAAY,IAAI;EAChB,WAAW,IAAI;EACf,UAAU,IAAI;EACd,eAAe,IAAI;EACnB,WAAW,aAAa,IAAI,UAAU;EACtC,WAAW,aAAa,IAAI,UAAU;CACxC,CAAC;AACH;AAEA,SAAS,kBAAkB,QAAsC;CAC/D,IAAI,UAAU;CAEd,eAAe,IACb,KACA,YACuE;EACvE,IAAI,SAAS,aAAa,kBAAkB,mCAAmC;EAC/E,IAAI;GACF,MAAM,SAAS,MAAM,OAAO,MAAM,KAAK,CAAC,GAAG,UAAU,CAAC;GACtD,OAAO;IAAE,MAAM,OAAO;IAAM,UAAU,OAAO,YAAY;GAAE;EAC7D,QAAQ;GAEN,OAAO,aAAa,2BAA2B,wBAAwB;EACzE;CACF;CAEA,eAAe,MACb,KACA,YACA,KAC4B;EAC5B,MAAM,EAAE,SAAS,MAAM,IAAI,KAAK,UAAU;EAC1C,IAAI,KAAK,WAAW,GAAG,OAAO,KAAA;EAC9B,IAAI,KAAK,SAAS,GAChB,OAAO,aAAa,2BAA2B,iCAAiC;EAElF,MAAM,MAAM,KAAK;EACjB,OAAO,QAAQ,KAAA,IAAY,KAAA,IAAY,IAAI,GAAG;CAChD;CAEA,eAAe,SAAS,KAAa,YAAkD;EACrF,QAAQ,MAAM,IAAI,KAAK,UAAU,EAAA,CAAG,aAAa;CACnD;CAEA,OAAO;EACL,yBAAyB,WAAW;GAClC,OAAO,MAAM,4BAA4B,CAAC,SAAS,GAAG,aAAa;EACrE;EACA,2BAA2B,QAAQ;GACjC,OAAO,SAAS,8BAA8B;IAC5C,OAAO;IACP,OAAO;IACP,OAAO;IACP,OAAO;IACP,OAAO;IACP,OAAO;IACP,OAAO;IACP,OAAO;IACP,OAAO;GACT,CAAC;EACH;EACA,0BAA0B,WAAW;GACnC,OAAO,MAAM,6BAA6B,CAAC,SAAS,GAAG,cAAc;EACvE;EACA,4BAA4B,QAAQ;GAClC,OAAO,SAAS,+BAA+B;IAC7C,OAAO;IACP,OAAO;IACP,OAAO;IACP,OAAO;IACP,OAAO;IACP,OAAO;GACT,CAAC;EACH;EACA,2BAA2B,SAAS;GAClC,OAAO,MAAM,8BAA8B,CAAC,OAAO,GAAG,kBAAkB;EAC1E;EACA,6BAA6B,QAAQ;GACnC,OAAO,SAAS,gCAAgC;IAC9C,OAAO;IACP,OAAO;IACP,OAAO;IACP,OAAO;IACP,OAAO;GACT,CAAC;EACH;EACA,sBAAsB,UAAU;GAC9B,OAAO,MAAM,yBAAyB,CAAC,QAAQ,GAAG,UAAU;EAC9D;EACA,wBAAwB,QAAQ;GAC9B,OAAO,SAAS,2BAA2B;IACzC,OAAO;IACP,OAAO;IACP,OAAO;IACP,OAAO;IACP,OAAO;IACP,OAAO;IACP,OAAO;IACP,OAAO;IACP,OAAO;IACP,OAAO;GACT,CAAC;EACH;EACA,yBAAyB,UAAU,YAAY;GAC7C,OAAO,SAAS,4BAA4B,CAAC,UAAU,UAAU,CAAC;EACpE;EACA,sBAAsB,YAAY;GAChC,OAAO,MAAM,yBAAyB,CAAC,UAAU,GAAG,cAAc;EACpE;EACA,wBAAwB,QAAQ;GAC9B,OAAO,SAAS,2BAA2B;IACzC,OAAO;IACP,OAAO;IACP,OAAO;IACP,OAAO;IACP,OAAO;IACP,OAAO;IACP,OAAO;GACT,CAAC;EACH;EACA,uBAAuB,YAAY,WAAW;GAC5C,OAAO,SAAS,0BAA0B,CAAC,YAAY,SAAS,CAAC;EACnE;EACA,MAAM,SAAS;GACb,IAAI,SAAS,aAAa,kBAAkB,mCAAmC;GAC/E,UAAU;GACV,IAAI;GACJ,IAAI;IACF,WAAW,MAAM,OAAO,MAAM,QAAQ,EAAA,CAAG;GAC3C,QAAQ;IAEN,OAAO,QAAQ,IAAI;IACnB,OAAO,aAAa,yBAAyB,kCAAkC;GACjF;GACA,IAAI,YAAY,UAAU;IAExB,OAAO,QAAQ,IAAI;IACnB,OAAO,aAAa,yBAAyB,6BAA6B;GAC5E;GACA,OAAO,QAAQ;EACjB;EACA,MAAM,WAAW;GACf,IAAI,SAAS;GACb,UAAU;GACV,IAAI;IACF,MAAM,OAAO,MAAM,UAAU;IAC7B,OAAO,QAAQ;GACjB,QAAQ;IAEN,OAAO,QAAQ,IAAI;GACrB;EACF;CACF;AACF;AAEA,SAAgB,yBAAyB,SAAgD;CACvF,MAAM,QAAQ,EAAE,UAAU;CAC1B,MAAM,OACJ,UAAU,UAAU,QAAQ,OAAO,IAAI,GAAG,KAAK,EAAE,kBAAkB,QAAQ,iBAAiB,CAAC;CAE/F,OAAO;EACL,MAAM,QAAmC;GACvC,IAAI;GACJ,IAAI;IACF,SAAS,MAAM,KAAK,QAAQ;GAC9B,QAAQ;IACN,OAAO,aAAa,2BAA2B,iCAAiC;GAClF;GACA,IAAI;IACF,MAAM,OAAO,MAAM,OAAO;GAC5B,QAAQ;IACN,OAAO,QAAQ,IAAI;IACnB,OAAO,aAAa,2BAA2B,mCAAmC;GACpF;GACA,OAAO,kBAAkB,MAAM;EACjC;EACA,MAAM,QAAuB;GAE3B,IAAI,CAAC,OAAO;GACZ,IAAI;IACF,MAAM,KAAK,IAAI;GACjB,QAAQ;IACN,aAAa,2BAA2B,gCAAgC;GAC1E;EACF;CACF;AACF"}