@oimlsmart/platform-server 0.1.0

package/src/store/sqlite/upstream-store.ts

@@ -0,0 +1,148 @@
+// ═══════════════════════════════════════════════════════════════════
+// The upstream providers' SQLite half (TODO.identity/08) — the sync
+// implementations behind the ServerStore upstream methods
+// (sqlite-server-store.ts delegates here one-for-one, mirroring
+// op-store.ts's role for the OP domain).
+//
+// Two tables:
+//   identity_providers — the upstream registry (GitHub + Google + Apple
+//     + Entra + generic OIDC; the client secret is NEVER stored, only
+//     the env reference);
+//   identity_links — the linked identities (TODO.identity/02's shape,
+//     landed additively here): THE match rule for an upstream sign-in
+//     is (provider, provider_account_id) — NEVER email alone.
+//
+// NODE-ONLY: better-sqlite3 through ./store's getDb. The Worker bundle
+// never sees this module (the D1 store implements the same surface in
+// d1-store.ts).
+// ═══════════════════════════════════════════════════════════════════
+
+import { randomUUID } from 'crypto'
+import { getDb } from './store'
+import type { IdentityLink, IdentityProvider } from '../../store'
+
+function toIdentityProvider(row: Record<string, unknown>): IdentityProvider {
+  return {
+    id: row.id as string,
+    kind: row.kind as IdentityProvider['kind'],
+    displayName: row.display_name as string,
+    brandMark: (row.brand_mark as string | null) ?? null,
+    issuer: (row.issuer as string | null) ?? null,
+    clientId: row.client_id as string,
+    clientSecretRef: (row.client_secret_ref as string | null) ?? null,
+    scopes: (row.scopes as string | null) ?? null,
+    enabled: row.enabled === 1,
+    createdAt: row.created_at as string,
+    createdBy: (row.created_by as string | null) ?? null,
+    updatedAt: (row.updated_at as string | null) ?? null,
+  }
+}
+
+export function listIdentityProviders(): IdentityProvider[] {
+  const rows = getDb().prepare('SELECT * FROM identity_providers ORDER BY created_at, id').all() as Array<Record<string, unknown>>
+  return rows.map(toIdentityProvider)
+}
+
+export function getIdentityProvider(id: string): IdentityProvider | null {
+  const row = getDb().prepare('SELECT * FROM identity_providers WHERE id = ?').get(id) as Record<string, unknown> | undefined
+  return row ? toIdentityProvider(row) : null
+}
+
+export function upsertIdentityProvider(input: {
+  id: string
+  kind: IdentityProvider['kind']
+  displayName: string
+  brandMark?: string | null
+  issuer?: string | null
+  clientId: string
+  clientSecretRef?: string | null
+  scopes?: string | null
+  enabled?: boolean
+  createdBy?: string | null
+}): IdentityProvider {
+  getDb().prepare(`
+    INSERT INTO identity_providers
+      (id, kind, display_name, brand_mark, issuer, client_id, client_secret_ref, scopes, enabled, created_by)
+    VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?)
+    ON CONFLICT (id) DO UPDATE SET
+      kind = excluded.kind,
+      display_name = excluded.display_name,
+      brand_mark = excluded.brand_mark,
+      issuer = excluded.issuer,
+      client_id = excluded.client_id,
+      client_secret_ref = excluded.client_secret_ref,
+      scopes = excluded.scopes,
+      enabled = excluded.enabled,
+      updated_at = datetime('now')
+  `).run(
+    input.id,
+    input.kind,
+    input.displayName,
+    input.brandMark ?? null,
+    input.issuer ?? null,
+    input.clientId,
+    input.clientSecretRef ?? null,
+    input.scopes ?? null,
+    // Disabled by default (the schema's DEFAULT 0): a provider becomes
+    // visible to the login page only by a deliberate enable.
+    input.enabled ? 1 : 0,
+    input.createdBy ?? null,
+  )
+  return getIdentityProvider(input.id)!
+}
+
+export function setIdentityProviderEnabled(id: string, enabled: boolean): IdentityProvider | null {
+  const res = getDb().prepare("UPDATE identity_providers SET enabled = ?, updated_at = datetime('now') WHERE id = ?")
+    .run(enabled ? 1 : 0, id)
+  return res.changes > 0 ? getIdentityProvider(id) : null
+}
+
+export function deleteIdentityProvider(id: string): boolean {
+  const res = getDb().prepare('DELETE FROM identity_providers WHERE id = ?').run(id)
+  return res.changes > 0
+}
+
+// ── the linked identities ────────────────────────────────────────────
+
+function toIdentityLink(row: Record<string, unknown>): IdentityLink {
+  return {
+    id: row.id as string,
+    userId: row.user_id as string,
+    provider: row.provider as string,
+    providerAccountId: row.provider_account_id as string,
+    linkedAt: row.linked_at as string,
+    linkedBy: (row.linked_by as string | null) ?? null,
+  }
+}
+
+export function listIdentityLinks(userId: string): IdentityLink[] {
+  const rows = getDb().prepare('SELECT * FROM identity_links WHERE user_id = ? ORDER BY linked_at, provider').all(userId) as Array<Record<string, unknown>>
+  return rows.map(toIdentityLink)
+}
+
+export function findIdentityLink(provider: string, providerAccountId: string): IdentityLink | null {
+  const row = getDb().prepare('SELECT * FROM identity_links WHERE provider = ? AND provider_account_id = ?')
+    .get(provider, providerAccountId) as Record<string, unknown> | undefined
+  return row ? toIdentityLink(row) : null
+}
+
+/** Create the link; NULL on the UNIQUE(provider, provider_account_id)
+ *  conflict — the pair is already linked (to any account). */
+export function createIdentityLink(input: {
+  userId: string
+  provider: string
+  providerAccountId: string
+  linkedBy?: string | null
+}): IdentityLink | null {
+  const id = randomUUID()
+  const res = getDb().prepare(
+    'INSERT OR IGNORE INTO identity_links (id, user_id, provider, provider_account_id, linked_by) VALUES (?, ?, ?, ?, ?)',
+  ).run(id, input.userId, input.provider, input.providerAccountId, input.linkedBy ?? null)
+  if (res.changes === 0) return null
+  return findIdentityLink(input.provider, input.providerAccountId)
+}
+
+export function deleteIdentityLink(userId: string, provider: string): boolean {
+  const res = getDb().prepare('DELETE FROM identity_links WHERE user_id = ? AND provider = ?').run(userId, provider)
+  return res.changes > 0
+}