@opengeni/db 3.4.0-canary.2 → 3.6.0

package/src/managed-auth-session-set-schema.ts

@@ -0,0 +1,176 @@
+import {
+  bigint,
+  index,
+  integer,
+  jsonb,
+  pgTable,
+  primaryKey,
+  text,
+  timestamp,
+  unique,
+  uniqueIndex,
+  uuid,
+} from "drizzle-orm/pg-core";
+import { sql } from "drizzle-orm";
+
+export const managedAuthBrowserInstallations = pgTable("managed_auth_browser_installations", {
+  id: uuid("id").primaryKey().defaultRandom(),
+  authorityHash: text("authority_hash").notNull().unique(),
+  createdAt: timestamp("created_at", { withTimezone: true }).notNull().defaultNow(),
+  lastSeenAt: timestamp("last_seen_at", { withTimezone: true }).notNull().defaultNow(),
+  idleExpiresAt: timestamp("idle_expires_at", { withTimezone: true }).notNull(),
+  absoluteExpiresAt: timestamp("absolute_expires_at", { withTimezone: true }).notNull(),
+  revokedAt: timestamp("revoked_at", { withTimezone: true }),
+});
+
+export const managedAuthSessionSets = pgTable("managed_auth_session_sets", {
+  id: uuid("id").primaryKey().defaultRandom(),
+  installationId: uuid("installation_id").notNull().unique(),
+  authorityHash: text("authority_hash").notNull().unique(),
+  csrfHash: text("csrf_hash").notNull(),
+  generation: bigint("generation", { mode: "number" }).notNull().default(1),
+  actorEpoch: bigint("actor_epoch", { mode: "number" }).notNull().default(1),
+  selectedSlotId: uuid("selected_slot_id"),
+  state: text("state").notNull().default("ready"),
+  createdAt: timestamp("created_at", { withTimezone: true }).notNull().defaultNow(),
+  updatedAt: timestamp("updated_at", { withTimezone: true }).notNull().defaultNow(),
+  idleExpiresAt: timestamp("idle_expires_at", { withTimezone: true }).notNull(),
+  absoluteExpiresAt: timestamp("absolute_expires_at", { withTimezone: true }).notNull(),
+  revokedAt: timestamp("revoked_at", { withTimezone: true }),
+});
+
+export const managedAuthLoginSlots = pgTable(
+  "managed_auth_login_slots",
+  {
+    id: uuid("id").primaryKey().defaultRandom(),
+    sessionSetId: uuid("session_set_id").notNull(),
+    authSessionId: text("auth_session_id"),
+    authUserId: text("auth_user_id").notNull(),
+    identityId: uuid("identity_id").notNull(),
+    loginBindingId: uuid("login_binding_id").notNull(),
+    identityRevision: bigint("identity_revision", { mode: "number" }).notNull(),
+    authRevision: bigint("auth_revision", { mode: "number" }).notNull(),
+    loginBindingRevision: bigint("login_binding_revision", { mode: "number" }).notNull(),
+    displayName: text("display_name").notNull(),
+    verifiedEmail: text("verified_email").notNull(),
+    status: text("status").notNull().default("active"),
+    createdAt: timestamp("created_at", { withTimezone: true }).notNull().defaultNow(),
+    updatedAt: timestamp("updated_at", { withTimezone: true }).notNull().defaultNow(),
+    revokedAt: timestamp("revoked_at", { withTimezone: true }),
+  },
+  (table) => ({
+    idSet: unique("managed_auth_login_slots_id_set_unique").on(table.id, table.sessionSetId),
+    liveBinding: uniqueIndex("managed_auth_login_slots_live_binding_idx")
+      .on(table.sessionSetId, table.loginBindingId)
+      .where(sql`${table.status} <> 'revoked'`),
+    liveSession: uniqueIndex("managed_auth_login_slots_live_session_idx")
+      .on(table.authSessionId)
+      .where(sql`${table.authSessionId} is not null and ${table.status} <> 'revoked'`),
+    setStatus: index("managed_auth_login_slots_set_status_idx").on(
+      table.sessionSetId,
+      table.status,
+      table.createdAt,
+      table.id,
+    ),
+  }),
+);
+
+export const managedAuthLoginReturnIntents = pgTable("managed_auth_login_return_intents", {
+  id: uuid("id").primaryKey(),
+  sessionSetId: uuid("session_set_id").notNull(),
+  path: text("path").notNull(),
+  expiresAt: timestamp("expires_at", { withTimezone: true }).notNull(),
+  consumedAt: timestamp("consumed_at", { withTimezone: true }),
+  createdAt: timestamp("created_at", { withTimezone: true }).notNull().defaultNow(),
+});
+
+export const managedAuthLoginTransactions = pgTable(
+  "managed_auth_login_transactions",
+  {
+    id: uuid("id").primaryKey(),
+    sessionSetId: uuid("session_set_id").notNull(),
+    secretHash: text("secret_hash").notNull(),
+    kind: text("kind").notNull(),
+    targetSlotId: uuid("target_slot_id"),
+    expectedIdentityId: uuid("expected_identity_id"),
+    expectedLoginBindingId: uuid("expected_login_binding_id"),
+    expectedIdentityRevision: bigint("expected_identity_revision", { mode: "number" }),
+    expectedAuthRevision: bigint("expected_auth_revision", { mode: "number" }),
+    expectedLoginBindingRevision: bigint("expected_login_binding_revision", { mode: "number" }),
+    expectedGeneration: bigint("expected_generation", { mode: "number" }).notNull(),
+    returnIntentId: uuid("return_intent_id"),
+    status: text("status").notNull().default("pending"),
+    expiresAt: timestamp("expires_at", { withTimezone: true }).notNull(),
+    consumedAt: timestamp("consumed_at", { withTimezone: true }),
+    createdAt: timestamp("created_at", { withTimezone: true }).notNull().defaultNow(),
+  },
+  (table) => ({
+    setStatus: index("managed_auth_login_transactions_set_status_idx").on(
+      table.sessionSetId,
+      table.status,
+      table.expiresAt,
+    ),
+  }),
+);
+
+export const managedAuthSessionSetOperations = pgTable(
+  "managed_auth_session_set_operations",
+  {
+    operationId: uuid("operation_id").primaryKey(),
+    sessionSetId: uuid("session_set_id").notNull(),
+    operationType: text("operation_type").notNull(),
+    requestDigest: text("request_digest").notNull(),
+    expectedGeneration: bigint("expected_generation", { mode: "number" }).notNull(),
+    resultGeneration: bigint("result_generation", { mode: "number" }).notNull(),
+    resultActorEpoch: bigint("result_actor_epoch", { mode: "number" }).notNull(),
+    targetSlotId: uuid("target_slot_id"),
+    replacementSlotId: uuid("replacement_slot_id"),
+    outcome: text("outcome").notNull(),
+    result: jsonb("result").notNull(),
+    createdAt: timestamp("created_at", { withTimezone: true }).notNull().defaultNow(),
+  },
+  (table) => ({
+    setCreated: index("managed_auth_session_set_operations_set_created_idx").on(
+      table.sessionSetId,
+      table.createdAt,
+      table.operationId,
+    ),
+  }),
+);
+
+export const managedAuthActorMutationLeases = pgTable(
+  "managed_auth_actor_mutation_leases",
+  {
+    sessionSetId: uuid("session_set_id").notNull(),
+    requestId: uuid("request_id").notNull(),
+    actorEpoch: bigint("actor_epoch", { mode: "number" }).notNull(),
+    acquiredAt: timestamp("acquired_at", { withTimezone: true }).notNull().defaultNow(),
+    expiresAt: timestamp("expires_at", { withTimezone: true }).notNull(),
+  },
+  (table) => ({
+    primaryKey: primaryKey({ columns: [table.sessionSetId, table.requestId] }),
+    expiry: index("managed_auth_actor_mutation_leases_expiry_idx").on(
+      table.expiresAt,
+      table.sessionSetId,
+    ),
+  }),
+);
+
+export const managedAuthLoginTransactionRateLimits = pgTable(
+  "managed_auth_login_transaction_rate_limits",
+  {
+    scopeKind: text("scope_kind").notNull(),
+    scopeHash: text("scope_hash").notNull(),
+    windowStartedAt: timestamp("window_started_at", { withTimezone: true }).notNull(),
+    attemptCount: integer("attempt_count").notNull(),
+    expiresAt: timestamp("expires_at", { withTimezone: true }).notNull(),
+  },
+  (table) => ({
+    primaryKey: primaryKey({ columns: [table.scopeKind, table.scopeHash] }),
+    expiry: index("managed_auth_login_transaction_rate_limits_expiry_idx").on(
+      table.expiresAt,
+      table.scopeKind,
+      table.scopeHash,
+    ),
+  }),
+);

package/src/managed-auth-session-sets.ts

@@ -0,0 +1,430 @@
+import {
+  ManagedAuthLoginTransaction,
+  ManagedAuthLogoutAllReceipt,
+  ManagedAuthSessionSetProjection,
+  type ManagedAuthLoginTransaction as ManagedAuthLoginTransactionType,
+  type ManagedAuthLogoutAllReceipt as ManagedAuthLogoutAllReceiptType,
+  type ManagedAuthSessionSetMode,
+  type ManagedAuthSessionSetProjection as ManagedAuthSessionSetProjectionType,
+} from "@opengeni/contracts/managed-auth-session-sets";
+import { sql, type SQL } from "drizzle-orm";
+import type { Database } from "./database";
+import { rawRows } from "./database";
+import { nestedPostgresSqlState } from "./persistence-errors";
+
+const DatabaseProjection = ManagedAuthSessionSetProjection.omit({ csrfToken: true });
+export type ManagedAuthDatabaseProjection = Omit<ManagedAuthSessionSetProjectionType, "csrfToken">;
+
+export type ManagedAuthSelectedSession = {
+  slotId: string;
+  authSessionId: string;
+  authUserId: string;
+  token: string;
+  email: string;
+  name: string;
+  emailVerified: boolean;
+};
+
+export type ManagedAuthInternalSlot = ManagedAuthSelectedSession;
+
+export type ManagedAuthAdoptedSessionSnapshot = {
+  authorityHash: string;
+  actorEpoch: string;
+  selected: ManagedAuthSelectedSession | null;
+};
+
+export class ManagedAuthSessionSetGenerationConflictError extends Error {
+  readonly name = "ManagedAuthSessionSetGenerationConflictError";
+  readonly code = "generation_conflict";
+  constructor() {
+    super("The browser session set changed in another request");
+  }
+}
+
+export class ManagedAuthSessionSetOperationReuseError extends Error {
+  readonly name = "ManagedAuthSessionSetOperationReuseError";
+  constructor() {
+    super("The browser session-set operation id was reused for different input");
+  }
+}
+
+export class ManagedAuthSessionSetAuthorityError extends Error {
+  readonly name = "ManagedAuthSessionSetAuthorityError";
+}
+
+export class ManagedAuthLoginSlotUnavailableError extends Error {
+  readonly name = "ManagedAuthLoginSlotUnavailableError";
+}
+
+export class ManagedAuthLoginSlotLimitError extends Error {
+  readonly name = "ManagedAuthLoginSlotLimitError";
+}
+
+export class ManagedAuthLoginSlotAlreadyExistsError extends Error {
+  readonly name = "ManagedAuthLoginSlotAlreadyExistsError";
+  readonly code = "slot_already_exists";
+}
+
+export class ManagedAuthActorMutationInFlightError extends Error {
+  readonly name = "ManagedAuthActorMutationInFlightError";
+  readonly code = "actor_mutation_in_flight";
+}
+
+export class ManagedAuthLoginTransactionRateLimitError extends Error {
+  readonly name = "ManagedAuthLoginTransactionRateLimitError";
+  readonly code = "login_transaction_rate_limited";
+}
+
+function mapSqlError(error: unknown): never {
+  const state = nestedPostgresSqlState(error);
+  if (state === "40001") throw new ManagedAuthSessionSetGenerationConflictError();
+  if (state === "23505") throw new ManagedAuthSessionSetOperationReuseError();
+  if (state === "P0002") throw new ManagedAuthLoginSlotUnavailableError();
+  if (state === "P0003") throw new ManagedAuthLoginSlotAlreadyExistsError();
+  if (state === "54000") throw new ManagedAuthLoginSlotLimitError();
+  if (state === "55P03") throw new ManagedAuthActorMutationInFlightError();
+  if (state === "P0004") throw new ManagedAuthLoginTransactionRateLimitError();
+  if (state === "42501") {
+    throw new ManagedAuthSessionSetAuthorityError(
+      error instanceof Error ? error.message : "Browser session-set authority denied",
+    );
+  }
+  throw error;
+}
+
+function jsonValue(value: unknown): unknown {
+  return typeof value === "string" ? JSON.parse(value) : value;
+}
+
+async function oneJson(db: Database, query: SQL): Promise<unknown> {
+  const [row] = await rawRows<{ result: unknown }>(db, query);
+  return row ? jsonValue(row.result) : null;
+}
+
+function projectionFromResult(value: unknown): ManagedAuthDatabaseProjection {
+  const projection = (value as { projection?: unknown } | null)?.projection;
+  return DatabaseProjection.parse(projection);
+}
+
+export async function getManagedAuthSessionSetAuthorityState(
+  db: Database,
+  authorityHash: string,
+): Promise<"absent" | "active" | "retired"> {
+  try {
+    const [row] = await rawRows<{ state: string }>(
+      db,
+      sql`select managed_auth_session_set_authority_state(${authorityHash}) as state`,
+    );
+    const value = row?.state;
+    if (value === "absent" || value === "active" || value === "retired") return value;
+    throw new ManagedAuthSessionSetAuthorityError("Invalid browser session-set authority state");
+  } catch (error) {
+    mapSqlError(error);
+  }
+}
+
+export async function getManagedAuthSessionSetSnapshot(
+  db: Database,
+  input: {
+    authorityHash: string;
+    mode: ManagedAuthSessionSetMode;
+    includeInternal?: boolean;
+    allowRecovery?: boolean;
+    readOnly?: boolean;
+  },
+): Promise<{
+  projection: ManagedAuthDatabaseProjection;
+  selected: ManagedAuthSelectedSession | null;
+  internalSlots: ManagedAuthInternalSlot[];
+} | null> {
+  try {
+    const value = await oneJson(
+      db,
+      sql`select managed_auth_session_set_snapshot(
+        ${input.authorityHash}, ${input.mode}, ${input.includeInternal ?? false},
+        ${input.allowRecovery ?? false}, ${input.readOnly ?? false}
+      ) as result`,
+    );
+    if (value === null) return null;
+    const snapshot = value as {
+      projection: unknown;
+      selected?: ManagedAuthSelectedSession | null;
+      internalSlots?: ManagedAuthInternalSlot[];
+    };
+    return {
+      projection: DatabaseProjection.parse(snapshot.projection),
+      selected: snapshot.selected ?? null,
+      internalSlots: snapshot.internalSlots ?? [],
+    };
+  } catch (error) {
+    mapSqlError(error);
+  }
+}
+
+export async function bootstrapManagedAuthSessionSet(
+  db: Database,
+  input: {
+    authorityHash: string;
+    csrfHash: string;
+    authSessionId: string | null;
+    mode: ManagedAuthSessionSetMode;
+    operationId: string;
+    requestDigest: string;
+    expectedGeneration: string;
+    expectedActorEpoch: string;
+  },
+): Promise<ManagedAuthDatabaseProjection> {
+  try {
+    return projectionFromResult(
+      await oneJson(
+        db,
+        sql`select managed_auth_session_set_bootstrap(
+          ${input.authorityHash}, ${input.csrfHash}, ${input.authSessionId}, ${input.mode},
+          ${input.operationId}::uuid, ${input.requestDigest},
+          ${input.expectedGeneration}::bigint, ${input.expectedActorEpoch}::bigint
+        ) as result`,
+      ),
+    );
+  } catch (error) {
+    mapSqlError(error);
+  }
+}
+
+export async function beginManagedAuthLoginTransaction(
+  db: Database,
+  input: {
+    authorityHash: string;
+    csrfHash: string;
+    rateScopeHash?: string;
+    operationId: string;
+    requestDigest: string;
+    expectedGeneration: string;
+    expectedActorEpoch: string;
+    transactionId: string;
+    transactionSecretHash: string;
+    kind: "add" | "reauth";
+    targetSlotId: string | null;
+    returnIntentId: string | null;
+    returnPath: string | null;
+    expiresAt: Date;
+  },
+): Promise<ManagedAuthLoginTransactionType> {
+  try {
+    const value = (await oneJson(
+      db,
+      sql`select managed_auth_session_set_begin_transaction(
+          ${input.authorityHash}, ${input.csrfHash},
+          ${input.rateScopeHash ?? input.authorityHash}, ${input.operationId}::uuid,
+          ${input.requestDigest}, ${input.expectedGeneration}::bigint,
+          ${input.transactionId}::uuid, ${input.expectedActorEpoch}::bigint,
+          ${input.transactionSecretHash}, ${input.kind},
+          ${input.targetSlotId}::uuid, ${input.returnIntentId}::uuid,
+          ${input.returnPath}, ${input.expiresAt.toISOString()}::timestamptz
+        ) as result`,
+    )) as { expiresAt?: unknown } | null;
+    return ManagedAuthLoginTransaction.parse({
+      ...value,
+      expiresAt:
+        typeof value?.expiresAt === "string" || value?.expiresAt instanceof Date
+          ? new Date(value.expiresAt).toISOString()
+          : value?.expiresAt,
+    });
+  } catch (error) {
+    mapSqlError(error);
+  }
+}
+
+export async function completeManagedAuthLoginTransaction(
+  db: Database,
+  input: {
+    authorityHash: string;
+    csrfHash: string;
+    operationId: string;
+    requestDigest: string;
+    expectedGeneration: string;
+    expectedActorEpoch: string;
+    transactionId: string;
+    transactionSecretHash: string;
+    authSessionId: string;
+    mode: ManagedAuthSessionSetMode;
+  },
+): Promise<{ projection: ManagedAuthDatabaseProjection; returnIntent: string | null }> {
+  try {
+    const result = (await oneJson(
+      db,
+      sql`select managed_auth_session_set_complete_transaction(
+        ${input.authorityHash}, ${input.csrfHash}, ${input.operationId}::uuid,
+        ${input.requestDigest}, ${input.expectedGeneration}::bigint,
+        ${input.expectedActorEpoch}::bigint,
+        ${input.transactionId}::uuid, ${input.transactionSecretHash},
+        ${input.authSessionId}, ${input.mode}
+      ) as result`,
+    )) as { projection: unknown; returnIntent?: string | null };
+    return {
+      projection: DatabaseProjection.parse(result.projection),
+      returnIntent: result.returnIntent ?? null,
+    };
+  } catch (error) {
+    mapSqlError(error);
+  }
+}
+
+export async function mutateManagedAuthSessionSet(
+  db: Database,
+  input: {
+    authorityHash: string;
+    csrfHash: string;
+    operationId: string;
+    requestDigest: string;
+    expectedGeneration: string;
+    expectedActorEpoch: string;
+    operationType: "cancel_transaction" | "select" | "logout_one" | "logout_all";
+    targetSlotId?: string | null;
+    replacementSlotId?: string | null;
+    transactionId?: string | null;
+    transactionSecretHash?: string | null;
+    mode: ManagedAuthSessionSetMode;
+  },
+): Promise<ManagedAuthDatabaseProjection | ManagedAuthLogoutAllReceiptType> {
+  try {
+    const result = await oneJson(
+      db,
+      sql`select managed_auth_session_set_mutate(
+        ${input.authorityHash}, ${input.csrfHash}, ${input.operationId}::uuid,
+        ${input.requestDigest}, ${input.expectedGeneration}::bigint,
+        ${input.expectedActorEpoch}::bigint, ${input.operationType},
+        ${input.targetSlotId ?? null}::uuid, ${input.replacementSlotId ?? null}::uuid,
+        ${input.transactionId ?? null}::uuid, ${input.transactionSecretHash ?? null}, ${input.mode}
+      ) as result`,
+    );
+    if (input.operationType === "logout_all") return ManagedAuthLogoutAllReceipt.parse(result);
+    return projectionFromResult(result);
+  } catch (error) {
+    mapSqlError(error);
+  }
+}
+
+export async function getManagedAuthSessionSetOperationReceipt(
+  db: Database,
+  input: { authorityHash: string; operationId: string; requestDigest: string },
+): Promise<{ projection: ManagedAuthDatabaseProjection; returnIntent: string | null } | null> {
+  const result = (await oneJson(
+    db,
+    sql`select managed_auth_session_set_operation_receipt(
+      ${input.authorityHash}, ${input.operationId}::uuid, ${input.requestDigest}, 'complete'
+    ) as result`,
+  )) as { projection?: unknown; returnIntent?: string | null } | null;
+  if (!result?.projection) return null;
+  return {
+    projection: DatabaseProjection.parse(result.projection),
+    returnIntent: result.returnIntent ?? null,
+  };
+}
+
+export async function acquireManagedAuthActorMutationLease(
+  db: Database,
+  input: {
+    authorityHash: string;
+    actorEpoch: string;
+    requestId: string;
+    leaseSeconds: number;
+  },
+): Promise<Date> {
+  try {
+    const [row] = await rawRows<{ expiresAt: Date | string }>(
+      db,
+      sql`select managed_auth_actor_mutation_lease_acquire(
+        ${input.authorityHash}, ${input.actorEpoch}::bigint,
+        ${input.requestId}::uuid, ${input.leaseSeconds}::integer
+      ) as "expiresAt"`,
+    );
+    if (!row) throw new ManagedAuthSessionSetAuthorityError("Mutation lease was not acquired");
+    return row.expiresAt instanceof Date ? row.expiresAt : new Date(row.expiresAt);
+  } catch (error) {
+    mapSqlError(error);
+  }
+}
+
+export async function releaseManagedAuthActorMutationLease(
+  db: Database,
+  input: { authorityHash: string; requestId: string },
+): Promise<boolean> {
+  try {
+    const [row] = await rawRows<{ released: boolean }>(
+      db,
+      sql`select managed_auth_actor_mutation_lease_release(
+        ${input.authorityHash}, ${input.requestId}::uuid
+      ) as released`,
+    );
+    return row?.released === true;
+  } catch (error) {
+    mapSqlError(error);
+  }
+}
+
+/** Classify a legacy ambient session once it has entered session-set authority. */
+export async function getManagedAuthAdoptedSessionSnapshot(
+  db: Database,
+  authSessionId: string,
+): Promise<ManagedAuthAdoptedSessionSnapshot | null> {
+  try {
+    const value = (await oneJson(
+      db,
+      sql`select managed_auth_adopted_session_snapshot(${authSessionId}) as result`,
+    )) as ManagedAuthAdoptedSessionSnapshot | null;
+    if (value === null) return null;
+    if (!/^[0-9a-f]{64}$/.test(value.authorityHash) || !/^[1-9][0-9]*$/.test(value.actorEpoch)) {
+      throw new ManagedAuthSessionSetAuthorityError("Invalid adopted-session snapshot");
+    }
+    return value;
+  } catch (error) {
+    mapSqlError(error);
+  }
+}
+
+/** Exact post-handler proof that the request-owned actor lease is still live. */
+export async function validateManagedAuthActorMutationLease(
+  db: Database,
+  input: { authorityHash: string; actorEpoch: string; requestId: string },
+): Promise<boolean> {
+  try {
+    const [row] = await rawRows<{ valid: boolean }>(
+      db,
+      sql`select managed_auth_actor_mutation_lease_validate(
+        ${input.authorityHash}, ${input.actorEpoch}::bigint, ${input.requestId}::uuid
+      ) as valid`,
+    );
+    return row?.valid === true;
+  } catch (error) {
+    mapSqlError(error);
+  }
+}
+
+/** Bounded cleanup for provider sessions left by a process death before adoption. */
+export async function reapManagedAuthIsolatedSessions(db: Database, limit = 100): Promise<number> {
+  try {
+    const [row] = await rawRows<{ reaped: number }>(
+      db,
+      sql`select managed_auth_isolated_session_reap(${limit}::integer) as reaped`,
+    );
+    return row?.reaped ?? 0;
+  } catch (error) {
+    mapSqlError(error);
+  }
+}
+
+/** Bounded, lease-aware retirement of expired installation/session-set authority. */
+export async function reapExpiredManagedAuthSessionSets(
+  db: Database,
+  limit = 100,
+): Promise<number> {
+  try {
+    const [row] = await rawRows<{ retired: number }>(
+      db,
+      sql`select managed_auth_expired_session_set_reap(${limit}::integer) as retired`,
+    );
+    return row?.retired ?? 0;
+  } catch (error) {
+    mapSqlError(error);
+  }
+}