@opengeni/db 3.4.0-canary.2 → 3.6.0

package/dist/chunk-V3TRUXFJ.js.map

@@ -1 +0,0 @@
-{"version":3,"sources":["../src/canonical-human-identities.ts"],"sourcesContent":["import { createHash } from \"node:crypto\";\nimport {\n  CanonicalHumanIdentityMutationResponse,\n  CanonicalHumanIdentityProjection,\n  type CanonicalHumanIdentityMutationOutcome,\n  type CanonicalHumanIdentityMutationResponse as CanonicalHumanIdentityMutationResponseType,\n  type CanonicalHumanIdentityProjection as CanonicalHumanIdentityProjectionType,\n} from \"@opengeni/contracts/canonical-human-identities\";\nimport { sql } from \"drizzle-orm\";\nimport type { Database } from \"./database\";\nimport { rawRows } from \"./database\";\nimport { nestedPostgresSqlState } from \"./persistence-errors\";\n\nexport type CanonicalHumanSessionAuthority = {\n  identityId: string;\n  identityRevision: number;\n  authRevision: number;\n  identityStatus: \"active\" | \"recovery_required\" | \"disputed\" | \"disabled\";\n};\n\nexport class CanonicalHumanIdentityConflictError extends Error {\n  readonly name = \"CanonicalHumanIdentityConflictError\";\n  readonly code = \"CANONICAL_HUMAN_IDENTITY_CONFLICT\";\n\n  constructor() {\n    super(\"The canonical human identity changed in another request\");\n  }\n}\n\nexport class CanonicalHumanIdentityOperationReuseError extends Error {\n  readonly name = \"CanonicalHumanIdentityOperationReuseError\";\n  readonly code = \"CANONICAL_HUMAN_IDENTITY_OPERATION_REUSED\";\n\n  constructor() {\n    super(\"The canonical human identity operation id was already used for another request\");\n  }\n}\n\nexport class CanonicalHumanIdentityNotFoundError extends Error {\n  readonly name = \"CanonicalHumanIdentityNotFoundError\";\n\n  constructor(message = \"Canonical human identity was not found\") {\n    super(message);\n  }\n}\n\nexport class CanonicalHumanIdentityAuthorityError extends Error {\n  readonly name = \"CanonicalHumanIdentityAuthorityError\";\n}\n\nfunction deterministicOperationId(seed: string): string {\n  const bytes = createHash(\"sha256\").update(seed, \"utf8\").digest().subarray(0, 16);\n  bytes[6] = (bytes[6]! & 0x0f) | 0x50;\n  bytes[8] = (bytes[8]! & 0x3f) | 0x80;\n  const hex = bytes.toString(\"hex\");\n  return `${hex.slice(0, 8)}-${hex.slice(8, 12)}-${hex.slice(12, 16)}-${hex.slice(16, 20)}-${hex.slice(20)}`;\n}\n\nfunction projectionValue(value: unknown): unknown {\n  if (typeof value === \"string\") return JSON.parse(value);\n  return value;\n}\n\nfunction mapSqlError(error: unknown): never {\n  const state = nestedPostgresSqlState(error);\n  if (state === \"40001\") throw new CanonicalHumanIdentityConflictError();\n  if (state === \"23505\") throw new CanonicalHumanIdentityOperationReuseError();\n  if (state === \"P0002\") throw new CanonicalHumanIdentityNotFoundError();\n  if (state === \"42501\") {\n    throw new CanonicalHumanIdentityAuthorityError(\n      error instanceof Error ? error.message : \"Canonical human identity authority denied\",\n    );\n  }\n  throw error;\n}\n\nexport async function ensureCanonicalHumanIdentity(\n  db: Database,\n  input: { authUserId: string; displayName: string },\n): Promise<CanonicalHumanSessionAuthority> {\n  try {\n    const [row] = await rawRows<{\n      identityId: string;\n      identityRevision: number | string;\n      authRevision: number | string;\n      identityStatus: CanonicalHumanSessionAuthority[\"identityStatus\"];\n    }>(\n      db,\n      sql`\n        select\n          identity_id as \"identityId\",\n          identity_revision as \"identityRevision\",\n          auth_revision as \"authRevision\",\n          identity_status as \"identityStatus\"\n        from ensure_canonical_human_identity(${input.authUserId}, ${input.displayName})\n      `,\n    );\n    if (!row) throw new CanonicalHumanIdentityNotFoundError();\n    return {\n      identityId: row.identityId,\n      identityRevision: Number(row.identityRevision),\n      authRevision: Number(row.authRevision),\n      identityStatus: row.identityStatus,\n    };\n  } catch (error) {\n    mapSqlError(error);\n  }\n}\n\nexport async function ensureCanonicalHumanIdentityForAuthUser(\n  db: Database,\n  authUserId: string,\n): Promise<CanonicalHumanSessionAuthority> {\n  const [user] = await rawRows<{ displayName: string }>(\n    db,\n    sql`\n      select coalesce(nullif(btrim(name), ''), email) as \"displayName\"\n      from auth_users\n      where id = ${authUserId}\n      limit 1\n    `,\n  );\n  if (!user) throw new CanonicalHumanIdentityNotFoundError(\"Authentication user was not found\");\n  return await ensureCanonicalHumanIdentity(db, {\n    authUserId,\n    displayName: user.displayName,\n  });\n}\n\nexport async function synchronizeCanonicalHumanLoginBindings(\n  db: Database,\n  authUserId: string,\n): Promise<CanonicalHumanSessionAuthority> {\n  let authority = await ensureCanonicalHumanIdentityForAuthUser(db, authUserId);\n  const accounts = await rawRows<{\n    id: string;\n    providerId: string;\n    providerAccountId: string;\n  }>(\n    db,\n    sql`\n      select\n        id,\n        lower(provider_id) as \"providerId\",\n        account_id as \"providerAccountId\"\n      from auth_identities\n      where user_id = ${authUserId}\n      order by created_at, id\n    `,\n  );\n\n  for (const account of accounts) {\n    for (let attempt = 0; attempt < 4; attempt += 1) {\n      const projection = await getCanonicalHumanIdentityProjection(db, authUserId);\n      if (projection.activeIdentity.status !== \"active\") {\n        return {\n          identityId: projection.activeIdentity.id,\n          identityRevision: projection.activeIdentity.identityRevision,\n          authRevision: projection.activeIdentity.authRevision,\n          identityStatus: projection.activeIdentity.status,\n        };\n      }\n      const existing = projection.loginBindings.find(\n        (binding) =>\n          binding.providerId === account.providerId &&\n          binding.providerAccountId === account.providerAccountId,\n      );\n      if (existing?.status === \"active\") {\n        authority = {\n          identityId: projection.activeIdentity.id,\n          identityRevision: projection.activeIdentity.identityRevision,\n          authRevision: projection.activeIdentity.authRevision,\n          identityStatus: projection.activeIdentity.status,\n        };\n        break;\n      }\n      try {\n        const result = await applyCanonicalHumanIdentityOperation(db, {\n          operationId: deterministicOperationId(\n            `canonical-human-account-link\\n${account.id}\\n${projection.activeIdentity.identityRevision}`,\n          ),\n          authUserId,\n          expectedIdentityRevision: projection.activeIdentity.identityRevision,\n          operationType: \"link\",\n          providerId: account.providerId,\n          providerAccountId: account.providerAccountId,\n          reason: \"Synchronize verified authentication account\",\n        });\n        authority = {\n          identityId: result.identity.activeIdentity.id,\n          identityRevision: result.identity.activeIdentity.identityRevision,\n          authRevision: result.identity.activeIdentity.authRevision,\n          identityStatus: result.identity.activeIdentity.status,\n        };\n        break;\n      } catch (error) {\n        if (error instanceof CanonicalHumanIdentityConflictError && attempt < 3) continue;\n        if (error instanceof CanonicalHumanIdentityAuthorityError) {\n          const currentProjection = await getCanonicalHumanIdentityProjection(db, authUserId);\n          if (currentProjection.activeIdentity.status !== \"active\") {\n            return {\n              identityId: currentProjection.activeIdentity.id,\n              identityRevision: currentProjection.activeIdentity.identityRevision,\n              authRevision: currentProjection.activeIdentity.authRevision,\n              identityStatus: currentProjection.activeIdentity.status,\n            };\n          }\n        }\n        throw error;\n      }\n    }\n  }\n  return authority;\n}\n\nexport async function validateCanonicalHumanSession(\n  db: Database,\n  input: { authSessionId: string; authUserId: string; allowRecovery?: boolean },\n): Promise<boolean> {\n  try {\n    const [row] = await rawRows<{ valid: boolean }>(\n      db,\n      sql`\n        select validate_canonical_human_session(\n          ${input.authSessionId},\n          ${input.authUserId},\n          ${input.allowRecovery ?? false}\n        ) as valid\n      `,\n    );\n    return row?.valid === true;\n  } catch (error) {\n    mapSqlError(error);\n  }\n}\n\nexport async function getCanonicalHumanIdentityProjection(\n  db: Database,\n  authUserId: string,\n): Promise<CanonicalHumanIdentityProjectionType> {\n  try {\n    const [row] = await rawRows<{ projection: unknown }>(\n      db,\n      sql`\n        select get_canonical_human_identity_projection(${authUserId}) as projection\n      `,\n    );\n    if (row?.projection === null || row?.projection === undefined) {\n      throw new CanonicalHumanIdentityNotFoundError();\n    }\n    return CanonicalHumanIdentityProjection.parse(projectionValue(row.projection));\n  } catch (error) {\n    if (error instanceof CanonicalHumanIdentityNotFoundError) throw error;\n    mapSqlError(error);\n  }\n}\n\nexport type ApplyCanonicalHumanIdentityOperationInput = {\n  operationId: string;\n  authUserId: string;\n  expectedIdentityRevision: number;\n  operationType: \"link\" | \"unlink\" | \"begin_recovery\" | \"recover\";\n  bindingId?: string | null;\n  providerId?: string | null;\n  providerAccountId?: string | null;\n  reason: string;\n};\n\nexport async function applyCanonicalHumanIdentityOperation(\n  db: Database,\n  input: ApplyCanonicalHumanIdentityOperationInput,\n): Promise<CanonicalHumanIdentityMutationResponseType> {\n  try {\n    const [row] = await rawRows<{\n      outcome: CanonicalHumanIdentityMutationOutcome;\n      identityId: string;\n      identityRevision: number | string;\n      authRevision: number | string;\n    }>(\n      db,\n      sql`\n        select\n          outcome,\n          identity_id as \"identityId\",\n          identity_revision as \"identityRevision\",\n          auth_revision as \"authRevision\"\n        from apply_canonical_human_identity_operation(\n          ${input.operationId},\n          ${input.authUserId},\n          ${input.expectedIdentityRevision},\n          ${input.operationType},\n          ${input.bindingId ?? null},\n          ${input.providerId ?? null},\n          ${input.providerAccountId ?? null},\n          ${input.reason}\n        )\n      `,\n    );\n    if (!row) throw new CanonicalHumanIdentityNotFoundError();\n    const identity = await getCanonicalHumanIdentityProjection(db, input.authUserId);\n    return CanonicalHumanIdentityMutationResponse.parse({\n      outcome: row.outcome,\n      operationId: input.operationId,\n      identity,\n    });\n  } catch (error) {\n    if (\n      error instanceof CanonicalHumanIdentityConflictError ||\n      error instanceof CanonicalHumanIdentityOperationReuseError ||\n      error instanceof CanonicalHumanIdentityNotFoundError ||\n      error instanceof CanonicalHumanIdentityAuthorityError\n    ) {\n      throw error;\n    }\n    mapSqlError(error);\n  }\n}\n"],"mappings":";;;;;;AAAA,SAAS,kBAAkB;AAC3B;AAAA,EACE;AAAA,EACA;AAAA,OAIK;AACP,SAAS,WAAW;AAYb,IAAM,sCAAN,cAAkD,MAAM;AAAA,EACpD,OAAO;AAAA,EACP,OAAO;AAAA,EAEhB,cAAc;AACZ,UAAM,yDAAyD;AAAA,EACjE;AACF;AAEO,IAAM,4CAAN,cAAwD,MAAM;AAAA,EAC1D,OAAO;AAAA,EACP,OAAO;AAAA,EAEhB,cAAc;AACZ,UAAM,gFAAgF;AAAA,EACxF;AACF;AAEO,IAAM,sCAAN,cAAkD,MAAM;AAAA,EACpD,OAAO;AAAA,EAEhB,YAAY,UAAU,0CAA0C;AAC9D,UAAM,OAAO;AAAA,EACf;AACF;AAEO,IAAM,uCAAN,cAAmD,MAAM;AAAA,EACrD,OAAO;AAClB;AAEA,SAAS,yBAAyB,MAAsB;AACtD,QAAM,QAAQ,WAAW,QAAQ,EAAE,OAAO,MAAM,MAAM,EAAE,OAAO,EAAE,SAAS,GAAG,EAAE;AAC/E,QAAM,CAAC,IAAK,MAAM,CAAC,IAAK,KAAQ;AAChC,QAAM,CAAC,IAAK,MAAM,CAAC,IAAK,KAAQ;AAChC,QAAM,MAAM,MAAM,SAAS,KAAK;AAChC,SAAO,GAAG,IAAI,MAAM,GAAG,CAAC,CAAC,IAAI,IAAI,MAAM,GAAG,EAAE,CAAC,IAAI,IAAI,MAAM,IAAI,EAAE,CAAC,IAAI,IAAI,MAAM,IAAI,EAAE,CAAC,IAAI,IAAI,MAAM,EAAE,CAAC;AAC1G;AAEA,SAAS,gBAAgB,OAAyB;AAChD,MAAI,OAAO,UAAU,SAAU,QAAO,KAAK,MAAM,KAAK;AACtD,SAAO;AACT;AAEA,SAAS,YAAY,OAAuB;AAC1C,QAAM,QAAQ,uBAAuB,KAAK;AAC1C,MAAI,UAAU,QAAS,OAAM,IAAI,oCAAoC;AACrE,MAAI,UAAU,QAAS,OAAM,IAAI,0CAA0C;AAC3E,MAAI,UAAU,QAAS,OAAM,IAAI,oCAAoC;AACrE,MAAI,UAAU,SAAS;AACrB,UAAM,IAAI;AAAA,MACR,iBAAiB,QAAQ,MAAM,UAAU;AAAA,IAC3C;AAAA,EACF;AACA,QAAM;AACR;AAEA,eAAsB,6BACpB,IACA,OACyC;AACzC,MAAI;AACF,UAAM,CAAC,GAAG,IAAI,MAAM;AAAA,MAMlB;AAAA,MACA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,+CAMyC,MAAM,UAAU,KAAK,MAAM,WAAW;AAAA;AAAA,IAEjF;AACA,QAAI,CAAC,IAAK,OAAM,IAAI,oCAAoC;AACxD,WAAO;AAAA,MACL,YAAY,IAAI;AAAA,MAChB,kBAAkB,OAAO,IAAI,gBAAgB;AAAA,MAC7C,cAAc,OAAO,IAAI,YAAY;AAAA,MACrC,gBAAgB,IAAI;AAAA,IACtB;AAAA,EACF,SAAS,OAAO;AACd,gBAAY,KAAK;AAAA,EACnB;AACF;AAEA,eAAsB,wCACpB,IACA,YACyC;AACzC,QAAM,CAAC,IAAI,IAAI,MAAM;AAAA,IACnB;AAAA,IACA;AAAA;AAAA;AAAA,mBAGe,UAAU;AAAA;AAAA;AAAA,EAG3B;AACA,MAAI,CAAC,KAAM,OAAM,IAAI,oCAAoC,mCAAmC;AAC5F,SAAO,MAAM,6BAA6B,IAAI;AAAA,IAC5C;AAAA,IACA,aAAa,KAAK;AAAA,EACpB,CAAC;AACH;AAEA,eAAsB,uCACpB,IACA,YACyC;AACzC,MAAI,YAAY,MAAM,wCAAwC,IAAI,UAAU;AAC5E,QAAM,WAAW,MAAM;AAAA,IAKrB;AAAA,IACA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,wBAMoB,UAAU;AAAA;AAAA;AAAA,EAGhC;AAEA,aAAW,WAAW,UAAU;AAC9B,aAAS,UAAU,GAAG,UAAU,GAAG,WAAW,GAAG;AAC/C,YAAM,aAAa,MAAM,oCAAoC,IAAI,UAAU;AAC3E,UAAI,WAAW,eAAe,WAAW,UAAU;AACjD,eAAO;AAAA,UACL,YAAY,WAAW,eAAe;AAAA,UACtC,kBAAkB,WAAW,eAAe;AAAA,UAC5C,cAAc,WAAW,eAAe;AAAA,UACxC,gBAAgB,WAAW,eAAe;AAAA,QAC5C;AAAA,MACF;AACA,YAAM,WAAW,WAAW,cAAc;AAAA,QACxC,CAAC,YACC,QAAQ,eAAe,QAAQ,cAC/B,QAAQ,sBAAsB,QAAQ;AAAA,MAC1C;AACA,UAAI,UAAU,WAAW,UAAU;AACjC,oBAAY;AAAA,UACV,YAAY,WAAW,eAAe;AAAA,UACtC,kBAAkB,WAAW,eAAe;AAAA,UAC5C,cAAc,WAAW,eAAe;AAAA,UACxC,gBAAgB,WAAW,eAAe;AAAA,QAC5C;AACA;AAAA,MACF;AACA,UAAI;AACF,cAAM,SAAS,MAAM,qCAAqC,IAAI;AAAA,UAC5D,aAAa;AAAA,YACX;AAAA,EAAiC,QAAQ,EAAE;AAAA,EAAK,WAAW,eAAe,gBAAgB;AAAA,UAC5F;AAAA,UACA;AAAA,UACA,0BAA0B,WAAW,eAAe;AAAA,UACpD,eAAe;AAAA,UACf,YAAY,QAAQ;AAAA,UACpB,mBAAmB,QAAQ;AAAA,UAC3B,QAAQ;AAAA,QACV,CAAC;AACD,oBAAY;AAAA,UACV,YAAY,OAAO,SAAS,eAAe;AAAA,UAC3C,kBAAkB,OAAO,SAAS,eAAe;AAAA,UACjD,cAAc,OAAO,SAAS,eAAe;AAAA,UAC7C,gBAAgB,OAAO,SAAS,eAAe;AAAA,QACjD;AACA;AAAA,MACF,SAAS,OAAO;AACd,YAAI,iBAAiB,uCAAuC,UAAU,EAAG;AACzE,YAAI,iBAAiB,sCAAsC;AACzD,gBAAM,oBAAoB,MAAM,oCAAoC,IAAI,UAAU;AAClF,cAAI,kBAAkB,eAAe,WAAW,UAAU;AACxD,mBAAO;AAAA,cACL,YAAY,kBAAkB,eAAe;AAAA,cAC7C,kBAAkB,kBAAkB,eAAe;AAAA,cACnD,cAAc,kBAAkB,eAAe;AAAA,cAC/C,gBAAgB,kBAAkB,eAAe;AAAA,YACnD;AAAA,UACF;AAAA,QACF;AACA,cAAM;AAAA,MACR;AAAA,IACF;AAAA,EACF;AACA,SAAO;AACT;AAEA,eAAsB,8BACpB,IACA,OACkB;AAClB,MAAI;AACF,UAAM,CAAC,GAAG,IAAI,MAAM;AAAA,MAClB;AAAA,MACA;AAAA;AAAA,YAEM,MAAM,aAAa;AAAA,YACnB,MAAM,UAAU;AAAA,YAChB,MAAM,iBAAiB,KAAK;AAAA;AAAA;AAAA,IAGpC;AACA,WAAO,KAAK,UAAU;AAAA,EACxB,SAAS,OAAO;AACd,gBAAY,KAAK;AAAA,EACnB;AACF;AAEA,eAAsB,oCACpB,IACA,YAC+C;AAC/C,MAAI;AACF,UAAM,CAAC,GAAG,IAAI,MAAM;AAAA,MAClB;AAAA,MACA;AAAA,yDACmD,UAAU;AAAA;AAAA,IAE/D;AACA,QAAI,KAAK,eAAe,QAAQ,KAAK,eAAe,QAAW;AAC7D,YAAM,IAAI,oCAAoC;AAAA,IAChD;AACA,WAAO,iCAAiC,MAAM,gBAAgB,IAAI,UAAU,CAAC;AAAA,EAC/E,SAAS,OAAO;AACd,QAAI,iBAAiB,oCAAqC,OAAM;AAChE,gBAAY,KAAK;AAAA,EACnB;AACF;AAaA,eAAsB,qCACpB,IACA,OACqD;AACrD,MAAI;AACF,UAAM,CAAC,GAAG,IAAI,MAAM;AAAA,MAMlB;AAAA,MACA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,YAOM,MAAM,WAAW;AAAA,YACjB,MAAM,UAAU;AAAA,YAChB,MAAM,wBAAwB;AAAA,YAC9B,MAAM,aAAa;AAAA,YACnB,MAAM,aAAa,IAAI;AAAA,YACvB,MAAM,cAAc,IAAI;AAAA,YACxB,MAAM,qBAAqB,IAAI;AAAA,YAC/B,MAAM,MAAM;AAAA;AAAA;AAAA,IAGpB;AACA,QAAI,CAAC,IAAK,OAAM,IAAI,oCAAoC;AACxD,UAAM,WAAW,MAAM,oCAAoC,IAAI,MAAM,UAAU;AAC/E,WAAO,uCAAuC,MAAM;AAAA,MAClD,SAAS,IAAI;AAAA,MACb,aAAa,MAAM;AAAA,MACnB;AAAA,IACF,CAAC;AAAA,EACH,SAAS,OAAO;AACd,QACE,iBAAiB,uCACjB,iBAAiB,6CACjB,iBAAiB,uCACjB,iBAAiB,sCACjB;AACA,YAAM;AAAA,IACR;AACA,gBAAY,KAAK;AAAA,EACnB;AACF;","names":[]}