@payload-auth-link/migrate 0.4.3 → 0.6.0

package/src/importer/source.ts

@@ -31,10 +31,22 @@ export type SourceUser = {
   /** Stored role values from the `users_role` child table. */
   readonly roles: readonly string[]
   readonly accounts: readonly SourceAccount[]
+  /**
+   * Better Auth admin-plugin ban state (issue #88), `null` when the
+   * source layout has no such column (the plugin was never installed).
+   */
+  readonly banned: boolean | null
+  readonly banReason: string | null
+  readonly banExpires: Date | null
+  /** Better Auth anonymous-plugin marker; `null` when no column exists. */
+  readonly isAnonymous: boolean | null
 }
 
 export type SourceAccount = {
   readonly id: string
+  /** Source row timestamps, carried onto the target row (issue #88). */
+  readonly createdAt: Date | null
+  readonly updatedAt: Date | null
   readonly accountId: string
   readonly providerId: string
   readonly password: string | null
@@ -76,14 +88,24 @@ const requiredColumns: Readonly<Record<SourceModel, readonly string[]>> = {
   users_role: ['parent_id', 'value'],
 }
 
-export async function openSource(connectionString: string): Promise<Client> {
+/**
+ * The slice of a `pg` client the read side uses. Public signatures take
+ * this structural type (a `pg.Client` satisfies it) so the published
+ * `.d.ts` never references `pg` — consumers need no `@types/pg`.
+ */
+export interface SourceClient {
+  query(text: string, values?: unknown[]): Promise<{ rows: unknown[] }>
+  end(): Promise<void>
+}
+
+export async function openSource(connectionString: string): Promise<SourceClient> {
   const client = new Client({ connectionString })
   await client.connect()
   return client
 }
 
 /** The columns one table actually has (customized layouts drop columns). */
-async function columnsOf(client: Client, table: string): Promise<Set<string>> {
+async function columnsOf(client: SourceClient, table: string): Promise<Set<string>> {
   const result = await client.query(
     `SELECT column_name FROM information_schema.columns
      WHERE table_schema = 'public' AND table_name = $1`,
@@ -92,7 +114,7 @@ async function columnsOf(client: Client, table: string): Promise<Set<string>> {
   return new Set(result.rows.map((row) => String((row as { column_name: unknown }).column_name)))
 }
 
-async function tableExists(client: Client, table: string): Promise<boolean> {
+async function tableExists(client: SourceClient, table: string): Promise<boolean> {
   const result = await client.query(
     `SELECT 1 FROM information_schema.tables WHERE table_schema = 'public' AND table_name = $1`,
     [table]
@@ -108,7 +130,7 @@ async function tableExists(client: Client, table: string): Promise<boolean> {
  * read, planned, or written past a failed probe.
  */
 export async function probeSourceLayout(
-  client: Client,
+  client: SourceClient,
   tables: ResolvedSourceTables
 ): Promise<readonly SourceLayoutIssue[]> {
   const issues: SourceLayoutIssue[] = []
@@ -146,7 +168,7 @@ export async function probeSourceLayout(
  * throw here means the probe was skipped.
  */
 export async function countTables(
-  client: Client,
+  client: SourceClient,
   tables: readonly string[]
 ): Promise<Record<string, number>> {
   const counts: Record<string, number> = {}
@@ -170,7 +192,7 @@ function text(value: unknown): string | null {
 
 /** Every source user, with role rows and accounts attached. */
 export async function readSourceUsers(
-  client: Client,
+  client: SourceClient,
   tables: ResolvedSourceTables = defaultSourceTables
 ): Promise<SourceUser[]> {
   const usersTable = tables['users']
@@ -179,8 +201,14 @@ export async function readSourceUsers(
   if (usersTable === null) {
     return []
   }
+  // Plugin columns (admin bans, anonymous marker) exist only when the
+  // payload-auth app installed those plugins — read them when present.
+  const userColumns = await columnsOf(client, usersTable)
+  const optionalUserColumns = ['banned', 'ban_reason', 'ban_expires', 'is_anonymous'].filter(
+    (column) => userColumns.has(column)
+  )
   const users = await client.query(
-    `SELECT id, email, name, email_verified, image, created_at, updated_at FROM ${usersTable} ORDER BY id`
+    `SELECT ${['id', 'email', 'name', 'email_verified', 'image', 'created_at', 'updated_at', ...optionalUserColumns].join(', ')} FROM ${usersTable} ORDER BY id`
   )
   const rolesTable = tables['users_role']
   const roleRows =
@@ -193,19 +221,37 @@ export async function readSourceUsers(
     list.push(row.value)
     rolesByUser.set(String(row.parent_id), list)
   }
+  const accountColumns =
+    accountsTable === null ? new Set<string>() : await columnsOf(client, accountsTable)
+  const accountTimestamps = ['created_at', 'updated_at'].filter((column) =>
+    accountColumns.has(column)
+  )
   const accounts =
     accountsTable === null
       ? { rows: [] as unknown[] }
       : await client.query(
-          `SELECT id, account_id, provider_id, password, access_token, refresh_token, id_token,
-            scope, access_token_expires_at, refresh_token_expires_at, user_id
-     FROM ${accountsTable} ORDER BY id`
+          `SELECT ${[
+            'id',
+            'account_id',
+            'provider_id',
+            'password',
+            'access_token',
+            'refresh_token',
+            'id_token',
+            'scope',
+            'access_token_expires_at',
+            'refresh_token_expires_at',
+            'user_id',
+            ...accountTimestamps,
+          ].join(', ')} FROM ${accountsTable} ORDER BY id`
         )
   const accountsByUser = new Map<string, SourceAccount[]>()
   for (const row of accounts.rows as Record<string, unknown>[]) {
     const userId = String(row.user_id)
     const account: SourceAccount = {
       id: String(row.id),
+      createdAt: iso(row.created_at),
+      updatedAt: iso(row.updated_at),
       accountId: String(row.account_id),
       providerId: String(row.provider_id),
       password: text(row.password),
@@ -233,6 +279,10 @@ export async function readSourceUsers(
       updatedAt: iso(row.updated_at) ?? new Date(),
       roles: rolesByUser.get(id) ?? [],
       accounts: accountsByUser.get(id) ?? [],
+      banned: userColumns.has('banned') ? row.banned === true : null,
+      banReason: userColumns.has('ban_reason') ? text(row.ban_reason) : null,
+      banExpires: userColumns.has('ban_expires') ? iso(row.ban_expires) : null,
+      isAnonymous: userColumns.has('is_anonymous') ? row.is_anonymous === true : null,
     })
   }
   return out
@@ -244,14 +294,22 @@ export async function readSourceUsers(
  * asking for it, and an unmapped missing table aborts at the probe.
  */
 export async function readFlatRows(
-  client: Client,
+  client: SourceClient,
   table: string,
-  columns: readonly string[]
+  columns: readonly string[],
+  /**
+   * Columns read only when the layout has them (issue #88: row
+   * timestamps) — an absent optional column is simply not selected,
+   * and the row carries no key for it.
+   */
+  optionalColumns: readonly string[] = []
 ): Promise<SourceRow[]> {
   if (!(await tableExists(client, table))) {
     throw new Error(`source table '${table}' is missing — run probeSourceLayout first`)
   }
-  const result = await client.query(`SELECT ${columns.join(', ')} FROM ${table} ORDER BY id`)
+  const existing = optionalColumns.length > 0 ? await columnsOf(client, table) : new Set<string>()
+  const selected = [...columns, ...optionalColumns.filter((column) => existing.has(column))]
+  const result = await client.query(`SELECT ${selected.join(', ')} FROM ${table} ORDER BY id`)
   return result.rows as SourceRow[]
 }
 
@@ -274,7 +332,7 @@ export type OrphanScan = {
  * of passing silently.
  */
 export async function findOrphans(
-  client: Client,
+  client: SourceClient,
   tables: ResolvedSourceTables = defaultSourceTables
 ): Promise<OrphanScan> {
   const orphans: Unmappable[] = []

package/src/importer/types.ts

@@ -2,6 +2,15 @@
  * Importer manifest (issue #50): every row created and every field
  * changed, so `rollback` is exact. The manifest is the run's contract —
  * `verify`, `rollback`, and `finalize` all read it.
+ *
+ * Privacy (issue #88): a version-2 manifest holds NO email address or
+ * other field value in the clear. Created rows are named by ids only,
+ * and every captured prior value is sealed (AES-256-GCM, keyed from the
+ * target app's Payload `secret`), so only the same app can restore it.
+ * The file is written with mode 0600.
+ *
+ * Integrity: a version-3 manifest is signed (`mac`), and rollback or a
+ * resumed run refuses one that does not verify.
  */
 export type CreatedRow = {
   /** Target collection slug. */
@@ -16,12 +25,27 @@ export type FieldWrite = {
   readonly collection: string
   readonly id: string | number
   readonly field: string
-  /** The prior value, JSON-serialized, restored by rollback. */
-  readonly before: string | null
+  /**
+   * The prior value, JSON-serialized — version-1 manifests only.
+   * Version 2 never stores values in the clear; see `sealedBefore`.
+   */
+  readonly before?: string | null | undefined
+  /**
+   * The prior value, JSON-serialized and sealed with the target app's
+   * Payload secret (version 2, issue #88), restored by rollback. Only
+   * the FIRST capture per document field is kept, so a rollback after
+   * any number of `--apply` passes restores the pre-import state.
+   */
+  readonly sealedBefore?: string | undefined
 }
 
+/** Which command produced the manifest (issue #88). */
+export type ManifestKind = 'import' | 'adopt-prelink'
+
 export type ImportManifest = {
-  readonly version: 1
+  readonly version: 1 | 2 | 3
+  /** The producing command; absent on version-1 manifests (imports). */
+  readonly kind?: ManifestKind | undefined
   readonly createdAt: string
   readonly sourceDatabase: string
   readonly options: {
@@ -32,8 +56,15 @@ export type ImportManifest = {
   readonly finalized: boolean
   /** Counts per source table at plan time (the rollback baseline). */
   readonly sourceCounts: Readonly<Record<string, number>>
-  /** Cumulative plan totals (rows created + skipped across resumes). */
+  /** Rows the LATEST pass planned per model — never summed across passes (#88). */
   readonly totals: Readonly<Record<string, number>>
+  /** When the last rollback reset this manifest (issue #88). */
+  readonly rolledBackAt?: string | undefined
+  /**
+   * Version 3: HMAC over the whole manifest (except `finalized`), keyed
+   * from the target app's Payload secret. See `manifest-mac.ts`.
+   */
+  readonly mac?: string | undefined
 }
 
 /** Per-model plan row for the dry run. */

package/src/index.ts

@@ -16,7 +16,16 @@ export { classifyPlugins, pluginsFromSourceTree } from './doctor/plugins.js'
 export { scanSource, projectedUserFields, listSourceFiles } from './doctor/source-scan.js'
 export { analyzeUsersCollection, findUsersCollection, localStrategyOn } from './doctor/users.js'
 export { introspectDatabase } from './doctor/database.js'
-export { runFromPayloadAuth, runVerify, runRollback, runFinalize } from './importer/run-import.js'
+export {
+  runFromPayloadAuth,
+  runVerify,
+  runRollback,
+  runFinalize,
+  runAdoptPrelink,
+  type ImportCommandOptions,
+  type PrelinkCommandOptions,
+} from './importer/run-import.js'
+export { prelinkUsers, type PrelinkOptions, type PrelinkResult } from './importer/prelink.js'
 export { applyImport, summarizePlanRows } from './importer/apply.js'
 export {
   countTables,
@@ -27,6 +36,7 @@ export {
   readSourceUsers,
   unverifiedEmails,
   type OrphanScan,
+  type SourceClient,
   type SourceLayoutIssue,
   type SourceAccount,
   type SourceRow,
@@ -39,6 +49,7 @@ export {
   rollbackImport,
   finalizeManifest,
   defaultManifestPath,
+  defaultPrelinkManifestPath,
   type VerifyIssue,
   type VerifyResult,
 } from './importer/lifecycle.js'
@@ -57,6 +68,7 @@ export {
   type TargetSlugMap,
   type FieldWrite,
   type ImportManifest,
+  type ManifestKind,
   type ImportPlan,
   type ImportResult,
   type PlanRow,

package/src/private-file.ts

@@ -0,0 +1,18 @@
+import { closeSync, fchmodSync, ftruncateSync, openSync, writeSync } from 'node:fs'
+
+/**
+ * Write `content` to `path` readable by the owner only (0600). The
+ * mode is tightened on the open descriptor BEFORE any content lands, so
+ * a pre-existing world-readable file (an older kit's manifest, a
+ * reused `--out` path) never holds the new content with its old mode.
+ */
+export function writePrivateFile(path: string, content: string): void {
+  const fd = openSync(path, 'a', 0o600)
+  try {
+    fchmodSync(fd, 0o600)
+    ftruncateSync(fd, 0)
+    writeSync(fd, content, 0)
+  } finally {
+    closeSync(fd)
+  }
+}