@plyaz/auth 1.0.0

package/src/db/repositories/connected-account.repository.ts

@@ -0,0 +1,415 @@
+import { createClient } from '@supabase/supabase-js';
+import type { ConnectedAccount, ConnectedAccountRepository as IConnectedAccountRepository, CreateConnectedAccountData, UpdateConnectedAccountData } from '@/common/types/auth.types';
+
+/**
+ * Repository for managing connected accounts (provider account linking)
+ * 
+ * @description
+ * Handles CRUD operations for external provider accounts linked to users.
+ * Supports OAuth providers (Clerk, Google, Facebook, etc.) and stores tokens.
+ * 
+ * @example
+ * ```typescript
+ * const repo = new ConnectedAccountRepository(supabaseUrl, supabaseKey);
+ * const account = await repo.findByProvider('clerk', 'user_123');
+ * ```
+ */
+export class ConnectedAccountRepository implements IConnectedAccountRepository {
+  private supabase;
+
+  /**
+   * STEP 1: Initialize repository with Supabase client
+   * @param supabaseUrl - Supabase project URL
+   * @param supabaseKey - Supabase service role key
+   */
+  constructor(supabaseUrl: string, supabaseKey: string) {
+    this.supabase = createClient(supabaseUrl, supabaseKey);
+  }
+
+
+
+
+
+  /**
+   * STEP 2: Create a new connected account
+   * Links an external provider account to a user
+   * 
+   * @param data - Connected account creation data
+   * @returns Promise resolving to created ConnectedAccount
+   * @throws Error if creation fails
+   */
+  async create(data: CreateConnectedAccountData): Promise<ConnectedAccount> {
+    const insertData = this.transformToDbFormat(data);
+    
+    const { data: accountData, error } = await this.supabase
+      .from('connected_accounts')
+      .insert(insertData)
+      .select()
+      .single();
+
+    if (error || !accountData) throw new Error(`Failed to create connected account: ${error?.message}`);
+    return this.mapToConnectedAccount(accountData);
+  }
+
+  /**
+   * STEP 3: Find connected account by ID
+   * 
+   * @param id - Connected account UUID
+   * @returns Promise resolving to ConnectedAccount or null if not found
+   */
+  async findById(id: string): Promise<ConnectedAccount | null> {
+    const { data, error } = await this.supabase
+      .from('connected_accounts')
+      .select('*')
+      .eq('id', id)
+      .single();
+
+    if (error || !data) return null;
+    return this.mapToConnectedAccount(data);
+  }
+
+  /**
+   * STEP 4: Find all connected accounts for a user
+   * Returns accounts ordered by creation date (newest first)
+   * 
+   * @param userId - User UUID
+   * @returns Promise resolving to array of ConnectedAccount
+   */
+  async findByUserId(userId: string): Promise<ConnectedAccount[]> {
+    const { data, error } = await this.supabase
+      .from('connected_accounts')
+      .select('*')
+      .eq('user_id', userId)
+      .order('created_at', { ascending: false });
+
+    if (error || !data) return [];
+    return data.map(this.mapToConnectedAccount);
+  }
+
+  /**
+   * STEP 5: Find connected account by provider credentials
+   * Used for authentication - matches (provider, provider_account_id)
+   * 
+   * @param provider - Provider name (e.g., 'clerk', 'google')
+   * @param providerAccountId - Provider's user ID
+   * @returns Promise resolving to ConnectedAccount or null if not found
+   */
+  async findByProvider(provider: string, providerAccountId: string): Promise<ConnectedAccount | null> {
+    const { data, error } = await this.supabase
+      .from('connected_accounts')
+      .select('*')
+      .eq('provider', provider)
+      .eq('provider_account_id', providerAccountId)
+      .single();
+
+    if (error || !data) return null;
+    return this.mapToConnectedAccount(data);
+  }
+
+  /**
+   * Find connected account by provider and ID (alias for compatibility)
+   */
+  async findByProviderAndId(provider: string, providerAccountId: string): Promise<ConnectedAccount | null> {
+    return this.findByProvider(provider, providerAccountId);
+  }
+
+  /**
+   * Update tokens for connected account
+   */
+  async updateTokens(accountId: string, accessToken: string, refreshToken?: string): Promise<void> {
+    const updateData = {
+      access_token_encrypted: accessToken,
+      updated_at: new Date(),
+      refresh_token_encrypted:refreshToken
+    };
+    
+    if (refreshToken) {
+      updateData.refresh_token_encrypted = refreshToken;
+    }
+
+    const { error } = await this.supabase
+      .from('connected_accounts')
+      .update(updateData)
+      .eq('id', accountId);
+
+    if (error) throw new Error(`Failed to update tokens: ${error.message}`);
+  }
+
+  /**
+   * STEP 6: Update connected account
+   * Updates tokens, profile info, or metadata
+   * 
+   * @param id - Connected account UUID
+   * @param data - Partial update data
+   * @returns Promise resolving to updated ConnectedAccount
+   * @throws Error if update fails
+   */
+  async update(id: string, data: UpdateConnectedAccountData): Promise<ConnectedAccount> {
+    const updateData = this.buildUpdateData(data);
+
+    const { data: accountData, error } = await this.supabase
+      .from('connected_accounts')
+      .update(updateData)
+      .eq('id', id)
+      .select()
+      .single();
+
+    if (error || !accountData) throw new Error(`Failed to update connected account: ${error?.message}`);
+    return this.mapToConnectedAccount(accountData);
+  }
+
+  /**
+   * STEP 7: Delete connected account (unlink provider)
+   * 
+   * @param id - Connected account UUID
+   * @throws Error if deletion fails
+   */
+  async delete(id: string): Promise<void> {
+    const { error } = await this.supabase
+      .from('connected_accounts')
+      .delete()
+      .eq('id', id);
+
+    if (error) throw new Error(`Failed to delete connected account: ${error.message}`);
+  }
+
+  /**
+   * Find primary connected account for user
+   * Query WHERE user_id AND is_primary = true
+   * @param userId - User identifier
+   * @returns Primary connected account or null
+   */
+  async findPrimary(userId: string): Promise<ConnectedAccount | null> {
+    const { data, error } = await this.supabase
+      .from('connected_accounts')
+      .select('*')
+      .eq('user_id', userId)
+      .eq('is_primary', true)
+      .eq('is_active', true)
+      .single();
+
+    if (error || !data) return null;
+    return this.mapToConnectedAccount(data);
+  }
+
+  /**
+   * Set primary connected account
+   * UPDATE all user accounts is_primary = false, then UPDATE specific account is_primary = true
+   * @param userId - User identifier
+   * @param accountId - Account identifier to set as primary
+   */
+  async setPrimary(userId: string, accountId: string): Promise<void> {
+    // First, unset all primary accounts for user
+    await this.supabase
+      .from('connected_accounts')
+      .update({ is_primary: false, updated_at: new Date() })
+      .eq('user_id', userId);
+
+    // Then set the specified account as primary
+    const { error } = await this.supabase
+      .from('connected_accounts')
+      .update({ is_primary: true, updated_at: new Date() })
+      .eq('id', accountId)
+      .eq('user_id', userId);
+
+    if (error) throw new Error(`Failed to set primary account: ${error.message}`);
+  }
+
+  /**
+   * Link account to user
+   * INSERT new connected account and emit account.linked event
+   * @param userId - User identifier
+   * @param provider - Provider name
+   * @param providerData - Provider account data
+   * @returns Created connected account
+   */
+  async linkAccount(userId: string, provider: string, providerData: ConnectedAccount): Promise<ConnectedAccount> {
+    const accountData = {
+      user_id: userId,
+      provider_type: providerData.providerType ?? 'OAUTH',
+      provider,
+      provider_account_id: providerData.providerAccountId,
+      provider_email: providerData.providerEmail,
+      provider_username: providerData.providerUsername,
+      provider_display_name: providerData.providerDisplayName,
+      provider_avatar_url: providerData.providerAvatarUrl,
+      provider_metadata: providerData.providerMetadata ?? {},
+      is_primary: false,
+      is_verified: true,
+      is_active: true,
+      linked_at: new Date(),
+      created_at: new Date(),
+      updated_at: new Date()
+    };
+
+    const { data, error } = await this.supabase
+      .from('connected_accounts')
+      .insert(accountData)
+      .select()
+      .single();
+
+    if (error || !data) throw new Error(`Failed to link account: ${error?.message}`);
+    
+    const connectedAccount = this.mapToConnectedAccount(data);
+    
+    // Emit account linked event
+    this.emitAccountLinkedEvent(userId, provider, connectedAccount.id);
+    
+    return connectedAccount;
+  }
+
+  /**
+   * Unlink account from user
+   * DELETE connected account with validation (not last auth method) and emit account.unlinked event
+   * @param accountId - Account identifier
+   */
+  async unlinkAccount(accountId: string): Promise<void> {
+    // Get account details
+    const account = await this.findById(accountId);
+    if (!account) {
+      throw new Error('Connected account not found');
+    }
+
+    // Check if this is the last authentication method
+    const userAccounts = await this.findByUserId(account.userId);
+    if (userAccounts.length <= 1) {
+      throw new Error('Cannot unlink the last authentication method');
+    }
+
+    // Delete the account
+    await this.delete(accountId);
+    
+    // Emit account unlinked event
+    this.emitAccountUnlinkedEvent(account.userId, account.provider, accountId);
+  }
+
+  /**
+   * Emit account linked event
+   * @param userId - User identifier
+   * @param provider - Provider name
+   * @param accountId - Account identifier
+   * @private
+   */
+  private emitAccountLinkedEvent(userId: string, provider: string, accountId: string): void {
+    // Mock event emission - in real implementation would use event system
+    globalThis.console.log('Event: auth.account.linked', {
+      userId,
+      provider,
+      accountId,
+      timestamp: new Date()
+    });
+  }
+
+  /**
+   * Emit account unlinked event
+   * @param userId - User identifier
+   * @param provider - Provider name
+   * @param accountId - Account identifier
+   * @private
+   */
+  private emitAccountUnlinkedEvent(userId: string, provider: string, accountId: string): void {
+    // Mock event emission - in real implementation would use event system
+    globalThis.console.log('Event: auth.account.unlinked', {
+      userId,
+      provider,
+      accountId,
+      timestamp: new Date()
+    });
+  }
+
+  /**
+   * Transform camelCase DTO to snake_case database format
+   * @private
+   */
+  private transformToDbFormat(data: CreateConnectedAccountData): Record<string, string| undefined | Record<string, unknown> |Date | boolean > {
+    return {
+      user_id: data.userId,
+      provider_type: data.providerType,
+      provider: data.provider,
+      provider_account_id: data.providerAccountId,
+      provider_email: data.providerEmail,
+      provider_username: data.providerUsername,
+      provider_display_name: data.providerDisplayName,
+      provider_avatar_url: data.providerAvatarUrl,
+      provider_profile_url: data.providerProfileUrl,
+      provider_metadata: data.providerMetadata,
+      wallet_address: data.walletAddress,
+      chain_id: data.chainId,
+      access_token_encrypted: data.accessTokenEncrypted,
+      refresh_token_encrypted: data.refreshTokenEncrypted,
+      token_expires_at: data.tokenExpiresAt,
+      token_scope: data.tokenScope,
+      is_primary: data.isPrimary ?? false,
+      is_verified: data.isVerified ?? true,
+      is_active: data.isActive ?? true,
+      linked_ip_address: data.linkedIpAddress,
+      linked_user_agent: data.linkedUserAgent,
+    };
+  }
+
+  /**
+   * Build update data with only defined fields
+   * @private
+   */
+  private buildUpdateData(data: UpdateConnectedAccountData): Record<string, string> {
+    const result: Record<string, string> = { updated_at: new Date().toString() };
+    
+    // Only include defined fields
+    Object.entries(data).forEach(([key, value]) => {
+      if (value !== undefined) {
+        const dbKey = this.camelToSnake(key);
+        result[dbKey] = value;
+      }
+    });
+    
+    return result;
+  }
+
+  /**
+   * Convert camelCase to snake_case
+   * @private
+   */
+  private camelToSnake(str: string): string {
+    return str.replace(/[A-Z]/g, letter => `_${letter.toLowerCase()}`);
+  }
+
+  /**
+   * STEP 8: Map database row to ConnectedAccount interface
+   * Converts snake_case to camelCase
+   * 
+   * @param data - Raw database row
+   * @returns Mapped ConnectedAccount object
+   * @private
+   */
+  private mapToConnectedAccount(data: ConnectedAccount): ConnectedAccount {
+    return {
+      id: data.id,
+      userId: data.userId,
+      providerType: data.providerType,
+      provider: data.provider,
+      providerAccountId: data.providerAccountId,
+      providerEmail: data.providerEmail,
+      providerUsername: data.providerUsername,
+      providerDisplayName: data.providerDisplayName,
+      providerAvatarUrl: data.providerAvatarUrl,
+      providerProfileUrl: data.providerProfileUrl,
+      providerMetadata: data.providerMetadata,
+      walletAddress: data.walletAddress,
+      chainId: data.chainId,
+      accessTokenEncrypted: data.accessTokenEncrypted,
+      refreshTokenEncrypted: data.refreshTokenEncrypted,
+      tokenExpiresAt: data.tokenExpiresAt ? new Date(data.tokenExpiresAt) : undefined,
+      tokenScope: data.tokenScope,
+      isPrimary: data.isPrimary,
+      isVerified: data.isVerified,
+      isActive: data.isActive,
+      linkedAt: new Date(data.linkedAt),
+      linkedIpAddress: data.lastUsedIpAddress,
+      linkedUserAgent: data.linkedUserAgent,
+      lastUsedAt: data.lastUsedAt ? new Date(data.lastUsedAt) : undefined,
+      lastUsedIpAddress: data.lastUsedIpAddress,
+      createdAt: new Date(data.createdAt),
+      updatedAt: new Date(data.updatedAt),
+    };
+  }
+}