@portaidentity/server 1.7.0

package/dist/clients/repository.js

@@ -0,0 +1,318 @@
+/**
+ * Client repository — PostgreSQL data access layer.
+ *
+ * Provides CRUD operations for the `clients` table using parameterized
+ * queries. Each function acquires the pool via `getPool()` and returns
+ * mapped Client objects.
+ *
+ * Key patterns:
+ * - Dynamic UPDATE query builder for partial updates
+ * - Paginated listing with org/app/status/search filters
+ * - Whitelisted sort columns to prevent SQL injection
+ * - All rows mapped through `mapRowToClient()`
+ * - Array columns (TEXT[]) handled natively by pg driver
+ */
+import { getPool } from '../lib/database.js';
+import { mapRowToClient } from './types.js';
+import { decodeCursor, buildCursorResult } from '../lib/cursor.js';
+/**
+ * Insert a new client into the database.
+ *
+ * Uses RETURNING * to get the full row back in a single round trip.
+ * The client_id (OIDC identifier) must be unique (enforced by DB constraint).
+ *
+ * Builds the column list dynamically so `login_methods` can be omitted —
+ * letting the DB `DEFAULT NULL` fire for callers that don't know about the
+ * column. When explicitly set (even to `null`), the value is included.
+ *
+ * @param data - Client data to insert
+ * @returns The newly created client
+ * @throws If client_id already exists (unique constraint violation)
+ */
+export async function insertClient(data) {
+    const pool = getPool();
+    const columns = [
+        'organization_id',
+        'application_id',
+        'client_id',
+        'client_name',
+        'client_type',
+        'application_type',
+        'redirect_uris',
+        'post_logout_redirect_uris',
+        'grant_types',
+        'response_types',
+        'scope',
+        'token_endpoint_auth_method',
+        'allowed_origins',
+        'require_pkce',
+    ];
+    const values = [
+        data.organizationId,
+        data.applicationId,
+        data.clientId,
+        data.clientName,
+        data.clientType,
+        data.applicationType,
+        data.redirectUris,
+        data.postLogoutRedirectUris,
+        data.grantTypes,
+        data.responseTypes,
+        data.scope,
+        data.tokenEndpointAuthMethod,
+        data.allowedOrigins,
+        data.requirePkce,
+    ];
+    // Include login_methods only when the caller passed the key (including
+    // explicit null). Omission → DB default (NULL) fires naturally.
+    if (Object.prototype.hasOwnProperty.call(data, 'loginMethods')) {
+        columns.push('login_methods');
+        values.push(data.loginMethods ?? null);
+    }
+    const placeholders = values.map((_, i) => `$${i + 1}`).join(', ');
+    const sql = `INSERT INTO clients (${columns.join(', ')}) VALUES (${placeholders}) RETURNING *`;
+    const result = await pool.query(sql, values);
+    return mapRowToClient(result.rows[0]);
+}
+// ===========================================================================
+// Find
+// ===========================================================================
+/**
+ * Find a client by its internal UUID.
+ *
+ * @param id - Client internal UUID
+ * @returns Client or null if not found
+ */
+export async function findClientById(id) {
+    const pool = getPool();
+    const result = await pool.query('SELECT * FROM clients WHERE id = $1', [id]);
+    if (result.rows.length === 0)
+        return null;
+    return mapRowToClient(result.rows[0]);
+}
+/**
+ * Find a client by its OIDC client_id (public identifier).
+ *
+ * @param clientId - OIDC client_id
+ * @returns Client or null if not found
+ */
+export async function findClientByClientId(clientId) {
+    const pool = getPool();
+    const result = await pool.query('SELECT * FROM clients WHERE client_id = $1', [clientId]);
+    if (result.rows.length === 0)
+        return null;
+    return mapRowToClient(result.rows[0]);
+}
+/**
+ * Mapping from UpdateClientData keys to database column names.
+ * Used by the dynamic query builder to construct SET clauses.
+ */
+const CLIENT_FIELD_TO_COLUMN = {
+    clientName: 'client_name',
+    redirectUris: 'redirect_uris',
+    postLogoutRedirectUris: 'post_logout_redirect_uris',
+    grantTypes: 'grant_types',
+    responseTypes: 'response_types',
+    scope: 'scope',
+    tokenEndpointAuthMethod: 'token_endpoint_auth_method',
+    allowedOrigins: 'allowed_origins',
+    requirePkce: 'require_pkce',
+    status: 'status',
+    loginMethods: 'login_methods',
+};
+/**
+ * Update a client's fields using a dynamic SET clause.
+ *
+ * Only explicitly provided fields are included in the UPDATE statement,
+ * enabling partial updates. The `updated_at` column is handled by the DB
+ * trigger.
+ *
+ * Null-aware logic for `loginMethods`:
+ *   - `undefined` → column omitted from SET (existing value preserved)
+ *   - `null` → SET login_methods = NULL (clears the per-client override)
+ *   - array → SET login_methods = <array>
+ *
+ * To distinguish these three cases, the iteration checks `hasOwnProperty`
+ * on the input — `undefined` keys are treated as absent, while `null` and
+ * arrays are both persisted.
+ *
+ * @param id - Client internal UUID
+ * @param data - Fields to update
+ * @returns Updated client
+ * @throws Error if client not found or no fields provided
+ */
+export async function updateClient(id, data) {
+    const pool = getPool();
+    // Build dynamic SET clause from provided fields
+    const setClauses = [];
+    const values = [id]; // $1 is always the ID
+    let paramIndex = 2;
+    for (const [field, column] of Object.entries(CLIENT_FIELD_TO_COLUMN)) {
+        // For non-nullable fields, presence check via `!== undefined` works.
+        // For nullable fields (loginMethods), we need to persist explicit null
+        // too — so use hasOwnProperty to include all keys the caller passed.
+        const hasKey = Object.prototype.hasOwnProperty.call(data, field);
+        const value = data[field];
+        if (hasKey && value !== undefined) {
+            setClauses.push(`${column} = $${paramIndex}`);
+            values.push(value);
+            paramIndex++;
+        }
+    }
+    if (setClauses.length === 0) {
+        throw new Error('No fields to update');
+    }
+    const sql = `UPDATE clients SET ${setClauses.join(', ')} WHERE id = $1 RETURNING *`;
+    const result = await pool.query(sql, values);
+    if (result.rows.length === 0) {
+        throw new Error('Client not found');
+    }
+    return mapRowToClient(result.rows[0]);
+}
+// ===========================================================================
+// List
+// ===========================================================================
+/**
+ * Allowed sort columns — whitelisted to prevent SQL injection.
+ */
+const ALLOWED_SORT_COLUMNS = {
+    client_name: 'client_name',
+    created_at: 'created_at',
+};
+/**
+ * List clients with pagination, filters, and sorting.
+ *
+ * Supports filtering by organization, application, status, and search text.
+ * Executes two queries: COUNT for total, then data with LIMIT/OFFSET.
+ *
+ * @param options - Pagination, filter, and sort options
+ * @returns Paginated result with clients and metadata
+ */
+export async function listClients(options) {
+    const pool = getPool();
+    const { page, pageSize, organizationId, applicationId, status, search, sortBy, sortOrder } = options;
+    // Build WHERE conditions
+    const conditions = [];
+    const params = [];
+    let paramIndex = 1;
+    if (organizationId) {
+        conditions.push(`organization_id = $${paramIndex}`);
+        params.push(organizationId);
+        paramIndex++;
+    }
+    if (applicationId) {
+        conditions.push(`application_id = $${paramIndex}`);
+        params.push(applicationId);
+        paramIndex++;
+    }
+    if (status) {
+        conditions.push(`status = $${paramIndex}`);
+        params.push(status);
+        paramIndex++;
+    }
+    if (search) {
+        conditions.push(`client_name ILIKE $${paramIndex}`);
+        params.push(`%${search}%`);
+        paramIndex++;
+    }
+    const whereClause = conditions.length > 0 ? `WHERE ${conditions.join(' AND ')}` : '';
+    // Whitelist sort column and direction
+    const sortColumn = ALLOWED_SORT_COLUMNS[sortBy ?? 'created_at'] ?? 'created_at';
+    const direction = sortOrder === 'asc' ? 'ASC' : 'DESC';
+    // Count total matching rows
+    const countResult = await pool.query(`SELECT COUNT(*) as count FROM clients ${whereClause}`, params);
+    const total = parseInt(countResult.rows[0].count, 10);
+    // Fetch paginated data
+    const offset = (page - 1) * pageSize;
+    const dataResult = await pool.query(`SELECT * FROM clients ${whereClause} ORDER BY ${sortColumn} ${direction} LIMIT $${paramIndex} OFFSET $${paramIndex + 1}`, [...params, pageSize, offset]);
+    return {
+        data: dataResult.rows.map(mapRowToClient),
+        total,
+        page,
+        pageSize,
+        totalPages: Math.ceil(total / pageSize),
+    };
+}
+/**
+ * List clients with cursor-based keyset pagination.
+ *
+ * @param options - Cursor pagination, filter, and sort options
+ * @returns Cursor-paginated result with clients
+ */
+export async function listClientsCursor(options) {
+    const pool = getPool();
+    const limit = Math.min(Math.max(1, options.limit ?? 25), 100);
+    const sortColumn = ALLOWED_SORT_COLUMNS[options.sortBy ?? 'created_at'] ?? 'created_at';
+    const direction = options.sortOrder === 'asc' ? 'ASC' : 'DESC';
+    const comparator = direction === 'ASC' ? '>' : '<';
+    const conditions = [];
+    const params = [];
+    let paramIndex = 1;
+    if (options.cursor) {
+        const decoded = decodeCursor(options.cursor);
+        if (decoded) {
+            if (decoded.s === null) {
+                conditions.push(`(${sortColumn} IS NOT NULL OR (${sortColumn} IS NULL AND id ${comparator} $${paramIndex}))`);
+                params.push(decoded.i);
+                paramIndex++;
+            }
+            else {
+                conditions.push(`(${sortColumn}, id) ${comparator} ($${paramIndex}, $${paramIndex + 1})`);
+                params.push(decoded.s, decoded.i);
+                paramIndex += 2;
+            }
+        }
+    }
+    if (options.organizationId) {
+        conditions.push(`organization_id = $${paramIndex}`);
+        params.push(options.organizationId);
+        paramIndex++;
+    }
+    if (options.applicationId) {
+        conditions.push(`application_id = $${paramIndex}`);
+        params.push(options.applicationId);
+        paramIndex++;
+    }
+    if (options.status) {
+        conditions.push(`status = $${paramIndex}`);
+        params.push(options.status);
+        paramIndex++;
+    }
+    if (options.search) {
+        conditions.push(`client_name ILIKE $${paramIndex}`);
+        params.push(`%${options.search}%`);
+        paramIndex++;
+    }
+    const whereClause = conditions.length > 0 ? `WHERE ${conditions.join(' AND ')}` : '';
+    const sql = `SELECT * FROM clients ${whereClause} ORDER BY ${sortColumn} ${direction}, id ${direction} LIMIT $${paramIndex}`;
+    params.push(limit + 1);
+    const result = await pool.query(sql, params);
+    const rows = result.rows.map(mapRowToClient);
+    return buildCursorResult(rows, limit, (c) => sortColumn === 'client_name' ? c.clientName : c.createdAt.toISOString(), (c) => c.id);
+}
+// ===========================================================================
+// Count helpers
+// ===========================================================================
+/**
+ * Count clients for an organization.
+ *
+ * @param organizationId - Organization UUID
+ * @returns Number of clients
+ */
+export async function countClientsByOrg(organizationId) {
+    const pool = getPool();
+    const result = await pool.query('SELECT COUNT(*) as count FROM clients WHERE organization_id = $1', [organizationId]);
+    return parseInt(result.rows[0].count, 10);
+}
+/**
+ * Count clients for an application.
+ *
+ * @param applicationId - Application UUID
+ * @returns Number of clients
+ */
+export async function countClientsByApp(applicationId) {
+    const pool = getPool();
+    const result = await pool.query('SELECT COUNT(*) as count FROM clients WHERE application_id = $1', [applicationId]);
+    return parseInt(result.rows[0].count, 10);
+}
+//# sourceMappingURL=repository.js.map

package/dist/clients/repository.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"repository.js","sourceRoot":"","sources":["../../src/clients/repository.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAEH,OAAO,EAAE,OAAO,EAAE,MAAM,oBAAoB,CAAC;AAQ7C,OAAO,EAAE,cAAc,EAAE,MAAM,YAAY,CAAC;AAC5C,OAAO,EAAE,YAAY,EAAE,iBAAiB,EAAE,MAAM,kBAAkB,CAAC;AAmCnE;;;;;;;;;;;;;GAaG;AACH,MAAM,CAAC,KAAK,UAAU,YAAY,CAAC,IAAsB;IACvD,MAAM,IAAI,GAAG,OAAO,EAAE,CAAC;IAEvB,MAAM,OAAO,GAAa;QACxB,iBAAiB;QACjB,gBAAgB;QAChB,WAAW;QACX,aAAa;QACb,aAAa;QACb,kBAAkB;QAClB,eAAe;QACf,2BAA2B;QAC3B,aAAa;QACb,gBAAgB;QAChB,OAAO;QACP,4BAA4B;QAC5B,iBAAiB;QACjB,cAAc;KACf,CAAC;IACF,MAAM,MAAM,GAAc;QACxB,IAAI,CAAC,cAAc;QACnB,IAAI,CAAC,aAAa;QAClB,IAAI,CAAC,QAAQ;QACb,IAAI,CAAC,UAAU;QACf,IAAI,CAAC,UAAU;QACf,IAAI,CAAC,eAAe;QACpB,IAAI,CAAC,YAAY;QACjB,IAAI,CAAC,sBAAsB;QAC3B,IAAI,CAAC,UAAU;QACf,IAAI,CAAC,aAAa;QAClB,IAAI,CAAC,KAAK;QACV,IAAI,CAAC,uBAAuB;QAC5B,IAAI,CAAC,cAAc;QACnB,IAAI,CAAC,WAAW;KACjB,CAAC;IAEF,uEAAuE;IACvE,gEAAgE;IAChE,IAAI,MAAM,CAAC,SAAS,CAAC,cAAc,CAAC,IAAI,CAAC,IAAI,EAAE,cAAc,CAAC,EAAE,CAAC;QAC/D,OAAO,CAAC,IAAI,CAAC,eAAe,CAAC,CAAC;QAC9B,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,YAAY,IAAI,IAAI,CAAC,CAAC;IACzC,CAAC;IAED,MAAM,YAAY,GAAG,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAClE,MAAM,GAAG,GAAG,wBAAwB,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,aAAa,YAAY,eAAe,CAAC;IAE/F,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,KAAK,CAAY,GAAG,EAAE,MAAM,CAAC,CAAC;IAExD,OAAO,cAAc,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC;AACxC,CAAC;AAGD,8EAA8E;AAC9E,OAAO;AACP,8EAA8E;AAE9E;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,cAAc,CAAC,EAAU;IAC7C,MAAM,IAAI,GAAG,OAAO,EAAE,CAAC;IAEvB,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,KAAK,CAC7B,qCAAqC,EACrC,CAAC,EAAE,CAAC,CACL,CAAC;IAEF,IAAI,MAAM,CAAC,IAAI,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IAC1C,OAAO,cAAc,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC;AACxC,CAAC;AAED;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,oBAAoB,CAAC,QAAgB;IACzD,MAAM,IAAI,GAAG,OAAO,EAAE,CAAC;IAEvB,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,KAAK,CAC7B,4CAA4C,EAC5C,CAAC,QAAQ,CAAC,CACX,CAAC;IAEF,IAAI,MAAM,CAAC,IAAI,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IAC1C,OAAO,cAAc,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC;AACxC,CAAC;AA+BD;;;GAGG;AACH,MAAM,sBAAsB,GAA2B;IACrD,UAAU,EAAE,aAAa;IACzB,YAAY,EAAE,eAAe;IAC7B,sBAAsB,EAAE,2BAA2B;IACnD,UAAU,EAAE,aAAa;IACzB,aAAa,EAAE,gBAAgB;IAC/B,KAAK,EAAE,OAAO;IACd,uBAAuB,EAAE,4BAA4B;IACrD,cAAc,EAAE,iBAAiB;IACjC,WAAW,EAAE,cAAc;IAC3B,MAAM,EAAE,QAAQ;IAChB,YAAY,EAAE,eAAe;CAC9B,CAAC;AAEF;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,MAAM,CAAC,KAAK,UAAU,YAAY,CAChC,EAAU,EACV,IAAsB;IAEtB,MAAM,IAAI,GAAG,OAAO,EAAE,CAAC;IAEvB,gDAAgD;IAChD,MAAM,UAAU,GAAa,EAAE,CAAC;IAChC,MAAM,MAAM,GAAc,CAAC,EAAE,CAAC,CAAC,CAAC,sBAAsB;IACtD,IAAI,UAAU,GAAG,CAAC,CAAC;IAEnB,KAAK,MAAM,CAAC,KAAK,EAAE,MAAM,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,sBAAsB,CAAC,EAAE,CAAC;QACrE,qEAAqE;QACrE,uEAAuE;QACvE,qEAAqE;QACrE,MAAM,MAAM,GAAG,MAAM,CAAC,SAAS,CAAC,cAAc,CAAC,IAAI,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;QACjE,MAAM,KAAK,GAAG,IAAI,CAAC,KAA+B,CAAC,CAAC;QACpD,IAAI,MAAM,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;YAClC,UAAU,CAAC,IAAI,CAAC,GAAG,MAAM,OAAO,UAAU,EAAE,CAAC,CAAC;YAC9C,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;YACnB,UAAU,EAAE,CAAC;QACf,CAAC;IACH,CAAC;IAED,IAAI,UAAU,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC5B,MAAM,IAAI,KAAK,CAAC,qBAAqB,CAAC,CAAC;IACzC,CAAC;IAED,MAAM,GAAG,GAAG,sBAAsB,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,4BAA4B,CAAC;IACpF,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,KAAK,CAAY,GAAG,EAAE,MAAM,CAAC,CAAC;IAExD,IAAI,MAAM,CAAC,IAAI,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC7B,MAAM,IAAI,KAAK,CAAC,kBAAkB,CAAC,CAAC;IACtC,CAAC;IAED,OAAO,cAAc,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC;AACxC,CAAC;AAGD,8EAA8E;AAC9E,OAAO;AACP,8EAA8E;AAE9E;;GAEG;AACH,MAAM,oBAAoB,GAA2B;IACnD,WAAW,EAAE,aAAa;IAC1B,UAAU,EAAE,YAAY;CACzB,CAAC;AAEF;;;;;;;;GAQG;AACH,MAAM,CAAC,KAAK,UAAU,WAAW,CAC/B,OAA2B;IAE3B,MAAM,IAAI,GAAG,OAAO,EAAE,CAAC;IACvB,MAAM,EAAE,IAAI,EAAE,QAAQ,EAAE,cAAc,EAAE,aAAa,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,SAAS,EAAE,GAAG,OAAO,CAAC;IAErG,yBAAyB;IACzB,MAAM,UAAU,GAAa,EAAE,CAAC;IAChC,MAAM,MAAM,GAAc,EAAE,CAAC;IAC7B,IAAI,UAAU,GAAG,CAAC,CAAC;IAEnB,IAAI,cAAc,EAAE,CAAC;QACnB,UAAU,CAAC,IAAI,CAAC,sBAAsB,UAAU,EAAE,CAAC,CAAC;QACpD,MAAM,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC;QAC5B,UAAU,EAAE,CAAC;IACf,CAAC;IAED,IAAI,aAAa,EAAE,CAAC;QAClB,UAAU,CAAC,IAAI,CAAC,qBAAqB,UAAU,EAAE,CAAC,CAAC;QACnD,MAAM,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC;QAC3B,UAAU,EAAE,CAAC;IACf,CAAC;IAED,IAAI,MAAM,EAAE,CAAC;QACX,UAAU,CAAC,IAAI,CAAC,aAAa,UAAU,EAAE,CAAC,CAAC;QAC3C,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QACpB,UAAU,EAAE,CAAC;IACf,CAAC;IAED,IAAI,MAAM,EAAE,CAAC;QACX,UAAU,CAAC,IAAI,CAAC,sBAAsB,UAAU,EAAE,CAAC,CAAC;QACpD,MAAM,CAAC,IAAI,CAAC,IAAI,MAAM,GAAG,CAAC,CAAC;QAC3B,UAAU,EAAE,CAAC;IACf,CAAC;IAED,MAAM,WAAW,GAAG,UAAU,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,SAAS,UAAU,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;IAErF,sCAAsC;IACtC,MAAM,UAAU,GAAG,oBAAoB,CAAC,MAAM,IAAI,YAAY,CAAC,IAAI,YAAY,CAAC;IAChF,MAAM,SAAS,GAAG,SAAS,KAAK,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC;IAEvD,4BAA4B;IAC5B,MAAM,WAAW,GAAG,MAAM,IAAI,CAAC,KAAK,CAClC,yCAAyC,WAAW,EAAE,EACtD,MAAM,CACP,CAAC;IACF,MAAM,KAAK,GAAG,QAAQ,CAAC,WAAW,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;IAEtD,uBAAuB;IACvB,MAAM,MAAM,GAAG,CAAC,IAAI,GAAG,CAAC,CAAC,GAAG,QAAQ,CAAC;IACrC,MAAM,UAAU,GAAG,MAAM,IAAI,CAAC,KAAK,CACjC,yBAAyB,WAAW,aAAa,UAAU,IAAI,SAAS,WAAW,UAAU,YAAY,UAAU,GAAG,CAAC,EAAE,EACzH,CAAC,GAAG,MAAM,EAAE,QAAQ,EAAE,MAAM,CAAC,CAC9B,CAAC;IAEF,OAAO;QACL,IAAI,EAAE,UAAU,CAAC,IAAI,CAAC,GAAG,CAAC,cAAc,CAAC;QACzC,KAAK;QACL,IAAI;QACJ,QAAQ;QACR,UAAU,EAAE,IAAI,CAAC,IAAI,CAAC,KAAK,GAAG,QAAQ,CAAC;KACxC,CAAC;AACJ,CAAC;AAkBD;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,iBAAiB,CACrC,OAAiC;IAEjC,MAAM,IAAI,GAAG,OAAO,EAAE,CAAC;IACvB,MAAM,KAAK,GAAG,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,OAAO,CAAC,KAAK,IAAI,EAAE,CAAC,EAAE,GAAG,CAAC,CAAC;IAC9D,MAAM,UAAU,GAAG,oBAAoB,CAAC,OAAO,CAAC,MAAM,IAAI,YAAY,CAAC,IAAI,YAAY,CAAC;IACxF,MAAM,SAAS,GAAG,OAAO,CAAC,SAAS,KAAK,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC;IAC/D,MAAM,UAAU,GAAG,SAAS,KAAK,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC;IAEnD,MAAM,UAAU,GAAa,EAAE,CAAC;IAChC,MAAM,MAAM,GAAc,EAAE,CAAC;IAC7B,IAAI,UAAU,GAAG,CAAC,CAAC;IAEnB,IAAI,OAAO,CAAC,MAAM,EAAE,CAAC;QACnB,MAAM,OAAO,GAAG,YAAY,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;QAC7C,IAAI,OAAO,EAAE,CAAC;YACZ,IAAI,OAAO,CAAC,CAAC,KAAK,IAAI,EAAE,CAAC;gBACvB,UAAU,CAAC,IAAI,CAAC,IAAI,UAAU,oBAAoB,UAAU,mBAAmB,UAAU,KAAK,UAAU,IAAI,CAAC,CAAC;gBAC9G,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC;gBACvB,UAAU,EAAE,CAAC;YACf,CAAC;iBAAM,CAAC;gBACN,UAAU,CAAC,IAAI,CAAC,IAAI,UAAU,SAAS,UAAU,MAAM,UAAU,MAAM,UAAU,GAAG,CAAC,GAAG,CAAC,CAAC;gBAC1F,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,EAAE,OAAO,CAAC,CAAC,CAAC,CAAC;gBAClC,UAAU,IAAI,CAAC,CAAC;YAClB,CAAC;QACH,CAAC;IACH,CAAC;IAED,IAAI,OAAO,CAAC,cAAc,EAAE,CAAC;QAC3B,UAAU,CAAC,IAAI,CAAC,sBAAsB,UAAU,EAAE,CAAC,CAAC;QACpD,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,cAAc,CAAC,CAAC;QACpC,UAAU,EAAE,CAAC;IACf,CAAC;IAED,IAAI,OAAO,CAAC,aAAa,EAAE,CAAC;QAC1B,UAAU,CAAC,IAAI,CAAC,qBAAqB,UAAU,EAAE,CAAC,CAAC;QACnD,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,aAAa,CAAC,CAAC;QACnC,UAAU,EAAE,CAAC;IACf,CAAC;IAED,IAAI,OAAO,CAAC,MAAM,EAAE,CAAC;QACnB,UAAU,CAAC,IAAI,CAAC,aAAa,UAAU,EAAE,CAAC,CAAC;QAC3C,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;QAC5B,UAAU,EAAE,CAAC;IACf,CAAC;IAED,IAAI,OAAO,CAAC,MAAM,EAAE,CAAC;QACnB,UAAU,CAAC,IAAI,CAAC,sBAAsB,UAAU,EAAE,CAAC,CAAC;QACpD,MAAM,CAAC,IAAI,CAAC,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC,CAAC;QACnC,UAAU,EAAE,CAAC;IACf,CAAC;IAED,MAAM,WAAW,GAAG,UAAU,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,SAAS,UAAU,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;IACrF,MAAM,GAAG,GAAG,yBAAyB,WAAW,aAAa,UAAU,IAAI,SAAS,QAAQ,SAAS,WAAW,UAAU,EAAE,CAAC;IAC7H,MAAM,CAAC,IAAI,CAAC,KAAK,GAAG,CAAC,CAAC,CAAC;IAEvB,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,KAAK,CAAY,GAAG,EAAE,MAAM,CAAC,CAAC;IACxD,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,cAAc,CAAC,CAAC;IAE7C,OAAO,iBAAiB,CACtB,IAAI,EACJ,KAAK,EACL,CAAC,CAAC,EAAE,EAAE,CAAC,UAAU,KAAK,aAAa,CAAC,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,WAAW,EAAE,EAC9E,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CACZ,CAAC;AACJ,CAAC;AAED,8EAA8E;AAC9E,gBAAgB;AAChB,8EAA8E;AAE9E;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,iBAAiB,CAAC,cAAsB;IAC5D,MAAM,IAAI,GAAG,OAAO,EAAE,CAAC;IAEvB,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,KAAK,CAC7B,kEAAkE,EAClE,CAAC,cAAc,CAAC,CACjB,CAAC;IAEF,OAAO,QAAQ,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;AAC5C,CAAC;AAED;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,iBAAiB,CAAC,aAAqB;IAC3D,MAAM,IAAI,GAAG,OAAO,EAAE,CAAC;IAEvB,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,KAAK,CAC7B,iEAAiE,EACjE,CAAC,aAAa,CAAC,CAChB,CAAC;IAEF,OAAO,QAAQ,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;AAC5C,CAAC"}

package/dist/clients/resolve-login-methods.d.ts

@@ -0,0 +1,74 @@
+/**
+ * Login method resolution helper.
+ *
+ * Computes the effective login methods for a client by applying the
+ * inheritance rule: if `client.loginMethods` is `null` (or, defensively,
+ * an empty array), fall back to the organization's `defaultLoginMethods`.
+ * Otherwise, use the client's explicit override.
+ *
+ * This is the single source of truth for "which login methods apply
+ * here?" and is consumed by:
+ *   - the login interaction handler (to drive template rendering)
+ *   - the POST /login and POST /magic-link handlers (to enforce)
+ *   - the admin API + CLI (to display the resolved value)
+ *
+ * Both functions are pure — no I/O, no side effects, deterministic. They
+ * live next to {@link ../clients/types.ts | LoginMethod} so consumers can
+ * import the type and helpers from a single barrel.
+ */
+import type { Organization } from '../organizations/types.js';
+import type { LoginMethod } from './types.js';
+/**
+ * Minimal client shape consumed by {@link resolveLoginMethods}.
+ *
+ * Defined inline (instead of `Pick<Client, 'loginMethods'>`) so this
+ * helper compiles cleanly *before* the `Client` model gains the
+ * `loginMethods` field in Phase 4 of the implementation plan. Once the
+ * field is added, this shape stays a valid structural subtype of
+ * `Client`, so call sites continue to compile without changes.
+ */
+export interface LoginMethodsClientView {
+    /**
+     * Per-client override:
+     *   - `null` → inherit org defaults
+     *   - non-empty array → use these methods exclusively
+     *   - empty array → defensively treated as inherit (service layer
+     *     rejects this on write, but the resolver stays safe on read)
+     */
+    loginMethods: LoginMethod[] | null;
+}
+/**
+ * Resolve the effective login methods for a client.
+ *
+ * Inheritance rule:
+ *   - If the client has explicit methods set (non-null **and** non-empty),
+ *     return those (the override).
+ *   - Otherwise, return the organization's `defaultLoginMethods`.
+ *
+ * The empty-array branch is defensive: the data layer should never
+ * persist an empty `loginMethods` array (the service layer rejects it),
+ * but treating `[]` the same as `null` keeps the resolver safe in the
+ * face of unexpected upstream data.
+ *
+ * @param org - Organization owning the client (only `defaultLoginMethods` is read)
+ * @param client - Client — either with its own `loginMethods` or `null` to inherit
+ * @returns The effective array of login methods that apply to this client
+ */
+export declare function resolveLoginMethods(org: Pick<Organization, 'defaultLoginMethods'>, client: LoginMethodsClientView): LoginMethod[];
+/**
+ * Normalize a list of login-method inputs by deduplicating while
+ * preserving first-occurrence order.
+ *
+ * Duplicate values (e.g., `['password', 'password', 'magic_link']`) are
+ * collapsed to the first occurrence, yielding `['password', 'magic_link']`.
+ *
+ * Used by the service layer during create/update to sanitize incoming
+ * arrays before persisting. An empty input returns an empty array — the
+ * caller (typically the service validator) is responsible for rejecting
+ * empty inputs when they are invalid.
+ *
+ * @param methods - Raw input array (may contain duplicates)
+ * @returns De-duplicated array preserving first-occurrence order
+ */
+export declare function normalizeLoginMethods(methods: LoginMethod[]): LoginMethod[];
+//# sourceMappingURL=resolve-login-methods.d.ts.map

package/dist/clients/resolve-login-methods.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"resolve-login-methods.d.ts","sourceRoot":"","sources":["../../src/clients/resolve-login-methods.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;GAiBG;AAEH,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,2BAA2B,CAAC;AAC9D,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,YAAY,CAAC;AAE9C;;;;;;;;GAQG;AACH,MAAM,WAAW,sBAAsB;IACrC;;;;;;OAMG;IACH,YAAY,EAAE,WAAW,EAAE,GAAG,IAAI,CAAC;CACpC;AAED;;;;;;;;;;;;;;;;GAgBG;AACH,wBAAgB,mBAAmB,CACjC,GAAG,EAAE,IAAI,CAAC,YAAY,EAAE,qBAAqB,CAAC,EAC9C,MAAM,EAAE,sBAAsB,GAC7B,WAAW,EAAE,CAKf;AAED;;;;;;;;;;;;;;GAcG;AACH,wBAAgB,qBAAqB,CAAC,OAAO,EAAE,WAAW,EAAE,GAAG,WAAW,EAAE,CAU3E"}

package/dist/clients/resolve-login-methods.js

@@ -0,0 +1,68 @@
+/**
+ * Login method resolution helper.
+ *
+ * Computes the effective login methods for a client by applying the
+ * inheritance rule: if `client.loginMethods` is `null` (or, defensively,
+ * an empty array), fall back to the organization's `defaultLoginMethods`.
+ * Otherwise, use the client's explicit override.
+ *
+ * This is the single source of truth for "which login methods apply
+ * here?" and is consumed by:
+ *   - the login interaction handler (to drive template rendering)
+ *   - the POST /login and POST /magic-link handlers (to enforce)
+ *   - the admin API + CLI (to display the resolved value)
+ *
+ * Both functions are pure — no I/O, no side effects, deterministic. They
+ * live next to {@link ../clients/types.ts | LoginMethod} so consumers can
+ * import the type and helpers from a single barrel.
+ */
+/**
+ * Resolve the effective login methods for a client.
+ *
+ * Inheritance rule:
+ *   - If the client has explicit methods set (non-null **and** non-empty),
+ *     return those (the override).
+ *   - Otherwise, return the organization's `defaultLoginMethods`.
+ *
+ * The empty-array branch is defensive: the data layer should never
+ * persist an empty `loginMethods` array (the service layer rejects it),
+ * but treating `[]` the same as `null` keeps the resolver safe in the
+ * face of unexpected upstream data.
+ *
+ * @param org - Organization owning the client (only `defaultLoginMethods` is read)
+ * @param client - Client — either with its own `loginMethods` or `null` to inherit
+ * @returns The effective array of login methods that apply to this client
+ */
+export function resolveLoginMethods(org, client) {
+    if (client.loginMethods !== null && client.loginMethods.length > 0) {
+        return client.loginMethods;
+    }
+    return org.defaultLoginMethods;
+}
+/**
+ * Normalize a list of login-method inputs by deduplicating while
+ * preserving first-occurrence order.
+ *
+ * Duplicate values (e.g., `['password', 'password', 'magic_link']`) are
+ * collapsed to the first occurrence, yielding `['password', 'magic_link']`.
+ *
+ * Used by the service layer during create/update to sanitize incoming
+ * arrays before persisting. An empty input returns an empty array — the
+ * caller (typically the service validator) is responsible for rejecting
+ * empty inputs when they are invalid.
+ *
+ * @param methods - Raw input array (may contain duplicates)
+ * @returns De-duplicated array preserving first-occurrence order
+ */
+export function normalizeLoginMethods(methods) {
+    const seen = new Set();
+    const result = [];
+    for (const m of methods) {
+        if (!seen.has(m)) {
+            seen.add(m);
+            result.push(m);
+        }
+    }
+    return result;
+}
+//# sourceMappingURL=resolve-login-methods.js.map

package/dist/clients/resolve-login-methods.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"resolve-login-methods.js","sourceRoot":"","sources":["../../src/clients/resolve-login-methods.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;GAiBG;AAyBH;;;;;;;;;;;;;;;;GAgBG;AACH,MAAM,UAAU,mBAAmB,CACjC,GAA8C,EAC9C,MAA8B;IAE9B,IAAI,MAAM,CAAC,YAAY,KAAK,IAAI,IAAI,MAAM,CAAC,YAAY,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACnE,OAAO,MAAM,CAAC,YAAY,CAAC;IAC7B,CAAC;IACD,OAAO,GAAG,CAAC,mBAAmB,CAAC;AACjC,CAAC;AAED;;;;;;;;;;;;;;GAcG;AACH,MAAM,UAAU,qBAAqB,CAAC,OAAsB;IAC1D,MAAM,IAAI,GAAG,IAAI,GAAG,EAAe,CAAC;IACpC,MAAM,MAAM,GAAkB,EAAE,CAAC;IACjC,KAAK,MAAM,CAAC,IAAI,OAAO,EAAE,CAAC;QACxB,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC;YACjB,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;YACZ,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QACjB,CAAC;IACH,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC"}

package/dist/clients/secret-repository.d.ts

@@ -0,0 +1,109 @@
+/**
+ * Secret repository — PostgreSQL data access for client_secrets table.
+ *
+ * Manages the storage of hashed client secrets. The plaintext secret
+ * is NEVER stored — only the Argon2id hash. The secret_hash field
+ * is only accessible here in the repository layer; the mapRowToClientSecret
+ * function intentionally excludes it from the domain model.
+ *
+ * Key operations:
+ * - Insert hashed secret
+ * - List secrets (metadata only, no hashes)
+ * - Find active secrets with hashes (for verification only)
+ * - Revoke secrets
+ * - Update last_used_at timestamp
+ * - Cleanup expired secrets
+ */
+import type { ClientSecret } from './types.js';
+/** Data required to insert a new secret */
+export interface InsertSecretData {
+    clientId: string;
+    secretHash: string;
+    secretSha256: string | null;
+    label: string | null;
+    expiresAt: Date | null;
+}
+/**
+ * Insert a new client secret.
+ *
+ * Stores the Argon2id hash — never the plaintext.
+ *
+ * @param data - Secret data including the hash
+ * @returns The created secret metadata (without hash)
+ */
+export declare function insertSecret(data: InsertSecretData): Promise<ClientSecret>;
+/**
+ * List all secrets for a client (metadata only, no hashes).
+ *
+ * @param clientId - Client internal UUID
+ * @returns Array of secret metadata
+ */
+export declare function listSecretsByClient(clientId: string): Promise<ClientSecret[]>;
+/**
+ * Find a specific secret by ID.
+ *
+ * @param id - Secret UUID
+ * @returns Secret metadata or null
+ */
+export declare function findSecretById(id: string): Promise<ClientSecret | null>;
+/**
+ * Get active secret hashes for verification.
+ *
+ * This is the ONLY function that returns secret_hash values.
+ * Used exclusively by the secret service for Argon2id verification.
+ * Returns secrets that are active AND not expired.
+ *
+ * @param clientId - Client internal UUID
+ * @returns Array of {id, hash} pairs for active secrets
+ */
+export declare function getActiveSecretHashes(clientId: string): Promise<Array<{
+    id: string;
+    hash: string;
+}>>;
+/**
+ * Revoke a secret (set status = 'revoked').
+ *
+ * This is a permanent operation — revoked secrets cannot be reactivated.
+ *
+ * @param id - Secret UUID
+ * @returns Updated secret metadata, or null if not found
+ */
+export declare function revokeSecret(id: string): Promise<ClientSecret | null>;
+/**
+ * Update the last_used_at timestamp for a secret.
+ *
+ * Called after successful secret verification to track usage.
+ *
+ * @param id - Secret UUID
+ */
+export declare function updateLastUsedAt(id: string): Promise<void>;
+/**
+ * Delete expired secrets that have been expired for more than the given days.
+ *
+ * Only deletes secrets where expires_at is in the past by at least `retentionDays`.
+ * This prevents premature deletion of recently-expired secrets that might
+ * still appear in audit logs.
+ *
+ * @param retentionDays - Number of days to retain expired secrets (default: 30)
+ * @returns Number of deleted secrets
+ */
+export declare function cleanupExpiredSecrets(retentionDays?: number): Promise<number>;
+/**
+ * Get the SHA-256 hash of the most recent active, non-expired secret.
+ *
+ * Used by findForOidc() to include the SHA-256 hash as client_secret
+ * in oidc-provider metadata. Returns null if no active secret has a
+ * SHA-256 hash (e.g., secrets created before migration 013).
+ *
+ * @param clientId - Client internal UUID
+ * @returns SHA-256 hex hash string, or null if none available
+ */
+export declare function getLatestActiveSha256(clientId: string): Promise<string | null>;
+/**
+ * Count active secrets for a client.
+ *
+ * @param clientId - Client internal UUID
+ * @returns Number of active (non-revoked, non-expired) secrets
+ */
+export declare function countActiveSecrets(clientId: string): Promise<number>;
+//# sourceMappingURL=secret-repository.d.ts.map

package/dist/clients/secret-repository.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"secret-repository.d.ts","sourceRoot":"","sources":["../../src/clients/secret-repository.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AAGH,OAAO,KAAK,EAAE,YAAY,EAAmB,MAAM,YAAY,CAAC;AAOhE,2CAA2C;AAC3C,MAAM,WAAW,gBAAgB;IAC/B,QAAQ,EAAE,MAAM,CAAC;IACjB,UAAU,EAAE,MAAM,CAAC;IACnB,YAAY,EAAE,MAAM,GAAG,IAAI,CAAC;IAC5B,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;IACrB,SAAS,EAAE,IAAI,GAAG,IAAI,CAAC;CACxB;AAED;;;;;;;GAOG;AACH,wBAAsB,YAAY,CAAC,IAAI,EAAE,gBAAgB,GAAG,OAAO,CAAC,YAAY,CAAC,CAWhF;AAMD;;;;;GAKG;AACH,wBAAsB,mBAAmB,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,YAAY,EAAE,CAAC,CASnF;AAED;;;;;GAKG;AACH,wBAAsB,cAAc,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,YAAY,GAAG,IAAI,CAAC,CAU7E;AAED;;;;;;;;;GASG;AACH,wBAAsB,qBAAqB,CACzC,QAAQ,EAAE,MAAM,GACf,OAAO,CAAC,KAAK,CAAC;IAAE,EAAE,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAA;CAAE,CAAC,CAAC,CAa9C;AAMD;;;;;;;GAOG;AACH,wBAAsB,YAAY,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,YAAY,GAAG,IAAI,CAAC,CAU3E;AAED;;;;;;GAMG;AACH,wBAAsB,gBAAgB,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAOhE;AAMD;;;;;;;;;GASG;AACH,wBAAsB,qBAAqB,CAAC,aAAa,GAAE,MAAW,GAAG,OAAO,CAAC,MAAM,CAAC,CAWvF;AAED;;;;;;;;;GASG;AACH,wBAAsB,qBAAqB,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAgBpF;AAED;;;;;GAKG;AACH,wBAAsB,kBAAkB,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAY1E"}