@rebasepro/server-postgres 0.0.1-canary.4829d6e

package/src/schema/auth-schema.ts

@@ -0,0 +1,233 @@
+import { pgSchema, pgTable, varchar, uuid, timestamp, boolean, jsonb, text, unique } from "drizzle-orm/pg-core";
+import { relations } from "drizzle-orm";
+
+/**
+ * Factory function to dynamically create the auth tables bound to the specified schema names.
+ */
+export function createAuthSchema(usersSchemaName = "rebase") {
+    const usersSchema = usersSchemaName === "public" ? null : pgSchema(usersSchemaName);
+
+    const tableCreator = (usersSchema ? usersSchema.table.bind(usersSchema) : pgTable) as typeof pgTable;
+    const usersTableCreator = tableCreator;
+
+    /**
+     * Users table - stores both email/password and OAuth users
+     */
+    const users = usersTableCreator("users", {
+        id: uuid("id").defaultRandom().primaryKey(),
+        email: varchar("email", { length: 255 }).notNull().unique(),
+        passwordHash: varchar("password_hash", { length: 255 }), // NULL for OAuth-only users
+        displayName: varchar("display_name", { length: 255 }),
+        photoUrl: varchar("photo_url", { length: 500 }),
+        emailVerified: boolean("email_verified").default(false).notNull(),
+        emailVerificationToken: varchar("email_verification_token", { length: 255 }),
+        emailVerificationSentAt: timestamp("email_verification_sent_at"),
+        isAnonymous: boolean("is_anonymous").default(false).notNull(),
+        roles: text("roles").array().default([]).notNull(),
+        metadata: jsonb("metadata").$type<Record<string, unknown>>().default({}).notNull(),
+        createdAt: timestamp("created_at").defaultNow().notNull(),
+        updatedAt: timestamp("updated_at").defaultNow().notNull()
+    });
+
+
+    /**
+     * Refresh tokens for long-lived sessions
+     */
+    const refreshTokens = tableCreator("refresh_tokens", {
+        id: uuid("id").defaultRandom().primaryKey(),
+        userId: uuid("user_id").notNull().references(() => users.id, { onDelete: "cascade" }),
+        tokenHash: varchar("token_hash", { length: 255 }).notNull().unique(),
+        expiresAt: timestamp("expires_at").notNull(),
+        userAgent: varchar("user_agent", { length: 500 }),
+        ipAddress: varchar("ip_address", { length: 45 }),
+        createdAt: timestamp("created_at").defaultNow().notNull()
+    }, (table) => ({
+        uniqueDeviceSession: unique("unique_device_session").on(table.userId, table.userAgent, table.ipAddress)
+    }));
+
+    /**
+     * Password reset tokens for forgot password flow
+     */
+    const passwordResetTokens = tableCreator("password_reset_tokens", {
+        id: uuid("id").defaultRandom().primaryKey(),
+        userId: uuid("user_id").notNull().references(() => users.id, { onDelete: "cascade" }),
+        tokenHash: varchar("token_hash", { length: 255 }).notNull().unique(),
+        expiresAt: timestamp("expires_at").notNull(),
+        usedAt: timestamp("used_at"),
+        createdAt: timestamp("created_at").defaultNow().notNull()
+    });
+
+    /**
+     * App config - key/value store for custom settings
+     */
+    const appConfig = tableCreator("app_config", {
+        key: varchar("key", { length: 100 }).primaryKey(),
+        value: jsonb("value").notNull(),
+        updatedAt: timestamp("updated_at").defaultNow().notNull()
+    });
+
+    /**
+     * User identities - maps external OAuth profiles back to local users
+     */
+    const userIdentities = tableCreator("user_identities", {
+        id: uuid("id").defaultRandom().primaryKey(),
+        userId: uuid("user_id").notNull().references(() => users.id, { onDelete: "cascade" }),
+        provider: varchar("provider", { length: 50 }).notNull(), // e.g. 'google', 'linkedin'
+        providerId: varchar("provider_id", { length: 255 }).notNull(),
+        profileData: jsonb("profile_data"),
+        createdAt: timestamp("created_at").defaultNow().notNull(),
+        updatedAt: timestamp("updated_at").defaultNow().notNull()
+    }, (table) => ({
+        uniqueProviderId: unique("unique_provider_id").on(table.provider, table.providerId)
+    }));
+
+    /**
+     * MFA factors table - stores enrolled MFA methods
+     */
+    const mfaFactors = tableCreator("mfa_factors", {
+        id: uuid("id").defaultRandom().primaryKey(),
+        userId: uuid("user_id").notNull().references(() => users.id, { onDelete: "cascade" }),
+        factorType: varchar("factor_type", { length: 20 }).notNull(), // 'totp'
+        secretEncrypted: varchar("secret_encrypted", { length: 500 }).notNull(),
+        friendlyName: varchar("friendly_name", { length: 255 }),
+        verified: boolean("verified").default(false).notNull(),
+        createdAt: timestamp("created_at").defaultNow().notNull(),
+        updatedAt: timestamp("updated_at").defaultNow().notNull()
+    });
+
+    /**
+     * MFA challenges table - tracks active MFA verification attempts
+     */
+    const mfaChallenges = tableCreator("mfa_challenges", {
+        id: uuid("id").defaultRandom().primaryKey(),
+        factorId: uuid("factor_id").notNull().references(() => mfaFactors.id, { onDelete: "cascade" }),
+        createdAt: timestamp("created_at").defaultNow().notNull(),
+        verifiedAt: timestamp("verified_at"),
+        ipAddress: varchar("ip_address", { length: 45 }),
+        expiresAt: timestamp("expires_at").notNull()
+    });
+
+    /**
+     * Recovery codes table - backup codes for MFA
+     */
+    const recoveryCodes = tableCreator("recovery_codes", {
+        id: uuid("id").defaultRandom().primaryKey(),
+        userId: uuid("user_id").notNull().references(() => users.id, { onDelete: "cascade" }),
+        codeHash: varchar("code_hash", { length: 255 }).notNull(),
+        usedAt: timestamp("used_at"),
+        createdAt: timestamp("created_at").defaultNow().notNull()
+    });
+
+    /**
+     * Magic link tokens for passwordless email login
+     */
+    const magicLinkTokens = tableCreator("magic_link_tokens", {
+        id: uuid("id").defaultRandom().primaryKey(),
+        userId: uuid("user_id").notNull().references(() => users.id, { onDelete: "cascade" }),
+        tokenHash: varchar("token_hash", { length: 255 }).notNull().unique(),
+        expiresAt: timestamp("expires_at").notNull(),
+        usedAt: timestamp("used_at"),
+        createdAt: timestamp("created_at").defaultNow().notNull()
+    });
+
+    return {
+        usersSchema,
+        users,
+        refreshTokens,
+        passwordResetTokens,
+        appConfig,
+        userIdentities,
+        mfaFactors,
+        mfaChallenges,
+        recoveryCodes,
+        magicLinkTokens
+    };
+}
+
+// Instantiate default schema and tables using the default "rebase" schema
+const defaultAuthSchema = createAuthSchema("rebase");
+
+export const usersSchema = defaultAuthSchema.usersSchema;
+
+export const users = defaultAuthSchema.users;
+export const refreshTokens = defaultAuthSchema.refreshTokens;
+export const passwordResetTokens = defaultAuthSchema.passwordResetTokens;
+export const appConfig = defaultAuthSchema.appConfig;
+export const userIdentities = defaultAuthSchema.userIdentities;
+export const mfaFactors = defaultAuthSchema.mfaFactors;
+export const mfaChallenges = defaultAuthSchema.mfaChallenges;
+export const recoveryCodes = defaultAuthSchema.recoveryCodes;
+export const magicLinkTokens = defaultAuthSchema.magicLinkTokens;
+
+// Relations
+export const usersRelations = relations(users, ({ many }) => ({
+    refreshTokens: many(refreshTokens),
+    passwordResetTokens: many(passwordResetTokens),
+    userIdentities: many(userIdentities),
+    mfaFactors: many(mfaFactors),
+    recoveryCodes: many(recoveryCodes),
+    magicLinkTokens: many(magicLinkTokens)
+}));
+
+export const refreshTokensRelations = relations(refreshTokens, ({ one }) => ({
+    user: one(users, {
+        fields: [refreshTokens.userId],
+        references: [users.id]
+    })
+}));
+
+export const passwordResetTokensRelations = relations(passwordResetTokens, ({ one }) => ({
+    user: one(users, {
+        fields: [passwordResetTokens.userId],
+        references: [users.id]
+    })
+}));
+
+export const userIdentitiesRelations = relations(userIdentities, ({ one }) => ({
+    user: one(users, {
+        fields: [userIdentities.userId],
+        references: [users.id]
+    })
+}));
+
+export const mfaFactorsRelations = relations(mfaFactors, ({ one, many }) => ({
+    user: one(users, {
+        fields: [mfaFactors.userId],
+        references: [users.id]
+    }),
+    challenges: many(mfaChallenges)
+}));
+
+export const mfaChallengesRelations = relations(mfaChallenges, ({ one }) => ({
+    factor: one(mfaFactors, {
+        fields: [mfaChallenges.factorId],
+        references: [mfaFactors.id]
+    })
+}));
+
+export const recoveryCodesRelations = relations(recoveryCodes, ({ one }) => ({
+    user: one(users, {
+        fields: [recoveryCodes.userId],
+        references: [users.id]
+    })
+}));
+
+export const magicLinkTokensRelations = relations(magicLinkTokens, ({ one }) => ({
+    user: one(users, {
+        fields: [magicLinkTokens.userId],
+        references: [users.id]
+    })
+}));
+
+// Type exports
+export type User = typeof users.$inferSelect;
+export type NewUser = typeof users.$inferInsert;
+export type RefreshToken = typeof refreshTokens.$inferSelect;
+export type PasswordResetToken = typeof passwordResetTokens.$inferSelect;
+export type AppConfig = typeof appConfig.$inferSelect;
+export type UserIdentity = typeof userIdentities.$inferSelect;
+export type NewUserIdentity = typeof userIdentities.$inferInsert;
+export type MfaFactorRow = typeof mfaFactors.$inferSelect;
+export type MfaChallengeRow = typeof mfaChallenges.$inferSelect;
+export type RecoveryCodeRow = typeof recoveryCodes.$inferSelect;
+export type MagicLinkToken = typeof magicLinkTokens.$inferSelect;

package/src/schema/doctor-cli.ts

@@ -0,0 +1,113 @@
+#!/usr/bin/env node
+/**
+ * CLI entry point for `rebase doctor`.
+ * Invoked via tsx by the server-postgres CLI plugin.
+ */
+import path from "path";
+import chalk from "chalk";
+import fs from "fs";
+import { runDoctor, loadCollections } from "./doctor";
+import { checkPolicyDrift, formatPolicyDrift, hasDrift } from "../security/policy-drift";
+import { validatePolicyPgRoles } from "../security/rls-enforcement";
+import { logger } from "@rebasepro/server";
+
+/**
+ * The RLS half of the doctor: policies actually deployed vs the ones the
+ * collections describe, plus policy roles this server could never satisfy.
+ *
+ * Returns true when something is wrong, so callers can set the exit code.
+ */
+async function runPolicyChecks(collectionsPath: string, databaseUrl?: string): Promise<boolean> {
+    if (!databaseUrl) {
+        logger.warn(chalk.yellow("  ⚠ No DATABASE_URL — skipping RLS policy checks"));
+        return false;
+    }
+
+    let problems = false;
+    const { Pool } = await import("pg");
+    const pool = new Pool({ connectionString: databaseUrl });
+    try {
+        const collections = await loadCollections(path.resolve(process.cwd(), collectionsPath));
+        const runSql = async (text: string) => (await pool.query(text)).rows as Record<string, unknown>[];
+
+        // A policy naming a role the server never runs as filters every row, so
+        // the collection reads as empty. Report it without booting a server.
+        try {
+            await validatePolicyPgRoles(runSql, collections as never);
+            logger.info(chalk.green("  ✓ Policy roles are usable by this server"));
+        } catch (err) {
+            problems = true;
+            logger.info("");
+            logger.error(chalk.red(err instanceof Error ? err.message : String(err)));
+        }
+
+        const drift = await checkPolicyDrift(pool as never, collections);
+        logger.info("");
+        if (hasDrift(drift)) {
+            problems = true;
+            logger.info(chalk.yellow("  RLS policies: database does not match your collections"));
+            logger.info(formatPolicyDrift(drift));
+        } else {
+            logger.info(chalk.green("  ✓ RLS policies match your collections"));
+        }
+    } catch (err) {
+        logger.warn(chalk.yellow("  ⚠ Could not check RLS policies"), { error: err });
+    } finally {
+        await pool.end();
+    }
+    return problems;
+}
+
+async function main() {
+    const collectionsArg = process.argv.find((a) => a.startsWith("--collections="));
+    const schemaArg = process.argv.find((a) => a.startsWith("--schema="));
+    const sdkArg = process.argv.find((a) => a.startsWith("--sdk="));
+    // --policies runs only the RLS checks: no schema diff, no SDK types. Useful
+    // as a CI gate against a deployed database, where the collection files and
+    // generated schema are not what you are asking about.
+    const policiesOnly = process.argv.includes("--policies");
+
+    const collectionsPath = collectionsArg?.split("=")[1] ?? path.join("..", "config", "collections");
+    const schemaPath = schemaArg?.split("=")[1] ?? path.join("src", "schema.generated.ts");
+    const sdkPath = sdkArg?.split("=")[1] ?? path.join("..", "generated", "sdk", "database.types.ts");
+
+    // Load .env
+    try {
+        const dotenv = await import("dotenv");
+        const envPath = process.env.DOTENV_CONFIG_PATH;
+        if (envPath) {
+            dotenv.config({ path: envPath });
+        } else {
+            dotenv.config();
+        }
+    } catch {
+        // dotenv may not be installed
+    }
+
+    const databaseUrl = process.env.DATABASE_URL || process.env.ADMIN_CONNECTION_STRING;
+
+    if (policiesOnly) {
+        // Non-zero so this can gate CI — the whole point of the flag.
+        if (await runPolicyChecks(collectionsPath, databaseUrl)) process.exit(1);
+        return;
+    }
+
+    const report = await runDoctor({
+        collectionsPath: path.resolve(process.cwd(), collectionsPath),
+        schemaPath: path.resolve(process.cwd(), schemaPath),
+        sdkPath: path.resolve(process.cwd(), sdkPath),
+        databaseUrl: databaseUrl ?? undefined
+    });
+
+    const policiesDrifted = await runPolicyChecks(collectionsPath, databaseUrl);
+
+    // Exit with non-zero code if there are errors
+    if (report.summary.errors > 0 || policiesDrifted) {
+        process.exit(1);
+    }
+}
+
+main().catch((err) => {
+    logger.error(chalk.red("  ✗ Doctor failed"), { error: err });
+    process.exit(1);
+});