@rehearsal-db/core 0.1.0-beta.13 → 0.1.0-beta.15

package/dist/src/identity/claim.d.mts

@@ -0,0 +1,144 @@
+/** Associate a reviewed copied owner graph with one verified local Auth identity. */
+import type { SupabaseStorageTransfer } from "./storage.mjs";
+declare const SUPPORTED_IDENTITY_PROVIDERS: readonly ["email", "github", "google"];
+type JsonObject = Record<string, unknown>;
+type IdentityProvider = (typeof SUPPORTED_IDENTITY_PROVIDERS)[number];
+type SubjectIdentityProvider = Exclude<IdentityProvider, "email">;
+type IdentityStrategy = "transfer" | "preserve-audit";
+type PathValueType = "text" | "jsonb";
+interface Relation {
+    readonly schema: string;
+    readonly table: string;
+}
+interface PatternDefaultMatcher {
+    readonly kind: "pattern";
+    readonly pattern: string;
+}
+interface ExactDefaultMatcher {
+    readonly kind: "exact";
+    readonly value: unknown;
+}
+type SignupDefaultMatcher = PatternDefaultMatcher | ExactDefaultMatcher;
+interface VerifiedEmailMatcher {
+    readonly type: "verified-email";
+    readonly providers: readonly IdentityProvider[];
+    readonly emailEnvironmentVariable: string;
+    readonly approvedEmailSha256: string;
+}
+interface ProviderSubjectMatcher {
+    readonly type: "provider-subject";
+    readonly provider: SubjectIdentityProvider;
+    readonly subjectEnvironmentVariable: string;
+    readonly approvedSubjectSha256: string;
+}
+type IdentityMatcher = VerifiedEmailMatcher | ProviderSubjectMatcher;
+interface IdentityReference extends Relation {
+    readonly column: string;
+    readonly required: boolean;
+    readonly strategy: IdentityStrategy;
+}
+interface JsonIdentityReference extends Relation {
+    readonly column: string;
+    readonly path: readonly string[];
+}
+interface SignupDefaultDeclaration {
+    readonly table: Relation;
+    readonly identityColumn: string;
+    readonly ignoredColumns: readonly string[];
+    readonly values: Readonly<Record<string, SignupDefaultMatcher>>;
+}
+interface PathIdentityReference extends Relation {
+    readonly column: string;
+    readonly valueType: PathValueType;
+}
+interface IdentityAsset {
+    readonly bucket: string;
+    readonly prefix: string;
+    readonly rewritePath: boolean;
+}
+interface IdentityTokenHook {
+    readonly function: Readonly<{
+        schema: string;
+        name: string;
+    }>;
+    readonly expectedClaims: JsonObject;
+}
+export interface IdentityDeclaration {
+    readonly name: string;
+    readonly matcher: IdentityMatcher;
+    readonly placeholderUserId: string;
+    readonly references: readonly IdentityReference[];
+    readonly jsonReferences: readonly JsonIdentityReference[];
+    readonly signupDefaults: readonly SignupDefaultDeclaration[];
+    readonly pathReferences: readonly PathIdentityReference[];
+    readonly assets: readonly IdentityAsset[];
+    readonly claims: JsonObject;
+    readonly tokenHook: IdentityTokenHook | null;
+}
+export interface IdentityPolicy {
+    readonly identityVersion: 1;
+    readonly identities: readonly IdentityDeclaration[];
+}
+interface IdentityClaimReview {
+    readonly planVersion: 3;
+    readonly operation: "claim-local-identity";
+    readonly name: string;
+    readonly matcher: IdentityMatcher;
+    readonly placeholderUserId: string;
+    readonly references: readonly IdentityReference[];
+    readonly jsonReferences: readonly JsonIdentityReference[];
+    readonly signupDefaults: readonly Readonly<{
+        table: Relation;
+        identityColumn: string;
+        ignoredColumns: readonly string[];
+        valuesSha256: string;
+    }>[];
+    readonly pathReferences: readonly PathIdentityReference[];
+    readonly assets: readonly IdentityAsset[];
+    readonly claimKeys: readonly string[];
+    readonly claimsSha256: string;
+    readonly tokenHook: Readonly<{
+        function: Readonly<{
+            schema: string;
+            name: string;
+        }>;
+        expectedClaimsSha256: string;
+    }> | null;
+}
+export interface IdentityClaimPlan {
+    readonly identity: IdentityDeclaration;
+    readonly review: Readonly<IdentityClaimReview>;
+    readonly digest: string;
+}
+interface QueryResult<Row extends JsonObject = JsonObject> {
+    readonly rows: Row[];
+}
+interface IdentityDatabaseClient {
+    connect?(): Promise<void>;
+    end?(): Promise<void>;
+    query<Row extends JsonObject = JsonObject>(sql: string, parameters?: readonly unknown[]): Promise<QueryResult<Row>>;
+}
+type IdentityClientFactory = (connectionString: string) => IdentityDatabaseClient | Promise<IdentityDatabaseClient>;
+export declare const validateIdentityPolicy: (policy: unknown) => IdentityPolicy;
+export declare const createIdentityClaimPlan: ({ policy, name, environment, }: {
+    policy: unknown;
+    name: string;
+    environment?: Readonly<Record<string, string | undefined>>;
+}) => IdentityClaimPlan;
+export declare const applyIdentityClaim: ({ plan, confirmation, connectionString, clientFactory, storageTransfer, }: {
+    plan: IdentityClaimPlan;
+    confirmation: string;
+    connectionString: string;
+    clientFactory?: IdentityClientFactory;
+    storageTransfer?: SupabaseStorageTransfer;
+}) => Promise<{
+    name: string;
+    provider: IdentityProvider;
+    claimed: true;
+    removedSignupDefaults: number;
+    tokenHookVerified: boolean;
+    placeholderRetainedForAudit: boolean;
+    storageObjectsTransferred: number;
+    idempotent: boolean;
+}>;
+export {};