@remit/auth-service 0.0.15 → 0.1.0

package/src/schema/auth-schema-sqlite.ts

@@ -1,6 +1,6 @@
 // The five better-auth identity tables, in the shape better-auth's drizzle
 // adapter emits with `provider: "sqlite"`. Used to generate the committed
-// sqlite migrations (deploy/vps/migrations-sqlite/auth).
+// sqlite migrations (deploy/vps/migrations-sqlite/app).
 //
 // Hand-maintained, deliberately. The `@better-auth/cli generate` command no
 // longer emits this shape: it writes `mode: "timestamp_ms"` where these columns
@@ -10,7 +10,14 @@
 // every deployed instance and rewrite all five tables. Match better-auth's
 // runtime expectations by hand when a version bump changes them, and let
 // vps-migrations-drift.sqlite.test.ts catch the migration side.
-import { index, integer, sqliteTable, text } from "drizzle-orm/sqlite-core";
+import { sql } from "drizzle-orm";
+import {
+	index,
+	integer,
+	sqliteTable,
+	text,
+	uniqueIndex,
+} from "drizzle-orm/sqlite-core";
 
 export const auth_user = sqliteTable("auth_user", {
 	id: text("id").primaryKey(),
@@ -27,6 +34,10 @@ export const auth_user = sqliteTable("auth_user", {
 		.$defaultFn(() => /* @__PURE__ */ new Date())
 		.$onUpdate(() => /* @__PURE__ */ new Date())
 		.notNull(),
+	disabled: integer("disabled", { mode: "boolean" }).default(false).notNull(),
+	lastSignInAt: integer("last_sign_in_at", { mode: "timestamp" })
+		.default(sql`0`)
+		.notNull(),
 });
 
 export const auth_session = sqliteTable(
@@ -104,4 +115,39 @@ export const auth_jwks = sqliteTable("auth_jwks", {
 	privateKey: text("private_key").notNull(),
 	createdAt: integer("created_at", { mode: "timestamp" }).notNull(),
 	expiresAt: integer("expires_at", { mode: "timestamp" }),
+	alg: text("alg"),
+	crv: text("crv"),
 });
+
+// Not better-auth tables: the self-host People operations own these
+// (packages/auth-service/src/people.ts). Times are epoch milliseconds.
+export const identity_audit_event = sqliteTable(
+	"identity_audit_event",
+	{
+		auditEventId: text("audit_event_id").primaryKey(),
+		occurredAt: integer("occurred_at", { mode: "timestamp_ms" }).notNull(),
+		actor: text("actor").notNull(),
+		target: text("target").notNull(),
+		action: text("action").notNull(),
+		outcome: text("outcome").notNull(),
+		clientIp: text("client_ip").notNull(),
+	},
+	(table) => [
+		index("identity_audit_event_occurred_at_idx").on(table.occurredAt),
+	],
+);
+
+export const identity_step_up = sqliteTable(
+	"identity_step_up",
+	{
+		digest: text("digest").notNull(),
+		callerUserId: text("caller_user_id").notNull(),
+		action: text("action").notNull(),
+		targetUserId: text("target_user_id").notNull(),
+		expiresAt: integer("expires_at", { mode: "timestamp_ms" }).notNull(),
+	},
+	(table) => [
+		uniqueIndex("identity_step_up_digest_idx").on(table.digest),
+		index("identity_step_up_caller_idx").on(table.callerUserId),
+	],
+);

package/src/signup.test.ts

@@ -2,6 +2,7 @@ import assert from "node:assert/strict";
 import { describe, it } from "node:test";
 import { createAuth } from "./auth.js";
 import { resolveSelfSignUpEnabled } from "./config.js";
+import { openIdentityStore } from "./identity-store.js";
 
 describe("resolveSelfSignUpEnabled", () => {
 	it("defaults to enabled when unset or blank", () => {
@@ -35,28 +36,11 @@ const baseConfig = {
 };
 
 describe("createAuth self-signup gate", () => {
-	it("flips better-auth disableSignUp from the selfSignUpEnabled flag", async () => {
-		const open = await createAuth({ ...baseConfig, selfSignUpEnabled: true });
-		const closed = await createAuth({
-			...baseConfig,
-			selfSignUpEnabled: false,
-		});
-		assert.equal(open.options.emailAndPassword?.disableSignUp, false);
-		assert.equal(closed.options.emailAndPassword?.disableSignUp, true);
-	});
-
-	it("drives the sqlite drizzle provider", async () => {
-		const auth = await createAuth({
-			connectionString: ":memory:",
-			secret: baseConfig.secret,
-			baseURL: baseConfig.baseURL,
-			selfSignUpEnabled: true,
-		});
-		assert.equal(auth.options.emailAndPassword?.disableSignUp, false);
-	});
-
 	it("rejects a signup request server-side when disabled, before any DB access", async () => {
-		const auth = await createAuth({ ...baseConfig, selfSignUpEnabled: false });
+		const auth = await createAuth(
+			{ ...baseConfig, selfSignUpEnabled: false, signInEnabled: true },
+			await openIdentityStore(baseConfig.connectionString),
+		);
 		const request = new Request(
 			"http://localhost:3000/api/auth/sign-up/email",
 			{

package/src/verifier.ts

@@ -10,6 +10,8 @@ export {
 	AUTH_BASE_PATH,
 	AUTH_JWKS_PATH,
 	AUTH_TOKEN_PATH,
+	resolveSelfSignUpEnabled,
+	resolveSignInEnabled,
 	resolveVerifierConfig,
 	type VerifierConfig,
 } from "./config.js";

package/src/schema/meta-schema-sqlite.ts

@@ -1,16 +0,0 @@
-// The instance-owner singleton, used to generate the committed SQLite
-// migrations (deploy/vps/migrations-sqlite/meta).
-import { sql } from "drizzle-orm";
-import { check, integer, sqliteTable, text } from "drizzle-orm/sqlite-core";
-
-export const instance_owner = sqliteTable(
-	"instance_owner",
-	{
-		id: integer("id").primaryKey().default(1),
-		userId: text("user_id").notNull(),
-		claimedAt: integer("claimed_at", { mode: "timestamp" })
-			.$defaultFn(() => /* @__PURE__ */ new Date())
-			.notNull(),
-	},
-	(table) => [check("instance_owner_singleton", sql`${table.id} = 1`)],
-);