@riffdb/better-auth 0.0.0-stage → 0.2.1

package/riffdb/contract.riff

@@ -0,0 +1,547 @@
+contract RiffDBBetterAuthCore version 1 {
+  entity User {
+    key (organization_id: uuid, user_id: uuid)
+    field name: string<256>
+    field email: string<320>
+    field email_verified: bool
+    field image: optional<string<2048>>
+    field created_at: timestamp
+    field updated_at: timestamp
+    field revision: u64
+    unique user_email (organization_id, email)
+    index by_email (organization_id, email, user_id) cover(name, email_verified, image, created_at, updated_at, revision)
+    index search_email (organization_id, email, user_id) text_key(email, binary_utf8_v1) cover(name, email_verified, image, created_at, updated_at, revision)
+    index by_created_at (organization_id, created_at, user_id) cover(name, email, email_verified, image, updated_at, revision)
+    index by_image (organization_id, image, user_id) presence(image) cover(name, email, email_verified, created_at, updated_at, revision)
+    delete_policy cascade {
+      relationship Account.account_user using Account.by_user maximum 32
+      relationship Session.session_user using Session.by_user maximum 32
+    }
+  }
+
+  entity Account {
+    key (organization_id: uuid, user_id: uuid, id: uuid)
+    field account_id: string<256>
+    field provider_id: string<64>
+    field secret access_token: optional<string<4096>>
+    field secret refresh_token: optional<string<4096>>
+    field access_token_expires_at: optional<timestamp>
+    field refresh_token_expires_at: optional<timestamp>
+    field scope: optional<string<2048>>
+    field secret id_token: optional<string<8192>>
+    field secret password: optional<string<1024>>
+    field created_at: timestamp
+    field updated_at: timestamp
+    field revision: u64
+    unique account_row_id (organization_id, id)
+    unique provider_identity (organization_id, provider_id, account_id)
+    index by_id (organization_id, id, user_id)
+    index by_provider (organization_id, provider_id, account_id, user_id, id)
+    index by_user (organization_id, user_id, id)
+    index by_user_provider (organization_id, user_id, provider_id, id)
+    reference account_user (organization_id, user_id) -> User(organization_id, user_id)
+    delete_policy no_inbound
+  }
+
+  entity Session {
+    key (organization_id: uuid, user_id: uuid, id: uuid)
+    field secret token: string<512>
+    field expires_at: timestamp
+    field ip_address: optional<string<128>>
+    field user_agent: optional<string<2048>>
+    field created_at: timestamp
+    field updated_at: timestamp
+    field revision: u64
+    unique session_token (organization_id, token)
+    unique session_id (organization_id, id)
+    index by_token (organization_id, token, user_id, id)
+    index by_id (organization_id, id, user_id)
+    index by_user (organization_id, user_id, id)
+    index by_user_expiry (organization_id, user_id, expires_at, id)
+    reference session_user (organization_id, user_id) -> User(organization_id, user_id)
+    delete_policy no_inbound
+  }
+
+  entity Verification {
+    key (organization_id: uuid, verification_id: uuid)
+    field identifier: string<1024>
+    field secret value: string<4096>
+    field expires_at: timestamp
+    field created_at: timestamp
+    field updated_at: timestamp
+    field revision: u64
+    index by_identifier_created (organization_id, identifier, created_at, verification_id)
+    index by_expiry (organization_id, expires_at, verification_id)
+    delete_policy no_inbound
+  }
+
+  entity AccountPasswordUpdate {
+    key (organization_id: uuid, user_id: uuid, account_id: uuid)
+    field provider_id: string<64>
+    field secret password: optional<string<1024>>
+    field updated_at: timestamp
+    field expected_revision: u64
+  }
+
+  aggregate UserAuthData {
+    root User
+    child Account
+    child Session
+    child AccountPasswordUpdate
+    partition_by organization_id
+    conflict_key (organization_id, user_id)
+  }
+
+  aggregate VerificationData {
+    root Verification
+    partition_by organization_id
+    conflict_key (organization_id, verification_id)
+  }
+
+  command CreateUser {
+    input request_id: uuid
+    input organization_id: uuid
+    input id: uuid
+    input name: string<256>
+    input email: string<320>
+    input email_verified: bool
+    input image: optional<string<2048>>
+    input created_at: timestamp
+    input updated_at: timestamp
+    idempotency_key request_id
+    create User(organization_id, id) as user else UserAlreadyExists {}
+    set user.name = name
+    set user.email = email
+    set user.email_verified = email_verified
+    set user.image = image
+    set user.created_at = created_at
+    set user.updated_at = updated_at
+    set user.revision = 1
+    return UserCreated {}
+  }
+
+  command CreateAccount {
+    input request_id: uuid
+    input organization_id: uuid
+    input user_id: uuid
+    input id: uuid
+    input account_id: string<256>
+    input provider_id: string<64>
+    input access_token: optional<string<4096>>
+    input refresh_token: optional<string<4096>>
+    input access_token_expires_at: optional<timestamp>
+    input refresh_token_expires_at: optional<timestamp>
+    input scope: optional<string<2048>>
+    input id_token: optional<string<8192>>
+    input password: optional<string<1024>>
+    input created_at: timestamp
+    input updated_at: timestamp
+    idempotency_key request_id
+    read User(organization_id, user_id) as owner else AccountUserMissing {}
+    create Account(organization_id, user_id, id) as account else AccountAlreadyExists {}
+    set account.account_id = account_id
+    set account.provider_id = provider_id
+    set account.access_token = access_token
+    set account.refresh_token = refresh_token
+    set account.access_token_expires_at = access_token_expires_at
+    set account.refresh_token_expires_at = refresh_token_expires_at
+    set account.scope = scope
+    set account.id_token = id_token
+    set account.password = password
+    set account.created_at = created_at
+    set account.updated_at = updated_at
+    set account.revision = 1
+    return AccountCreated {}
+  }
+
+  command CreateSession {
+    input request_id: uuid
+    input organization_id: uuid
+    input user_id: uuid
+    input id: uuid
+    input token: string<512>
+    input expires_at: timestamp
+    input ip_address: optional<string<128>>
+    input user_agent: optional<string<2048>>
+    input created_at: timestamp
+    input updated_at: timestamp
+    idempotency_key request_id
+    read User(organization_id, user_id) as owner else SessionUserMissing {}
+    create Session(organization_id, user_id, id) as session else SessionAlreadyExists {}
+    set session.token = token
+    set session.expires_at = expires_at
+    set session.ip_address = ip_address
+    set session.user_agent = user_agent
+    set session.created_at = created_at
+    set session.updated_at = updated_at
+    set session.revision = 1
+    return SessionCreated {}
+  }
+
+  command CreateVerification {
+    input request_id: uuid
+    input organization_id: uuid
+    input id: uuid
+    input identifier: string<1024>
+    input value: string<4096>
+    input expires_at: timestamp
+    input created_at: timestamp
+    input updated_at: timestamp
+    idempotency_key request_id
+    create Verification(organization_id, id) as verification else VerificationAlreadyExists {}
+    set verification.identifier = identifier
+    set verification.value = value
+    set verification.expires_at = expires_at
+    set verification.created_at = created_at
+    set verification.updated_at = updated_at
+    set verification.revision = 1
+    return VerificationCreated {}
+  }
+
+  command CreateSignupGraph {
+    input request_id: uuid
+    input organization_id: uuid
+    input user_id: uuid
+    input user_name: string<256>
+    input user_email: string<320>
+    input user_email_verified: bool
+    input user_image: optional<string<2048>>
+    input user_created_at: timestamp
+    input user_updated_at: timestamp
+    input account_id: uuid
+    input external_account_id: string<256>
+    input provider_id: string<64>
+    input account_password: optional<string<1024>>
+    input account_created_at: timestamp
+    input account_updated_at: timestamp
+    input session_id: uuid
+    input session_token: string<512>
+    input session_expires_at: timestamp
+    input session_ip_address: optional<string<128>>
+    input session_user_agent: optional<string<2048>>
+    input session_created_at: timestamp
+    input session_updated_at: timestamp
+    idempotency_key request_id
+    create User(organization_id, user_id) as user else SignupUserExists {}
+    create Account(organization_id, user_id, account_id) as account else SignupAccountExists {}
+    create Session(organization_id, user_id, session_id) as session else SignupSessionExists {}
+    set user.name = user_name
+    set user.email = user_email
+    set user.email_verified = user_email_verified
+    set user.image = user_image
+    set user.created_at = user_created_at
+    set user.updated_at = user_updated_at
+    set user.revision = 1
+    set account.account_id = external_account_id
+    set account.provider_id = provider_id
+    set account.access_token = null
+    set account.refresh_token = null
+    set account.access_token_expires_at = null
+    set account.refresh_token_expires_at = null
+    set account.scope = null
+    set account.id_token = null
+    set account.password = account_password
+    set account.created_at = account_created_at
+    set account.updated_at = account_updated_at
+    set account.revision = 1
+    set session.token = session_token
+    set session.expires_at = session_expires_at
+    set session.ip_address = session_ip_address
+    set session.user_agent = session_user_agent
+    set session.created_at = session_created_at
+    set session.updated_at = session_updated_at
+    set session.revision = 1
+    return SignupGraphCreated {}
+  }
+
+  command CreateOAuthUserGraph {
+    input request_id: uuid
+    input organization_id: uuid
+    input user_id: uuid
+    input user_name: string<256>
+    input user_email: string<320>
+    input user_email_verified: bool
+    input user_image: optional<string<2048>>
+    input user_created_at: timestamp
+    input user_updated_at: timestamp
+    input account_id: uuid
+    input external_account_id: string<256>
+    input provider_id: string<64>
+    input access_token: optional<string<4096>>
+    input refresh_token: optional<string<4096>>
+    input access_token_expires_at: optional<timestamp>
+    input refresh_token_expires_at: optional<timestamp>
+    input scope: optional<string<2048>>
+    input id_token: optional<string<8192>>
+    input password: optional<string<1024>>
+    input account_created_at: timestamp
+    input account_updated_at: timestamp
+    idempotency_key request_id
+    create User(organization_id, user_id) as user else OAuthUserExists {}
+    create Account(organization_id, user_id, account_id) as account else OAuthAccountExists {}
+    set user.name = user_name
+    set user.email = user_email
+    set user.email_verified = user_email_verified
+    set user.image = user_image
+    set user.created_at = user_created_at
+    set user.updated_at = user_updated_at
+    set user.revision = 1
+    set account.account_id = external_account_id
+    set account.provider_id = provider_id
+    set account.access_token = access_token
+    set account.refresh_token = refresh_token
+    set account.access_token_expires_at = access_token_expires_at
+    set account.refresh_token_expires_at = refresh_token_expires_at
+    set account.scope = scope
+    set account.id_token = id_token
+    set account.password = password
+    set account.created_at = account_created_at
+    set account.updated_at = account_updated_at
+    set account.revision = 1
+    return OAuthUserGraphCreated {}
+  }
+
+  command UpdateUser {
+    input request_id: uuid
+    input organization_id: uuid
+    input user_id: uuid
+    input expected_revision: u64
+    input name: string<256>
+    input email: string<320>
+    input email_verified: bool
+    input image: optional<string<2048>>
+    input updated_at: timestamp
+    idempotency_key request_id
+    mutate User(organization_id, user_id) as user else UserUpdateMissing {}
+    require current_revision: user.revision == expected_revision else UserUpdateStale {}
+    set user.name = name
+    set user.email = email
+    set user.email_verified = email_verified
+    set user.image = image
+    set user.updated_at = updated_at
+    set user.revision = user.revision + 1
+    return UserUpdated {}
+  }
+
+  command UpdateSession {
+    input request_id: uuid
+    input organization_id: uuid
+    input user_id: uuid
+    input session_id: uuid
+    input expected_revision: u64
+    input expires_at: timestamp
+    input ip_address: optional<string<128>>
+    input user_agent: optional<string<2048>>
+    input updated_at: timestamp
+    idempotency_key request_id
+    mutate Session(organization_id, user_id, session_id) as session else SessionUpdateMissing {}
+    require current_revision: session.revision == expected_revision else SessionUpdateStale {}
+    set session.expires_at = expires_at checked_by current_revision
+    set session.ip_address = ip_address checked_by current_revision
+    set session.user_agent = user_agent checked_by current_revision
+    set session.updated_at = updated_at checked_by current_revision
+    set session.revision = session.revision + 1
+    return SessionUpdated {}
+  }
+
+  command UpdateAccount {
+    input request_id: uuid
+    input organization_id: uuid
+    input user_id: uuid
+    input account_id: uuid
+    input expected_revision: u64
+    input external_account_id: string<256>
+    input provider_id: string<64>
+    input access_token: optional<string<4096>>
+    input refresh_token: optional<string<4096>>
+    input access_token_expires_at: optional<timestamp>
+    input refresh_token_expires_at: optional<timestamp>
+    input scope: optional<string<2048>>
+    input id_token: optional<string<8192>>
+    input password: optional<string<1024>>
+    input updated_at: timestamp
+    idempotency_key request_id
+    mutate Account(organization_id, user_id, account_id) as account else AccountUpdateMissing {}
+    require current_revision: account.revision == expected_revision else AccountUpdateStale {}
+    set account.account_id = external_account_id checked_by current_revision
+    set account.provider_id = provider_id checked_by current_revision
+    set account.access_token = access_token checked_by current_revision
+    set account.refresh_token = refresh_token checked_by current_revision
+    set account.access_token_expires_at = access_token_expires_at checked_by current_revision
+    set account.refresh_token_expires_at = refresh_token_expires_at checked_by current_revision
+    set account.scope = scope checked_by current_revision
+    set account.id_token = id_token checked_by current_revision
+    set account.password = password checked_by current_revision
+    set account.updated_at = updated_at checked_by current_revision
+    set account.revision = account.revision + 1
+    return AccountUpdated {}
+  }
+
+  command UpdateVerification {
+    input request_id: uuid
+    input organization_id: uuid
+    input verification_id: uuid
+    input expected_revision: u64
+    input value: string<4096>
+    input expires_at: timestamp
+    input updated_at: timestamp
+    idempotency_key request_id
+    mutate Verification(organization_id, verification_id) as verification else VerificationUpdateMissing {}
+    require current_revision: verification.revision == expected_revision else VerificationUpdateStale {}
+    set verification.value = value
+    set verification.expires_at = expires_at
+    set verification.updated_at = updated_at
+    set verification.revision = verification.revision + 1
+    return VerificationUpdated {}
+  }
+
+  bulk command DeleteSession {
+    input request_id: uuid
+    input organization_id: uuid
+    input user_id: uuid
+    input session_ids: list<uuid, 1..32>
+    idempotency_key request_id
+    for session_id in session_ids {
+      delete Session(organization_id, user_id, session_id) as session else SessionMissing {}
+    }
+    return SessionDeleted {}
+  }
+
+  bulk command DeleteAccount {
+    input request_id: uuid
+    input organization_id: uuid
+    input user_id: uuid
+    input account_ids: list<uuid, 1..32>
+    idempotency_key request_id
+    for account_id in account_ids {
+      delete Account(organization_id, user_id, account_id) as account else AccountMissing {}
+    }
+    return AccountDeleted {}
+  }
+
+  bulk command DeleteVerification {
+    input request_id: uuid
+    input organization_id: uuid
+    input verification_ids: list<uuid, 1..32>
+    idempotency_key request_id
+    for verification_id in verification_ids {
+      delete Verification(organization_id, verification_id) as verification else VerificationMissing {}
+    }
+    return VerificationDeleted {}
+  }
+
+  bulk command DeleteUser {
+    input request_id: uuid
+    input organization_id: uuid
+    input user_ids: list<uuid, 1..1>
+    idempotency_key request_id
+    for user_id in user_ids {
+      delete User(organization_id, user_id) as user else DeleteUserMissing {}
+        cascade DeleteUserCascadeLimitExceeded {}
+    }
+    return UserDeleted {}
+  }
+
+  bulk command ConsumeVerificationSet {
+    input request_id: uuid
+    input organization_id: uuid
+    input verification_ids: list<uuid, 1..32>
+    idempotency_key request_id
+    for verification_id in verification_ids {
+      delete Verification(organization_id, verification_id) as verification else VerificationConsumeMissing {}
+    }
+    return VerificationSetConsumed {}
+  }
+
+  command ConsumeVerification {
+    input request_id: uuid
+    input organization_id: uuid
+    input verification_id: uuid
+    idempotency_key request_id
+    delete Verification(organization_id, verification_id) as verification else VerificationConsumeMissing {}
+    return VerificationConsumed {
+      verification_id: verification.verification_id,
+      identifier: verification.identifier,
+      value: verification.value reveals verification.value,
+      expires_at: verification.expires_at,
+      created_at: verification.created_at,
+      updated_at: verification.updated_at,
+      revision: verification.revision
+    }
+  }
+
+  bulk command UpdateAccountPasswords {
+    input request_id: uuid
+    input organization_id: uuid
+    input user_id: uuid
+    input updates: list<AccountPasswordUpdate, 1..8>
+    idempotency_key request_id
+    for update in updates {
+      mutate Account(organization_id, user_id, update.account_id) as account else PasswordAccountMissing {}
+      require provider_matches: account.provider_id == update.provider_id else PasswordProviderMismatch {}
+      require current_revision: account.revision == update.expected_revision else PasswordAccountStale {}
+      set account.password = update.password checked_by current_revision
+      set account.updated_at = update.updated_at checked_by current_revision
+      set account.revision = account.revision + 1
+    }
+    return AccountPasswordsUpdated {}
+  }
+
+  command ConsumeVerificationSnapshot {
+    input request_id: uuid
+    input organization_id: uuid
+    input verification_id: uuid
+    input expected_revision: u64
+    idempotency_key request_id
+    delete Verification(organization_id, verification_id) as verification else VerificationConsumeMissing {}
+    require snapshot: verification.revision == expected_revision else VerificationConsumeStale {}
+    return VerificationConsumed {}
+  }
+
+  bulk command ResetCredentialPassword {
+    input request_id: uuid
+    input organization_id: uuid
+    input verification_ids: list<uuid, 1..1>
+    input verification_revision: u64
+    input user_id: uuid
+    input external_account_id: string<256>
+    input account_id: uuid
+    input account_revision: u64
+    input password: string<1024>
+    input updated_at: timestamp
+    idempotency_key request_id
+    mutate Account(organization_id, user_id, account_id) as account else PasswordAccountMissing {}
+    for verification_id in verification_ids {
+      delete Verification(organization_id, verification_id) as verification else VerificationConsumeMissing {}
+      require verification_snapshot: verification.revision == verification_revision else VerificationConsumeStale {}
+    }
+    require credential_provider: account.provider_id == "credential" else PasswordProviderMismatch {}
+    require credential_identity: account.account_id == external_account_id else PasswordProviderMismatch {}
+    require account_snapshot: account.revision == account_revision else PasswordAccountStale {}
+    set account.password = password checked_by account_snapshot
+    set account.updated_at = updated_at checked_by account_snapshot
+    set account.revision = account.revision + 1
+    return CredentialPasswordReset {}
+  }
+
+  command UpdateCredentialPassword {
+    input request_id: uuid
+    input organization_id: uuid
+    input user_id: uuid
+    input account_id: uuid
+    input external_account_id: string<256>
+    input expected_revision: u64
+    input password: string<1024>
+    input updated_at: timestamp
+    idempotency_key request_id
+    mutate Account(organization_id, user_id, account_id) as account else PasswordAccountMissing {}
+    require credential_provider: account.provider_id == "credential" else PasswordProviderMismatch {}
+    require credential_identity: account.account_id == external_account_id else PasswordProviderMismatch {}
+    require account_snapshot: account.revision == expected_revision else PasswordAccountStale {}
+    set account.password = password checked_by account_snapshot
+    set account.updated_at = updated_at checked_by account_snapshot
+    set account.revision = account.revision + 1
+    return CredentialPasswordUpdated {}
+  }
+
+}

package/riffdb/queries/admin_users_all_email_asc.riffq

@@ -0,0 +1,24 @@
+query AdminUsersAllEmailAsc(
+    $organization_id: User.organization_id,
+    $minimum_email: User.email,
+    $user_id: User.user_id?,
+    $limit: Limit<100> = 50,
+    $offset: u64 = 0
+) {
+    many users from User
+        where organization_id == $organization_id
+          && email >= $minimum_email
+          && when $user_id { user_id == $user_id }
+        order by email asc, user_id asc
+        take $limit offset $offset
+
+    aggregate total from users { exact_count() as value }
+
+    return Found {
+        users: users {
+            organization_id user_id name email email_verified image created_at updated_at revision
+        }
+        total: total { value }
+    }
+    outcomes Found
+}

package/riffdb/queries/admin_users_contains_asc.riffq

@@ -0,0 +1,24 @@
+query AdminUsersContainsAsc(
+    $organization_id: User.organization_id,
+    $needle: User.email,
+    $user_id: User.user_id?,
+    $limit: Limit<100> = 50,
+    $offset: u64 = 0
+) {
+    many users from User
+        where organization_id == $organization_id
+          && when $user_id { user_id == $user_id }
+          && email contains $needle
+        order by email asc, user_id asc
+        take $limit offset $offset
+
+    aggregate total from users { exact_count() as value }
+
+    return Found {
+        users: users {
+            organization_id user_id name email email_verified image created_at updated_at revision
+        }
+        total: total { value }
+    }
+    outcomes Found
+}

package/riffdb/queries/admin_users_contains_desc.riffq

@@ -0,0 +1,24 @@
+query AdminUsersContainsDesc(
+    $organization_id: User.organization_id,
+    $needle: User.email,
+    $user_id: User.user_id?,
+    $limit: Limit<100> = 50,
+    $offset: u64 = 0
+) {
+    many users from User
+        where organization_id == $organization_id
+          && when $user_id { user_id == $user_id }
+          && email contains $needle
+        order by email desc, user_id asc
+        take $limit offset $offset
+
+    aggregate total from users { exact_count() as value }
+
+    return Found {
+        users: users {
+            organization_id user_id name email email_verified image created_at updated_at revision
+        }
+        total: total { value }
+    }
+    outcomes Found
+}

package/riffdb/queries/admin_users_email_contains_created_desc.riffq

@@ -0,0 +1,24 @@
+query AdminUsersEmailContainsCreatedDesc(
+    $organization_id: User.organization_id,
+    $needle: User.email,
+    $user_id: User.user_id?,
+    $limit: Limit<100> = 50,
+    $offset: u64 = 0
+) {
+    many users from User
+        where organization_id == $organization_id
+          && when $user_id { user_id == $user_id }
+          && email contains $needle
+        order by created_at desc, user_id asc
+        take $limit offset $offset
+
+    aggregate total from users { exact_count() as value }
+
+    return Found {
+        users: users {
+            organization_id user_id name email email_verified image created_at updated_at revision
+        }
+        total: total { value }
+    }
+    outcomes Found
+}

package/riffdb/queries/admin_users_email_contains_image_asc.riffq

@@ -0,0 +1,24 @@
+query AdminUsersEmailContainsImageAsc(
+    $organization_id: User.organization_id,
+    $needle: User.email,
+    $user_id: User.user_id?,
+    $limit: Limit<100> = 50,
+    $offset: u64 = 0
+) {
+    many users from User
+        where organization_id == $organization_id
+          && when $user_id { user_id == $user_id }
+          && email contains $needle
+        order by image asc nulls last, user_id asc
+        take $limit offset $offset
+
+    aggregate total from users { exact_count() as value }
+
+    return Found {
+        users: users {
+            organization_id user_id name email email_verified image created_at updated_at revision
+        }
+        total: total { value }
+    }
+    outcomes Found
+}

package/riffdb/queries/admin_users_ends_with_asc.riffq

@@ -0,0 +1,24 @@
+query AdminUsersEndsWithAsc(
+    $organization_id: User.organization_id,
+    $needle: User.email,
+    $user_id: User.user_id?,
+    $limit: Limit<100> = 50,
+    $offset: u64 = 0
+) {
+    many users from User
+        where organization_id == $organization_id
+          && when $user_id { user_id == $user_id }
+          && email ends_with $needle
+        order by email asc, user_id asc
+        take $limit offset $offset
+
+    aggregate total from users { exact_count() as value }
+
+    return Found {
+        users: users {
+            organization_id user_id name email email_verified image created_at updated_at revision
+        }
+        total: total { value }
+    }
+    outcomes Found
+}