@sdods/db 0.2.0

package/dist/repos/auth.js

@@ -0,0 +1,258 @@
+import { createHash, randomBytes } from 'node:crypto';
+import { API_TOKEN_PREFIX, ROLES, isScope, scopesForRole, } from '@sdods/contracts/scopes';
+import { enc, nowIso, readBool, readJson, readTs } from '../col.js';
+import { newId } from '../ids.js';
+/** Seed the three built-in roles (idempotent). */
+export async function ensureRoles(db) {
+    const out = {};
+    for (const name of ROLES) {
+        const existing = await db
+            .selectFrom('roles')
+            .select(['id'])
+            .where('name', '=', name)
+            .executeTakeFirst();
+        if (existing) {
+            out[name] = existing.id;
+            continue;
+        }
+        const id = newId();
+        await db
+            .insertInto('roles')
+            .values({ id, name, permissions_json: enc.json(scopesForRole(name)), created_at: nowIso() })
+            .execute();
+        out[name] = id;
+    }
+    return out;
+}
+export async function createUser(db, driver, input) {
+    const roles = await ensureRoles(db);
+    const id = newId();
+    await db
+        .insertInto('users')
+        .values({
+        id,
+        username: input.username,
+        email: input.email ?? null,
+        password_hash: input.passwordHash,
+        role_id: roles[input.role],
+        active: enc.bool(driver, true),
+        auth_provider: input.authProvider ?? 'local',
+        external_id: input.externalId ?? null,
+        last_login_at: null,
+        created_at: nowIso(),
+        updated_at: nowIso(),
+    })
+        .execute();
+    return id;
+}
+export async function getUserByUsername(db, username) {
+    const row = await db
+        .selectFrom('users')
+        .innerJoin('roles', 'roles.id', 'users.role_id')
+        .selectAll('users')
+        .select('roles.name as role')
+        .where('users.username', '=', username)
+        .executeTakeFirst();
+    return row ? mapUser(row) : null;
+}
+export async function getUserById(db, id) {
+    const row = await db
+        .selectFrom('users')
+        .innerJoin('roles', 'roles.id', 'users.role_id')
+        .selectAll('users')
+        .select('roles.name as role')
+        .where('users.id', '=', id)
+        .executeTakeFirst();
+    return row ? mapUser(row) : null;
+}
+export async function listUsers(db) {
+    const rows = await db
+        .selectFrom('users')
+        .innerJoin('roles', 'roles.id', 'users.role_id')
+        .selectAll('users')
+        .select('roles.name as role')
+        .orderBy('users.username')
+        .execute();
+    return rows.map(mapUser);
+}
+export async function updateUser(db, driver, id, patch) {
+    const roles = patch.role ? await ensureRoles(db) : undefined;
+    await db
+        .updateTable('users')
+        .set({
+        ...(patch.passwordHash ? { password_hash: patch.passwordHash } : {}),
+        ...(roles && patch.role ? { role_id: roles[patch.role] } : {}),
+        ...(patch.active !== undefined ? { active: enc.bool(driver, patch.active) } : {}),
+        ...(patch.email !== undefined ? { email: patch.email } : {}),
+        ...(patch.lastLoginAt ? { last_login_at: patch.lastLoginAt } : {}),
+        updated_at: nowIso(),
+    })
+        .where('id', '=', id)
+        .execute();
+}
+export async function countUsers(db) {
+    const r = await db
+        .selectFrom('users')
+        .select((eb) => eb.fn.countAll().as('n'))
+        .executeTakeFirst();
+    return Number(r?.n ?? 0);
+}
+function mapUser(row) {
+    return {
+        id: row.id,
+        username: row.username,
+        email: row.email,
+        passwordHash: row.password_hash,
+        role: row.role,
+        active: readBool(row.active),
+        authProvider: row.auth_provider,
+        lastLoginAt: readTs(row.last_login_at),
+        createdAt: readTs(row.created_at),
+    };
+}
+// ── sessions ──────────────────────────────────────────────────────────────
+export function hashToken(token) {
+    return createHash('sha256').update(token).digest('hex');
+}
+export async function createSession(db, input) {
+    const token = randomBytes(32).toString('base64url');
+    const csrf = randomBytes(24).toString('base64url');
+    const now = nowIso();
+    await db
+        .insertInto('sessions')
+        .values({
+        id: hashToken(token),
+        user_id: input.userId,
+        csrf_token: csrf,
+        ip: input.ip ?? null,
+        user_agent: input.userAgent ?? null,
+        created_at: now,
+        expires_at: new Date(Date.now() + input.ttlMs).toISOString(),
+        last_seen_at: now,
+    })
+        .execute();
+    return { token, csrfToken: csrf };
+}
+export async function getSession(db, token) {
+    const row = await db
+        .selectFrom('sessions')
+        .selectAll()
+        .where('id', '=', hashToken(token))
+        .executeTakeFirst();
+    if (!row)
+        return null;
+    if (new Date(String(row.expires_at)).getTime() < Date.now())
+        return null;
+    return {
+        id: row.id,
+        userId: row.user_id,
+        csrfToken: row.csrf_token,
+        expiresAt: readTs(row.expires_at),
+        lastSeenAt: readTs(row.last_seen_at),
+    };
+}
+export async function touchSession(db, token, ttlMs) {
+    await db
+        .updateTable('sessions')
+        .set({ last_seen_at: nowIso(), expires_at: new Date(Date.now() + ttlMs).toISOString() })
+        .where('id', '=', hashToken(token))
+        .execute();
+}
+export async function deleteSession(db, token) {
+    await db.deleteFrom('sessions').where('id', '=', hashToken(token)).execute();
+}
+export async function purgeExpiredSessions(db) {
+    await db.deleteFrom('sessions').where('expires_at', '<', nowIso()).execute();
+}
+// ── api tokens (free, scoped) ─────────────────────────────────────────────
+export async function createApiToken(db, input) {
+    const allowed = new Set(scopesForRole(input.ownerRole));
+    const scopes = input.scopes.filter((s) => isScope(s));
+    const denied = scopes.filter((s) => !allowed.has(s));
+    if (denied.length)
+        throw new Error(`Scopes exceed the owner's role: ${denied.join(', ')}`);
+    const token = API_TOKEN_PREFIX +
+        randomBytes(32)
+            .toString('base64url')
+            .replace(/[^A-Za-z0-9]/g, '')
+            .slice(0, 40);
+    const id = newId();
+    await db
+        .insertInto('api_tokens')
+        .values({
+        id,
+        user_id: input.userId,
+        name: input.name,
+        token_prefix: token.slice(0, 12),
+        hash: hashToken(token),
+        scopes_json: enc.json(scopes),
+        expires_at: input.expiresInDays
+            ? new Date(Date.now() + input.expiresInDays * 86_400_000).toISOString()
+            : null,
+        last_used_at: null,
+        revoked_at: null,
+        created_at: nowIso(),
+    })
+        .execute();
+    return { token, id, prefix: token.slice(0, 12), scopes };
+}
+/** Resolve a bearer token to its owner and effective scopes (intersection with the owner's current role). */
+export async function resolveApiToken(db, token) {
+    if (!token.startsWith(API_TOKEN_PREFIX))
+        return null;
+    const row = await db
+        .selectFrom('api_tokens')
+        .selectAll()
+        .where('hash', '=', hashToken(token))
+        .executeTakeFirst();
+    if (!row || row.revoked_at)
+        return null;
+    if (row.expires_at && new Date(String(row.expires_at)).getTime() < Date.now())
+        return null;
+    const user = await getUserById(db, row.user_id);
+    if (!user || !user.active)
+        return null;
+    const roleScopes = new Set(scopesForRole(user.role));
+    const scopes = (readJson(row.scopes_json) ?? []).filter((s) => isScope(s) && roleScopes.has(s));
+    const last = readTs(row.last_used_at);
+    if (!last || Date.now() - new Date(last).getTime() > 5 * 60_000) {
+        await db
+            .updateTable('api_tokens')
+            .set({ last_used_at: nowIso() })
+            .where('id', '=', row.id)
+            .execute();
+    }
+    return { tokenId: row.id, userId: user.id, username: user.username, role: user.role, scopes };
+}
+export async function listApiTokens(db, userId) {
+    let q = db
+        .selectFrom('api_tokens')
+        .innerJoin('users', 'users.id', 'api_tokens.user_id')
+        .selectAll('api_tokens')
+        .select('users.username as username')
+        .orderBy('api_tokens.created_at', 'desc');
+    if (userId)
+        q = q.where('api_tokens.user_id', '=', userId);
+    const rows = await q.execute();
+    return rows.map((r) => ({
+        id: r.id,
+        userId: r.user_id,
+        username: r.username,
+        name: r.name,
+        prefix: r.token_prefix,
+        scopes: readJson(r.scopes_json) ?? [],
+        expiresAt: readTs(r.expires_at),
+        lastUsedAt: readTs(r.last_used_at),
+        revokedAt: readTs(r.revoked_at),
+        createdAt: readTs(r.created_at),
+    }));
+}
+export async function revokeApiToken(db, id) {
+    await db
+        .updateTable('api_tokens')
+        .set({ revoked_at: nowIso() })
+        .where('id', '=', id)
+        .where('revoked_at', 'is', null)
+        .execute();
+}
+//# sourceMappingURL=auth.js.map

package/dist/repos/hierarchy.d.ts

@@ -0,0 +1,151 @@
+import type { Kysely } from 'kysely';
+import type { ModuleConfig, ProcessConfig, ProjectConfig, WorkspaceFile } from '@sdods/contracts/schemas';
+import { type OrgRole, type Role, type WorkspaceRole } from '@sdods/contracts/scopes';
+import type { Driver } from '../driver.js';
+import type { Database } from '../schema.js';
+export declare function upsertOrganization(db: Kysely<Database>, input: {
+    slug: string;
+    name: string;
+    description?: string | null;
+    url?: string | null;
+}): Promise<string>;
+export declare function upsertWorkspace(db: Kysely<Database>, input: {
+    organizationId: string;
+    slug: string;
+    name: string;
+    description?: string | null;
+}): Promise<string>;
+export declare function listOrganizations(db: Kysely<Database>): Promise<{
+    id: string;
+    slug: string;
+    name: string;
+    description: string | null;
+    url: string | null;
+    createdAt: string | null;
+}[]>;
+export declare function listWorkspaces(db: Kysely<Database>, organizationId?: string): Promise<{
+    id: string;
+    organizationId: string;
+    organizationSlug: string;
+    slug: string;
+    name: string;
+    description: string | null;
+    createdAt: string | null;
+}[]>;
+export declare function getWorkspaceBySlug(db: Kysely<Database>, orgSlug: string, slug: string): Promise<{
+    id: string;
+    organizationId: string;
+    organizationSlug: string;
+    slug: string;
+    name: string;
+    description: string | null;
+    createdAt: string | null;
+} | null>;
+export declare function addOrgMember(db: Kysely<Database>, organizationId: string, userId: string, role: OrgRole): Promise<void>;
+export declare function removeOrgMember(db: Kysely<Database>, organizationId: string, userId: string): Promise<void>;
+export declare function addWorkspaceMember(db: Kysely<Database>, workspaceId: string, userId: string, role: WorkspaceRole): Promise<void>;
+export declare function removeWorkspaceMember(db: Kysely<Database>, workspaceId: string, userId: string): Promise<void>;
+/** `setRole` for either level. */
+export declare function setRole(db: Kysely<Database>, target: {
+    organizationId: string;
+    userId: string;
+    role: OrgRole;
+} | {
+    workspaceId: string;
+    userId: string;
+    role: WorkspaceRole;
+}): Promise<void>;
+export declare function listOrgMembers(db: Kysely<Database>, organizationId: string): Promise<{
+    id: string;
+    userId: string;
+    username: string;
+    role: OrgRole;
+    createdAt: string | null;
+}[]>;
+export declare function listWorkspaceMembers(db: Kysely<Database>, workspaceId: string): Promise<{
+    id: string;
+    userId: string;
+    username: string;
+    role: WorkspaceRole;
+    createdAt: string | null;
+}[]>;
+export declare function listUserOrgs(db: Kysely<Database>, userId: string): Promise<{
+    id: string;
+    slug: string;
+    name: string;
+    role: OrgRole;
+}[]>;
+/**
+ * Every workspace the user can see with the effective role (max of explicit workspace role and the
+ * role implied by org membership; platform admins see everything as admin).
+ */
+export declare function listUserWorkspaces(db: Kysely<Database>, userId: string, platformRole?: Role): Promise<({
+    id: string;
+    organizationId: string;
+    organizationSlug: string;
+    slug: string;
+    name: string;
+    description: string | null;
+    createdAt: string | null;
+} & {
+    role: WorkspaceRole;
+})[]>;
+export declare function effectiveRoleForWorkspace(db: Kysely<Database>, userId: string, workspaceId: string, platformRole?: Role): Promise<WorkspaceRole | null>;
+/** Grant `owner` on every organization that has no owner yet (admin bootstrap). */
+export declare function bootstrapOwner(db: Kysely<Database>, userId: string): Promise<string[]>;
+export declare function upsertModule(db: Kysely<Database>, projectId: string, m: ModuleConfig): Promise<string>;
+export declare function listModules(db: Kysely<Database>, projectId: string): Promise<{
+    id: string;
+    name: string;
+    title: string | null;
+    description: string | null;
+    path: string | null;
+    layers: string[];
+    testingTypes: string[];
+    tags: string[];
+    owner: string | null;
+    jiraComponent: string | null;
+    routes: string[];
+    endpoints: string[];
+}[]>;
+export declare function upsertProcess(db: Kysely<Database>, driver: Driver, scope: {
+    projectId?: string | null;
+    workspaceId?: string | null;
+}, p: ProcessConfig): Promise<string>;
+export declare function listProcesses(db: Kysely<Database>, scope?: {
+    projectId?: string;
+    workspaceId?: string;
+}): Promise<{
+    id: string;
+    projectId: string | null;
+    workspaceId: string | null;
+    name: string;
+    title: string | null;
+    description: string | null;
+    trigger: string;
+    config: Record<string, unknown>;
+    enabled: boolean;
+    lastRunId: string | null;
+    lastStatus: string | null;
+}[]>;
+export declare function updateProcessState(db: Kysely<Database>, id: string, patch: {
+    lastRunId?: string | null;
+    lastStatus?: string | null;
+}): Promise<void>;
+export interface SyncHierarchyInput {
+    workspaceFile?: WorkspaceFile | null;
+    projects: Array<{
+        config: ProjectConfig;
+        root?: string;
+    }>;
+}
+export interface SyncHierarchyResult {
+    organizationId: string | null;
+    workspaces: Record<string, string>;
+    projects: Record<string, string>;
+    modules: number;
+    processes: number;
+}
+/** Upsert organization → workspaces → projects → modules/processes from the yaml files. */
+export declare function syncHierarchy(db: Kysely<Database>, driver: Driver, input: SyncHierarchyInput): Promise<SyncHierarchyResult>;
+//# sourceMappingURL=hierarchy.d.ts.map