@sixb/core 0.1.12 → 0.1.14

package/src/storage/auth/types.ts

@@ -1,10 +1,11 @@
 import type { AccessTokenKind, AuthSessionAudience, Principal } from "../../auth"
+import type { AuthorizablePrincipal } from "../../execution/types"
 
 export type UserStatus = "active" | "suspended"
 export type ServiceAccountStatus = "active" | "suspended"
 export type InvitationStatus = "pending" | "accepted" | "revoked"
-export type GroupMembershipSource = "invitation" | "manual" | "agent"
-export type AccessTokenSubjectType = "user" | "serviceAccount"
+/** `directory`: owned by the identity provider, and synced to its groups on every sign-in. */
+export type GroupMembershipSource = "invitation" | "manual" | "agent" | "directory"
 export type DeviceAuthorizationStatus = "pending" | "approved" | "denied" | "consumed"
 export const MAX_PENDING_DEVICE_AUTHORIZATIONS = 100
 
@@ -45,7 +46,8 @@ export interface ServiceAccountGroupMembershipRecord {
   readonly projectId: string
   readonly serviceAccountId: string
   readonly groupId: string
-  readonly source: GroupMembershipSource
+  /** Service accounts never sign in, so no identity provider owns their memberships. */
+  readonly source: Exclude<GroupMembershipSource, "directory">
   readonly createdAt: Date
 }
 
@@ -54,6 +56,7 @@ export interface SessionRecord {
   readonly projectId: string
   readonly userId: string
   readonly strategyId: string
+  /** The web app a browser session belongs to. A bearer session belongs to none and ignores it. */
   readonly audience: AuthSessionAudience
   readonly tokenHash: string
   readonly createdAt: Date
@@ -65,15 +68,36 @@ export interface SessionRecord {
   // view. Display only — never used for authorization.
   readonly userAgent?: string
   readonly ipAddress?: string
+  /** Present when a native client holds the session as bearer tokens instead of a cookie. */
+  readonly bearer?: BearerSessionState
+}
+
+/**
+ * A native client's credentials for its session. `tokenHash` on the session is the current access
+ * token's hash; the refresh token rotates on every refresh.
+ */
+export interface BearerSessionState {
+  /** Self-reported client label, such as "sixb CLI on alex-mbp". Display only. */
+  readonly clientName: string
+  readonly accessExpiresAt: Date
+  readonly refreshTokenHash: string
+  /** The refresh token the last rotation replaced, accepted briefly in case its response was lost. */
+  readonly previousRefreshTokenHash?: string
+  readonly refreshedAt?: Date
 }
 
+export type RotateSessionRefreshTokenResult =
+  | { readonly status: "rotated"; readonly session: SessionRecord }
+  /** A replaced refresh token came back after the grace window; the session is now revoked. */
+  | { readonly status: "reused" }
+  | { readonly status: "invalid" }
+
 export interface AccessTokenRecord {
   readonly id: string
   readonly projectId: string
   readonly name: string
   readonly kind: AccessTokenKind
-  readonly subjectType: AccessTokenSubjectType
-  readonly subjectId: string
+  readonly subject: AuthorizablePrincipal
   readonly tokenHash: string
   /**
    * Optional group constraint. Undefined means "inherit every current group";
@@ -148,8 +172,6 @@ export interface DeviceAuthorizationRecord {
   readonly deviceCodeHash: string
   readonly userCode: string
   readonly clientName: string
-  readonly tokenName: string
-  readonly tokenExpiresAt: Date
   readonly status: DeviceAuthorizationStatus
   readonly approvedUserId?: string
   readonly approvedSessionId?: string
@@ -249,7 +271,7 @@ export interface UpsertAuthServiceAccountGroupMembershipInput {
   readonly projectId: string
   readonly serviceAccountId: string
   readonly groupId: string
-  readonly source: GroupMembershipSource
+  readonly source: ServiceAccountGroupMembershipRecord["source"]
   readonly createdAt?: Date
 }
 
@@ -273,6 +295,7 @@ export interface CreateAuthSessionInput {
   readonly absoluteExpiresAt?: Date
   readonly userAgent?: string
   readonly ipAddress?: string
+  readonly bearer?: Pick<BearerSessionState, "clientName" | "accessExpiresAt" | "refreshTokenHash">
 }
 
 export interface CreateAuthAccessTokenInput {
@@ -280,8 +303,7 @@ export interface CreateAuthAccessTokenInput {
   readonly projectId: string
   readonly name: string
   readonly kind: AccessTokenKind
-  readonly subjectType: AccessTokenSubjectType
-  readonly subjectId: string
+  readonly subject: AuthorizablePrincipal
   readonly tokenHash: string
   readonly groupIds?: readonly string[]
   readonly createdByPrincipal?: Principal
@@ -293,8 +315,7 @@ export interface CreateAuthAccessTokenInput {
 export interface ListAuthAccessTokensInput {
   readonly projectId: string
   readonly kind?: AccessTokenKind
-  readonly subjectType?: AccessTokenSubjectType
-  readonly subjectId?: string
+  readonly subject?: AuthorizablePrincipal
   readonly includeRevoked?: boolean
   readonly limit?: number
   readonly offset?: number
@@ -385,8 +406,6 @@ export interface CreateDeviceAuthorizationInput {
   readonly deviceCodeHash: string
   readonly userCode: string
   readonly clientName: string
-  readonly tokenName: string
-  readonly tokenExpiresAt: Date
   readonly createdAt: Date
   readonly expiresAt: Date
 }
@@ -395,13 +414,14 @@ export interface CompleteDeviceAuthorizationInput {
   readonly projectId: string
   readonly id: string
   readonly deviceCodeHash: string
-  readonly accessToken: CreateAuthAccessTokenInput
+  /** The bearer session to start for the approving user. */
+  readonly session: CreateAuthSessionInput & { readonly bearer: BearerSessionState }
   readonly completedAt: Date
 }
 
 export interface CompleteDeviceAuthorizationResult {
   readonly authorization: DeviceAuthorizationRecord
-  readonly accessToken: AccessTokenRecord
+  readonly session: SessionRecord
 }
 
 export interface CompleteMagicLinkSignInInput {
@@ -413,7 +433,6 @@ export interface CompleteMagicLinkSignInInput {
   readonly newUserDisplayName?: string
   readonly newUserAvatarUrl?: string
   readonly allowUserCreationWithoutInvitation?: boolean
-  readonly requireNoActiveUsersForUserCreation?: boolean
   readonly manualGroupIds?: readonly string[]
   readonly session: CompleteAuthSessionInput
 }
@@ -424,15 +443,22 @@ export interface CompleteOidcSignInInput {
   readonly stateHash: string
   readonly completedAt: Date
   readonly subject: string
+  /**
+   * An address the strategy has already decided to trust. Without an identity for `subject`, it
+   * links the user who has this email, or claims this email's invitation for a new user.
+   */
   readonly email: string
-  readonly emailVerified?: boolean
   readonly displayName?: string
   readonly avatarUrl?: string
   readonly claims?: Readonly<Record<string, unknown>>
-  readonly autoLinkByVerifiedEmail?: boolean
   readonly allowUserCreationWithoutInvitation?: boolean
-  readonly requireNoActiveUsersForUserCreation?: boolean
   readonly manualGroupIds?: readonly string[]
+  /**
+   * The groups the identity provider grants this user. When present, the user's `directory`
+   * memberships become exactly these; memberships from any other source are never touched, and a
+   * group the user already has from another source keeps it. Omitted, nothing is synced.
+   */
+  readonly directoryGroupIds?: readonly string[]
   readonly newUserId: string
   readonly session: CompleteAuthSessionInput
 }
@@ -523,6 +549,7 @@ export interface AuthSessionStore {
     readonly userId: string
     readonly now: Date
   }): Promise<readonly SessionRecord[]>
+  /** A live browser (cookie) session whose secret hashes to `tokenHash`. */
   findValidByTokenHash(params: {
     readonly projectId: string
     readonly id: string
@@ -530,6 +557,31 @@ export interface AuthSessionStore {
     readonly tokenHash: string
     readonly now: Date
   }): Promise<SessionRecord | null>
+  /** A live bearer session whose current, unexpired access token hashes to `tokenHash`. */
+  findValidByAccessTokenHash(params: {
+    readonly projectId: string
+    readonly id: string
+    readonly tokenHash: string
+    readonly now: Date
+  }): Promise<SessionRecord | null>
+  /**
+   * Atomically replace a live bearer session's tokens. The current refresh token rotates; the one
+   * it replaced also rotates within `reuseGraceMs` of that replacement. Presenting it later revokes
+   * the session. `next.expiresAt` extends the idle deadline, never past the absolute one.
+   */
+  rotateRefreshToken(params: {
+    readonly projectId: string
+    readonly id: string
+    readonly refreshTokenHash: string
+    readonly now: Date
+    readonly reuseGraceMs: number
+    readonly next: {
+      readonly tokenHash: string
+      readonly accessExpiresAt: Date
+      readonly refreshTokenHash: string
+      readonly expiresAt: Date
+    }
+  }): Promise<RotateSessionRefreshTokenResult>
   renewIfValid(params: {
     readonly projectId: string
     readonly id: string

package/src/storage/executions/validation.ts

@@ -340,7 +340,7 @@ async function validateCredential(
       `[Sixb] Authority access token '${credential.id}' does not exist in project '${record.projectId}'.`
     )
   }
-  if (token.subjectType !== principal.type || token.subjectId !== principal.id) {
+  if (!principalsEqual(token.subject, principal)) {
     throw new ExecutionStorageError(
       "invalid_credential",
       `[Sixb] Authority access token '${credential.id}' does not belong to principal '${principal.id}'.`

package/src/storage/file-upload-sessions/in-memory.ts

@@ -1,32 +1,37 @@
-import type { Principal } from "../../auth"
-import type { FileRef, SignedBlobUploadPart } from "../../blob-storage"
-import { FileUploadSessionError } from "./errors"
+import {
+  DurableFileUploadSessions,
+  type FileUploadSessionPersistence,
+  type FileUploadSessionPersistenceBackend,
+} from "./provider"
 import type {
   CreateFileUploadSessionInput,
   FileUploadSession,
-  FileUploadSessionStore,
+  ListAbandonedFileUploadSessionsInput,
 } from "./types"
-import {
-  createFileUploadId,
-  isFileUploadSessionExpired,
-  isTerminalFileUploadSessionExpired,
-  principalKey,
-  shouldDeleteFileUploadSession,
-} from "./utils"
+import { isAbandonedFileUploadSession, shouldDeleteFileUploadSession } from "./utils"
 
 export type InMemoryFileUploadSessionsSnapshot = Map<string, FileUploadSession>
 
 /**
- * In-memory {@link FileUploadSessionStore}.
+ * In-memory {@link FileUploadSessionStore}: the shared durable state machine over a Map.
  *
- * Sessions live only in this process's memory: they do not survive a restart and
- * are not shared across instances. Staged/direct-put uploads therefore require a
- * single-instance deployment for now; a durable (Pg/Sqlite) store is a follow-up.
- * Expired sessions are reaped opportunistically on `create` and on demand via
- * `cleanupExpired` (there is no background sweeper).
+ * Sessions live only in this process's memory: they do not survive a restart and are not
+ * shared across instances, so staged uploads need a single instance. `@sixb/pg` and
+ * `@sixb/sqlite` provide durable stores. Reapable sessions are also reaped on `create`.
  */
-export class InMemoryFileUploadSessions implements FileUploadSessionStore {
-  private readonly sessionsById = new Map<string, FileUploadSession>()
+export class InMemoryFileUploadSessions extends DurableFileUploadSessions {
+  private readonly sessionsById: Map<string, FileUploadSession>
+
+  constructor() {
+    const sessionsById = new Map<string, FileUploadSession>()
+    super(new InMemoryFileUploadSessionBackend(sessionsById))
+    this.sessionsById = sessionsById
+  }
+
+  override async create(input: CreateFileUploadSessionInput): Promise<FileUploadSession> {
+    await this.cleanupExpired()
+    return super.create(input)
+  }
 
   snapshot(): InMemoryFileUploadSessionsSnapshot {
     return structuredClone(this.sessionsById)
@@ -38,100 +43,63 @@ export class InMemoryFileUploadSessions implements FileUploadSessionStore {
       this.sessionsById.set(id, structuredClone(session))
     }
   }
+}
 
-  async create(input: CreateFileUploadSessionInput): Promise<FileUploadSession> {
-    await this.cleanupExpired()
+class InMemoryFileUploadSessionBackend implements FileUploadSessionPersistenceBackend {
+  private readonly persistence: FileUploadSessionPersistence
+  // Every await yields; chaining transactions keeps read-modify-write atomic.
+  private tail: Promise<unknown> = Promise.resolve()
 
-    const session: FileUploadSession = {
-      id: input.id ?? createFileUploadId(),
-      projectId: input.projectId,
-      principalKey: principalKey(input.principal),
-      strategy: input.strategy,
-      status: "pending",
-      ...(input.fileName === undefined ? {} : { fileName: input.fileName }),
-      ...(input.mediaType === undefined ? {} : { mediaType: input.mediaType }),
-      ...(input.logicalPath === undefined ? {} : { logicalPath: input.logicalPath }),
-      ...(input.expectedSizeBytes === undefined
-        ? {}
-        : { expectedSizeBytes: input.expectedSizeBytes }),
-      ...(input.expectedDigest === undefined ? {} : { expectedDigest: input.expectedDigest }),
-      ...(input.providerUpload === undefined ? {} : { providerUpload: input.providerUpload }),
-      signedParts: [],
-      createdAt: new Date(),
-      expiresAt: input.expiresAt,
-    }
+  constructor(sessionsById: Map<string, FileUploadSession>) {
+    this.persistence = new InMemoryFileUploadSessionPersistence(sessionsById)
+  }
 
-    this.sessionsById.set(session.id, session)
-    return session
+  read<T>(run: (persistence: FileUploadSessionPersistence) => Promise<T>): Promise<T> {
+    return run(this.persistence)
   }
 
-  async getForPrincipal(uploadId: string, principal: Principal): Promise<FileUploadSession> {
-    const session = this.sessionsById.get(uploadId)
-    if (!session || session.principalKey !== principalKey(principal)) {
-      throw new FileUploadSessionError("not_found", "File upload session not found.")
-    }
+  transaction<T>(run: (persistence: FileUploadSessionPersistence) => Promise<T>): Promise<T> {
+    const result = this.tail.then(() => run(this.persistence))
+    this.tail = result.catch(() => undefined)
+    return result
+  }
+}
 
-    const nowMs = Date.now()
-    if (isFileUploadSessionExpired(session, nowMs)) {
-      this.sessionsById.delete(uploadId)
-      throw new FileUploadSessionError("expired", "File upload session has expired.")
-    }
+class InMemoryFileUploadSessionPersistence implements FileUploadSessionPersistence {
+  constructor(private readonly sessionsById: Map<string, FileUploadSession>) {}
 
-    if (isTerminalFileUploadSessionExpired(session, nowMs)) {
-      this.sessionsById.delete(uploadId)
-      throw new FileUploadSessionError("not_found", "File upload session not found.")
-    }
-
-    return session
+  async now(): Promise<Date> {
+    return new Date()
   }
 
-  async markUploaded(uploadId: string, fileRef: FileRef): Promise<FileUploadSession> {
-    const session = this.requirePending(uploadId)
-    const updated = {
-      ...session,
-      fileRef,
-    }
-    this.sessionsById.set(uploadId, updated)
-    return updated
+  async insert(session: FileUploadSession): Promise<boolean> {
+    if (this.sessionsById.has(session.id)) return false
+    this.sessionsById.set(session.id, session)
+    return true
   }
 
-  async addSignedPart(uploadId: string, part: SignedBlobUploadPart): Promise<FileUploadSession> {
-    const session = this.requirePending(uploadId)
-    const updated = {
-      ...session,
-      signedParts: [
-        ...session.signedParts.filter((candidate) => candidate.partNumber !== part.partNumber),
-        part,
-      ].sort((left, right) => left.partNumber - right.partNumber),
-    }
-    this.sessionsById.set(uploadId, updated)
-    return updated
+  async get(uploadId: string): Promise<FileUploadSession | null> {
+    return this.sessionsById.get(uploadId) ?? null
   }
 
-  async complete(uploadId: string, fileRef: FileRef): Promise<FileUploadSession> {
-    const session = this.requirePending(uploadId)
-    const updated = {
-      ...session,
-      status: "completed" as const,
-      fileRef,
-      completedAt: new Date(),
-    }
-    this.sessionsById.set(uploadId, updated)
-    return updated
+  async update(session: FileUploadSession): Promise<void> {
+    this.sessionsById.set(session.id, session)
   }
 
-  async abort(uploadId: string): Promise<FileUploadSession> {
-    const session = this.requirePending(uploadId)
-    const updated = {
-      ...session,
-      status: "aborted" as const,
-      abortedAt: new Date(),
-    }
-    this.sessionsById.set(uploadId, updated)
-    return updated
+  async listAbandoned(
+    input: ListAbandonedFileUploadSessionsInput
+  ): Promise<readonly FileUploadSession[]> {
+    return [...this.sessionsById.values()]
+      .filter(
+        (session) =>
+          session.projectId === input.projectId &&
+          isAbandonedFileUploadSession(session, input.now.getTime())
+      )
+      .sort((left, right) => left.expiresAt.getTime() - right.expiresAt.getTime())
+      .slice(0, input.limit)
   }
 
-  async cleanupExpired(now = new Date()): Promise<number> {
+  async deleteReapable(now: Date): Promise<number> {
     let deleted = 0
     for (const [id, session] of this.sessionsById) {
       if (shouldDeleteFileUploadSession(session, now.getTime())) {
@@ -139,23 +107,6 @@ export class InMemoryFileUploadSessions implements FileUploadSessionStore {
         deleted += 1
       }
     }
-
     return deleted
   }
-
-  private requirePending(uploadId: string): FileUploadSession {
-    const session = this.sessionsById.get(uploadId)
-    if (!session) {
-      throw new FileUploadSessionError("not_found", "File upload session not found.")
-    }
-
-    if (session.status !== "pending") {
-      throw new FileUploadSessionError(
-        session.status === "completed" ? "already_completed" : "already_aborted",
-        `File upload session is already ${session.status}.`
-      )
-    }
-
-    return session
-  }
 }

package/src/storage/file-upload-sessions/index.ts

@@ -7,6 +7,7 @@ export type {
   FileUploadSessionStore,
   FileUploadStatus,
   FileUploadStrategy,
+  ListAbandonedFileUploadSessionsInput,
 } from "./types"
 export {
   createFileUploadId,