@sixb/core 0.1.20 → 0.1.22

package/src/storage/artifacts/record.ts

@@ -0,0 +1,260 @@
+import { isArtifactKind } from "../../artifacts/kinds"
+import { ARTIFACT_STATE_LIMITS } from "../../artifacts/limits"
+import type { ArtifactOutline } from "../../artifacts/outline"
+import type { ArtifactReference } from "../../artifacts/references"
+import type { Principal } from "../../auth"
+import { isFileRef } from "../../blob-storage"
+import { type ArtifactLatestVersion, ArtifactStorageError } from "./errors"
+import type {
+  ArtifactFile,
+  ArtifactFrameGrantRecord,
+  ArtifactFrameTarget,
+  ArtifactKind,
+  ArtifactRecord,
+  ArtifactStateEntry,
+  ArtifactVersionRecord,
+} from "./types"
+
+// Rows arrive from providers with camelCase keys. JSON columns may arrive parsed (jsonb) or as text
+// (SQLite), and timestamps as `Date` or ISO text. A row that does not read back as a valid record
+// fails closed rather than rendering something the store never held.
+
+type Row = { readonly [column: string]: unknown }
+
+export function parseArtifactRow(row: Row): ArtifactRecord {
+  const id = text(row.id, "id", "artifact")
+  const where = `artifact '${id}'`
+  const kind = row.kind
+  if (!isArtifactKind(kind)) throw corrupt(where, "kind is not an artifact kind")
+  return {
+    projectId: text(row.projectId, "projectId", where),
+    id,
+    kind,
+    title: text(row.title, "title", where),
+    owner: principal(row.ownerPrincipalType, row.ownerPrincipalId, "owner", where),
+    latestVersion: positiveInteger(row.latestVersion, "latestVersion", where),
+    createdAt: date(row.createdAt, "createdAt", where),
+    updatedAt: date(row.updatedAt, "updatedAt", where),
+  }
+}
+
+export function parseArtifactVersionRow(row: Row): ArtifactVersionRecord {
+  const artifactId = text(row.artifactId, "artifactId", "artifact version")
+  const version = positiveInteger(row.version, "version", `artifact '${artifactId}'`)
+  const where = `artifact '${artifactId}' version ${version}`
+  const originThreadId = row.originThreadId
+  const originRunId = row.originRunId
+  if ((originThreadId == null) !== (originRunId == null)) {
+    throw corrupt(where, "origin needs both a thread and a run")
+  }
+  return {
+    projectId: text(row.projectId, "projectId", where),
+    artifactId,
+    version,
+    title: text(row.title, "title", where),
+    entry: text(row.entry, "entry", where),
+    files: files(json(row.files, "files", where), where),
+    outline: outline(json(row.outline, "outline", where), where),
+    references: references(json(row.refs, "refs", where), where),
+    author: principal(row.authorPrincipalType, row.authorPrincipalId, "author", where),
+    ...(originThreadId == null
+      ? {}
+      : {
+          origin: {
+            threadId: text(originThreadId, "originThreadId", where),
+            runId: text(originRunId, "originRunId", where),
+          },
+        }),
+    createdAt: date(row.createdAt, "createdAt", where),
+  }
+}
+
+/** Targets are checked one by one: they decide what a frame may show from other artifacts. */
+export function parseArtifactFrameGrantRow(row: Row): ArtifactFrameGrantRecord {
+  const artifactId = text(row.artifactId, "artifactId", "artifact frame grant")
+  const where = `frame grant for artifact '${artifactId}'`
+  return {
+    projectId: text(row.projectId, "projectId", where),
+    tokenHash: text(row.tokenHash, "tokenHash", where),
+    artifactId,
+    version: positiveInteger(row.version, "version", where),
+    targets: frameTargets(json(row.targets, "targets", where), where),
+    createdAt: date(row.createdAt, "createdAt", where),
+    expiresAt: date(row.expiresAt, "expiresAt", where),
+  }
+}
+
+export function parseArtifactStateRow(row: Row): ArtifactStateEntry {
+  const key = text(row.key, "key", "artifact state")
+  const where = `artifact state '${key}'`
+  const sizeBytes = Number(row.sizeBytes)
+  if (!Number.isSafeInteger(sizeBytes) || sizeBytes < 0) {
+    throw corrupt(where, "sizeBytes is not a byte count")
+  }
+  return {
+    key,
+    value: text(row.value, "value", where),
+    sizeBytes,
+    updatedAt: date(row.updatedAt, "updatedAt", where),
+  }
+}
+
+/** A value's UTF-8 bytes, which a reader's state limits count. */
+export function artifactStateBytes(value: string): number {
+  return new TextEncoder().encode(value).byteLength
+}
+
+/**
+ * Throws `artifact_state_full` when a value would take a reader past `ARTIFACT_STATE_LIMITS`.
+ * `others` is what the reader keeps under every other key, so replacing a value counts once.
+ */
+export function checkArtifactStateWrite(input: {
+  readonly key: string
+  readonly valueBytes: number
+  readonly others: { readonly keys: number; readonly bytes: number }
+}): void {
+  const limits = ARTIFACT_STATE_LIMITS
+  if (input.valueBytes > limits.maxValueBytes) {
+    throw artifactStorageErrors.stateFull(
+      `[Sixb] '${input.key}' is ${kilobytes(input.valueBytes)}; a page keeps at most ${kilobytes(limits.maxValueBytes)} under one key.`
+    )
+  }
+  if (input.others.keys + 1 > limits.maxKeys) {
+    throw artifactStorageErrors.stateFull(
+      `[Sixb] A page keeps at most ${limits.maxKeys} keys for each reader: delete one before keeping '${input.key}'.`
+    )
+  }
+  if (input.others.bytes + input.valueBytes > limits.maxBytes) {
+    throw artifactStorageErrors.stateFull(
+      `[Sixb] A page keeps at most ${kilobytes(limits.maxBytes)} for each reader; '${input.key}' would take it to ${kilobytes(input.others.bytes + input.valueBytes)}.`
+    )
+  }
+}
+
+function kilobytes(bytes: number): string {
+  return `${Math.ceil(bytes / 1024).toLocaleString("en-US")} KB`
+}
+
+/** The errors every provider raises, with one wording. */
+export const artifactStorageErrors = {
+  exists: (id: string) =>
+    new ArtifactStorageError("artifact_exists", `[Sixb] Artifact '${id}' already exists.`),
+  notFound: (id: string) =>
+    new ArtifactStorageError("artifact_not_found", `[Sixb] Artifact '${id}' was not found.`),
+  kindMismatch: (id: string, kind: ArtifactKind, requested: ArtifactKind) =>
+    new ArtifactStorageError(
+      "artifact_kind_mismatch",
+      `[Sixb] Artifact '${id}' is a ${kind}; it cannot take a ${requested} version.`
+    ),
+  moved: (id: string, baseVersion: number, latest: ArtifactLatestVersion) =>
+    new ArtifactStorageError(
+      "artifact_moved",
+      `[Sixb] Artifact '${id}' is at version ${latest.version}, not version ${baseVersion}, which this publish was based on.`,
+      latest
+    ),
+  stateFull: (message: string) => new ArtifactStorageError("artifact_state_full", message),
+}
+
+function files(value: unknown, where: string): ArtifactFile[] {
+  if (!Array.isArray(value)) throw corrupt(where, "files is not a list")
+  return value.map((entry) => {
+    if (!isObject(entry) || typeof entry.path !== "string" || !isFileRef(entry.file)) {
+      throw corrupt(where, "a file entry is not a path and a file reference")
+    }
+    return { path: entry.path, file: entry.file }
+  })
+}
+
+function outline(value: unknown, where: string): ArtifactOutline {
+  if (!isObject(value) || !isArtifactKind(value.kind)) {
+    throw corrupt(where, "outline does not name an artifact kind")
+  }
+  return value as unknown as ArtifactOutline
+}
+
+function references(value: unknown, where: string): ArtifactReference[] {
+  if (!Array.isArray(value)) throw corrupt(where, "references is not a list")
+  return value.map((entry) => {
+    if (
+      !isObject(entry) ||
+      typeof entry.address !== "string" ||
+      (entry.as !== "embed" && entry.as !== "link") ||
+      typeof entry.at !== "string" ||
+      !Number.isSafeInteger(entry.resolvedVersion) ||
+      (entry.resolvedVersion as number) < 1
+    ) {
+      throw corrupt(where, "a reference is not an address, a verb, a place, and a version")
+    }
+    return {
+      address: entry.address,
+      as: entry.as,
+      at: entry.at,
+      resolvedVersion: entry.resolvedVersion as number,
+    }
+  })
+}
+
+function frameTargets(value: unknown, where: string): ArtifactFrameTarget[] {
+  if (!Array.isArray(value)) throw corrupt(where, "targets is not a list")
+  return value.map((entry) => {
+    if (
+      !isObject(entry) ||
+      typeof entry.address !== "string" ||
+      typeof entry.artifactId !== "string" ||
+      !Number.isSafeInteger(entry.version) ||
+      (entry.version as number) < 1
+    ) {
+      throw corrupt(where, "a target is not an address, an artifact, and a version")
+    }
+    return {
+      address: entry.address,
+      artifactId: entry.artifactId,
+      version: entry.version as number,
+    }
+  })
+}
+
+const PRINCIPAL_TYPES: ReadonlySet<string> = new Set(["user", "serviceAccount", "system"])
+
+function principal(type: unknown, id: unknown, column: string, where: string): Principal {
+  if (typeof type !== "string" || !PRINCIPAL_TYPES.has(type)) {
+    throw corrupt(where, `${column} is not a principal`)
+  }
+  return { type: type as Principal["type"], id: text(id, column, where) }
+}
+
+function json(value: unknown, column: string, where: string): unknown {
+  if (typeof value !== "string") return value
+  try {
+    return JSON.parse(value)
+  } catch {
+    throw corrupt(where, `${column} is not JSON`)
+  }
+}
+
+function text(value: unknown, column: string, where: string): string {
+  if (typeof value !== "string" || value.length === 0) throw corrupt(where, `${column} is not text`)
+  return value
+}
+
+function positiveInteger(value: unknown, column: string, where: string): number {
+  const number = typeof value === "bigint" ? Number(value) : value
+  if (typeof number !== "number" || !Number.isSafeInteger(number) || number < 1) {
+    throw corrupt(where, `${column} is not a positive integer`)
+  }
+  return number
+}
+
+function date(value: unknown, column: string, where: string): Date {
+  const parsed = value instanceof Date || typeof value === "string" ? new Date(value) : null
+  if (!parsed || !Number.isFinite(parsed.getTime())) throw corrupt(where, `${column} is not a date`)
+  return parsed
+}
+
+function isObject(value: unknown): value is Record<string, unknown> {
+  return typeof value === "object" && value !== null && !Array.isArray(value)
+}
+
+function corrupt(where: string, reason: string): Error {
+  return new Error(`[Sixb] Stored ${where} is invalid: ${reason}.`)
+}

package/src/storage/artifacts/types.ts

@@ -0,0 +1,293 @@
+import type { ArtifactKind } from "../../artifacts/kinds"
+import type { ArtifactOutline } from "../../artifacts/outline"
+import type { ArtifactReference } from "../../artifacts/references"
+import type { Principal } from "../../auth"
+import type { FileRef } from "../../blob-storage"
+
+export type { ArtifactKind, ArtifactOutline, ArtifactReference }
+
+/** A versioned document, sheet, deck, or file. Its kind never changes. */
+export interface ArtifactRecord {
+  readonly projectId: string
+  readonly id: string
+  readonly kind: ArtifactKind
+  /** The latest version's title. */
+  readonly title: string
+  /** Who created the artifact; reading and publishing are decided from it. */
+  readonly owner: Principal
+  readonly latestVersion: number
+  readonly createdAt: Date
+  /** When the latest version was published. */
+  readonly updatedAt: Date
+}
+
+/** One file of a version, at its path inside the artifact. */
+export interface ArtifactFile {
+  /** Relative, with `/` separators and no `.` or `..` segments. */
+  readonly path: string
+  readonly file: FileRef
+}
+
+/**
+ * Where a version was published from: an Agent turn in a thread. Publishing one shares the artifact
+ * in that thread.
+ */
+export interface ArtifactOrigin {
+  readonly threadId: string
+  readonly runId: string
+}
+
+/** One published version. A version never changes once stored. */
+export interface ArtifactVersionRecord {
+  readonly projectId: string
+  readonly artifactId: string
+  readonly version: number
+  readonly title: string
+  /** The path of the file the kind renders from, one of `files`. */
+  readonly entry: string
+  readonly files: readonly ArtifactFile[]
+  readonly outline: ArtifactOutline
+  readonly references: readonly ArtifactReference[]
+  /** Who published this version. */
+  readonly author: Principal
+  readonly origin?: ArtifactOrigin
+  readonly createdAt: Date
+}
+
+/** A version's content before storage numbers it. */
+export type ArtifactVersionInput = Omit<
+  ArtifactVersionRecord,
+  "projectId" | "artifactId" | "version"
+>
+
+export interface CreateArtifactInput {
+  readonly projectId: string
+  readonly id: string
+  readonly kind: ArtifactKind
+  readonly owner: Principal
+  /** Becomes version 1. */
+  readonly version: ArtifactVersionInput
+}
+
+export interface PublishArtifactVersionInput {
+  readonly projectId: string
+  readonly artifactId: string
+  /** Must be the artifact's kind. */
+  readonly kind: ArtifactKind
+  readonly version: ArtifactVersionInput
+  /**
+   * The version this one was made from. When the latest version is another, the publish fails
+   * with `artifact_moved` rather than replace changes it never saw.
+   */
+  readonly baseVersion?: number
+}
+
+export interface PublishedArtifactVersion {
+  readonly artifact: ArtifactRecord
+  readonly version: ArtifactVersionRecord
+}
+
+export interface GetArtifactInput {
+  readonly projectId: string
+  readonly id: string
+}
+
+export interface ListArtifactsInput {
+  readonly projectId: string
+  readonly owner?: Principal
+  /** Only artifacts shared in this thread. */
+  readonly threadId?: string
+  /** Only artifacts of this kind. */
+  readonly kind?: ArtifactKind
+  readonly limit?: number
+  readonly offset?: number
+}
+
+export interface ListArtifactsResult {
+  readonly artifacts: readonly ArtifactRecord[]
+  readonly hasMore: boolean
+  readonly total: number
+}
+
+export interface GetArtifactVersionInput {
+  readonly projectId: string
+  readonly artifactId: string
+  readonly version: number
+}
+
+export interface ListArtifactVersionsInput {
+  readonly projectId: string
+  readonly artifactId: string
+  readonly limit?: number
+  readonly offset?: number
+}
+
+export interface ListArtifactVersionsResult {
+  readonly versions: readonly ArtifactVersionRecord[]
+  readonly hasMore: boolean
+  readonly total: number
+}
+
+export interface DeleteArtifactInput {
+  readonly projectId: string
+  readonly id: string
+}
+
+export interface CopyArtifactInput {
+  readonly projectId: string
+  /** The artifact copied. */
+  readonly sourceId: string
+  /** The copy's id. */
+  readonly id: string
+  /** Owns the copy. */
+  readonly owner: Principal
+  /** The thread the copy is shared in, as long as it lasts: a fork's. */
+  readonly threadId: string
+  readonly copiedAt?: Date
+}
+
+export interface ListReferencingVersionsInput {
+  readonly projectId: string
+  /** The artifact the versions refer to. */
+  readonly artifactId: string
+}
+
+/**
+ * A short-lived link to one version, which a sandboxed frame loads a deck's files through. Only
+ * the SHA-256 of the link's token is stored; the token is the credential.
+ */
+export interface ArtifactFrameGrantRecord {
+  readonly projectId: string
+  /** SHA-256 hex of the token. */
+  readonly tokenHash: string
+  readonly artifactId: string
+  readonly version: number
+  /** What the frame may show from other artifacts, decided for its reader when it was issued. */
+  readonly targets: readonly ArtifactFrameTarget[]
+  readonly createdAt: Date
+  readonly expiresAt: Date
+}
+
+/** An address a version embeds, and the version of its target a frame shows. */
+export interface ArtifactFrameTarget {
+  readonly address: string
+  readonly artifactId: string
+  readonly version: number
+}
+
+export interface FindArtifactFrameGrantInput {
+  readonly projectId: string
+  readonly tokenHash: string
+}
+
+export interface DeleteExpiredArtifactFrameGrantsInput {
+  readonly projectId: string
+  readonly expiredBefore: Date
+  readonly limit: number
+}
+
+export interface DeleteArtifactVersionsByOriginInput {
+  readonly projectId: string
+  readonly runId: string
+}
+
+/** Whose values, kept by which artifact: a page keeps its own for each reader. */
+export interface ArtifactStateScope {
+  readonly projectId: string
+  readonly artifactId: string
+  readonly principal: Principal
+}
+
+export interface ArtifactStateKeyInput extends ArtifactStateScope {
+  readonly key: string
+}
+
+export interface SetArtifactStateInput extends ArtifactStateKeyInput {
+  /** JSON text, stored as written. */
+  readonly value: string
+  readonly updatedAt: Date
+}
+
+/** One value a page keeps for a reader. */
+export interface ArtifactStateEntry {
+  readonly key: string
+  /** JSON text. */
+  readonly value: string
+  /** The value's UTF-8 bytes, which the reader's limits count. */
+  readonly sizeBytes: number
+  readonly updatedAt: Date
+}
+
+/**
+ * Persistence only: who may read or publish, and what a version may contain, are decided in Core
+ * before a call reaches storage.
+ */
+export interface ArtifactStorage {
+  /**
+   * Creates the artifact with its first version, shared in its origin's thread. Throws
+   * `artifact_exists` when the id is taken.
+   */
+  create(input: CreateArtifactInput): Promise<PublishedArtifactVersion>
+  /**
+   * Stores the next version and makes it the latest, sharing the artifact in its origin's thread.
+   * Throws `artifact_not_found`, `artifact_kind_mismatch`, or `artifact_moved` with the latest version and its author when
+   * `baseVersion` is not the latest, checked in the same transaction as the write, so of two
+   * publishes from one base only the first is stored. A version number is never reused, even
+   * after its version is deleted.
+   */
+  publish(input: PublishArtifactVersionInput): Promise<PublishedArtifactVersion>
+  get(input: GetArtifactInput): Promise<ArtifactRecord | null>
+  /** Most recently updated first. */
+  list(input: ListArtifactsInput): Promise<ListArtifactsResult>
+  getVersion(input: GetArtifactVersionInput): Promise<ArtifactVersionRecord | null>
+  /** Newest first. */
+  listVersions(input: ListArtifactVersionsInput): Promise<ListArtifactVersionsResult>
+  /**
+   * The threads the artifact is shared in, by id: each one a version it keeps was published from,
+   * and the one it was copied for.
+   */
+  listThreadIds(input: GetArtifactInput): Promise<string[]>
+  /**
+   * Copies an artifact with every version under its number, each without its origin, as a new
+   * artifact shared in `threadId` for as long as it lasts: a fork's copy, whose `@N` addresses
+   * still resolve. The files are reused, not copied. Throws `artifact_not_found` without the
+   * source and `artifact_exists` when the id is taken.
+   */
+  copy(input: CopyArtifactInput): Promise<ArtifactRecord>
+  /**
+   * The latest version of each artifact whose latest version has an address to this artifact, so
+   * a new version can tell which artifacts it breaks. Ordered by artifact id.
+   */
+  listReferencingVersions(input: ListReferencingVersionsInput): Promise<ArtifactVersionRecord[]>
+  /** Stores a frame grant. Throws `artifact_not_found` when its artifact does not exist. */
+  createFrameGrant(record: ArtifactFrameGrantRecord): Promise<void>
+  /** Returns expired grants too; the caller decides whether one still serves. */
+  findFrameGrant(input: FindArtifactFrameGrantInput): Promise<ArtifactFrameGrantRecord | null>
+  /** Deletes up to `limit` grants that expired before `expiredBefore`, and returns the count. */
+  deleteExpiredFrameGrants(input: DeleteExpiredArtifactFrameGrantsInput): Promise<number>
+  /** A value a page keeps for a reader, or null when it keeps none under the key. */
+  getState(input: ArtifactStateKeyInput): Promise<ArtifactStateEntry | null>
+  /**
+   * Keeps a value under its key, replacing one there. Throws `artifact_not_found`, or
+   * `artifact_state_full` when the value, or the reader's keys or bytes with it, would pass
+   * `ARTIFACT_STATE_LIMITS`, checked in the same transaction as the write.
+   */
+  setState(input: SetArtifactStateInput): Promise<void>
+  /** `false` when there was no value under the key. */
+  deleteState(input: ArtifactStateKeyInput): Promise<boolean>
+  /** Every value a page keeps for a reader, by key. */
+  listState(input: ArtifactStateScope): Promise<ArtifactStateEntry[]>
+  /** Deletes every value a page keeps for a reader, and returns how many. */
+  clearState(input: ArtifactStateScope): Promise<number>
+  /**
+   * Deletes the artifact, every version, its frame grants, and what it keeps for its readers.
+   * `false` when it does not exist.
+   */
+  delete(input: DeleteArtifactInput): Promise<boolean>
+  /**
+   * Deletes the versions a run published and returns how many. An artifact left without versions
+   * is deleted; one that lost its latest version points at its newest remaining one. One left
+   * without a version from the run's thread is no longer shared there, unless it was copied for it.
+   */
+  deleteVersionsByOrigin(input: DeleteArtifactVersionsByOriginInput): Promise<number>
+}

package/src/storage/auth/in-memory/auth-storage.ts

@@ -11,6 +11,7 @@ import type {
   InvitationRecord,
   SessionRecord,
   SuspendUserAndRevokeSessionsInput,
+  UpdateAuthUserResult,
   UserIdentityRecord,
   UserRecord,
 } from "../types"
@@ -241,6 +242,7 @@ export class InMemoryAuthStorage implements AuthStorage {
       consumedAt: completedAt,
     })
 
+    const previousUser = existingUser ? cloneRecord(existingUser) : null
     let user = existingUser
     if (!user) {
       user = {
@@ -283,6 +285,7 @@ export class InMemoryAuthStorage implements AuthStorage {
       session: cloneRecord(session),
       invitation: invitation.invitation ? cloneRecord(invitation.invitation) : undefined,
       groupMemberships: memberships.map(cloneRecord),
+      previousUser,
     }
   }
 
@@ -366,6 +369,7 @@ export class InMemoryAuthStorage implements AuthStorage {
 
     this.consumeOidcAttempt(input, completedAt, projectId)
 
+    const previousUser = user ? cloneRecord(user) : null
     if (!user) {
       user = {
         id: newUserId ?? assertNonEmpty(input.newUserId, "User id"),
@@ -378,6 +382,8 @@ export class InMemoryAuthStorage implements AuthStorage {
         updatedAt: completedAt,
       }
       this.state.users.set(userKey(projectId, user.id), cloneRecord(user))
+    } else {
+      user = this.refreshProviderProfile(user, input, completedAt)
     }
 
     const invitation = this.acceptInvitationAndApplyGroups({
@@ -428,12 +434,13 @@ export class InMemoryAuthStorage implements AuthStorage {
       identity: cloneRecord(nextIdentity),
       invitation: invitation.invitation ? cloneRecord(invitation.invitation) : undefined,
       groupMemberships: memberships.map(cloneRecord),
+      previousUser,
     }
   }
 
   async suspendUserAndRevokeSessions(
     input: SuspendUserAndRevokeSessionsInput
-  ): Promise<UserRecord> {
+  ): Promise<UpdateAuthUserResult> {
     const key = userKey(input.projectId, input.userId)
     const existing = this.state.users.get(key)
 
@@ -452,7 +459,25 @@ export class InMemoryAuthStorage implements AuthStorage {
     this.state.users.set(key, cloneRecord(next))
     revokeActiveSessionsForUser(this.state, input.projectId, input.userId, input.suspendedAt)
 
-    return cloneRecord(next)
+    return { user: cloneRecord(next), previousUser: cloneRecord(existing) }
+  }
+
+  // The identity provider owns the name and picture it sends: every sign-in overwrites them, and
+  // one it leaves out keeps the stored value.
+  private refreshProviderProfile(
+    user: UserRecord,
+    input: CompleteOidcSignInInput,
+    updatedAt: Date
+  ): UserRecord {
+    const displayName = input.displayName ?? user.displayName
+    const avatarUrl = input.avatarUrl ?? user.avatarUrl
+    if (displayName === user.displayName && avatarUrl === user.avatarUrl) {
+      return user
+    }
+
+    const next: UserRecord = { ...user, displayName, avatarUrl, updatedAt: cloneDate(updatedAt) }
+    this.state.users.set(userKey(user.projectId, user.id), cloneRecord(next))
+    return next
   }
 
   private acceptInvitationAndApplyGroups(input: {

package/src/storage/auth/in-memory/sessions.ts

@@ -2,6 +2,8 @@ import { AuthStorageError } from "../errors"
 import type {
   AuthSessionStore,
   CreateAuthSessionInput,
+  ListAuthSessionsInput,
+  ListAuthSessionsResult,
   RotateSessionRefreshTokenResult,
   SessionRecord,
 } from "../types"
@@ -50,6 +52,25 @@ export class InMemoryAuthSessionStore implements AuthSessionStore {
       .map(cloneRecord)
   }
 
+  async listByUserId(params: ListAuthSessionsInput): Promise<ListAuthSessionsResult> {
+    const before = params.before
+    const offset = before?.skip ?? 0
+    const sessions = [...this.state.sessions.values()]
+      .filter((session) => session.projectId === params.projectId)
+      .filter((session) => session.userId === params.userId)
+      .filter((session) => !before || session.createdAt <= before.createdAt)
+      .sort((a, b) => {
+        const created = b.createdAt.getTime() - a.createdAt.getTime()
+        if (created !== 0) return created
+        return a.id < b.id ? 1 : a.id > b.id ? -1 : 0
+      })
+
+    return {
+      sessions: sessions.slice(offset, offset + params.limit).map(cloneRecord),
+      hasMore: sessions.length > offset + params.limit,
+    }
+  }
+
   async findValidByTokenHash(params: {
     readonly projectId: string
     readonly id: string