@sixb/pg 0.0.1

package/src/auth-storage/group-memberships.ts

@@ -0,0 +1,47 @@
+import type {
+  AuthGroupMembershipStore,
+  GroupMembershipRecord,
+  UpsertAuthGroupMembershipInput,
+} from "@sixb/core/storage"
+import type { PgStoreClient } from "../transactions"
+import type { PgAuthGroupMembershipRow } from "./rows"
+import { rowToGroupMembershipRecord } from "./rows"
+import { listMembershipsForUser, removeGroupMembership, upsertGroupMembership } from "./shared"
+
+export class PgAuthGroupMembershipStore implements AuthGroupMembershipStore {
+  constructor(private readonly sql: PgStoreClient) {}
+
+  async upsert(input: UpsertAuthGroupMembershipInput): Promise<GroupMembershipRecord> {
+    return upsertGroupMembership(this.sql, input)
+  }
+
+  async remove(params: {
+    readonly projectId: string
+    readonly userId: string
+    readonly groupId: string
+  }): Promise<GroupMembershipRecord | null> {
+    return removeGroupMembership(this.sql, params)
+  }
+
+  async listForUser(params: {
+    readonly projectId: string
+    readonly userId: string
+  }): Promise<readonly GroupMembershipRecord[]> {
+    return listMembershipsForUser(this.sql, params)
+  }
+
+  async listForGroup(params: {
+    readonly projectId: string
+    readonly groupId: string
+  }): Promise<readonly GroupMembershipRecord[]> {
+    const rows = await this.sql<PgAuthGroupMembershipRow[]>`
+      SELECT *
+      FROM auth_group_memberships
+      WHERE project_id = ${params.projectId}
+        AND group_id = ${params.groupId}
+      ORDER BY user_id ASC
+    `
+
+    return rows.map(rowToGroupMembershipRecord)
+  }
+}

package/src/auth-storage/identities.ts

@@ -0,0 +1,85 @@
+import type {
+  AuthUserIdentityStore,
+  UpsertAuthUserIdentityInput,
+  UserIdentityRecord,
+} from "@sixb/core/storage"
+import type { PgStoreClient } from "../transactions"
+import type { PgAuthUserIdentityRow } from "./rows"
+import { rowToIdentityRecord, serializeOptionalRecord } from "./rows"
+import { assertNonEmpty, dateOrNow, getIdentityRowBySubject, requireUserById } from "./shared"
+
+export class PgAuthUserIdentityStore implements AuthUserIdentityStore {
+  constructor(private readonly sql: PgStoreClient) {}
+
+  async upsert(input: UpsertAuthUserIdentityInput): Promise<UserIdentityRecord> {
+    const projectId = assertNonEmpty(input.projectId, "Project id")
+    const strategyId = assertNonEmpty(input.strategyId, "Strategy id")
+    const subject = assertNonEmpty(input.subject, "Subject")
+    const userId = assertNonEmpty(input.userId, "User id")
+    const existing = await getIdentityRowBySubject(this.sql, {
+      projectId,
+      strategyId,
+      subject,
+    })
+    const createdAt = existing ? new Date(existing.created_at) : dateOrNow(input.createdAt)
+    const updatedAt = input.updatedAt
+      ? new Date(input.updatedAt)
+      : existing
+        ? new Date()
+        : createdAt
+
+    await requireUserById(this.sql, { projectId, id: userId })
+
+    const [row] = await this.sql<PgAuthUserIdentityRow[]>`
+      INSERT INTO auth_user_identities (
+        project_id,
+        strategy_id,
+        subject,
+        user_id,
+        claims,
+        created_at,
+        updated_at
+      ) VALUES (
+        ${projectId},
+        ${strategyId},
+        ${subject},
+        ${userId},
+        ${serializeOptionalRecord(input.claims)}::text::jsonb,
+        ${createdAt},
+        ${updatedAt}
+      )
+      ON CONFLICT (project_id, strategy_id, subject)
+      DO UPDATE SET
+        user_id = excluded.user_id,
+        claims = excluded.claims,
+        updated_at = excluded.updated_at
+      RETURNING *
+    `
+
+    return rowToIdentityRecord(row)
+  }
+
+  async getBySubject(params: {
+    readonly projectId: string
+    readonly strategyId: string
+    readonly subject: string
+  }): Promise<UserIdentityRecord | null> {
+    const row = await getIdentityRowBySubject(this.sql, params)
+    return row ? rowToIdentityRecord(row) : null
+  }
+
+  async listForUser(params: {
+    readonly projectId: string
+    readonly userId: string
+  }): Promise<readonly UserIdentityRecord[]> {
+    const rows = await this.sql<PgAuthUserIdentityRow[]>`
+      SELECT *
+      FROM auth_user_identities
+      WHERE project_id = ${params.projectId}
+        AND user_id = ${params.userId}
+      ORDER BY created_at ASC, strategy_id ASC, subject ASC
+    `
+
+    return rows.map(rowToIdentityRecord)
+  }
+}

package/src/auth-storage/index.ts

@@ -0,0 +1,2 @@
+export type { PgAuthStorageOptions } from "./auth-storage"
+export { PgAuthStorage } from "./auth-storage"

package/src/auth-storage/invitations.ts

@@ -0,0 +1,280 @@
+import type {
+  AuthInvitationStore,
+  CreateOrUpdateAuthInvitationInput,
+  InvitationRecord,
+  ListAuthInvitationsInput,
+  ListAuthInvitationsResult,
+} from "@sixb/core/storage"
+import { AuthStorageError } from "@sixb/core/storage"
+import type { SQLClient } from "../pg-client"
+import {
+  authLockKey,
+  lockAdvisoryKeys,
+  type PgStoreClient,
+  runPgTransaction,
+} from "../transactions"
+import type { PgAuthInvitationRow } from "./rows"
+import { rowToInvitationRecord } from "./rows"
+import {
+  appendPagination,
+  assertNonEmpty,
+  dateOrNow,
+  getActiveInvitationByEmail,
+  getInvitationById,
+  getInvitationGroupIds,
+  hasEmptyFilter,
+  invitationCreatorColumns,
+  mapUniqueConstraintError,
+  normalizeEmail,
+  normalizeGroupIds,
+  type PgValue,
+  placeholders,
+  replaceInvitationGroups,
+  requireInvitationById,
+  requireSessionById,
+  requireUserById,
+} from "./shared"
+
+export class PgAuthInvitationStore implements AuthInvitationStore {
+  constructor(private readonly sql: PgStoreClient) {}
+
+  async createOrUpdateActive(input: CreateOrUpdateAuthInvitationInput): Promise<InvitationRecord> {
+    return runPgTransaction(this.sql, async (tx) => {
+      const id = assertNonEmpty(input.id, "Invitation id")
+      const projectId = assertNonEmpty(input.projectId, "Project id")
+      const email = normalizeEmail(input.email)
+      const groupIds = normalizeGroupIds(input.groupIds)
+      const now = dateOrNow(input.updatedAt ?? input.createdAt)
+      const creator = invitationCreatorColumns(input.createdByPrincipal)
+
+      await lockAdvisoryKeys(tx, [authLockKey("invitations", projectId, email)])
+      await this.validateCreator(tx, projectId, input)
+
+      const existingActive = await getActiveInvitationByEmail(
+        tx,
+        {
+          projectId,
+          email,
+          now,
+        },
+        { forUpdate: true }
+      )
+
+      if (existingActive) {
+        await tx`
+          UPDATE auth_invitations
+          SET created_by_user_id = ${creator.createdByUserId},
+              created_by_service_account_id = ${creator.createdByServiceAccountId},
+              created_by_system_id = ${creator.createdBySystemId},
+              created_by_session_id = ${input.createdBySessionId ?? null},
+              expires_at = ${input.expiresAt},
+              updated_at = ${now}
+          WHERE project_id = ${projectId}
+            AND id = ${existingActive.id}
+        `
+        await replaceInvitationGroups(tx, {
+          projectId,
+          invitationId: existingActive.id,
+          groupIds,
+        })
+
+        return requireInvitationById(tx, { projectId, id: existingActive.id })
+      }
+
+      if (await getInvitationById(tx, { projectId, id })) {
+        throw new AuthStorageError(
+          "duplicate_invitation",
+          `[Sixb] Invitation '${id}' already exists but is not active for project '${projectId}'.`
+        )
+      }
+
+      const createdAt = dateOrNow(input.createdAt)
+      try {
+        await tx`
+          INSERT INTO auth_invitations (
+            project_id,
+            id,
+            email,
+            status,
+            created_by_user_id,
+            created_by_service_account_id,
+            created_by_system_id,
+            created_by_session_id,
+            created_at,
+            updated_at,
+            expires_at
+          ) VALUES (
+            ${projectId},
+            ${id},
+            ${email},
+            ${"pending"},
+            ${creator.createdByUserId},
+            ${creator.createdByServiceAccountId},
+            ${creator.createdBySystemId},
+            ${input.createdBySessionId ?? null},
+            ${createdAt},
+            ${now},
+            ${input.expiresAt}
+          )
+        `
+      } catch (error) {
+        mapUniqueConstraintError(
+          error,
+          "duplicate_invitation",
+          `[Sixb] Invitation '${id}' already exists for project '${projectId}'.`
+        )
+      }
+
+      await replaceInvitationGroups(tx, { projectId, invitationId: id, groupIds })
+      return requireInvitationById(tx, { projectId, id })
+    })
+  }
+
+  async getById(params: {
+    readonly projectId: string
+    readonly id: string
+  }): Promise<InvitationRecord | null> {
+    return getInvitationById(this.sql, params)
+  }
+
+  async getActiveByEmail(params: {
+    readonly projectId: string
+    readonly email: string
+    readonly now: Date
+  }): Promise<InvitationRecord | null> {
+    return getActiveInvitationByEmail(this.sql, params)
+  }
+
+  async list(input: ListAuthInvitationsInput): Promise<ListAuthInvitationsResult> {
+    if (hasEmptyFilter(input.statuses) || hasEmptyFilter(input.groupIds)) {
+      return { invitations: [], hasMore: false, total: 0 }
+    }
+
+    const whereClauses = ["project_id = $1"]
+    const params: PgValue[] = [input.projectId]
+    let nextIndex = 2
+
+    if (input.email) {
+      whereClauses.push(`email = $${nextIndex++}`)
+      params.push(normalizeEmail(input.email))
+    }
+
+    if (input.statuses) {
+      const statusPlaceholders = placeholders(nextIndex, input.statuses.length)
+      nextIndex += input.statuses.length
+      whereClauses.push(`status IN (${statusPlaceholders.join(", ")})`)
+      params.push(...input.statuses)
+    }
+
+    const groupIds = input.groupIds ? normalizeGroupIds(input.groupIds) : null
+    if (groupIds) {
+      const groupPlaceholders = placeholders(nextIndex, groupIds.length)
+      nextIndex += groupIds.length
+      whereClauses.push(`
+        EXISTS (
+          SELECT 1
+          FROM auth_invitation_groups invitation_groups
+          WHERE invitation_groups.project_id = auth_invitations.project_id
+            AND invitation_groups.invitation_id = auth_invitations.id
+            AND invitation_groups.group_id IN (${groupPlaceholders.join(", ")})
+        )
+      `)
+      params.push(...groupIds)
+    }
+
+    const where = `WHERE ${whereClauses.join(" AND ")}`
+    const order = input.order === "asc" ? "ASC" : "DESC"
+    const [totalRow] = await this.sql.unsafe<{ readonly count: string | number }[]>(
+      `SELECT COUNT(*)::bigint AS count FROM auth_invitations ${where}`,
+      [...params]
+    )
+
+    const queryParams = [...params]
+    const query = appendPagination(
+      `
+        SELECT *
+        FROM auth_invitations
+        ${where}
+        ORDER BY created_at ${order}, id ${order}
+      `,
+      queryParams,
+      nextIndex,
+      input
+    )
+    const rows = await this.sql.unsafe<PgAuthInvitationRow[]>(query, queryParams)
+    const invitations = await Promise.all(
+      rows.map(async (row) =>
+        rowToInvitationRecord(
+          row,
+          await getInvitationGroupIds(this.sql, {
+            projectId: row.project_id,
+            invitationId: row.id,
+          })
+        )
+      )
+    )
+    const total = Number(totalRow?.count ?? 0)
+
+    return {
+      invitations,
+      hasMore: (input.offset ?? 0) + rows.length < total,
+      total,
+    }
+  }
+
+  async accept(params: {
+    readonly projectId: string
+    readonly id: string
+    readonly acceptedAt: Date
+  }): Promise<InvitationRecord> {
+    return runPgTransaction(this.sql, async (tx) => {
+      await requireInvitationById(tx, params, { forUpdate: true })
+
+      await tx`
+        UPDATE auth_invitations
+        SET status = 'accepted',
+            accepted_at = ${params.acceptedAt},
+            updated_at = ${params.acceptedAt}
+        WHERE project_id = ${params.projectId}
+          AND id = ${params.id}
+      `
+
+      return requireInvitationById(tx, params)
+    })
+  }
+
+  async revoke(params: {
+    readonly projectId: string
+    readonly id: string
+    readonly revokedAt: Date
+  }): Promise<InvitationRecord> {
+    return runPgTransaction(this.sql, async (tx) => {
+      await requireInvitationById(tx, params, { forUpdate: true })
+
+      await tx`
+        UPDATE auth_invitations
+        SET status = 'revoked',
+            revoked_at = ${params.revokedAt},
+            updated_at = ${params.revokedAt}
+        WHERE project_id = ${params.projectId}
+          AND id = ${params.id}
+      `
+
+      return requireInvitationById(tx, params)
+    })
+  }
+
+  private async validateCreator(
+    sql: SQLClient,
+    projectId: string,
+    input: CreateOrUpdateAuthInvitationInput
+  ): Promise<void> {
+    if (input.createdByPrincipal?.type === "user") {
+      await requireUserById(sql, { projectId, id: input.createdByPrincipal.id })
+    }
+
+    if (input.createdBySessionId) {
+      await requireSessionById(sql, { projectId, id: input.createdBySessionId })
+    }
+  }
+}

package/src/auth-storage/magic-links.ts

@@ -0,0 +1,140 @@
+import { resolveAuthSessionAudience } from "@sixb/core"
+import type {
+  AuthMagicLinkStore,
+  CreateAuthMagicLinkInput,
+  MagicLinkRecord,
+} from "@sixb/core/storage"
+import { AuthStorageError } from "@sixb/core/storage"
+import {
+  authLockKey,
+  lockAdvisoryKeys,
+  type PgStoreClient,
+  runPgTransaction,
+} from "../transactions"
+import type { PgAuthMagicLinkRow } from "./rows"
+import { rowToMagicLinkRecord } from "./rows"
+import {
+  assertNonEmpty,
+  consumeMagicLink,
+  getMagicLinkById,
+  getMagicLinkRowById,
+  mapUniqueConstraintError,
+  normalizeEmail,
+  revokeActiveMagicLinksForEmail,
+} from "./shared"
+
+export class PgAuthMagicLinkStore implements AuthMagicLinkStore {
+  constructor(private readonly sql: PgStoreClient) {}
+
+  async create(input: CreateAuthMagicLinkInput): Promise<MagicLinkRecord> {
+    return runPgTransaction(this.sql, async (tx) => {
+      const id = assertNonEmpty(input.id, "Magic link id")
+      const projectId = assertNonEmpty(input.projectId, "Project id")
+      const strategyId = assertNonEmpty(input.strategyId, "Strategy id")
+      const audience = resolveAuthSessionAudience(input.audience)
+      const email = normalizeEmail(input.email)
+      const tokenHash = assertNonEmpty(input.tokenHash, "Magic link token hash")
+
+      await lockAdvisoryKeys(tx, [authLockKey("magic-links", projectId, email)])
+
+      if (await getMagicLinkRowById(tx, { projectId, id })) {
+        throw new AuthStorageError(
+          "duplicate_magic_link",
+          `[Sixb] Magic link '${id}' already exists for project '${projectId}'.`
+        )
+      }
+
+      await revokeActiveMagicLinksForEmail(tx, {
+        projectId,
+        email,
+        revokedAt: input.createdAt,
+      })
+
+      try {
+        const [row] = await tx<PgAuthMagicLinkRow[]>`
+          INSERT INTO auth_magic_links (
+            project_id,
+            id,
+            strategy_id,
+            audience,
+            email,
+            token_hash,
+            return_to,
+            created_at,
+            expires_at
+          ) VALUES (
+            ${projectId},
+            ${id},
+            ${strategyId},
+            ${audience},
+            ${email},
+            ${tokenHash},
+            ${input.returnTo ?? null},
+            ${input.createdAt},
+            ${input.expiresAt}
+          )
+          RETURNING *
+        `
+
+        return rowToMagicLinkRecord(row)
+      } catch (error) {
+        mapUniqueConstraintError(
+          error,
+          "duplicate_magic_link",
+          `[Sixb] Magic link '${id}' already exists for project '${projectId}'.`
+        )
+      }
+    })
+  }
+
+  async getById(params: {
+    readonly projectId: string
+    readonly id: string
+  }): Promise<MagicLinkRecord | null> {
+    return getMagicLinkById(this.sql, params)
+  }
+
+  async getActiveByEmail(params: {
+    readonly projectId: string
+    readonly email: string
+    readonly now: Date
+  }): Promise<MagicLinkRecord | null> {
+    const [row] = await this.sql<PgAuthMagicLinkRow[]>`
+      SELECT *
+      FROM auth_magic_links
+      WHERE project_id = ${params.projectId}
+        AND email = ${normalizeEmail(params.email)}
+        AND consumed_at IS NULL
+        AND revoked_at IS NULL
+        AND expires_at > ${params.now}
+      ORDER BY created_at DESC, id DESC
+      LIMIT 1
+    `
+
+    return row ? rowToMagicLinkRecord(row) : null
+  }
+
+  async consume(params: {
+    readonly projectId: string
+    readonly id: string
+    readonly tokenHash: string
+    readonly consumedAt: Date
+  }): Promise<MagicLinkRecord> {
+    return runPgTransaction(this.sql, (tx) => consumeMagicLink(tx, params))
+  }
+
+  async revokeActiveForEmail(params: {
+    readonly projectId: string
+    readonly email: string
+    readonly revokedAt: Date
+  }): Promise<readonly MagicLinkRecord[]> {
+    return runPgTransaction(this.sql, async (tx) => {
+      const email = normalizeEmail(params.email)
+      await lockAdvisoryKeys(tx, [authLockKey("magic-links", params.projectId, email)])
+      return revokeActiveMagicLinksForEmail(tx, {
+        ...params,
+        email,
+      })
+    })
+  }
+}

package/src/auth-storage/oidc-attempts.ts

@@ -0,0 +1,93 @@
+import { resolveAuthSessionAudience } from "@sixb/core"
+import type {
+  AuthOidcAuthorizationAttemptStore,
+  CreateOidcAuthorizationAttemptInput,
+  OidcAuthorizationAttemptRecord,
+} from "@sixb/core/storage"
+import { AuthStorageError } from "@sixb/core/storage"
+import { type PgStoreClient, runPgTransaction } from "../transactions"
+import type { PgAuthOidcAttemptRow } from "./rows"
+import { rowToOidcAuthorizationAttemptRecord } from "./rows"
+import {
+  assertNonEmpty,
+  consumeOidcAttempt,
+  getOidcAttemptById,
+  getOidcAttemptRowById,
+  mapUniqueConstraintError,
+} from "./shared"
+
+export class PgAuthOidcAuthorizationAttemptStore implements AuthOidcAuthorizationAttemptStore {
+  constructor(private readonly sql: PgStoreClient) {}
+
+  async create(
+    input: CreateOidcAuthorizationAttemptInput
+  ): Promise<OidcAuthorizationAttemptRecord> {
+    const id = assertNonEmpty(input.id, "OIDC authorization attempt id")
+    const projectId = assertNonEmpty(input.projectId, "Project id")
+    const strategyId = assertNonEmpty(input.strategyId, "Strategy id")
+    const audience = resolveAuthSessionAudience(input.audience)
+    const stateHash = assertNonEmpty(input.stateHash, "OIDC state hash")
+    const nonceHash = assertNonEmpty(input.nonceHash, "OIDC nonce hash")
+    const codeVerifier = assertNonEmpty(input.codeVerifier, "OIDC code verifier")
+
+    if (await getOidcAttemptRowById(this.sql, { projectId, id })) {
+      throw new AuthStorageError(
+        "duplicate_oidc_attempt",
+        `[Sixb] OIDC authorization attempt '${id}' already exists for project '${projectId}'.`
+      )
+    }
+
+    try {
+      const [row] = await this.sql<PgAuthOidcAttemptRow[]>`
+        INSERT INTO auth_oidc_authorization_attempts (
+          project_id,
+          id,
+          strategy_id,
+          audience,
+          state_hash,
+          nonce_hash,
+          code_verifier,
+          return_to,
+          created_at,
+          expires_at
+        ) VALUES (
+          ${projectId},
+          ${id},
+          ${strategyId},
+          ${audience},
+          ${stateHash},
+          ${nonceHash},
+          ${codeVerifier},
+          ${input.returnTo ?? null},
+          ${input.createdAt},
+          ${input.expiresAt}
+        )
+        RETURNING *
+      `
+
+      return rowToOidcAuthorizationAttemptRecord(row)
+    } catch (error) {
+      mapUniqueConstraintError(
+        error,
+        "duplicate_oidc_attempt",
+        `[Sixb] OIDC authorization attempt '${id}' already exists for project '${projectId}'.`
+      )
+    }
+  }
+
+  async getById(params: {
+    readonly projectId: string
+    readonly id: string
+  }): Promise<OidcAuthorizationAttemptRecord | null> {
+    return getOidcAttemptById(this.sql, params)
+  }
+
+  async consume(params: {
+    readonly projectId: string
+    readonly id: string
+    readonly stateHash: string
+    readonly consumedAt: Date
+  }): Promise<OidcAuthorizationAttemptRecord> {
+    return runPgTransaction(this.sql, (tx) => consumeOidcAttempt(tx, params))
+  }
+}