@sixb/pg 0.0.1

package/src/auth-storage/rows.ts

@@ -0,0 +1,352 @@
+import type { Principal } from "@sixb/core"
+import type {
+  AccessTokenRecord,
+  GroupMembershipRecord,
+  GroupMembershipSource,
+  InvitationRecord,
+  InvitationStatus,
+  MagicLinkRecord,
+  OidcAuthorizationAttemptRecord,
+  ServiceAccountGroupMembershipRecord,
+  ServiceAccountRecord,
+  ServiceAccountStatus,
+  SessionRecord,
+  UserIdentityRecord,
+  UserRecord,
+  UserStatus,
+} from "@sixb/core/storage"
+
+type PgDate = Date | string
+
+export interface PgAuthUserRow {
+  readonly project_id: string
+  readonly id: string
+  readonly email: string
+  readonly display_name: string | null
+  readonly avatar_url: string | null
+  readonly status: UserStatus
+  readonly created_at: PgDate
+  readonly updated_at: PgDate
+}
+
+export interface PgAuthUserIdentityRow {
+  readonly project_id: string
+  readonly strategy_id: string
+  readonly subject: string
+  readonly user_id: string
+  readonly claims: Readonly<Record<string, unknown>> | string | null
+  readonly created_at: PgDate
+  readonly updated_at: PgDate
+}
+
+export interface PgAuthServiceAccountRow {
+  readonly project_id: string
+  readonly id: string
+  readonly name: string
+  readonly description: string | null
+  readonly status: ServiceAccountStatus
+  readonly created_by_user_id: string | null
+  readonly created_by_service_account_id: string | null
+  readonly created_by_system_id: string | null
+  readonly created_by_session_id: string | null
+  readonly created_at: PgDate
+  readonly updated_at: PgDate
+}
+
+export interface PgAuthServiceAccountGroupMembershipRow {
+  readonly project_id: string
+  readonly service_account_id: string
+  readonly group_id: string
+  readonly source: GroupMembershipSource
+  readonly created_at: PgDate
+}
+
+export interface PgAuthSessionRow {
+  readonly project_id: string
+  readonly id: string
+  readonly user_id: string
+  readonly strategy_id: string
+  readonly audience: SessionRecord["audience"]
+  readonly token_hash: string
+  readonly created_at: PgDate
+  readonly expires_at: PgDate
+  readonly absolute_expires_at: PgDate | null
+  readonly revoked_at: PgDate | null
+  readonly last_seen_at: PgDate | null
+  readonly user_agent: string | null
+  readonly ip_address: string | null
+}
+
+export interface PgAuthAccessTokenRow {
+  readonly project_id: string
+  readonly id: string
+  readonly name: string
+  readonly kind: AccessTokenRecord["kind"]
+  readonly subject_type: AccessTokenRecord["subjectType"]
+  readonly subject_id: string
+  readonly token_hash: string
+  readonly group_ids: readonly string[] | string | null
+  readonly created_by_user_id: string | null
+  readonly created_by_service_account_id: string | null
+  readonly created_by_system_id: string | null
+  readonly created_by_session_id: string | null
+  readonly created_at: PgDate
+  readonly expires_at: PgDate
+  readonly revoked_at: PgDate | null
+  readonly last_used_at: PgDate | null
+  readonly last_used_user_agent: string | null
+  readonly last_used_ip_address: string | null
+}
+
+export interface PgAuthInvitationRow {
+  readonly project_id: string
+  readonly id: string
+  readonly email: string
+  readonly status: InvitationStatus
+  readonly created_by_user_id: string | null
+  readonly created_by_service_account_id: string | null
+  readonly created_by_system_id: string | null
+  readonly created_by_session_id: string | null
+  readonly created_at: PgDate
+  readonly updated_at: PgDate
+  readonly expires_at: PgDate
+  readonly accepted_at: PgDate | null
+  readonly revoked_at: PgDate | null
+}
+
+export interface PgAuthGroupMembershipRow {
+  readonly project_id: string
+  readonly user_id: string
+  readonly group_id: string
+  readonly source: GroupMembershipSource
+  readonly created_at: PgDate
+}
+
+export interface PgAuthMagicLinkRow {
+  readonly project_id: string
+  readonly id: string
+  readonly strategy_id: string
+  readonly audience: MagicLinkRecord["audience"]
+  readonly email: string
+  readonly token_hash: string
+  readonly return_to: string | null
+  readonly created_at: PgDate
+  readonly expires_at: PgDate
+  readonly consumed_at: PgDate | null
+  readonly revoked_at: PgDate | null
+}
+
+export interface PgAuthOidcAttemptRow {
+  readonly project_id: string
+  readonly id: string
+  readonly strategy_id: string
+  readonly audience: OidcAuthorizationAttemptRecord["audience"]
+  readonly state_hash: string
+  readonly nonce_hash: string
+  readonly code_verifier: string
+  readonly return_to: string | null
+  readonly created_at: PgDate
+  readonly expires_at: PgDate
+  readonly consumed_at: PgDate | null
+}
+
+export function rowToUserRecord(row: PgAuthUserRow): UserRecord {
+  return {
+    id: row.id,
+    projectId: row.project_id,
+    email: row.email,
+    displayName: row.display_name ?? undefined,
+    avatarUrl: row.avatar_url ?? undefined,
+    status: row.status,
+    createdAt: toDate(row.created_at),
+    updatedAt: toDate(row.updated_at),
+  }
+}
+
+export function rowToIdentityRecord(row: PgAuthUserIdentityRow): UserIdentityRecord {
+  return {
+    projectId: row.project_id,
+    strategyId: row.strategy_id,
+    subject: row.subject,
+    userId: row.user_id,
+    claims: parseOptionalRecord(row.claims),
+    createdAt: toDate(row.created_at),
+    updatedAt: toDate(row.updated_at),
+  }
+}
+
+export function rowToServiceAccountRecord(row: PgAuthServiceAccountRow): ServiceAccountRecord {
+  return {
+    id: row.id,
+    projectId: row.project_id,
+    name: row.name,
+    description: row.description ?? undefined,
+    status: row.status,
+    createdByPrincipal: principalFromColumns(row),
+    createdBySessionId: row.created_by_session_id ?? undefined,
+    createdAt: toDate(row.created_at),
+    updatedAt: toDate(row.updated_at),
+  }
+}
+
+export function rowToServiceAccountGroupMembershipRecord(
+  row: PgAuthServiceAccountGroupMembershipRow
+): ServiceAccountGroupMembershipRecord {
+  return {
+    projectId: row.project_id,
+    serviceAccountId: row.service_account_id,
+    groupId: row.group_id,
+    source: row.source,
+    createdAt: toDate(row.created_at),
+  }
+}
+
+export function rowToSessionRecord(row: PgAuthSessionRow): SessionRecord {
+  return {
+    id: row.id,
+    projectId: row.project_id,
+    userId: row.user_id,
+    strategyId: row.strategy_id,
+    audience: row.audience,
+    tokenHash: row.token_hash,
+    createdAt: toDate(row.created_at),
+    expiresAt: toDate(row.expires_at),
+    absoluteExpiresAt: row.absolute_expires_at ? toDate(row.absolute_expires_at) : undefined,
+    revokedAt: row.revoked_at ? toDate(row.revoked_at) : undefined,
+    lastSeenAt: row.last_seen_at ? toDate(row.last_seen_at) : undefined,
+    userAgent: row.user_agent ?? undefined,
+    ipAddress: row.ip_address ?? undefined,
+  }
+}
+
+export function rowToAccessTokenRecord(row: PgAuthAccessTokenRow): AccessTokenRecord {
+  return {
+    id: row.id,
+    projectId: row.project_id,
+    name: row.name,
+    kind: row.kind,
+    subjectType: row.subject_type,
+    subjectId: row.subject_id,
+    tokenHash: row.token_hash,
+    groupIds: parseOptionalStringArray(row.group_ids),
+    createdByPrincipal: principalFromColumns(row),
+    createdBySessionId: row.created_by_session_id ?? undefined,
+    createdAt: toDate(row.created_at),
+    expiresAt: toDate(row.expires_at),
+    revokedAt: row.revoked_at ? toDate(row.revoked_at) : undefined,
+    lastUsedAt: row.last_used_at ? toDate(row.last_used_at) : undefined,
+    lastUsedUserAgent: row.last_used_user_agent ?? undefined,
+    lastUsedIpAddress: row.last_used_ip_address ?? undefined,
+  }
+}
+
+export function rowToInvitationRecord(
+  row: PgAuthInvitationRow,
+  groupIds: readonly string[]
+): InvitationRecord {
+  return {
+    id: row.id,
+    projectId: row.project_id,
+    email: row.email,
+    groupIds,
+    status: row.status,
+    createdByPrincipal: invitationCreatorFromRow(row),
+    createdBySessionId: row.created_by_session_id ?? undefined,
+    createdAt: toDate(row.created_at),
+    updatedAt: toDate(row.updated_at),
+    expiresAt: toDate(row.expires_at),
+    acceptedAt: row.accepted_at ? toDate(row.accepted_at) : undefined,
+    revokedAt: row.revoked_at ? toDate(row.revoked_at) : undefined,
+  }
+}
+
+export function rowToGroupMembershipRecord(row: PgAuthGroupMembershipRow): GroupMembershipRecord {
+  return {
+    projectId: row.project_id,
+    userId: row.user_id,
+    groupId: row.group_id,
+    source: row.source,
+    createdAt: toDate(row.created_at),
+  }
+}
+
+export function rowToMagicLinkRecord(row: PgAuthMagicLinkRow): MagicLinkRecord {
+  return {
+    id: row.id,
+    projectId: row.project_id,
+    strategyId: row.strategy_id,
+    audience: row.audience,
+    email: row.email,
+    tokenHash: row.token_hash,
+    returnTo: row.return_to ?? undefined,
+    createdAt: toDate(row.created_at),
+    expiresAt: toDate(row.expires_at),
+    consumedAt: row.consumed_at ? toDate(row.consumed_at) : undefined,
+    revokedAt: row.revoked_at ? toDate(row.revoked_at) : undefined,
+  }
+}
+
+export function rowToOidcAuthorizationAttemptRecord(
+  row: PgAuthOidcAttemptRow
+): OidcAuthorizationAttemptRecord {
+  return {
+    id: row.id,
+    projectId: row.project_id,
+    strategyId: row.strategy_id,
+    audience: row.audience,
+    stateHash: row.state_hash,
+    nonceHash: row.nonce_hash,
+    codeVerifier: row.code_verifier,
+    returnTo: row.return_to ?? undefined,
+    createdAt: toDate(row.created_at),
+    expiresAt: toDate(row.expires_at),
+    consumedAt: row.consumed_at ? toDate(row.consumed_at) : undefined,
+  }
+}
+
+export function serializeOptionalRecord(
+  value: Readonly<Record<string, unknown>> | undefined
+): string | null {
+  return value ? JSON.stringify(value) : null
+}
+
+export function serializeOptionalStringArray(value: readonly string[] | undefined): string | null {
+  return value === undefined ? null : JSON.stringify(value)
+}
+
+function principalFromColumns(row: {
+  readonly created_by_user_id: string | null
+  readonly created_by_service_account_id: string | null
+  readonly created_by_system_id: string | null
+}): Principal | undefined {
+  if (row.created_by_user_id) return { type: "user", id: row.created_by_user_id }
+  if (row.created_by_service_account_id) {
+    return { type: "serviceAccount", id: row.created_by_service_account_id }
+  }
+  if (row.created_by_system_id) return { type: "system", id: row.created_by_system_id }
+  return undefined
+}
+
+function invitationCreatorFromRow(row: PgAuthInvitationRow): Principal | undefined {
+  return principalFromColumns(row)
+}
+
+function parseOptionalRecord(
+  value: Readonly<Record<string, unknown>> | string | null
+): Readonly<Record<string, unknown>> | undefined {
+  if (!value) return undefined
+  if (typeof value === "string") return JSON.parse(value) as Readonly<Record<string, unknown>>
+  return structuredClone(value)
+}
+
+function parseOptionalStringArray(
+  value: readonly string[] | string | null
+): readonly string[] | undefined {
+  if (value === null) return undefined
+  if (typeof value === "string") return JSON.parse(value) as readonly string[]
+  return [...value]
+}
+
+function toDate(value: PgDate): Date {
+  return value instanceof Date ? new Date(value) : new Date(value)
+}

package/src/auth-storage/service-account-group-memberships.ts

@@ -0,0 +1,150 @@
+import type {
+  AuthServiceAccountGroupMembershipStore,
+  ReconcileAuthServiceAccountGroupMembershipsInput,
+  ServiceAccountGroupMembershipRecord,
+  UpsertAuthServiceAccountGroupMembershipInput,
+} from "@sixb/core/storage"
+import { AuthStorageError } from "@sixb/core/storage"
+import type { PgStoreClient } from "../transactions"
+import type { PgAuthServiceAccountGroupMembershipRow, PgAuthServiceAccountRow } from "./rows"
+import { rowToServiceAccountGroupMembershipRecord } from "./rows"
+import { assertNonEmpty, dateOrNow } from "./shared"
+
+export class PgAuthServiceAccountGroupMembershipStore
+  implements AuthServiceAccountGroupMembershipStore
+{
+  constructor(private readonly sql: PgStoreClient) {}
+
+  async upsert(
+    input: UpsertAuthServiceAccountGroupMembershipInput
+  ): Promise<ServiceAccountGroupMembershipRecord> {
+    const projectId = assertNonEmpty(input.projectId, "Project id")
+    const serviceAccountId = assertNonEmpty(input.serviceAccountId, "Service account id")
+    const groupId = assertNonEmpty(input.groupId, "Group id")
+    const [serviceAccount] = await this.sql<PgAuthServiceAccountRow[]>`
+      SELECT *
+      FROM auth_service_accounts
+      WHERE project_id = ${projectId}
+        AND id = ${serviceAccountId}
+    `
+    if (!serviceAccount) {
+      throw new AuthStorageError(
+        "missing_service_account",
+        `[Sixb] Service account '${serviceAccountId}' not found for project '${projectId}'.`
+      )
+    }
+
+    const [row] = await this.sql<PgAuthServiceAccountGroupMembershipRow[]>`
+      INSERT INTO auth_service_account_group_memberships (
+        project_id,
+        service_account_id,
+        group_id,
+        source,
+        created_at
+      ) VALUES (
+        ${projectId},
+        ${serviceAccountId},
+        ${groupId},
+        ${input.source},
+        ${dateOrNow(input.createdAt)}
+      )
+      ON CONFLICT (project_id, service_account_id, group_id) DO UPDATE
+      SET source = auth_service_account_group_memberships.source
+      RETURNING *
+    `
+
+    return rowToServiceAccountGroupMembershipRecord(row)
+  }
+
+  async reconcileForServiceAccount(
+    input: ReconcileAuthServiceAccountGroupMembershipsInput
+  ): Promise<readonly ServiceAccountGroupMembershipRecord[]> {
+    const projectId = assertNonEmpty(input.projectId, "Project id")
+    const serviceAccountId = assertNonEmpty(input.serviceAccountId, "Service account id")
+    const groupIds = [
+      ...new Set(input.groupIds.map((groupId) => assertNonEmpty(groupId, "Group id"))),
+    ]
+    const [serviceAccount] = await this.sql<PgAuthServiceAccountRow[]>`
+      SELECT *
+      FROM auth_service_accounts
+      WHERE project_id = ${projectId}
+        AND id = ${serviceAccountId}
+    `
+    if (!serviceAccount) {
+      throw new AuthStorageError(
+        "missing_service_account",
+        `[Sixb] Service account '${serviceAccountId}' not found for project '${projectId}'.`
+      )
+    }
+
+    if (groupIds.length === 0) {
+      await this.sql`
+        DELETE FROM auth_service_account_group_memberships
+        WHERE project_id = ${projectId}
+          AND service_account_id = ${serviceAccountId}
+          AND source = ${input.source}
+      `
+    } else {
+      await this.sql`
+        DELETE FROM auth_service_account_group_memberships
+        WHERE project_id = ${projectId}
+          AND service_account_id = ${serviceAccountId}
+          AND source = ${input.source}
+          AND group_id NOT IN ${this.sql(groupIds)}
+      `
+    }
+
+    const updatedAt = dateOrNow(input.updatedAt)
+    for (const groupId of groupIds) {
+      await this.sql<PgAuthServiceAccountGroupMembershipRow[]>`
+        INSERT INTO auth_service_account_group_memberships (
+          project_id,
+          service_account_id,
+          group_id,
+          source,
+          created_at
+        ) VALUES (
+          ${projectId},
+          ${serviceAccountId},
+          ${groupId},
+          ${input.source},
+          ${updatedAt}
+        )
+        ON CONFLICT (project_id, service_account_id, group_id) DO UPDATE
+        SET source = EXCLUDED.source
+      `
+    }
+
+    return this.listForServiceAccount({ projectId, serviceAccountId })
+  }
+
+  async listForServiceAccount(params: {
+    readonly projectId: string
+    readonly serviceAccountId: string
+  }): Promise<readonly ServiceAccountGroupMembershipRecord[]> {
+    const rows = await this.sql<PgAuthServiceAccountGroupMembershipRow[]>`
+      SELECT *
+      FROM auth_service_account_group_memberships
+      WHERE project_id = ${params.projectId}
+        AND service_account_id = ${params.serviceAccountId}
+      ORDER BY group_id ASC
+    `
+
+    return rows.map(rowToServiceAccountGroupMembershipRecord)
+  }
+
+  async listForGroup(params: {
+    readonly projectId: string
+    readonly groupId: string
+  }): Promise<readonly ServiceAccountGroupMembershipRecord[]> {
+    const rows = await this.sql<PgAuthServiceAccountGroupMembershipRow[]>`
+      SELECT *
+      FROM auth_service_account_group_memberships
+      WHERE project_id = ${params.projectId}
+        AND group_id = ${params.groupId}
+      ORDER BY service_account_id ASC
+    `
+
+    return rows.map(rowToServiceAccountGroupMembershipRecord)
+  }
+}

package/src/auth-storage/service-accounts.ts

@@ -0,0 +1,154 @@
+import type {
+  AuthServiceAccountStore,
+  CreateAuthServiceAccountInput,
+  ListAuthServiceAccountsInput,
+  ListAuthServiceAccountsResult,
+  ServiceAccountRecord,
+  UpdateAuthServiceAccountInput,
+} from "@sixb/core/storage"
+import { AuthStorageError } from "@sixb/core/storage"
+import type { PgStoreClient } from "../transactions"
+import type { PgAuthServiceAccountRow } from "./rows"
+import { rowToServiceAccountRecord } from "./rows"
+import {
+  appendPagination,
+  assertNonEmpty,
+  dateOrNow,
+  hasEmptyFilter,
+  mapUniqueConstraintError,
+  type PgValue,
+} from "./shared"
+
+export class PgAuthServiceAccountStore implements AuthServiceAccountStore {
+  constructor(private readonly sql: PgStoreClient) {}
+
+  async create(input: CreateAuthServiceAccountInput): Promise<ServiceAccountRecord> {
+    const id = assertNonEmpty(input.id, "Service account id")
+    const projectId = assertNonEmpty(input.projectId, "Project id")
+    const name = assertNonEmpty(input.name, "Service account name")
+    const createdAt = dateOrNow(input.createdAt)
+    const updatedAt = input.updatedAt ? new Date(input.updatedAt) : createdAt
+
+    try {
+      const [row] = await this.sql<PgAuthServiceAccountRow[]>`
+        INSERT INTO auth_service_accounts (
+          project_id,
+          id,
+          name,
+          description,
+          status,
+          created_by_user_id,
+          created_by_service_account_id,
+          created_by_system_id,
+          created_by_session_id,
+          created_at,
+          updated_at
+        ) VALUES (
+          ${projectId},
+          ${id},
+          ${name},
+          ${input.description ?? null},
+          ${input.status ?? "active"},
+          ${input.createdByPrincipal?.type === "user" ? input.createdByPrincipal.id : null},
+          ${
+            input.createdByPrincipal?.type === "serviceAccount" ? input.createdByPrincipal.id : null
+          },
+          ${input.createdByPrincipal?.type === "system" ? input.createdByPrincipal.id : null},
+          ${input.createdBySessionId ?? null},
+          ${createdAt},
+          ${updatedAt}
+        )
+        RETURNING *
+      `
+
+      return rowToServiceAccountRecord(row)
+    } catch (error) {
+      mapUniqueConstraintError(
+        error,
+        "duplicate_service_account",
+        `[Sixb] Service account '${id}' already exists for project '${projectId}'.`
+      )
+    }
+  }
+
+  async getById(params: {
+    readonly projectId: string
+    readonly id: string
+  }): Promise<ServiceAccountRecord | null> {
+    const [row] = await this.sql<PgAuthServiceAccountRow[]>`
+      SELECT *
+      FROM auth_service_accounts
+      WHERE project_id = ${params.projectId}
+        AND id = ${params.id}
+    `
+    return row ? rowToServiceAccountRecord(row) : null
+  }
+
+  async update(input: UpdateAuthServiceAccountInput): Promise<ServiceAccountRecord> {
+    const existing = await this.getById(input)
+    if (!existing) {
+      throw new AuthStorageError(
+        "missing_service_account",
+        `[Sixb] Service account '${input.id}' not found for project '${input.projectId}'.`
+      )
+    }
+
+    const updatedAt = dateOrNow(input.updatedAt)
+    const name =
+      input.name === undefined ? existing.name : assertNonEmpty(input.name, "Service account name")
+    const description = input.description === undefined ? existing.description : input.description
+    const [row] = await this.sql<PgAuthServiceAccountRow[]>`
+      UPDATE auth_service_accounts
+      SET name = ${name},
+          description = ${description ?? null},
+          status = ${input.status ?? existing.status},
+          updated_at = ${updatedAt}
+      WHERE project_id = ${input.projectId}
+        AND id = ${input.id}
+      RETURNING *
+    `
+
+    return rowToServiceAccountRecord(row)
+  }
+
+  async list(input: ListAuthServiceAccountsInput): Promise<ListAuthServiceAccountsResult> {
+    if (hasEmptyFilter(input.statuses)) {
+      return { serviceAccounts: [], hasMore: false, total: 0 }
+    }
+
+    const whereClauses = ["project_id = $1"]
+    const params: PgValue[] = [input.projectId]
+    let nextIndex = 2
+    if (input.statuses) {
+      whereClauses.push(`status IN (${input.statuses.map(() => `$${nextIndex++}`).join(", ")})`)
+      params.push(...input.statuses)
+    }
+
+    const where = `WHERE ${whereClauses.join(" AND ")}`
+    const order = input.order === "desc" ? "DESC" : "ASC"
+    const [totalRow] = await this.sql.unsafe<{ readonly count: string | number }[]>(
+      `SELECT COUNT(*)::bigint AS count FROM auth_service_accounts ${where}`,
+      [...params]
+    )
+    const queryParams = [...params]
+    const query = appendPagination(
+      `
+        SELECT *
+        FROM auth_service_accounts
+        ${where}
+        ORDER BY created_at ${order}, id ${order}
+      `,
+      queryParams,
+      nextIndex,
+      input
+    )
+    const rows = await this.sql.unsafe<PgAuthServiceAccountRow[]>(query, queryParams)
+    const total = Number(totalRow?.count ?? 0)
+
+    return {
+      serviceAccounts: rows.map(rowToServiceAccountRecord),
+      hasMore: input.limit === undefined ? false : (input.offset ?? 0) + input.limit < total,
+      total,
+    }
+  }
+}