@sixb/pg 0.1.13 → 0.1.14
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/dist/auth-storage/auth-storage.d.ts +2 -1
- package/dist/auth-storage/auth-storage.d.ts.map +1 -1
- package/dist/auth-storage/rows.d.ts +1 -1
- package/dist/auth-storage/rows.d.ts.map +1 -1
- package/dist/index.js +39 -47
- package/dist/index.js.map +5 -5
- package/dist/migrations.d.ts.map +1 -1
- package/package.json +3 -3
- package/src/auth-storage/auth-storage.ts +43 -75
- package/src/auth-storage/rows.ts +1 -1
- package/src/migrations/050-directory-group-memberships.sql +5 -0
- package/src/migrations.ts +4 -0
|
@@ -36,7 +36,8 @@ export declare class PgAuthStorage implements AuthStorage {
|
|
|
36
36
|
private assertOidcAttemptUsable;
|
|
37
37
|
private insertUser;
|
|
38
38
|
private acceptInvitationAndApplyGroups;
|
|
39
|
-
private
|
|
39
|
+
private applyGroups;
|
|
40
|
+
private syncDirectoryGroups;
|
|
40
41
|
private createSignInSession;
|
|
41
42
|
private consumeOidcAttempt;
|
|
42
43
|
private upsertIdentity;
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"auth-storage.d.ts","sourceRoot":"","sources":["../../src/auth-storage/auth-storage.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EACV,WAAW,EACX,gCAAgC,EAChC,iCAAiC,EACjC,4BAA4B,EAC5B,uBAAuB,EACvB,oBAAoB,
|
|
1
|
+
{"version":3,"file":"auth-storage.d.ts","sourceRoot":"","sources":["../../src/auth-storage/auth-storage.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EACV,WAAW,EACX,gCAAgC,EAChC,iCAAiC,EACjC,4BAA4B,EAC5B,uBAAuB,EACvB,oBAAoB,EAMpB,iCAAiC,EAEjC,UAAU,EACX,MAAM,oBAAoB,CAAA;AAG3B,OAAO,EAGL,KAAK,aAAa,EAEnB,MAAM,iBAAiB,CAAA;AACxB,OAAO,EAAE,sBAAsB,EAAE,MAAM,iBAAiB,CAAA;AACxD,OAAO,EAEL,8BAA8B,EAC/B,MAAM,yBAAyB,CAAA;AAChC,OAAO,EAAE,0BAA0B,EAAE,MAAM,qBAAqB,CAAA;AAChE,OAAO,EAAE,uBAAuB,EAAE,MAAM,cAAc,CAAA;AACtD,OAAO,EAAE,qBAAqB,EAAE,MAAM,eAAe,CAAA;AACrD,OAAO,EAAE,oBAAoB,EAAE,MAAM,eAAe,CAAA;AACpD,OAAO,EAAE,mCAAmC,EAAE,MAAM,iBAAiB,CAAA;AAQrE,OAAO,EAAE,wCAAwC,EAAE,MAAM,qCAAqC,CAAA;AAC9F,OAAO,EAAE,yBAAyB,EAAE,MAAM,oBAAoB,CAAA;AAC9D,OAAO,EAAE,kBAAkB,EAAE,MAAM,YAAY,CAAA;AAqB/C,OAAO,EAAE,eAAe,EAAE,MAAM,SAAS,CAAA;AAMzC,MAAM,WAAW,oBAAoB;IACnC,QAAQ,CAAC,GAAG,EAAE,aAAa,CAAA;CAC5B;AAED,qBAAa,aAAc,YAAW,WAAW;IAC/C,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAe;IAEnC,QAAQ,CAAC,KAAK,EAAE,eAAe,CAAA;IAC/B,QAAQ,CAAC,UAAU,EAAE,uBAAuB,CAAA;IAC5C,QAAQ,CAAC,eAAe,EAAE,yBAAyB,CAAA;IACnD,QAAQ,CAAC,8BAA8B,EAAE,wCAAwC,CAAA;IACjF,QAAQ,CAAC,QAAQ,EAAE,kBAAkB,CAAA;IACrC,QAAQ,CAAC,YAAY,EAAE,sBAAsB,CAAA;IAC7C,QAAQ,CAAC,WAAW,EAAE,qBAAqB,CAAA;IAC3C,QAAQ,CAAC,gBAAgB,EAAE,0BAA0B,CAAA;IACrD,QAAQ,CAAC,UAAU,EAAE,oBAAoB,CAAA;IACzC,QAAQ,CAAC,yBAAyB,EAAE,mCAAmC,CAAA;IACvE,QAAQ,CAAC,oBAAoB,EAAE,8BAA8B,CAAA;gBAEjD,OAAO,EAAE,oBAAoB;IAenC,2BAA2B,CAC/B,KAAK,EAAE,gCAAgC,GACtC,OAAO,CAAC,iCAAiC,CAAC;IAkCvC,uBAAuB,CAC3B,KAAK,EAAE,4BAA4B,GAClC,OAAO,CAAC,oBAAoB,CAAC;IAqK1B,kBAAkB,CAAC,KAAK,EAAE,uBAAuB,GAAG,OAAO,CAAC,oBAAoB,CAAC;IAwLjF,4BAA4B,CAChC,KAAK,EAAE,iCAAiC,GACvC,OAAO,CAAC,UAAU,CAAC;IAsCtB,OAAO,CAAC,qBAAqB;IAiB7B,OAAO,CAAC,uBAAuB;YAiBjB,UAAU;YA6CV,8BAA8B;YA+C9B,WAAW;YA6BX,mBAAmB;YA0BnB,mBAAmB;YA6BnB,kBAAkB;YAclB,cAAc;CAwC7B"}
|
|
@@ -36,7 +36,7 @@ export interface PgAuthServiceAccountGroupMembershipRow {
|
|
|
36
36
|
readonly project_id: string;
|
|
37
37
|
readonly service_account_id: string;
|
|
38
38
|
readonly group_id: string;
|
|
39
|
-
readonly source:
|
|
39
|
+
readonly source: ServiceAccountGroupMembershipRecord["source"];
|
|
40
40
|
readonly created_at: PgDate;
|
|
41
41
|
}
|
|
42
42
|
export interface PgAuthSessionRow {
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"rows.d.ts","sourceRoot":"","sources":["../../src/auth-storage/rows.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EACV,iBAAiB,EACjB,yBAAyB,EACzB,qBAAqB,EACrB,qBAAqB,EACrB,gBAAgB,EAChB,gBAAgB,EAChB,eAAe,EACf,8BAA8B,EAC9B,mCAAmC,EACnC,oBAAoB,EACpB,oBAAoB,EACpB,aAAa,EACb,kBAAkB,EAClB,UAAU,EACV,UAAU,EACX,MAAM,oBAAoB,CAAA;AAE3B,KAAK,MAAM,GAAG,IAAI,GAAG,MAAM,CAAA;AAE3B,MAAM,WAAW,aAAa;IAC5B,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAA;IAC3B,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAA;IACnB,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAA;IACtB,QAAQ,CAAC,YAAY,EAAE,MAAM,GAAG,IAAI,CAAA;IACpC,QAAQ,CAAC,UAAU,EAAE,MAAM,GAAG,IAAI,CAAA;IAClC,QAAQ,CAAC,MAAM,EAAE,UAAU,CAAA;IAC3B,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAA;IAC3B,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAA;CAC5B;AAED,MAAM,WAAW,qBAAqB;IACpC,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAA;IAC3B,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAA;IAC5B,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAA;IACxB,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAA;IACxB,QAAQ,CAAC,MAAM,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,GAAG,MAAM,GAAG,IAAI,CAAA;IAClE,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAA;IAC3B,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAA;CAC5B;AAED,MAAM,WAAW,uBAAuB;IACtC,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAA;IAC3B,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAA;IACnB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;IACrB,QAAQ,CAAC,WAAW,EAAE,MAAM,GAAG,IAAI,CAAA;IACnC,QAAQ,CAAC,MAAM,EAAE,oBAAoB,CAAA;IACrC,QAAQ,CAAC,kBAAkB,EAAE,MAAM,GAAG,IAAI,CAAA;IAC1C,QAAQ,CAAC,6BAA6B,EAAE,MAAM,GAAG,IAAI,CAAA;IACrD,QAAQ,CAAC,oBAAoB,EAAE,MAAM,GAAG,IAAI,CAAA;IAC5C,QAAQ,CAAC,qBAAqB,EAAE,MAAM,GAAG,IAAI,CAAA;IAC7C,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAA;IAC3B,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAA;CAC5B;AAED,MAAM,WAAW,sCAAsC;IACrD,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAA;IAC3B,QAAQ,CAAC,kBAAkB,EAAE,MAAM,CAAA;IACnC,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAA;IACzB,QAAQ,CAAC,MAAM,EAAE,
|
|
1
|
+
{"version":3,"file":"rows.d.ts","sourceRoot":"","sources":["../../src/auth-storage/rows.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EACV,iBAAiB,EACjB,yBAAyB,EACzB,qBAAqB,EACrB,qBAAqB,EACrB,gBAAgB,EAChB,gBAAgB,EAChB,eAAe,EACf,8BAA8B,EAC9B,mCAAmC,EACnC,oBAAoB,EACpB,oBAAoB,EACpB,aAAa,EACb,kBAAkB,EAClB,UAAU,EACV,UAAU,EACX,MAAM,oBAAoB,CAAA;AAE3B,KAAK,MAAM,GAAG,IAAI,GAAG,MAAM,CAAA;AAE3B,MAAM,WAAW,aAAa;IAC5B,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAA;IAC3B,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAA;IACnB,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAA;IACtB,QAAQ,CAAC,YAAY,EAAE,MAAM,GAAG,IAAI,CAAA;IACpC,QAAQ,CAAC,UAAU,EAAE,MAAM,GAAG,IAAI,CAAA;IAClC,QAAQ,CAAC,MAAM,EAAE,UAAU,CAAA;IAC3B,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAA;IAC3B,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAA;CAC5B;AAED,MAAM,WAAW,qBAAqB;IACpC,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAA;IAC3B,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAA;IAC5B,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAA;IACxB,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAA;IACxB,QAAQ,CAAC,MAAM,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,GAAG,MAAM,GAAG,IAAI,CAAA;IAClE,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAA;IAC3B,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAA;CAC5B;AAED,MAAM,WAAW,uBAAuB;IACtC,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAA;IAC3B,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAA;IACnB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;IACrB,QAAQ,CAAC,WAAW,EAAE,MAAM,GAAG,IAAI,CAAA;IACnC,QAAQ,CAAC,MAAM,EAAE,oBAAoB,CAAA;IACrC,QAAQ,CAAC,kBAAkB,EAAE,MAAM,GAAG,IAAI,CAAA;IAC1C,QAAQ,CAAC,6BAA6B,EAAE,MAAM,GAAG,IAAI,CAAA;IACrD,QAAQ,CAAC,oBAAoB,EAAE,MAAM,GAAG,IAAI,CAAA;IAC5C,QAAQ,CAAC,qBAAqB,EAAE,MAAM,GAAG,IAAI,CAAA;IAC7C,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAA;IAC3B,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAA;CAC5B;AAED,MAAM,WAAW,sCAAsC;IACrD,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAA;IAC3B,QAAQ,CAAC,kBAAkB,EAAE,MAAM,CAAA;IACnC,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAA;IACzB,QAAQ,CAAC,MAAM,EAAE,mCAAmC,CAAC,QAAQ,CAAC,CAAA;IAC9D,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAA;CAC5B;AAED,MAAM,WAAW,gBAAgB;IAC/B,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAA;IAC3B,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAA;IACnB,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAA;IACxB,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAA;IAC5B,QAAQ,CAAC,QAAQ,EAAE,aAAa,CAAC,UAAU,CAAC,CAAA;IAC5C,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAA;IAC3B,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAA;IAC3B,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAA;IAC3B,QAAQ,CAAC,mBAAmB,EAAE,MAAM,GAAG,IAAI,CAAA;IAC3C,QAAQ,CAAC,UAAU,EAAE,MAAM,GAAG,IAAI,CAAA;IAClC,QAAQ,CAAC,YAAY,EAAE,MAAM,GAAG,IAAI,CAAA;IACpC,QAAQ,CAAC,UAAU,EAAE,MAAM,GAAG,IAAI,CAAA;IAClC,QAAQ,CAAC,UAAU,EAAE,MAAM,GAAG,IAAI,CAAA;IAClC,QAAQ,CAAC,WAAW,EAAE,MAAM,GAAG,IAAI,CAAA;IACnC,QAAQ,CAAC,iBAAiB,EAAE,MAAM,GAAG,IAAI,CAAA;IACzC,QAAQ,CAAC,kBAAkB,EAAE,MAAM,GAAG,IAAI,CAAA;IAC1C,QAAQ,CAAC,2BAA2B,EAAE,MAAM,GAAG,IAAI,CAAA;IACnD,QAAQ,CAAC,YAAY,EAAE,MAAM,GAAG,IAAI,CAAA;CACrC;AAED,MAAM,WAAW,oBAAoB;IACnC,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAA;IAC3B,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAA;IACnB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;IACrB,QAAQ,CAAC,IAAI,EAAE,iBAAiB,CAAC,MAAM,CAAC,CAAA;IACxC,QAAQ,CAAC,YAAY,EAAE,iBAAiB,CAAC,SAAS,CAAC,CAAC,MAAM,CAAC,CAAA;IAC3D,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAA;IAC3B,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAA;IAC3B,QAAQ,CAAC,SAAS,EAAE,SAAS,MAAM,EAAE,GAAG,MAAM,GAAG,IAAI,CAAA;IACrD,QAAQ,CAAC,kBAAkB,EAAE,MAAM,GAAG,IAAI,CAAA;IAC1C,QAAQ,CAAC,6BAA6B,EAAE,MAAM,GAAG,IAAI,CAAA;IACrD,QAAQ,CAAC,oBAAoB,EAAE,MAAM,GAAG,IAAI,CAAA;IAC5C,QAAQ,CAAC,qBAAqB,EAAE,MAAM,GAAG,IAAI,CAAA;IAC7C,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAA;IAC3B,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAA;IAC3B,QAAQ,CAAC,UAAU,EAAE,MAAM,GAAG,IAAI,CAAA;IAClC,QAAQ,CAAC,YAAY,EAAE,MAAM,GAAG,IAAI,CAAA;IACpC,QAAQ,CAAC,oBAAoB,EAAE,MAAM,GAAG,IAAI,CAAA;IAC5C,QAAQ,CAAC,oBAAoB,EAAE,MAAM,GAAG,IAAI,CAAA;CAC7C;AAED,MAAM,WAAW,mBAAmB;IAClC,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAA;IAC3B,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAA;IACnB,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAA;IACtB,QAAQ,CAAC,MAAM,EAAE,gBAAgB,CAAA;IACjC,QAAQ,CAAC,kBAAkB,EAAE,MAAM,GAAG,IAAI,CAAA;IAC1C,QAAQ,CAAC,6BAA6B,EAAE,MAAM,GAAG,IAAI,CAAA;IACrD,QAAQ,CAAC,oBAAoB,EAAE,MAAM,GAAG,IAAI,CAAA;IAC5C,QAAQ,CAAC,qBAAqB,EAAE,MAAM,GAAG,IAAI,CAAA;IAC7C,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAA;IAC3B,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAA;IAC3B,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAA;IAC3B,QAAQ,CAAC,WAAW,EAAE,MAAM,GAAG,IAAI,CAAA;IACnC,QAAQ,CAAC,UAAU,EAAE,MAAM,GAAG,IAAI,CAAA;CACnC;AAED,MAAM,WAAW,wBAAwB;IACvC,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAA;IAC3B,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAA;IACxB,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAA;IACzB,QAAQ,CAAC,MAAM,EAAE,qBAAqB,CAAA;IACtC,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAA;CAC5B;AAED,MAAM,WAAW,kBAAkB;IACjC,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAA;IAC3B,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAA;IACnB,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAA;IAC5B,QAAQ,CAAC,QAAQ,EAAE,eAAe,CAAC,UAAU,CAAC,CAAA;IAC9C,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAA;IACtB,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAA;IAC3B,QAAQ,CAAC,SAAS,EAAE,MAAM,GAAG,IAAI,CAAA;IACjC,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAA;IAC3B,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAA;IAC3B,QAAQ,CAAC,WAAW,EAAE,MAAM,GAAG,IAAI,CAAA;IACnC,QAAQ,CAAC,UAAU,EAAE,MAAM,GAAG,IAAI,CAAA;CACnC;AAED,MAAM,WAAW,oBAAoB;IACnC,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAA;IAC3B,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAA;IACnB,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAA;IAC5B,QAAQ,CAAC,QAAQ,EAAE,8BAA8B,CAAC,UAAU,CAAC,CAAA;IAC7D,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAA;IAC3B,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAA;IAC3B,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAA;IAC9B,QAAQ,CAAC,SAAS,EAAE,MAAM,GAAG,IAAI,CAAA;IACjC,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAA;IAC3B,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAA;IAC3B,QAAQ,CAAC,WAAW,EAAE,MAAM,GAAG,IAAI,CAAA;CACpC;AAED,MAAM,WAAW,4BAA4B;IAC3C,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAA;IAC3B,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAA;IACnB,QAAQ,CAAC,gBAAgB,EAAE,MAAM,CAAA;IACjC,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAA;IAC1B,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAA;IAC5B,QAAQ,CAAC,MAAM,EAAE,yBAAyB,CAAC,QAAQ,CAAC,CAAA;IACpD,QAAQ,CAAC,gBAAgB,EAAE,MAAM,GAAG,IAAI,CAAA;IACxC,QAAQ,CAAC,mBAAmB,EAAE,MAAM,GAAG,IAAI,CAAA;IAC3C,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAA;IAC3B,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAA;IAC3B,QAAQ,CAAC,WAAW,EAAE,MAAM,GAAG,IAAI,CAAA;IACnC,QAAQ,CAAC,SAAS,EAAE,MAAM,GAAG,IAAI,CAAA;IACjC,QAAQ,CAAC,WAAW,EAAE,MAAM,GAAG,IAAI,CAAA;CACpC;AAED,wBAAgB,eAAe,CAAC,GAAG,EAAE,aAAa,GAAG,UAAU,CAW9D;AAED,wBAAgB,mBAAmB,CAAC,GAAG,EAAE,qBAAqB,GAAG,kBAAkB,CAUlF;AAED,wBAAgB,yBAAyB,CAAC,GAAG,EAAE,uBAAuB,GAAG,oBAAoB,CAY5F;AAED,wBAAgB,wCAAwC,CACtD,GAAG,EAAE,sCAAsC,GAC1C,mCAAmC,CAQrC;AAED,wBAAgB,kBAAkB,CAAC,GAAG,EAAE,gBAAgB,GAAG,aAAa,CA0BvE;AAED,wBAAgB,sBAAsB,CAAC,GAAG,EAAE,oBAAoB,GAAG,iBAAiB,CAkBnF;AAED,wBAAgB,qBAAqB,CACnC,GAAG,EAAE,mBAAmB,EACxB,QAAQ,EAAE,SAAS,MAAM,EAAE,GAC1B,gBAAgB,CAelB;AAED,wBAAgB,0BAA0B,CAAC,GAAG,EAAE,wBAAwB,GAAG,qBAAqB,CAQ/F;AAED,wBAAgB,oBAAoB,CAAC,GAAG,EAAE,kBAAkB,GAAG,eAAe,CAc7E;AAED,wBAAgB,mCAAmC,CACjD,GAAG,EAAE,oBAAoB,GACxB,8BAA8B,CAchC;AAED,wBAAgB,8BAA8B,CAC5C,GAAG,EAAE,4BAA4B,GAChC,yBAAyB,CAgB3B;AAED,wBAAgB,uBAAuB,CACrC,KAAK,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,GAAG,SAAS,GACnD,MAAM,GAAG,IAAI,CAEf;AAED,wBAAgB,4BAA4B,CAAC,KAAK,EAAE,SAAS,MAAM,EAAE,GAAG,SAAS,GAAG,MAAM,GAAG,IAAI,CAEhG"}
|
package/dist/index.js
CHANGED
|
@@ -3055,17 +3055,6 @@ class PgAuthStorage {
|
|
|
3055
3055
|
error: new AuthStorageError11("user_creation_not_allowed", `[Sixb] Magic link '${input.magicLinkId}' cannot create a user for project '${projectId}'.`)
|
|
3056
3056
|
};
|
|
3057
3057
|
}
|
|
3058
|
-
if (shouldCreateUser && !activeInvitation && input.allowUserCreationWithoutInvitation && input.requireNoActiveUsersForUserCreation && await hasActiveUsers(tx, projectId)) {
|
|
3059
|
-
await consumeMagicLink(tx, {
|
|
3060
|
-
projectId,
|
|
3061
|
-
id: input.magicLinkId,
|
|
3062
|
-
tokenHash: input.tokenHash,
|
|
3063
|
-
consumedAt: completedAt
|
|
3064
|
-
});
|
|
3065
|
-
return {
|
|
3066
|
-
error: new AuthStorageError11("user_creation_not_allowed", `[Sixb] Magic link '${input.magicLinkId}' cannot create a user for project '${projectId}'.`)
|
|
3067
|
-
};
|
|
3068
|
-
}
|
|
3069
3058
|
await validateCompleteSessionInput(tx, projectId, input.session);
|
|
3070
3059
|
assertSignInSessionAudience(projectId, input.session.audience, magicLink.audience);
|
|
3071
3060
|
let newUserId;
|
|
@@ -3097,8 +3086,9 @@ class PgAuthStorage {
|
|
|
3097
3086
|
projectId,
|
|
3098
3087
|
user
|
|
3099
3088
|
});
|
|
3100
|
-
const groupMemberships = await this.
|
|
3089
|
+
const groupMemberships = await this.applyGroups(tx, {
|
|
3101
3090
|
completedAt,
|
|
3091
|
+
source: "manual",
|
|
3102
3092
|
existing: invitation.groupMemberships,
|
|
3103
3093
|
groupIds: manualGroupIds,
|
|
3104
3094
|
projectId,
|
|
@@ -3158,36 +3148,18 @@ class PgAuthStorage {
|
|
|
3158
3148
|
error: new AuthStorageError11("missing_user", `[Sixb] User '${identity.user_id}' not found for linked OIDC identity.`)
|
|
3159
3149
|
};
|
|
3160
3150
|
}
|
|
3161
|
-
if (!identity && userRow && (!input.autoLinkByVerifiedEmail || !input.emailVerified)) {
|
|
3162
|
-
await this.consumeOidcAttempt(input, completedAt, projectId, tx);
|
|
3163
|
-
return {
|
|
3164
|
-
error: new AuthStorageError11("email_link_not_allowed", `[Sixb] OIDC identity cannot auto-link to user '${userRow.id}' for project '${projectId}'.`)
|
|
3165
|
-
};
|
|
3166
|
-
}
|
|
3167
3151
|
if (userRow?.status === "suspended") {
|
|
3168
3152
|
await this.consumeOidcAttempt(input, completedAt, projectId, tx);
|
|
3169
3153
|
return {
|
|
3170
3154
|
error: new AuthStorageError11("suspended_user", `[Sixb] User '${userRow.id}' is suspended for project '${projectId}'.`)
|
|
3171
3155
|
};
|
|
3172
3156
|
}
|
|
3173
|
-
if (shouldCreateUser && !input.emailVerified) {
|
|
3174
|
-
await this.consumeOidcAttempt(input, completedAt, projectId, tx);
|
|
3175
|
-
return {
|
|
3176
|
-
error: new AuthStorageError11("user_creation_not_allowed", `[Sixb] OIDC authorization attempt '${input.oidcAuthorizationAttemptId}' cannot create a user for project '${projectId}'.`)
|
|
3177
|
-
};
|
|
3178
|
-
}
|
|
3179
3157
|
if (shouldCreateUser && !activeInvitation && !input.allowUserCreationWithoutInvitation) {
|
|
3180
3158
|
await this.consumeOidcAttempt(input, completedAt, projectId, tx);
|
|
3181
3159
|
return {
|
|
3182
3160
|
error: new AuthStorageError11("user_creation_not_allowed", `[Sixb] OIDC authorization attempt '${input.oidcAuthorizationAttemptId}' cannot create a user for project '${projectId}'.`)
|
|
3183
3161
|
};
|
|
3184
3162
|
}
|
|
3185
|
-
if (shouldCreateUser && !activeInvitation && input.allowUserCreationWithoutInvitation && input.requireNoActiveUsersForUserCreation && await hasActiveUsers(tx, projectId)) {
|
|
3186
|
-
await this.consumeOidcAttempt(input, completedAt, projectId, tx);
|
|
3187
|
-
return {
|
|
3188
|
-
error: new AuthStorageError11("user_creation_not_allowed", `[Sixb] OIDC authorization attempt '${input.oidcAuthorizationAttemptId}' cannot create a user for project '${projectId}'.`)
|
|
3189
|
-
};
|
|
3190
|
-
}
|
|
3191
3163
|
await validateCompleteSessionInput(tx, projectId, input.session);
|
|
3192
3164
|
assertSignInSessionAudience(projectId, input.session.audience, attempt.audience);
|
|
3193
3165
|
let newUserId;
|
|
@@ -3230,10 +3202,17 @@ class PgAuthStorage {
|
|
|
3230
3202
|
projectId,
|
|
3231
3203
|
user
|
|
3232
3204
|
});
|
|
3233
|
-
const groupMemberships = await this.
|
|
3205
|
+
const groupMemberships = await this.syncDirectoryGroups(tx, {
|
|
3234
3206
|
completedAt,
|
|
3235
|
-
existing:
|
|
3236
|
-
|
|
3207
|
+
existing: await this.applyGroups(tx, {
|
|
3208
|
+
completedAt,
|
|
3209
|
+
source: "manual",
|
|
3210
|
+
existing: invitation.groupMemberships,
|
|
3211
|
+
groupIds: manualGroupIds,
|
|
3212
|
+
projectId,
|
|
3213
|
+
userId: user.id
|
|
3214
|
+
}),
|
|
3215
|
+
groupIds: input.directoryGroupIds,
|
|
3237
3216
|
projectId,
|
|
3238
3217
|
userId: user.id
|
|
3239
3218
|
});
|
|
@@ -3362,19 +3341,33 @@ class PgAuthStorage {
|
|
|
3362
3341
|
}
|
|
3363
3342
|
return { invitation, groupMemberships };
|
|
3364
3343
|
}
|
|
3365
|
-
async
|
|
3344
|
+
async applyGroups(sql, input) {
|
|
3366
3345
|
const groupMemberships = [...input.existing];
|
|
3367
3346
|
for (const groupId of input.groupIds) {
|
|
3368
3347
|
groupMemberships.push(await upsertGroupMembership(sql, {
|
|
3369
3348
|
projectId: input.projectId,
|
|
3370
3349
|
userId: input.userId,
|
|
3371
3350
|
groupId,
|
|
3372
|
-
source:
|
|
3351
|
+
source: input.source,
|
|
3373
3352
|
createdAt: input.completedAt
|
|
3374
3353
|
}));
|
|
3375
3354
|
}
|
|
3376
3355
|
return groupMemberships;
|
|
3377
3356
|
}
|
|
3357
|
+
async syncDirectoryGroups(sql, input) {
|
|
3358
|
+
if (!input.groupIds) {
|
|
3359
|
+
return input.existing;
|
|
3360
|
+
}
|
|
3361
|
+
const groupIds = normalizeGroupIds(input.groupIds);
|
|
3362
|
+
await sql`
|
|
3363
|
+
DELETE FROM auth_group_memberships
|
|
3364
|
+
WHERE project_id = ${input.projectId}
|
|
3365
|
+
AND user_id = ${input.userId}
|
|
3366
|
+
AND source = 'directory'
|
|
3367
|
+
${groupIds.length > 0 ? sql`AND group_id NOT IN ${sql(groupIds)}` : sql``}
|
|
3368
|
+
`;
|
|
3369
|
+
return this.applyGroups(sql, { ...input, groupIds, source: "directory" });
|
|
3370
|
+
}
|
|
3378
3371
|
async createSignInSession(sql, input) {
|
|
3379
3372
|
await lockAdvisoryKeys(sql, [
|
|
3380
3373
|
authLockKey("sessions", input.projectId, input.userId),
|
|
@@ -3431,16 +3424,6 @@ class PgAuthStorage {
|
|
|
3431
3424
|
return rowToIdentityRecord(row);
|
|
3432
3425
|
}
|
|
3433
3426
|
}
|
|
3434
|
-
async function hasActiveUsers(sql, projectId) {
|
|
3435
|
-
const rows = await sql`
|
|
3436
|
-
SELECT 1 AS active
|
|
3437
|
-
FROM auth_users
|
|
3438
|
-
WHERE project_id = ${projectId}
|
|
3439
|
-
AND status = 'active'
|
|
3440
|
-
LIMIT 1
|
|
3441
|
-
`;
|
|
3442
|
-
return rows.length > 0;
|
|
3443
|
-
}
|
|
3444
3427
|
function assertSignInSessionAudience(projectId, sessionAudience, storedAudience) {
|
|
3445
3428
|
if (sessionAudience === storedAudience) {
|
|
3446
3429
|
return;
|
|
@@ -7388,6 +7371,14 @@ ALTER TABLE auth_device_authorizations
|
|
|
7388
7371
|
DROP COLUMN token_expires_at;
|
|
7389
7372
|
`;
|
|
7390
7373
|
|
|
7374
|
+
// src/migrations/050-directory-group-memberships.sql
|
|
7375
|
+
var _050_directory_group_memberships_default = `-- A membership the identity provider owns is recorded with source 'directory' and synced to the
|
|
7376
|
+
-- provider's groups on every sign-in. Service accounts never sign in, so their table is unchanged.
|
|
7377
|
+
ALTER TABLE auth_group_memberships DROP CONSTRAINT auth_group_memberships_source_check;
|
|
7378
|
+
ALTER TABLE auth_group_memberships ADD CONSTRAINT auth_group_memberships_source_check
|
|
7379
|
+
CHECK (source IN ('invitation', 'manual', 'agent', 'directory'));
|
|
7380
|
+
`;
|
|
7381
|
+
|
|
7391
7382
|
// src/migrations/037-execution-requester-groups.sql
|
|
7392
7383
|
var _037_execution_requester_groups_default = `ALTER TABLE executions ADD COLUMN requester_group_ids JSONB NOT NULL DEFAULT '[]'::jsonb;
|
|
7393
7384
|
|
|
@@ -7686,7 +7677,8 @@ var postgresStorageMigrations = defineMigrations({
|
|
|
7686
7677
|
pgSql("046-workflow-intervention-principals", _046_workflow_intervention_principals_default),
|
|
7687
7678
|
pgSql("047-ontology-commit-attribution", _047_ontology_commit_attribution_default),
|
|
7688
7679
|
pgSql("048-file-upload-sessions", _048_file_upload_sessions_default),
|
|
7689
|
-
pgSql("049-native-sessions", _049_native_sessions_default)
|
|
7680
|
+
pgSql("049-native-sessions", _049_native_sessions_default),
|
|
7681
|
+
pgSql("050-directory-group-memberships", _050_directory_group_memberships_default)
|
|
7690
7682
|
]
|
|
7691
7683
|
});
|
|
7692
7684
|
|
|
@@ -18915,4 +18907,4 @@ export {
|
|
|
18915
18907
|
migratePostgresStorage
|
|
18916
18908
|
};
|
|
18917
18909
|
|
|
18918
|
-
//# debugId=
|
|
18910
|
+
//# debugId=5427C0EF9727207C64756E2164756E21
|