@sixb/pg 0.1.13 → 0.1.14

package/dist/migrations.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"migrations.d.ts","sourceRoot":"","sources":["../src/migrations.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,YAAY,CAAA;AACjD,OAAO,KAAK,EAGV,YAAY,EACZ,aAAa,EACb,oBAAoB,EACrB,MAAM,oBAAoB,CAAA;AAoG3B,OAAO,KAAK,EAAE,GAAG,EAAa,MAAM,aAAa,CAAA;AAEjD,MAAM,WAAW,wBAAwB;IACvC,IAAI,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAA;CACrC;AAED,eAAO,MAAM,2BAA2B,wBAAwB,CAAA;AAEhE,wBAAgB,KAAK,CAAC,EAAE,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,aAAa,CAAC,wBAAwB,CAAC,CAE1F;AAED,wBAAgB,MAAM,CACpB,EAAE,EAAE,MAAM,EACV,EAAE,EAAE,CAAC,OAAO,EAAE,wBAAwB,KAAK,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,EAC/D,OAAO,GAAE,oBAAyB,GACjC,aAAa,CAAC,wBAAwB,CAAC,CAEzC;AAED,wBAAgB,8BAA8B,CAC5C,GAAG,EAAE,GAAG,EACR,UAAU,EAAE,MAAM,GACjB,SAAS,eAAe,EAAE,CAQ5B;AAED,wBAAgB,sBAAsB,CAAC,MAAM,EAAE;IAC7C,QAAQ,CAAC,GAAG,EAAE,GAAG,CAAA;IACjB,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAA;IAC3B,QAAQ,CAAC,UAAU,EAAE,YAAY,CAAC,wBAAwB,CAAC,CAAA;CAC5D,GAAG,eAAe,CAqBlB;AAED,wBAAsB,sBAAsB,CAAC,GAAG,EAAE,GAAG,EAAE,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAMxF;AAED,wBAAsB,UAAU,CAAC,GAAG,EAAE,GAAG,EAAE,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAE5E;AAED,wBAAgB,UAAU,CAAC,UAAU,EAAE,MAAM,GAAG,MAAM,CAKrD;AA6KD,eAAO,MAAM,yBAAyB,wCAqDpC,CAAA"}
+{"version":3,"file":"migrations.d.ts","sourceRoot":"","sources":["../src/migrations.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,YAAY,CAAA;AACjD,OAAO,KAAK,EAGV,YAAY,EACZ,aAAa,EACb,oBAAoB,EACrB,MAAM,oBAAoB,CAAA;AAuG3B,OAAO,KAAK,EAAE,GAAG,EAAa,MAAM,aAAa,CAAA;AAEjD,MAAM,WAAW,wBAAwB;IACvC,IAAI,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAA;CACrC;AAED,eAAO,MAAM,2BAA2B,wBAAwB,CAAA;AAEhE,wBAAgB,KAAK,CAAC,EAAE,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,aAAa,CAAC,wBAAwB,CAAC,CAE1F;AAED,wBAAgB,MAAM,CACpB,EAAE,EAAE,MAAM,EACV,EAAE,EAAE,CAAC,OAAO,EAAE,wBAAwB,KAAK,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,EAC/D,OAAO,GAAE,oBAAyB,GACjC,aAAa,CAAC,wBAAwB,CAAC,CAEzC;AAED,wBAAgB,8BAA8B,CAC5C,GAAG,EAAE,GAAG,EACR,UAAU,EAAE,MAAM,GACjB,SAAS,eAAe,EAAE,CAQ5B;AAED,wBAAgB,sBAAsB,CAAC,MAAM,EAAE;IAC7C,QAAQ,CAAC,GAAG,EAAE,GAAG,CAAA;IACjB,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAA;IAC3B,QAAQ,CAAC,UAAU,EAAE,YAAY,CAAC,wBAAwB,CAAC,CAAA;CAC5D,GAAG,eAAe,CAqBlB;AAED,wBAAsB,sBAAsB,CAAC,GAAG,EAAE,GAAG,EAAE,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAMxF;AAED,wBAAsB,UAAU,CAAC,GAAG,EAAE,GAAG,EAAE,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAE5E;AAED,wBAAgB,UAAU,CAAC,UAAU,EAAE,MAAM,GAAG,MAAM,CAKrD;AA6KD,eAAO,MAAM,yBAAyB,wCAsDpC,CAAA"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@sixb/pg",
-  "version": "0.1.13",
+  "version": "0.1.14",
   "description": "PostgreSQL storage provider for Sixb",
   "keywords": [
     "sixb",
@@ -40,10 +40,10 @@
     "postgres": "^3.4.5"
   },
   "peerDependencies": {
-    "@sixb/core": "0.1.13"
+    "@sixb/core": "0.1.14"
   },
   "devDependencies": {
-    "@sixb/core": "0.1.13",
+    "@sixb/core": "0.1.14",
     "@types/bun": "latest",
     "typescript": "^5.7.0"
   },

package/src/auth-storage/auth-storage.ts

@@ -7,6 +7,7 @@ import type {
   CompleteSignInResult,
   DeviceAuthorizationRecord,
   GroupMembershipRecord,
+  GroupMembershipSource,
   InvitationRecord,
   SessionRecord,
   SuspendUserAndRevokeSessionsInput,
@@ -232,27 +233,6 @@ export class PgAuthStorage implements AuthStorage {
           }
         }
 
-        if (
-          shouldCreateUser &&
-          !activeInvitation &&
-          input.allowUserCreationWithoutInvitation &&
-          input.requireNoActiveUsersForUserCreation &&
-          (await hasActiveUsers(tx, projectId))
-        ) {
-          await consumeMagicLink(tx, {
-            projectId,
-            id: input.magicLinkId,
-            tokenHash: input.tokenHash,
-            consumedAt: completedAt,
-          })
-          return {
-            error: new AuthStorageError(
-              "user_creation_not_allowed",
-              `[Sixb] Magic link '${input.magicLinkId}' cannot create a user for project '${projectId}'.`
-            ),
-          }
-        }
-
         await validateCompleteSessionInput(tx, projectId, input.session)
         assertSignInSessionAudience(projectId, input.session.audience, magicLink.audience)
 
@@ -294,8 +274,9 @@ export class PgAuthStorage implements AuthStorage {
           projectId,
           user,
         })
-        const groupMemberships = await this.applyManualGroups(tx, {
+        const groupMemberships = await this.applyGroups(tx, {
           completedAt,
+          source: "manual",
           existing: invitation.groupMemberships,
           groupIds: manualGroupIds,
           projectId,
@@ -392,16 +373,6 @@ export class PgAuthStorage implements AuthStorage {
           }
         }
 
-        if (!identity && userRow && (!input.autoLinkByVerifiedEmail || !input.emailVerified)) {
-          await this.consumeOidcAttempt(input, completedAt, projectId, tx)
-          return {
-            error: new AuthStorageError(
-              "email_link_not_allowed",
-              `[Sixb] OIDC identity cannot auto-link to user '${userRow.id}' for project '${projectId}'.`
-            ),
-          }
-        }
-
         if (userRow?.status === "suspended") {
           await this.consumeOidcAttempt(input, completedAt, projectId, tx)
           return {
@@ -412,16 +383,6 @@ export class PgAuthStorage implements AuthStorage {
           }
         }
 
-        if (shouldCreateUser && !input.emailVerified) {
-          await this.consumeOidcAttempt(input, completedAt, projectId, tx)
-          return {
-            error: new AuthStorageError(
-              "user_creation_not_allowed",
-              `[Sixb] OIDC authorization attempt '${input.oidcAuthorizationAttemptId}' cannot create a user for project '${projectId}'.`
-            ),
-          }
-        }
-
         if (shouldCreateUser && !activeInvitation && !input.allowUserCreationWithoutInvitation) {
           await this.consumeOidcAttempt(input, completedAt, projectId, tx)
           return {
@@ -432,22 +393,6 @@ export class PgAuthStorage implements AuthStorage {
           }
         }
 
-        if (
-          shouldCreateUser &&
-          !activeInvitation &&
-          input.allowUserCreationWithoutInvitation &&
-          input.requireNoActiveUsersForUserCreation &&
-          (await hasActiveUsers(tx, projectId))
-        ) {
-          await this.consumeOidcAttempt(input, completedAt, projectId, tx)
-          return {
-            error: new AuthStorageError(
-              "user_creation_not_allowed",
-              `[Sixb] OIDC authorization attempt '${input.oidcAuthorizationAttemptId}' cannot create a user for project '${projectId}'.`
-            ),
-          }
-        }
-
         await validateCompleteSessionInput(tx, projectId, input.session)
         assertSignInSessionAudience(projectId, input.session.audience, attempt.audience)
 
@@ -497,10 +442,17 @@ export class PgAuthStorage implements AuthStorage {
           projectId,
           user,
         })
-        const groupMemberships = await this.applyManualGroups(tx, {
+        const groupMemberships = await this.syncDirectoryGroups(tx, {
           completedAt,
-          existing: invitation.groupMemberships,
-          groupIds: manualGroupIds,
+          existing: await this.applyGroups(tx, {
+            completedAt,
+            source: "manual",
+            existing: invitation.groupMemberships,
+            groupIds: manualGroupIds,
+            projectId,
+            userId: user.id,
+          }),
+          groupIds: input.directoryGroupIds,
           projectId,
           userId: user.id,
         })
@@ -703,13 +655,14 @@ export class PgAuthStorage implements AuthStorage {
     return { invitation, groupMemberships }
   }
 
-  private async applyManualGroups(
+  private async applyGroups(
     sql: SQLClient,
     input: {
       readonly completedAt: Date
       readonly existing: readonly GroupMembershipRecord[]
       readonly groupIds: readonly string[]
       readonly projectId: string
+      readonly source: GroupMembershipSource
       readonly userId: string
     }
   ): Promise<readonly GroupMembershipRecord[]> {
@@ -721,7 +674,7 @@ export class PgAuthStorage implements AuthStorage {
           projectId: input.projectId,
           userId: input.userId,
           groupId,
-          source: "manual",
+          source: input.source,
           createdAt: input.completedAt,
         })
       )
@@ -729,6 +682,33 @@ export class PgAuthStorage implements AuthStorage {
 
     return groupMemberships
   }
+  // Directory memberships become exactly `groupIds`. A group the user already holds from another
+  // source keeps that source, and memberships from other sources are never removed.
+  private async syncDirectoryGroups(
+    sql: SQLClient,
+    input: {
+      readonly completedAt: Date
+      readonly existing: readonly GroupMembershipRecord[]
+      readonly groupIds?: readonly string[]
+      readonly projectId: string
+      readonly userId: string
+    }
+  ): Promise<readonly GroupMembershipRecord[]> {
+    if (!input.groupIds) {
+      return input.existing
+    }
+
+    const groupIds = normalizeGroupIds(input.groupIds)
+    await sql`
+      DELETE FROM auth_group_memberships
+      WHERE project_id = ${input.projectId}
+        AND user_id = ${input.userId}
+        AND source = 'directory'
+        ${groupIds.length > 0 ? sql`AND group_id NOT IN ${sql(groupIds)}` : sql``}
+    `
+
+    return this.applyGroups(sql, { ...input, groupIds, source: "directory" })
+  }
 
   private async createSignInSession(
     sql: SQLClient,
@@ -815,18 +795,6 @@ export class PgAuthStorage implements AuthStorage {
   }
 }
 
-async function hasActiveUsers(sql: SQLClient, projectId: string): Promise<boolean> {
-  const rows = (await sql`
-    SELECT 1 AS active
-    FROM auth_users
-    WHERE project_id = ${projectId}
-      AND status = 'active'
-    LIMIT 1
-  `) as Array<{ readonly active: number }>
-
-  return rows.length > 0
-}
-
 function assertSignInSessionAudience(
   projectId: string,
   sessionAudience: string,

package/src/auth-storage/rows.ts

@@ -58,7 +58,7 @@ export interface PgAuthServiceAccountGroupMembershipRow {
   readonly project_id: string
   readonly service_account_id: string
   readonly group_id: string
-  readonly source: GroupMembershipSource
+  readonly source: ServiceAccountGroupMembershipRecord["source"]
   readonly created_at: PgDate
 }
 

package/src/migrations/050-directory-group-memberships.sql

@@ -0,0 +1,5 @@
+-- A membership the identity provider owns is recorded with source 'directory' and synced to the
+-- provider's groups on every sign-in. Service accounts never sign in, so their table is unchanged.
+ALTER TABLE auth_group_memberships DROP CONSTRAINT auth_group_memberships_source_check;
+ALTER TABLE auth_group_memberships ADD CONSTRAINT auth_group_memberships_source_check
+  CHECK (source IN ('invitation', 'manual', 'agent', 'directory'));

package/src/migrations.ts

@@ -106,6 +106,9 @@ import ontologyCommitAttributionSql from "./migrations/047-ontology-commit-attri
   type: "text",
 }
 import nativeSessionsSql from "./migrations/049-native-sessions.sql" with { type: "text" }
+import directoryGroupMembershipsSql from "./migrations/050-directory-group-memberships.sql" with {
+  type: "text",
+}
 import type { SQL, SQLClient } from "./pg-client"
 
 export interface PostgresMigrationContext {
@@ -408,6 +411,7 @@ export const postgresStorageMigrations = defineMigrations<PostgresMigrationConte
     pgSql("047-ontology-commit-attribution", ontologyCommitAttributionSql),
     pgSql("048-file-upload-sessions", fileUploadSessionsSql),
     pgSql("049-native-sessions", nativeSessionsSql),
+    pgSql("050-directory-group-memberships", directoryGroupMembershipsSql),
   ],
 })