@sixb/pg 0.1.19 → 0.1.20

package/dist/migrations.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"migrations.d.ts","sourceRoot":"","sources":["../src/migrations.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,YAAY,CAAA;AACjD,OAAO,KAAK,EAGV,YAAY,EACZ,aAAa,EACb,oBAAoB,EACrB,MAAM,oBAAoB,CAAA;AAqH3B,OAAO,KAAK,EAAe,GAAG,EAAa,MAAM,aAAa,CAAA;AAG9D,MAAM,WAAW,wBAAwB;IACvC,IAAI,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAA;CACrC;AAED,eAAO,MAAM,2BAA2B,wBAAwB,CAAA;AAEhE,wBAAgB,KAAK,CAAC,EAAE,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,aAAa,CAAC,wBAAwB,CAAC,CAE1F;AAED,wBAAgB,MAAM,CACpB,EAAE,EAAE,MAAM,EACV,EAAE,EAAE,CAAC,OAAO,EAAE,wBAAwB,KAAK,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,EAC/D,OAAO,GAAE,oBAAyB,GACjC,aAAa,CAAC,wBAAwB,CAAC,CAEzC;AAED,wBAAgB,8BAA8B,CAC5C,GAAG,EAAE,GAAG,EACR,UAAU,EAAE,MAAM,GACjB,SAAS,eAAe,EAAE,CAQ5B;AAED,wBAAgB,sBAAsB,CAAC,MAAM,EAAE;IAC7C,QAAQ,CAAC,GAAG,EAAE,GAAG,CAAA;IACjB,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAA;IAC3B,QAAQ,CAAC,UAAU,EAAE,YAAY,CAAC,wBAAwB,CAAC,CAAA;CAC5D,GAAG,eAAe,CAqBlB;AAED,wBAAsB,sBAAsB,CAAC,GAAG,EAAE,GAAG,EAAE,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAMxF;AAED,wBAAsB,UAAU,CAAC,GAAG,EAAE,GAAG,EAAE,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAE5E;AAED,wBAAgB,UAAU,CAAC,UAAU,EAAE,MAAM,GAAG,MAAM,CAKrD;AAuKD,eAAO,MAAM,yBAAyB,wCAiEpC,CAAA"}
+{"version":3,"file":"migrations.d.ts","sourceRoot":"","sources":["../src/migrations.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,YAAY,CAAA;AACjD,OAAO,KAAK,EAGV,YAAY,EACZ,aAAa,EACb,oBAAoB,EACrB,MAAM,oBAAoB,CAAA;AAqH3B,OAAO,KAAK,EAAe,GAAG,EAAa,MAAM,aAAa,CAAA;AAG9D,MAAM,WAAW,wBAAwB;IACvC,IAAI,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAA;CACrC;AAED,eAAO,MAAM,2BAA2B,wBAAwB,CAAA;AAEhE,wBAAgB,KAAK,CAAC,EAAE,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,aAAa,CAAC,wBAAwB,CAAC,CAE1F;AAED,wBAAgB,MAAM,CACpB,EAAE,EAAE,MAAM,EACV,EAAE,EAAE,CAAC,OAAO,EAAE,wBAAwB,KAAK,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,EAC/D,OAAO,GAAE,oBAAyB,GACjC,aAAa,CAAC,wBAAwB,CAAC,CAEzC;AAED,wBAAgB,8BAA8B,CAC5C,GAAG,EAAE,GAAG,EACR,UAAU,EAAE,MAAM,GACjB,SAAS,eAAe,EAAE,CAQ5B;AAED,wBAAgB,sBAAsB,CAAC,MAAM,EAAE;IAC7C,QAAQ,CAAC,GAAG,EAAE,GAAG,CAAA;IACjB,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAA;IAC3B,QAAQ,CAAC,UAAU,EAAE,YAAY,CAAC,wBAAwB,CAAC,CAAA;CAC5D,GAAG,eAAe,CAqBlB;AAED,wBAAsB,sBAAsB,CAAC,GAAG,EAAE,GAAG,EAAE,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAMxF;AAED,wBAAsB,UAAU,CAAC,GAAG,EAAE,GAAG,EAAE,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAE5E;AAED,wBAAgB,UAAU,CAAC,UAAU,EAAE,MAAM,GAAG,MAAM,CAKrD;AAuKD,eAAO,MAAM,yBAAyB,wCAkEpC,CAAA"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@sixb/pg",
-  "version": "0.1.19",
+  "version": "0.1.20",
   "description": "PostgreSQL storage provider for Sixb",
   "keywords": [
     "sixb",
@@ -40,10 +40,10 @@
     "postgres": "^3.4.5"
   },
   "peerDependencies": {
-    "@sixb/core": "0.1.19"
+    "@sixb/core": "0.1.20"
   },
   "devDependencies": {
-    "@sixb/core": "0.1.19",
+    "@sixb/core": "0.1.20",
     "@types/bun": "latest",
     "typescript": "^5.7.0"
   },

package/src/auth-storage/auth-storage.ts

@@ -234,7 +234,6 @@ export class PgAuthStorage implements AuthStorage {
         }
 
         await validateCompleteSessionInput(tx, projectId, input.session)
-        assertSignInSessionAudience(projectId, input.session.audience, magicLink.audience)
 
         let newUserId: string | undefined
         if (shouldCreateUser) {
@@ -394,7 +393,6 @@ export class PgAuthStorage implements AuthStorage {
         }
 
         await validateCompleteSessionInput(tx, projectId, input.session)
-        assertSignInSessionAudience(projectId, input.session.audience, attempt.audience)
 
         let newUserId: string | undefined
         if (shouldCreateUser) {
@@ -719,17 +717,13 @@ export class PgAuthStorage implements AuthStorage {
       readonly userId: string
     }
   ): Promise<SessionRecord> {
-    await lockAdvisoryKeys(sql, [
-      authLockKey("sessions", input.projectId, input.userId),
-      authLockKey("sessions", input.projectId, input.userId, input.session.audience),
-    ])
+    await lockAdvisoryKeys(sql, [authLockKey("sessions", input.projectId, input.userId)])
 
     return createSession(sql, {
       id: input.session.id,
       projectId: input.projectId,
       userId: input.userId,
       strategyId: input.strategyId,
-      audience: input.session.audience,
       tokenHash: input.session.tokenHash,
       createdAt: input.session.createdAt,
       expiresAt: input.session.expiresAt,
@@ -795,21 +789,6 @@ export class PgAuthStorage implements AuthStorage {
   }
 }
 
-function assertSignInSessionAudience(
-  projectId: string,
-  sessionAudience: string,
-  storedAudience: string
-): void {
-  if (sessionAudience === storedAudience) {
-    return
-  }
-
-  throw new AuthStorageError(
-    "invalid_input",
-    `[Sixb] Sign-in session audience '${sessionAudience}' does not match stored auth audience '${storedAudience}' for project '${projectId}'.`
-  )
-}
-
 function assertCompletableDeviceAuthorization(
   authorization: DeviceAuthorizationRecord,
   input: CompleteDeviceAuthorizationInput

package/src/auth-storage/magic-links.ts

@@ -1,4 +1,3 @@
-import { resolveAuthSessionAudience } from "@sixb/core"
 import type {
   AuthMagicLinkStore,
   CreateAuthMagicLinkInput,
@@ -31,7 +30,6 @@ export class PgAuthMagicLinkStore implements AuthMagicLinkStore {
       const id = assertNonEmpty(input.id, "Magic link id")
       const projectId = assertNonEmpty(input.projectId, "Project id")
       const strategyId = assertNonEmpty(input.strategyId, "Strategy id")
-      const audience = resolveAuthSessionAudience(input.audience)
       const email = normalizeEmail(input.email)
       const tokenHash = assertNonEmpty(input.tokenHash, "Magic link token hash")
 
@@ -56,7 +54,6 @@ export class PgAuthMagicLinkStore implements AuthMagicLinkStore {
             project_id,
             id,
             strategy_id,
-            audience,
             email,
             token_hash,
             return_to,
@@ -66,7 +63,6 @@ export class PgAuthMagicLinkStore implements AuthMagicLinkStore {
             ${projectId},
             ${id},
             ${strategyId},
-            ${audience},
             ${email},
             ${tokenHash},
             ${input.returnTo ?? null},

package/src/auth-storage/oidc-attempts.ts

@@ -1,4 +1,3 @@
-import { resolveAuthSessionAudience } from "@sixb/core"
 import type {
   AuthOidcAuthorizationAttemptStore,
   CreateOidcAuthorizationAttemptInput,
@@ -25,7 +24,6 @@ export class PgAuthOidcAuthorizationAttemptStore implements AuthOidcAuthorizatio
     const id = assertNonEmpty(input.id, "OIDC authorization attempt id")
     const projectId = assertNonEmpty(input.projectId, "Project id")
     const strategyId = assertNonEmpty(input.strategyId, "Strategy id")
-    const audience = resolveAuthSessionAudience(input.audience)
     const stateHash = assertNonEmpty(input.stateHash, "OIDC state hash")
     const nonceHash = assertNonEmpty(input.nonceHash, "OIDC nonce hash")
     const codeVerifier = assertNonEmpty(input.codeVerifier, "OIDC code verifier")
@@ -43,7 +41,6 @@ export class PgAuthOidcAuthorizationAttemptStore implements AuthOidcAuthorizatio
           project_id,
           id,
           strategy_id,
-          audience,
           state_hash,
           nonce_hash,
           code_verifier,
@@ -54,7 +51,6 @@ export class PgAuthOidcAuthorizationAttemptStore implements AuthOidcAuthorizatio
           ${projectId},
           ${id},
           ${strategyId},
-          ${audience},
           ${stateHash},
           ${nonceHash},
           ${codeVerifier},

package/src/auth-storage/rows.ts

@@ -67,7 +67,6 @@ export interface PgAuthSessionRow {
   readonly id: string
   readonly user_id: string
   readonly strategy_id: string
-  readonly audience: SessionRecord["audience"]
   readonly token_hash: string
   readonly created_at: PgDate
   readonly expires_at: PgDate
@@ -132,7 +131,6 @@ export interface PgAuthMagicLinkRow {
   readonly project_id: string
   readonly id: string
   readonly strategy_id: string
-  readonly audience: MagicLinkRecord["audience"]
   readonly email: string
   readonly token_hash: string
   readonly return_to: string | null
@@ -146,7 +144,6 @@ export interface PgAuthOidcAttemptRow {
   readonly project_id: string
   readonly id: string
   readonly strategy_id: string
-  readonly audience: OidcAuthorizationAttemptRecord["audience"]
   readonly state_hash: string
   readonly nonce_hash: string
   readonly code_verifier: string
@@ -229,7 +226,6 @@ export function rowToSessionRecord(row: PgAuthSessionRow): SessionRecord {
     projectId: row.project_id,
     userId: row.user_id,
     strategyId: row.strategy_id,
-    audience: row.audience,
     tokenHash: row.token_hash,
     createdAt: toDate(row.created_at),
     expiresAt: toDate(row.expires_at),
@@ -306,7 +302,6 @@ export function rowToMagicLinkRecord(row: PgAuthMagicLinkRow): MagicLinkRecord {
     id: row.id,
     projectId: row.project_id,
     strategyId: row.strategy_id,
-    audience: row.audience,
     email: row.email,
     tokenHash: row.token_hash,
     returnTo: row.return_to ?? undefined,
@@ -324,7 +319,6 @@ export function rowToOidcAuthorizationAttemptRecord(
     id: row.id,
     projectId: row.project_id,
     strategyId: row.strategy_id,
-    audience: row.audience,
     stateHash: row.state_hash,
     nonceHash: row.nonce_hash,
     codeVerifier: row.code_verifier,

package/src/auth-storage/sessions.ts

@@ -1,4 +1,3 @@
-import type { AuthSessionAudience } from "@sixb/core"
 import type {
   AuthSessionStore,
   CreateAuthSessionInput,
@@ -38,28 +37,6 @@ export class PgAuthSessionStore implements AuthSessionStore {
     return getSessionById(this.sql, params)
   }
 
-  async getActiveByUserId(params: {
-    readonly projectId: string
-    readonly userId: string
-    readonly audience: AuthSessionAudience
-    readonly now: Date
-  }): Promise<SessionRecord | null> {
-    const [row] = await this.sql<PgAuthSessionRow[]>`
-      SELECT *
-      FROM auth_sessions
-      WHERE project_id = ${params.projectId}
-        AND user_id = ${params.userId}
-        AND audience = ${params.audience}
-        AND revoked_at IS NULL
-        AND expires_at > ${params.now}
-        AND (absolute_expires_at IS NULL OR absolute_expires_at > ${params.now})
-      ORDER BY created_at DESC, id DESC
-      LIMIT 1
-    `
-
-    return row ? rowToSessionRecord(row) : null
-  }
-
   async listActiveByUserId(params: {
     readonly projectId: string
     readonly userId: string
@@ -82,7 +59,6 @@ export class PgAuthSessionStore implements AuthSessionStore {
   async findValidByTokenHash(params: {
     readonly projectId: string
     readonly id: string
-    readonly audience: AuthSessionAudience
     readonly tokenHash: string
     readonly now: Date
   }): Promise<SessionRecord | null> {
@@ -91,7 +67,6 @@ export class PgAuthSessionStore implements AuthSessionStore {
     if (
       !row ||
       row.refresh_token_hash !== null ||
-      row.audience !== params.audience ||
       row.token_hash !== params.tokenHash ||
       !isLiveSessionRow(row, params.now)
     ) {
@@ -169,7 +144,6 @@ export class PgAuthSessionStore implements AuthSessionStore {
   async renewIfValid(params: {
     readonly projectId: string
     readonly id: string
-    readonly audience: AuthSessionAudience
     readonly tokenHash: string
     readonly now: Date
     readonly expiresAt: Date
@@ -186,7 +160,6 @@ export class PgAuthSessionStore implements AuthSessionStore {
           last_seen_at = ${params.now}
       WHERE project_id = ${params.projectId}
         AND id = ${params.id}
-        AND audience = ${params.audience}
         AND token_hash = ${params.tokenHash}
         AND refresh_token_hash IS NULL
         AND revoked_at IS NULL
@@ -228,15 +201,10 @@ export class PgAuthSessionStore implements AuthSessionStore {
   async revokeActiveForUser(params: {
     readonly projectId: string
     readonly userId: string
-    readonly audience?: AuthSessionAudience
     readonly revokedAt: Date
   }): Promise<readonly SessionRecord[]> {
     return runPgTransaction(this.sql, async (tx) => {
-      const locks = [authLockKey("sessions", params.projectId, params.userId)]
-      if (params.audience) {
-        locks.push(authLockKey("sessions", params.projectId, params.userId, params.audience))
-      }
-      await lockAdvisoryKeys(tx, locks)
+      await lockAdvisoryKeys(tx, [authLockKey("sessions", params.projectId, params.userId)])
       return revokeActiveSessionsForUser(tx, params)
     })
   }

package/src/auth-storage/shared.ts

@@ -1,4 +1,4 @@
-import type { AuthSessionAudience, Principal } from "@sixb/core"
+import type { Principal } from "@sixb/core"
 import type {
   CompleteAuthSessionInput,
   CreateAuthSessionInput,
@@ -442,7 +442,6 @@ export async function validateCompleteSessionInput(
   session: CompleteAuthSessionInput
 ): Promise<void> {
   const sessionId = assertNonEmpty(session.id, "Session id")
-  assertNonEmpty(session.audience, "Session audience")
   assertNonEmpty(session.tokenHash, "Session token hash")
   await assertSessionIdAvailable(sql, projectId, sessionId)
 }
@@ -468,7 +467,6 @@ export async function createSession(
   const projectId = assertNonEmpty(input.projectId, "Project id")
   const userId = assertNonEmpty(input.userId, "User id")
   const strategyId = assertNonEmpty(input.strategyId, "Strategy id")
-  const audience = assertNonEmpty(input.audience, "Session audience")
   const tokenHash = assertNonEmpty(input.tokenHash, "Session token hash")
 
   await requireUserById(sql, { projectId, id: userId })
@@ -481,7 +479,6 @@ export async function createSession(
         id,
         user_id,
         strategy_id,
-        audience,
         token_hash,
         created_at,
         expires_at,
@@ -496,7 +493,6 @@ export async function createSession(
         ${id},
         ${userId},
         ${strategyId},
-        ${audience},
         ${tokenHash},
         ${input.createdAt},
         ${input.expiresAt},
@@ -525,13 +521,10 @@ export async function revokeActiveSessionsForUser(
   params: {
     readonly projectId: string
     readonly userId: string
-    readonly audience?: AuthSessionAudience
     readonly revokedAt: Date
   }
 ): Promise<readonly SessionRecord[]> {
-  const rows =
-    params.audience === undefined
-      ? await sql<PgAuthSessionRow[]>`
+  const rows = await sql<PgAuthSessionRow[]>`
       SELECT *
       FROM auth_sessions
       WHERE project_id = ${params.projectId}
@@ -542,41 +535,16 @@ export async function revokeActiveSessionsForUser(
       ORDER BY created_at ASC, id ASC
       FOR UPDATE
     `
-      : await sql<PgAuthSessionRow[]>`
-      SELECT *
-      FROM auth_sessions
-      WHERE project_id = ${params.projectId}
-        AND user_id = ${params.userId}
-        AND audience = ${params.audience}
-        AND revoked_at IS NULL
-        AND expires_at > ${params.revokedAt}
-        AND (absolute_expires_at IS NULL OR absolute_expires_at > ${params.revokedAt})
-      ORDER BY created_at ASC, id ASC
-      FOR UPDATE
-    `
 
-  if (params.audience === undefined) {
-    await sql`
-      UPDATE auth_sessions
-      SET revoked_at = ${params.revokedAt}
-      WHERE project_id = ${params.projectId}
-        AND user_id = ${params.userId}
-        AND revoked_at IS NULL
-        AND expires_at > ${params.revokedAt}
-        AND (absolute_expires_at IS NULL OR absolute_expires_at > ${params.revokedAt})
-    `
-  } else {
-    await sql`
+  await sql`
       UPDATE auth_sessions
       SET revoked_at = ${params.revokedAt}
       WHERE project_id = ${params.projectId}
         AND user_id = ${params.userId}
-        AND audience = ${params.audience}
         AND revoked_at IS NULL
         AND expires_at > ${params.revokedAt}
         AND (absolute_expires_at IS NULL OR absolute_expires_at > ${params.revokedAt})
     `
-  }
 
   return rows.map((row) =>
     rowToSessionRecord({

package/src/migrations/062-drop-auth-audience.sql

@@ -0,0 +1,19 @@
+-- A project has one browser app, so sessions, magic links and sign-in attempts no longer name the
+-- one they belong to. Atlas's browser sessions end here: their cookie is no longer read. Native
+-- sessions carried Atlas's name only because the column needed a value, so they stay.
+UPDATE auth_sessions
+SET revoked_at = now()
+WHERE audience = 'atlas'
+  AND refresh_token_hash IS NULL
+  AND revoked_at IS NULL;
+
+-- Dropping the column drops the two indexes that name it.
+ALTER TABLE auth_sessions DROP COLUMN audience;
+CREATE INDEX idx_auth_sessions_user_active
+  ON auth_sessions (project_id, user_id, expires_at DESC, created_at DESC, id DESC)
+  WHERE revoked_at IS NULL;
+CREATE INDEX idx_auth_sessions_user_created
+  ON auth_sessions (project_id, user_id, created_at DESC, id DESC);
+
+ALTER TABLE auth_magic_links DROP COLUMN audience;
+ALTER TABLE auth_oidc_authorization_attempts DROP COLUMN audience;

package/src/migrations.ts

@@ -432,6 +432,7 @@ export const postgresStorageMigrations = defineMigrations<PostgresMigrationConte
     pgSql("059-file-download-grants", fileDownloadGrantsSql),
     pgSql("060-drained-source-versions", drainedSourceVersionsSql),
     pgSql("061-terminal-action-runs", terminalActionRunsSql),
+    pgSql("062-drop-auth-audience", dropAuthAudienceSql),
   ],
 })
 
@@ -461,3 +462,4 @@ import drainedSourceVersionsSql from "./migrations/060-drained-source-versions.s
   type: "text",
 }
 import terminalActionRunsSql from "./migrations/061-terminal-action-runs.sql" with { type: "text" }
+import dropAuthAudienceSql from "./migrations/062-drop-auth-audience.sql" with { type: "text" }