@sixb/sqlite 0.0.1

package/src/auth-storage/group-memberships.ts

@@ -0,0 +1,52 @@
+import type { Database } from "bun:sqlite"
+import type {
+  AuthGroupMembershipStore,
+  GroupMembershipRecord,
+  UpsertAuthGroupMembershipInput,
+} from "@sixb/core/storage"
+import { runImmediateTransaction } from "../transactions"
+import type { SqliteAuthGroupMembershipRow } from "./rows"
+import { rowToGroupMembershipRecord } from "./rows"
+import { listMembershipsForUser, removeGroupMembership, upsertGroupMembership } from "./shared"
+
+export class SqliteAuthGroupMembershipStore implements AuthGroupMembershipStore {
+  constructor(private readonly db: Database) {}
+
+  async upsert(input: UpsertAuthGroupMembershipInput): Promise<GroupMembershipRecord> {
+    return runImmediateTransaction(this.db, () => upsertGroupMembership(this.db, input))
+  }
+
+  async remove(params: {
+    readonly projectId: string
+    readonly userId: string
+    readonly groupId: string
+  }): Promise<GroupMembershipRecord | null> {
+    return runImmediateTransaction(this.db, () => removeGroupMembership(this.db, params))
+  }
+
+  async listForUser(params: {
+    readonly projectId: string
+    readonly userId: string
+  }): Promise<readonly GroupMembershipRecord[]> {
+    return listMembershipsForUser(this.db, params)
+  }
+
+  async listForGroup(params: {
+    readonly projectId: string
+    readonly groupId: string
+  }): Promise<readonly GroupMembershipRecord[]> {
+    const rows = this.db
+      .query(
+        `
+        SELECT *
+        FROM auth_group_memberships
+        WHERE project_id = ?
+          AND group_id = ?
+        ORDER BY user_id ASC
+      `
+      )
+      .all(params.projectId, params.groupId) as SqliteAuthGroupMembershipRow[]
+
+    return rows.map(rowToGroupMembershipRecord)
+  }
+}

package/src/auth-storage/identities.ts

@@ -0,0 +1,98 @@
+import type { Database } from "bun:sqlite"
+import type {
+  AuthUserIdentityStore,
+  UpsertAuthUserIdentityInput,
+  UserIdentityRecord,
+} from "@sixb/core/storage"
+import type { SqliteAuthUserIdentityRow } from "./rows"
+import { rowToIdentityRecord, serializeOptionalRecord } from "./rows"
+import { assertNonEmpty, dateOrNow, getIdentityRowBySubject, toIso } from "./shared"
+
+export class SqliteAuthUserIdentityStore implements AuthUserIdentityStore {
+  constructor(private readonly db: Database) {}
+
+  async upsert(input: UpsertAuthUserIdentityInput): Promise<UserIdentityRecord> {
+    const projectId = assertNonEmpty(input.projectId, "Project id")
+    const strategyId = assertNonEmpty(input.strategyId, "Strategy id")
+    const subject = assertNonEmpty(input.subject, "Subject")
+    const userId = assertNonEmpty(input.userId, "User id")
+    const existing = getIdentityRowBySubject(this.db, {
+      projectId,
+      strategyId,
+      subject,
+    })
+    const createdAt = existing ? new Date(existing.created_at) : dateOrNow(input.createdAt)
+    const updatedAt = input.updatedAt
+      ? new Date(input.updatedAt)
+      : existing
+        ? new Date()
+        : createdAt
+
+    this.db
+      .query(
+        `
+        INSERT INTO auth_user_identities (
+          project_id,
+          strategy_id,
+          subject,
+          user_id,
+          claims,
+          created_at,
+          updated_at
+        ) VALUES (?, ?, ?, ?, ?, ?, ?)
+        ON CONFLICT(project_id, strategy_id, subject)
+        DO UPDATE SET
+          user_id = excluded.user_id,
+          claims = excluded.claims,
+          updated_at = excluded.updated_at
+      `
+      )
+      .run(
+        projectId,
+        strategyId,
+        subject,
+        userId,
+        serializeOptionalRecord(input.claims),
+        toIso(createdAt),
+        toIso(updatedAt)
+      )
+
+    return {
+      projectId,
+      strategyId,
+      subject,
+      userId,
+      claims: input.claims ? structuredClone(input.claims) : undefined,
+      createdAt,
+      updatedAt,
+    }
+  }
+
+  async getBySubject(params: {
+    readonly projectId: string
+    readonly strategyId: string
+    readonly subject: string
+  }): Promise<UserIdentityRecord | null> {
+    const row = getIdentityRowBySubject(this.db, params)
+    return row ? rowToIdentityRecord(row) : null
+  }
+
+  async listForUser(params: {
+    readonly projectId: string
+    readonly userId: string
+  }): Promise<readonly UserIdentityRecord[]> {
+    const rows = this.db
+      .query(
+        `
+        SELECT *
+        FROM auth_user_identities
+        WHERE project_id = ?
+          AND user_id = ?
+        ORDER BY created_at ASC, strategy_id ASC, subject ASC
+      `
+      )
+      .all(params.projectId, params.userId) as SqliteAuthUserIdentityRow[]
+
+    return rows.map(rowToIdentityRecord)
+  }
+}

package/src/auth-storage/index.ts

@@ -0,0 +1,2 @@
+export type { SqliteAuthStorageOptions } from "./auth-storage"
+export { SqliteAuthStorage } from "./auth-storage"

package/src/auth-storage/invitations.ts

@@ -0,0 +1,258 @@
+import type { Database } from "bun:sqlite"
+import type {
+  AuthInvitationStore,
+  CreateOrUpdateAuthInvitationInput,
+  InvitationRecord,
+  ListAuthInvitationsInput,
+  ListAuthInvitationsResult,
+} from "@sixb/core/storage"
+import { AuthStorageError } from "@sixb/core/storage"
+import { runImmediateTransaction } from "../transactions"
+import type { SqliteAuthInvitationRow } from "./rows"
+import { rowToInvitationRecord } from "./rows"
+import {
+  appendPagination,
+  assertNonEmpty,
+  dateOrNow,
+  getActiveInvitationByEmail,
+  getInvitationById,
+  getInvitationGroupIds,
+  hasEmptyFilter,
+  mapUniqueConstraintError,
+  normalizeEmail,
+  normalizeGroupIds,
+  replaceInvitationGroups,
+  requireInvitationById,
+  type SqliteValue,
+  toIso,
+} from "./shared"
+
+export class SqliteAuthInvitationStore implements AuthInvitationStore {
+  constructor(private readonly db: Database) {}
+
+  async createOrUpdateActive(input: CreateOrUpdateAuthInvitationInput): Promise<InvitationRecord> {
+    return runImmediateTransaction(this.db, () => {
+      const id = assertNonEmpty(input.id, "Invitation id")
+      const projectId = assertNonEmpty(input.projectId, "Project id")
+      const email = normalizeEmail(input.email)
+      const groupIds = normalizeGroupIds(input.groupIds)
+      const now = dateOrNow(input.updatedAt ?? input.createdAt)
+      const existingActive = getActiveInvitationByEmail(this.db, {
+        projectId,
+        email,
+        now,
+      })
+
+      if (existingActive) {
+        this.db
+          .query(
+            `
+            UPDATE auth_invitations
+            SET created_by_principal_type = ?,
+                created_by_principal_id = ?,
+                created_by_session_id = ?,
+                expires_at = ?,
+                updated_at = ?
+            WHERE project_id = ?
+              AND id = ?
+          `
+          )
+          .run(
+            input.createdByPrincipal?.type ?? null,
+            input.createdByPrincipal?.id ?? null,
+            input.createdBySessionId ?? null,
+            toIso(input.expiresAt),
+            toIso(now),
+            projectId,
+            existingActive.id
+          )
+        replaceInvitationGroups(this.db, {
+          projectId,
+          invitationId: existingActive.id,
+          groupIds,
+        })
+
+        return requireInvitationById(this.db, { projectId, id: existingActive.id })
+      }
+
+      if (getInvitationById(this.db, { projectId, id })) {
+        throw new AuthStorageError(
+          "duplicate_invitation",
+          `[Sixb] Invitation '${id}' already exists but is not active for project '${projectId}'.`
+        )
+      }
+
+      const createdAt = dateOrNow(input.createdAt)
+      try {
+        this.db
+          .query(
+            `
+            INSERT INTO auth_invitations (
+              project_id,
+              id,
+              email,
+              status,
+              created_by_principal_type,
+              created_by_principal_id,
+              created_by_session_id,
+              created_at,
+              updated_at,
+              expires_at
+            ) VALUES (?, ?, ?, 'pending', ?, ?, ?, ?, ?, ?)
+          `
+          )
+          .run(
+            projectId,
+            id,
+            email,
+            input.createdByPrincipal?.type ?? null,
+            input.createdByPrincipal?.id ?? null,
+            input.createdBySessionId ?? null,
+            toIso(createdAt),
+            toIso(now),
+            toIso(input.expiresAt)
+          )
+      } catch (error) {
+        mapUniqueConstraintError(
+          error,
+          "duplicate_invitation",
+          `[Sixb] Invitation '${id}' already exists for project '${projectId}'.`
+        )
+      }
+
+      replaceInvitationGroups(this.db, { projectId, invitationId: id, groupIds })
+      return requireInvitationById(this.db, { projectId, id })
+    })
+  }
+
+  async getById(params: {
+    readonly projectId: string
+    readonly id: string
+  }): Promise<InvitationRecord | null> {
+    return getInvitationById(this.db, params)
+  }
+
+  async getActiveByEmail(params: {
+    readonly projectId: string
+    readonly email: string
+    readonly now: Date
+  }): Promise<InvitationRecord | null> {
+    return getActiveInvitationByEmail(this.db, params)
+  }
+
+  async list(input: ListAuthInvitationsInput): Promise<ListAuthInvitationsResult> {
+    if (hasEmptyFilter(input.statuses) || hasEmptyFilter(input.groupIds)) {
+      return { invitations: [], hasMore: false, total: 0 }
+    }
+
+    const whereClauses = ["project_id = ?"]
+    const args: SqliteValue[] = [input.projectId]
+
+    if (input.email) {
+      whereClauses.push("email = ?")
+      args.push(normalizeEmail(input.email))
+    }
+
+    if (input.statuses) {
+      whereClauses.push(`status IN (${input.statuses.map(() => "?").join(", ")})`)
+      args.push(...input.statuses)
+    }
+
+    const groupIds = input.groupIds ? normalizeGroupIds(input.groupIds) : null
+    if (groupIds) {
+      whereClauses.push(`
+        EXISTS (
+          SELECT 1
+          FROM auth_invitation_groups invitation_groups
+          WHERE invitation_groups.project_id = auth_invitations.project_id
+            AND invitation_groups.invitation_id = auth_invitations.id
+            AND invitation_groups.group_id IN (${groupIds.map(() => "?").join(", ")})
+        )
+      `)
+      args.push(...groupIds)
+    }
+
+    const where = `WHERE ${whereClauses.join(" AND ")}`
+    const order = input.order === "asc" ? "ASC" : "DESC"
+    const totalRow = this.db
+      .query(`SELECT COUNT(*) AS count FROM auth_invitations ${where}`)
+      .get(...args) as { readonly count: number }
+
+    const queryArgs = [...args]
+    const query = appendPagination(
+      `
+      SELECT *
+      FROM auth_invitations
+      ${where}
+      ORDER BY created_at ${order}, id ${order}
+    `,
+      queryArgs,
+      input
+    )
+    const rows = this.db.query(query).all(...queryArgs) as SqliteAuthInvitationRow[]
+
+    return {
+      invitations: rows.map((row) =>
+        rowToInvitationRecord(
+          row,
+          getInvitationGroupIds(this.db, {
+            projectId: row.project_id,
+            invitationId: row.id,
+          })
+        )
+      ),
+      hasMore: (input.offset ?? 0) + rows.length < totalRow.count,
+      total: totalRow.count,
+    }
+  }
+
+  async accept(params: {
+    readonly projectId: string
+    readonly id: string
+    readonly acceptedAt: Date
+  }): Promise<InvitationRecord> {
+    return runImmediateTransaction(this.db, () => {
+      requireInvitationById(this.db, params)
+
+      this.db
+        .query(
+          `
+          UPDATE auth_invitations
+          SET status = 'accepted',
+              accepted_at = ?,
+              updated_at = ?
+          WHERE project_id = ?
+            AND id = ?
+        `
+        )
+        .run(toIso(params.acceptedAt), toIso(params.acceptedAt), params.projectId, params.id)
+
+      return requireInvitationById(this.db, params)
+    })
+  }
+
+  async revoke(params: {
+    readonly projectId: string
+    readonly id: string
+    readonly revokedAt: Date
+  }): Promise<InvitationRecord> {
+    return runImmediateTransaction(this.db, () => {
+      requireInvitationById(this.db, params)
+
+      this.db
+        .query(
+          `
+          UPDATE auth_invitations
+          SET status = 'revoked',
+              revoked_at = ?,
+              updated_at = ?
+          WHERE project_id = ?
+            AND id = ?
+        `
+        )
+        .run(toIso(params.revokedAt), toIso(params.revokedAt), params.projectId, params.id)
+
+      return requireInvitationById(this.db, params)
+    })
+  }
+}

package/src/auth-storage/magic-links.ts

@@ -0,0 +1,149 @@
+import type { Database } from "bun:sqlite"
+import { resolveAuthSessionAudience } from "@sixb/core"
+import type {
+  AuthMagicLinkStore,
+  CreateAuthMagicLinkInput,
+  MagicLinkRecord,
+} from "@sixb/core/storage"
+import { AuthStorageError } from "@sixb/core/storage"
+import { runImmediateTransaction } from "../transactions"
+import type { SqliteAuthMagicLinkRow } from "./rows"
+import { rowToMagicLinkRecord } from "./rows"
+import {
+  assertNonEmpty,
+  consumeMagicLink,
+  getMagicLinkById,
+  getMagicLinkRowById,
+  mapUniqueConstraintError,
+  normalizeEmail,
+  revokeActiveMagicLinksForEmail,
+  toIso,
+} from "./shared"
+
+export class SqliteAuthMagicLinkStore implements AuthMagicLinkStore {
+  constructor(private readonly db: Database) {}
+
+  async create(input: CreateAuthMagicLinkInput): Promise<MagicLinkRecord> {
+    return runImmediateTransaction(this.db, () => {
+      const id = assertNonEmpty(input.id, "Magic link id")
+      const projectId = assertNonEmpty(input.projectId, "Project id")
+      const strategyId = assertNonEmpty(input.strategyId, "Strategy id")
+      const audience = resolveAuthSessionAudience(input.audience)
+      const email = normalizeEmail(input.email)
+      const tokenHash = assertNonEmpty(input.tokenHash, "Magic link token hash")
+
+      if (getMagicLinkRowById(this.db, { projectId, id })) {
+        throw new AuthStorageError(
+          "duplicate_magic_link",
+          `[Sixb] Magic link '${id}' already exists for project '${projectId}'.`
+        )
+      }
+
+      revokeActiveMagicLinksForEmail(this.db, {
+        projectId,
+        email,
+        revokedAt: input.createdAt,
+      })
+
+      try {
+        this.db
+          .query(
+            `
+            INSERT INTO auth_magic_links (
+              project_id,
+              id,
+              strategy_id,
+              audience,
+              email,
+              token_hash,
+              return_to,
+              created_at,
+              expires_at
+            ) VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?)
+          `
+          )
+          .run(
+            projectId,
+            id,
+            strategyId,
+            audience,
+            email,
+            tokenHash,
+            input.returnTo ?? null,
+            toIso(input.createdAt),
+            toIso(input.expiresAt)
+          )
+      } catch (error) {
+        mapUniqueConstraintError(
+          error,
+          "duplicate_magic_link",
+          `[Sixb] Magic link '${id}' already exists for project '${projectId}'.`
+        )
+      }
+
+      return {
+        id,
+        projectId,
+        strategyId,
+        audience,
+        email,
+        tokenHash,
+        returnTo: input.returnTo,
+        createdAt: new Date(input.createdAt),
+        expiresAt: new Date(input.expiresAt),
+      }
+    })
+  }
+
+  async getById(params: {
+    readonly projectId: string
+    readonly id: string
+  }): Promise<MagicLinkRecord | null> {
+    return getMagicLinkById(this.db, params)
+  }
+
+  async getActiveByEmail(params: {
+    readonly projectId: string
+    readonly email: string
+    readonly now: Date
+  }): Promise<MagicLinkRecord | null> {
+    const row = this.db
+      .query(
+        `
+        SELECT *
+        FROM auth_magic_links
+        WHERE project_id = ?
+          AND email = ?
+          AND consumed_at IS NULL
+          AND revoked_at IS NULL
+          AND expires_at > ?
+        ORDER BY created_at DESC, id DESC
+        LIMIT 1
+      `
+      )
+      .get(
+        params.projectId,
+        normalizeEmail(params.email),
+        toIso(params.now)
+      ) as SqliteAuthMagicLinkRow | null
+
+    return row ? rowToMagicLinkRecord(row) : null
+  }
+
+  async consume(params: {
+    readonly projectId: string
+    readonly id: string
+    readonly tokenHash: string
+    readonly consumedAt: Date
+  }): Promise<MagicLinkRecord> {
+    return runImmediateTransaction(this.db, () => consumeMagicLink(this.db, params))
+  }
+
+  async revokeActiveForEmail(params: {
+    readonly projectId: string
+    readonly email: string
+    readonly revokedAt: Date
+  }): Promise<readonly MagicLinkRecord[]> {
+    return runImmediateTransaction(this.db, () => revokeActiveMagicLinksForEmail(this.db, params))
+  }
+}

package/src/auth-storage/oidc-attempts.ts

@@ -0,0 +1,109 @@
+import type { Database } from "bun:sqlite"
+import { resolveAuthSessionAudience } from "@sixb/core"
+import type {
+  AuthOidcAuthorizationAttemptStore,
+  CreateOidcAuthorizationAttemptInput,
+  OidcAuthorizationAttemptRecord,
+} from "@sixb/core/storage"
+import { AuthStorageError } from "@sixb/core/storage"
+import { runImmediateTransaction } from "../transactions"
+import {
+  assertNonEmpty,
+  consumeOidcAttempt,
+  getOidcAttemptById,
+  getOidcAttemptRowById,
+  mapUniqueConstraintError,
+  toIso,
+} from "./shared"
+
+export class SqliteAuthOidcAuthorizationAttemptStore implements AuthOidcAuthorizationAttemptStore {
+  constructor(private readonly db: Database) {}
+
+  async create(
+    input: CreateOidcAuthorizationAttemptInput
+  ): Promise<OidcAuthorizationAttemptRecord> {
+    return runImmediateTransaction(this.db, () => {
+      const id = assertNonEmpty(input.id, "OIDC authorization attempt id")
+      const projectId = assertNonEmpty(input.projectId, "Project id")
+      const strategyId = assertNonEmpty(input.strategyId, "Strategy id")
+      const audience = resolveAuthSessionAudience(input.audience)
+      const stateHash = assertNonEmpty(input.stateHash, "OIDC state hash")
+      const nonceHash = assertNonEmpty(input.nonceHash, "OIDC nonce hash")
+      const codeVerifier = assertNonEmpty(input.codeVerifier, "OIDC code verifier")
+
+      if (getOidcAttemptRowById(this.db, { projectId, id })) {
+        throw new AuthStorageError(
+          "duplicate_oidc_attempt",
+          `[Sixb] OIDC authorization attempt '${id}' already exists for project '${projectId}'.`
+        )
+      }
+
+      try {
+        this.db
+          .query(
+            `
+            INSERT INTO auth_oidc_authorization_attempts (
+              project_id,
+              id,
+              strategy_id,
+              audience,
+              state_hash,
+              nonce_hash,
+              code_verifier,
+              return_to,
+              created_at,
+              expires_at
+            ) VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?)
+          `
+          )
+          .run(
+            projectId,
+            id,
+            strategyId,
+            audience,
+            stateHash,
+            nonceHash,
+            codeVerifier,
+            input.returnTo ?? null,
+            toIso(input.createdAt),
+            toIso(input.expiresAt)
+          )
+      } catch (error) {
+        mapUniqueConstraintError(
+          error,
+          "duplicate_oidc_attempt",
+          `[Sixb] OIDC authorization attempt '${id}' already exists for project '${projectId}'.`
+        )
+      }
+
+      return {
+        id,
+        projectId,
+        strategyId,
+        audience,
+        stateHash,
+        nonceHash,
+        codeVerifier,
+        returnTo: input.returnTo,
+        createdAt: new Date(input.createdAt),
+        expiresAt: new Date(input.expiresAt),
+      }
+    })
+  }
+
+  async getById(params: {
+    readonly projectId: string
+    readonly id: string
+  }): Promise<OidcAuthorizationAttemptRecord | null> {
+    return getOidcAttemptById(this.db, params)
+  }
+
+  async consume(params: {
+    readonly projectId: string
+    readonly id: string
+    readonly stateHash: string
+    readonly consumedAt: Date
+  }): Promise<OidcAuthorizationAttemptRecord> {
+    return runImmediateTransaction(this.db, () => consumeOidcAttempt(this.db, params))
+  }
+}