@sixb/sqlite 0.0.1

package/src/auth-storage/rows.ts

@@ -0,0 +1,338 @@
+import type { Principal } from "@sixb/core"
+import type {
+  AccessTokenRecord,
+  GroupMembershipRecord,
+  GroupMembershipSource,
+  InvitationRecord,
+  InvitationStatus,
+  MagicLinkRecord,
+  OidcAuthorizationAttemptRecord,
+  ServiceAccountGroupMembershipRecord,
+  ServiceAccountRecord,
+  ServiceAccountStatus,
+  SessionRecord,
+  UserIdentityRecord,
+  UserRecord,
+  UserStatus,
+} from "@sixb/core/storage"
+
+export interface SqliteAuthUserRow {
+  readonly project_id: string
+  readonly id: string
+  readonly email: string
+  readonly display_name: string | null
+  readonly avatar_url: string | null
+  readonly status: UserStatus
+  readonly created_at: string
+  readonly updated_at: string
+}
+
+export interface SqliteAuthUserIdentityRow {
+  readonly project_id: string
+  readonly strategy_id: string
+  readonly subject: string
+  readonly user_id: string
+  readonly claims: string | null
+  readonly created_at: string
+  readonly updated_at: string
+}
+
+export interface SqliteAuthServiceAccountRow {
+  readonly project_id: string
+  readonly id: string
+  readonly name: string
+  readonly description: string | null
+  readonly status: ServiceAccountStatus
+  readonly created_by_principal_type: Principal["type"] | null
+  readonly created_by_principal_id: string | null
+  readonly created_by_session_id: string | null
+  readonly created_at: string
+  readonly updated_at: string
+}
+
+export interface SqliteAuthServiceAccountGroupMembershipRow {
+  readonly project_id: string
+  readonly service_account_id: string
+  readonly group_id: string
+  readonly source: GroupMembershipSource
+  readonly created_at: string
+}
+
+export interface SqliteAuthSessionRow {
+  readonly project_id: string
+  readonly id: string
+  readonly user_id: string
+  readonly strategy_id: string
+  readonly audience: SessionRecord["audience"]
+  readonly token_hash: string
+  readonly created_at: string
+  readonly expires_at: string
+  readonly absolute_expires_at: string | null
+  readonly revoked_at: string | null
+  readonly last_seen_at: string | null
+  readonly user_agent: string | null
+  readonly ip_address: string | null
+}
+
+export interface SqliteAuthAccessTokenRow {
+  readonly project_id: string
+  readonly id: string
+  readonly name: string
+  readonly kind: AccessTokenRecord["kind"]
+  readonly subject_type: AccessTokenRecord["subjectType"]
+  readonly subject_id: string
+  readonly token_hash: string
+  readonly group_ids: string | null
+  readonly created_by_principal_type: Principal["type"] | null
+  readonly created_by_principal_id: string | null
+  readonly created_by_session_id: string | null
+  readonly created_at: string
+  readonly expires_at: string
+  readonly revoked_at: string | null
+  readonly last_used_at: string | null
+  readonly last_used_user_agent: string | null
+  readonly last_used_ip_address: string | null
+}
+
+export interface SqliteAuthInvitationRow {
+  readonly project_id: string
+  readonly id: string
+  readonly email: string
+  readonly status: InvitationStatus
+  readonly created_by_principal_type: Principal["type"] | null
+  readonly created_by_principal_id: string | null
+  readonly created_by_session_id: string | null
+  readonly created_at: string
+  readonly updated_at: string
+  readonly expires_at: string
+  readonly accepted_at: string | null
+  readonly revoked_at: string | null
+}
+
+export interface SqliteAuthGroupMembershipRow {
+  readonly project_id: string
+  readonly user_id: string
+  readonly group_id: string
+  readonly source: GroupMembershipSource
+  readonly created_at: string
+}
+
+export interface SqliteAuthMagicLinkRow {
+  readonly project_id: string
+  readonly id: string
+  readonly strategy_id: string
+  readonly audience: MagicLinkRecord["audience"]
+  readonly email: string
+  readonly token_hash: string
+  readonly return_to: string | null
+  readonly created_at: string
+  readonly expires_at: string
+  readonly consumed_at: string | null
+  readonly revoked_at: string | null
+}
+
+export interface SqliteAuthOidcAttemptRow {
+  readonly project_id: string
+  readonly id: string
+  readonly strategy_id: string
+  readonly audience: OidcAuthorizationAttemptRecord["audience"]
+  readonly state_hash: string
+  readonly nonce_hash: string
+  readonly code_verifier: string
+  readonly return_to: string | null
+  readonly created_at: string
+  readonly expires_at: string
+  readonly consumed_at: string | null
+}
+
+export function rowToUserRecord(row: SqliteAuthUserRow): UserRecord {
+  return {
+    id: row.id,
+    projectId: row.project_id,
+    email: row.email,
+    displayName: row.display_name ?? undefined,
+    avatarUrl: row.avatar_url ?? undefined,
+    status: row.status,
+    createdAt: new Date(row.created_at),
+    updatedAt: new Date(row.updated_at),
+  }
+}
+
+export function rowToIdentityRecord(row: SqliteAuthUserIdentityRow): UserIdentityRecord {
+  return {
+    projectId: row.project_id,
+    strategyId: row.strategy_id,
+    subject: row.subject,
+    userId: row.user_id,
+    claims: parseOptionalRecord(row.claims),
+    createdAt: new Date(row.created_at),
+    updatedAt: new Date(row.updated_at),
+  }
+}
+
+export function rowToServiceAccountRecord(row: SqliteAuthServiceAccountRow): ServiceAccountRecord {
+  return {
+    id: row.id,
+    projectId: row.project_id,
+    name: row.name,
+    description: row.description ?? undefined,
+    status: row.status,
+    createdByPrincipal:
+      row.created_by_principal_type && row.created_by_principal_id
+        ? {
+            type: row.created_by_principal_type,
+            id: row.created_by_principal_id,
+          }
+        : undefined,
+    createdBySessionId: row.created_by_session_id ?? undefined,
+    createdAt: new Date(row.created_at),
+    updatedAt: new Date(row.updated_at),
+  }
+}
+
+export function rowToServiceAccountGroupMembershipRecord(
+  row: SqliteAuthServiceAccountGroupMembershipRow
+): ServiceAccountGroupMembershipRecord {
+  return {
+    projectId: row.project_id,
+    serviceAccountId: row.service_account_id,
+    groupId: row.group_id,
+    source: row.source,
+    createdAt: new Date(row.created_at),
+  }
+}
+
+export function rowToSessionRecord(row: SqliteAuthSessionRow): SessionRecord {
+  return {
+    id: row.id,
+    projectId: row.project_id,
+    userId: row.user_id,
+    strategyId: row.strategy_id,
+    audience: row.audience,
+    tokenHash: row.token_hash,
+    createdAt: new Date(row.created_at),
+    expiresAt: new Date(row.expires_at),
+    absoluteExpiresAt: row.absolute_expires_at ? new Date(row.absolute_expires_at) : undefined,
+    revokedAt: row.revoked_at ? new Date(row.revoked_at) : undefined,
+    lastSeenAt: row.last_seen_at ? new Date(row.last_seen_at) : undefined,
+    userAgent: row.user_agent ?? undefined,
+    ipAddress: row.ip_address ?? undefined,
+  }
+}
+
+export function rowToAccessTokenRecord(row: SqliteAuthAccessTokenRow): AccessTokenRecord {
+  return {
+    id: row.id,
+    projectId: row.project_id,
+    name: row.name,
+    kind: row.kind,
+    subjectType: row.subject_type,
+    subjectId: row.subject_id,
+    tokenHash: row.token_hash,
+    groupIds: parseOptionalStringArray(row.group_ids),
+    createdByPrincipal:
+      row.created_by_principal_type && row.created_by_principal_id
+        ? {
+            type: row.created_by_principal_type,
+            id: row.created_by_principal_id,
+          }
+        : undefined,
+    createdBySessionId: row.created_by_session_id ?? undefined,
+    createdAt: new Date(row.created_at),
+    expiresAt: new Date(row.expires_at),
+    revokedAt: row.revoked_at ? new Date(row.revoked_at) : undefined,
+    lastUsedAt: row.last_used_at ? new Date(row.last_used_at) : undefined,
+    lastUsedUserAgent: row.last_used_user_agent ?? undefined,
+    lastUsedIpAddress: row.last_used_ip_address ?? undefined,
+  }
+}
+
+export function rowToInvitationRecord(
+  row: SqliteAuthInvitationRow,
+  groupIds: readonly string[]
+): InvitationRecord {
+  return {
+    id: row.id,
+    projectId: row.project_id,
+    email: row.email,
+    groupIds,
+    status: row.status,
+    createdByPrincipal:
+      row.created_by_principal_type && row.created_by_principal_id
+        ? {
+            type: row.created_by_principal_type,
+            id: row.created_by_principal_id,
+          }
+        : undefined,
+    createdBySessionId: row.created_by_session_id ?? undefined,
+    createdAt: new Date(row.created_at),
+    updatedAt: new Date(row.updated_at),
+    expiresAt: new Date(row.expires_at),
+    acceptedAt: row.accepted_at ? new Date(row.accepted_at) : undefined,
+    revokedAt: row.revoked_at ? new Date(row.revoked_at) : undefined,
+  }
+}
+
+export function rowToGroupMembershipRecord(
+  row: SqliteAuthGroupMembershipRow
+): GroupMembershipRecord {
+  return {
+    projectId: row.project_id,
+    userId: row.user_id,
+    groupId: row.group_id,
+    source: row.source,
+    createdAt: new Date(row.created_at),
+  }
+}
+
+export function rowToMagicLinkRecord(row: SqliteAuthMagicLinkRow): MagicLinkRecord {
+  return {
+    id: row.id,
+    projectId: row.project_id,
+    strategyId: row.strategy_id,
+    audience: row.audience,
+    email: row.email,
+    tokenHash: row.token_hash,
+    returnTo: row.return_to ?? undefined,
+    createdAt: new Date(row.created_at),
+    expiresAt: new Date(row.expires_at),
+    consumedAt: row.consumed_at ? new Date(row.consumed_at) : undefined,
+    revokedAt: row.revoked_at ? new Date(row.revoked_at) : undefined,
+  }
+}
+
+export function rowToOidcAuthorizationAttemptRecord(
+  row: SqliteAuthOidcAttemptRow
+): OidcAuthorizationAttemptRecord {
+  return {
+    id: row.id,
+    projectId: row.project_id,
+    strategyId: row.strategy_id,
+    audience: row.audience,
+    stateHash: row.state_hash,
+    nonceHash: row.nonce_hash,
+    codeVerifier: row.code_verifier,
+    returnTo: row.return_to ?? undefined,
+    createdAt: new Date(row.created_at),
+    expiresAt: new Date(row.expires_at),
+    consumedAt: row.consumed_at ? new Date(row.consumed_at) : undefined,
+  }
+}
+
+export function serializeOptionalRecord(
+  value: Readonly<Record<string, unknown>> | undefined
+): string | null {
+  return value ? JSON.stringify(value) : null
+}
+
+export function serializeOptionalStringArray(value: readonly string[] | undefined): string | null {
+  return value === undefined ? null : JSON.stringify(value)
+}
+
+function parseOptionalRecord(value: string | null): Readonly<Record<string, unknown>> | undefined {
+  return value ? (JSON.parse(value) as Readonly<Record<string, unknown>>) : undefined
+}
+
+function parseOptionalStringArray(value: string | null): readonly string[] | undefined {
+  return value === null ? undefined : (JSON.parse(value) as readonly string[])
+}

package/src/auth-storage/service-account-group-memberships.ts

@@ -0,0 +1,161 @@
+import type { Database } from "bun:sqlite"
+import type {
+  AuthServiceAccountGroupMembershipStore,
+  ReconcileAuthServiceAccountGroupMembershipsInput,
+  ServiceAccountGroupMembershipRecord,
+  UpsertAuthServiceAccountGroupMembershipInput,
+} from "@sixb/core/storage"
+import { AuthStorageError } from "@sixb/core/storage"
+import type {
+  SqliteAuthServiceAccountGroupMembershipRow,
+  SqliteAuthServiceAccountRow,
+} from "./rows"
+import { rowToServiceAccountGroupMembershipRecord } from "./rows"
+import { assertNonEmpty, dateOrNow, normalizeGroupIds, toIso } from "./shared"
+
+export class SqliteAuthServiceAccountGroupMembershipStore
+  implements AuthServiceAccountGroupMembershipStore
+{
+  constructor(private readonly db: Database) {}
+
+  async upsert(
+    input: UpsertAuthServiceAccountGroupMembershipInput
+  ): Promise<ServiceAccountGroupMembershipRecord> {
+    const projectId = assertNonEmpty(input.projectId, "Project id")
+    const serviceAccountId = assertNonEmpty(input.serviceAccountId, "Service account id")
+    const groupId = assertNonEmpty(input.groupId, "Group id")
+    const serviceAccount = this.db
+      .query("SELECT * FROM auth_service_accounts WHERE project_id = ? AND id = ?")
+      .get(projectId, serviceAccountId) as SqliteAuthServiceAccountRow | null
+    if (!serviceAccount) {
+      throw new AuthStorageError(
+        "missing_service_account",
+        `[Sixb] Service account '${serviceAccountId}' not found for project '${projectId}'.`
+      )
+    }
+
+    this.db
+      .query(
+        `
+        INSERT OR IGNORE INTO auth_service_account_group_memberships (
+          project_id,
+          service_account_id,
+          group_id,
+          source,
+          created_at
+        ) VALUES (?, ?, ?, ?, ?)
+      `
+      )
+      .run(projectId, serviceAccountId, groupId, input.source, toIso(dateOrNow(input.createdAt)))
+
+    const row = this.db
+      .query(
+        `
+        SELECT *
+        FROM auth_service_account_group_memberships
+        WHERE project_id = ?
+          AND service_account_id = ?
+          AND group_id = ?
+      `
+      )
+      .get(projectId, serviceAccountId, groupId) as SqliteAuthServiceAccountGroupMembershipRow
+    return rowToServiceAccountGroupMembershipRecord(row)
+  }
+
+  async reconcileForServiceAccount(
+    input: ReconcileAuthServiceAccountGroupMembershipsInput
+  ): Promise<readonly ServiceAccountGroupMembershipRecord[]> {
+    const projectId = assertNonEmpty(input.projectId, "Project id")
+    const serviceAccountId = assertNonEmpty(input.serviceAccountId, "Service account id")
+    const serviceAccount = this.db
+      .query("SELECT * FROM auth_service_accounts WHERE project_id = ? AND id = ?")
+      .get(projectId, serviceAccountId) as SqliteAuthServiceAccountRow | null
+    if (!serviceAccount) {
+      throw new AuthStorageError(
+        "missing_service_account",
+        `[Sixb] Service account '${serviceAccountId}' not found for project '${projectId}'.`
+      )
+    }
+
+    const groupIds = normalizeGroupIds(input.groupIds)
+    const desired = new Set(groupIds)
+    const existing = await this.listForServiceAccount({ projectId, serviceAccountId })
+    for (const membership of existing) {
+      if (membership.source === input.source && !desired.has(membership.groupId)) {
+        this.db
+          .query(
+            `
+            DELETE FROM auth_service_account_group_memberships
+            WHERE project_id = ?
+              AND service_account_id = ?
+              AND group_id = ?
+              AND source = ?
+          `
+          )
+          .run(projectId, serviceAccountId, membership.groupId, input.source)
+      }
+    }
+
+    const updatedAt = toIso(dateOrNow(input.updatedAt))
+    for (const groupId of groupIds) {
+      this.db
+        .query(
+          `
+          INSERT INTO auth_service_account_group_memberships (
+            project_id,
+            service_account_id,
+            group_id,
+            source,
+            created_at
+          ) VALUES (?, ?, ?, ?, ?)
+          ON CONFLICT(project_id, service_account_id, group_id) DO UPDATE
+          SET source = excluded.source
+        `
+        )
+        .run(projectId, serviceAccountId, groupId, input.source, updatedAt)
+    }
+
+    return this.listForServiceAccount({ projectId, serviceAccountId })
+  }
+
+  async listForServiceAccount(params: {
+    readonly projectId: string
+    readonly serviceAccountId: string
+  }): Promise<readonly ServiceAccountGroupMembershipRecord[]> {
+    const rows = this.db
+      .query(
+        `
+        SELECT *
+        FROM auth_service_account_group_memberships
+        WHERE project_id = ?
+          AND service_account_id = ?
+        ORDER BY group_id ASC
+      `
+      )
+      .all(
+        params.projectId,
+        params.serviceAccountId
+      ) as SqliteAuthServiceAccountGroupMembershipRow[]
+
+    return rows.map(rowToServiceAccountGroupMembershipRecord)
+  }
+
+  async listForGroup(params: {
+    readonly projectId: string
+    readonly groupId: string
+  }): Promise<readonly ServiceAccountGroupMembershipRecord[]> {
+    const rows = this.db
+      .query(
+        `
+        SELECT *
+        FROM auth_service_account_group_memberships
+        WHERE project_id = ?
+          AND group_id = ?
+        ORDER BY service_account_id ASC
+      `
+      )
+      .all(params.projectId, params.groupId) as SqliteAuthServiceAccountGroupMembershipRow[]
+
+    return rows.map(rowToServiceAccountGroupMembershipRecord)
+  }
+}

package/src/auth-storage/service-accounts.ts

@@ -0,0 +1,168 @@
+import type { Database } from "bun:sqlite"
+import type {
+  AuthServiceAccountStore,
+  CreateAuthServiceAccountInput,
+  ListAuthServiceAccountsInput,
+  ListAuthServiceAccountsResult,
+  ServiceAccountRecord,
+  UpdateAuthServiceAccountInput,
+} from "@sixb/core/storage"
+import { AuthStorageError } from "@sixb/core/storage"
+import type { SqliteAuthServiceAccountRow } from "./rows"
+import { rowToServiceAccountRecord } from "./rows"
+import {
+  appendPagination,
+  assertNonEmpty,
+  dateOrNow,
+  hasEmptyFilter,
+  mapUniqueConstraintError,
+  type SqliteValue,
+  toIso,
+} from "./shared"
+
+export class SqliteAuthServiceAccountStore implements AuthServiceAccountStore {
+  constructor(private readonly db: Database) {}
+
+  async create(input: CreateAuthServiceAccountInput): Promise<ServiceAccountRecord> {
+    const id = assertNonEmpty(input.id, "Service account id")
+    const projectId = assertNonEmpty(input.projectId, "Project id")
+    const name = assertNonEmpty(input.name, "Service account name")
+    const createdAt = dateOrNow(input.createdAt)
+    const updatedAt = input.updatedAt ? new Date(input.updatedAt) : createdAt
+
+    try {
+      this.db
+        .query(
+          `
+          INSERT INTO auth_service_accounts (
+            project_id,
+            id,
+            name,
+            description,
+            status,
+            created_by_principal_type,
+            created_by_principal_id,
+            created_by_session_id,
+            created_at,
+            updated_at
+          ) VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?)
+        `
+        )
+        .run(
+          projectId,
+          id,
+          name,
+          input.description ?? null,
+          input.status ?? "active",
+          input.createdByPrincipal?.type ?? null,
+          input.createdByPrincipal?.id ?? null,
+          input.createdBySessionId ?? null,
+          toIso(createdAt),
+          toIso(updatedAt)
+        )
+    } catch (error) {
+      mapUniqueConstraintError(
+        error,
+        "duplicate_service_account",
+        `[Sixb] Service account '${id}' already exists for project '${projectId}'.`
+      )
+    }
+
+    return {
+      id,
+      projectId,
+      name,
+      description: input.description,
+      status: input.status ?? "active",
+      createdByPrincipal: input.createdByPrincipal,
+      createdBySessionId: input.createdBySessionId,
+      createdAt,
+      updatedAt,
+    }
+  }
+
+  async getById(params: {
+    readonly projectId: string
+    readonly id: string
+  }): Promise<ServiceAccountRecord | null> {
+    const row = this.db
+      .query("SELECT * FROM auth_service_accounts WHERE project_id = ? AND id = ?")
+      .get(params.projectId, params.id) as SqliteAuthServiceAccountRow | null
+    return row ? rowToServiceAccountRecord(row) : null
+  }
+
+  async update(input: UpdateAuthServiceAccountInput): Promise<ServiceAccountRecord> {
+    const existing = await this.getById(input)
+    if (!existing) {
+      throw new AuthStorageError(
+        "missing_service_account",
+        `[Sixb] Service account '${input.id}' not found for project '${input.projectId}'.`
+      )
+    }
+
+    const updatedAt = dateOrNow(input.updatedAt)
+    const name =
+      input.name === undefined ? existing.name : assertNonEmpty(input.name, "Service account name")
+    const description = input.description === undefined ? existing.description : input.description
+    const status = input.status ?? existing.status
+    this.db
+      .query(
+        `
+        UPDATE auth_service_accounts
+        SET name = ?,
+            description = ?,
+            status = ?,
+            updated_at = ?
+        WHERE project_id = ?
+          AND id = ?
+      `
+      )
+      .run(name, description ?? null, status, toIso(updatedAt), input.projectId, input.id)
+
+    return {
+      ...existing,
+      name,
+      description,
+      status,
+      updatedAt,
+    }
+  }
+
+  async list(input: ListAuthServiceAccountsInput): Promise<ListAuthServiceAccountsResult> {
+    if (hasEmptyFilter(input.statuses)) {
+      return { serviceAccounts: [], hasMore: false, total: 0 }
+    }
+
+    const whereClauses = ["project_id = ?"]
+    const args: SqliteValue[] = [input.projectId]
+    if (input.statuses) {
+      whereClauses.push(`status IN (${input.statuses.map(() => "?").join(", ")})`)
+      args.push(...input.statuses)
+    }
+
+    const where = `WHERE ${whereClauses.join(" AND ")}`
+    const order = input.order === "desc" ? "DESC" : "ASC"
+    const totalRow = this.db
+      .query(`SELECT COUNT(*) AS count FROM auth_service_accounts ${where}`)
+      .get(...args) as { readonly count: number }
+    const queryArgs = [...args]
+    const query = appendPagination(
+      `
+      SELECT *
+      FROM auth_service_accounts
+      ${where}
+      ORDER BY created_at ${order}, id ${order}
+    `,
+      queryArgs,
+      input
+    )
+    const rows = this.db.query(query).all(...queryArgs) as SqliteAuthServiceAccountRow[]
+
+    return {
+      serviceAccounts: rows.map(rowToServiceAccountRecord),
+      hasMore:
+        input.limit === undefined ? false : (input.offset ?? 0) + input.limit < totalRow.count,
+      total: totalRow.count,
+    }
+  }
+}