@sixb/sqlite 0.1.13 → 0.1.14

package/dist/migrations.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"migrations.d.ts","sourceRoot":"","sources":["../src/migrations.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,MAAM,YAAY,CAAA;AAIrC,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,YAAY,CAAA;AACjD,OAAO,KAAK,EAGV,YAAY,EACZ,aAAa,EACb,oBAAoB,EACrB,MAAM,oBAAoB,CAAA;AAqH3B,eAAO,MAAM,yBAAyB,sBAAsB,CAAA;AAC5D,eAAO,MAAM,mBAAmB,mBAAmB,CAAA;AAEnD,eAAO,MAAM,uBAAuB,wBAwFlC,CAAA;AAEF,wBAAgB,iBAAiB,CAAC,QAAQ,EAAE,MAAM,GAAG,MAAM,CAE1D;AAED,wBAAgB,SAAS,CAAC,EAAE,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,aAAa,CAAC,QAAQ,CAAC,CAQ9E;AAED,wBAAgB,UAAU,CACxB,EAAE,EAAE,MAAM,EACV,EAAE,EAAE,CAAC,EAAE,EAAE,QAAQ,KAAK,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,EAC1C,OAAO,GAAE,oBAAyB,GACjC,aAAa,CAAC,QAAQ,CAAC,CAEzB;AAED,wBAAgB,wBAAwB,CAAC,EAAE,EAAE,QAAQ,GAAG,IAAI,CAS3D;AAED,wBAAgB,4BAA4B,CAAC,QAAQ,EAAE,MAAM,GAAG,SAAS,eAAe,EAAE,CAOzF;AAED,wBAAgB,oBAAoB,CAAC,MAAM,EAAE;IAC3C,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;IACrB,QAAQ,CAAC,UAAU,EAAE,YAAY,CAAC,QAAQ,CAAC,CAAA;CAC5C,GAAG,eAAe,CAoBlB;AAED,wBAAsB,oBAAoB,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAM1E"}
+{"version":3,"file":"migrations.d.ts","sourceRoot":"","sources":["../src/migrations.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,MAAM,YAAY,CAAA;AAIrC,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,YAAY,CAAA;AACjD,OAAO,KAAK,EAGV,YAAY,EACZ,aAAa,EACb,oBAAoB,EACrB,MAAM,oBAAoB,CAAA;AAwH3B,eAAO,MAAM,yBAAyB,sBAAsB,CAAA;AAC5D,eAAO,MAAM,mBAAmB,mBAAmB,CAAA;AAEnD,eAAO,MAAM,uBAAuB,wBAyFlC,CAAA;AAEF,wBAAgB,iBAAiB,CAAC,QAAQ,EAAE,MAAM,GAAG,MAAM,CAE1D;AAED,wBAAgB,SAAS,CAAC,EAAE,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,aAAa,CAAC,QAAQ,CAAC,CAQ9E;AAED,wBAAgB,UAAU,CACxB,EAAE,EAAE,MAAM,EACV,EAAE,EAAE,CAAC,EAAE,EAAE,QAAQ,KAAK,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,EAC1C,OAAO,GAAE,oBAAyB,GACjC,aAAa,CAAC,QAAQ,CAAC,CAEzB;AAED,wBAAgB,wBAAwB,CAAC,EAAE,EAAE,QAAQ,GAAG,IAAI,CAS3D;AAED,wBAAgB,4BAA4B,CAAC,QAAQ,EAAE,MAAM,GAAG,SAAS,eAAe,EAAE,CAOzF;AAED,wBAAgB,oBAAoB,CAAC,MAAM,EAAE;IAC3C,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;IACrB,QAAQ,CAAC,UAAU,EAAE,YAAY,CAAC,QAAQ,CAAC,CAAA;CAC5C,GAAG,eAAe,CAoBlB;AAED,wBAAsB,oBAAoB,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAM1E"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@sixb/sqlite",
-  "version": "0.1.13",
+  "version": "0.1.14",
   "description": "SQLite storage provider for Sixb",
   "keywords": [
     "sixb",
@@ -37,10 +37,10 @@
     "prepack": "bun run build"
   },
   "peerDependencies": {
-    "@sixb/core": "0.1.13"
+    "@sixb/core": "0.1.14"
   },
   "devDependencies": {
-    "@sixb/core": "0.1.13",
+    "@sixb/core": "0.1.14",
     "@types/bun": "latest",
     "typescript": "^5.7.0"
   },

package/src/auth-storage/auth-storage.ts

@@ -8,6 +8,7 @@ import type {
   CompleteSignInResult,
   DeviceAuthorizationRecord,
   GroupMembershipRecord,
+  GroupMembershipSource,
   InvitationRecord,
   SessionRecord,
   SuspendUserAndRevokeSessionsInput,
@@ -200,27 +201,6 @@ export class SqliteAuthStorage implements AuthStorage {
           }
         }
 
-        if (
-          shouldCreateUser &&
-          !activeInvitation &&
-          input.allowUserCreationWithoutInvitation &&
-          input.requireNoActiveUsersForUserCreation &&
-          hasActiveUsers(this.db, projectId)
-        ) {
-          consumeMagicLink(this.db, {
-            projectId,
-            id: input.magicLinkId,
-            tokenHash: input.tokenHash,
-            consumedAt: completedAt,
-          })
-          return {
-            error: new AuthStorageError(
-              "user_creation_not_allowed",
-              `[Sixb] Magic link '${input.magicLinkId}' cannot create a user for project '${projectId}'.`
-            ),
-          }
-        }
-
         validateCompleteSessionInput(this.db, projectId, input.session)
         assertSignInSessionAudience(projectId, input.session.audience, magicLink.audience)
 
@@ -259,8 +239,9 @@ export class SqliteAuthStorage implements AuthStorage {
           projectId,
           user,
         })
-        const groupMemberships = this.applyManualGroups({
+        const groupMemberships = this.applyGroups({
           completedAt,
+          source: "manual",
           existing: invitation.groupMemberships,
           groupIds: manualGroupIds,
           projectId,
@@ -338,16 +319,6 @@ export class SqliteAuthStorage implements AuthStorage {
           }
         }
 
-        if (!identity && userRow && (!input.autoLinkByVerifiedEmail || !input.emailVerified)) {
-          this.consumeOidcAttempt(input, completedAt, projectId)
-          return {
-            error: new AuthStorageError(
-              "email_link_not_allowed",
-              `[Sixb] OIDC identity cannot auto-link to user '${userRow.id}' for project '${projectId}'.`
-            ),
-          }
-        }
-
         if (userRow?.status === "suspended") {
           this.consumeOidcAttempt(input, completedAt, projectId)
           return {
@@ -358,16 +329,6 @@ export class SqliteAuthStorage implements AuthStorage {
           }
         }
 
-        if (shouldCreateUser && !input.emailVerified) {
-          this.consumeOidcAttempt(input, completedAt, projectId)
-          return {
-            error: new AuthStorageError(
-              "user_creation_not_allowed",
-              `[Sixb] OIDC authorization attempt '${input.oidcAuthorizationAttemptId}' cannot create a user for project '${projectId}'.`
-            ),
-          }
-        }
-
         if (shouldCreateUser && !activeInvitation && !input.allowUserCreationWithoutInvitation) {
           this.consumeOidcAttempt(input, completedAt, projectId)
           return {
@@ -378,22 +339,6 @@ export class SqliteAuthStorage implements AuthStorage {
           }
         }
 
-        if (
-          shouldCreateUser &&
-          !activeInvitation &&
-          input.allowUserCreationWithoutInvitation &&
-          input.requireNoActiveUsersForUserCreation &&
-          hasActiveUsers(this.db, projectId)
-        ) {
-          this.consumeOidcAttempt(input, completedAt, projectId)
-          return {
-            error: new AuthStorageError(
-              "user_creation_not_allowed",
-              `[Sixb] OIDC authorization attempt '${input.oidcAuthorizationAttemptId}' cannot create a user for project '${projectId}'.`
-            ),
-          }
-        }
-
         validateCompleteSessionInput(this.db, projectId, input.session)
         assertSignInSessionAudience(projectId, input.session.audience, attempt.audience)
 
@@ -438,10 +383,17 @@ export class SqliteAuthStorage implements AuthStorage {
           projectId,
           user,
         })
-        const groupMemberships = this.applyManualGroups({
+        const groupMemberships = this.syncDirectoryGroups({
           completedAt,
-          existing: invitation.groupMemberships,
-          groupIds: manualGroupIds,
+          existing: this.applyGroups({
+            completedAt,
+            source: "manual",
+            existing: invitation.groupMemberships,
+            groupIds: manualGroupIds,
+            projectId,
+            userId: user.id,
+          }),
+          groupIds: input.directoryGroupIds,
           projectId,
           userId: user.id,
         })
@@ -684,11 +636,12 @@ export class SqliteAuthStorage implements AuthStorage {
     return { invitation, groupMemberships }
   }
 
-  private applyManualGroups(input: {
+  private applyGroups(input: {
     readonly completedAt: Date
     readonly existing: readonly GroupMembershipRecord[]
     readonly groupIds: readonly string[]
     readonly projectId: string
+    readonly source: GroupMembershipSource
     readonly userId: string
   }): readonly GroupMembershipRecord[] {
     const groupMemberships = [...input.existing]
@@ -699,7 +652,7 @@ export class SqliteAuthStorage implements AuthStorage {
           projectId: input.projectId,
           userId: input.userId,
           groupId,
-          source: "manual",
+          source: input.source,
           createdAt: input.completedAt,
         })
       )
@@ -707,6 +660,34 @@ export class SqliteAuthStorage implements AuthStorage {
 
     return groupMemberships
   }
+  // Directory memberships become exactly `groupIds`. A group the user already holds from another
+  // source keeps that source, and memberships from other sources are never removed.
+  private syncDirectoryGroups(input: {
+    readonly completedAt: Date
+    readonly existing: readonly GroupMembershipRecord[]
+    readonly groupIds?: readonly string[]
+    readonly projectId: string
+    readonly userId: string
+  }): readonly GroupMembershipRecord[] {
+    if (!input.groupIds) {
+      return input.existing
+    }
+
+    const groupIds = normalizeGroupIds(input.groupIds)
+    this.db
+      .query(
+        `
+        DELETE FROM auth_group_memberships
+        WHERE project_id = ?
+          AND user_id = ?
+          AND source = 'directory'
+          AND group_id NOT IN (${groupIds.map(() => "?").join(", ")})
+      `
+      )
+      .run(input.projectId, input.userId, ...groupIds)
+
+    return this.applyGroups({ ...input, groupIds, source: "directory" })
+  }
 
   private createSignInSession(input: {
     readonly projectId: string
@@ -792,22 +773,6 @@ export class SqliteAuthStorage implements AuthStorage {
   }
 }
 
-function hasActiveUsers(db: Database, projectId: string): boolean {
-  const row = db
-    .query(
-      `
-      SELECT 1 AS active
-      FROM auth_users
-      WHERE project_id = ?
-        AND status = 'active'
-      LIMIT 1
-    `
-    )
-    .get(projectId) as { readonly active: number } | null
-
-  return row !== null
-}
-
 function assertSignInSessionAudience(
   projectId: string,
   sessionAudience: string,

package/src/auth-storage/rows.ts

@@ -55,7 +55,7 @@ export interface SqliteAuthServiceAccountGroupMembershipRow {
   readonly project_id: string
   readonly service_account_id: string
   readonly group_id: string
-  readonly source: GroupMembershipSource
+  readonly source: ServiceAccountGroupMembershipRecord["source"]
   readonly created_at: string
 }
 

package/src/migrations/050-directory-group-memberships.sql

@@ -0,0 +1,21 @@
+-- A membership the identity provider owns is recorded with source 'directory' and synced to the
+-- provider's groups on every sign-in. Service accounts never sign in, so their table is unchanged.
+-- SQLite cannot change a CHECK constraint in place, so the table is rebuilt.
+CREATE TABLE auth_group_memberships_next (
+  project_id TEXT NOT NULL,
+  user_id TEXT NOT NULL,
+  group_id TEXT NOT NULL,
+  source TEXT NOT NULL CHECK (source IN ('invitation', 'manual', 'agent', 'directory')),
+  created_at TEXT NOT NULL,
+  PRIMARY KEY (project_id, user_id, group_id)
+);
+
+INSERT INTO auth_group_memberships_next (project_id, user_id, group_id, source, created_at)
+SELECT project_id, user_id, group_id, source, created_at
+FROM auth_group_memberships;
+
+DROP TABLE auth_group_memberships;
+ALTER TABLE auth_group_memberships_next RENAME TO auth_group_memberships;
+
+CREATE INDEX idx_auth_group_memberships_group
+  ON auth_group_memberships(project_id, group_id);

package/src/migrations.ts

@@ -112,6 +112,9 @@ import ontologyCommitAttributionSql from "./migrations/047-ontology-commit-attri
   type: "text",
 }
 import nativeSessionsSql from "./migrations/049-native-sessions.sql" with { type: "text" }
+import directoryGroupMembershipsSql from "./migrations/050-directory-group-memberships.sql" with {
+  type: "text",
+}
 
 const MIGRATIONS_TABLE_SQL = `
   CREATE TABLE IF NOT EXISTS sixb_migrations (
@@ -216,6 +219,7 @@ export const sqliteStorageMigrations = defineMigrations({
     sqliteSql("047-ontology-commit-attribution", ontologyCommitAttributionSql),
     sqliteSql("048-file-upload-sessions", fileUploadSessionsSql),
     sqliteSql("049-native-sessions", nativeSessionsSql),
+    sqliteSql("050-directory-group-memberships", directoryGroupMembershipsSql),
   ],
 })