@stacksjs/database 0.70.351 → 0.70.352

package/dist/auth-tables.d.ts

@@ -42,6 +42,26 @@ export declare function usersTwoFactorColumnsSql(sql: SqlHelpers): string[];
  * stacksjs/status#1 Phase 9).
  */
 export declare function usersStripeIdSql(): string;
+/**
+ * Defensive ALTERs guaranteeing the device columns on
+ * `oauth_access_tokens` - `user_agent` and `ip_address`.
+ *
+ * They exist for one feature and it cannot be built without them: **a list of
+ * your own sessions that you can revoke.** Without something to recognise a row
+ * by, that page is a column of identical timestamps and "revoke" is guesswork,
+ * so the page nobody can act on is the page nobody builds - which is why
+ * "somebody is signed in as me on a laptop I sold" has no answer in most
+ * self-hosted software.
+ *
+ * Nullable, and populated only by callers that have a request to read them
+ * from. A token minted by a script has no user agent and no meaningful address,
+ * and inventing one would make the list less trustworthy rather than more.
+ *
+ * Same pure-builder + try/catch-swallow pattern as the `users` guarantees
+ * above, for the same reason: no generated migration creates this table, so
+ * both schema paths have to be able to add to it idempotently.
+ */
+export declare function oauthAccessTokenDeviceColumnsSql(): string[];
 /**
  * Runs every `users` guarantee-column ALTER (email_verified_at,
  * password_changed_at, two_factor_secret, two_factor_enabled,

package/dist/auth-tables.js

@@ -1,4 +1,4 @@
-import process from"node:process";import{randomBytes}from"node:crypto";import{log}from"@stacksjs/logging";import{env as envVars}from"@stacksjs/env";import{db}from"./utils";import{sqlHelpers}from"./sql-helpers";import{indexSqlForDialect}from"./dialect";function getDbDriver(){return envVars.DB_CONNECTION||"sqlite"}export function usersEmailVerifiedAtSql(sql){return`ALTER TABLE users ADD COLUMN email_verified_at ${sql.nullableTimestamp}`}export function usersPasswordChangedAtSql(sql){return`ALTER TABLE users ADD COLUMN password_changed_at ${sql.nullableTimestamp}`}export function usersTwoFactorColumnsSql(sql){return["ALTER TABLE users ADD COLUMN two_factor_secret VARCHAR(255)",`ALTER TABLE users ADD COLUMN two_factor_enabled BOOLEAN NOT NULL DEFAULT ${sql.boolFalse}`,"ALTER TABLE users ADD COLUMN two_factor_last_used_step BIGINT"]}export function usersStripeIdSql(){return"ALTER TABLE users ADD COLUMN stripe_id VARCHAR(255)"}export async function ensureUsersAuthColumns(sql,options={}){const alters=[usersEmailVerifiedAtSql(sql),usersPasswordChangedAtSql(sql),...usersTwoFactorColumnsSql(sql),usersStripeIdSql()];for(const alterSql of alters)try{await db.unsafe(alterSql).execute()}catch{if(options.verbose)log.debug(`[auth-tables] Skipped (already applied or users missing): ${alterSql}`)}try{await db.unsafe(indexSqlForDialect("CREATE UNIQUE INDEX IF NOT EXISTS idx_users_stripe_id ON users(stripe_id)",getDbDriver())).execute()}catch{if(options.verbose)log.debug("[auth-tables] Skipped users.stripe_id unique index (already applied or users missing)")}}export async function migrateAuthTables(options={}){const dbDriver=getDbDriver(),sql=sqlHelpers(dbDriver),{isPostgres,boolTrue,now,pkColumn,nullableTimestamp,datetime}=sql;if(options.verbose)log.info(`Creating auth tables for ${dbDriver}...`);try{if(options.verbose)log.info("Creating oauth_clients table...");await db.unsafe(`
+import process from"node:process";import{randomBytes}from"node:crypto";import{log}from"@stacksjs/logging";import{env as envVars}from"@stacksjs/env";import{db}from"./utils";import{sqlHelpers}from"./sql-helpers";import{indexSqlForDialect}from"./dialect";function getDbDriver(){return envVars.DB_CONNECTION||"sqlite"}export function usersEmailVerifiedAtSql(sql){return`ALTER TABLE users ADD COLUMN email_verified_at ${sql.nullableTimestamp}`}export function usersPasswordChangedAtSql(sql){return`ALTER TABLE users ADD COLUMN password_changed_at ${sql.nullableTimestamp}`}export function usersTwoFactorColumnsSql(sql){return["ALTER TABLE users ADD COLUMN two_factor_secret VARCHAR(255)",`ALTER TABLE users ADD COLUMN two_factor_enabled BOOLEAN NOT NULL DEFAULT ${sql.boolFalse}`,"ALTER TABLE users ADD COLUMN two_factor_last_used_step BIGINT"]}export function usersStripeIdSql(){return"ALTER TABLE users ADD COLUMN stripe_id VARCHAR(255)"}export function oauthAccessTokenDeviceColumnsSql(){return["ALTER TABLE oauth_access_tokens ADD COLUMN user_agent VARCHAR(255)","ALTER TABLE oauth_access_tokens ADD COLUMN ip_address VARCHAR(45)"]}export async function ensureUsersAuthColumns(sql,options={}){const alters=[usersEmailVerifiedAtSql(sql),usersPasswordChangedAtSql(sql),...usersTwoFactorColumnsSql(sql),usersStripeIdSql()];for(const alterSql of alters)try{await db.unsafe(alterSql).execute()}catch{if(options.verbose)log.debug(`[auth-tables] Skipped (already applied or users missing): ${alterSql}`)}try{await db.unsafe(indexSqlForDialect("CREATE UNIQUE INDEX IF NOT EXISTS idx_users_stripe_id ON users(stripe_id)",getDbDriver())).execute()}catch{if(options.verbose)log.debug("[auth-tables] Skipped users.stripe_id unique index (already applied or users missing)")}}export async function migrateAuthTables(options={}){const dbDriver=getDbDriver(),sql=sqlHelpers(dbDriver),{isPostgres,boolTrue,now,pkColumn,nullableTimestamp,datetime}=sql;if(options.verbose)log.info(`Creating auth tables for ${dbDriver}...`);try{if(options.verbose)log.info("Creating oauth_clients table...");await db.unsafe(`
       CREATE TABLE IF NOT EXISTS oauth_clients (
         ${pkColumn},
         name VARCHAR(255) NOT NULL,
@@ -21,10 +21,15 @@ import process from"node:process";import{randomBytes}from"node:crypto";import{lo
         scopes TEXT,
         revoked BOOLEAN NOT NULL DEFAULT ${sql.boolFalse},
         expires_at ${nullableTimestamp},
+        -- What the browser called itself and where it came from, so a person
+        -- can recognise their own sessions well enough to revoke one. Null for
+        -- a token minted by a script, which has neither.
+        user_agent VARCHAR(255),
+        ip_address VARCHAR(45),
         created_at ${datetime} DEFAULT CURRENT_TIMESTAMP,
         updated_at ${nullableTimestamp}
       )
-    `).execute();await createTokenIndex("idx_oauth_access_tokens_token","oauth_access_tokens","token");if(options.verbose)log.info("Creating oauth_refresh_tokens table...");await db.unsafe(`
+    `).execute();await createTokenIndex("idx_oauth_access_tokens_token","oauth_access_tokens","token");for(const alterSql of oauthAccessTokenDeviceColumnsSql())try{await db.unsafe(alterSql).execute()}catch{if(options.verbose)log.debug(`[auth-tables] Skipped (already applied): ${alterSql}`)}if(options.verbose)log.info("Creating oauth_refresh_tokens table...");await db.unsafe(`
       CREATE TABLE IF NOT EXISTS oauth_refresh_tokens (
         ${pkColumn},
         access_token_id INTEGER NOT NULL,

package/package.json

@@ -2,7 +2,7 @@
   "name": "@stacksjs/database",
   "type": "module",
   "sideEffects": false,
-  "version": "0.70.351",
+  "version": "0.70.352",
   "description": "The Stacks database integration.",
   "author": "Chris Breuer",
   "contributors": [
@@ -65,15 +65,15 @@
     "dynamodb-tooling": "^0.3.2"
   },
   "devDependencies": {
-    "@stacksjs/cli": "0.70.351",
-    "@stacksjs/config": "0.70.351",
-    "@stacksjs/logging": "0.70.351",
-    "@stacksjs/router": "0.70.351",
+    "@stacksjs/cli": "0.70.352",
+    "@stacksjs/config": "0.70.352",
+    "@stacksjs/logging": "0.70.352",
+    "@stacksjs/router": "0.70.352",
     "better-dx": "^0.2.17",
-    "@stacksjs/path": "0.70.351",
-    "@stacksjs/query-builder": "0.70.351",
-    "@stacksjs/storage": "0.70.351",
-    "@stacksjs/strings": "0.70.351",
-    "@stacksjs/utils": "0.70.351"
+    "@stacksjs/path": "0.70.352",
+    "@stacksjs/query-builder": "0.70.352",
+    "@stacksjs/storage": "0.70.352",
+    "@stacksjs/strings": "0.70.352",
+    "@stacksjs/utils": "0.70.352"
   }
 }