@stacksjs/database 0.70.352 → 0.70.354

package/dist/auth-tables.d.ts

@@ -62,6 +62,21 @@ export declare function usersStripeIdSql(): string;
  * both schema paths have to be able to add to it idempotently.
  */
 export declare function oauthAccessTokenDeviceColumnsSql(): string[];
+/**
+ * Defensive ALTER guaranteeing `password_resets.expires_at`.
+ *
+ * `createResetToken` in `core/auth/src/password/reset.ts` has always written
+ * this column on insert, and the CREATE here never declared it, so on any
+ * install whose table came from this migrator "forgot my password" failed with
+ * `table password_resets has no column named expires_at`. It went unnoticed
+ * because the tests that cover the reset flow hand-rolled their own
+ * `password_resets` DDL and invented the column the migrator was missing.
+ *
+ * The read path deliberately tolerates its absence (see `isWithinExpiry`,
+ * which falls back to `created_at` plus the configured expiry), so adding it
+ * changes no behaviour for rows already written.
+ */
+export declare function passwordResetsExpiresAtSql(): string[];
 /**
  * Runs every `users` guarantee-column ALTER (email_verified_at,
  * password_changed_at, two_factor_secret, two_factor_enabled,

package/dist/auth-tables.js

@@ -1,4 +1,4 @@
-import process from"node:process";import{randomBytes}from"node:crypto";import{log}from"@stacksjs/logging";import{env as envVars}from"@stacksjs/env";import{db}from"./utils";import{sqlHelpers}from"./sql-helpers";import{indexSqlForDialect}from"./dialect";function getDbDriver(){return envVars.DB_CONNECTION||"sqlite"}export function usersEmailVerifiedAtSql(sql){return`ALTER TABLE users ADD COLUMN email_verified_at ${sql.nullableTimestamp}`}export function usersPasswordChangedAtSql(sql){return`ALTER TABLE users ADD COLUMN password_changed_at ${sql.nullableTimestamp}`}export function usersTwoFactorColumnsSql(sql){return["ALTER TABLE users ADD COLUMN two_factor_secret VARCHAR(255)",`ALTER TABLE users ADD COLUMN two_factor_enabled BOOLEAN NOT NULL DEFAULT ${sql.boolFalse}`,"ALTER TABLE users ADD COLUMN two_factor_last_used_step BIGINT"]}export function usersStripeIdSql(){return"ALTER TABLE users ADD COLUMN stripe_id VARCHAR(255)"}export function oauthAccessTokenDeviceColumnsSql(){return["ALTER TABLE oauth_access_tokens ADD COLUMN user_agent VARCHAR(255)","ALTER TABLE oauth_access_tokens ADD COLUMN ip_address VARCHAR(45)"]}export async function ensureUsersAuthColumns(sql,options={}){const alters=[usersEmailVerifiedAtSql(sql),usersPasswordChangedAtSql(sql),...usersTwoFactorColumnsSql(sql),usersStripeIdSql()];for(const alterSql of alters)try{await db.unsafe(alterSql).execute()}catch{if(options.verbose)log.debug(`[auth-tables] Skipped (already applied or users missing): ${alterSql}`)}try{await db.unsafe(indexSqlForDialect("CREATE UNIQUE INDEX IF NOT EXISTS idx_users_stripe_id ON users(stripe_id)",getDbDriver())).execute()}catch{if(options.verbose)log.debug("[auth-tables] Skipped users.stripe_id unique index (already applied or users missing)")}}export async function migrateAuthTables(options={}){const dbDriver=getDbDriver(),sql=sqlHelpers(dbDriver),{isPostgres,boolTrue,now,pkColumn,nullableTimestamp,datetime}=sql;if(options.verbose)log.info(`Creating auth tables for ${dbDriver}...`);try{if(options.verbose)log.info("Creating oauth_clients table...");await db.unsafe(`
+import process from"node:process";import{randomBytes}from"node:crypto";import{log}from"@stacksjs/logging";import{env as envVars}from"@stacksjs/env";import{db}from"./utils";import{sqlHelpers}from"./sql-helpers";import{indexSqlForDialect}from"./dialect";function getDbDriver(){return envVars.DB_CONNECTION||"sqlite"}export function usersEmailVerifiedAtSql(sql){return`ALTER TABLE users ADD COLUMN email_verified_at ${sql.nullableTimestamp}`}export function usersPasswordChangedAtSql(sql){return`ALTER TABLE users ADD COLUMN password_changed_at ${sql.nullableTimestamp}`}export function usersTwoFactorColumnsSql(sql){return["ALTER TABLE users ADD COLUMN two_factor_secret VARCHAR(255)",`ALTER TABLE users ADD COLUMN two_factor_enabled BOOLEAN NOT NULL DEFAULT ${sql.boolFalse}`,"ALTER TABLE users ADD COLUMN two_factor_last_used_step BIGINT"]}export function usersStripeIdSql(){return"ALTER TABLE users ADD COLUMN stripe_id VARCHAR(255)"}export function oauthAccessTokenDeviceColumnsSql(){return["ALTER TABLE oauth_access_tokens ADD COLUMN user_agent VARCHAR(255)","ALTER TABLE oauth_access_tokens ADD COLUMN ip_address VARCHAR(45)"]}export function passwordResetsExpiresAtSql(){return["ALTER TABLE password_resets ADD COLUMN expires_at TIMESTAMP"]}export async function ensureUsersAuthColumns(sql,options={}){const alters=[usersEmailVerifiedAtSql(sql),usersPasswordChangedAtSql(sql),...usersTwoFactorColumnsSql(sql),usersStripeIdSql()];for(const alterSql of alters)try{await db.unsafe(alterSql).execute()}catch{if(options.verbose)log.debug(`[auth-tables] Skipped (already applied or users missing): ${alterSql}`)}try{await db.unsafe(indexSqlForDialect("CREATE UNIQUE INDEX IF NOT EXISTS idx_users_stripe_id ON users(stripe_id)",getDbDriver())).execute()}catch{if(options.verbose)log.debug("[auth-tables] Skipped users.stripe_id unique index (already applied or users missing)")}}export async function migrateAuthTables(options={}){const dbDriver=getDbDriver(),sql=sqlHelpers(dbDriver),{isPostgres,boolTrue,now,pkColumn,nullableTimestamp,datetime}=sql;if(options.verbose)log.info(`Creating auth tables for ${dbDriver}...`);try{if(options.verbose)log.info("Creating oauth_clients table...");await db.unsafe(`
       CREATE TABLE IF NOT EXISTS oauth_clients (
         ${pkColumn},
         name VARCHAR(255) NOT NULL,
@@ -43,9 +43,14 @@ import process from"node:process";import{randomBytes}from"node:crypto";import{lo
         ${pkColumn},
         email VARCHAR(255) NOT NULL,
         token VARCHAR(255) NOT NULL,
+        -- createResetToken writes this on every insert, so the table has to
+        -- have it or requesting a reset throws. The read side (isWithinExpiry)
+        -- still falls back to clock arithmetic against created_at, because
+        -- rows written before the column existed have to keep verifying.
+        expires_at ${nullableTimestamp},
         created_at ${datetime} DEFAULT CURRENT_TIMESTAMP
       )
-    `).execute();try{await db.unsafe(indexSqlForDialect("CREATE INDEX IF NOT EXISTS idx_password_resets_email ON password_resets(email)",dbDriver)).execute()}catch{}if(options.verbose)log.info("Creating email_verifications table...");await db.unsafe(`
+    `).execute();for(const alterSql of passwordResetsExpiresAtSql())try{await db.unsafe(alterSql).execute()}catch{if(options.verbose)log.debug(`[auth-tables] Skipped (already applied): ${alterSql}`)}try{await db.unsafe(indexSqlForDialect("CREATE INDEX IF NOT EXISTS idx_password_resets_email ON password_resets(email)",dbDriver)).execute()}catch{}if(options.verbose)log.info("Creating email_verifications table...");await db.unsafe(`
       CREATE TABLE IF NOT EXISTS email_verifications (
         ${pkColumn},
         user_id INTEGER NOT NULL,

package/package.json

@@ -2,7 +2,7 @@
   "name": "@stacksjs/database",
   "type": "module",
   "sideEffects": false,
-  "version": "0.70.352",
+  "version": "0.70.354",
   "description": "The Stacks database integration.",
   "author": "Chris Breuer",
   "contributors": [
@@ -65,15 +65,15 @@
     "dynamodb-tooling": "^0.3.2"
   },
   "devDependencies": {
-    "@stacksjs/cli": "0.70.352",
-    "@stacksjs/config": "0.70.352",
-    "@stacksjs/logging": "0.70.352",
-    "@stacksjs/router": "0.70.352",
+    "@stacksjs/cli": "0.70.354",
+    "@stacksjs/config": "0.70.354",
+    "@stacksjs/logging": "0.70.354",
+    "@stacksjs/router": "0.70.354",
     "better-dx": "^0.2.17",
-    "@stacksjs/path": "0.70.352",
-    "@stacksjs/query-builder": "0.70.352",
-    "@stacksjs/storage": "0.70.352",
-    "@stacksjs/strings": "0.70.352",
-    "@stacksjs/utils": "0.70.352"
+    "@stacksjs/path": "0.70.354",
+    "@stacksjs/query-builder": "0.70.354",
+    "@stacksjs/storage": "0.70.354",
+    "@stacksjs/strings": "0.70.354",
+    "@stacksjs/utils": "0.70.354"
   }
 }