@stjoseph/prumo 0.2.0 → 0.4.0

package/templates/api/src/infra/auth/jose-access-tokens.adapter.ts

@@ -0,0 +1,64 @@
+import { jwtVerify, SignJWT } from 'jose'
+import type {
+  AccessClaims,
+  AccessTokens,
+  IssuedToken,
+} from '@/domain/auth/ports/access-tokens.port'
+import type { Env } from '@/infra/config/env'
+
+// One algorithm, named on both sides: a token that declares any other, `none` included, is refused.
+const ALGORITHM = 'HS256'
+
+export class JoseAccessTokens implements AccessTokens {
+  private readonly key: Uint8Array
+  private readonly issuer: string
+
+  constructor(env: Pick<Env, 'JWT_SECRET' | 'API_URL'>) {
+    this.key = new TextEncoder().encode(env.JWT_SECRET)
+    this.issuer = env.API_URL
+  }
+
+  async issue(
+    { userId, sessionId, clientId, scope }: AccessClaims,
+    expiresAt: Date,
+    audience = this.issuer,
+  ): Promise<IssuedToken> {
+    const token = await new SignJWT({
+      sid: sessionId,
+      ...(clientId !== undefined && { client_id: clientId }),
+      ...(scope !== undefined && { scope }),
+    })
+      .setProtectedHeader({ alg: ALGORITHM })
+      .setSubject(userId)
+      .setIssuer(this.issuer)
+      .setAudience(audience)
+      .setIssuedAt()
+      .setExpirationTime(Math.floor(expiresAt.getTime() / 1000))
+      .sign(this.key)
+
+    return { token, expiresAt }
+  }
+
+  async verify(token: string, audience = this.issuer): Promise<AccessClaims | null> {
+    try {
+      const { payload } = await jwtVerify(token, this.key, {
+        algorithms: [ALGORITHM],
+        issuer: this.issuer,
+        audience,
+      })
+
+      if (typeof payload.sub !== 'string' || typeof payload.sid !== 'string') {
+        return null
+      }
+
+      return {
+        userId: payload.sub,
+        sessionId: payload.sid,
+        ...(typeof payload.client_id === 'string' && { clientId: payload.client_id }),
+        ...(typeof payload.scope === 'string' && { scope: payload.scope }),
+      }
+    } catch {
+      return null
+    }
+  }
+}

package/templates/api/src/infra/config/env.ts

@@ -5,14 +5,28 @@ const envSchema = z.object({
   NODE_ENV: z.enum(['development', 'test', 'production']),
   PORT: z.coerce.number().int().min(1).max(65535),
   DATABASE_URL: z.string().min(1),
-  AUTH_DATABASE_URL: z.string().min(1),
-  BETTER_AUTH_SECRET: z.string().min(32),
-  BETTER_AUTH_URL: z.string().min(1),
+  JWT_SECRET: z.string().min(32),
+  // Where this API is reached from outside: the issuer of its tokens, and what decides whether cookies are Secure.
+  API_URL: z.url(),
   WEB_ORIGIN: z.string().min(1),
+  // prumo:social
+  // Where a mobile app is sent back after signing in with a provider: its own scheme, as in app.json.
   MOBILE_APP_SCHEME: z
     .string()
     .regex(/^[a-z][a-z0-9+.-]*$/)
     .optional(),
+  // prumo:end-social
+  // prumo:google
+  GOOGLE_CLIENT_ID: z.string().min(1).optional(),
+  GOOGLE_CLIENT_SECRET: z.string().min(1).optional(),
+  // prumo:end-google
+  // prumo:apple
+  APPLE_CLIENT_ID: z.string().min(1).optional(),
+  APPLE_TEAM_ID: z.string().min(1).optional(),
+  APPLE_KEY_ID: z.string().min(1).optional(),
+  // The .p8 key's contents; on one line, with its line breaks written as \n.
+  APPLE_PRIVATE_KEY: z.string().min(1).optional(),
+  // prumo:end-apple
   LOG_LEVEL: z.enum(['error', 'warn', 'info', 'debug']),
 })
 

package/templates/api/src/infra/database/mikroorm/entities/authorization.schema.ts

@@ -0,0 +1,38 @@
+import { EntitySchema } from '@mikro-orm/core'
+import { Authorization } from '@/domain/oauth/entities/authorization.entity'
+
+export const AuthorizationSchema = new EntitySchema({
+  class: Authorization,
+  properties: {
+    id: { type: 'uuid', primary: true, defaultRaw: 'uuidv7()' },
+    clientId: { type: 'text' },
+    clientName: { type: 'text' },
+    redirectUri: { type: 'text' },
+    codeChallenge: { type: 'text' },
+    clientState: { type: 'text', nullable: true },
+    resource: { type: 'text' },
+    scope: { type: 'text' },
+    status: { type: 'text' },
+    userId: {
+      kind: 'm:1',
+      // EntitySchema cannot type a to-one relation held as its primary key on a string property.
+      entity: () => 'User' as never,
+      mapToPk: true,
+      fieldName: 'user_id',
+      nullable: true,
+      index: true,
+      // An authorization means nothing without the user who gave it.
+      deleteRule: 'cascade',
+    },
+    codeHash: { type: 'text', nullable: true },
+    sessionId: { type: 'uuid', nullable: true },
+    expiresAt: { type: 'datetime' },
+    createdAt: { type: 'datetime', onCreate: () => new Date(), defaultRaw: 'now()' },
+    updatedAt: {
+      type: 'datetime',
+      onCreate: () => new Date(),
+      onUpdate: () => new Date(),
+      defaultRaw: 'now()',
+    },
+  },
+})

package/templates/api/src/infra/database/mikroorm/entities/email-code.schema.ts

@@ -0,0 +1,30 @@
+import { EntitySchema } from '@mikro-orm/core'
+import { EmailCode } from '@/domain/auth/entities/email-code.entity'
+
+export const EmailCodeSchema = new EntitySchema({
+  class: EmailCode,
+  uniques: [{ properties: ['userId', 'purpose'] }],
+  properties: {
+    id: { type: 'uuid', primary: true, defaultRaw: 'uuidv7()' },
+    userId: {
+      kind: 'm:1',
+      // EntitySchema cannot type a to-one relation held as its primary key on a string property.
+      entity: () => 'User' as never,
+      mapToPk: true,
+      fieldName: 'user_id',
+      // A code means nothing without its user.
+      deleteRule: 'cascade',
+    },
+    purpose: { type: 'text' },
+    codeHash: { type: 'text' },
+    attemptsLeft: { type: 'integer' },
+    expiresAt: { type: 'datetime' },
+    createdAt: { type: 'datetime', onCreate: () => new Date(), defaultRaw: 'now()' },
+    updatedAt: {
+      type: 'datetime',
+      onCreate: () => new Date(),
+      onUpdate: () => new Date(),
+      defaultRaw: 'now()',
+    },
+  },
+})

package/templates/api/src/infra/database/mikroorm/entities/identity.schema.ts

@@ -0,0 +1,29 @@
+import { EntitySchema } from '@mikro-orm/core'
+import { Identity } from '@/domain/auth/entities/identity.entity'
+
+export const IdentitySchema = new EntitySchema({
+  class: Identity,
+  uniques: [{ properties: ['provider', 'subject'] }],
+  properties: {
+    id: { type: 'uuid', primary: true, defaultRaw: 'uuidv7()' },
+    userId: {
+      kind: 'm:1',
+      // EntitySchema cannot type a to-one relation held as its primary key on a string property.
+      entity: () => 'User' as never,
+      mapToPk: true,
+      fieldName: 'user_id',
+      index: true,
+      // An identity means nothing without its user.
+      deleteRule: 'cascade',
+    },
+    provider: { type: 'text' },
+    subject: { type: 'text' },
+    createdAt: { type: 'datetime', onCreate: () => new Date(), defaultRaw: 'now()' },
+    updatedAt: {
+      type: 'datetime',
+      onCreate: () => new Date(),
+      onUpdate: () => new Date(),
+      defaultRaw: 'now()',
+    },
+  },
+})

package/templates/api/src/infra/database/mikroorm/entities/profile.schema.ts

@@ -8,7 +8,7 @@ export const ProfileSchema = new EntitySchema({
     userId: {
       kind: 'm:1',
       // EntitySchema cannot type a to-one relation held as its primary key on a string property.
-      entity: () => 'AuthUser' as never,
+      entity: () => 'User' as never,
       mapToPk: true,
       fieldName: 'user_id',
       unique: true,

package/templates/api/src/infra/database/mikroorm/entities/session.schema.ts

@@ -0,0 +1,34 @@
+import { EntitySchema } from '@mikro-orm/core'
+import { Session } from '@/domain/auth/entities/session.entity'
+
+export const SessionSchema = new EntitySchema({
+  class: Session,
+  properties: {
+    id: { type: 'uuid', primary: true, defaultRaw: 'uuidv7()' },
+    userId: {
+      kind: 'm:1',
+      // EntitySchema cannot type a to-one relation held as its primary key on a string property.
+      entity: () => 'User' as never,
+      mapToPk: true,
+      fieldName: 'user_id',
+      index: true,
+      // A session means nothing without its user.
+      deleteRule: 'cascade',
+    },
+    tokenHash: { type: 'text' },
+    clientId: { type: 'text', nullable: true },
+    resource: { type: 'text', nullable: true },
+    scope: { type: 'text', nullable: true },
+    previousTokenHash: { type: 'text', nullable: true },
+    rotatedAt: { type: 'datetime', nullable: true },
+    expiresAt: { type: 'datetime' },
+    revokedAt: { type: 'datetime', nullable: true },
+    createdAt: { type: 'datetime', onCreate: () => new Date(), defaultRaw: 'now()' },
+    updatedAt: {
+      type: 'datetime',
+      onCreate: () => new Date(),
+      onUpdate: () => new Date(),
+      defaultRaw: 'now()',
+    },
+  },
+})

package/templates/api/src/infra/database/mikroorm/entities/social-sign-in.schema.ts

@@ -0,0 +1,35 @@
+import { EntitySchema } from '@mikro-orm/core'
+import { SocialSignIn } from '@/domain/auth/entities/social-sign-in.entity'
+
+export const SocialSignInSchema = new EntitySchema({
+  class: SocialSignIn,
+  properties: {
+    id: { type: 'uuid', primary: true, defaultRaw: 'uuidv7()' },
+    provider: { type: 'text' },
+    client: { type: 'text' },
+    returnTo: { type: 'text' },
+    browserHash: { type: 'text' },
+    codeVerifier: { type: 'text', nullable: true },
+    nonce: { type: 'text' },
+    status: { type: 'text' },
+    userId: {
+      kind: 'm:1',
+      // EntitySchema cannot type a to-one relation held as its primary key on a string property.
+      entity: () => 'User' as never,
+      mapToPk: true,
+      fieldName: 'user_id',
+      nullable: true,
+      index: true,
+      deleteRule: 'cascade',
+    },
+    exchangeHash: { type: 'text', nullable: true },
+    expiresAt: { type: 'datetime' },
+    createdAt: { type: 'datetime', onCreate: () => new Date(), defaultRaw: 'now()' },
+    updatedAt: {
+      type: 'datetime',
+      onCreate: () => new Date(),
+      onUpdate: () => new Date(),
+      defaultRaw: 'now()',
+    },
+  },
+})

package/templates/api/src/infra/database/mikroorm/entities/user.schema.ts

@@ -0,0 +1,19 @@
+import { EntitySchema } from '@mikro-orm/core'
+import { User } from '@/domain/auth/entities/user.entity'
+
+export const UserSchema = new EntitySchema({
+  class: User,
+  properties: {
+    id: { type: 'uuid', primary: true, defaultRaw: 'uuidv7()' },
+    email: { type: 'text', unique: true },
+    passwordHash: { type: 'text', nullable: true },
+    emailVerifiedAt: { type: 'datetime', nullable: true },
+    createdAt: { type: 'datetime', onCreate: () => new Date(), defaultRaw: 'now()' },
+    updatedAt: {
+      type: 'datetime',
+      onCreate: () => new Date(),
+      onUpdate: () => new Date(),
+      defaultRaw: 'now()',
+    },
+  },
+})

package/templates/api/src/infra/database/mikroorm/mikro-orm.factory.ts

@@ -1,17 +1,28 @@
 import { Migrator } from '@mikro-orm/migrations'
 import { defineConfig } from '@mikro-orm/postgresql'
 import type { Env } from '@/infra/config/env'
-import { AuthUserSchema } from './entities/auth-user.schema'
+import { AuthorizationSchema } from './entities/authorization.schema' // prumo:mcp
+import { EmailCodeSchema } from './entities/email-code.schema' // prumo:email
+import { IdentitySchema } from './entities/identity.schema' // prumo:social
 import { ProfileSchema } from './entities/profile.schema'
+import { SessionSchema } from './entities/session.schema'
+import { SocialSignInSchema } from './entities/social-sign-in.schema' // prumo:social
+import { UserSchema } from './entities/user.schema'
 
 export function createOrmConfig(env: Pick<Env, 'DATABASE_URL' | 'NODE_ENV'>) {
   return defineConfig({
     clientUrl: env.DATABASE_URL,
-    entities: [ProfileSchema, AuthUserSchema],
+    entities: [
+      UserSchema,
+      ProfileSchema,
+      SessionSchema,
+      AuthorizationSchema, // prumo:mcp
+      EmailCodeSchema, // prumo:email
+      IdentitySchema, // prumo:social
+      SocialSignInSchema, // prumo:social
+    ],
     extensions: [Migrator],
     migrations: { path: './migrations', snapshot: false },
-    // Better Auth migrates its own schema; without this, every generated migration drops it.
-    schemaGenerator: { ignoreSchema: ['auth'], skipTables: ['auth.user'] },
     debug: env.NODE_ENV === 'development',
   })
 }

package/templates/api/src/infra/database/mikroorm/repositories/mikroorm-authorization.repository.ts

@@ -0,0 +1,21 @@
+import { EntityManager, LockMode } from '@mikro-orm/postgresql'
+import { injectable } from 'tsyringe'
+import { Authorization } from '@/domain/oauth/entities/authorization.entity'
+import type { AuthorizationRepository } from '@/domain/oauth/repositories/authorization.repository'
+
+@injectable()
+export class MikroOrmAuthorizationRepository implements AuthorizationRepository {
+  constructor(private readonly em: EntityManager) {}
+
+  findById(id: string): Promise<Authorization | null> {
+    return this.em.findOne(Authorization, { id })
+  }
+
+  lockById(id: string): Promise<Authorization | null> {
+    return this.em.findOne(Authorization, { id }, { lockMode: LockMode.PESSIMISTIC_WRITE })
+  }
+
+  async save(authorization: Authorization): Promise<void> {
+    await this.em.persist(authorization).flush()
+  }
+}

package/templates/api/src/infra/database/mikroorm/repositories/mikroorm-email-code.repository.ts

@@ -0,0 +1,17 @@
+import { EntityManager, LockMode } from '@mikro-orm/postgresql'
+import { injectable } from 'tsyringe'
+import { EmailCode, type EmailCodePurpose } from '@/domain/auth/entities/email-code.entity'
+import type { EmailCodeRepository } from '@/domain/auth/repositories/email-code.repository'
+
+@injectable()
+export class MikroOrmEmailCodeRepository implements EmailCodeRepository {
+  constructor(private readonly em: EntityManager) {}
+
+  lockFor(userId: string, purpose: EmailCodePurpose): Promise<EmailCode | null> {
+    return this.em.findOne(EmailCode, { userId, purpose }, { lockMode: LockMode.PESSIMISTIC_WRITE })
+  }
+
+  async save(code: EmailCode): Promise<void> {
+    await this.em.persist(code).flush()
+  }
+}

package/templates/api/src/infra/database/mikroorm/repositories/mikroorm-identity.repository.ts

@@ -0,0 +1,18 @@
+import { EntityManager } from '@mikro-orm/postgresql'
+import { injectable } from 'tsyringe'
+import { Identity } from '@/domain/auth/entities/identity.entity'
+import type { ProviderName } from '@/domain/auth/ports/identity-providers.port'
+import type { IdentityRepository } from '@/domain/auth/repositories/identity.repository'
+
+@injectable()
+export class MikroOrmIdentityRepository implements IdentityRepository {
+  constructor(private readonly em: EntityManager) {}
+
+  findBySubject(provider: ProviderName, subject: string): Promise<Identity | null> {
+    return this.em.findOne(Identity, { provider, subject })
+  }
+
+  async save(identity: Identity): Promise<void> {
+    await this.em.persist(identity).flush()
+  }
+}

package/templates/api/src/infra/database/mikroorm/repositories/mikroorm-session.repository.ts

@@ -0,0 +1,25 @@
+import { EntityManager, LockMode } from '@mikro-orm/postgresql'
+import { injectable } from 'tsyringe'
+import { Session } from '@/domain/auth/entities/session.entity'
+import type { SessionRepository } from '@/domain/auth/repositories/session.repository'
+
+@injectable()
+export class MikroOrmSessionRepository implements SessionRepository {
+  constructor(private readonly em: EntityManager) {}
+
+  findById(id: string): Promise<Session | null> {
+    return this.em.findOne(Session, { id })
+  }
+
+  lockById(id: string): Promise<Session | null> {
+    return this.em.findOne(Session, { id }, { lockMode: LockMode.PESSIMISTIC_WRITE })
+  }
+
+  async save(session: Session): Promise<void> {
+    await this.em.persist(session).flush()
+  }
+
+  async revokeAllFor(userId: string, now: Date): Promise<void> {
+    await this.em.nativeUpdate(Session, { userId, revokedAt: null }, { revokedAt: now })
+  }
+}

package/templates/api/src/infra/database/mikroorm/repositories/mikroorm-social-sign-in.repository.ts

@@ -0,0 +1,17 @@
+import { EntityManager, LockMode } from '@mikro-orm/postgresql'
+import { injectable } from 'tsyringe'
+import { SocialSignIn } from '@/domain/auth/entities/social-sign-in.entity'
+import type { SocialSignInRepository } from '@/domain/auth/repositories/social-sign-in.repository'
+
+@injectable()
+export class MikroOrmSocialSignInRepository implements SocialSignInRepository {
+  constructor(private readonly em: EntityManager) {}
+
+  lockById(id: string): Promise<SocialSignIn | null> {
+    return this.em.findOne(SocialSignIn, { id }, { lockMode: LockMode.PESSIMISTIC_WRITE })
+  }
+
+  async save(signIn: SocialSignIn): Promise<void> {
+    await this.em.persist(signIn).flush()
+  }
+}

package/templates/api/src/infra/database/mikroorm/repositories/mikroorm-user.repository.ts

@@ -0,0 +1,31 @@
+import { EntityManager, UniqueConstraintViolationException } from '@mikro-orm/postgresql'
+import { injectable } from 'tsyringe'
+import { User } from '@/domain/auth/entities/user.entity'
+import { EmailTakenError } from '@/domain/auth/errors/email-taken.error'
+import type { UserRepository } from '@/domain/auth/repositories/user.repository'
+
+@injectable()
+export class MikroOrmUserRepository implements UserRepository {
+  constructor(private readonly em: EntityManager) {}
+
+  findById(id: string): Promise<User | null> {
+    return this.em.findOne(User, { id })
+  }
+
+  findByEmail(email: string): Promise<User | null> {
+    return this.em.findOne(User, { email })
+  }
+
+  async save(user: User): Promise<void> {
+    try {
+      await this.em.persist(user).flush()
+    } catch (error) {
+      // Two sign-ups with one email can both pass the check; the unique index settles which one exists.
+      if (error instanceof UniqueConstraintViolationException) {
+        throw new EmailTakenError()
+      }
+
+      throw error
+    }
+  }
+}

package/templates/api/src/infra/di/auth.di.ts

@@ -0,0 +1,21 @@
+import type { DependencyContainer } from 'tsyringe'
+import { ACCESS_TOKENS } from '@/domain/auth/ports/access-tokens.port'
+import { OPAQUE_TOKENS } from '@/domain/auth/ports/opaque-tokens.port'
+import { PASSWORD_HASHER } from '@/domain/auth/ports/password-hasher.port'
+import { SESSION_REPOSITORY } from '@/domain/auth/repositories/session.repository'
+import { USER_REPOSITORY } from '@/domain/auth/repositories/user.repository'
+import { Argon2PasswordHasher } from '@/infra/auth/argon2-password-hasher.adapter'
+import { CryptoOpaqueTokens } from '@/infra/auth/crypto-opaque-tokens.adapter'
+import { JoseAccessTokens } from '@/infra/auth/jose-access-tokens.adapter'
+import { ENV, type Env } from '@/infra/config/env'
+import { MikroOrmSessionRepository } from '@/infra/database/mikroorm/repositories/mikroorm-session.repository'
+import { MikroOrmUserRepository } from '@/infra/database/mikroorm/repositories/mikroorm-user.repository'
+
+export function registerAuth(container: DependencyContainer): void {
+  container.register(USER_REPOSITORY, { useClass: MikroOrmUserRepository })
+  container.register(SESSION_REPOSITORY, { useClass: MikroOrmSessionRepository })
+  // One instance each: the hasher keeps its decoy hash, the signer its key.
+  container.register(PASSWORD_HASHER, { useValue: new Argon2PasswordHasher() })
+  container.register(ACCESS_TOKENS, { useValue: new JoseAccessTokens(container.resolve<Env>(ENV)) })
+  container.register(OPAQUE_TOKENS, { useValue: new CryptoOpaqueTokens() })
+}

package/templates/api/src/infra/di/email.di.ts

@@ -0,0 +1,23 @@
+import type { DependencyContainer } from 'tsyringe'
+import { MAILER } from '@/domain/auth/ports/mailer.port'
+import { ONE_TIME_CODES } from '@/domain/auth/ports/one-time-codes.port'
+import { EMAIL_CODE_REPOSITORY } from '@/domain/auth/repositories/email-code.repository'
+import { ENV, type Env } from '@/infra/config/env'
+import { MikroOrmEmailCodeRepository } from '@/infra/database/mikroorm/repositories/mikroorm-email-code.repository'
+import { HmacOneTimeCodes } from '@/infra/email/hmac-one-time-codes.adapter'
+import { LogMailer } from '@/infra/email/log-mailer.adapter'
+
+export function registerEmail(container: DependencyContainer): void {
+  const env = container.resolve<Env>(ENV)
+
+  container.register(EMAIL_CODE_REPOSITORY, { useClass: MikroOrmEmailCodeRepository })
+  container.register(ONE_TIME_CODES, { useValue: new HmacOneTimeCodes(env) })
+  // Silent under test, where a test registers its own Mailer to read what was sent.
+  container.register(MAILER, {
+    useValue: new LogMailer((line) => {
+      if (env.NODE_ENV !== 'test') {
+        console.info(line)
+      }
+    }),
+  })
+}

package/templates/api/src/infra/di/index.ts

@@ -1,10 +1,12 @@
 import { EntityManager, MikroORM } from '@mikro-orm/postgresql'
 import { type DependencyContainer, container as root } from 'tsyringe'
 import { TRANSACTION_MANAGER } from '@/domain/shared/transactions/transaction-manager'
-import { CreateProfileUseCase } from '@/domain/users/use-cases/create-profile.use-case'
-import { AUTH, createAuth } from '@/infra/auth/auth.factory'
 import { ENV, type Env } from '@/infra/config/env'
 import { MikroOrmTransactionManager } from '@/infra/database/mikroorm/transactions/mikroorm-transaction-manager'
+import { registerAuth } from './auth.di'
+import { registerEmail } from './email.di' // prumo:email
+import { registerOauth } from './oauth.di' // prumo:mcp
+import { registerSocial } from './social.di' // prumo:social
 import { registerUsers } from './users.di'
 
 export type Dependencies = { env: Env; orm: MikroORM }
@@ -18,15 +20,11 @@ export function createContainer({ env, orm }: Dependencies): DependencyContainer
   container.register(EntityManager, { useValue: orm.em })
   container.register(TRANSACTION_MANAGER, { useClass: MikroOrmTransactionManager })
 
+  registerAuth(container)
   registerUsers(container)
-
-  container.register(AUTH, {
-    useValue: createAuth(env, {
-      onUserCreated: async (user) => {
-        await container.resolve(CreateProfileUseCase).execute(user.id, user.name)
-      },
-    }),
-  })
+  registerOauth(container) // prumo:mcp
+  registerEmail(container) // prumo:email
+  registerSocial(container) // prumo:social
 
   return container
 }

package/templates/api/src/infra/di/oauth.di.ts

@@ -0,0 +1,14 @@
+import type { DependencyContainer } from 'tsyringe'
+import { AUTHORIZATION_CODES } from '@/domain/oauth/ports/authorization-codes.port'
+import { CLIENT_METADATA } from '@/domain/oauth/ports/client-metadata.port'
+import { AUTHORIZATION_REPOSITORY } from '@/domain/oauth/repositories/authorization.repository'
+import { MikroOrmAuthorizationRepository } from '@/infra/database/mikroorm/repositories/mikroorm-authorization.repository'
+import { CryptoAuthorizationCodes } from '@/infra/oauth/crypto-authorization-codes.adapter'
+import { HttpsClientMetadata } from '@/infra/oauth/https-client-metadata.adapter'
+
+export function registerOauth(container: DependencyContainer): void {
+  container.register(AUTHORIZATION_REPOSITORY, { useClass: MikroOrmAuthorizationRepository })
+  container.register(AUTHORIZATION_CODES, { useValue: new CryptoAuthorizationCodes() })
+  // One instance, so its cache of client documents outlives a request.
+  container.register(CLIENT_METADATA, { useValue: new HttpsClientMetadata() })
+}

package/templates/api/src/infra/di/social.di.ts

@@ -0,0 +1,17 @@
+import type { DependencyContainer } from 'tsyringe'
+import { IDENTITY_PROVIDERS } from '@/domain/auth/ports/identity-providers.port'
+import { IDENTITY_REPOSITORY } from '@/domain/auth/repositories/identity.repository'
+import { SOCIAL_SIGN_IN_REPOSITORY } from '@/domain/auth/repositories/social-sign-in.repository'
+import { ENV, type Env } from '@/infra/config/env'
+import { MikroOrmIdentityRepository } from '@/infra/database/mikroorm/repositories/mikroorm-identity.repository'
+import { MikroOrmSocialSignInRepository } from '@/infra/database/mikroorm/repositories/mikroorm-social-sign-in.repository'
+import { OpenIdIdentityProviders } from '@/infra/social/openid-identity-providers.adapter'
+
+export function registerSocial(container: DependencyContainer): void {
+  container.register(IDENTITY_REPOSITORY, { useClass: MikroOrmIdentityRepository })
+  container.register(SOCIAL_SIGN_IN_REPOSITORY, { useClass: MikroOrmSocialSignInRepository })
+  // One instance, so each provider's discovery document is fetched once.
+  container.register(IDENTITY_PROVIDERS, {
+    useValue: new OpenIdIdentityProviders(container.resolve<Env>(ENV)),
+  })
+}

package/templates/api/src/infra/email/hmac-one-time-codes.adapter.ts

@@ -0,0 +1,16 @@
+import { createHmac, randomInt } from 'node:crypto'
+import type { OneTimeCodes } from '@/domain/auth/ports/one-time-codes.port'
+import type { Env } from '@/infra/config/env'
+
+export class HmacOneTimeCodes implements OneTimeCodes {
+  constructor(private readonly env: Pick<Env, 'JWT_SECRET'>) {}
+
+  create(): string {
+    return randomInt(0, 1_000_000).toString().padStart(6, '0')
+  }
+
+  // A million codes hash in a moment, so the hash is keyed by a secret the database does not hold.
+  digest(code: string): string {
+    return createHmac('sha256', this.env.JWT_SECRET).update(code).digest('base64url')
+  }
+}

package/templates/api/src/infra/email/log-mailer.adapter.ts

@@ -0,0 +1,11 @@
+import type { Mail, Mailer } from '@/domain/auth/ports/mailer.port'
+
+// Writes each mail to the log instead of sending it: enough to develop against, and nothing to sign up for. A
+// project that sends real mail gives the Mailer port another adapter; see .prumo/email/.
+export class LogMailer implements Mailer {
+  constructor(private readonly write: (line: string) => void) {}
+
+  async send(mail: Mail): Promise<void> {
+    this.write(`[mail] to ${mail.to}: ${mail.subject}\n${mail.text}`)
+  }
+}