@stjoseph/prumo 0.3.0 → 0.4.1

package/templates/api/src/domain/auth/use-cases/reset-password.use-case.ts

@@ -0,0 +1,73 @@
+import { inject, injectable } from 'tsyringe'
+import type { ResetPasswordDto } from '@/domain/auth/dto/reset-password.dto'
+import { User } from '@/domain/auth/entities/user.entity'
+import { InvalidCodeError } from '@/domain/auth/errors/invalid-code.error'
+import { ONE_TIME_CODES, type OneTimeCodes } from '@/domain/auth/ports/one-time-codes.port'
+import { PASSWORD_HASHER, type PasswordHasher } from '@/domain/auth/ports/password-hasher.port'
+import {
+  EMAIL_CODE_REPOSITORY,
+  type EmailCodeRepository,
+} from '@/domain/auth/repositories/email-code.repository'
+import {
+  SESSION_REPOSITORY,
+  type SessionRepository,
+} from '@/domain/auth/repositories/session.repository'
+import { USER_REPOSITORY, type UserRepository } from '@/domain/auth/repositories/user.repository'
+import {
+  type SessionTokens,
+  StartSessionUseCase,
+} from '@/domain/auth/use-cases/start-session.use-case'
+import {
+  TRANSACTION_MANAGER,
+  type TransactionManager,
+} from '@/domain/shared/transactions/transaction-manager'
+
+@injectable()
+export class ResetPasswordUseCase {
+  constructor(
+    @inject(USER_REPOSITORY) private readonly users: UserRepository,
+    @inject(EMAIL_CODE_REPOSITORY) private readonly codes: EmailCodeRepository,
+    @inject(SESSION_REPOSITORY) private readonly sessions: SessionRepository,
+    @inject(ONE_TIME_CODES) private readonly oneTimeCodes: OneTimeCodes,
+    @inject(PASSWORD_HASHER) private readonly hasher: PasswordHasher,
+    @inject(TRANSACTION_MANAGER) private readonly transactions: TransactionManager,
+    private readonly startSession: StartSessionUseCase,
+  ) {}
+
+  async execute({ email, code, password }: ResetPasswordDto): Promise<SessionTokens> {
+    const passwordHash = await this.hasher.hash(password)
+
+    const reset = await this.transactions.run(async () => {
+      const now = new Date()
+      const user = await this.users.findByEmail(User.normalizeEmail(email))
+      const stored = user === null ? null : await this.codes.lockFor(user.id, 'reset-password')
+
+      if (user === null || stored === null) {
+        return null
+      }
+
+      const outcome = stored.check(this.oneTimeCodes.digest(code), now)
+
+      await this.codes.save(stored)
+
+      if (outcome !== 'valid') {
+        return null
+      }
+
+      // The code arrived in the inbox, which is the proof verification asks for.
+      user.changePassword(passwordHash)
+      user.verifyEmail(now)
+      await this.users.save(user)
+      // Whoever knew the old password may still hold a session it opened.
+      await this.sessions.revokeAllFor(user.id, now)
+
+      return user
+    })
+
+    if (reset === null) {
+      throw new InvalidCodeError()
+    }
+
+    return this.startSession.execute(reset.id)
+  }
+}

package/templates/api/src/domain/auth/use-cases/sign-in.use-case.ts

@@ -1,6 +1,7 @@
 import { inject, injectable } from 'tsyringe'
 import type { SignInDto } from '@/domain/auth/dto/sign-in.dto'
 import { User } from '@/domain/auth/entities/user.entity'
+import { EmailNotVerifiedError } from '@/domain/auth/errors/email-not-verified.error' // prumo:email
 import { InvalidCredentialsError } from '@/domain/auth/errors/invalid-credentials.error'
 import { PASSWORD_HASHER, type PasswordHasher } from '@/domain/auth/ports/password-hasher.port'
 import { USER_REPOSITORY, type UserRepository } from '@/domain/auth/repositories/user.repository'
@@ -19,12 +20,19 @@ export class SignInUseCase {
 
   async execute({ email, password }: SignInDto): Promise<SessionTokens> {
     const user = await this.users.findByEmail(User.normalizeEmail(email))
-    const valid = await this.hasher.verify(user?.passwordHash, password)
+    const valid = await this.hasher.verify(user?.passwordHash ?? undefined, password)
 
     if (user === null || !valid) {
       throw new InvalidCredentialsError()
     }
 
+    // prumo:email
+    // Asked only after the password matched, so the answer says nothing to someone who does not know it.
+    if (user.emailVerifiedAt === null) {
+      throw new EmailNotVerifiedError()
+    }
+
+    // prumo:end-email
     return this.startSession.execute(user.id)
   }
 }

package/templates/api/src/domain/auth/use-cases/sign-up.use-case.ts

@@ -4,6 +4,7 @@ import { User } from '@/domain/auth/entities/user.entity'
 import { EmailTakenError } from '@/domain/auth/errors/email-taken.error'
 import { PASSWORD_HASHER, type PasswordHasher } from '@/domain/auth/ports/password-hasher.port'
 import { USER_REPOSITORY, type UserRepository } from '@/domain/auth/repositories/user.repository'
+import { IssueEmailCodeUseCase } from '@/domain/auth/use-cases/issue-email-code.use-case' // prumo:email
 import {
   type SessionTokens,
   StartSessionUseCase,
@@ -22,9 +23,11 @@ export class SignUpUseCase {
     @inject(TRANSACTION_MANAGER) private readonly transactions: TransactionManager,
     private readonly createProfile: CreateProfileUseCase,
     private readonly startSession: StartSessionUseCase,
+    private readonly issueEmailCode: IssueEmailCodeUseCase, // prumo:email
   ) {}
 
-  async execute({ name, email, password }: SignUpDto): Promise<SessionTokens> {
+  // Null when the account must confirm its email before it may sign in.
+  async execute({ name, email, password }: SignUpDto): Promise<SessionTokens | null> {
     const passwordHash = await this.hasher.hash(password)
 
     // The account and its profile exist together or not at all.
@@ -41,6 +44,14 @@ export class SignUpUseCase {
       return user
     })
 
+    // prumo:email
+    // Until the address is confirmed the account cannot sign in, so it opens no session either.
+    if (user.emailVerifiedAt === null) {
+      await this.issueEmailCode.execute(user, 'verify-email')
+      return null
+    }
+
+    // prumo:end-email
     return this.startSession.execute(user.id)
   }
 }

package/templates/api/src/domain/auth/use-cases/start-session.use-case.ts

@@ -17,6 +17,8 @@ export type SessionTokens = {
   accessToken: IssuedToken
   refreshToken: string
   refreshExpiresAt: Date
+  // What an OAuth client's tokens may do; null for the application's own sessions, which may do everything.
+  scope: string | null
 }
 
 @injectable()
@@ -37,12 +39,17 @@ export class StartSessionUseCase {
     return {
       sessionId: session.id,
       accessToken: await this.tokens.issue(
-        { userId, sessionId: session.id, ...(grant && { clientId: grant.clientId }) },
+        {
+          userId,
+          sessionId: session.id,
+          ...(grant && { clientId: grant.clientId, scope: grant.scope }),
+        },
         new Date(now.getTime() + ACCESS_TOKEN_LIFETIME_MS),
         grant?.resource,
       ),
       refreshToken: session.refreshToken(secret),
       refreshExpiresAt: session.expiresAt,
+      scope: session.scope,
     }
   }
 }

package/templates/api/src/domain/auth/use-cases/start-social-sign-in.use-case.ts

@@ -0,0 +1,54 @@
+import { inject, injectable } from 'tsyringe'
+import { type SocialClient, SocialSignIn } from '@/domain/auth/entities/social-sign-in.entity'
+import { ProviderNotConfiguredError } from '@/domain/auth/errors/provider-not-configured.error'
+import {
+  IDENTITY_PROVIDERS,
+  type IdentityProviders,
+  type ProviderName,
+} from '@/domain/auth/ports/identity-providers.port'
+import { OPAQUE_TOKENS, type OpaqueTokens } from '@/domain/auth/ports/opaque-tokens.port'
+import {
+  SOCIAL_SIGN_IN_REPOSITORY,
+  type SocialSignInRepository,
+} from '@/domain/auth/repositories/social-sign-in.repository'
+
+export type SocialStart = { provider: ProviderName; client: SocialClient; returnTo: string }
+
+@injectable()
+export class StartSocialSignInUseCase {
+  constructor(
+    @inject(IDENTITY_PROVIDERS) private readonly providers: IdentityProviders,
+    @inject(SOCIAL_SIGN_IN_REPOSITORY) private readonly signIns: SocialSignInRepository,
+    @inject(OPAQUE_TOKENS) private readonly opaque: OpaqueTokens,
+  ) {}
+
+  // Returns where to send the browser, and the token the browser keeps to prove, on the way back, that it started.
+  async execute({
+    provider,
+    client,
+    returnTo,
+  }: SocialStart): Promise<{ url: string; browserToken: string }> {
+    if (!this.providers.isConfigured(provider)) {
+      throw new ProviderNotConfiguredError(provider)
+    }
+
+    const secret = this.opaque.create()
+    const signIn = new SocialSignIn(
+      provider,
+      client,
+      returnTo,
+      this.opaque.digest(secret),
+      new Date(),
+    )
+
+    // Saved first: its id is the state the provider sends back.
+    await this.signIns.save(signIn)
+
+    const redirect = await this.providers.redirect(provider, signIn.id)
+
+    signIn.prepare(redirect.codeVerifier, redirect.nonce)
+    await this.signIns.save(signIn)
+
+    return { url: redirect.url, browserToken: signIn.token(secret) }
+  }
+}

package/templates/api/src/domain/auth/use-cases/verify-email.use-case.ts

@@ -0,0 +1,62 @@
+import { inject, injectable } from 'tsyringe'
+import type { VerifyEmailDto } from '@/domain/auth/dto/verify-email.dto'
+import { User } from '@/domain/auth/entities/user.entity'
+import { InvalidCodeError } from '@/domain/auth/errors/invalid-code.error'
+import { ONE_TIME_CODES, type OneTimeCodes } from '@/domain/auth/ports/one-time-codes.port'
+import {
+  EMAIL_CODE_REPOSITORY,
+  type EmailCodeRepository,
+} from '@/domain/auth/repositories/email-code.repository'
+import { USER_REPOSITORY, type UserRepository } from '@/domain/auth/repositories/user.repository'
+import {
+  type SessionTokens,
+  StartSessionUseCase,
+} from '@/domain/auth/use-cases/start-session.use-case'
+import {
+  TRANSACTION_MANAGER,
+  type TransactionManager,
+} from '@/domain/shared/transactions/transaction-manager'
+
+@injectable()
+export class VerifyEmailUseCase {
+  constructor(
+    @inject(USER_REPOSITORY) private readonly users: UserRepository,
+    @inject(EMAIL_CODE_REPOSITORY) private readonly codes: EmailCodeRepository,
+    @inject(ONE_TIME_CODES) private readonly oneTimeCodes: OneTimeCodes,
+    @inject(TRANSACTION_MANAGER) private readonly transactions: TransactionManager,
+    private readonly startSession: StartSessionUseCase,
+  ) {}
+
+  // A confirmed address signs the user in: they proved the inbox and already chose a password.
+  async execute({ email, code }: VerifyEmailDto): Promise<SessionTokens> {
+    // The spent attempt is committed before the error is thrown, or a wrong guess would cost nothing.
+    const verified = await this.transactions.run(async () => {
+      const now = new Date()
+      const user = await this.users.findByEmail(User.normalizeEmail(email))
+      const stored = user === null ? null : await this.codes.lockFor(user.id, 'verify-email')
+
+      if (user === null || stored === null) {
+        return null
+      }
+
+      const outcome = stored.check(this.oneTimeCodes.digest(code), now)
+
+      await this.codes.save(stored)
+
+      if (outcome !== 'valid') {
+        return null
+      }
+
+      user.verifyEmail(now)
+      await this.users.save(user)
+
+      return user
+    })
+
+    if (verified === null) {
+      throw new InvalidCodeError()
+    }
+
+    return this.startSession.execute(verified.id)
+  }
+}

package/templates/api/src/domain/oauth/dto/authorization-view.dto.ts

@@ -8,6 +8,7 @@ export const authorizationViewSchema = z.object({
   redirectHost: z.string(),
   // A localhost redirect cannot prove which program is listening there, so the page warns about it.
   redirectsToThisDevice: z.boolean(),
+  scopes: z.array(z.object({ scope: z.string(), description: z.string() })),
 })
 
 export type AuthorizationViewDto = z.infer<typeof authorizationViewSchema>

package/templates/api/src/domain/oauth/entities/authorization.entity.ts

@@ -13,6 +13,8 @@ export type AuthorizationRequest = {
   codeChallenge: string
   clientState: string | null
   resource: string
+  // The scopes the client asked for and the user is shown, space-separated.
+  scope: string
 }
 
 // One OAuth authorization, from the client's request through the user's answer to the code it is exchanged for.
@@ -24,6 +26,7 @@ export class Authorization {
   codeChallenge: string
   clientState: string | null
   resource: string
+  scope: string
   status: AuthorizationStatus = 'pending'
   userId: string | null = null
   codeHash: string | null = null
@@ -39,6 +42,7 @@ export class Authorization {
     this.codeChallenge = request.codeChallenge
     this.clientState = request.clientState
     this.resource = request.resource
+    this.scope = request.scope
     this.expiresAt = new Date(now.getTime() + AUTHORIZATION_REQUEST_LIFETIME_MS)
   }
 

package/templates/api/src/domain/oauth/errors/authorization-request.error.ts

@@ -6,7 +6,11 @@ export class AuthorizationRequestError extends DomainError {
   readonly kind = 'invalid'
 
   constructor(
-    readonly code: 'invalid_request' | 'unsupported_response_type' | 'invalid_target',
+    readonly code:
+      | 'invalid_request'
+      | 'unsupported_response_type'
+      | 'invalid_target'
+      | 'invalid_scope',
     message: string,
   ) {
     super(message)

package/templates/api/src/domain/oauth/use-cases/exchange-code.use-case.ts

@@ -78,6 +78,7 @@ export class ExchangeCodeUseCase {
       const tokens = await this.startSession.execute(authorization.userId, {
         clientId: authorization.clientId,
         resource: authorization.resource,
+        scope: authorization.scope,
       })
 
       authorization.exchange(tokens.sessionId)

package/templates/api/src/domain/oauth/use-cases/start-authorization.use-case.ts

@@ -22,6 +22,7 @@ export type AuthorizeRequest = {
   codeChallengeMethod: string | undefined
   clientState: string | null
   resource: string | undefined
+  scope: string | undefined
 }
 
 @injectable()
@@ -32,7 +33,11 @@ export class StartAuthorizationUseCase {
   ) {}
 
   // The client and its redirect URI are checked first: until both are, no error may be sent anywhere.
-  async execute(request: AuthorizeRequest, expectedResource: string): Promise<Authorization> {
+  async execute(
+    request: AuthorizeRequest,
+    expectedResource: string,
+    supportedScopes: readonly string[],
+  ): Promise<Authorization> {
     const client = await this.clients.read(request.clientId)
 
     // Exact match only: a prefix or a pattern is how an authorization code ends up somewhere else.
@@ -56,6 +61,14 @@ export class StartAuthorizationUseCase {
       throw new AuthorizationRequestError('invalid_target', `resource must be ${expectedResource}`)
     }
 
+    // A client that asks for nothing gets everything this server offers, and the consent page says so.
+    const requested = (request.scope ?? '').split(' ').filter(Boolean)
+    const unknown = requested.filter((scope) => !supportedScopes.includes(scope))
+
+    if (unknown.length > 0) {
+      throw new AuthorizationRequestError('invalid_scope', `Unknown scope: ${unknown.join(' ')}`)
+    }
+
     const authorization = new Authorization(
       {
         clientId: request.clientId,
@@ -64,6 +77,7 @@ export class StartAuthorizationUseCase {
         codeChallenge: request.codeChallenge as string,
         clientState: request.clientState,
         resource: expectedResource,
+        scope: (requested.length > 0 ? requested : supportedScopes).join(' '),
       },
       new Date(),
     )

package/templates/api/src/domain/shared/errors/domain-error.ts

@@ -2,4 +2,6 @@ export type DomainErrorKind = 'not_found' | 'conflict' | 'invalid' | 'forbidden'
 
 export abstract class DomainError extends Error {
   abstract readonly kind: DomainErrorKind
+  // A stable name a client can act on, when the status alone does not say what to do next.
+  readonly code?: string
 }

package/templates/api/src/infra/auth/jose-access-tokens.adapter.ts

@@ -19,13 +19,14 @@ export class JoseAccessTokens implements AccessTokens {
   }
 
   async issue(
-    { userId, sessionId, clientId }: AccessClaims,
+    { userId, sessionId, clientId, scope }: AccessClaims,
     expiresAt: Date,
     audience = this.issuer,
   ): Promise<IssuedToken> {
     const token = await new SignJWT({
       sid: sessionId,
       ...(clientId !== undefined && { client_id: clientId }),
+      ...(scope !== undefined && { scope }),
     })
       .setProtectedHeader({ alg: ALGORITHM })
       .setSubject(userId)
@@ -54,6 +55,7 @@ export class JoseAccessTokens implements AccessTokens {
         userId: payload.sub,
         sessionId: payload.sid,
         ...(typeof payload.client_id === 'string' && { clientId: payload.client_id }),
+        ...(typeof payload.scope === 'string' && { scope: payload.scope }),
       }
     } catch {
       return null

package/templates/api/src/infra/config/env.ts

@@ -9,6 +9,24 @@ const envSchema = z.object({
   // Where this API is reached from outside: the issuer of its tokens, and what decides whether cookies are Secure.
   API_URL: z.url(),
   WEB_ORIGIN: z.string().min(1),
+  // prumo:social
+  // Where a mobile app is sent back after signing in with a provider: its own scheme, as in app.json.
+  MOBILE_APP_SCHEME: z
+    .string()
+    .regex(/^[a-z][a-z0-9+.-]*$/)
+    .optional(),
+  // prumo:end-social
+  // prumo:google
+  GOOGLE_CLIENT_ID: z.string().min(1).optional(),
+  GOOGLE_CLIENT_SECRET: z.string().min(1).optional(),
+  // prumo:end-google
+  // prumo:apple
+  APPLE_CLIENT_ID: z.string().min(1).optional(),
+  APPLE_TEAM_ID: z.string().min(1).optional(),
+  APPLE_KEY_ID: z.string().min(1).optional(),
+  // The .p8 key's contents; on one line, with its line breaks written as \n.
+  APPLE_PRIVATE_KEY: z.string().min(1).optional(),
+  // prumo:end-apple
   LOG_LEVEL: z.enum(['error', 'warn', 'info', 'debug']),
 })
 

package/templates/api/src/infra/database/mikroorm/entities/authorization.schema.ts

@@ -11,6 +11,7 @@ export const AuthorizationSchema = new EntitySchema({
     codeChallenge: { type: 'text' },
     clientState: { type: 'text', nullable: true },
     resource: { type: 'text' },
+    scope: { type: 'text' },
     status: { type: 'text' },
     userId: {
       kind: 'm:1',

package/templates/api/src/infra/database/mikroorm/entities/email-code.schema.ts

@@ -0,0 +1,30 @@
+import { EntitySchema } from '@mikro-orm/core'
+import { EmailCode } from '@/domain/auth/entities/email-code.entity'
+
+export const EmailCodeSchema = new EntitySchema({
+  class: EmailCode,
+  uniques: [{ properties: ['userId', 'purpose'] }],
+  properties: {
+    id: { type: 'uuid', primary: true, defaultRaw: 'uuidv7()' },
+    userId: {
+      kind: 'm:1',
+      // EntitySchema cannot type a to-one relation held as its primary key on a string property.
+      entity: () => 'User' as never,
+      mapToPk: true,
+      fieldName: 'user_id',
+      // A code means nothing without its user.
+      deleteRule: 'cascade',
+    },
+    purpose: { type: 'text' },
+    codeHash: { type: 'text' },
+    attemptsLeft: { type: 'integer' },
+    expiresAt: { type: 'datetime' },
+    createdAt: { type: 'datetime', onCreate: () => new Date(), defaultRaw: 'now()' },
+    updatedAt: {
+      type: 'datetime',
+      onCreate: () => new Date(),
+      onUpdate: () => new Date(),
+      defaultRaw: 'now()',
+    },
+  },
+})

package/templates/api/src/infra/database/mikroorm/entities/identity.schema.ts

@@ -0,0 +1,29 @@
+import { EntitySchema } from '@mikro-orm/core'
+import { Identity } from '@/domain/auth/entities/identity.entity'
+
+export const IdentitySchema = new EntitySchema({
+  class: Identity,
+  uniques: [{ properties: ['provider', 'subject'] }],
+  properties: {
+    id: { type: 'uuid', primary: true, defaultRaw: 'uuidv7()' },
+    userId: {
+      kind: 'm:1',
+      // EntitySchema cannot type a to-one relation held as its primary key on a string property.
+      entity: () => 'User' as never,
+      mapToPk: true,
+      fieldName: 'user_id',
+      index: true,
+      // An identity means nothing without its user.
+      deleteRule: 'cascade',
+    },
+    provider: { type: 'text' },
+    subject: { type: 'text' },
+    createdAt: { type: 'datetime', onCreate: () => new Date(), defaultRaw: 'now()' },
+    updatedAt: {
+      type: 'datetime',
+      onCreate: () => new Date(),
+      onUpdate: () => new Date(),
+      defaultRaw: 'now()',
+    },
+  },
+})

package/templates/api/src/infra/database/mikroorm/entities/session.schema.ts

@@ -18,6 +18,7 @@ export const SessionSchema = new EntitySchema({
     tokenHash: { type: 'text' },
     clientId: { type: 'text', nullable: true },
     resource: { type: 'text', nullable: true },
+    scope: { type: 'text', nullable: true },
     previousTokenHash: { type: 'text', nullable: true },
     rotatedAt: { type: 'datetime', nullable: true },
     expiresAt: { type: 'datetime' },

package/templates/api/src/infra/database/mikroorm/entities/social-sign-in.schema.ts

@@ -0,0 +1,35 @@
+import { EntitySchema } from '@mikro-orm/core'
+import { SocialSignIn } from '@/domain/auth/entities/social-sign-in.entity'
+
+export const SocialSignInSchema = new EntitySchema({
+  class: SocialSignIn,
+  properties: {
+    id: { type: 'uuid', primary: true, defaultRaw: 'uuidv7()' },
+    provider: { type: 'text' },
+    client: { type: 'text' },
+    returnTo: { type: 'text' },
+    browserHash: { type: 'text' },
+    codeVerifier: { type: 'text', nullable: true },
+    nonce: { type: 'text' },
+    status: { type: 'text' },
+    userId: {
+      kind: 'm:1',
+      // EntitySchema cannot type a to-one relation held as its primary key on a string property.
+      entity: () => 'User' as never,
+      mapToPk: true,
+      fieldName: 'user_id',
+      nullable: true,
+      index: true,
+      deleteRule: 'cascade',
+    },
+    exchangeHash: { type: 'text', nullable: true },
+    expiresAt: { type: 'datetime' },
+    createdAt: { type: 'datetime', onCreate: () => new Date(), defaultRaw: 'now()' },
+    updatedAt: {
+      type: 'datetime',
+      onCreate: () => new Date(),
+      onUpdate: () => new Date(),
+      defaultRaw: 'now()',
+    },
+  },
+})

package/templates/api/src/infra/database/mikroorm/entities/user.schema.ts

@@ -6,7 +6,8 @@ export const UserSchema = new EntitySchema({
   properties: {
     id: { type: 'uuid', primary: true, defaultRaw: 'uuidv7()' },
     email: { type: 'text', unique: true },
-    passwordHash: { type: 'text' },
+    passwordHash: { type: 'text', nullable: true },
+    emailVerifiedAt: { type: 'datetime', nullable: true },
     createdAt: { type: 'datetime', onCreate: () => new Date(), defaultRaw: 'now()' },
     updatedAt: {
       type: 'datetime',

package/templates/api/src/infra/database/mikroorm/mikro-orm.factory.ts

@@ -2,8 +2,11 @@ import { Migrator } from '@mikro-orm/migrations'
 import { defineConfig } from '@mikro-orm/postgresql'
 import type { Env } from '@/infra/config/env'
 import { AuthorizationSchema } from './entities/authorization.schema' // prumo:mcp
+import { EmailCodeSchema } from './entities/email-code.schema' // prumo:email
+import { IdentitySchema } from './entities/identity.schema' // prumo:social
 import { ProfileSchema } from './entities/profile.schema'
 import { SessionSchema } from './entities/session.schema'
+import { SocialSignInSchema } from './entities/social-sign-in.schema' // prumo:social
 import { UserSchema } from './entities/user.schema'
 
 export function createOrmConfig(env: Pick<Env, 'DATABASE_URL' | 'NODE_ENV'>) {
@@ -14,6 +17,9 @@ export function createOrmConfig(env: Pick<Env, 'DATABASE_URL' | 'NODE_ENV'>) {
       ProfileSchema,
       SessionSchema,
       AuthorizationSchema, // prumo:mcp
+      EmailCodeSchema, // prumo:email
+      IdentitySchema, // prumo:social
+      SocialSignInSchema, // prumo:social
     ],
     extensions: [Migrator],
     migrations: { path: './migrations', snapshot: false },

package/templates/api/src/infra/database/mikroorm/repositories/mikroorm-email-code.repository.ts

@@ -0,0 +1,17 @@
+import { EntityManager, LockMode } from '@mikro-orm/postgresql'
+import { injectable } from 'tsyringe'
+import { EmailCode, type EmailCodePurpose } from '@/domain/auth/entities/email-code.entity'
+import type { EmailCodeRepository } from '@/domain/auth/repositories/email-code.repository'
+
+@injectable()
+export class MikroOrmEmailCodeRepository implements EmailCodeRepository {
+  constructor(private readonly em: EntityManager) {}
+
+  lockFor(userId: string, purpose: EmailCodePurpose): Promise<EmailCode | null> {
+    return this.em.findOne(EmailCode, { userId, purpose }, { lockMode: LockMode.PESSIMISTIC_WRITE })
+  }
+
+  async save(code: EmailCode): Promise<void> {
+    await this.em.persist(code).flush()
+  }
+}

package/templates/api/src/infra/database/mikroorm/repositories/mikroorm-identity.repository.ts

@@ -0,0 +1,18 @@
+import { EntityManager } from '@mikro-orm/postgresql'
+import { injectable } from 'tsyringe'
+import { Identity } from '@/domain/auth/entities/identity.entity'
+import type { ProviderName } from '@/domain/auth/ports/identity-providers.port'
+import type { IdentityRepository } from '@/domain/auth/repositories/identity.repository'
+
+@injectable()
+export class MikroOrmIdentityRepository implements IdentityRepository {
+  constructor(private readonly em: EntityManager) {}
+
+  findBySubject(provider: ProviderName, subject: string): Promise<Identity | null> {
+    return this.em.findOne(Identity, { provider, subject })
+  }
+
+  async save(identity: Identity): Promise<void> {
+    await this.em.persist(identity).flush()
+  }
+}

package/templates/api/src/infra/database/mikroorm/repositories/mikroorm-session.repository.ts

@@ -18,4 +18,8 @@ export class MikroOrmSessionRepository implements SessionRepository {
   async save(session: Session): Promise<void> {
     await this.em.persist(session).flush()
   }
+
+  async revokeAllFor(userId: string, now: Date): Promise<void> {
+    await this.em.nativeUpdate(Session, { userId, revokedAt: null }, { revokedAt: now })
+  }
 }

package/templates/api/src/infra/database/mikroorm/repositories/mikroorm-social-sign-in.repository.ts

@@ -0,0 +1,17 @@
+import { EntityManager, LockMode } from '@mikro-orm/postgresql'
+import { injectable } from 'tsyringe'
+import { SocialSignIn } from '@/domain/auth/entities/social-sign-in.entity'
+import type { SocialSignInRepository } from '@/domain/auth/repositories/social-sign-in.repository'
+
+@injectable()
+export class MikroOrmSocialSignInRepository implements SocialSignInRepository {
+  constructor(private readonly em: EntityManager) {}
+
+  lockById(id: string): Promise<SocialSignIn | null> {
+    return this.em.findOne(SocialSignIn, { id }, { lockMode: LockMode.PESSIMISTIC_WRITE })
+  }
+
+  async save(signIn: SocialSignIn): Promise<void> {
+    await this.em.persist(signIn).flush()
+  }
+}