@tempoxyz/id 0.0.0-stage → 0.0.1

package/src/app/crons/cleanup.ts

@@ -0,0 +1,104 @@
+/**
+ * Deletes expired rows, which reads already ignore. Void reads {@link cron} from the file's text,
+ * so it stays a literal. @module
+ */
+import { and, eq, isNotNull, lt, notExists, sql } from 'drizzle-orm'
+import { defineScheduled } from 'void'
+import { db } from 'void/db'
+import * as Log from '../../internal/Log.js'
+import * as Schema from '../db/schema.js'
+
+/** Hourly. */
+export const cron = '0 * * * *'
+
+/** Milliseconds that a third-party app's row stays without a consent or a realm. */
+const unconsented = 24 * 60 * 60 * 1000
+
+/**
+ * Deletes expired codes, device requests, pending keys, client assertions, tokens, and sessions,
+ * and unclaimed third-party app rows. A failure logs and fails the run.
+ */
+export default defineScheduled(async (controller) => {
+  const now = new Date()
+  try {
+    await db
+      .delete(Schema.verification)
+      .where(lt(Schema.verification.expiresAt, now))
+    await db
+      .delete(Schema.deviceCode)
+      .where(lt(Schema.deviceCode.expiresAt, now))
+    await db
+      .delete(Schema.deviceRequests)
+      .where(lt(Schema.deviceRequests.expiresAt, now))
+    await db
+      .delete(Schema.pendingKeys)
+      .where(lt(Schema.pendingKeys.expiresAt, now))
+    await db
+      .delete(Schema.oauthClient)
+      .where(
+        and(
+          isNotNull(Schema.oauthClient.clientDiscoveryId),
+          lt(
+            Schema.oauthClient.updatedAt,
+            new Date(now.getTime() - unconsented),
+          ),
+          sql`not exists (select 1 from ${Schema.oauthConsent} where ${Schema.oauthConsent.clientId} = ${Schema.oauthClient.clientId})`,
+          sql`not exists (select 1 from ${Schema.appRealms} where ${Schema.appRealms.clientId} = ${Schema.oauthClient.clientId})`,
+        ),
+      )
+    // An assertion's row expires with the assertion, which the token endpoint then refuses anyway.
+    await db
+      .delete(Schema.oauthClientAssertion)
+      .where(lt(Schema.oauthClientAssertion.expiresAt, now))
+    // The access tokens go first, so each access token that the next two deletes find is live.
+    await db
+      .delete(Schema.oauthAccessToken)
+      .where(lt(Schema.oauthAccessToken.expiresAt, now))
+    // The refresh grant refuses an expired refresh token before it checks for replay, so replay
+    // detection reads no expired row. A delete cascades to the token's access tokens, so a refresh
+    // token with a live access token stays.
+    await db.delete(Schema.oauthRefreshToken).where(
+      and(
+        lt(Schema.oauthRefreshToken.expiresAt, now),
+        notExists(
+          db
+            .select({ one: sql`1` })
+            .from(Schema.oauthAccessToken)
+            .where(
+              eq(
+                Schema.oauthAccessToken.refreshId,
+                Schema.oauthRefreshToken.id,
+              ),
+            ),
+        ),
+      ),
+    )
+    // A delete clears the session from its tokens. A token without a session introspects as active,
+    // and a refresh token without one mints access tokens without `sid`, so a session that a live
+    // access token or a remaining refresh token names stays.
+    await db.delete(Schema.session).where(
+      and(
+        lt(Schema.session.expiresAt, now),
+        notExists(
+          db
+            .select({ one: sql`1` })
+            .from(Schema.oauthAccessToken)
+            .where(eq(Schema.oauthAccessToken.sessionId, Schema.session.id)),
+        ),
+        notExists(
+          db
+            .select({ one: sql`1` })
+            .from(Schema.oauthRefreshToken)
+            .where(eq(Schema.oauthRefreshToken.sessionId, Schema.session.id)),
+        ),
+      ),
+    )
+  } catch (error) {
+    Log.error({
+      error,
+      fields: { cron: controller.cron },
+      message: 'The cleanup cron failed.',
+    })
+    throw error
+  }
+})

package/src/app/db/auth.ts

@@ -0,0 +1,440 @@
+/**
+ * The Better Auth tables, as Drizzle declares them. `pnpm db:schema` writes this file from the
+ * options in `src/internal/Auth.ts`, so edit those options instead.
+ * @module
+ */
+import { relations } from 'drizzle-orm'
+import {
+  boolean,
+  index,
+  integer,
+  jsonb,
+  text,
+  timestamp,
+  uniqueIndex,
+} from 'drizzle-orm/pg-core'
+import * as Table from './table.js'
+
+export const account = Table.define(
+  'account',
+  {
+    accessToken: text('access_token'),
+    accessTokenExpiresAt: timestamp('access_token_expires_at'),
+    accountId: text('account_id').notNull(),
+    createdAt: timestamp('created_at').defaultNow().notNull(),
+    id: text('id').primaryKey(),
+    idToken: text('id_token'),
+    password: text('password'),
+    providerId: text('provider_id').notNull(),
+    refreshToken: text('refresh_token'),
+    refreshTokenExpiresAt: timestamp('refresh_token_expires_at'),
+    scope: text('scope'),
+    updatedAt: timestamp('updated_at')
+      .$onUpdate(() => /* @__PURE__ */ new Date())
+      .notNull(),
+    userId: text('user_id')
+      .notNull()
+      .references(() => user.id, { onDelete: 'cascade' }),
+  },
+  (table) => [index('account_userId_idx').on(table.userId)],
+)
+
+export const accountRelations = relations(account, ({ one }) => ({
+  user: one(user, {
+    fields: [account.userId],
+    references: [user.id],
+  }),
+}))
+
+export const deviceCode = Table.define(
+  'device_code',
+  {
+    acr: text('acr'),
+    amr: text('amr').array(),
+    authTime: timestamp('auth_time'),
+    clientId: text('client_id'),
+    deviceCode: text('device_code').notNull(),
+    expiresAt: timestamp('expires_at').notNull(),
+    id: text('id').primaryKey(),
+    lastPolledAt: timestamp('last_polled_at'),
+    oauthClientId: text('oauth_client_id'),
+    pollingInterval: integer('polling_interval'),
+    referenceId: text('reference_id'),
+    resources: text('resources').array(),
+    scope: text('scope'),
+    status: text('status').notNull(),
+    userCode: text('user_code').notNull(),
+    userId: text('user_id'),
+  },
+  (table) => [
+    uniqueIndex('deviceCode_deviceCode_uidx').on(table.deviceCode),
+    index('deviceCode_expiresAt_idx').on(table.expiresAt),
+    uniqueIndex('deviceCode_userCode_uidx').on(table.userCode),
+  ],
+)
+
+export const jwks = Table.define('jwks', {
+  alg: text('alg'),
+  createdAt: timestamp('created_at').notNull(),
+  crv: text('crv'),
+  expiresAt: timestamp('expires_at'),
+  id: text('id').primaryKey(),
+  privateKey: text('private_key').notNull(),
+  publicKey: text('public_key').notNull(),
+})
+
+export const oauthAccessToken = Table.define(
+  'oauth_access_token',
+  {
+    authorizationCodeId: text('authorization_code_id'),
+    clientId: text('client_id')
+      .notNull()
+      .references(() => oauthClient.clientId, { onDelete: 'cascade' }),
+    confirmation: jsonb('confirmation'),
+    createdAt: timestamp('created_at').notNull(),
+    expiresAt: timestamp('expires_at').notNull(),
+    id: text('id').primaryKey(),
+    referenceId: text('reference_id'),
+    refreshId: text('refresh_id').references(() => oauthRefreshToken.id, {
+      onDelete: 'cascade',
+    }),
+    requestedUserInfoClaims: text('requested_user_info_claims').array(),
+    resources: text('resources').array(),
+    revoked: timestamp('revoked'),
+    scopes: text('scopes').array().notNull(),
+    sessionId: text('session_id').references(() => session.id, {
+      onDelete: 'set null',
+    }),
+    token: text('token').notNull().unique(),
+    userId: text('user_id').references(() => user.id, { onDelete: 'cascade' }),
+  },
+  (table) => [
+    index('oauthAccessToken_authorizationCodeId_idx').on(
+      table.authorizationCodeId,
+    ),
+    index('oauthAccessToken_clientId_idx').on(table.clientId),
+    index('oauthAccessToken_expiresAt_idx').on(table.expiresAt),
+    index('oauthAccessToken_refreshId_idx').on(table.refreshId),
+    index('oauthAccessToken_sessionId_idx').on(table.sessionId),
+    index('oauthAccessToken_userId_idx').on(table.userId),
+  ],
+)
+
+export const oauthAccessTokenRelations = relations(
+  oauthAccessToken,
+  ({ one }) => ({
+    oauthClient: one(oauthClient, {
+      fields: [oauthAccessToken.clientId],
+      references: [oauthClient.clientId],
+    }),
+    oauthRefreshToken: one(oauthRefreshToken, {
+      fields: [oauthAccessToken.refreshId],
+      references: [oauthRefreshToken.id],
+    }),
+    session: one(session, {
+      fields: [oauthAccessToken.sessionId],
+      references: [session.id],
+    }),
+    user: one(user, {
+      fields: [oauthAccessToken.userId],
+      references: [user.id],
+    }),
+  }),
+)
+
+export const oauthClient = Table.define(
+  'oauth_client',
+  {
+    applicationType: text('application_type'),
+    backchannelLogoutSessionRequired: boolean(
+      'backchannel_logout_session_required',
+    ),
+    backchannelLogoutUri: text('backchannel_logout_uri'),
+    clientCredentialsScopes: text('client_credentials_scopes')
+      .array()
+      .default([]),
+    clientDiscoveryId: text('client_discovery_id'),
+    clientId: text('client_id').notNull().unique(),
+    clientSecret: text('client_secret'),
+    contacts: text('contacts').array(),
+    createdAt: timestamp('created_at'),
+    disabled: boolean('disabled').default(false),
+    dpopBoundAccessTokens: boolean('dpop_bound_access_tokens').default(false),
+    enableEndSession: boolean('enable_end_session'),
+    frontchannelLogoutSessionRequired: boolean(
+      'frontchannel_logout_session_required',
+    ),
+    frontchannelLogoutUri: text('frontchannel_logout_uri'),
+    grantTypes: text('grant_types').array(),
+    icon: text('icon'),
+    id: text('id').primaryKey(),
+    jwks: text('jwks'),
+    jwksUri: text('jwks_uri'),
+    metadata: jsonb('metadata'),
+    name: text('name'),
+    policy: text('policy'),
+    postLogoutRedirectUris: text('post_logout_redirect_uris').array(),
+    redirectUris: text('redirect_uris').array().notNull(),
+    referenceId: text('reference_id'),
+    requirePKCE: boolean('require_pkce'),
+    responseTypes: text('response_types').array(),
+    scopes: text('scopes').array(),
+    sectorIdentifier: text('sector_identifier'),
+    skipConsent: boolean('skip_consent'),
+    softwareId: text('software_id'),
+    softwareStatement: text('software_statement'),
+    softwareVersion: text('software_version'),
+    subjectType: text('subject_type'),
+    tokenEndpointAuthMethod: text('token_endpoint_auth_method'),
+    tos: text('tos'),
+    updatedAt: timestamp('updated_at'),
+    uri: text('uri'),
+    userId: text('user_id').references(() => user.id, { onDelete: 'cascade' }),
+  },
+  (table) => [index('oauthClient_userId_idx').on(table.userId)],
+)
+
+export const oauthClientAssertion = Table.define(
+  'oauth_client_assertion',
+  {
+    expiresAt: timestamp('expires_at').notNull(),
+    id: text('id').primaryKey(),
+  },
+  (table) => [index('oauthClientAssertion_expiresAt_idx').on(table.expiresAt)],
+)
+
+export const oauthClientRelations = relations(oauthClient, ({ many, one }) => ({
+  oauthAccessTokens: many(oauthAccessToken),
+  oauthClientResources: many(oauthClientResource),
+  oauthConsents: many(oauthConsent),
+  oauthRefreshTokens: many(oauthRefreshToken),
+  user: one(user, {
+    fields: [oauthClient.userId],
+    references: [user.id],
+  }),
+}))
+
+export const oauthClientResource = Table.define(
+  'oauth_client_resource',
+  {
+    clientId: text('client_id')
+      .notNull()
+      .references(() => oauthClient.clientId, { onDelete: 'cascade' }),
+    createdAt: timestamp('created_at'),
+    id: text('id').primaryKey(),
+    metadata: jsonb('metadata'),
+    resourceId: text('resource_id')
+      .notNull()
+      .references(() => oauthResource.identifier, { onDelete: 'cascade' }),
+  },
+  (table) => [
+    index('oauthClientResource_clientId_idx').on(table.clientId),
+    uniqueIndex('oauthClientResource_clientId_resourceId_uidx').on(
+      table.clientId,
+      table.resourceId,
+    ),
+    index('oauthClientResource_resourceId_idx').on(table.resourceId),
+  ],
+)
+
+export const oauthClientResourceRelations = relations(
+  oauthClientResource,
+  ({ one }) => ({
+    oauthClient: one(oauthClient, {
+      fields: [oauthClientResource.clientId],
+      references: [oauthClient.clientId],
+    }),
+    oauthResource: one(oauthResource, {
+      fields: [oauthClientResource.resourceId],
+      references: [oauthResource.identifier],
+    }),
+  }),
+)
+
+export const oauthConsent = Table.define(
+  'oauth_consent',
+  {
+    clientId: text('client_id')
+      .notNull()
+      .references(() => oauthClient.clientId, { onDelete: 'cascade' }),
+    createdAt: timestamp('created_at').notNull(),
+    id: text('id').primaryKey(),
+    referenceId: text('reference_id'),
+    requestedUserInfoClaims: text('requested_user_info_claims').array(),
+    resources: text('resources').array(),
+    scopes: text('scopes').array().notNull(),
+    updatedAt: timestamp('updated_at').notNull(),
+    userId: text('user_id').references(() => user.id, { onDelete: 'cascade' }),
+  },
+  (table) => [
+    index('oauthConsent_clientId_idx').on(table.clientId),
+    index('oauthConsent_userId_idx').on(table.userId),
+  ],
+)
+
+export const oauthConsentRelations = relations(oauthConsent, ({ one }) => ({
+  oauthClient: one(oauthClient, {
+    fields: [oauthConsent.clientId],
+    references: [oauthClient.clientId],
+  }),
+  user: one(user, {
+    fields: [oauthConsent.userId],
+    references: [user.id],
+  }),
+}))
+
+export const oauthRefreshToken = Table.define(
+  'oauth_refresh_token',
+  {
+    acr: text('acr'),
+    amr: text('amr').array(),
+    authorizationCodeId: text('authorization_code_id'),
+    authTime: timestamp('auth_time'),
+    clientId: text('client_id')
+      .notNull()
+      .references(() => oauthClient.clientId, { onDelete: 'cascade' }),
+    confirmation: jsonb('confirmation'),
+    createdAt: timestamp('created_at').notNull(),
+    expiresAt: timestamp('expires_at').notNull(),
+    id: text('id').primaryKey(),
+    referenceId: text('reference_id'),
+    requestedUserInfoClaims: text('requested_user_info_claims').array(),
+    resources: text('resources').array(),
+    revoked: timestamp('revoked'),
+    rotatedAt: timestamp('rotated_at'),
+    rotationReplayExpiresAt: timestamp('rotation_replay_expires_at'),
+    rotationReplayResponse: text('rotation_replay_response'),
+    scopes: text('scopes').array().notNull(),
+    sessionId: text('session_id').references(() => session.id, {
+      onDelete: 'set null',
+    }),
+    token: text('token').notNull().unique(),
+    userId: text('user_id')
+      .notNull()
+      .references(() => user.id, { onDelete: 'cascade' }),
+  },
+  (table) => [
+    index('oauthRefreshToken_authorizationCodeId_idx').on(
+      table.authorizationCodeId,
+    ),
+    index('oauthRefreshToken_clientId_idx').on(table.clientId),
+    index('oauthRefreshToken_expiresAt_idx').on(table.expiresAt),
+    index('oauthRefreshToken_sessionId_idx').on(table.sessionId),
+    index('oauthRefreshToken_userId_idx').on(table.userId),
+  ],
+)
+
+export const oauthRefreshTokenRelations = relations(
+  oauthRefreshToken,
+  ({ many, one }) => ({
+    oauthAccessTokens: many(oauthAccessToken),
+    oauthClient: one(oauthClient, {
+      fields: [oauthRefreshToken.clientId],
+      references: [oauthClient.clientId],
+    }),
+    session: one(session, {
+      fields: [oauthRefreshToken.sessionId],
+      references: [session.id],
+    }),
+    user: one(user, {
+      fields: [oauthRefreshToken.userId],
+      references: [user.id],
+    }),
+  }),
+)
+
+export const oauthResource = Table.define('oauth_resource', {
+  accessTokenTtl: integer('access_token_ttl'),
+  allowedScopes: text('allowed_scopes').array(),
+  createdAt: timestamp('created_at'),
+  customClaims: jsonb('custom_claims'),
+  disabled: boolean('disabled').default(false),
+  dpopBoundAccessTokensRequired: boolean(
+    'dpop_bound_access_tokens_required',
+  ).default(false),
+  id: text('id').primaryKey(),
+  identifier: text('identifier').notNull().unique(),
+  metadata: jsonb('metadata'),
+  name: text('name').notNull(),
+  policyVersion: integer('policy_version').default(1),
+  refreshTokenTtl: integer('refresh_token_ttl'),
+  signingAlgorithm: text('signing_algorithm'),
+  signingKeyId: text('signing_key_id'),
+  updatedAt: timestamp('updated_at'),
+})
+
+export const oauthResourceRelations = relations(oauthResource, ({ many }) => ({
+  oauthClientResources: many(oauthClientResource),
+}))
+
+export const session = Table.define(
+  'session',
+  {
+    createdAt: timestamp('created_at').defaultNow().notNull(),
+    expiresAt: timestamp('expires_at').notNull(),
+    id: text('id').primaryKey(),
+    ipAddress: text('ip_address'),
+    token: text('token').notNull().unique(),
+    updatedAt: timestamp('updated_at')
+      .$onUpdate(() => /* @__PURE__ */ new Date())
+      .notNull(),
+    userAgent: text('user_agent'),
+    userId: text('user_id')
+      .notNull()
+      .references(() => user.id, { onDelete: 'cascade' }),
+  },
+  (table) => [
+    index('session_expiresAt_idx').on(table.expiresAt),
+    index('session_userId_idx').on(table.userId),
+  ],
+)
+
+export const sessionRelations = relations(session, ({ many, one }) => ({
+  oauthAccessTokens: many(oauthAccessToken),
+  oauthRefreshTokens: many(oauthRefreshToken),
+  user: one(user, {
+    fields: [session.userId],
+    references: [user.id],
+  }),
+}))
+
+export const user = Table.define('user', {
+  createdAt: timestamp('created_at').defaultNow().notNull(),
+  email: text('email').notNull().unique(),
+  emailVerified: boolean('email_verified').default(false).notNull(),
+  id: text('id').primaryKey(),
+  image: text('image'),
+  name: text('name').notNull(),
+  updatedAt: timestamp('updated_at')
+    .defaultNow()
+    .$onUpdate(() => /* @__PURE__ */ new Date())
+    .notNull(),
+})
+
+export const userRelations = relations(user, ({ many }) => ({
+  accounts: many(account),
+  oauthAccessTokens: many(oauthAccessToken),
+  oauthClients: many(oauthClient),
+  oauthConsents: many(oauthConsent),
+  oauthRefreshTokens: many(oauthRefreshToken),
+  sessions: many(session),
+}))
+
+export const verification = Table.define(
+  'verification',
+  {
+    createdAt: timestamp('created_at').defaultNow().notNull(),
+    expiresAt: timestamp('expires_at').notNull(),
+    id: text('id').primaryKey(),
+    identifier: text('identifier').notNull(),
+    updatedAt: timestamp('updated_at')
+      .defaultNow()
+      .$onUpdate(() => /* @__PURE__ */ new Date())
+      .notNull(),
+    value: text('value').notNull(),
+  },
+  (table) => [
+    index('verification_expiresAt_idx').on(table.expiresAt),
+    index('verification_identifier_idx').on(table.identifier),
+  ],
+)

package/src/app/db/migrations/0000_better_auth.sql

@@ -0,0 +1,53 @@
+CREATE TABLE "account" (
+	"id" text PRIMARY KEY NOT NULL,
+	"account_id" text NOT NULL,
+	"provider_id" text NOT NULL,
+	"user_id" text NOT NULL,
+	"access_token" text,
+	"refresh_token" text,
+	"id_token" text,
+	"access_token_expires_at" timestamp,
+	"refresh_token_expires_at" timestamp,
+	"scope" text,
+	"password" text,
+	"created_at" timestamp DEFAULT now() NOT NULL,
+	"updated_at" timestamp NOT NULL
+);
+--> statement-breakpoint
+CREATE TABLE "session" (
+	"id" text PRIMARY KEY NOT NULL,
+	"expires_at" timestamp NOT NULL,
+	"token" text NOT NULL,
+	"created_at" timestamp DEFAULT now() NOT NULL,
+	"updated_at" timestamp NOT NULL,
+	"ip_address" text,
+	"user_agent" text,
+	"user_id" text NOT NULL,
+	CONSTRAINT "session_token_unique" UNIQUE("token")
+);
+--> statement-breakpoint
+CREATE TABLE "user" (
+	"id" text PRIMARY KEY NOT NULL,
+	"name" text NOT NULL,
+	"email" text NOT NULL,
+	"email_verified" boolean DEFAULT false NOT NULL,
+	"image" text,
+	"created_at" timestamp DEFAULT now() NOT NULL,
+	"updated_at" timestamp DEFAULT now() NOT NULL,
+	CONSTRAINT "user_email_unique" UNIQUE("email")
+);
+--> statement-breakpoint
+CREATE TABLE "verification" (
+	"id" text PRIMARY KEY NOT NULL,
+	"identifier" text NOT NULL,
+	"value" text NOT NULL,
+	"expires_at" timestamp NOT NULL,
+	"created_at" timestamp DEFAULT now() NOT NULL,
+	"updated_at" timestamp DEFAULT now() NOT NULL
+);
+--> statement-breakpoint
+ALTER TABLE "account" ADD CONSTRAINT "account_user_id_user_id_fk" FOREIGN KEY ("user_id") REFERENCES "public"."user"("id") ON DELETE cascade ON UPDATE no action;--> statement-breakpoint
+ALTER TABLE "session" ADD CONSTRAINT "session_user_id_user_id_fk" FOREIGN KEY ("user_id") REFERENCES "public"."user"("id") ON DELETE cascade ON UPDATE no action;--> statement-breakpoint
+CREATE INDEX "account_userId_idx" ON "account" USING btree ("user_id");--> statement-breakpoint
+CREATE INDEX "session_userId_idx" ON "session" USING btree ("user_id");--> statement-breakpoint
+CREATE INDEX "verification_identifier_idx" ON "verification" USING btree ("identifier");