@ttoss/auth-postgresdb 0.1.0

package/dist/index.mjs

@@ -0,0 +1,475 @@
+/** Powered by @ttoss/config. https://ttoss.dev/docs/modules/packages/config/ */
+import { hashAuthorizationCode } from "@ttoss/auth-core";
+import { Column, DataType, Model, PrimaryKey, Table } from "@ttoss/postgresdb";
+
+//#region src/stores/createAuthCodeStore.ts
+/**
+* Creates an {@link AuthCodeStore} backed by the `oauth_auth_codes` table,
+* storing codes by SHA-256 hash.
+*
+* The engine hands the store the plaintext code on every call and never compares
+* the returned `code` against anything — it reads only `clientId`,
+* `redirectUri`, `codeChallenge`, `scopes`, `subject`, and `expiresAt`. So the
+* adapter hashes to find the row and echoes the presented value back, and a
+* database dump yields no replayable codes.
+*/
+var createAuthCodeStore = ({
+  model
+}) => {
+  return {
+    save: async code => {
+      await model.upsert({
+        codeHash: hashAuthorizationCode({
+          code: code.code
+        }),
+        clientId: code.clientId,
+        redirectUri: code.redirectUri,
+        codeChallenge: code.codeChallenge,
+        scopes: code.scopes,
+        subject: code.subject,
+        expiresAt: new Date(code.expiresAt)
+      });
+    },
+    get: async code => {
+      const row = await model.findByPk(hashAuthorizationCode({
+        code
+      }));
+      if (!row) return;
+      return {
+        code,
+        clientId: row.clientId,
+        redirectUri: row.redirectUri,
+        codeChallenge: row.codeChallenge,
+        scopes: row.scopes,
+        subject: row.subject,
+        expiresAt: row.expiresAt.getTime()
+      };
+    },
+    delete: async code => {
+      await model.destroy({
+        where: {
+          codeHash: hashAuthorizationCode({
+            code
+          })
+        }
+      });
+    }
+  };
+};
+
+//#endregion
+//#region src/stores/createClientStore.ts
+/**
+* Registration fields that have their own column. Everything else a client
+* submits goes to `metadata`, so the document round-trips unchanged.
+*/
+var COLUMN_FIELDS = ["client_id", "client_secret", "client_name", "redirect_uris", "grant_types", "response_types", "token_endpoint_auth_method", "scope", "client_id_issued_at"];
+var toRecord = row => {
+  return {
+    ...row.metadata,
+    client_id: row.clientId,
+    redirect_uris: row.redirectUris,
+    ...(row.clientSecret !== null && {
+      client_secret: row.clientSecret
+    }),
+    ...(row.clientName !== null && {
+      client_name: row.clientName
+    }),
+    ...(row.grantTypes !== null && {
+      grant_types: row.grantTypes
+    }),
+    ...(row.responseTypes !== null && {
+      response_types: row.responseTypes
+    }),
+    ...(row.tokenEndpointAuthMethod !== null && {
+      token_endpoint_auth_method: row.tokenEndpointAuthMethod
+    }),
+    ...(row.scope !== null && {
+      scope: row.scope
+    }),
+    ...(row.clientIdIssuedAt !== null && {
+      client_id_issued_at: Number(row.clientIdIssuedAt)
+    })
+  };
+};
+var toMetadata = client => {
+  const metadata = {};
+  for (const [key, value] of Object.entries(client)) if (!COLUMN_FIELDS.includes(key)) metadata[key] = value;
+  return metadata;
+};
+/**
+* Creates a {@link ClientStore} backed by the `oauth_clients` table.
+*
+* `register` upserts, so re-registering an existing `client_id` replaces the
+* stored document rather than failing on the primary key.
+*/
+var createClientStore = ({
+  model
+}) => {
+  return {
+    get: async clientId => {
+      const row = await model.findByPk(clientId);
+      return row ? toRecord(row) : void 0;
+    },
+    register: async client => {
+      await model.upsert({
+        clientId: client.client_id,
+        clientSecret: client.client_secret ?? null,
+        clientName: client.client_name ?? null,
+        redirectUris: client.redirect_uris,
+        grantTypes: client.grant_types ?? null,
+        responseTypes: client.response_types ?? null,
+        tokenEndpointAuthMethod: client.token_endpoint_auth_method ?? null,
+        scope: client.scope ?? null,
+        clientIdIssuedAt: client.client_id_issued_at ?? null,
+        metadata: toMetadata(client)
+      });
+    }
+  };
+};
+
+//#endregion
+//#region src/stores/createConsentStore.ts
+/**
+* Creates a consent store backed by the `oauth_consents` table, for use with
+* `createRedirectConsentOnAuthorize`.
+*
+* Reads and deletes satisfy `ConsentGrantStore`; `saveConsentGrant` covers the
+* write the consent page performs. Grants are single-use — the `onAuthorize`
+* hook deletes each one as it consumes it.
+*/
+var createConsentStore = ({
+  model
+}) => {
+  return {
+    saveConsentGrant: async ({
+      codeChallenge,
+      subject,
+      scopes,
+      expiresAt
+    }) => {
+      await model.upsert({
+        codeChallenge,
+        subject,
+        scopes,
+        expiresAt: new Date(expiresAt)
+      });
+    },
+    getConsentGrant: async ({
+      codeChallenge
+    }) => {
+      const row = await model.findByPk(codeChallenge);
+      if (!row) return;
+      return {
+        subject: row.subject,
+        scopes: row.scopes,
+        expiresAt: row.expiresAt.getTime()
+      };
+    },
+    deleteConsentGrant: async ({
+      codeChallenge
+    }) => {
+      await model.destroy({
+        where: {
+          codeChallenge
+        }
+      });
+    }
+  };
+};
+
+//#endregion
+//#region src/stores/createRefreshTokenStore.ts
+/**
+* Creates a {@link RefreshTokenStore} backed by the `oauth_refresh_tokens`
+* table, keyed by token hash and by the `(clientId, subject)` owner that
+* `deleteByOwner` revokes on reuse detection.
+*/
+var createRefreshTokenStore = ({
+  model
+}) => {
+  return {
+    save: async token => {
+      await model.upsert({
+        tokenHash: token.tokenHash,
+        clientId: token.clientId,
+        subject: token.subject,
+        scopes: token.scopes,
+        expiresAt: new Date(token.expiresAt),
+        consumedAt: token.consumedAt === void 0 ? null : new Date(token.consumedAt)
+      });
+    },
+    get: async tokenHash => {
+      const row = await model.findByPk(tokenHash);
+      if (!row) return;
+      return {
+        tokenHash: row.tokenHash,
+        clientId: row.clientId,
+        subject: row.subject,
+        scopes: row.scopes,
+        expiresAt: row.expiresAt.getTime(),
+        /**
+        * The key is omitted, not set to `null`. Rotation tests
+        * `stored.consumedAt !== undefined` to detect reuse, and a nullable
+        * timestamp column reads back as `null` — which would make every live
+        * token look consumed, so the first refresh would be treated as a
+        * replay and revoke the owner's entire token set.
+        */
+        ...(row.consumedAt !== null && {
+          consumedAt: row.consumedAt.getTime()
+        })
+      };
+    },
+    delete: async tokenHash => {
+      await model.destroy({
+        where: {
+          tokenHash
+        }
+      });
+    },
+    deleteByOwner: async ({
+      clientId,
+      subject
+    }) => {
+      await model.destroy({
+        where: {
+          clientId,
+          subject
+        }
+      });
+    }
+  };
+};
+
+//#endregion
+//#region src/createPostgresdbOAuthStores.ts
+/**
+* Creates every durable OAuth store from a `@ttoss/postgresdb` `db` handle.
+*
+* The stores are mechanical adapters between the `@ttoss/auth-core` store
+* contracts and Sequelize, so an app that already uses `@ttoss/postgresdb` does
+* not have to write them — nor reach around its own ORM to inject a raw `pg`
+* query runner.
+*
+* @example
+* ```typescript
+* import { createPostgresdbOAuthStores, oauthModels } from '@ttoss/auth-postgresdb';
+* import { initialize } from '@ttoss/postgresdb';
+*
+* const db = await initialize({ models: { ...oauthModels, User } });
+*
+* const { clientStore, authCodeStore, consentStore, refreshTokenStore } =
+*   createPostgresdbOAuthStores({ db });
+* ```
+*/
+var createPostgresdbOAuthStores = ({
+  db
+}) => {
+  return {
+    clientStore: createClientStore({
+      model: db.OAuthClient
+    }),
+    authCodeStore: createAuthCodeStore({
+      model: db.OAuthAuthCode
+    }),
+    consentStore: createConsentStore({
+      model: db.OAuthConsent
+    }),
+    refreshTokenStore: createRefreshTokenStore({
+      model: db.OAuthRefreshToken
+    })
+  };
+};
+
+//#endregion
+//#region \0@oxc-project+runtime@0.134.0/helpers/esm/decorateMetadata.js
+function __decorateMetadata(k, v) {
+  if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+}
+
+//#endregion
+//#region \0@oxc-project+runtime@0.134.0/helpers/esm/decorate.js
+function __decorate(decorators, target, key, desc) {
+  var c = arguments.length,
+    r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc,
+    d;
+  if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+  return c > 3 && r && Object.defineProperty(target, key, r), r;
+}
+
+//#endregion
+//#region src/models/OAuthAuthCode.ts
+var OAuthAuthCode = class OAuthAuthCode extends Model {};
+__decorate([PrimaryKey, Column({
+  type: DataType.STRING,
+  allowNull: false
+}), __decorateMetadata("design:type", String)], OAuthAuthCode.prototype, "codeHash", void 0);
+__decorate([Column({
+  type: DataType.STRING,
+  allowNull: false
+}), __decorateMetadata("design:type", String)], OAuthAuthCode.prototype, "clientId", void 0);
+__decorate([Column({
+  type: DataType.TEXT,
+  allowNull: false
+}), __decorateMetadata("design:type", String)], OAuthAuthCode.prototype, "redirectUri", void 0);
+__decorate([Column({
+  type: DataType.STRING,
+  allowNull: false
+}), __decorateMetadata("design:type", String)], OAuthAuthCode.prototype, "codeChallenge", void 0);
+__decorate([Column({
+  type: DataType.JSONB,
+  allowNull: false
+}), __decorateMetadata("design:type", Array)], OAuthAuthCode.prototype, "scopes", void 0);
+__decorate([Column({
+  type: DataType.STRING,
+  allowNull: false
+}), __decorateMetadata("design:type", String)], OAuthAuthCode.prototype, "subject", void 0);
+__decorate([Column({
+  type: DataType.DATE,
+  allowNull: false
+}), __decorateMetadata("design:type", typeof Date === "undefined" ? Object : Date)], OAuthAuthCode.prototype, "expiresAt", void 0);
+OAuthAuthCode = __decorate([Table({
+  tableName: "oauth_auth_codes",
+  modelName: "oauthAuthCode",
+  indexes: [{
+    fields: ["expires_at"]
+  }]
+})], OAuthAuthCode);
+
+//#endregion
+//#region src/models/OAuthClient.ts
+var OAuthClient = class OAuthClient extends Model {};
+__decorate([PrimaryKey, Column({
+  type: DataType.STRING,
+  allowNull: false
+}), __decorateMetadata("design:type", String)], OAuthClient.prototype, "clientId", void 0);
+__decorate([Column({
+  type: DataType.STRING,
+  allowNull: true
+}), __decorateMetadata("design:type", Object)], OAuthClient.prototype, "clientSecret", void 0);
+__decorate([Column({
+  type: DataType.STRING,
+  allowNull: true
+}), __decorateMetadata("design:type", Object)], OAuthClient.prototype, "clientName", void 0);
+__decorate([Column({
+  type: DataType.JSONB,
+  allowNull: false
+}), __decorateMetadata("design:type", Array)], OAuthClient.prototype, "redirectUris", void 0);
+__decorate([Column({
+  type: DataType.JSONB,
+  allowNull: true
+}), __decorateMetadata("design:type", Object)], OAuthClient.prototype, "grantTypes", void 0);
+__decorate([Column({
+  type: DataType.JSONB,
+  allowNull: true
+}), __decorateMetadata("design:type", Object)], OAuthClient.prototype, "responseTypes", void 0);
+__decorate([Column({
+  type: DataType.STRING,
+  allowNull: true
+}), __decorateMetadata("design:type", Object)], OAuthClient.prototype, "tokenEndpointAuthMethod", void 0);
+__decorate([Column({
+  type: DataType.STRING,
+  allowNull: true
+}), __decorateMetadata("design:type", Object)], OAuthClient.prototype, "scope", void 0);
+__decorate([Column({
+  type: DataType.BIGINT,
+  allowNull: true
+}), __decorateMetadata("design:type", Object)], OAuthClient.prototype, "clientIdIssuedAt", void 0);
+__decorate([Column({
+  type: DataType.JSONB,
+  allowNull: false,
+  defaultValue: {}
+}), __decorateMetadata("design:type", typeof Record === "undefined" ? Object : Record)], OAuthClient.prototype, "metadata", void 0);
+OAuthClient = __decorate([Table({
+  tableName: "oauth_clients",
+  modelName: "oauthClient"
+})], OAuthClient);
+
+//#endregion
+//#region src/models/OAuthConsent.ts
+var OAuthConsent = class OAuthConsent extends Model {};
+__decorate([PrimaryKey, Column({
+  type: DataType.STRING,
+  allowNull: false
+}), __decorateMetadata("design:type", String)], OAuthConsent.prototype, "codeChallenge", void 0);
+__decorate([Column({
+  type: DataType.STRING,
+  allowNull: false
+}), __decorateMetadata("design:type", String)], OAuthConsent.prototype, "subject", void 0);
+__decorate([Column({
+  type: DataType.JSONB,
+  allowNull: false
+}), __decorateMetadata("design:type", Array)], OAuthConsent.prototype, "scopes", void 0);
+__decorate([Column({
+  type: DataType.DATE,
+  allowNull: false
+}), __decorateMetadata("design:type", typeof Date === "undefined" ? Object : Date)], OAuthConsent.prototype, "expiresAt", void 0);
+OAuthConsent = __decorate([Table({
+  tableName: "oauth_consents",
+  modelName: "oauthConsent",
+  indexes: [{
+    fields: ["expires_at"]
+  }]
+})], OAuthConsent);
+
+//#endregion
+//#region src/models/OAuthRefreshToken.ts
+var OAuthRefreshToken = class OAuthRefreshToken extends Model {};
+__decorate([PrimaryKey, Column({
+  type: DataType.STRING,
+  allowNull: false
+}), __decorateMetadata("design:type", String)], OAuthRefreshToken.prototype, "tokenHash", void 0);
+__decorate([Column({
+  type: DataType.STRING,
+  allowNull: false
+}), __decorateMetadata("design:type", String)], OAuthRefreshToken.prototype, "clientId", void 0);
+__decorate([Column({
+  type: DataType.STRING,
+  allowNull: false
+}), __decorateMetadata("design:type", String)], OAuthRefreshToken.prototype, "subject", void 0);
+__decorate([Column({
+  type: DataType.JSONB,
+  allowNull: false
+}), __decorateMetadata("design:type", Array)], OAuthRefreshToken.prototype, "scopes", void 0);
+__decorate([Column({
+  type: DataType.DATE,
+  allowNull: false
+}), __decorateMetadata("design:type", typeof Date === "undefined" ? Object : Date)], OAuthRefreshToken.prototype, "expiresAt", void 0);
+__decorate([Column({
+  type: DataType.DATE,
+  allowNull: true
+}), __decorateMetadata("design:type", Object)], OAuthRefreshToken.prototype, "consumedAt", void 0);
+OAuthRefreshToken = __decorate([Table({
+  tableName: "oauth_refresh_tokens",
+  modelName: "oauthRefreshToken",
+  indexes: [{
+    fields: ["client_id", "subject"]
+  }, {
+    fields: ["expires_at"]
+  }]
+})], OAuthRefreshToken);
+
+//#endregion
+//#region src/models/index.ts
+/**
+* The OAuth data model, ready to register alongside the application's own
+* models so `ttoss-postgresdb sync` and `erd` cover these tables like any
+* other instead of them being a side-channel schema the CLI cannot see.
+*
+* @example
+* ```typescript
+* import { oauthModels } from '@ttoss/auth-postgresdb';
+* import { initialize } from '@ttoss/postgresdb';
+*
+* export const db = await initialize({ models: { ...oauthModels, User } });
+* ```
+*/
+var oauthModels = {
+  OAuthAuthCode,
+  OAuthClient,
+  OAuthConsent,
+  OAuthRefreshToken
+};
+
+//#endregion
+export { OAuthAuthCode, OAuthClient, OAuthConsent, OAuthRefreshToken, createAuthCodeStore, createClientStore, createConsentStore, createPostgresdbOAuthStores, createRefreshTokenStore, oauthModels };

package/package.json

@@ -0,0 +1,54 @@
+{
+  "name": "@ttoss/auth-postgresdb",
+  "version": "0.1.0",
+  "description": "Durable Postgres OAuth stores and models for @ttoss/auth-core",
+  "keywords": [
+    "auth",
+    "oauth",
+    "postgres",
+    "sequelize",
+    "ttoss"
+  ],
+  "repository": {
+    "type": "git",
+    "url": "https://github.com/ttoss/ttoss.git",
+    "directory": "packages/auth-postgresdb"
+  },
+  "license": "MIT",
+  "author": "ttoss",
+  "contributors": [
+    "Pedro Arantes <pedro@arantespp.com> (https://arantespp.com)"
+  ],
+  "sideEffects": false,
+  "type": "module",
+  "exports": {
+    ".": {
+      "import": "./dist/index.mjs",
+      "require": "./dist/index.cjs",
+      "types": "./dist/index.d.mts"
+    }
+  },
+  "files": [
+    "dist"
+  ],
+  "devDependencies": {
+    "jest": "^30.4.2",
+    "tsdown": "^0.22.2",
+    "@ttoss/config": "^1.37.17",
+    "@ttoss/postgresdb": "^0.11.0",
+    "@ttoss/auth-core": "^0.13.0"
+  },
+  "peerDependencies": {
+    "@ttoss/auth-core": "^0.13.0",
+    "@ttoss/postgresdb": "^0.11.0"
+  },
+  "publishConfig": {
+    "access": "public",
+    "provenance": true
+  },
+  "scripts": {
+    "build": "tsdown",
+    "pretest": "pnpm run build",
+    "test": "jest --projects tests/unit"
+  }
+}