@voltro/plugin-auth-social 0.86.0 → 0.88.0

package/dist/guestHandoff.js

@@ -0,0 +1,60 @@
+import { SocialConfigError as e } from "./errors.js";
+import { isSocialProviderId as t } from "./providers.js";
+import { signAuthClaims as n, verifyAuthClaims as r } from "@voltro/plugin-auth";
+// src/guestHandoff.ts
+var i = (t, r) => {
+	let i = t.profile, a = n({
+		exp: t.exp,
+		audience: t.audience,
+		guest: t.guest,
+		profile: {
+			provider: i.provider,
+			providerAccountId: i.providerAccountId,
+			email: i.email,
+			emailVerified: i.emailVerified,
+			emailIsPrivateRelay: i.emailIsPrivateRelay,
+			firstName: i.firstName,
+			lastName: i.lastName,
+			nameIsFirstAuthorizationOnly: i.nameIsFirstAuthorizationOnly
+		}
+	}, r.current.secret, "social-upgrade");
+	if (a.length > 3400) throw new e("Guest upgrade handoff exceeds its cookie budget");
+	return a;
+}, a = (e) => typeof e == "object" && e && !Array.isArray(e) ? e : null, o = (e) => {
+	let t = a(e), n = a(t?.metadata);
+	return t?.type !== "user" || t.kind !== "guest" || typeof t.id != "string" || !/^guest_[A-Za-z0-9_-]+$/.test(t.id) || typeof t.tenantId != "string" || !t.tenantId.trim() || typeof n?.sessionId != "string" || !n.sessionId || typeof n.guestDeviceId != "string" || !/^gdev_[A-Za-z0-9_-]+$/.test(n.guestDeviceId) || typeof n.guestDeviceGeneration != "number" || !Number.isSafeInteger(n.guestDeviceGeneration) || n.guestDeviceGeneration < 0 ? null : {
+		type: "user",
+		kind: "guest",
+		id: t.id,
+		tenantId: t.tenantId,
+		metadata: {
+			sessionId: n.sessionId,
+			guestDeviceId: n.guestDeviceId,
+			guestDeviceGeneration: n.guestDeviceGeneration
+		}
+	};
+}, s = (e, n, i) => {
+	if (!e || e.length > 3400) return null;
+	let s = [n.current, n.previous].filter((e) => e !== void 0).map((t) => r(e, t.secret, "social-upgrade")).find((e) => e !== null);
+	if (!s || s.audience !== i || typeof s.exp != "number") return null;
+	let c = o(s.guest), l = a(s.profile), u = (e) => e === null || typeof e == "string";
+	return !c || !l || typeof l.provider != "string" || !t(l.provider) || typeof l.providerAccountId != "string" || !l.providerAccountId || !u(l.email) || !u(l.firstName) || !u(l.lastName) || typeof l.emailVerified != "boolean" || typeof l.emailIsPrivateRelay != "boolean" || typeof l.nameIsFirstAuthorizationOnly != "boolean" ? null : {
+		guest: c,
+		exp: s.exp,
+		audience: i,
+		profile: {
+			provider: l.provider,
+			providerAccountId: l.providerAccountId,
+			email: l.email,
+			emailVerified: l.emailVerified,
+			emailIsPrivateRelay: l.emailIsPrivateRelay,
+			firstName: l.firstName,
+			lastName: l.lastName,
+			nameIsFirstAuthorizationOnly: l.nameIsFirstAuthorizationOnly,
+			name: null,
+			avatarUrl: null,
+			raw: {}
+		}
+	};
+};
+export { s as decodeGuestUpgradeHandoff, i as encodeGuestUpgradeHandoff, o as guestIdentityOf };

package/dist/guestUpgrade.js

@@ -0,0 +1,96 @@
+import { SOCIAL_IDENTITY_TABLE as e, dataStoreSocialIdentityStore as t } from "./identityStore.js";
+import { Effect as n } from "effect";
+import { and as r, eq as i } from "@voltro/database";
+import { GuestAuthError as a, dataStoreGuestAuth as o, dataStoreSessionRegistry as s, issueUserSession as c, runSubjectGuards as l } from "@voltro/plugin-auth";
+// src/guestUpgrade.ts
+var u = (e, t, n) => ({
+	table: e,
+	predicate: i(t, n),
+	order: [],
+	take: void 0,
+	skip: void 0,
+	projection: void 0
+}), d = (d) => {
+	if (d.config.defaultTenantId !== d.guest.tenantId || d.config.ensureActor !== void 0 && d.configForTransaction === void 0) return n.succeed({
+		kind: "refused",
+		status: 500,
+		code: "config",
+		message: "Guest upgrade requires a matching tenant and transaction-bound actor hooks."
+	});
+	let f = d.profile, p = f.email === null || f.email.length === 0 ? null : f.email;
+	return (d.service ?? o(d.store, d.guest)).upgrade(d.credential, async (o) => {
+		let m = o.store, h = t(m);
+		if (await n.runPromise(h.findByProviderAccount(f.provider, f.providerAccountId)) !== null || p !== null && (await m.query(u("users", "email", p))).length !== 0) throw new a({ code: "upgrade_conflict" });
+		let g = {
+			id: o.subjectId,
+			tenantId: o.tenantId,
+			email: p,
+			passwordHash: null,
+			createdAt: o.createdAt,
+			mfaSecret: null,
+			mfaEnrolledAt: null,
+			emailVerifiedAt: p !== null && f.emailVerified ? /* @__PURE__ */ new Date() : null
+		}, _ = d.configForTransaction?.(m) ?? d.config;
+		if (_.defaultTenantId !== o.tenantId || !(await n.runPromise(l(_.subjectGuards ?? [], g))).ok) throw new a({ code: "credential_rejected" });
+		if (await m.insert("users", {
+			...g,
+			updatedAt: /* @__PURE__ */ new Date()
+		}), !await n.runPromise(h.insert({
+			userId: g.id,
+			provider: f.provider,
+			providerAccountId: f.providerAccountId,
+			email: p,
+			emailVerified: p !== null && f.emailVerified
+		}).pipe(n.as(!0), n.catchTag("SocialIdentityConflict", () => n.succeed(!1))))) throw new a({ code: "upgrade_conflict" });
+		let v = {
+			...d.users,
+			...s(m),
+			listMemberships: (e) => n.promise(async () => (await m.query({
+				...u("memberships", "userId", e),
+				predicate: r(i("userId", e), i("tenantId", o.tenantId))
+			})).map((t) => {
+				if (t.userId !== e || t.tenantId !== o.tenantId || typeof t.role != "string") throw new a({ code: "store_unavailable" });
+				let n = t.joinedAt instanceof Date ? t.joinedAt : new Date(String(t.joinedAt));
+				if (!Number.isFinite(n.getTime())) throw new a({ code: "store_unavailable" });
+				return {
+					userId: e,
+					tenantId: o.tenantId,
+					role: t.role,
+					joinedAt: n
+				};
+			}))
+		}, y = await n.runPromise(c(g, v, _, {
+			clearLoginFailures: !1,
+			ipAddress: d.ipAddress ?? null,
+			userAgent: d.userAgent ?? null
+		})), b = y.subject.type === "user" ? y.subject.metadata?.sessionId : null;
+		if (typeof b != "string" || (await m.query(u("sessions", "id", b))).length !== 1) throw new a({ code: "store_unavailable" });
+		let x = (await m.query({
+			...u(e, "provider", f.provider),
+			predicate: r(i("provider", f.provider), i("providerAccountId", f.providerAccountId))
+		}))[0];
+		if (!x || x.provider !== f.provider || x.providerAccountId !== f.providerAccountId || x.userId !== g.id) throw new a({ code: "upgrade_conflict" });
+		return {
+			kind: "ok",
+			userId: g.id,
+			subject: y.subject,
+			setCookie: y.setCookie,
+			session: {
+				value: y.value,
+				expiresAt: y.expiresAt
+			},
+			created: !0,
+			linked: !0,
+			oneTimeName: f.nameIsFirstAuthorizationOnly ? {
+				firstName: f.firstName,
+				lastName: f.lastName
+			} : null
+		};
+	}).pipe(n.catch((e) => n.succeed({
+		kind: "refused",
+		status: e.code === "upgrade_conflict" ? 409 : e.code === "credential_rejected" ? 403 : 503,
+		code: e.code === "upgrade_conflict" ? "account_merge_required" : e.code,
+		message: e.code === "upgrade_conflict" ? "The provider or email belongs to an existing account. Confirm both accounts before merging." : e.code === "credential_rejected" ? "Guest upgrade was refused." : "Guest upgrade storage is unavailable."
+	})));
+};
+export { d as completeGuestSocialUpgrade };

package/dist/identityStore.js

@@ -1,104 +1,123 @@
-import { Effect as e } from "effect";
-import { and as t, boolean as n, eq as r, generateId as i, id as a, table as o, text as s, timestamp as c } from "@voltro/database";
-//#region src/identityStore.ts
-var l = "_voltro_oauth_identities", u = o(l, {
-	id: a({ prefix: "oauthid" }),
-	userId: s(),
-	provider: s(),
-	providerAccountId: s(),
-	email: s().nullable(),
-	emailVerified: n().default(!1),
-	createdAt: c().default("now"),
-	lastLoginAt: c().nullable()
-}).unique("byOauthProviderAccount", ["provider", "providerAccountId"]).index(["userId"]), d = [u], f = () => i({
+import { Data as e, Effect as t } from "effect";
+import { and as n, boolean as r, classifyConstraintViolation as i, eq as a, extractDbCause as o, generateId as s, id as c, table as l, text as u, timestamp as d } from "@voltro/database";
+// src/identityStore.ts
+var f = "_voltro_oauth_identities", p = l(f, {
+	id: c({ prefix: "oauthid" }),
+	userId: u(),
+	provider: u(),
+	providerAccountId: u(),
+	email: u().nullable(),
+	emailVerified: r().default(!1),
+	createdAt: d().default("now"),
+	lastLoginAt: d().nullable()
+}).unique("byOauthProviderAccount", ["provider", "providerAccountId"]).index(["userId"]), m = [p], h = class extends e.TaggedError("SocialIdentityConflict") {}, g = (e) => typeof e == "object" && !!e && e._tag === "ConstraintViolation" && e.kind === "unique" || i(o(e), "insert")?.kind === "unique", _ = () => s({
 	kind: "typeid",
 	prefix: "oauthid"
-}, "oauthid"), p = (t = []) => {
-	let n = [...t];
+}, "oauthid"), v = (e = []) => {
+	let n = [...e];
 	return {
-		findByProviderAccount: (t, r) => e.sync(() => n.find((e) => e.provider === t && e.providerAccountId === r) ?? null),
-		listForUser: (t) => e.sync(() => n.filter((e) => e.userId === t)),
-		insert: (t) => e.sync(() => {
-			let e = {
-				...t,
-				id: f(),
+		findByProviderAccount: (e, r) => t.sync(() => n.find((t) => t.provider === e && t.providerAccountId === r) ?? null),
+		listForUser: (e) => t.sync(() => n.filter((t) => t.userId === e)),
+		insert: (e) => n.some((t) => t.provider === e.provider && t.providerAccountId === e.providerAccountId) ? t.fail(new h({ provider: e.provider })) : t.sync(() => {
+			let t = {
+				...e,
+				id: _(),
 				createdAt: /* @__PURE__ */ new Date(),
 				lastLoginAt: null
 			};
-			return n.push(e), e;
+			return n.push(t), t;
 		}),
-		touch: (t, r) => e.sync(() => {
-			let e = n.findIndex((e) => e.id === t);
-			e >= 0 && (n[e] = {
-				...n[e],
+		touch: (e, r) => t.sync(() => {
+			let t = n.findIndex((t) => t.id === e);
+			t >= 0 && (n[t] = {
+				...n[t],
 				lastLoginAt: r
 			});
 		}),
-		remove: (t, r) => e.sync(() => {
-			let e = n.findIndex((e) => e.userId === t && e.provider === r);
-			return e < 0 ? !1 : (n.splice(e, 1), !0);
+		remove: (e, r) => t.sync(() => {
+			let t = n.findIndex((t) => t.userId === e && t.provider === r);
+			return t < 0 ? !1 : (n.splice(t, 1), !0);
 		})
 	};
-}, m = (e) => {
+}, y = (e) => {
 	if (e instanceof Date) return e;
 	if (typeof e == "string" || typeof e == "number") {
 		let t = new Date(e);
 		return Number.isNaN(t.getTime()) ? null : t;
 	}
 	return null;
-}, h = (e) => ({
+}, b = (e) => ({
 	id: String(e.id ?? ""),
 	userId: String(e.userId ?? ""),
 	provider: String(e.provider ?? ""),
 	providerAccountId: String(e.providerAccountId ?? ""),
 	email: typeof e.email == "string" && e.email.length > 0 ? e.email : null,
 	emailVerified: e.emailVerified === !0 || e.emailVerified === 1,
-	createdAt: m(e.createdAt) ?? /* @__PURE__ */ new Date(0),
-	lastLoginAt: m(e.lastLoginAt)
-}), g = (n) => ({
-	findByProviderAccount: (i, a) => e.promise(async () => {
-		let e = (await n.query({
-			table: l,
-			predicate: t(r("provider", i), r("providerAccountId", a)),
-			limit: 1
+	createdAt: y(e.createdAt) ?? /* @__PURE__ */ new Date(0),
+	lastLoginAt: y(e.lastLoginAt)
+}), x = (e) => ({
+	findByProviderAccount: (r, i) => t.promise(async () => {
+		let t = (await e.query({
+			table: f,
+			predicate: n(a("provider", r), a("providerAccountId", i)),
+			limit: 1,
+			take: 1,
+			skip: void 0,
+			projection: void 0,
+			order: []
 		}))[0];
-		return e ? h(e) : null;
+		return t ? b(t) : null;
 	}),
-	listForUser: (t) => e.promise(async () => (await n.query({
-		table: l,
-		predicate: r("userId", t),
+	listForUser: (n) => t.promise(async () => (await e.query({
+		table: f,
+		predicate: a("userId", n),
 		order: [{
 			column: "createdAt",
 			direction: "asc"
-		}]
-	})).map(h)),
-	insert: (t) => e.promise(async () => h(await n.insert(l, {
-		id: f(),
-		userId: t.userId,
-		provider: t.provider,
-		providerAccountId: t.providerAccountId,
-		email: t.email,
-		emailVerified: t.emailVerified,
-		createdAt: /* @__PURE__ */ new Date(),
-		lastLoginAt: null
-	}))),
-	touch: (t, r) => e.promise(async () => {
-		await n.update(l, t, { lastLoginAt: r });
+		}],
+		take: void 0,
+		skip: void 0,
+		projection: void 0
+	})).map(b)),
+	insert: (n) => t.tryPromise({
+		try: async () => {
+			let t = {
+				id: _(),
+				userId: n.userId,
+				provider: n.provider,
+				providerAccountId: n.providerAccountId,
+				email: n.email,
+				emailVerified: n.emailVerified,
+				createdAt: /* @__PURE__ */ new Date(),
+				lastLoginAt: null
+			};
+			if (!("insertIgnoreWithOutcome" in e) || e.insertIgnoreWithOutcome === void 0) return b(await e.insert(f, t));
+			let r = await e.insertIgnoreWithOutcome(f, t, { conflictColumns: ["provider", "providerAccountId"] });
+			if (r.outcome === "ignored") throw new h({ provider: n.provider });
+			return b(r.row);
+		},
+		catch: (e) => e
+	}).pipe(t.catch((e) => e instanceof h || g(e) ? t.fail(new h({ provider: n.provider })) : t.die(e))),
+	touch: (n, r) => t.promise(async () => {
+		await e.update(f, n, { lastLoginAt: r });
 	}),
-	remove: (i, a) => e.promise(async () => {
-		let e = (await n.query({
-			table: l,
-			predicate: t(r("userId", i), r("provider", a)),
-			limit: 1
+	remove: (r, i) => t.promise(async () => {
+		let t = (await e.query({
+			table: f,
+			predicate: n(a("userId", r), a("provider", i)),
+			limit: 1,
+			take: 1,
+			skip: void 0,
+			projection: void 0,
+			order: []
 		}))[0];
-		return e ? n.delete(l, String(e.id ?? "")) : !1;
+		return t ? e.delete(f, String(t.id ?? "")) : !1;
 	})
-}), _ = (t, n, r) => e.gen(function* () {
-	let i = yield* t.findByProviderAccount(r.provider, r.providerAccountId);
-	return i ? i.userId === n ? i : yield* e.fail(/* @__PURE__ */ Error(`linkSocialIdentity: this ${r.provider} account is already linked to another user`)) : yield* t.insert({
+}), S = (e, n, r) => t.gen(function* () {
+	let i = yield* e.findByProviderAccount(r.provider, r.providerAccountId);
+	return i ? i.userId === n ? i : yield* t.fail(/* @__PURE__ */ Error(`linkSocialIdentity: this ${r.provider} account is already linked to another user`)) : yield* e.insert({
 		...r,
 		userId: n
 	});
 });
-//#endregion
-export { l as SOCIAL_IDENTITY_TABLE, g as dataStoreSocialIdentityStore, _ as linkSocialIdentity, p as memorySocialIdentityStore, d as socialAuthTables, u as socialIdentitiesTable };
+export { f as SOCIAL_IDENTITY_TABLE, h as SocialIdentityConflict, x as dataStoreSocialIdentityStore, S as linkSocialIdentity, v as memorySocialIdentityStore, m as socialAuthTables, p as socialIdentitiesTable };