ajo-kit-auth 0.1.0

package/dist/index.js

@@ -0,0 +1,629 @@
+import { all, can, compact, intersect, merge } from "./ability.js";
+import { Denied, Failure, Forbidden, ajax, api, origin } from "ajo-kit";
+import { createHash, createHmac, randomBytes, timingSafeEqual } from "node:crypto";
+import { sql } from "ajo-kit/database";
+import { createRequire } from "node:module";
+//#region \0rolldown/runtime.js
+var __defProp = Object.defineProperty;
+var __exportAll = (all, no_symbols) => {
+	let target = {};
+	for (var name in all) __defProp(target, name, {
+		get: all[name],
+		enumerable: true
+	});
+	if (!no_symbols) __defProp(target, Symbol.toStringTag, { value: "Module" });
+	return target;
+};
+//#endregion
+//#region packages/ajo-kit-auth/src/confirm.ts
+var confirm_exports = /* @__PURE__ */ __exportAll({
+	check: () => check$1,
+	clear: () => clear$2,
+	clearSession: () => clearSession,
+	clearToken: () => clearToken,
+	clearUser: () => clearUser,
+	credential: () => credential,
+	stamp: () => stamp$1
+});
+var stamps = /* @__PURE__ */ new Map();
+var key = (user, kind, id) => `${kind}:${user}:${id}`;
+var segment = (user) => `:${user}:`;
+/** Returns the current session/token confirmation key for a request. */
+function credential(req) {
+	if (!req.user) return null;
+	if (req.token) return key(req.user.id, "token", req.token.id);
+	if (req.session) return key(req.user.id, "session", req.session.id);
+	return null;
+}
+/** Stamps the current credential as recently password-confirmed. */
+function stamp$1(req) {
+	const id = credential(req);
+	if (!id) return false;
+	stamps.set(id, Date.now());
+	return true;
+}
+/** Returns true when the current credential was confirmed recently. */
+function check$1(req, window = 18e4) {
+	const id = credential(req);
+	if (!id) return false;
+	const at = stamps.get(id);
+	if (!at) return false;
+	return Date.now() - at < window;
+}
+/** Clears the confirmation stamp for the current credential. */
+function clear$2(req) {
+	const id = credential(req);
+	if (id) stamps.delete(id);
+}
+/** Clears the confirmation stamp for a specific session. */
+function clearSession(user, id) {
+	stamps.delete(key(user, "session", id));
+}
+/** Clears the confirmation stamp for a specific bearer token. */
+function clearToken(user, id) {
+	stamps.delete(key(user, "token", id));
+}
+/** Clears every confirmation stamp for a user. */
+function clearUser(user) {
+	for (const id of stamps.keys()) if (id.includes(segment(user))) stamps.delete(id);
+}
+//#endregion
+//#region packages/ajo-kit-auth/src/store.ts
+var accessor = null;
+/** Sets the Kysely accessor used by auth helpers. */
+var configure = (fn) => {
+	accessor = fn;
+};
+/** Returns the configured auth Kysely instance or throws if missing. */
+var db = () => {
+	if (!accessor) throw new Error("Auth database not configured. Call configure() from ajo-kit-auth.");
+	return accessor();
+};
+//#endregion
+//#region packages/ajo-kit-auth/src/guard.ts
+var guard_exports = /* @__PURE__ */ __exportAll({
+	ability: () => ability,
+	auth: () => auth,
+	authorize: () => authorize,
+	confirmed: () => confirmed,
+	guest: () => guest,
+	protect: () => protect,
+	redirect: () => redirect,
+	verified: () => verified,
+	when: () => when
+});
+/** Redirects HTML requests or returns a JSON redirect envelope for AJAX. */
+var redirect = (to) => (req, res) => {
+	const target = typeof to === "function" ? to(req) : to;
+	const json = ajax(req);
+	res.writeHead(json ? 200 : 302, json ? {
+		"Content-Type": "application/json",
+		"Cache-Control": "no-store"
+	} : { Location: target });
+	res.end(json ? JSON.stringify({ redirect: target }) : void 0);
+};
+/** Runs middleware only when a request condition matches. */
+var when = (condition, middleware, otherwise) => (req, res, next) => {
+	if (condition(req, res)) return middleware(req, res, next);
+	if (otherwise) return otherwise(req, res, next);
+	next();
+};
+/** Requires an authenticated request user. */
+var auth = () => (req, _, next) => {
+	if (!req.user) throw new Denied();
+	next();
+};
+/** Redirects guests away from protected browser routes. */
+var protect = (to = "/login") => when((req) => !req.user, redirect(to));
+/** Redirects authenticated users away from guest-only routes. */
+var guest = (to = "/dashboard") => when((req) => !!req.user, redirect(to));
+/** Throws when the current account or bearer token lacks required abilities. */
+function authorize(req, ...required) {
+	if (!req.user) throw new Denied();
+	const abilities = req.user.abilities ?? [];
+	const missing = required.find((ability) => !can(abilities, ability)) ?? (req.token ? required.find((ability) => !can(req.token.abilities, ability)) : void 0);
+	if (missing) throw new Forbidden(`Missing ability: ${missing}`);
+}
+/** Middleware variant of authorize() for route stacks. */
+var ability = (...required) => (req, _, next) => {
+	authorize(req, ...required);
+	next();
+};
+/** Requires recent password confirmation for the current credential. */
+var confirmed = (window) => (req, res, next) => {
+	if (!req.user || !credential(req)) throw new Denied();
+	if (!check$1(req, window)) return redirect(`/confirm?redirect=${encodeURIComponent(req.originalUrl)}`)(req, res, next);
+	next();
+};
+/** Requires the authenticated user to have a verified timestamp. */
+var verified = () => async (req, res, next) => {
+	if (!req.user) throw new Denied();
+	if (!(await db().selectFrom("users").select(["verified"]).where("id", "=", req.user.id).executeTakeFirst())?.verified) {
+		if (ajax(req)) throw new Failure(403, "Email verification required");
+		return redirect("/verify")(req, res, next);
+	}
+	next();
+};
+//#endregion
+//#region packages/ajo-kit-auth/src/account.ts
+var account_exports = /* @__PURE__ */ __exportAll({
+	abilities: () => abilities,
+	grants: () => grants
+});
+function parse$1(value) {
+	try {
+		const abilities = JSON.parse(value);
+		return Array.isArray(abilities) && abilities.every((ability) => typeof ability === "string") ? abilities : [];
+	} catch {
+		return [];
+	}
+}
+/** Loads role ability bundles for an auth user. */
+async function grants(user) {
+	return (await db().selectFrom("members").innerJoin("roles", "roles.id", "members.role").select(["roles.name", "roles.abilities"]).where("members.user", "=", user).orderBy("roles.id").execute()).map((role) => ({
+		name: role.name,
+		abilities: parse$1(role.abilities)
+	}));
+}
+/** Resolves the effective account abilities from all assigned roles. */
+async function abilities(user) {
+	return merge(...(await grants(user)).map((role) => role.abilities));
+}
+//#endregion
+//#region packages/ajo-kit-auth/src/cookie.ts
+var cookie_exports = /* @__PURE__ */ __exportAll({
+	clear: () => clear$1,
+	parse: () => parse,
+	read: () => read,
+	write: () => write
+});
+var name = "session";
+var secure$1 = () => process.env.NODE_ENV === "production" ? "; Secure" : "";
+var base = () => `HttpOnly; SameSite=Lax; Path=/${secure$1()}`;
+/** Reads one cookie by exact name and rejects duplicates. */
+var parse = (header, key) => {
+	let value;
+	for (const part of header?.split(";") ?? []) {
+		const trimmed = part.trim();
+		const index = trimmed.indexOf("=");
+		if (index === -1) continue;
+		if (trimmed.slice(0, index) !== key) continue;
+		if (value !== void 0) return;
+		value = trimmed.slice(index + 1);
+	}
+	return value;
+};
+/** Reads the session cookie from a request. */
+var read = (req) => parse(req.headers.cookie, name);
+/** Writes the session cookie to a response. */
+var write = (res, value, remember = false) => {
+	const age = remember ? 31536e3 : 2592e3;
+	res.setHeader("Set-Cookie", `${name}=${value}; ${base()}; Max-Age=${age}`);
+};
+/** Clears the session cookie on a response. */
+var clear$1 = (res) => res.setHeader("Set-Cookie", `${name}=; ${base()}; Max-Age=0`);
+//#endregion
+//#region packages/ajo-kit-auth/src/session.ts
+var session_exports = /* @__PURE__ */ __exportAll({
+	create: () => create$2,
+	generate: () => generate,
+	hash: () => hash$3,
+	prune: () => prune$2,
+	remove: () => remove,
+	touch: () => touch,
+	validate: () => validate$3
+});
+var minute = 60 * 1e3;
+var day = 1440 * 60 * 1e3;
+var idle = 30 * minute;
+var pace = 5 * minute;
+function stamp(now = Date.now()) {
+	return new Date(now).toISOString();
+}
+function time(value) {
+	const parsed = value ? Date.parse(value) : NaN;
+	return Number.isFinite(parsed) ? parsed : 0;
+}
+function age(session, now) {
+	return now - time(session.last ?? session.created);
+}
+function expired(session, now) {
+	return time(session.expiry) <= now || age(session, now) > idle;
+}
+function stale(session, now) {
+	return age(session, now) > pace;
+}
+function cutoff(now = Date.now()) {
+	return stamp(now - idle);
+}
+function drop(id) {
+	return db().deleteFrom("sessions").where("id", "=", id).execute();
+}
+function mark(id, last = stamp()) {
+	return db().updateTable("sessions").set({ last }).where("id", "=", id).execute();
+}
+/** Generates a random plaintext credential value. */
+function generate() {
+	return randomBytes(32).toString("base64url");
+}
+/** Hashes a plaintext session credential for database storage. */
+function hash$3(plain) {
+	return createHash("sha256").update(plain).digest("hex");
+}
+/** Creates a cookie session and returns its plaintext credential. */
+var create$2 = async (user, remember = false, ip, agent) => {
+	const plain = generate();
+	const id = hash$3(plain);
+	const lifetime = remember ? 365 : 30;
+	const now = Date.now();
+	const expiry = stamp(now + lifetime * day);
+	const last = stamp(now);
+	await db().insertInto("sessions").values({
+		id,
+		user,
+		expiry,
+		ip: ip ?? null,
+		agent: agent ?? null,
+		last
+	}).execute();
+	return plain;
+};
+/**
+* Resolves a session credential, enforcing expiry and throttled activity touch.
+*
+* Pass `activity = false` for background checks that must not renew activity.
+*/
+var validate$3 = async (plain, activity = true) => {
+	const id = hash$3(plain);
+	const session = await db().selectFrom("sessions").select([
+		"id",
+		"user",
+		"expiry",
+		"last",
+		"created"
+	]).where("id", "=", id).executeTakeFirst();
+	if (!session) return null;
+	const now = Date.now();
+	if (expired(session, now)) {
+		await drop(id);
+		return null;
+	}
+	if (activity && stale(session, now)) {
+		const last = stamp(now);
+		await mark(id, last);
+		return {
+			...session,
+			last
+		};
+	}
+	return session;
+};
+/** Deletes the session matching a plaintext credential. */
+var remove = (plain) => drop(hash$3(plain));
+/** Updates the last-seen timestamp for a session credential. */
+var touch = (plain) => mark(hash$3(plain));
+/** Deletes sessions past their absolute or idle timeout. */
+var prune$2 = () => {
+	const now = Date.now();
+	return db().deleteFrom("sessions").where((eb) => eb.or([eb("expiry", "<=", stamp(now)), sql`unixepoch(coalesce(last, created)) <= unixepoch(${cutoff(now)})`])).execute();
+};
+//#endregion
+//#region packages/ajo-kit-auth/src/secret.ts
+var fallback = "change-in-production";
+var minimum = 32;
+var samples = new Set([fallback, "your-secret-key"]);
+var production = () => process.env.NODE_ENV === "production";
+/** Returns the app signing secret and fails closed in production. */
+var value = () => {
+	const secret = process.env.APP_SECRET?.trim() ? process.env.APP_SECRET : void 0;
+	if (production() && (!secret || secret.length < minimum || samples.has(secret))) {
+		const message = "APP_SECRET must be set to a strong production secret";
+		console.error(`[security] ${message}`);
+		throw new Error(message);
+	}
+	return secret ?? fallback;
+};
+//#endregion
+//#region packages/ajo-kit-auth/src/csrf.ts
+var csrf_exports = /* @__PURE__ */ __exportAll({
+	set: () => set,
+	verify: () => verify$1
+});
+var NAME = "XSRF-TOKEN";
+var secure = () => process.env.NODE_ENV === "production" ? "; Secure" : "";
+var sign$1 = (session, token) => createHmac("sha256", value()).update(`${session}:${token}`).digest("hex");
+var equal = (left, right) => {
+	const a = Buffer.from(left, "hex");
+	const b = Buffer.from(right, "hex");
+	return a.length === b.length && timingSafeEqual(a, b);
+};
+var seal = (session) => {
+	const token = generate();
+	return `${token}.${sign$1(session, token)}`;
+};
+var signed = (req, token) => {
+	if (!req.session) return false;
+	const parts = token.split(".");
+	if (parts.length !== 2) return false;
+	const [plain, mac] = parts;
+	if (!plain || !mac) return false;
+	return equal(mac, sign$1(req.session.id, plain));
+};
+/** Sets a readable session-bound XSRF cookie and returns its token. */
+function set(req, res) {
+	if (!req.session) throw new Error("CSRF token requires a session");
+	const token = seal(req.session.id);
+	res.setHeader("Set-Cookie", `${NAME}=${token}; Path=/; SameSite=Lax${secure()}`);
+	return token;
+}
+/** Validates signed session-bound CSRF or same-origin proof. */
+function verify$1(req) {
+	const cookie = parse(req.headers.cookie, NAME);
+	const header = req.headers["x-xsrf-token"];
+	if (cookie && cookie === header && signed(req, header)) return true;
+	const source = req.headers.origin;
+	const referer = req.headers.referer;
+	if (!source && !referer) return false;
+	const base = origin(req);
+	if (source) try {
+		if (new URL(source).origin === base) return true;
+	} catch {}
+	if (referer) try {
+		if (new URL(referer).origin === base) return true;
+	} catch {}
+	return false;
+}
+//#endregion
+//#region packages/ajo-kit-auth/src/limit.ts
+var limit_exports = /* @__PURE__ */ __exportAll({
+	check: () => check,
+	clear: () => clear,
+	hit: () => hit,
+	remaining: () => remaining
+});
+var store = /* @__PURE__ */ new Map();
+/** Returns true when a key is still under the hit limit. */
+function check(key, max = 5) {
+	const entry = store.get(key);
+	if (!entry || Date.now() > entry.reset) return true;
+	return entry.count < max;
+}
+/** Records one hit for a key within the current window. */
+function hit(key, window = 6e4) {
+	const entry = store.get(key);
+	const now = Date.now();
+	if (!entry || now > entry.reset) store.set(key, {
+		count: 1,
+		reset: now + window
+	});
+	else entry.count++;
+}
+/** Clears all hits for a key. */
+function clear(key) {
+	store.delete(key);
+}
+/** Returns remaining hits before a key reaches the limit. */
+function remaining(key, max = 5) {
+	const entry = store.get(key);
+	if (!entry || Date.now() > entry.reset) return max;
+	return Math.max(0, max - entry.count);
+}
+//#endregion
+//#region packages/ajo-kit-auth/src/password.ts
+var password_exports = /* @__PURE__ */ __exportAll({
+	hash: () => hash$2,
+	verify: () => verify
+});
+var argon2 = createRequire(import.meta.resolve("ajo-kit-auth"))("argon2");
+var options = {
+	type: argon2.argon2id,
+	memoryCost: 19456,
+	timeCost: 2,
+	parallelism: 1
+};
+/** Hashes a plaintext password with Argon2id. */
+var hash$2 = (plain) => argon2.hash(plain, options);
+/** Verifies a plaintext password against an Argon2 hash. */
+var verify = (plain, hashed) => argon2.verify(hashed, plain);
+//#endregion
+//#region packages/ajo-kit-auth/src/reset.ts
+var reset_exports = /* @__PURE__ */ __exportAll({
+	create: () => create$1,
+	prune: () => prune$1,
+	validate: () => validate$2
+});
+var hash$1 = (plain) => createHash("sha256").update(plain).digest("hex");
+var hours$1 = 1;
+/** Creates a password reset token and returns its plaintext value. */
+async function create$1(user) {
+	await db().deleteFrom("resets").where("user", "=", user).execute();
+	const plain = generate();
+	const id = hash$1(plain);
+	const expiry = new Date(Date.now() + hours$1 * 60 * 60 * 1e3).toISOString();
+	await db().insertInto("resets").values({
+		id,
+		user,
+		expiry
+	}).execute();
+	return plain;
+}
+/** Resolves a plaintext reset token to its user id when active. */
+async function validate$2(plain) {
+	const id = hash$1(plain);
+	const reset = await db().selectFrom("resets").select(["user", "expiry"]).where("id", "=", id).executeTakeFirst();
+	if (!reset || new Date(reset.expiry) < /* @__PURE__ */ new Date()) return null;
+	return reset.user;
+}
+/** Deletes expired password reset tokens. */
+function prune$1() {
+	return db().deleteFrom("resets").where("expiry", "<", (/* @__PURE__ */ new Date()).toISOString()).execute();
+}
+//#endregion
+//#region packages/ajo-kit-auth/src/token.ts
+var token_exports = /* @__PURE__ */ __exportAll({
+	create: () => create,
+	list: () => list,
+	prune: () => prune,
+	purge: () => purge,
+	revoke: () => revoke,
+	validate: () => validate$1
+});
+var hash = (plain) => createHash("sha256").update(plain).digest("hex");
+/** Creates an API token and returns its plaintext credential once. */
+async function create(user, name, abilities, ttl = 2160 * 60 * 60 * 1e3) {
+	const plain = generate();
+	const id = hash(plain);
+	const expiry = ttl ? new Date(Date.now() + ttl).toISOString() : null;
+	await db().insertInto("tokens").values({
+		id,
+		user,
+		name,
+		abilities: JSON.stringify(abilities),
+		last: null,
+		expiry
+	}).execute();
+	return plain;
+}
+/** Resolves a plaintext API token to its stored bearer identity. */
+async function validate$1(plain) {
+	const id = hash(plain);
+	const token = await db().selectFrom("tokens").select([
+		"id",
+		"user",
+		"abilities",
+		"expiry"
+	]).where("id", "=", id).executeTakeFirst();
+	if (!token) return null;
+	if (token.expiry && new Date(token.expiry) < /* @__PURE__ */ new Date()) {
+		await db().deleteFrom("tokens").where("id", "=", id).execute();
+		return null;
+	}
+	await db().updateTable("tokens").set({ last: (/* @__PURE__ */ new Date()).toISOString() }).where("id", "=", id).execute();
+	return {
+		...token,
+		abilities: JSON.parse(token.abilities)
+	};
+}
+/** Deletes the API token matching a plaintext credential. */
+var revoke = (plain) => db().deleteFrom("tokens").where("id", "=", hash(plain)).execute();
+/** Deletes every API token owned by a user. */
+var purge = (user) => db().deleteFrom("tokens").where("user", "=", user).execute();
+/** Lists stored API tokens for a user without plaintext secrets. */
+var list = (user) => db().selectFrom("tokens").select([
+	"id",
+	"name",
+	"abilities",
+	"last",
+	"expiry",
+	"created"
+]).where("user", "=", user).execute();
+/** Deletes expired API tokens. */
+var prune = () => db().deleteFrom("tokens").where("expiry", "<", (/* @__PURE__ */ new Date()).toISOString()).execute();
+//#endregion
+//#region packages/ajo-kit-auth/src/verify.ts
+var verify_exports = /* @__PURE__ */ __exportAll({
+	sign: () => sign,
+	url: () => url,
+	validate: () => validate
+});
+var hours = 24;
+/** Signs a user id into a time-limited email verification signature. */
+function sign(user) {
+	const data = `${user}:${Date.now() + hours * 60 * 60 * 1e3}`;
+	const sig = createHmac("sha256", value()).update(data).digest("hex");
+	return Buffer.from(`${data}:${sig}`).toString("base64url");
+}
+/** Validates an email verification signature and returns its user id. */
+function validate(signature) {
+	const key = value();
+	try {
+		const [user, expiry, sig] = Buffer.from(signature, "base64url").toString().split(":");
+		if (Date.now() > Number(expiry)) return null;
+		const expected = createHmac("sha256", key).update(`${user}:${expiry}`).digest("hex");
+		if (!timingSafeEqual(Buffer.from(sig, "hex"), Buffer.from(expected, "hex"))) return null;
+		return Number(user);
+	} catch {
+		return null;
+	}
+}
+/** Builds an absolute email verification URL for a user. */
+function url(user, base) {
+	return `${base}/verify/${sign(user)}`;
+}
+//#endregion
+//#region packages/ajo-kit-auth/src/wares.ts
+var wares_exports = /* @__PURE__ */ __exportAll({
+	csrf: () => csrf,
+	session: () => session
+});
+async function resolve(id) {
+	const user = await db().selectFrom("users").select([
+		"id",
+		"name",
+		"email",
+		"verified"
+	]).where("id", "=", id).executeTakeFirst();
+	if (!user) return null;
+	const roles = await grants(user.id);
+	return {
+		...user,
+		roles: roles.map((r) => r.name),
+		abilities: merge(...roles.map((r) => r.abilities))
+	};
+}
+var reset = (req) => {
+	delete req.user;
+	delete req.session;
+	delete req.token;
+};
+/** Authenticates requests from bearer API tokens or session cookies. */
+function session(lookup) {
+	const find = lookup ?? resolve;
+	return async (req, res, next) => {
+		reset(req);
+		const auth = req.headers.authorization;
+		if (api(req) && auth?.startsWith("Bearer ")) {
+			const authz = await validate$1(auth.slice(7));
+			if (authz) {
+				const user = await find(authz.user);
+				if (user) {
+					req.user = user;
+					req.token = {
+						id: authz.id,
+						abilities: authz.abilities
+					};
+				}
+			}
+			return next();
+		}
+		const cookie = read(req);
+		if (cookie) {
+			const valid = await validate$3(cookie, req.headers.accept !== "text/event-stream");
+			if (valid) {
+				const user = await find(valid.user);
+				if (user) {
+					req.user = user;
+					req.session = { id: valid.id };
+					return next();
+				}
+			}
+			clear$1(res);
+			return next();
+		}
+		next();
+	};
+}
+/** Rejects unsafe cookie-auth requests without CSRF proof. */
+var csrf = (req, _, next) => {
+	if (req.token) return next();
+	if ([
+		"GET",
+		"HEAD",
+		"OPTIONS"
+	].includes(req.method)) return next();
+	if (api(req) && !req.user) return next();
+	if (!verify$1(req)) throw new Forbidden("Invalid CSRF token");
+	next();
+};
+//#endregion
+export { ability, account_exports as account, all, auth, authorize, can, compact, configure, confirm_exports as confirm, confirmed, cookie_exports as cookie, csrf_exports as csrf, guard_exports as guard, guest, intersect, limit_exports as limit, merge, password_exports as password, protect, redirect, reset_exports as reset, session_exports as session, token_exports as token, verified, verify_exports as verify, wares_exports as wares, when };

package/dist/migrations/0001_initial.js

@@ -0,0 +1,28 @@
+import { sql } from "ajo-kit/database";
+//#region packages/ajo-kit-auth/migrations/0001_initial.ts
+async function up(db) {
+	await db.schema.createTable("users").addColumn("id", "integer", (c) => c.primaryKey()).addColumn("name", "text", (c) => c.notNull().defaultTo("")).addColumn("email", "text", (c) => c.notNull().unique()).addColumn("password", "text").addColumn("verified", "text").addColumn("created", "text", (c) => c.defaultTo(sql`CURRENT_TIMESTAMP`)).addColumn("updated", "text").execute();
+	await db.schema.createTable("sessions").addColumn("id", "text", (c) => c.primaryKey()).addColumn("user", "integer", (c) => c.notNull().references("users.id").onDelete("cascade")).addColumn("expiry", "text", (c) => c.notNull()).addColumn("ip", "text").addColumn("agent", "text").addColumn("created", "text", (c) => c.defaultTo(sql`CURRENT_TIMESTAMP`)).addColumn("last", "text").execute();
+	await db.schema.createTable("roles").addColumn("id", "integer", (c) => c.primaryKey()).addColumn("name", "text", (c) => c.notNull().unique()).addColumn("abilities", "text", (c) => c.notNull().defaultTo("[]")).execute();
+	await db.schema.createTable("members").addColumn("user", "integer", (c) => c.notNull().references("users.id").onDelete("cascade")).addColumn("role", "integer", (c) => c.notNull().references("roles.id").onDelete("cascade")).execute();
+	await db.schema.createTable("resets").addColumn("id", "text", (c) => c.primaryKey()).addColumn("user", "integer", (c) => c.notNull().references("users.id").onDelete("cascade")).addColumn("expiry", "text", (c) => c.notNull()).addColumn("created", "text", (c) => c.defaultTo(sql`CURRENT_TIMESTAMP`)).execute();
+	await db.schema.createTable("tokens").addColumn("id", "text", (c) => c.primaryKey()).addColumn("user", "integer", (c) => c.notNull().references("users.id").onDelete("cascade")).addColumn("name", "text", (c) => c.notNull()).addColumn("abilities", "text", (c) => c.notNull().defaultTo("[\"*\"]")).addColumn("last", "text").addColumn("expiry", "text").addColumn("created", "text", (c) => c.defaultTo(sql`CURRENT_TIMESTAMP`)).execute();
+	await db.schema.createIndex("idx_resets_user").on("resets").column("user").execute();
+	await db.schema.createIndex("idx_tokens_user").on("tokens").column("user").execute();
+	await db.schema.createIndex("idx_sessions_user_created").on("sessions").columns(["user", "created"]).execute();
+	await db.schema.createIndex("idx_sessions_created").on("sessions").column("created").execute();
+	await db.schema.createIndex("idx_sessions_user_last").on("sessions").columns(["user", "last"]).execute();
+	await db.schema.createIndex("idx_members_user").on("members").column("user").execute();
+	await db.schema.createIndex("idx_members_role").on("members").column("role").execute();
+	await db.schema.createIndex("idx_users_created").on("users").column("created").execute();
+}
+async function down(db) {
+	await db.schema.dropTable("tokens").execute();
+	await db.schema.dropTable("resets").execute();
+	await db.schema.dropTable("members").execute();
+	await db.schema.dropTable("sessions").execute();
+	await db.schema.dropTable("roles").execute();
+	await db.schema.dropTable("users").execute();
+}
+//#endregion
+export { down, up };