devpush 0.0.0-stage → 1.0.0-beta.3

package/src/server/db/migrations-sqlite/meta/_journal.json

@@ -0,0 +1,20 @@
+{
+  "version": "7",
+  "dialect": "sqlite",
+  "entries": [
+    {
+      "idx": 0,
+      "version": "6",
+      "when": 1792741633143,
+      "tag": "0000_initial",
+      "breakpoints": true
+    },
+    {
+      "idx": 1,
+      "version": "6",
+      "when": 1793105303539,
+      "tag": "0001_agent_indexes",
+      "breakpoints": true
+    }
+  ]
+}

package/src/server/db/oauth-schema.ts

@@ -0,0 +1,216 @@
+import {
+  index,
+  integer,
+  sqliteTable,
+  text,
+  uniqueIndex,
+} from 'drizzle-orm/sqlite-core'
+import { user, session } from './schema'
+
+// Maintained provider schema: @better-auth/oauth-provider and better-auth 1.7.7.
+// Array/JSON fields are serialized by Better Auth's SQLite adapter.
+
+export const oauthClient = sqliteTable(
+  'oauth_client',
+  {
+    id: text('id').primaryKey(),
+    clientId: text('client_id').notNull().unique(),
+    clientSecret: text('client_secret'),
+    clientDiscoveryId: text('client_discovery_id'),
+    disabled: integer('disabled', { mode: 'boolean' }).default(false),
+    skipConsent: integer('skip_consent', { mode: 'boolean' }),
+    enableEndSession: integer('enable_end_session', { mode: 'boolean' }),
+    subjectType: text('subject_type'),
+    scopes: text('scopes'),
+    clientCredentialsScopes: text('client_credentials_scopes'),
+    userId: text('user_id').references(() => user.id, { onDelete: 'cascade' }),
+    createdAt: integer('created_at', { mode: 'timestamp_ms' }),
+    updatedAt: integer('updated_at', { mode: 'timestamp_ms' }),
+    name: text('name'),
+    uri: text('uri'),
+    icon: text('icon'),
+    contacts: text('contacts'),
+    tos: text('tos'),
+    policy: text('policy'),
+    softwareId: text('software_id'),
+    softwareVersion: text('software_version'),
+    softwareStatement: text('software_statement'),
+    redirectUris: text('redirect_uris').notNull(),
+    postLogoutRedirectUris: text('post_logout_redirect_uris'),
+    backchannelLogoutUri: text('backchannel_logout_uri'),
+    backchannelLogoutSessionRequired: integer(
+      'backchannel_logout_session_required',
+      { mode: 'boolean' },
+    ),
+    tokenEndpointAuthMethod: text('token_endpoint_auth_method'),
+    applicationType: text('application_type'),
+    jwks: text('jwks'),
+    jwksUri: text('jwks_uri'),
+    grantTypes: text('grant_types'),
+    responseTypes: text('response_types'),
+    requirePKCE: integer('require_p_k_c_e', { mode: 'boolean' }),
+    dpopBoundAccessTokens: integer('dpop_bound_access_tokens', {
+      mode: 'boolean',
+    }).default(false),
+    referenceId: text('reference_id'),
+    metadata: text('metadata'),
+  },
+  (table) => [index('oauth_client_user_id_idx').on(table.userId)],
+)
+
+export const oauthResource = sqliteTable('oauth_resource', {
+  id: text('id').primaryKey(),
+  identifier: text('identifier').notNull().unique(),
+  name: text('name').notNull(),
+  accessTokenTtl: integer('access_token_ttl'),
+  refreshTokenTtl: integer('refresh_token_ttl'),
+  signingAlgorithm: text('signing_algorithm'),
+  signingKeyId: text('signing_key_id'),
+  allowedScopes: text('allowed_scopes'),
+  customClaims: text('custom_claims'),
+  dpopBoundAccessTokensRequired: integer('dpop_bound_access_tokens_required', {
+    mode: 'boolean',
+  }).default(false),
+  disabled: integer('disabled', { mode: 'boolean' }).default(false),
+  createdAt: integer('created_at', { mode: 'timestamp_ms' }),
+  updatedAt: integer('updated_at', { mode: 'timestamp_ms' }),
+  policyVersion: integer('policy_version').default(1),
+  metadata: text('metadata'),
+})
+
+export const oauthClientResource = sqliteTable(
+  'oauth_client_resource',
+  {
+    id: text('id').primaryKey(),
+    clientId: text('client_id')
+      .notNull()
+      .references(() => oauthClient.clientId, { onDelete: 'cascade' }),
+    resourceId: text('resource_id')
+      .notNull()
+      .references(() => oauthResource.identifier, { onDelete: 'cascade' }),
+    metadata: text('metadata'),
+    createdAt: integer('created_at', { mode: 'timestamp_ms' }),
+  },
+  (table) => [
+    index('oauth_client_resource_client_id_idx').on(table.clientId),
+    index('oauth_client_resource_resource_id_idx').on(table.resourceId),
+    uniqueIndex('oauth_client_resource_client_id_resource_id_idx').on(
+      table.clientId,
+      table.resourceId,
+    ),
+  ],
+)
+
+export const oauthRefreshToken = sqliteTable(
+  'oauth_refresh_token',
+  {
+    id: text('id').primaryKey(),
+    token: text('token').notNull().unique(),
+    clientId: text('client_id')
+      .notNull()
+      .references(() => oauthClient.clientId, { onDelete: 'cascade' }),
+    sessionId: text('session_id').references(() => session.id, {
+      onDelete: 'set null',
+    }),
+    userId: text('user_id')
+      .notNull()
+      .references(() => user.id, { onDelete: 'cascade' }),
+    referenceId: text('reference_id'),
+    authorizationCodeId: text('authorization_code_id'),
+    resources: text('resources'),
+    requestedUserInfoClaims: text('requested_user_info_claims'),
+    expiresAt: integer('expires_at', { mode: 'timestamp_ms' }).notNull(),
+    createdAt: integer('created_at', { mode: 'timestamp_ms' }).notNull(),
+    revoked: integer('revoked', { mode: 'timestamp_ms' }),
+    rotatedAt: integer('rotated_at', { mode: 'timestamp_ms' }),
+    rotationReplayResponse: text('rotation_replay_response'),
+    rotationReplayExpiresAt: integer('rotation_replay_expires_at', {
+      mode: 'timestamp_ms',
+    }),
+    authTime: integer('auth_time', { mode: 'timestamp_ms' }),
+    confirmation: text('confirmation'),
+    scopes: text('scopes').notNull(),
+  },
+  (table) => [
+    index('oauth_refresh_token_expiry_idx').on(table.expiresAt),
+    index('oauth_refresh_token_client_id_idx').on(table.clientId),
+    index('oauth_refresh_token_session_id_idx').on(table.sessionId),
+    index('oauth_refresh_token_user_id_idx').on(table.userId),
+    index('oauth_refresh_token_authorization_code_id_idx').on(
+      table.authorizationCodeId,
+    ),
+  ],
+)
+
+export const oauthAccessToken = sqliteTable(
+  'oauth_access_token',
+  {
+    id: text('id').primaryKey(),
+    token: text('token').notNull().unique(),
+    clientId: text('client_id')
+      .notNull()
+      .references(() => oauthClient.clientId, { onDelete: 'cascade' }),
+    sessionId: text('session_id').references(() => session.id, {
+      onDelete: 'set null',
+    }),
+    userId: text('user_id').references(() => user.id, { onDelete: 'cascade' }),
+    referenceId: text('reference_id'),
+    authorizationCodeId: text('authorization_code_id'),
+    resources: text('resources'),
+    requestedUserInfoClaims: text('requested_user_info_claims'),
+    refreshId: text('refresh_id').references(() => oauthRefreshToken.id, {
+      onDelete: 'cascade',
+    }),
+    expiresAt: integer('expires_at', { mode: 'timestamp_ms' }).notNull(),
+    createdAt: integer('created_at', { mode: 'timestamp_ms' }).notNull(),
+    revoked: integer('revoked', { mode: 'timestamp_ms' }),
+    confirmation: text('confirmation'),
+    scopes: text('scopes').notNull(),
+  },
+  (table) => [
+    index('oauth_access_token_expiry_idx').on(table.expiresAt),
+    index('oauth_access_token_client_id_idx').on(table.clientId),
+    index('oauth_access_token_session_id_idx').on(table.sessionId),
+    index('oauth_access_token_user_id_idx').on(table.userId),
+    index('oauth_access_token_authorization_code_id_idx').on(
+      table.authorizationCodeId,
+    ),
+    index('oauth_access_token_refresh_id_idx').on(table.refreshId),
+  ],
+)
+
+export const oauthConsent = sqliteTable(
+  'oauth_consent',
+  {
+    id: text('id').primaryKey(),
+    clientId: text('client_id')
+      .notNull()
+      .references(() => oauthClient.clientId, { onDelete: 'cascade' }),
+    userId: text('user_id').references(() => user.id, { onDelete: 'cascade' }),
+    referenceId: text('reference_id'),
+    resources: text('resources'),
+    requestedUserInfoClaims: text('requested_user_info_claims'),
+    scopes: text('scopes').notNull(),
+    createdAt: integer('created_at', { mode: 'timestamp_ms' }).notNull(),
+    updatedAt: integer('updated_at', { mode: 'timestamp_ms' }).notNull(),
+  },
+  (table) => [
+    index('oauth_consent_client_id_idx').on(table.clientId),
+    index('oauth_consent_user_id_idx').on(table.userId),
+  ],
+)
+
+export const oauthClientAssertion = sqliteTable('oauth_client_assertion', {
+  id: text('id').primaryKey(),
+  expiresAt: integer('expires_at', { mode: 'timestamp_ms' }).notNull(),
+})
+
+export const jwks = sqliteTable('jwks', {
+  id: text('id').primaryKey(),
+  publicKey: text('public_key').notNull(),
+  privateKey: text('private_key').notNull(),
+  createdAt: integer('created_at', { mode: 'timestamp_ms' }).notNull(),
+  expiresAt: integer('expires_at', { mode: 'timestamp_ms' }),
+  alg: text('alg'),
+  crv: text('crv'),
+})

package/src/server/db/remote-config.ts

@@ -0,0 +1,47 @@
+type RemoteConfig = {
+  DEVPUSH_DATABASE_URL?: string
+  DEVPUSH_LOG_DATABASE_URL?: string
+  DEVPUSH_DATABASE_AUTH_TOKEN?: string
+  DEVPUSH_LOG_DATABASE_AUTH_TOKEN?: string
+}
+
+export function remoteDatabaseConfig(env: RemoteConfig) {
+  const main = env.DEVPUSH_DATABASE_URL?.trim()
+  const logs = env.DEVPUSH_LOG_DATABASE_URL?.trim()
+  if (!main && !logs) {
+    if (env.DEVPUSH_DATABASE_AUTH_TOKEN || env.DEVPUSH_LOG_DATABASE_AUTH_TOKEN)
+      throw new Error(
+        'Database authentication tokens require remote database URLs.',
+      )
+    return undefined
+  }
+  if (!main || !logs)
+    throw new Error(
+      'Configure both DEVPUSH_DATABASE_URL and DEVPUSH_LOG_DATABASE_URL.',
+    )
+  function identity(value: string) {
+    let url: URL
+    try {
+      url = new URL(value)
+    } catch {
+      throw new Error('Invalid remote database URL.')
+    }
+    if (
+      !['libsql:', 'https:', 'http:'].includes(url.protocol) ||
+      !url.hostname ||
+      url.username ||
+      url.password ||
+      url.hash
+    )
+      throw new Error(
+        'Remote databases require libsql://, https:// or http:// URLs without embedded credentials or fragments.',
+      )
+    return `${url.hostname}:${url.port || (url.protocol === 'http:' ? '80' : '443')}${url.pathname.replace(/\/$/, '')}`
+  }
+  if (identity(main) === identity(logs))
+    throw new Error('Main data and logs must use different remote databases.')
+  return {
+    main: { url: main, authToken: env.DEVPUSH_DATABASE_AUTH_TOKEN },
+    logs: { url: logs, authToken: env.DEVPUSH_LOG_DATABASE_AUTH_TOKEN },
+  }
+}