dzql 0.11.0 → 0.12.0

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "dzql",
-  "version": "0.11.0",
+  "version": "0.12.0",
   "description": "delta's compiled Postgres step: an app's delta definitions compiled to SQL",
   "repository": {
     "type": "git",
@@ -18,6 +18,7 @@
     "./postgres": "./src/postgres/index.ts",
     "./pglite": "./src/postgres/pglite.ts",
     "./auth-jwt": "./src/postgres/auth-jwt.ts",
+    "./auth-link": "./src/postgres/auth-link.ts",
     "./compile": "./src/compile/opens.ts"
   },
   "files": [
@@ -63,11 +64,11 @@
     "pinia": "^3.0.4",
     "typescript": "^5.0.0",
     "vue": "^3.5.26",
-    "@blueshed/delta": "^1.0.0"
+    "@blueshed/delta": "^1.1.0"
   },
   "peerDependencies": {
     "typescript": "^5.0.0",
-    "@blueshed/delta": "^1.0.0"
+    "@blueshed/delta": "^1.1.0"
   },
   "engines": {
     "bun": ">=1.0.0"

package/src/cli/index.ts

@@ -15,8 +15,8 @@ const VERSION = packageJson.version;
 
 const args = process.argv.slice(2);
 
-// delta's Postgres commands (dzql is delta's Postgres step): sql, init, migrate
-if (["sql", "init", "migrate"].includes(args[0] ?? "")) {
+// delta's Postgres commands (dzql is delta's Postgres step): sql, init, migrate, link
+if (["sql", "init", "migrate", "link"].includes(args[0] ?? "")) {
   const { main } = await import("../postgres/cli.ts");
   await main(args);
   process.exit(0);

package/src/compile/rows.ts

@@ -44,8 +44,16 @@ RETURNS JSONB AS $$
 DECLARE
   v_row JSONB;
 BEGIN
-${dispatch(schema, (_, t) => `SELECT to_jsonb(t.*) INTO v_row FROM ${q(t.name)} t WHERE t.id = p_id${t.temporal ? " AND valid_to IS NULL" : ""} FOR UPDATE;
-      RETURN v_row;`, noCollection("p_coll"))}
+${dispatch(schema, (_, t) => {
+    const standing = `t.id = p_id${t.temporal ? " AND t.valid_to IS NULL" : ""}`;
+    // A write that waited on another's lock finds the row it waited on stored again (a new version,
+    // or put again): the row it locked is not the standing one. Asked afresh (each statement sees what
+    // has committed since), a standing row is locked in its turn; none standing is not there.
+    return `LOOP
+        SELECT to_jsonb(t.*) INTO v_row FROM ${q(t.name)} t WHERE ${standing} FOR UPDATE;
+        IF v_row IS NOT NULL OR NOT EXISTS (SELECT 1 FROM ${q(t.name)} t WHERE ${standing}) THEN RETURN v_row; END IF;
+      END LOOP;`;
+  }, noCollection("p_coll"))}
 END;
 $$ LANGUAGE plpgsql;`;
 

package/src/postgres/auth-link.ts

@@ -0,0 +1,53 @@
+/**
+ * Link sign-in on Postgres: the `LinkStore` delta's `auth-link` keeps its links and sessions in
+ * (`@blueshed/delta/auth-link`; Workshop's docs/link-sign-in-plan.md). The tables are its own,
+ * `_auth_links` and `_auth_sessions`, beside delta's `_delta_*`: hashes, the person's id, times. A
+ * link is used in one statement, so two taps at once make one session, on one server or several.
+ *
+ *   import { linkAuth } from "@blueshed/delta/auth-link";
+ *   import { postgresLinkStore } from "dzql/auth-link";
+ *
+ *   const auth = linkAuth({ store: await postgresLinkStore(pool), personOf, people });
+ */
+import type { Pool } from "pg";
+import type { KeptLink, KeptSession, LinkStore } from "@blueshed/delta/auth-link";
+
+export { linkAuth, makeLink } from "@blueshed/delta/auth-link";
+
+/** The links and sessions in Postgres, in tables of their own, made here (once: IF NOT EXISTS). */
+export async function postgresLinkStore(pool: Pool): Promise<LinkStore> {
+  await pool.query(`CREATE TABLE IF NOT EXISTS _auth_links (hash TEXT PRIMARY KEY, person BIGINT NOT NULL, opens TEXT, expires TIMESTAMPTZ NOT NULL, used TIMESTAMPTZ)`);
+  await pool.query(`CREATE TABLE IF NOT EXISTS _auth_sessions (hash TEXT PRIMARY KEY, person BIGINT NOT NULL, expires TIMESTAMPTZ NOT NULL)`);
+  // Times as delta's store has them: ISO strings; a person's id a number (pg reads BIGINT as text)
+  const iso = (t: Date | string | null) => (t === null ? null : new Date(t).toISOString());
+  const SESSION = "SELECT person::int AS person, expires FROM _auth_sessions WHERE hash = $1";
+  return {
+    async addLink(hash, l) {
+      await pool.query("INSERT INTO _auth_links (hash, person, opens, expires) VALUES ($1, $2, $3, $4)", [hash, l.person, l.opens, l.expires]);
+    },
+    async useLink(hash, now) {
+      const { rows } = await pool.query(
+        "UPDATE _auth_links SET used = $1 WHERE hash = $2 AND used IS NULL AND expires > $1 RETURNING person::int AS person, opens",
+        [now, hash],
+      );
+      return rows[0] ?? null;
+    },
+    async link(hash): Promise<KeptLink | null> {
+      const { rows } = await pool.query("SELECT person::int AS person, opens, expires, used FROM _auth_links WHERE hash = $1", [hash]);
+      return rows[0] ? { ...rows[0], expires: iso(rows[0].expires)!, used: iso(rows[0].used) } : null;
+    },
+    async addSession(hash, s) {
+      await pool.query("INSERT INTO _auth_sessions (hash, person, expires) VALUES ($1, $2, $3)", [hash, s.person, s.expires]);
+    },
+    async session(hash): Promise<KeptSession | null> {
+      const { rows } = await pool.query(SESSION, [hash]);
+      return rows[0] ? { person: rows[0].person, expires: iso(rows[0].expires)! } : null;
+    },
+    async renewSession(hash, expires) {
+      await pool.query("UPDATE _auth_sessions SET expires = $1 WHERE hash = $2", [expires, hash]);
+    },
+    async endSession(hash) {
+      await pool.query("DELETE FROM _auth_sessions WHERE hash = $1", [hash]);
+    },
+  };
+}

package/src/postgres/cli.ts

@@ -1,8 +1,8 @@
 #!/usr/bin/env bun
 /**
- * dzql's Postgres commands, as delta's CLI had them: `dzql sql`, `dzql init`
- * and `dzql migrate` (a postgres:// URL or a PGlite directory). Run through
- * `dzql <command>` (src/cli/index.ts hands these three here).
+ * dzql's Postgres commands, as delta's CLI had them: `dzql sql`, `dzql init`,
+ * `dzql migrate` (a postgres:// URL or a PGlite directory), and `dzql link`. Run through
+ * `dzql <command>` (src/cli/index.ts hands these four here).
  */
 import { parseArgs } from "node:util";
 import { resolve, basename, join, dirname } from "node:path";
@@ -26,6 +26,8 @@ const USAGE =
     `  dzql init <dir> [--with-auth] [--upgrade]\n` +
     `  dzql migrate <database> [--app <name>] [--dir <migrations>] [--status] [--json]\n` +
     `        <database>: a PGlite directory or a postgres:// URL; --dir defaults to ./migrations\n` +
+    `  dzql link <database> <person> [--origin <url>] [--opens <path>] [--json]\n` +
+    `        a link to sign in as someone (link sign-in): the first person's, on the server\n` +
     `\n` +
     `Exit codes: 0 done, 1 an error, 2 a bad argument.\n`;
 
@@ -299,6 +301,41 @@ async function cmdMigrate(target: string | undefined, values: Record<string, unk
   if (!r.fresh && r.ran.length === 0) process.stdout.write("nothing to run\n");
 }
 
+// ---------------------------------------------------------------------------
+// dzql link
+// ---------------------------------------------------------------------------
+
+/**
+ * A link to sign in as `person` (link sign-in, `dzql/auth-link`), made in the app's Postgres: how
+ * the first person signs in, before anyone can send them one. The site is --origin, else ORIGIN,
+ * else Railway's domain. The database as `migrate` takes it. A SQLite file is delta's (`delta link`).
+ */
+async function cmdLink(target: string | undefined, person: string | undefined, values: Record<string, unknown>) {
+  if (!target || !person) usageError("link takes a <database> and a <person>: dzql link postgres://… 1", true);
+  if (!/^\d+$/.test(person)) usageError(`<person> is a person's id, a number: ${person}`);
+  const isUrl = /^postgres(ql)?:\/\//.test(target);
+  const path = resolve(process.cwd(), target);
+  if (!isUrl && (!existsSync(path) || !statSync(path).isDirectory())) usageError(`no PGlite database at ${target} (a SQLite file is delta's: bunx @blueshed/delta link)`);
+  const { makeLink, siteOrigin } = await import("@blueshed/delta/auth-link");
+  let origin: string;
+  try { origin = (values.origin as string | undefined) ?? siteOrigin(); }
+  catch (err) { usageError(`${(err as Error).message}, or pass --origin`); }
+  const { postgresLinkStore } = await import("./auth-link");
+  let pool: any;
+  if (isUrl) {
+    const { Pool } = await import("pg");
+    pool = new Pool({ connectionString: target });
+  } else {
+    const { openPglite } = await import("./pglite");
+    pool = await openPglite(path);
+  }
+  try {
+    const made = await makeLink(await postgresLinkStore(pool), Number(person), { origin, opens: values.opens as string | undefined });
+    if (json) return print(made);
+    process.stdout.write(`${made.url}\n(used once, until ${made.expires})\n`);
+  } finally { await pool.end(); }
+}
+
 // ---------------------------------------------------------------------------
 // main
 // ---------------------------------------------------------------------------
@@ -318,6 +355,8 @@ export async function main(argv: string[]) {
       dir: { type: "string" },
       app: { type: "string" },
       status: { type: "boolean", default: false },
+      origin: { type: "string" },
+      opens: { type: "string" },
       help: { type: "boolean", short: "h", default: false },
     },
     allowPositionals: true,
@@ -327,11 +366,12 @@ export async function main(argv: string[]) {
   const { values, positionals } = parsed;
   json = !!values.json;
   if (values.help) { process.stdout.write(USAGE); return; }
-  const [cmd, arg] = positionals;
+  const [cmd, arg, arg2] = positionals;
   switch (cmd) {
     case "sql":     return cmdSql(arg, values);
     case "init":    return cmdInit(arg, values);
     case "migrate": return cmdMigrate(arg, values);
+    case "link":    return cmdLink(arg, arg2, values);
     default:        usageError(cmd ? `no command ${cmd}` : "a command, please", true);
   }
 }