or3-provider-sqlite 0.0.15 → 0.0.16

package/README.md

@@ -308,3 +308,9 @@ Rebuild the provider before testing a file-linked host; follow the existing OR3
 release/update workflow separately. Local qualification does not authorize
 publication or a production migration. Files cloud exposure remains gated until
 the supported profile is qualified.
+
+## Instance signup invitations
+
+The updated host distinguishes signup invites from existing team invites. Signup invites create a private workspace with only the recipient as owner; team invites retain their selected workspace and role. This requires the updated host and rebuilt provider artifacts, rather than the existing published release alone.
+
+Native SQLite implements five optional AuthWorkspaceStore methods with one additive signup_invites migration and one immediate acceptance transaction. User, identity mapping, recipient-only workspace membership, active pointer, and acceptance receipt commit together. Replay performs no provisioning writes. D1 deliberately does not advertise these methods. Dates are milliseconds; history pages contain at most 100 rows without hashes, with 90-day terminal retention and cleanup capped at 100 records per create/list call.

package/dist/module.json

@@ -1,7 +1,7 @@
 {
   "name": "or3-provider-sqlite",
   "configKey": "or3-provider-sqlite",
-  "version": "0.0.15",
+  "version": "0.0.16",
   "builder": {
     "@nuxt/module-builder": "1.0.2",
     "unbuild": "3.6.1"

package/dist/runtime/server/auth/sqlite-auth-workspace-store.d.ts

@@ -4,9 +4,49 @@
  * Maps provider identity -> internal user and manages workspace CRUD.
  * Uses Kysely for all queries. No Convex or Clerk SDK imports.
  */
-import type { AuthWorkspaceStore, InviteProvisionResult, InviteValidationResult } from '~~/server/auth/store/types';
+import type { AuthWorkspaceStore, SignupInviteSummary, SignupProvisionResult, SignupValidationResult, InviteProvisionResult, InviteValidationResult } from '~~/server/auth/store/types';
 import type { WorkspaceRole } from '~~/app/core/hooks/hook-types';
 export declare class SqliteAuthWorkspaceStore implements AuthWorkspaceStore {
+    constructor();
+    private cleanupSignupInvites;
+    createSignupInvite(input: {
+        id: string;
+        email: string;
+        token_hash: string;
+        expires_at: number;
+        created_by_admin: string;
+    }): Promise<{
+        id: string;
+    }>;
+    listSignupInvites(input: {
+        limit: number;
+        cursor?: string;
+    }): Promise<{
+        invites: SignupInviteSummary[];
+        next_cursor: string | null;
+    }>;
+    revokeSignupInvite(input: {
+        id: string;
+    }): Promise<{
+        ok: true;
+    } | {
+        ok: false;
+        reason: 'not_found' | 'already_used';
+    }>;
+    private checkSignupInvite;
+    validateSignupInvite(input: {
+        id: string;
+        email: string;
+        token_hash: string;
+    }): Promise<SignupValidationResult>;
+    acceptSignupInviteAndProvisionUser(input: {
+        invite_id: string;
+        token_hash: string;
+        provider: string;
+        provider_user_id: string;
+        email: string;
+        display_name?: string;
+    }): Promise<SignupProvisionResult>;
     private get db();
     protected onInviteProvisionStep(_step: 'invite_validated' | 'user_created' | 'membership_created' | 'invite_consumed'): void;
     getOrCreateUser(input: {

package/dist/runtime/server/auth/sqlite-auth-workspace-store.js

@@ -10,6 +10,99 @@ function normalizeEmail(email) {
   return email.trim().toLowerCase();
 }
 export class SqliteAuthWorkspaceStore {
+  constructor() {
+    if (isD1Driver()) {
+      Object.assign(this, {
+        createSignupInvite: void 0,
+        listSignupInvites: void 0,
+        revokeSignupInvite: void 0,
+        validateSignupInvite: void 0,
+        acceptSignupInviteAndProvisionUser: void 0
+      });
+    }
+  }
+  cleanupSignupInvites() {
+    getRawDb().prepare("DELETE FROM signup_invites WHERE id IN (SELECT id FROM signup_invites WHERE retain_until < ? ORDER BY retain_until LIMIT 100)").run(Date.now());
+  }
+  async createSignupInvite(input) {
+    this.db;
+    this.cleanupSignupInvites();
+    getRawDb().prepare("INSERT INTO signup_invites (id, email, token_hash, expires_at, created_at, created_by_admin, retain_until) VALUES (?, ?, ?, ?, ?, ?, ?)").run(input.id, normalizeEmail(input.email), input.token_hash, input.expires_at, Date.now(), input.created_by_admin, input.expires_at + 90 * 864e5);
+    return { id: input.id };
+  }
+  async listSignupInvites(input) {
+    this.db;
+    this.cleanupSignupInvites();
+    let cursor = null;
+    if (input.cursor) {
+      try {
+        cursor = JSON.parse(Buffer.from(input.cursor, "base64url").toString());
+      } catch {
+        throw new Error("Invalid invite cursor");
+      }
+      if (!cursor || !Number.isSafeInteger(cursor.created_at) || typeof cursor.id !== "string") throw new Error("Invalid invite cursor");
+    }
+    const limit = Math.min(100, Math.max(1, Math.trunc(input.limit)));
+    const rows = getRawDb().prepare(
+      "SELECT id, email, status, expires_at, created_at, created_by_admin, revoked_at, accepted_at, user_id, workspace_id FROM signup_invites " + (cursor ? "WHERE (created_at, id) < (?, ?) " : "") + "ORDER BY created_at DESC, id DESC LIMIT ?"
+    ).all(...cursor ? [cursor.created_at, cursor.id] : [], limit + 1);
+    const page = rows.slice(0, limit);
+    const last = page.at(-1);
+    return {
+      invites: page.map((row) => ({ ...row, status: row.status === "pending" && row.expires_at <= Date.now() ? "expired" : row.status })),
+      next_cursor: rows.length > limit && last ? Buffer.from(JSON.stringify({ created_at: last.created_at, id: last.id })).toString("base64url") : null
+    };
+  }
+  async revokeSignupInvite(input) {
+    this.db;
+    const raw = getRawDb();
+    return raw.transaction(() => {
+      const invite = raw.prepare("SELECT status, expires_at FROM signup_invites WHERE id = ?").get(input.id);
+      if (!invite) return { ok: false, reason: "not_found" };
+      if (invite.status !== "pending" || invite.expires_at <= Date.now()) return { ok: false, reason: "already_used" };
+      const now = Date.now();
+      raw.prepare("UPDATE signup_invites SET status = 'revoked', revoked_at = ?, retain_until = ? WHERE id = ?").run(now, now + 90 * 864e5, input.id);
+      return { ok: true };
+    }).immediate();
+  }
+  checkSignupInvite(invite, input) {
+    if (!invite) return { ok: false, reason: "not_found" };
+    if (invite.token_hash !== input.token_hash) return { ok: false, reason: "token_mismatch" };
+    if (invite.email !== normalizeEmail(input.email)) return { ok: false, reason: "email_mismatch" };
+    if (invite.status === "accepted") return { ok: false, reason: "already_used" };
+    if (invite.status === "revoked") return { ok: false, reason: "revoked" };
+    if (invite.expires_at <= Date.now()) return { ok: false, reason: "expired" };
+    return { ok: true };
+  }
+  async validateSignupInvite(input) {
+    this.db;
+    const invite = getRawDb().prepare("SELECT * FROM signup_invites WHERE id = ?").get(input.id);
+    return this.checkSignupInvite(invite, input);
+  }
+  async acceptSignupInviteAndProvisionUser(input) {
+    this.db;
+    const raw = getRawDb();
+    return raw.transaction(() => {
+      const invite = raw.prepare("SELECT * FROM signup_invites WHERE id = ?").get(input.invite_id);
+      if (invite?.status === "accepted" && invite.token_hash === input.token_hash && invite.email === normalizeEmail(input.email) && invite.accepted_provider === input.provider && invite.accepted_provider_user_id === input.provider_user_id) {
+        return { ok: true, user_id: invite.user_id, workspace_id: invite.workspace_id, workspace_name: "My Workspace", created: false };
+      }
+      const validation = this.checkSignupInvite(invite, input);
+      if (!validation.ok) return validation;
+      const email = normalizeEmail(input.email);
+      if (raw.prepare("SELECT id FROM auth_accounts WHERE provider = ? AND provider_user_id = ?").get(input.provider, input.provider_user_id) || raw.prepare("SELECT id FROM users WHERE lower(trim(email)) = ?").get(email)) return { ok: false, reason: "account_exists" };
+      const userId = uid();
+      const workspaceId = uid();
+      const now = nowEpoch();
+      raw.prepare("INSERT INTO users (id, email, display_name, active_workspace_id, created_at) VALUES (?, ?, ?, ?, ?)").run(userId, email, input.display_name ?? null, workspaceId, now);
+      raw.prepare("INSERT INTO auth_accounts (id, user_id, provider, provider_user_id, created_at) VALUES (?, ?, ?, ?, ?)").run(uid(), userId, input.provider, input.provider_user_id, now);
+      raw.prepare("INSERT INTO workspaces (id, name, owner_user_id, created_at) VALUES (?, ?, ?, ?)").run(workspaceId, "My Workspace", userId, now);
+      raw.prepare("INSERT INTO workspace_members (id, workspace_id, user_id, role, created_at) VALUES (?, ?, ?, ?, ?)").run(uid(), workspaceId, userId, "owner", now);
+      const acceptedAt = Date.now();
+      raw.prepare("UPDATE signup_invites SET status = 'accepted', accepted_at = ?, user_id = ?, workspace_id = ?, accepted_provider = ?, accepted_provider_user_id = ?, retain_until = ? WHERE id = ?").run(acceptedAt, userId, workspaceId, input.provider, input.provider_user_id, acceptedAt + 90 * 864e5, input.invite_id);
+      return { ok: true, user_id: userId, workspace_id: workspaceId, workspace_name: "My Workspace", created: true };
+    }).immediate();
+  }
   get db() {
     return getSqliteDb();
   }

package/dist/runtime/server/db/migrate.js

@@ -39,6 +39,7 @@ const REQUIRED_SCHEMA_TABLES = [
   "s_file_meta",
   "s_notifications",
   "auth_invites",
+  "signup_invites",
   "admin_users",
   "admin_workspace_settings",
   "sync_snapshots",
@@ -51,6 +52,7 @@ const REQUIRED_SCHEMA_TABLES = [
   "background_admission_cancels",
   "background_generation_receipts"
 ];
+import * as m024 from "./migrations/024_signup_invites.js";
 const migrations = {
   "001_init": m001,
   "002_sync_tables": m002,
@@ -74,7 +76,8 @@ const migrations = {
   "020_background_generation_receipts": m020,
   "021_background_request_usage": m021,
   "022_canonical_chat_reader": m022,
-  "023_legacy_chat_seek_index": m023
+  "023_legacy_chat_seek_index": m023,
+  "024_signup_invites": m024
 };
 class StaticMigrationProvider {
   async getMigrations() {

package/dist/runtime/server/db/migrations/024_signup_invites.d.ts

@@ -0,0 +1,4 @@
+import { type Kysely } from 'kysely';
+/** Additive: signup invitations never join an existing workspace. Millisecond dates. */
+export declare function up(db: Kysely<unknown>): Promise<void>;
+export declare function down(db: Kysely<unknown>): Promise<void>;

package/dist/runtime/server/db/migrations/024_signup_invites.js

@@ -0,0 +1,18 @@
+import { sql } from "kysely";
+export async function up(db) {
+  await sql`CREATE TABLE signup_invites (
+        id TEXT PRIMARY KEY, email TEXT NOT NULL, token_hash TEXT NOT NULL UNIQUE,
+        status TEXT NOT NULL DEFAULT 'pending', expires_at INTEGER NOT NULL,
+        created_at INTEGER NOT NULL, created_by_admin TEXT NOT NULL,
+        revoked_at INTEGER, accepted_at INTEGER, user_id TEXT, workspace_id TEXT,
+        accepted_provider TEXT, accepted_provider_user_id TEXT,
+        retain_until INTEGER NOT NULL
+    )`.execute(db);
+  await sql`CREATE INDEX signup_invites_created ON signup_invites(created_at, id)`.execute(db);
+  await sql`CREATE INDEX signup_invites_retention ON signup_invites(retain_until)`.execute(db);
+  await sql`CREATE INDEX users_normalized_email ON users(lower(trim(email)))`.execute(db);
+}
+export async function down(db) {
+  await db.schema.dropTable("signup_invites").execute();
+  await sql`DROP INDEX users_normalized_email`.execute(db);
+}

package/dist/runtime/server/db/schema.d.ts

@@ -33,6 +33,22 @@ export interface WorkspaceMembersTable {
     role: string;
     created_at: Generated<number>;
 }
+export interface SignupInvitesTable {
+    id: string;
+    email: string;
+    token_hash: string;
+    status: string;
+    expires_at: number;
+    created_at: number;
+    created_by_admin: string;
+    revoked_at: number | null;
+    accepted_at: number | null;
+    user_id: string | null;
+    workspace_id: string | null;
+    accepted_provider: string | null;
+    accepted_provider_user_id: string | null;
+    retain_until: number;
+}
 export interface AuthInvitesTable {
     id: string;
     workspace_id: string;
@@ -243,6 +259,7 @@ export interface Or3SqliteDb {
     workspaces: WorkspacesTable;
     workspace_members: WorkspaceMembersTable;
     auth_invites: AuthInvitesTable;
+    signup_invites: SignupInvitesTable;
     server_version_counter: ServerVersionCounterTable;
     change_log: ChangeLogTable;
     device_cursors: DeviceCursorsTable;

package/package.json

@@ -1,6 +1,6 @@
 {
     "name": "or3-provider-sqlite",
-    "version": "0.0.15",
+    "version": "0.0.16",
     "repository": {
         "type": "git",
         "url": "git+https://github.com/Saluana/or3-provider-sqlite.git"