style: lint
This commit is contained in:
Neko Ayaka
@@ -2,19 +2,19 @@ import { relations } from 'drizzle-orm'
|
||||
import { boolean, index, jsonb, pgTable, text, timestamp } from 'drizzle-orm/pg-core'
|
||||
|
||||
export const user = pgTable('user', {
|
||||
id: text('id').primaryKey(),
|
||||
name: text('name').notNull(),
|
||||
email: text('email').notNull().unique(),
|
||||
emailVerified: boolean('email_verified').default(false).notNull(),
|
||||
image: text('image'),
|
||||
banExpires: timestamp('ban_expires'),
|
||||
// Account-ban fields are owned by the private management backend. banGuard
|
||||
// rejects banned users during session creation. Resource and userinfo routes
|
||||
// re-check these fields for existing OIDC access tokens.
|
||||
banned: boolean('banned').default(false),
|
||||
banReason: text('ban_reason'),
|
||||
banExpires: timestamp('ban_expires'),
|
||||
lastSeenAt: timestamp('last_seen_at'),
|
||||
createdAt: timestamp('created_at').defaultNow().notNull(),
|
||||
email: text('email').notNull().unique(),
|
||||
emailVerified: boolean('email_verified').default(false).notNull(),
|
||||
id: text('id').primaryKey(),
|
||||
image: text('image'),
|
||||
lastSeenAt: timestamp('last_seen_at'),
|
||||
name: text('name').notNull(),
|
||||
updatedAt: timestamp('updated_at')
|
||||
.defaultNow()
|
||||
.$onUpdate(() => /* @__PURE__ */ new Date())
|
||||
@@ -24,14 +24,14 @@ export const user = pgTable('user', {
|
||||
export const session = pgTable(
|
||||
'session',
|
||||
{
|
||||
id: text('id').primaryKey(),
|
||||
expiresAt: timestamp('expires_at').notNull(),
|
||||
token: text('token').notNull().unique(),
|
||||
createdAt: timestamp('created_at').defaultNow().notNull(),
|
||||
expiresAt: timestamp('expires_at').notNull(),
|
||||
id: text('id').primaryKey(),
|
||||
ipAddress: text('ip_address'),
|
||||
token: text('token').notNull().unique(),
|
||||
updatedAt: timestamp('updated_at')
|
||||
.$onUpdate(() => /* @__PURE__ */ new Date())
|
||||
.notNull(),
|
||||
ipAddress: text('ip_address'),
|
||||
userAgent: text('user_agent'),
|
||||
userId: text('user_id')
|
||||
.notNull()
|
||||
@@ -46,23 +46,23 @@ export const session = pgTable(
|
||||
export const account = pgTable(
|
||||
'account',
|
||||
{
|
||||
id: text('id').primaryKey(),
|
||||
accountId: text('account_id').notNull(),
|
||||
providerId: text('provider_id').notNull(),
|
||||
userId: text('user_id')
|
||||
.notNull()
|
||||
.references(() => user.id, { onDelete: 'cascade' }),
|
||||
accessToken: text('access_token'),
|
||||
refreshToken: text('refresh_token'),
|
||||
idToken: text('id_token'),
|
||||
accessTokenExpiresAt: timestamp('access_token_expires_at'),
|
||||
accountId: text('account_id').notNull(),
|
||||
createdAt: timestamp('created_at').defaultNow().notNull(),
|
||||
id: text('id').primaryKey(),
|
||||
idToken: text('id_token'),
|
||||
password: text('password'),
|
||||
providerId: text('provider_id').notNull(),
|
||||
refreshToken: text('refresh_token'),
|
||||
refreshTokenExpiresAt: timestamp('refresh_token_expires_at'),
|
||||
scope: text('scope'),
|
||||
password: text('password'),
|
||||
createdAt: timestamp('created_at').defaultNow().notNull(),
|
||||
updatedAt: timestamp('updated_at')
|
||||
.$onUpdate(() => /* @__PURE__ */ new Date())
|
||||
.notNull(),
|
||||
userId: text('user_id')
|
||||
.notNull()
|
||||
.references(() => user.id, { onDelete: 'cascade' }),
|
||||
},
|
||||
table => [
|
||||
index('account_userId_idx').on(table.userId),
|
||||
@@ -73,80 +73,80 @@ export const account = pgTable(
|
||||
export const verification = pgTable(
|
||||
'verification',
|
||||
{
|
||||
createdAt: timestamp('created_at').defaultNow().notNull(),
|
||||
expiresAt: timestamp('expires_at').notNull(),
|
||||
id: text('id').primaryKey(),
|
||||
identifier: text('identifier').notNull(),
|
||||
value: text('value').notNull(),
|
||||
expiresAt: timestamp('expires_at').notNull(),
|
||||
createdAt: timestamp('created_at').defaultNow().notNull(),
|
||||
updatedAt: timestamp('updated_at')
|
||||
.defaultNow()
|
||||
.$onUpdate(() => /* @__PURE__ */ new Date())
|
||||
.notNull(),
|
||||
value: text('value').notNull(),
|
||||
},
|
||||
table => [index('verification_identifier_idx').on(table.identifier)],
|
||||
)
|
||||
|
||||
export const jwks = pgTable('jwks', {
|
||||
id: text('id').primaryKey(),
|
||||
publicKey: text('public_key').notNull(),
|
||||
privateKey: text('private_key').notNull(),
|
||||
createdAt: timestamp('created_at').notNull(),
|
||||
expiresAt: timestamp('expires_at'),
|
||||
id: text('id').primaryKey(),
|
||||
privateKey: text('private_key').notNull(),
|
||||
publicKey: text('public_key').notNull(),
|
||||
})
|
||||
|
||||
export const oauthClient = pgTable('oauth_client', {
|
||||
id: text('id').primaryKey(),
|
||||
clientId: text('client_id').notNull().unique(),
|
||||
clientSecret: text('client_secret'),
|
||||
disabled: boolean('disabled').default(false),
|
||||
skipConsent: boolean('skip_consent'),
|
||||
enableEndSession: boolean('enable_end_session'),
|
||||
subjectType: text('subject_type'),
|
||||
scopes: text('scopes').array(),
|
||||
userId: text('user_id').references(() => user.id, { onDelete: 'cascade' }),
|
||||
createdAt: timestamp('created_at'),
|
||||
updatedAt: timestamp('updated_at'),
|
||||
name: text('name'),
|
||||
uri: text('uri'),
|
||||
icon: text('icon'),
|
||||
contacts: text('contacts').array(),
|
||||
tos: text('tos'),
|
||||
policy: text('policy'),
|
||||
softwareId: text('software_id'),
|
||||
softwareVersion: text('software_version'),
|
||||
softwareStatement: text('software_statement'),
|
||||
redirectUris: text('redirect_uris').array().notNull(),
|
||||
postLogoutRedirectUris: text('post_logout_redirect_uris').array(),
|
||||
tokenEndpointAuthMethod: text('token_endpoint_auth_method'),
|
||||
createdAt: timestamp('created_at'),
|
||||
disabled: boolean('disabled').default(false),
|
||||
enableEndSession: boolean('enable_end_session'),
|
||||
grantTypes: text('grant_types').array(),
|
||||
responseTypes: text('response_types').array(),
|
||||
public: boolean('public'),
|
||||
type: text('type'),
|
||||
requirePKCE: boolean('require_pkce'),
|
||||
referenceId: text('reference_id'),
|
||||
icon: text('icon'),
|
||||
id: text('id').primaryKey(),
|
||||
metadata: jsonb('metadata'),
|
||||
name: text('name'),
|
||||
policy: text('policy'),
|
||||
postLogoutRedirectUris: text('post_logout_redirect_uris').array(),
|
||||
public: boolean('public'),
|
||||
redirectUris: text('redirect_uris').array().notNull(),
|
||||
referenceId: text('reference_id'),
|
||||
requirePKCE: boolean('require_pkce'),
|
||||
responseTypes: text('response_types').array(),
|
||||
scopes: text('scopes').array(),
|
||||
skipConsent: boolean('skip_consent'),
|
||||
softwareId: text('software_id'),
|
||||
softwareStatement: text('software_statement'),
|
||||
softwareVersion: text('software_version'),
|
||||
subjectType: text('subject_type'),
|
||||
tokenEndpointAuthMethod: text('token_endpoint_auth_method'),
|
||||
tos: text('tos'),
|
||||
type: text('type'),
|
||||
updatedAt: timestamp('updated_at'),
|
||||
uri: text('uri'),
|
||||
userId: text('user_id').references(() => user.id, { onDelete: 'cascade' }),
|
||||
})
|
||||
|
||||
export const oauthRefreshToken = pgTable(
|
||||
'oauth_refresh_token',
|
||||
{
|
||||
id: text('id').primaryKey(),
|
||||
token: text('token').notNull(),
|
||||
authTime: timestamp('auth_time'),
|
||||
clientId: text('client_id')
|
||||
.notNull()
|
||||
.references(() => oauthClient.clientId, { onDelete: 'cascade' }),
|
||||
createdAt: timestamp('created_at'),
|
||||
expiresAt: timestamp('expires_at'),
|
||||
id: text('id').primaryKey(),
|
||||
referenceId: text('reference_id'),
|
||||
revoked: timestamp('revoked'),
|
||||
scopes: text('scopes').array().notNull(),
|
||||
sessionId: text('session_id').references(() => session.id, {
|
||||
onDelete: 'set null',
|
||||
}),
|
||||
token: text('token').notNull(),
|
||||
userId: text('user_id')
|
||||
.notNull()
|
||||
.references(() => user.id, { onDelete: 'cascade' }),
|
||||
referenceId: text('reference_id'),
|
||||
expiresAt: timestamp('expires_at'),
|
||||
createdAt: timestamp('created_at'),
|
||||
revoked: timestamp('revoked'),
|
||||
authTime: timestamp('auth_time'),
|
||||
scopes: text('scopes').array().notNull(),
|
||||
},
|
||||
table => [
|
||||
index('oauth_refresh_token_token_idx').on(table.token),
|
||||
@@ -157,52 +157,52 @@ export const oauthRefreshToken = pgTable(
|
||||
)
|
||||
|
||||
export const oauthAccessToken = pgTable('oauth_access_token', {
|
||||
id: text('id').primaryKey(),
|
||||
token: text('token').unique(),
|
||||
clientId: text('client_id')
|
||||
.notNull()
|
||||
.references(() => oauthClient.clientId, { onDelete: 'cascade' }),
|
||||
sessionId: text('session_id').references(() => session.id, {
|
||||
onDelete: 'set null',
|
||||
}),
|
||||
userId: text('user_id').references(() => user.id, { onDelete: 'cascade' }),
|
||||
createdAt: timestamp('created_at'),
|
||||
expiresAt: timestamp('expires_at'),
|
||||
id: text('id').primaryKey(),
|
||||
referenceId: text('reference_id'),
|
||||
refreshId: text('refresh_id').references(() => oauthRefreshToken.id, {
|
||||
onDelete: 'cascade',
|
||||
}),
|
||||
expiresAt: timestamp('expires_at'),
|
||||
createdAt: timestamp('created_at'),
|
||||
scopes: text('scopes').array().notNull(),
|
||||
sessionId: text('session_id').references(() => session.id, {
|
||||
onDelete: 'set null',
|
||||
}),
|
||||
token: text('token').unique(),
|
||||
userId: text('user_id').references(() => user.id, { onDelete: 'cascade' }),
|
||||
})
|
||||
|
||||
export const oauthConsent = pgTable('oauth_consent', {
|
||||
id: text('id').primaryKey(),
|
||||
clientId: text('client_id')
|
||||
.notNull()
|
||||
.references(() => oauthClient.clientId, { onDelete: 'cascade' }),
|
||||
userId: text('user_id').references(() => user.id, { onDelete: 'cascade' }),
|
||||
createdAt: timestamp('created_at'),
|
||||
id: text('id').primaryKey(),
|
||||
referenceId: text('reference_id'),
|
||||
scopes: text('scopes').array().notNull(),
|
||||
createdAt: timestamp('created_at'),
|
||||
updatedAt: timestamp('updated_at'),
|
||||
userId: text('user_id').references(() => user.id, { onDelete: 'cascade' }),
|
||||
})
|
||||
|
||||
export const userRelations = relations(user, ({ many }) => ({
|
||||
sessions: many(session),
|
||||
accounts: many(account),
|
||||
oauthClients: many(oauthClient),
|
||||
oauthRefreshTokens: many(oauthRefreshToken),
|
||||
oauthAccessTokens: many(oauthAccessToken),
|
||||
oauthClients: many(oauthClient),
|
||||
oauthConsents: many(oauthConsent),
|
||||
oauthRefreshTokens: many(oauthRefreshToken),
|
||||
sessions: many(session),
|
||||
}))
|
||||
|
||||
export const sessionRelations = relations(session, ({ one, many }) => ({
|
||||
export const sessionRelations = relations(session, ({ many, one }) => ({
|
||||
oauthAccessTokens: many(oauthAccessToken),
|
||||
oauthRefreshTokens: many(oauthRefreshToken),
|
||||
user: one(user, {
|
||||
fields: [session.userId],
|
||||
references: [user.id],
|
||||
}),
|
||||
oauthRefreshTokens: many(oauthRefreshToken),
|
||||
oauthAccessTokens: many(oauthAccessToken),
|
||||
}))
|
||||
|
||||
export const accountRelations = relations(account, ({ one }) => ({
|
||||
@@ -212,19 +212,20 @@ export const accountRelations = relations(account, ({ one }) => ({
|
||||
}),
|
||||
}))
|
||||
|
||||
export const oauthClientRelations = relations(oauthClient, ({ one, many }) => ({
|
||||
export const oauthClientRelations = relations(oauthClient, ({ many, one }) => ({
|
||||
oauthAccessTokens: many(oauthAccessToken),
|
||||
oauthConsents: many(oauthConsent),
|
||||
oauthRefreshTokens: many(oauthRefreshToken),
|
||||
user: one(user, {
|
||||
fields: [oauthClient.userId],
|
||||
references: [user.id],
|
||||
}),
|
||||
oauthRefreshTokens: many(oauthRefreshToken),
|
||||
oauthAccessTokens: many(oauthAccessToken),
|
||||
oauthConsents: many(oauthConsent),
|
||||
}))
|
||||
|
||||
export const oauthRefreshTokenRelations = relations(
|
||||
oauthRefreshToken,
|
||||
({ one, many }) => ({
|
||||
({ many, one }) => ({
|
||||
oauthAccessTokens: many(oauthAccessToken),
|
||||
oauthClient: one(oauthClient, {
|
||||
fields: [oauthRefreshToken.clientId],
|
||||
references: [oauthClient.clientId],
|
||||
@@ -237,7 +238,6 @@ export const oauthRefreshTokenRelations = relations(
|
||||
fields: [oauthRefreshToken.userId],
|
||||
references: [user.id],
|
||||
}),
|
||||
oauthAccessTokens: many(oauthAccessToken),
|
||||
}),
|
||||
)
|
||||
|
||||
@@ -248,6 +248,10 @@ export const oauthAccessTokenRelations = relations(
|
||||
fields: [oauthAccessToken.clientId],
|
||||
references: [oauthClient.clientId],
|
||||
}),
|
||||
oauthRefreshToken: one(oauthRefreshToken, {
|
||||
fields: [oauthAccessToken.refreshId],
|
||||
references: [oauthRefreshToken.id],
|
||||
}),
|
||||
session: one(session, {
|
||||
fields: [oauthAccessToken.sessionId],
|
||||
references: [session.id],
|
||||
@@ -256,10 +260,6 @@ export const oauthAccessTokenRelations = relations(
|
||||
fields: [oauthAccessToken.userId],
|
||||
references: [user.id],
|
||||
}),
|
||||
oauthRefreshToken: one(oauthRefreshToken, {
|
||||
fields: [oauthAccessToken.refreshId],
|
||||
references: [oauthRefreshToken.id],
|
||||
}),
|
||||
}),
|
||||
)
|
||||
|
||||
|
||||
@@ -1,27 +1,27 @@
|
||||
/** Authenticated principal exposed to AIRI resource handlers. */
|
||||
export interface AuthSession {
|
||||
user: {
|
||||
session: {
|
||||
createdAt: Date
|
||||
expiresAt: Date
|
||||
id: string
|
||||
name: string
|
||||
ipAddress?: null | string
|
||||
token: string
|
||||
updatedAt: Date
|
||||
userAgent?: null | string
|
||||
userId: string
|
||||
}
|
||||
user: {
|
||||
banExpires?: Date | null
|
||||
banned?: boolean | null
|
||||
banReason?: null | string
|
||||
createdAt: Date
|
||||
email: string
|
||||
emailVerified: boolean
|
||||
image?: string | null
|
||||
banned?: boolean | null
|
||||
banReason?: string | null
|
||||
banExpires?: Date | null
|
||||
lastSeenAt?: Date | null
|
||||
createdAt: Date
|
||||
updatedAt: Date
|
||||
}
|
||||
session: {
|
||||
id: string
|
||||
token: string
|
||||
userId: string
|
||||
expiresAt: Date
|
||||
createdAt: Date
|
||||
image?: null | string
|
||||
lastSeenAt?: Date | null
|
||||
name: string
|
||||
updatedAt: Date
|
||||
ipAddress?: string | null
|
||||
userAgent?: string | null
|
||||
}
|
||||
}
|
||||
|
||||
@@ -29,7 +29,7 @@ export interface AuthSession {
|
||||
* Evaluates Better Auth's persisted ban fields without requiring its runtime.
|
||||
* Expired temporary bans are treated as inactive on stateless JWT paths.
|
||||
*/
|
||||
export function isUserBannedNow(user: { banned?: boolean | null, banExpires?: Date | string | null }): boolean {
|
||||
export function isUserBannedNow(user: { banExpires?: Date | null | string, banned?: boolean | null }): boolean {
|
||||
if (!user.banned)
|
||||
return false
|
||||
if (user.banExpires == null)
|
||||
|
||||
Reference in New Issue
Block a user