sso signup & login

migrations/20260115_sso_external_identities.sql

@@ -0,0 +1,44 @@
+CREATE TYPE sso_provider_type AS ENUM ('github', 'discord', 'google', 'gitlab', 'oidc');
+
+CREATE TABLE external_identities (
+    id UUID PRIMARY KEY DEFAULT gen_random_uuid(),
+    did TEXT NOT NULL REFERENCES users(did) ON DELETE CASCADE,
+    provider sso_provider_type NOT NULL,
+    provider_user_id TEXT NOT NULL,
+    provider_username TEXT,
+    provider_email TEXT,
+    created_at TIMESTAMPTZ NOT NULL DEFAULT NOW(),
+    updated_at TIMESTAMPTZ NOT NULL DEFAULT NOW(),
+    last_login_at TIMESTAMPTZ,
+    UNIQUE(provider, provider_user_id),
+    UNIQUE(did, provider)
+);
+
+CREATE INDEX idx_external_identities_did ON external_identities(did);
+CREATE INDEX idx_external_identities_provider_user ON external_identities(provider, provider_user_id);
+
+CREATE TABLE sso_auth_state (
+    state TEXT PRIMARY KEY,
+    request_uri TEXT NOT NULL,
+    provider sso_provider_type NOT NULL,
+    action TEXT NOT NULL,
+    nonce TEXT,
+    code_verifier TEXT,
+    created_at TIMESTAMPTZ NOT NULL DEFAULT NOW(),
+    expires_at TIMESTAMPTZ NOT NULL DEFAULT NOW() + INTERVAL '10 minutes'
+);
+
+CREATE INDEX idx_sso_auth_state_expires ON sso_auth_state(expires_at);
+
+CREATE TABLE sso_pending_registration (
+    token TEXT PRIMARY KEY,
+    request_uri TEXT NOT NULL,
+    provider sso_provider_type NOT NULL,
+    provider_user_id TEXT NOT NULL,
+    provider_username TEXT,
+    provider_email TEXT,
+    created_at TIMESTAMPTZ NOT NULL DEFAULT NOW(),
+    expires_at TIMESTAMPTZ NOT NULL DEFAULT NOW() + INTERVAL '10 minutes'
+);
+
+CREATE INDEX idx_sso_pending_registration_expires ON sso_pending_registration(expires_at);

migrations/20260116_sso_auth_state_did.sql

@@ -0,0 +1 @@
+ALTER TABLE sso_auth_state ADD COLUMN did TEXT;

migrations/20260117_handle_reservations.sql

@@ -0,0 +1,8 @@
+CREATE TABLE handle_reservations (
+    handle TEXT PRIMARY KEY,
+    reserved_by TEXT NOT NULL,
+    created_at TIMESTAMPTZ NOT NULL DEFAULT NOW(),
+    expires_at TIMESTAMPTZ NOT NULL DEFAULT NOW() + INTERVAL '5 minutes'
+);
+
+CREATE INDEX idx_handle_reservations_expires ON handle_reservations(expires_at);

migrations/20260118_external_identity_email_verified.sql

@@ -0,0 +1,3 @@
+ALTER TABLE external_identities ADD COLUMN provider_email_verified BOOLEAN NOT NULL DEFAULT FALSE;
+
+ALTER TABLE sso_pending_registration ADD COLUMN provider_email_verified BOOLEAN NOT NULL DEFAULT FALSE;

migrations/20260119_add_apple_sso_provider.sql

@@ -0,0 +1 @@
+ALTER TYPE sso_provider_type ADD VALUE IF NOT EXISTS 'apple';