Implement owner setup and browser authentication sessions

db/queries/authentication.sql

@@ -0,0 +1,162 @@
+-- name: CreateOwner :one
+INSERT INTO users (username, username_key, display_name, password_hash)
+VALUES (
+    sqlc.arg(username),
+    sqlc.arg(username_key),
+    sqlc.arg(display_name),
+    sqlc.arg(password_hash)
+)
+RETURNING id::TEXT AS id;
+
+-- name: CreateOwnerRootNode :one
+INSERT INTO nodes (
+    owner_id,
+    parent_id,
+    name,
+    name_key,
+    node_type,
+    size_bytes,
+    node_revision,
+    content_revision,
+    content_modified_at,
+    metadata_updated_at
+)
+VALUES (
+    sqlc.arg(owner_id)::UUID,
+    NULL,
+    'Drive',
+    'drive',
+    'directory',
+    0,
+    1,
+    0,
+    sqlc.arg(created_at),
+    sqlc.arg(created_at)
+)
+RETURNING id::TEXT AS id;
+
+-- name: SetOwnerRootNode :exec
+UPDATE users
+SET root_node_id = sqlc.arg(root_node_id)::UUID,
+    updated_at = sqlc.arg(updated_at)
+WHERE id = sqlc.arg(owner_id)::UUID;
+
+-- name: CreateRecoveryCode :exec
+INSERT INTO recovery_codes (user_id, code_hash)
+VALUES (sqlc.arg(owner_id)::UUID, sqlc.arg(code_hash));
+
+-- name: CreateBrowserSession :one
+INSERT INTO sessions (
+    owner_id,
+    token_hash,
+    csrf_token_hash,
+    remote_address,
+    user_agent,
+    authenticated_at,
+    last_seen_at,
+    expires_at
+)
+VALUES (
+    sqlc.arg(owner_id)::UUID,
+    sqlc.arg(token_hash),
+    sqlc.arg(csrf_token_hash),
+    NULLIF(sqlc.arg(remote_address), '')::INET,
+    NULLIF(sqlc.arg(user_agent), ''),
+    sqlc.arg(authenticated_at),
+    sqlc.arg(authenticated_at),
+    sqlc.arg(expires_at)
+)
+RETURNING id::TEXT AS id;
+
+-- name: CreateInitialRootChange :exec
+INSERT INTO changes (
+    owner_id,
+    event_type,
+    node_id,
+    node_revision,
+    content_revision,
+    resulting_state,
+    mutation_origin,
+    committed_at
+)
+VALUES (
+    sqlc.arg(owner_id)::UUID,
+    'node.created',
+    sqlc.arg(root_node_id)::UUID,
+    1,
+    0,
+    sqlc.arg(resulting_state)::JSONB,
+    sqlc.arg(mutation_origin)::JSONB,
+    sqlc.arg(committed_at)
+);
+
+-- name: CreateAuthenticationAuditEvent :exec
+INSERT INTO audit_events (
+    owner_id,
+    actor,
+    action,
+    resource_type,
+    resource_id,
+    outcome,
+    details,
+    occurred_at
+)
+VALUES (
+    sqlc.arg(owner_id)::UUID,
+    sqlc.arg(actor)::JSONB,
+    sqlc.arg(action),
+    sqlc.arg(resource_type),
+    sqlc.arg(resource_id)::UUID,
+    sqlc.arg(outcome),
+    sqlc.arg(details)::JSONB,
+    sqlc.arg(occurred_at)
+);
+
+-- name: GetOwnerAuthenticationRecord :one
+SELECT
+    id::TEXT AS id,
+    username,
+    username_key,
+    display_name,
+    password_hash
+FROM users
+LIMIT 1;
+
+-- name: GetActiveBrowserSession :one
+SELECT
+    sessions.id::TEXT AS session_id,
+    sessions.owner_id::TEXT AS owner_id,
+    users.username,
+    users.display_name,
+    sessions.csrf_token_hash,
+    sessions.authenticated_at,
+    sessions.last_seen_at,
+    sessions.expires_at
+FROM sessions
+JOIN users ON users.id = sessions.owner_id
+WHERE sessions.token_hash = sqlc.arg(token_hash)
+  AND sessions.revoked_at IS NULL
+  AND sessions.expires_at > sqlc.arg(now_at)
+LIMIT 1;
+
+-- name: TouchBrowserSession :exec
+UPDATE sessions
+SET last_seen_at = sqlc.arg(seen_at)
+WHERE id = sqlc.arg(session_id)::UUID
+  AND revoked_at IS NULL;
+
+-- name: RevokeBrowserSession :execrows
+UPDATE sessions
+SET revoked_at = sqlc.arg(revoked_at)
+WHERE id = sqlc.arg(session_id)::UUID
+  AND revoked_at IS NULL;
+
+-- name: GetAuthenticationInvariantCounts :one
+SELECT
+    (SELECT count(*) FROM users)::BIGINT AS owners,
+    (SELECT count(*) FROM nodes WHERE parent_id IS NULL)::BIGINT AS roots,
+    (SELECT count(*) FROM recovery_codes)::BIGINT AS recovery_codes,
+    (SELECT count(*) FROM changes)::BIGINT AS changes,
+    (SELECT count(*) FROM audit_events)::BIGINT AS audit_events,
+    (SELECT count(*) FROM sessions)::BIGINT AS sessions,
+    (SELECT count(*) FROM sessions WHERE revoked_at IS NULL)::BIGINT AS active_sessions;