Implement owner setup and browser authentication sessions

internal/adapters/authn/credentials.go

@@ -0,0 +1,46 @@
+package authn
+
+import (
+	"crypto/rand"
+	"crypto/sha256"
+	"encoding/base32"
+	"encoding/base64"
+	"fmt"
+	"strings"
+	"time"
+
+	"drive.local/drivev2/internal/application"
+)
+
+type CredentialGenerator struct{}
+
+func (CredentialGenerator) NewCredential() (application.GeneratedCredential, error) {
+	secret := make([]byte, 32)
+	if _, err := rand.Read(secret); err != nil {
+		return application.GeneratedCredential{}, fmt.Errorf("generate credential: %w", err)
+	}
+	plaintext := base64.RawURLEncoding.EncodeToString(secret)
+	digest := sha256.Sum256([]byte(plaintext))
+	return application.GeneratedCredential{Plaintext: plaintext, Digest: digest[:]}, nil
+}
+
+func (CredentialGenerator) NewRecoveryCodes(count int) ([]application.GeneratedCredential, error) {
+	codes := make([]application.GeneratedCredential, 0, count)
+	for range count {
+		raw := make([]byte, 12)
+		if _, err := rand.Read(raw); err != nil {
+			return nil, fmt.Errorf("generate recovery code: %w", err)
+		}
+		encoded := base32.StdEncoding.WithPadding(base32.NoPadding).EncodeToString(raw)
+		plaintext := strings.Join([]string{encoded[0:5], encoded[5:10], encoded[10:15], encoded[15:20]}, "-")
+		digest := sha256.Sum256([]byte(plaintext))
+		codes = append(codes, application.GeneratedCredential{Plaintext: plaintext, Digest: digest[:]})
+	}
+	return codes, nil
+}
+
+type SystemClock struct{}
+
+func (SystemClock) Now() time.Time {
+	return time.Now()
+}

internal/adapters/authn/password.go

@@ -0,0 +1,127 @@
+// Package authn implements password hashing and high-entropy credential generation.
+package authn
+
+import (
+	"crypto/rand"
+	"crypto/subtle"
+	"encoding/base64"
+	"errors"
+	"fmt"
+	"strconv"
+	"strings"
+
+	"golang.org/x/crypto/argon2"
+)
+
+var ErrInvalidPasswordHash = errors.New("invalid password hash")
+
+type Argon2Parameters struct {
+	MemoryKiB uint32
+	Time      uint32
+	Threads   uint8
+	SaltBytes uint32
+	KeyBytes  uint32
+}
+
+type PasswordHasher struct {
+	parameters Argon2Parameters
+}
+
+func NewPasswordHasher() PasswordHasher {
+	return PasswordHasher{parameters: Argon2Parameters{
+		MemoryKiB: 64 * 1024,
+		Time:      3,
+		Threads:   4,
+		SaltBytes: 16,
+		KeyBytes:  32,
+	}}
+}
+
+func newPasswordHasher(parameters Argon2Parameters) PasswordHasher {
+	return PasswordHasher{parameters: parameters}
+}
+
+func (h PasswordHasher) Hash(password string) (string, error) {
+	salt := make([]byte, h.parameters.SaltBytes)
+	if _, err := rand.Read(salt); err != nil {
+		return "", fmt.Errorf("generate password salt: %w", err)
+	}
+	derived := argon2.IDKey([]byte(password), salt, h.parameters.Time, h.parameters.MemoryKiB, h.parameters.Threads, h.parameters.KeyBytes)
+	return fmt.Sprintf(
+		"$argon2id$v=%d$m=%d,t=%d,p=%d$%s$%s",
+		argon2.Version,
+		h.parameters.MemoryKiB,
+		h.parameters.Time,
+		h.parameters.Threads,
+		base64.RawStdEncoding.EncodeToString(salt),
+		base64.RawStdEncoding.EncodeToString(derived),
+	), nil
+}
+
+func (h PasswordHasher) Verify(password, encoded string) (bool, error) {
+	parameters, salt, expected, err := parsePasswordHash(encoded)
+	if err != nil {
+		return false, err
+	}
+	actual := argon2.IDKey([]byte(password), salt, parameters.Time, parameters.MemoryKiB, parameters.Threads, uint32(len(expected)))
+	return subtle.ConstantTimeCompare(actual, expected) == 1, nil
+}
+
+func parsePasswordHash(encoded string) (Argon2Parameters, []byte, []byte, error) {
+	parts := strings.Split(encoded, "$")
+	if len(parts) != 6 || parts[0] != "" || parts[1] != "argon2id" {
+		return Argon2Parameters{}, nil, nil, ErrInvalidPasswordHash
+	}
+
+	version, err := parseNamedUint(parts[2], "v", 8)
+	if err != nil || version != argon2.Version {
+		return Argon2Parameters{}, nil, nil, ErrInvalidPasswordHash
+	}
+	parameters, err := parseArgon2Parameters(parts[3])
+	if err != nil {
+		return Argon2Parameters{}, nil, nil, err
+	}
+	salt, err := base64.RawStdEncoding.Strict().DecodeString(parts[4])
+	if err != nil || len(salt) < 16 || len(salt) > 64 {
+		return Argon2Parameters{}, nil, nil, ErrInvalidPasswordHash
+	}
+	derived, err := base64.RawStdEncoding.Strict().DecodeString(parts[5])
+	if err != nil || len(derived) < 16 || len(derived) > 64 {
+		return Argon2Parameters{}, nil, nil, ErrInvalidPasswordHash
+	}
+	parameters.SaltBytes = uint32(len(salt))
+	parameters.KeyBytes = uint32(len(derived))
+	return parameters, salt, derived, nil
+}
+
+func parseArgon2Parameters(value string) (Argon2Parameters, error) {
+	parts := strings.Split(value, ",")
+	if len(parts) != 3 {
+		return Argon2Parameters{}, ErrInvalidPasswordHash
+	}
+	memory, err := parseNamedUint(parts[0], "m", 32)
+	if err != nil || memory < 8*1024 || memory > 1024*1024 {
+		return Argon2Parameters{}, ErrInvalidPasswordHash
+	}
+	timeCost, err := parseNamedUint(parts[1], "t", 32)
+	if err != nil || timeCost == 0 || timeCost > 10 {
+		return Argon2Parameters{}, ErrInvalidPasswordHash
+	}
+	threads, err := parseNamedUint(parts[2], "p", 8)
+	if err != nil || threads == 0 || threads > 16 {
+		return Argon2Parameters{}, ErrInvalidPasswordHash
+	}
+	return Argon2Parameters{MemoryKiB: uint32(memory), Time: uint32(timeCost), Threads: uint8(threads)}, nil
+}
+
+func parseNamedUint(value, name string, bitSize int) (uint64, error) {
+	prefix := name + "="
+	if !strings.HasPrefix(value, prefix) {
+		return 0, ErrInvalidPasswordHash
+	}
+	parsed, err := strconv.ParseUint(strings.TrimPrefix(value, prefix), 10, bitSize)
+	if err != nil {
+		return 0, ErrInvalidPasswordHash
+	}
+	return parsed, nil
+}

internal/adapters/authn/password_test.go

@@ -0,0 +1,40 @@
+package authn
+
+import (
+	"errors"
+	"testing"
+)
+
+func TestPasswordHasherRoundTrip(t *testing.T) {
+	t.Parallel()
+
+	hasher := newPasswordHasher(Argon2Parameters{MemoryKiB: 8 * 1024, Time: 1, Threads: 1, SaltBytes: 16, KeyBytes: 32})
+	encoded, err := hasher.Hash("a correct horse battery staple")
+	if err != nil {
+		t.Fatalf("Hash returned an error: %v", err)
+	}
+	valid, err := hasher.Verify("a correct horse battery staple", encoded)
+	if err != nil {
+		t.Fatalf("Verify returned an error: %v", err)
+	}
+	if !valid {
+		t.Fatal("Verify = false, want true")
+	}
+	valid, err = hasher.Verify("wrong password", encoded)
+	if err != nil {
+		t.Fatalf("Verify wrong password returned an error: %v", err)
+	}
+	if valid {
+		t.Fatal("Verify wrong password = true, want false")
+	}
+}
+
+func TestPasswordHasherRejectsUnboundedParameters(t *testing.T) {
+	t.Parallel()
+
+	hasher := NewPasswordHasher()
+	_, err := hasher.Verify("password", "$argon2id$v=19$m=4294967295,t=3,p=4$c2FsdHNhbHRzYWx0c2FsdA$ZGVyaXZlZGRlcml2ZWRkZXJpdmVkZGVyaXZlZA")
+	if !errors.Is(err, ErrInvalidPasswordHash) {
+		t.Fatalf("Verify error = %v, want %v", err, ErrInvalidPasswordHash)
+	}
+}

internal/adapters/postgres/authentication.go

@@ -0,0 +1,214 @@
+package postgres
+
+import (
+	"context"
+	"errors"
+	"fmt"
+	"time"
+
+	dbgen "drive.local/drivev2/internal/adapters/postgres/generated"
+	"drive.local/drivev2/internal/application"
+	"github.com/jackc/pgerrcode"
+	"github.com/jackc/pgx/v5"
+	"github.com/jackc/pgx/v5/pgconn"
+	"github.com/jackc/pgx/v5/pgtype"
+)
+
+func (s *Store) WithAuthTransaction(ctx context.Context, operation func(application.AuthTransaction) error) (returnErr error) {
+	transaction, err := s.pool.BeginTx(ctx, pgx.TxOptions{IsoLevel: pgx.Serializable})
+	if err != nil {
+		return fmt.Errorf("begin authentication transaction: %w", err)
+	}
+	defer func() {
+		if err := transaction.Rollback(ctx); err != nil && !errors.Is(err, pgx.ErrTxClosed) {
+			returnErr = errors.Join(returnErr, fmt.Errorf("rollback authentication transaction: %w", err))
+		}
+	}()
+
+	transactionStore := &Store{queries: s.queries.WithTx(transaction)}
+	if err := operation(transactionStore); err != nil {
+		return err
+	}
+	if err := transaction.Commit(ctx); err != nil {
+		return fmt.Errorf("commit authentication transaction: %w", err)
+	}
+	return nil
+}
+
+func (s *Store) CreateOwner(ctx context.Context, record application.CreateOwnerRecord) (string, error) {
+	id, err := s.queries.CreateOwner(ctx, dbgen.CreateOwnerParams{
+		Username: record.Username, UsernameKey: record.UsernameKey, DisplayName: record.DisplayName, PasswordHash: record.PasswordHash,
+	})
+	if ownerAlreadyExists(err) {
+		return "", application.ErrSetupAlreadyComplete
+	}
+	if err != nil {
+		return "", fmt.Errorf("create owner: %w", err)
+	}
+	return id, nil
+}
+
+func (s *Store) CreateOwnerRoot(ctx context.Context, ownerID string, createdAt time.Time) (string, error) {
+	ownerUUID, err := parseUUID(ownerID)
+	if err != nil {
+		return "", err
+	}
+	id, err := s.queries.CreateOwnerRootNode(ctx, dbgen.CreateOwnerRootNodeParams{
+		OwnerID: ownerUUID, CreatedAt: timestamp(createdAt),
+	})
+	if err != nil {
+		return "", fmt.Errorf("create owner root node: %w", err)
+	}
+	return id, nil
+}
+
+func (s *Store) SetOwnerRoot(ctx context.Context, ownerID, rootNodeID string, updatedAt time.Time) error {
+	ownerUUID, err := parseUUID(ownerID)
+	if err != nil {
+		return err
+	}
+	rootUUID, err := parseUUID(rootNodeID)
+	if err != nil {
+		return err
+	}
+	if err := s.queries.SetOwnerRootNode(ctx, dbgen.SetOwnerRootNodeParams{
+		RootNodeID: rootUUID, UpdatedAt: timestamp(updatedAt), OwnerID: ownerUUID,
+	}); err != nil {
+		return fmt.Errorf("set owner root node: %w", err)
+	}
+	return nil
+}
+
+func (s *Store) CreateRecoveryCode(ctx context.Context, ownerID string, codeHash []byte) error {
+	ownerUUID, err := parseUUID(ownerID)
+	if err != nil {
+		return err
+	}
+	if err := s.queries.CreateRecoveryCode(ctx, dbgen.CreateRecoveryCodeParams{OwnerID: ownerUUID, CodeHash: codeHash}); err != nil {
+		return fmt.Errorf("create recovery code: %w", err)
+	}
+	return nil
+}
+
+func (s *Store) CreateBrowserSession(ctx context.Context, record application.CreateSessionRecord) (string, error) {
+	ownerUUID, err := parseUUID(record.OwnerID)
+	if err != nil {
+		return "", err
+	}
+	id, err := s.queries.CreateBrowserSession(ctx, dbgen.CreateBrowserSessionParams{
+		OwnerID: ownerUUID, TokenHash: record.TokenHash, CsrfTokenHash: record.CSRFTokenHash,
+		RemoteAddress: record.RemoteAddress, UserAgent: record.UserAgent,
+		AuthenticatedAt: timestamp(record.AuthenticatedAt), ExpiresAt: timestamp(record.ExpiresAt),
+	})
+	if err != nil {
+		return "", fmt.Errorf("create browser session: %w", err)
+	}
+	return id, nil
+}
+
+func (s *Store) CreateInitialRootChange(ctx context.Context, record application.InitialRootChangeRecord) error {
+	ownerUUID, err := parseUUID(record.OwnerID)
+	if err != nil {
+		return err
+	}
+	rootUUID, err := parseUUID(record.RootNodeID)
+	if err != nil {
+		return err
+	}
+	if err := s.queries.CreateInitialRootChange(ctx, dbgen.CreateInitialRootChangeParams{
+		OwnerID: ownerUUID, RootNodeID: rootUUID, ResultingState: record.ResultingState,
+		MutationOrigin: record.MutationOrigin, CommittedAt: timestamp(record.CommittedAt),
+	}); err != nil {
+		return fmt.Errorf("create initial root change: %w", err)
+	}
+	return nil
+}
+
+func (s *Store) CreateAuthenticationAudit(ctx context.Context, record application.AuthenticationAuditRecord) error {
+	ownerUUID, err := parseUUID(record.OwnerID)
+	if err != nil {
+		return err
+	}
+	resourceUUID, err := parseUUID(record.ResourceID)
+	if err != nil {
+		return err
+	}
+	resourceType := record.ResourceType
+	if err := s.queries.CreateAuthenticationAuditEvent(ctx, dbgen.CreateAuthenticationAuditEventParams{
+		OwnerID: ownerUUID, Actor: record.Actor, Action: record.Action, ResourceType: &resourceType,
+		ResourceID: resourceUUID, Outcome: record.Outcome, Details: record.Details, OccurredAt: timestamp(record.OccurredAt),
+	}); err != nil {
+		return fmt.Errorf("create authentication audit event: %w", err)
+	}
+	return nil
+}
+
+func (s *Store) GetOwnerAuthenticationRecord(ctx context.Context) (application.OwnerAuthenticationRecord, error) {
+	record, err := s.queries.GetOwnerAuthenticationRecord(ctx)
+	if errors.Is(err, pgx.ErrNoRows) {
+		return application.OwnerAuthenticationRecord{}, application.ErrOwnerNotFound
+	}
+	if err != nil {
+		return application.OwnerAuthenticationRecord{}, fmt.Errorf("get owner authentication record: %w", err)
+	}
+	return application.OwnerAuthenticationRecord{
+		ID: record.ID, Username: record.Username, UsernameKey: record.UsernameKey,
+		DisplayName: record.DisplayName, PasswordHash: record.PasswordHash,
+	}, nil
+}
+
+func (s *Store) GetActiveBrowserSession(ctx context.Context, tokenHash []byte, now time.Time) (application.BrowserSession, error) {
+	record, err := s.queries.GetActiveBrowserSession(ctx, dbgen.GetActiveBrowserSessionParams{TokenHash: tokenHash, NowAt: timestamp(now)})
+	if errors.Is(err, pgx.ErrNoRows) {
+		return application.BrowserSession{}, application.ErrSessionNotFound
+	}
+	if err != nil {
+		return application.BrowserSession{}, fmt.Errorf("get active browser session: %w", err)
+	}
+	return application.BrowserSession{
+		ID: record.SessionID, OwnerID: record.OwnerID, Username: record.Username, DisplayName: record.DisplayName,
+		CSRFTokenHash: record.CsrfTokenHash, AuthenticatedAt: record.AuthenticatedAt.Time,
+		LastSeenAt: record.LastSeenAt.Time, ExpiresAt: record.ExpiresAt.Time,
+	}, nil
+}
+
+func (s *Store) TouchBrowserSession(ctx context.Context, sessionID string, seenAt time.Time) error {
+	sessionUUID, err := parseUUID(sessionID)
+	if err != nil {
+		return err
+	}
+	if err := s.queries.TouchBrowserSession(ctx, dbgen.TouchBrowserSessionParams{SeenAt: timestamp(seenAt), SessionID: sessionUUID}); err != nil {
+		return fmt.Errorf("touch browser session: %w", err)
+	}
+	return nil
+}
+
+func (s *Store) RevokeBrowserSession(ctx context.Context, sessionID string, revokedAt time.Time) (bool, error) {
+	sessionUUID, err := parseUUID(sessionID)
+	if err != nil {
+		return false, err
+	}
+	rows, err := s.queries.RevokeBrowserSession(ctx, dbgen.RevokeBrowserSessionParams{RevokedAt: timestamp(revokedAt), SessionID: sessionUUID})
+	if err != nil {
+		return false, fmt.Errorf("revoke browser session: %w", err)
+	}
+	return rows == 1, nil
+}
+
+func parseUUID(value string) (pgtype.UUID, error) {
+	var parsed pgtype.UUID
+	if err := parsed.Scan(value); err != nil {
+		return pgtype.UUID{}, fmt.Errorf("parse UUID: %w", err)
+	}
+	return parsed, nil
+}
+
+func timestamp(value time.Time) pgtype.Timestamptz {
+	return pgtype.Timestamptz{Time: value, Valid: true}
+}
+
+func ownerAlreadyExists(err error) bool {
+	var postgresError *pgconn.PgError
+	return errors.As(err, &postgresError) && postgresError.Code == pgerrcode.UniqueViolation &&
+		(postgresError.ConstraintName == "users_single_owner" || postgresError.ConstraintName == "users_username_key_unique")
+}

internal/adapters/postgres/generated/authentication.sql.go

@@ -0,0 +1,409 @@
+// Code generated by sqlc. DO NOT EDIT.
+// versions:
+//   sqlc v1.31.1
+// source: authentication.sql
+
+package dbgen
+
+import (
+	"context"
+
+	"github.com/jackc/pgx/v5/pgtype"
+)
+
+const createAuthenticationAuditEvent = `-- name: CreateAuthenticationAuditEvent :exec
+INSERT INTO audit_events (
+    owner_id,
+    actor,
+    action,
+    resource_type,
+    resource_id,
+    outcome,
+    details,
+    occurred_at
+)
+VALUES (
+    $1::UUID,
+    $2::JSONB,
+    $3,
+    $4,
+    $5::UUID,
+    $6,
+    $7::JSONB,
+    $8
+)
+`
+
+type CreateAuthenticationAuditEventParams struct {
+	OwnerID      pgtype.UUID        `db:"owner_id" json:"owner_id"`
+	Actor        []byte             `db:"actor" json:"actor"`
+	Action       string             `db:"action" json:"action"`
+	ResourceType *string            `db:"resource_type" json:"resource_type"`
+	ResourceID   pgtype.UUID        `db:"resource_id" json:"resource_id"`
+	Outcome      string             `db:"outcome" json:"outcome"`
+	Details      []byte             `db:"details" json:"details"`
+	OccurredAt   pgtype.Timestamptz `db:"occurred_at" json:"occurred_at"`
+}
+
+func (q *Queries) CreateAuthenticationAuditEvent(ctx context.Context, arg CreateAuthenticationAuditEventParams) error {
+	_, err := q.db.Exec(ctx, createAuthenticationAuditEvent,
+		arg.OwnerID,
+		arg.Actor,
+		arg.Action,
+		arg.ResourceType,
+		arg.ResourceID,
+		arg.Outcome,
+		arg.Details,
+		arg.OccurredAt,
+	)
+	return err
+}
+
+const createBrowserSession = `-- name: CreateBrowserSession :one
+INSERT INTO sessions (
+    owner_id,
+    token_hash,
+    csrf_token_hash,
+    remote_address,
+    user_agent,
+    authenticated_at,
+    last_seen_at,
+    expires_at
+)
+VALUES (
+    $1::UUID,
+    $2,
+    $3,
+    NULLIF($4, '')::INET,
+    NULLIF($5, ''),
+    $6,
+    $6,
+    $7
+)
+RETURNING id::TEXT AS id
+`
+
+type CreateBrowserSessionParams struct {
+	OwnerID         pgtype.UUID        `db:"owner_id" json:"owner_id"`
+	TokenHash       []byte             `db:"token_hash" json:"token_hash"`
+	CsrfTokenHash   []byte             `db:"csrf_token_hash" json:"csrf_token_hash"`
+	RemoteAddress   interface{}        `db:"remote_address" json:"remote_address"`
+	UserAgent       interface{}        `db:"user_agent" json:"user_agent"`
+	AuthenticatedAt pgtype.Timestamptz `db:"authenticated_at" json:"authenticated_at"`
+	ExpiresAt       pgtype.Timestamptz `db:"expires_at" json:"expires_at"`
+}
+
+func (q *Queries) CreateBrowserSession(ctx context.Context, arg CreateBrowserSessionParams) (string, error) {
+	row := q.db.QueryRow(ctx, createBrowserSession,
+		arg.OwnerID,
+		arg.TokenHash,
+		arg.CsrfTokenHash,
+		arg.RemoteAddress,
+		arg.UserAgent,
+		arg.AuthenticatedAt,
+		arg.ExpiresAt,
+	)
+	var id string
+	err := row.Scan(&id)
+	return id, err
+}
+
+const createInitialRootChange = `-- name: CreateInitialRootChange :exec
+INSERT INTO changes (
+    owner_id,
+    event_type,
+    node_id,
+    node_revision,
+    content_revision,
+    resulting_state,
+    mutation_origin,
+    committed_at
+)
+VALUES (
+    $1::UUID,
+    'node.created',
+    $2::UUID,
+    1,
+    0,
+    $3::JSONB,
+    $4::JSONB,
+    $5
+)
+`
+
+type CreateInitialRootChangeParams struct {
+	OwnerID        pgtype.UUID        `db:"owner_id" json:"owner_id"`
+	RootNodeID     pgtype.UUID        `db:"root_node_id" json:"root_node_id"`
+	ResultingState []byte             `db:"resulting_state" json:"resulting_state"`
+	MutationOrigin []byte             `db:"mutation_origin" json:"mutation_origin"`
+	CommittedAt    pgtype.Timestamptz `db:"committed_at" json:"committed_at"`
+}
+
+func (q *Queries) CreateInitialRootChange(ctx context.Context, arg CreateInitialRootChangeParams) error {
+	_, err := q.db.Exec(ctx, createInitialRootChange,
+		arg.OwnerID,
+		arg.RootNodeID,
+		arg.ResultingState,
+		arg.MutationOrigin,
+		arg.CommittedAt,
+	)
+	return err
+}
+
+const createOwner = `-- name: CreateOwner :one
+INSERT INTO users (username, username_key, display_name, password_hash)
+VALUES (
+    $1,
+    $2,
+    $3,
+    $4
+)
+RETURNING id::TEXT AS id
+`
+
+type CreateOwnerParams struct {
+	Username     string `db:"username" json:"username"`
+	UsernameKey  string `db:"username_key" json:"username_key"`
+	DisplayName  string `db:"display_name" json:"display_name"`
+	PasswordHash string `db:"password_hash" json:"password_hash"`
+}
+
+func (q *Queries) CreateOwner(ctx context.Context, arg CreateOwnerParams) (string, error) {
+	row := q.db.QueryRow(ctx, createOwner,
+		arg.Username,
+		arg.UsernameKey,
+		arg.DisplayName,
+		arg.PasswordHash,
+	)
+	var id string
+	err := row.Scan(&id)
+	return id, err
+}
+
+const createOwnerRootNode = `-- name: CreateOwnerRootNode :one
+INSERT INTO nodes (
+    owner_id,
+    parent_id,
+    name,
+    name_key,
+    node_type,
+    size_bytes,
+    node_revision,
+    content_revision,
+    content_modified_at,
+    metadata_updated_at
+)
+VALUES (
+    $1::UUID,
+    NULL,
+    'Drive',
+    'drive',
+    'directory',
+    0,
+    1,
+    0,
+    $2,
+    $2
+)
+RETURNING id::TEXT AS id
+`
+
+type CreateOwnerRootNodeParams struct {
+	OwnerID   pgtype.UUID        `db:"owner_id" json:"owner_id"`
+	CreatedAt pgtype.Timestamptz `db:"created_at" json:"created_at"`
+}
+
+func (q *Queries) CreateOwnerRootNode(ctx context.Context, arg CreateOwnerRootNodeParams) (string, error) {
+	row := q.db.QueryRow(ctx, createOwnerRootNode, arg.OwnerID, arg.CreatedAt)
+	var id string
+	err := row.Scan(&id)
+	return id, err
+}
+
+const createRecoveryCode = `-- name: CreateRecoveryCode :exec
+INSERT INTO recovery_codes (user_id, code_hash)
+VALUES ($1::UUID, $2)
+`
+
+type CreateRecoveryCodeParams struct {
+	OwnerID  pgtype.UUID `db:"owner_id" json:"owner_id"`
+	CodeHash []byte      `db:"code_hash" json:"code_hash"`
+}
+
+func (q *Queries) CreateRecoveryCode(ctx context.Context, arg CreateRecoveryCodeParams) error {
+	_, err := q.db.Exec(ctx, createRecoveryCode, arg.OwnerID, arg.CodeHash)
+	return err
+}
+
+const getActiveBrowserSession = `-- name: GetActiveBrowserSession :one
+SELECT
+    sessions.id::TEXT AS session_id,
+    sessions.owner_id::TEXT AS owner_id,
+    users.username,
+    users.display_name,
+    sessions.csrf_token_hash,
+    sessions.authenticated_at,
+    sessions.last_seen_at,
+    sessions.expires_at
+FROM sessions
+JOIN users ON users.id = sessions.owner_id
+WHERE sessions.token_hash = $1
+  AND sessions.revoked_at IS NULL
+  AND sessions.expires_at > $2
+LIMIT 1
+`
+
+type GetActiveBrowserSessionParams struct {
+	TokenHash []byte             `db:"token_hash" json:"token_hash"`
+	NowAt     pgtype.Timestamptz `db:"now_at" json:"now_at"`
+}
+
+type GetActiveBrowserSessionRow struct {
+	SessionID       string             `db:"session_id" json:"session_id"`
+	OwnerID         string             `db:"owner_id" json:"owner_id"`
+	Username        string             `db:"username" json:"username"`
+	DisplayName     string             `db:"display_name" json:"display_name"`
+	CsrfTokenHash   []byte             `db:"csrf_token_hash" json:"csrf_token_hash"`
+	AuthenticatedAt pgtype.Timestamptz `db:"authenticated_at" json:"authenticated_at"`
+	LastSeenAt      pgtype.Timestamptz `db:"last_seen_at" json:"last_seen_at"`
+	ExpiresAt       pgtype.Timestamptz `db:"expires_at" json:"expires_at"`
+}
+
+func (q *Queries) GetActiveBrowserSession(ctx context.Context, arg GetActiveBrowserSessionParams) (GetActiveBrowserSessionRow, error) {
+	row := q.db.QueryRow(ctx, getActiveBrowserSession, arg.TokenHash, arg.NowAt)
+	var i GetActiveBrowserSessionRow
+	err := row.Scan(
+		&i.SessionID,
+		&i.OwnerID,
+		&i.Username,
+		&i.DisplayName,
+		&i.CsrfTokenHash,
+		&i.AuthenticatedAt,
+		&i.LastSeenAt,
+		&i.ExpiresAt,
+	)
+	return i, err
+}
+
+const getAuthenticationInvariantCounts = `-- name: GetAuthenticationInvariantCounts :one
+SELECT
+    (SELECT count(*) FROM users)::BIGINT AS owners,
+    (SELECT count(*) FROM nodes WHERE parent_id IS NULL)::BIGINT AS roots,
+    (SELECT count(*) FROM recovery_codes)::BIGINT AS recovery_codes,
+    (SELECT count(*) FROM changes)::BIGINT AS changes,
+    (SELECT count(*) FROM audit_events)::BIGINT AS audit_events,
+    (SELECT count(*) FROM sessions)::BIGINT AS sessions,
+    (SELECT count(*) FROM sessions WHERE revoked_at IS NULL)::BIGINT AS active_sessions
+`
+
+type GetAuthenticationInvariantCountsRow struct {
+	Owners         int64 `db:"owners" json:"owners"`
+	Roots          int64 `db:"roots" json:"roots"`
+	RecoveryCodes  int64 `db:"recovery_codes" json:"recovery_codes"`
+	Changes        int64 `db:"changes" json:"changes"`
+	AuditEvents    int64 `db:"audit_events" json:"audit_events"`
+	Sessions       int64 `db:"sessions" json:"sessions"`
+	ActiveSessions int64 `db:"active_sessions" json:"active_sessions"`
+}
+
+func (q *Queries) GetAuthenticationInvariantCounts(ctx context.Context) (GetAuthenticationInvariantCountsRow, error) {
+	row := q.db.QueryRow(ctx, getAuthenticationInvariantCounts)
+	var i GetAuthenticationInvariantCountsRow
+	err := row.Scan(
+		&i.Owners,
+		&i.Roots,
+		&i.RecoveryCodes,
+		&i.Changes,
+		&i.AuditEvents,
+		&i.Sessions,
+		&i.ActiveSessions,
+	)
+	return i, err
+}
+
+const getOwnerAuthenticationRecord = `-- name: GetOwnerAuthenticationRecord :one
+SELECT
+    id::TEXT AS id,
+    username,
+    username_key,
+    display_name,
+    password_hash
+FROM users
+LIMIT 1
+`
+
+type GetOwnerAuthenticationRecordRow struct {
+	ID           string `db:"id" json:"id"`
+	Username     string `db:"username" json:"username"`
+	UsernameKey  string `db:"username_key" json:"username_key"`
+	DisplayName  string `db:"display_name" json:"display_name"`
+	PasswordHash string `db:"password_hash" json:"password_hash"`
+}
+
+func (q *Queries) GetOwnerAuthenticationRecord(ctx context.Context) (GetOwnerAuthenticationRecordRow, error) {
+	row := q.db.QueryRow(ctx, getOwnerAuthenticationRecord)
+	var i GetOwnerAuthenticationRecordRow
+	err := row.Scan(
+		&i.ID,
+		&i.Username,
+		&i.UsernameKey,
+		&i.DisplayName,
+		&i.PasswordHash,
+	)
+	return i, err
+}
+
+const revokeBrowserSession = `-- name: RevokeBrowserSession :execrows
+UPDATE sessions
+SET revoked_at = $1
+WHERE id = $2::UUID
+  AND revoked_at IS NULL
+`
+
+type RevokeBrowserSessionParams struct {
+	RevokedAt pgtype.Timestamptz `db:"revoked_at" json:"revoked_at"`
+	SessionID pgtype.UUID        `db:"session_id" json:"session_id"`
+}
+
+func (q *Queries) RevokeBrowserSession(ctx context.Context, arg RevokeBrowserSessionParams) (int64, error) {
+	result, err := q.db.Exec(ctx, revokeBrowserSession, arg.RevokedAt, arg.SessionID)
+	if err != nil {
+		return 0, err
+	}
+	return result.RowsAffected(), nil
+}
+
+const setOwnerRootNode = `-- name: SetOwnerRootNode :exec
+UPDATE users
+SET root_node_id = $1::UUID,
+    updated_at = $2
+WHERE id = $3::UUID
+`
+
+type SetOwnerRootNodeParams struct {
+	RootNodeID pgtype.UUID        `db:"root_node_id" json:"root_node_id"`
+	UpdatedAt  pgtype.Timestamptz `db:"updated_at" json:"updated_at"`
+	OwnerID    pgtype.UUID        `db:"owner_id" json:"owner_id"`
+}
+
+func (q *Queries) SetOwnerRootNode(ctx context.Context, arg SetOwnerRootNodeParams) error {
+	_, err := q.db.Exec(ctx, setOwnerRootNode, arg.RootNodeID, arg.UpdatedAt, arg.OwnerID)
+	return err
+}
+
+const touchBrowserSession = `-- name: TouchBrowserSession :exec
+UPDATE sessions
+SET last_seen_at = $1
+WHERE id = $2::UUID
+  AND revoked_at IS NULL
+`
+
+type TouchBrowserSessionParams struct {
+	SeenAt    pgtype.Timestamptz `db:"seen_at" json:"seen_at"`
+	SessionID pgtype.UUID        `db:"session_id" json:"session_id"`
+}
+
+func (q *Queries) TouchBrowserSession(ctx context.Context, arg TouchBrowserSessionParams) error {
+	_, err := q.db.Exec(ctx, touchBrowserSession, arg.SeenAt, arg.SessionID)
+	return err
+}

internal/adapters/postgres/generated/querier.go

@@ -9,8 +9,20 @@ import (
 )
 
 type Querier interface {
+	CreateAuthenticationAuditEvent(ctx context.Context, arg CreateAuthenticationAuditEventParams) error
+	CreateBrowserSession(ctx context.Context, arg CreateBrowserSessionParams) (string, error)
+	CreateInitialRootChange(ctx context.Context, arg CreateInitialRootChangeParams) error
+	CreateOwner(ctx context.Context, arg CreateOwnerParams) (string, error)
+	CreateOwnerRootNode(ctx context.Context, arg CreateOwnerRootNodeParams) (string, error)
+	CreateRecoveryCode(ctx context.Context, arg CreateRecoveryCodeParams) error
 	DatabaseHealth(ctx context.Context) (int64, error)
+	GetActiveBrowserSession(ctx context.Context, arg GetActiveBrowserSessionParams) (GetActiveBrowserSessionRow, error)
+	GetAuthenticationInvariantCounts(ctx context.Context) (GetAuthenticationInvariantCountsRow, error)
+	GetOwnerAuthenticationRecord(ctx context.Context) (GetOwnerAuthenticationRecordRow, error)
 	OwnerExists(ctx context.Context) (bool, error)
+	RevokeBrowserSession(ctx context.Context, arg RevokeBrowserSessionParams) (int64, error)
+	SetOwnerRootNode(ctx context.Context, arg SetOwnerRootNodeParams) error
+	TouchBrowserSession(ctx context.Context, arg TouchBrowserSessionParams) error
 }
 
 var _ Querier = (*Queries)(nil)

internal/adapters/postgres/migrate_integration_test.go

@@ -2,11 +2,26 @@ package postgres
 
 import (
 	"context"
+	"errors"
 	"os"
+	"sync"
 	"testing"
 	"time"
+
+	"drive.local/drivev2/internal/adapters/authn"
+	"drive.local/drivev2/internal/application"
 )
 
+type integrationPasswordHasher struct{}
+
+func (integrationPasswordHasher) Hash(password string) (string, error) {
+	return "integration:" + password, nil
+}
+
+func (integrationPasswordHasher) Verify(password, encoded string) (bool, error) {
+	return encoded == "integration:"+password, nil
+}
+
 func TestMigrationsAndStore(t *testing.T) {
 	databaseURL := os.Getenv("DRIVE_TEST_DATABASE_URL")
 	if databaseURL == "" {
@@ -38,4 +53,85 @@ func TestMigrationsAndStore(t *testing.T) {
 	if initialized {
 		t.Fatal("OwnerExists = true on a fresh database, want false")
 	}
+
+	authentication := application.NewAuthenticationService(
+		store,
+		integrationPasswordHasher{},
+		authn.CredentialGenerator{},
+		authn.SystemClock{},
+	)
+	inputs := []application.SetupOwnerInput{
+		{Username: "owner-one", DisplayName: "Owner One", Password: "correct horse battery staple"},
+		{Username: "owner-two", DisplayName: "Owner Two", Password: "correct horse battery staple"},
+	}
+	results := make([]application.SetupOwnerResult, len(inputs))
+	errorsByAttempt := make([]error, len(inputs))
+	var waitGroup sync.WaitGroup
+	for index := range inputs {
+		waitGroup.Add(1)
+		go func() {
+			defer waitGroup.Done()
+			results[index], errorsByAttempt[index] = authentication.SetupOwner(ctx, inputs[index])
+		}()
+	}
+	waitGroup.Wait()
+
+	winner := -1
+	losers := 0
+	for index, setupErr := range errorsByAttempt {
+		switch {
+		case setupErr == nil:
+			winner = index
+		case errors.Is(setupErr, application.ErrSetupAlreadyComplete):
+			losers++
+		default:
+			t.Fatalf("setup attempt %d returned unexpected error: %v", index, setupErr)
+		}
+	}
+	if winner < 0 || losers != 1 {
+		t.Fatalf("winner = %d, losing attempts = %d, want one of each", winner, losers)
+	}
+	if len(results[winner].RecoveryCodes) != application.RecoveryCodeCount {
+		t.Fatalf("recovery code count = %d, want %d", len(results[winner].RecoveryCodes), application.RecoveryCodeCount)
+	}
+
+	counts, err := store.queries.GetAuthenticationInvariantCounts(ctx)
+	if err != nil {
+		t.Fatalf("GetAuthenticationInvariantCounts returned an error: %v", err)
+	}
+	if counts.Owners != 1 || counts.Roots != 1 || counts.RecoveryCodes != 10 || counts.Changes != 1 ||
+		counts.AuditEvents != 1 || counts.Sessions != 1 || counts.ActiveSessions != 1 {
+		t.Fatalf("unexpected post-setup counts: %#v", counts)
+	}
+
+	loggedIn, err := authentication.Login(ctx, application.LoginInput{
+		Username: inputs[winner].Username, Password: inputs[winner].Password,
+	})
+	if err != nil {
+		t.Fatalf("Login returned an error: %v", err)
+	}
+	current, err := authentication.CurrentSession(ctx, loggedIn.SessionToken)
+	if err != nil {
+		t.Fatalf("CurrentSession returned an error: %v", err)
+	}
+	if current.ID != loggedIn.Session.ID {
+		t.Fatalf("current session ID = %q, want %q", current.ID, loggedIn.Session.ID)
+	}
+	if err := authentication.Logout(ctx, loggedIn.SessionToken, loggedIn.CSRFToken, "wrong-csrf"); !errors.Is(err, application.ErrCSRFValidation) {
+		t.Fatalf("Logout with invalid CSRF error = %v, want %v", err, application.ErrCSRFValidation)
+	}
+	if err := authentication.Logout(ctx, loggedIn.SessionToken, loggedIn.CSRFToken, loggedIn.CSRFToken); err != nil {
+		t.Fatalf("Logout returned an error: %v", err)
+	}
+	if _, err := authentication.CurrentSession(ctx, loggedIn.SessionToken); !errors.Is(err, application.ErrSessionNotFound) {
+		t.Fatalf("CurrentSession after logout error = %v, want %v", err, application.ErrSessionNotFound)
+	}
+
+	counts, err = store.queries.GetAuthenticationInvariantCounts(ctx)
+	if err != nil {
+		t.Fatalf("GetAuthenticationInvariantCounts after logout returned an error: %v", err)
+	}
+	if counts.Sessions != 2 || counts.ActiveSessions != 1 || counts.AuditEvents != 3 {
+		t.Fatalf("unexpected post-logout counts: %#v", counts)
+	}
 }