feat(reui): update ReUI components and documentation

- Added new OIDC configuration options in `.env.example`. - Expanded documentation in `AGENTS.md` to include OIDC endpoints and admin UI. - Updated ReUI skill version and component count from 17 to 20 across various documentation files. - Enhanced `README.md` and other related files to reflect the new component structure and usage guidelines. Co-authored-by: Cursor <[email protected]>
2026-08-11 16:58:47 +07:00
parent cc38bf06f8
commit 0b6fa65b08
61 changed files with 2387 additions and 103 deletions
@@ -142,6 +142,46 @@ export function migrateSchema(sqlite: Sqlite): void {
    CREATE INDEX IF NOT EXISTS idx_audit_log_source ON audit_log(source_app, created_at);
    CREATE UNIQUE INDEX IF NOT EXISTS idx_audit_log_event_id ON audit_log(event_id) WHERE event_id IS NOT NULL;
  `)
+
+  sqlite.exec(`
+    CREATE TABLE IF NOT EXISTS oidc_clients (
+      id TEXT PRIMARY KEY NOT NULL,
+      client_id TEXT NOT NULL UNIQUE,
+      client_secret_hash TEXT NOT NULL,
+      name TEXT NOT NULL,
+      redirect_uris_json TEXT NOT NULL,
+      scopes_json TEXT NOT NULL,
+      enabled INTEGER NOT NULL DEFAULT 1,
+      created_at TEXT NOT NULL,
+      updated_at TEXT NOT NULL
+    );
+
+    CREATE TABLE IF NOT EXISTS oidc_auth_codes (
+      id TEXT PRIMARY KEY NOT NULL,
+      code_hash TEXT NOT NULL UNIQUE,
+      client_id TEXT NOT NULL,
+      user_id TEXT NOT NULL REFERENCES users(id) ON DELETE CASCADE,
+      redirect_uri TEXT NOT NULL,
+      scope TEXT NOT NULL,
+      nonce TEXT,
+      code_challenge TEXT,
+      code_challenge_method TEXT,
+      expires_at TEXT NOT NULL,
+      used_at TEXT,
+      created_at TEXT NOT NULL
+    );
+
+    CREATE TABLE IF NOT EXISTS oidc_signing_keys (
+      kid TEXT PRIMARY KEY NOT NULL,
+      private_pem TEXT NOT NULL,
+      public_jwk_json TEXT NOT NULL,
+      active INTEGER NOT NULL DEFAULT 1,
+      created_at TEXT NOT NULL
+    );
+
+    CREATE INDEX IF NOT EXISTS idx_oidc_auth_codes_client ON oidc_auth_codes(client_id);
+    CREATE INDEX IF NOT EXISTS idx_oidc_auth_codes_user ON oidc_auth_codes(user_id);
+  `)
 }

 export function healthCheck(sqlite: Sqlite): void {
@@ -152,3 +192,4 @@ export * from './schema/index.js'
 export * from './users.js'
 export * from './settings.js'
 export * from './audit-log.js'
+export * from './oidc.js'
@@ -0,0 +1,219 @@
+import { and, eq, isNull } from 'drizzle-orm'
+import { randomBytes, randomUUID } from 'node:crypto'
+import type { AppDb } from './index.js'
+import { oidcAuthCodes, oidcClients, oidcSigningKeys } from './schema/index.js'
+import { hashToken } from './users.js'
+
+export type OidcClientRow = typeof oidcClients.$inferSelect
+export type OidcAuthCodeRow = typeof oidcAuthCodes.$inferSelect
+export type OidcSigningKeyRow = typeof oidcSigningKeys.$inferSelect
+
+export function parseJsonStringArray(raw: string): string[] {
+  try {
+    const v = JSON.parse(raw) as unknown
+    if (!Array.isArray(v)) return []
+    return v.filter((x): x is string => typeof x === 'string')
+  } catch {
+    return []
+  }
+}
+
+export function listOidcClients(db: AppDb): OidcClientRow[] {
+  return db
+    .select()
+    .from(oidcClients)
+    .all()
+    .sort((a, b) => (a.createdAt < b.createdAt ? 1 : -1))
+}
+
+export function getOidcClientById(
+  db: AppDb,
+  id: string,
+): OidcClientRow | undefined {
+  return db.select().from(oidcClients).where(eq(oidcClients.id, id)).get()
+}
+
+export function getOidcClientByClientId(
+  db: AppDb,
+  clientId: string,
+): OidcClientRow | undefined {
+  return db
+    .select()
+    .from(oidcClients)
+    .where(eq(oidcClients.clientId, clientId))
+    .get()
+}
+
+export function createOidcClient(
+  db: AppDb,
+  input: {
+    name: string
+    clientSecretHash: string
+    redirectUris: string[]
+    scopes: string[]
+    enabled: boolean
+    clientId?: string
+  },
+): OidcClientRow {
+  const now = new Date().toISOString()
+  const id = randomUUID()
+  const clientId = input.clientId ?? randomUUID()
+  db.insert(oidcClients)
+    .values({
+      id,
+      clientId,
+      clientSecretHash: input.clientSecretHash,
+      name: input.name,
+      redirectUrisJson: JSON.stringify(input.redirectUris),
+      scopesJson: JSON.stringify(input.scopes),
+      enabled: input.enabled,
+      createdAt: now,
+      updatedAt: now,
+    })
+    .run()
+  return getOidcClientById(db, id)!
+}
+
+export function updateOidcClient(
+  db: AppDb,
+  id: string,
+  patch: {
+    name?: string
+    redirectUris?: string[]
+    scopes?: string[]
+    enabled?: boolean
+    clientSecretHash?: string
+  },
+): OidcClientRow | undefined {
+  const existing = getOidcClientById(db, id)
+  if (!existing) return undefined
+  const now = new Date().toISOString()
+  db.update(oidcClients)
+    .set({
+      name: patch.name ?? existing.name,
+      redirectUrisJson: patch.redirectUris
+        ? JSON.stringify(patch.redirectUris)
+        : existing.redirectUrisJson,
+      scopesJson: patch.scopes
+        ? JSON.stringify(patch.scopes)
+        : existing.scopesJson,
+      enabled: patch.enabled ?? existing.enabled,
+      clientSecretHash: patch.clientSecretHash ?? existing.clientSecretHash,
+      updatedAt: now,
+    })
+    .where(eq(oidcClients.id, id))
+    .run()
+  return getOidcClientById(db, id)
+}
+
+export function deleteOidcClient(db: AppDb, id: string): boolean {
+  const result = db.delete(oidcClients).where(eq(oidcClients.id, id)).run()
+  return result.changes > 0
+}
+
+export function generateOidcClientSecret(): string {
+  return randomBytes(32).toString('base64url')
+}
+
+export function createOidcAuthCode(
+  db: AppDb,
+  input: {
+    rawCode: string
+    clientId: string
+    userId: string
+    redirectUri: string
+    scope: string
+    nonce?: string | null
+    codeChallenge?: string | null
+    codeChallengeMethod?: string | null
+    expiresAt: Date
+  },
+): string {
+  const id = randomUUID()
+  db.insert(oidcAuthCodes)
+    .values({
+      id,
+      codeHash: hashToken(input.rawCode),
+      clientId: input.clientId,
+      userId: input.userId,
+      redirectUri: input.redirectUri,
+      scope: input.scope,
+      nonce: input.nonce ?? null,
+      codeChallenge: input.codeChallenge ?? null,
+      codeChallengeMethod: input.codeChallengeMethod ?? null,
+      expiresAt: input.expiresAt.toISOString(),
+      usedAt: null,
+      createdAt: new Date().toISOString(),
+    })
+    .run()
+  return id
+}
+
+export function consumeOidcAuthCode(
+  db: AppDb,
+  rawCode: string,
+): OidcAuthCodeRow | undefined {
+  const codeHash = hashToken(rawCode)
+  const row = db
+    .select()
+    .from(oidcAuthCodes)
+    .where(
+      and(eq(oidcAuthCodes.codeHash, codeHash), isNull(oidcAuthCodes.usedAt)),
+    )
+    .get()
+  if (!row) return undefined
+  const now = new Date().toISOString()
+  if (row.expiresAt < now) return undefined
+  db.update(oidcAuthCodes)
+    .set({ usedAt: now })
+    .where(eq(oidcAuthCodes.id, row.id))
+    .run()
+  return row
+}
+
+export function getActiveOidcSigningKey(
+  db: AppDb,
+): OidcSigningKeyRow | undefined {
+  return db
+    .select()
+    .from(oidcSigningKeys)
+    .where(eq(oidcSigningKeys.active, true))
+    .all()
+    .sort((a, b) => (a.createdAt < b.createdAt ? 1 : -1))[0]
+}
+
+export function listOidcSigningKeys(db: AppDb): OidcSigningKeyRow[] {
+  return db.select().from(oidcSigningKeys).all()
+}
+
+export function insertOidcSigningKey(
+  db: AppDb,
+  input: {
+    kid: string
+    privatePem: string
+    publicJwkJson: string
+  },
+): OidcSigningKeyRow {
+  for (const key of listOidcSigningKeys(db)) {
+    if (key.active) {
+      db.update(oidcSigningKeys)
+        .set({ active: false })
+        .where(eq(oidcSigningKeys.kid, key.kid))
+        .run()
+    }
+  }
+  db.insert(oidcSigningKeys)
+    .values({
+      kid: input.kid,
+      privatePem: input.privatePem,
+      publicJwkJson: input.publicJwkJson,
+      active: true,
+      createdAt: new Date().toISOString(),
+    })
+    .run()
+  return db
+    .select()
+    .from(oidcSigningKeys)
+    .where(eq(oidcSigningKeys.kid, input.kid))
+    .get()!
+}
@@ -64,3 +64,40 @@ export const auditLog = sqliteTable('audit_log', {
  ip: text('ip'),
  createdAt: text('created_at').notNull(),
 })
+
+export const oidcClients = sqliteTable('oidc_clients', {
+  id: text('id').primaryKey(),
+  clientId: text('client_id').notNull().unique(),
+  clientSecretHash: text('client_secret_hash').notNull(),
+  name: text('name').notNull(),
+  redirectUrisJson: text('redirect_uris_json').notNull(),
+  scopesJson: text('scopes_json').notNull(),
+  enabled: integer('enabled', { mode: 'boolean' }).notNull().default(true),
+  createdAt: text('created_at').notNull(),
+  updatedAt: text('updated_at').notNull(),
+})
+
+export const oidcAuthCodes = sqliteTable('oidc_auth_codes', {
+  id: text('id').primaryKey(),
+  codeHash: text('code_hash').notNull().unique(),
+  clientId: text('client_id').notNull(),
+  userId: text('user_id')
+    .notNull()
+    .references(() => users.id, { onDelete: 'cascade' }),
+  redirectUri: text('redirect_uri').notNull(),
+  scope: text('scope').notNull(),
+  nonce: text('nonce'),
+  codeChallenge: text('code_challenge'),
+  codeChallengeMethod: text('code_challenge_method'),
+  expiresAt: text('expires_at').notNull(),
+  usedAt: text('used_at'),
+  createdAt: text('created_at').notNull(),
+})
+
+export const oidcSigningKeys = sqliteTable('oidc_signing_keys', {
+  kid: text('kid').primaryKey(),
+  privatePem: text('private_pem').notNull(),
+  publicJwkJson: text('public_jwk_json').notNull(),
+  active: integer('active', { mode: 'boolean' }).notNull().default(true),
+  createdAt: text('created_at').notNull(),
+})
@@ -177,6 +177,24 @@ export function revokeRefreshSession(db: AppDb, rawToken: string): void {
    .run()
 }

+/** Active refresh session → user (for OIDC authorize cookie). */
+export function getUserByRefreshToken(
+  db: AppDb,
+  rawToken: string,
+): UserRow | undefined {
+  const now = new Date().toISOString()
+  const session = db
+    .select()
+    .from(refreshSessions)
+    .where(eq(refreshSessions.tokenHash, hashToken(rawToken)))
+    .get()
+  if (!session || session.revokedAt) return undefined
+  if (session.expiresAt < now) return undefined
+  const user = getUserById(db, session.userId)
+  if (!user || user.disabled) return undefined
+  return user
+}
+
 export type ActiveSessionRow = {
  id: string
  userId: string