Auth schema follows Better Auth; migrations reset to one 0001

crates/outer/src/apps/mod.rs

@@ -161,12 +161,12 @@ pub async fn ensure_account(pool: &SqlitePool, email: &str) -> anyhow::Result<St
     let email = email.trim().to_lowercase();
     anyhow::ensure!(!email.is_empty(), "email is empty");
     let now = now_ms();
-    if let Some(id) = sqlx::query_scalar::<_, String>("SELECT id FROM account WHERE email = ?1")
+    if let Some(id) = sqlx::query_scalar::<_, String>("SELECT id FROM user WHERE email = ?1")
         .bind(&email)
         .fetch_optional(pool)
         .await?
     {
-        sqlx::query("UPDATE account SET last_active_at = ?1 WHERE id = ?2")
+        sqlx::query("UPDATE user SET lastActiveAt = ?1, updatedAt = ?1 WHERE id = ?2")
             .bind(now)
             .bind(&id)
             .execute(pool)
@@ -175,7 +175,8 @@ pub async fn ensure_account(pool: &SqlitePool, email: &str) -> anyhow::Result<St
     }
     let id = uuid::Uuid::new_v4().to_string();
     let insert = sqlx::query(
-        "INSERT INTO account (id, email, last_active_at, created_at) VALUES (?1, ?2, ?3, ?3)",
+        "INSERT INTO user (id, email, emailVerified, lastActiveAt, createdAt, updatedAt) \
+         VALUES (?1, ?2, 1, ?3, ?3, ?3)",
     )
     .bind(&id)
     .bind(&email)
@@ -186,11 +187,11 @@ pub async fn ensure_account(pool: &SqlitePool, email: &str) -> anyhow::Result<St
         Ok(_) => Ok(id),
         Err(e) if is_unique_violation(&e) => {
             // A concurrent caller inserted the same email first.
-            let id = sqlx::query_scalar::<_, String>("SELECT id FROM account WHERE email = ?1")
+            let id = sqlx::query_scalar::<_, String>("SELECT id FROM user WHERE email = ?1")
                 .bind(&email)
                 .fetch_one(pool)
                 .await?;
-            sqlx::query("UPDATE account SET last_active_at = ?1 WHERE id = ?2")
+            sqlx::query("UPDATE user SET lastActiveAt = ?1, updatedAt = ?1 WHERE id = ?2")
                 .bind(now)
                 .bind(&id)
                 .execute(pool)
@@ -479,7 +480,7 @@ mod tests {
         let second = ensure_account(&pool, "  ANA@example.com ").await.unwrap();
         assert_eq!(first, second, "same email lowercases to the same account");
         let (email, last_active_at): (String, i64) =
-            sqlx::query_as("SELECT email, last_active_at FROM account WHERE id = ?1")
+            sqlx::query_as("SELECT email, lastActiveAt FROM user WHERE id = ?1")
                 .bind(&first)
                 .fetch_one(&pool)
                 .await

crates/outer/src/auth/cimd.rs

@@ -2,7 +2,7 @@
 //!
 //! The `client_id` is either an HTTPS URL (a client-instance metadata
 //! document, fetched with HTTPS only to public IPs only, 3 s timeout,
-//! ≤ 16 KiB, cached in `oauth_client`) or a `dcr_…` id from `POST
+//! ≤ 16 KiB, cached in `oauthClient`) or a `dcr_…` id from `POST
 //! /oauth/register`. Known clients only get a friendlier label; their
 //! redirects always come from their own document.
 
@@ -12,7 +12,7 @@ use std::time::Duration;
 use sqlx::SqlitePool;
 use url::Url;
 
-use super::{now_ms, AuthConfig};
+use super::{now_ms, tokens, AuthConfig};
 
 /// ≤ 16 KiB per spec.
 ///
@@ -213,8 +213,8 @@ fn check_redirect(mut doc: ClientDoc, redirect_uri: &str) -> Result<ClientDoc, C
 
 async fn dcr_client(pool: &SqlitePool, client_id: &str) -> anyhow::Result<Option<ClientDoc>> {
     let row: Option<(String, Option<String>, Option<String>, String)> = sqlx::query_as(
-        "SELECT client_id, name, host, redirect_uris FROM oauth_client \
-         WHERE client_id = ? AND kind = 'dcr'",
+        "SELECT clientId, name, host, redirectUris FROM oauthClient \
+         WHERE clientId = ? AND kind = 'dcr'",
     )
     .bind(client_id)
     .fetch_optional(pool)
@@ -331,17 +331,20 @@ async fn fetch_cimd(
     // Backdate so `fetched_at + 24 h` is the exact expiry.
     let fetched_at = now - (DOC_TTL_MS - ttl_ms);
     sqlx::query(
-        "INSERT INTO oauth_client (client_id, kind, name, host, redirect_uris, verified, fetched_at, created_at) \
-         VALUES (?, 'cimd', ?, ?, ?, 0, ?, ?) \
-         ON CONFLICT(client_id) DO UPDATE SET name = excluded.name, host = excluded.host, \
-           redirect_uris = excluded.redirect_uris, fetched_at = excluded.fetched_at",
+        "INSERT INTO oauthClient (id, clientId, kind, name, host, redirectUris, verified, fetchedAt, createdAt, updatedAt) \
+         VALUES (?, ?, 'cimd', ?, ?, ?, 0, ?, ?, ?) \
+         ON CONFLICT(clientId) DO UPDATE SET name = excluded.name, host = excluded.host, \
+           redirectUris = excluded.redirectUris, fetchedAt = excluded.fetchedAt, \
+           updatedAt = excluded.updatedAt",
     )
+    .bind(tokens::new_id())
     .bind(client_id)
     .bind(&name)
     .bind(&host)
     .bind(serde_json::to_string(&redirect_uris).unwrap_or_default())
     .bind(fetched_at)
     .bind(now)
+    .bind(now)
     .execute(pool)
     .await
     .map_err(|err| ClientError::Fetch(err.to_string()))?;
@@ -361,8 +364,8 @@ async fn cached_doc(
     now: i64,
 ) -> anyhow::Result<Option<ClientDoc>> {
     let row: Option<CachedDoc> = sqlx::query_as(
-        "SELECT name, host, redirect_uris, fetched_at FROM oauth_client \
-         WHERE client_id = ? AND kind = 'cimd'",
+        "SELECT name, host, redirectUris, fetchedAt FROM oauthClient \
+         WHERE clientId = ? AND kind = 'cimd'",
     )
     .bind(client_id)
     .fetch_optional(pool)