86c014cb66
First half of Task-multi-email-identity. Lays down everything except the NextAuth callback wiring, which is gated on a research subagent finishing its survey of OAuth provider behavior for the email_verified claim across GitHub, Google, and Authentik. Schema (packages/database): * New user_email_identities table colocated with `users` in users.ts. Columns: id, user_id (FK), email (lowercased), verified_at, source, created_at, last_used_at. * Indexes: user_id, email, unique(user_id, email), and a PARTIAL unique index on email WHERE verified_at IS NOT NULL — a verified email resolves to exactly one users row globally, while unverified rows (none today; placeholder for the manual-verification follow-up) do not share the constraint. * Drizzle relation: users.emailIdentities -> userEmailIdentities, and the inverse one(users) relation. * Migration 0005 generated by db:generate, augmented with a backfill INSERT that seeds one source='primary' identity per existing users row using created_at as verified_at. Migration applied to dev DB; existing admin@tasks.dev user verified as 1:1 mapped. Server (apps/web/server): * apps/web/server/lib/identity.ts exports two pure read helpers: - userOwnsEmail(userId, email): boolean used by the (upcoming) invite-accept procedure to verify the human controls the invited address under any of their linked identities. - findUserIdByVerifiedEmail(email): the replacement for the old ensureUserIdByEmail lookup. Will be called from auth.ts once the OAuth research subagent returns. * apps/web/server/routers/identity.ts exposes identity.listMine — a protected procedure returning the caller's identities ordered by verifiedAt desc. Cross-user identity surface is intentionally NOT exposed here; that lives behind the workspace-scoped autocomplete in Task 3 with its own tenancy fence. UI (apps/web/app): * New route /[workspaceSlug]/settings/profile renders a read-only "Linked emails" section with per-identity row (email, source badge, verified state, last-used relative time) plus a hint that explains how to add another email (sign in via that email's OAuth provider). * Empty / loading / error states all handled. The "no identities" branch should never fire post-backfill but renders a friendly message instead of throwing. What's NOT in this commit: * auth.ts changes (ensureUserIdByEmail -> ensureUserIdByVerifiedEmail, OAuth callback identity upsert, cross-user conflict rejection). Waiting on subagent research to land the callback wiring correctly on the first try across all three providers. * Vitest tests. The pure helpers are 10-line query shims and the behavior-relevant assertion is the auth callback path — easier to write meaningful tests once that lands. All three CI gates green: pnpm lint (14 pre-existing warnings, unchanged), pnpm type-check (6/6 packages), pnpm test (14/14 existing tests across @tasks/shared, @tasks/database, @tasks/ai). Co-authored-by: Cursor <cursoragent@cursor.com>
39 lines
1.3 KiB
TypeScript
39 lines
1.3 KiB
TypeScript
import { desc, eq } from "drizzle-orm";
|
|
|
|
import { router, protectedProcedure } from "@/server/trpc";
|
|
import { userEmailIdentities } from "@tasks/database/schema";
|
|
|
|
/**
|
|
* Procedures backing the "Linked emails" surface on the profile page and
|
|
* (eventually) the manual-verification flow. Read-only in v1.
|
|
*
|
|
* Everything is protected — only the authenticated user can see their own
|
|
* identities. We do not expose any cross-user identity lookup here; that
|
|
* surface (auto-suggest invitees by typing a name) lives in `invites.ts`
|
|
* with its own tenancy fence.
|
|
*/
|
|
export const identityRouter = router({
|
|
listMine: protectedProcedure.query(async ({ ctx }) => {
|
|
const userId = ctx.session!.user.id;
|
|
|
|
const rows = await ctx.db
|
|
.select({
|
|
id: userEmailIdentities.id,
|
|
email: userEmailIdentities.email,
|
|
source: userEmailIdentities.source,
|
|
verifiedAt: userEmailIdentities.verifiedAt,
|
|
createdAt: userEmailIdentities.createdAt,
|
|
lastUsedAt: userEmailIdentities.lastUsedAt,
|
|
})
|
|
.from(userEmailIdentities)
|
|
.where(eq(userEmailIdentities.userId, userId))
|
|
.orderBy(desc(userEmailIdentities.verifiedAt));
|
|
|
|
return rows.map((row) => ({
|
|
...row,
|
|
verified: row.verifiedAt !== null,
|
|
}));
|
|
}),
|
|
});
|
|
|
|
export type IdentityRouter = typeof identityRouter;
|