86c014cb66
First half of Task-multi-email-identity. Lays down everything except the NextAuth callback wiring, which is gated on a research subagent finishing its survey of OAuth provider behavior for the email_verified claim across GitHub, Google, and Authentik. Schema (packages/database): * New user_email_identities table colocated with `users` in users.ts. Columns: id, user_id (FK), email (lowercased), verified_at, source, created_at, last_used_at. * Indexes: user_id, email, unique(user_id, email), and a PARTIAL unique index on email WHERE verified_at IS NOT NULL — a verified email resolves to exactly one users row globally, while unverified rows (none today; placeholder for the manual-verification follow-up) do not share the constraint. * Drizzle relation: users.emailIdentities -> userEmailIdentities, and the inverse one(users) relation. * Migration 0005 generated by db:generate, augmented with a backfill INSERT that seeds one source='primary' identity per existing users row using created_at as verified_at. Migration applied to dev DB; existing admin@tasks.dev user verified as 1:1 mapped. Server (apps/web/server): * apps/web/server/lib/identity.ts exports two pure read helpers: - userOwnsEmail(userId, email): boolean used by the (upcoming) invite-accept procedure to verify the human controls the invited address under any of their linked identities. - findUserIdByVerifiedEmail(email): the replacement for the old ensureUserIdByEmail lookup. Will be called from auth.ts once the OAuth research subagent returns. * apps/web/server/routers/identity.ts exposes identity.listMine — a protected procedure returning the caller's identities ordered by verifiedAt desc. Cross-user identity surface is intentionally NOT exposed here; that lives behind the workspace-scoped autocomplete in Task 3 with its own tenancy fence. UI (apps/web/app): * New route /[workspaceSlug]/settings/profile renders a read-only "Linked emails" section with per-identity row (email, source badge, verified state, last-used relative time) plus a hint that explains how to add another email (sign in via that email's OAuth provider). * Empty / loading / error states all handled. The "no identities" branch should never fire post-backfill but renders a friendly message instead of throwing. What's NOT in this commit: * auth.ts changes (ensureUserIdByEmail -> ensureUserIdByVerifiedEmail, OAuth callback identity upsert, cross-user conflict rejection). Waiting on subagent research to land the callback wiring correctly on the first try across all three providers. * Vitest tests. The pure helpers are 10-line query shims and the behavior-relevant assertion is the auth callback path — easier to write meaningful tests once that lands. All three CI gates green: pnpm lint (14 pre-existing warnings, unchanged), pnpm type-check (6/6 packages), pnpm test (14/14 existing tests across @tasks/shared, @tasks/database, @tasks/ai). Co-authored-by: Cursor <cursoragent@cursor.com>
48 lines
No EOL
934 B
JSON
48 lines
No EOL
934 B
JSON
{
|
|
"version": "7",
|
|
"dialect": "postgresql",
|
|
"entries": [
|
|
{
|
|
"idx": 0,
|
|
"version": "7",
|
|
"when": 1774617985473,
|
|
"tag": "0000_nervous_ogun",
|
|
"breakpoints": true
|
|
},
|
|
{
|
|
"idx": 1,
|
|
"version": "7",
|
|
"when": 1774632231368,
|
|
"tag": "0001_parched_red_hulk",
|
|
"breakpoints": true
|
|
},
|
|
{
|
|
"idx": 2,
|
|
"version": "7",
|
|
"when": 1777225115319,
|
|
"tag": "0002_markdown_backlog_cursor_sync",
|
|
"breakpoints": true
|
|
},
|
|
{
|
|
"idx": 3,
|
|
"version": "7",
|
|
"when": 1778124738113,
|
|
"tag": "0003_damp_green_goblin",
|
|
"breakpoints": true
|
|
},
|
|
{
|
|
"idx": 4,
|
|
"version": "7",
|
|
"when": 1779987416637,
|
|
"tag": "0004_medical_blob",
|
|
"breakpoints": true
|
|
},
|
|
{
|
|
"idx": 5,
|
|
"version": "7",
|
|
"when": 1780412597413,
|
|
"tag": "0005_cooing_midnight",
|
|
"breakpoints": true
|
|
}
|
|
]
|
|
} |