add passkey support

src/sqlite.rs

@@ -7,11 +7,13 @@ use sha2::{Digest, Sha256};
 use sqlx::{Connection, Row, SqliteConnection, SqlitePool, sqlite::SqliteConnectOptions};
 
 use crate::domain::{
-    Category, DomainError, DomainResult, GroceryList, Item, Meal, MealIngredient, SessionUser, User,
+    Category, DomainError, DomainResult, GroceryList, Item, Meal, MealIngredient, Passkey,
+    SessionUser, User,
 };
 use crate::ports::{
     CategoryRepository, InvitationRepository, ItemRepository, ListRepository,
-    MealIngredientRepository, MealRepository, NewItem, SessionRepository, UserRepository,
+    MealIngredientRepository, MealRepository, NewItem, PasskeyRepository, SessionRepository,
+    UserRepository,
 };
 
 #[derive(Clone)]
@@ -105,6 +107,14 @@ async fn migrate(pool: &SqlitePool) -> DomainResult<()> {
             csrf_token TEXT NOT NULL,
             expires_at INTEGER NOT NULL
         );
+        CREATE TABLE IF NOT EXISTS passkeys (
+            id INTEGER PRIMARY KEY AUTOINCREMENT,
+            user_id INTEGER NOT NULL REFERENCES users(id) ON DELETE CASCADE,
+            credential_id TEXT NOT NULL UNIQUE,
+            credential TEXT NOT NULL,
+            counter INTEGER NOT NULL DEFAULT 0,
+            created_at INTEGER NOT NULL
+        );
         CREATE TABLE IF NOT EXISTS lists (
             id INTEGER PRIMARY KEY AUTOINCREMENT,
             name TEXT NOT NULL,
@@ -257,6 +267,117 @@ impl UserRepository for SqliteUserRepository {
     }
 }
 
+#[derive(Clone, Copy)]
+pub struct SqlitePasskeyRepository;
+
+#[async_trait]
+impl PasskeyRepository for SqlitePasskeyRepository {
+    async fn create_passkey(
+        &self,
+        txn: &mut SqliteConnection,
+        user_id: i64,
+        credential_id: String,
+        credential: String,
+        counter: i64,
+    ) -> DomainResult<Passkey> {
+        let result = sqlx::query(
+            "INSERT INTO passkeys (user_id, credential_id, credential, counter, created_at)
+             VALUES (?1, ?2, ?3, ?4, ?5)",
+        )
+        .bind(user_id)
+        .bind(&credential_id)
+        .bind(&credential)
+        .bind(counter)
+        .bind(now())
+        .execute(&mut *txn)
+        .await;
+        match result {
+            Ok(_) => {
+                let id = sqlx::query("SELECT last_insert_rowid()")
+                    .fetch_one(&mut *txn)
+                    .await
+                    .map_err(db_error)?
+                    .get::<i64, _>(0);
+                Ok(Passkey {
+                    id,
+                    user_id,
+                    credential_id,
+                    credential,
+                    counter,
+                })
+            }
+            Err(error) if is_unique_violation(&error) => Err(DomainError::Conflict),
+            Err(error) => Err(db_error(error)),
+        }
+    }
+
+    async fn find_by_credential_id(
+        &self,
+        txn: &mut SqliteConnection,
+        credential_id: String,
+    ) -> DomainResult<Option<Passkey>> {
+        let row = sqlx::query(
+            "SELECT id, user_id, credential_id, credential, counter
+             FROM passkeys WHERE credential_id = ?1",
+        )
+        .bind(&credential_id)
+        .fetch_optional(&mut *txn)
+        .await
+        .map_err(db_error)?;
+        Ok(row.map(|row| Passkey {
+            id: row.get(0),
+            user_id: row.get(1),
+            credential_id: row.get(2),
+            credential: row.get(3),
+            counter: row.get(4),
+        }))
+    }
+
+    async fn list_for_user(
+        &self,
+        txn: &mut SqliteConnection,
+        user_id: i64,
+    ) -> DomainResult<Vec<Passkey>> {
+        let rows = sqlx::query(
+            "SELECT id, user_id, credential_id, credential, counter
+             FROM passkeys WHERE user_id = ?1 ORDER BY id ASC",
+        )
+        .bind(user_id)
+        .fetch_all(&mut *txn)
+        .await
+        .map_err(db_error)?;
+        Ok(rows
+            .into_iter()
+            .map(|row| Passkey {
+                id: row.get(0),
+                user_id: row.get(1),
+                credential_id: row.get(2),
+                credential: row.get(3),
+                counter: row.get(4),
+            })
+            .collect())
+    }
+
+    async fn delete_passkey(
+        &self,
+        txn: &mut SqliteConnection,
+        user_id: i64,
+        passkey_id: i64,
+    ) -> DomainResult<()> {
+        let changed = sqlx::query("DELETE FROM passkeys WHERE id = ?1 AND user_id = ?2")
+            .bind(passkey_id)
+            .bind(user_id)
+            .execute(&mut *txn)
+            .await
+            .map_err(db_error)?
+            .rows_affected();
+        if changed == 0 {
+            return Err(DomainError::NotFound);
+        }
+        Ok(())
+    }
+}
+
 #[derive(Clone, Copy)]
 pub struct SqliteSessionRepository;
 
@@ -2012,4 +2133,106 @@ mod tests {
             .await;
         assert!(matches!(result, Err(DomainError::NotFound)));
     }
+
+    // ---- PasskeyRepository ----
+
+    #[tokio::test]
+    async fn passkey_crud_roundtrip() {
+        let db = setup().await;
+        let user = create_user(&db, "alice@example.com").await;
+        let passkeys = SqlitePasskeyRepository;
+
+        let created = db
+            .run(move |txn| {
+                let passkeys = passkeys.clone();
+                Box::pin(async move {
+                    passkeys
+                        .create_passkey(txn, user.id, "cred-1".into(), "{}".into(), 0)
+                        .await
+                })
+            })
+            .await
+            .unwrap();
+        assert!(created.id > 0);
+        assert_eq!(created.user_id, user.id);
+        assert_eq!(created.credential_id, "cred-1");
+
+        let found = db
+            .run(move |txn| {
+                let passkeys = passkeys.clone();
+                Box::pin(async move { passkeys.find_by_credential_id(txn, "cred-1".into()).await })
+            })
+            .await
+            .unwrap()
+            .unwrap();
+        assert_eq!(found.id, created.id);
+
+        let listed = db
+            .run(move |txn| {
+                let passkeys = passkeys.clone();
+                Box::pin(async move { passkeys.list_for_user(txn, user.id).await })
+            })
+            .await
+            .unwrap();
+        assert_eq!(listed.len(), 1);
+
+        db.run(move |txn| {
+            let passkeys = passkeys.clone();
+            Box::pin(async move { passkeys.delete_passkey(txn, user.id, created.id).await })
+        })
+        .await
+        .unwrap();
+
+        let after = db
+            .run(move |txn| {
+                let passkeys = passkeys.clone();
+                Box::pin(async move { passkeys.list_for_user(txn, user.id).await })
+            })
+            .await
+            .unwrap();
+        assert!(after.is_empty());
+    }
+
+    #[tokio::test]
+    async fn duplicate_passkey_credential_id_conflicts() {
+        let db = setup().await;
+        let user = create_user(&db, "alice@example.com").await;
+        let passkeys = SqlitePasskeyRepository;
+        db.run(move |txn| {
+            let passkeys = passkeys.clone();
+            Box::pin(async move {
+                passkeys
+                    .create_passkey(txn, user.id, "cred-1".into(), "{}".into(), 0)
+                    .await
+            })
+        })
+        .await
+        .unwrap();
+
+        let result = db
+            .run(move |txn| {
+                let passkeys = passkeys.clone();
+                Box::pin(async move {
+                    passkeys
+                        .create_passkey(txn, user.id, "cred-1".into(), "{}".into(), 0)
+                        .await
+                })
+            })
+            .await;
+        assert!(matches!(result, Err(DomainError::Conflict)));
+    }
+
+    #[tokio::test]
+    async fn delete_missing_passkey_fails() {
+        let db = setup().await;
+        let user = create_user(&db, "alice@example.com").await;
+        let passkeys = SqlitePasskeyRepository;
+        let result = db
+            .run(move |txn| {
+                let passkeys = passkeys.clone();
+                Box::pin(async move { passkeys.delete_passkey(txn, user.id, 9999).await })
+            })
+            .await;
+        assert!(matches!(result, Err(DomainError::NotFound)));
+    }
 }