@useoneauth/adapter-postgres

The reference Postgres persistence adapter for OneAuth — implements all 11 @useoneauth/adapter-sdk ports so runtime state survives across processes. Built on Prisma 7 (the prisma-client generator + the @prisma/adapter-pg driver adapter) and proven by the conformance kit, not bespoke tests.

Quick start

One call wires every port; hand the result straight to createOneAuth:

import { createPostgresAdapters } from "@useoneauth/adapter-postgres"
import { createOneAuth } from "@useoneauth/sdk-server"

const adapters = await createPostgresAdapters({
  connectionString: process.env.DATABASE_URL,
  keystorePassword: process.env.ONEAUTH_KEYSTORE_PASSWORD!, // encrypts signing keys at rest
})

const oneauth = await createOneAuth({ issuer, audience, adapters })

That's the whole integration — your identities, sessions, credentials, tokens, signing keys, and events now live in Postgres instead of memory.

Ports

All 11 implemented and verified against real Postgres:

| Conformance-tested | CRUD round-tripped | |---|---| | eventStore, identity, relationship, session | organization, membership, credential, credentialVersion, credentialPolicy, refreshToken, keyStore |

Notes on the design

• Prisma 7 driver adapter. Connection URLs moved out of the schema; getPrismaClient wires @prisma/adapter-pg and reuses one client across hot-reloads in dev (Prisma's guidance), so HMR doesn't exhaust connections. createPostgresAdapters uses it for you.
• Signing keys. The keyStore persists the ES256 key vault AES-256-GCM-encrypted in a single row (keystorePassword derives the data key) — private key material is never stored in the clear.
• No foreign keys. Referential integrity is the engine's job (and the conformance kit creates edges/sessions referencing ids that needn't exist as rows).

Testing

Tests use Testcontainers — a real, ephemeral Postgres per run, so the adapter is verified against actual Postgres semantics. Docker must be available.

pnpm --filter @useoneauth/adapter-postgres test

Layout

• prisma/schema.prisma — Prisma models (one per persisted entity).
• src/generated/ — generated Prisma client (gitignored; emitted by prisma generate).
• src/Prisma*.ts — one thin repository per port (domain logic stays in the engines).
• tests/conformance.test.ts — runs the @useoneauth/adapter-sdk conformance suites.