Harden OAuth and session handling

adapters/gorm/adapter.go

@@ -105,13 +105,24 @@ func (a *Adapter) FindMany(ctx context.Context, tableName limen.SchemaTableName,
 }
 
 func (a *Adapter) Update(ctx context.Context, tableName limen.SchemaTableName, conditions []limen.Where, updates map[string]any) error {
+	if len(updates) == 0 {
+		return nil
+	}
+	if len(conditions) == 0 {
+		return fmt.Errorf("%w: conditions required to prevent accidental table-wide update", limen.ErrMissingConditions)
+	}
+
 	db := a.getDB()
 	query := db.WithContext(ctx).Table(string(tableName))
 	query = a.applyConditions(query, conditions)
 	return query.Updates(updates).Error
 }
 
 func (a *Adapter) Delete(ctx context.Context, tableName limen.SchemaTableName, conditions []limen.Where) error {
+	if len(conditions) == 0 {
+		return fmt.Errorf("%w: conditions required to prevent accidental table-wide delete", limen.ErrMissingConditions)
+	}
+
 	db := a.getDB()
 	query := db.WithContext(ctx).Table(string(tableName))
 	query = a.applyConditions(query, conditions)

adapters/gorm/adapter_test.go

@@ -93,6 +93,24 @@ func TestGorm_Update(t *testing.T) {
 	assert.Equal(t, "new@test.com", result["email"])
 }
 
+func TestGorm_Update_RequiresConditions(t *testing.T) {
+	adapter := setupTestGormDB(t)
+	ctx := context.Background()
+
+	err := adapter.Update(ctx, "test_items", nil, map[string]any{"email": "new@test.com"})
+
+	assert.ErrorIs(t, err, limen.ErrMissingConditions)
+}
+
+func TestGorm_Update_EmptyUpdatesNoop(t *testing.T) {
+	adapter := setupTestGormDB(t)
+	ctx := context.Background()
+
+	err := adapter.Update(ctx, "test_items", nil, map[string]any{})
+
+	assert.NoError(t, err)
+}
+
 func TestGorm_Delete(t *testing.T) {
 	adapter := setupTestGormDB(t)
 	ctx := context.Background()
@@ -108,6 +126,15 @@ func TestGorm_Delete(t *testing.T) {
 	assert.ErrorIs(t, err, limen.ErrRecordNotFound)
 }
 
+func TestGorm_Delete_RequiresConditions(t *testing.T) {
+	adapter := setupTestGormDB(t)
+	ctx := context.Background()
+
+	err := adapter.Delete(ctx, "test_items", nil)
+
+	assert.ErrorIs(t, err, limen.ErrMissingConditions)
+}
+
 func TestGorm_Exists(t *testing.T) {
 	adapter := setupTestGormDB(t)
 	ctx := context.Background()

cmd/limen/migration.go

@@ -3,6 +3,7 @@ package main
 import (
 	"database/sql"
 	"fmt"
+	"sort"
 	"time"
 
 	"github.com/thecodearcher/limen"
@@ -16,7 +17,7 @@ type Migration struct {
 
 func generateMigrations(db *sql.DB, driver Driver, config *cliConfig) ([]Migration, error) {
 	migrations := make([]Migration, 0, len(config.Schemas))
-	timestamp := time.Now().Format("20060102150405")
+	timestamp := time.Now()
 
 	introspector := newSchemaIntrospector(db, driver)
 	tableNames := make([]string, 0, len(config.Schemas))
@@ -34,7 +35,13 @@ func generateMigrations(db *sql.DB, driver Driver, config *cliConfig) ([]Migrati
 		return nil, fmt.Errorf("failed to create migration generator: %w", err)
 	}
 
-	for schemaName, schemaDef := range config.Schemas {
+	schemaNames, err := orderSchemasByDependencies(config.Schemas)
+	if err != nil {
+		return nil, err
+	}
+
+	for _, schemaName := range schemaNames {
+		schemaDef := config.Schemas[schemaName]
 		var diff *schemaDiff
 
 		if existingTables[string(schemaDef.GetTableName())] {
@@ -59,7 +66,7 @@ func generateMigrations(db *sql.DB, driver Driver, config *cliConfig) ([]Migrati
 		}
 
 		migration := Migration{
-			Version: fmt.Sprintf("%s_%s", timestamp, schemaName),
+			Version: migrationVersion(timestamp, len(migrations), schemaName),
 			UpSQL:   upSQL,
 			DownSQL: downSQL,
 		}
@@ -70,6 +77,100 @@ func generateMigrations(db *sql.DB, driver Driver, config *cliConfig) ([]Migrati
 	return migrations, nil
 }
 
+func migrationVersion(base time.Time, sequence int, schemaName limen.SchemaName) string {
+	return fmt.Sprintf("%s_%s", base.Add(time.Duration(sequence)*time.Second).Format("20060102150405"), schemaName)
+}
+
+func orderSchemasByDependencies(schemas limen.SchemaDefinitionMap) ([]limen.SchemaName, error) {
+	names := sortedSchemaNames(schemas)
+	tableToSchema := make(map[limen.SchemaName]limen.SchemaName, len(schemas))
+	for _, name := range names {
+		schema := schemas[name]
+		tableToSchema[limen.SchemaName(schema.GetTableName())] = name
+	}
+
+	indegree := make(map[limen.SchemaName]int, len(schemas))
+	dependents := make(map[limen.SchemaName][]limen.SchemaName, len(schemas))
+	seenEdges := make(map[limen.SchemaName]map[limen.SchemaName]bool, len(schemas))
+	for _, name := range names {
+		indegree[name] = 0
+	}
+
+	for _, name := range names {
+		for _, fk := range schemas[name].ForeignKeys {
+			dependency, ok := resolveSchemaDependency(fk.ReferencedSchema, schemas, tableToSchema)
+			if !ok || dependency == name {
+				continue
+			}
+			if seenEdges[name] == nil {
+				seenEdges[name] = make(map[limen.SchemaName]bool)
+			}
+			if seenEdges[name][dependency] {
+				continue
+			}
+
+			seenEdges[name][dependency] = true
+			indegree[name]++
+			dependents[dependency] = append(dependents[dependency], name)
+		}
+	}
+
+	ready := make([]limen.SchemaName, 0, len(schemas))
+	for _, name := range names {
+		if indegree[name] == 0 {
+			ready = append(ready, name)
+		}
+	}
+
+	ordered := make([]limen.SchemaName, 0, len(schemas))
+	for len(ready) > 0 {
+		sortSchemaNames(ready)
+		name := ready[0]
+		ready = ready[1:]
+		ordered = append(ordered, name)
+
+		for _, dependent := range dependents[name] {
+			indegree[dependent]--
+			if indegree[dependent] == 0 {
+				ready = append(ready, dependent)
+			}
+		}
+	}
+
+	if len(ordered) != len(schemas) {
+		return nil, fmt.Errorf("foreign key dependency cycle detected among schemas")
+	}
+
+	return ordered, nil
+}
+
+func resolveSchemaDependency(
+	referenced limen.SchemaName,
+	schemas limen.SchemaDefinitionMap,
+	tableToSchema map[limen.SchemaName]limen.SchemaName,
+) (limen.SchemaName, bool) {
+	if _, ok := schemas[referenced]; ok {
+		return referenced, true
+	}
+	name, ok := tableToSchema[referenced]
+	return name, ok
+}
+
+func sortedSchemaNames(schemas limen.SchemaDefinitionMap) []limen.SchemaName {
+	names := make([]limen.SchemaName, 0, len(schemas))
+	for name := range schemas {
+		names = append(names, name)
+	}
+	sortSchemaNames(names)
+	return names
+}
+
+func sortSchemaNames(names []limen.SchemaName) {
+	sort.Slice(names, func(i, j int) bool {
+		return string(names[i]) < string(names[j])
+	})
+}
+
 func generateDiffForTable(introspector *schemaIntrospector, schema *limen.SchemaDefinition) (*schemaDiff, error) {
 	existingSchema, err := introspector.introspectTable(schema.GetTableName())
 	if err != nil {

cmd/limen/migration_test.go

@@ -0,0 +1,130 @@
+package main
+
+import (
+	"strings"
+	"testing"
+	"time"
+
+	"github.com/thecodearcher/limen"
+)
+
+func TestMigrationVersionIncrementsTimestampPerMigration(t *testing.T) {
+	base := time.Date(2026, 6, 7, 3, 44, 8, 0, time.UTC)
+
+	got := []string{
+		migrationVersion(base, 0, "users"),
+		migrationVersion(base, 1, "accounts"),
+		migrationVersion(base, 2, "sessions"),
+	}
+
+	want := []string{
+		"20260607034408_users",
+		"20260607034409_accounts",
+		"20260607034410_sessions",
+	}
+	for i := range want {
+		if got[i] != want[i] {
+			t.Fatalf("version %d = %q, want %q", i, got[i], want[i])
+		}
+	}
+}
+
+func TestOrderSchemasByDependenciesPutsReferencedTablesFirst(t *testing.T) {
+	schemas := limen.SchemaDefinitionMap{
+		"accounts": schemaDef("accounts", fk("app_users")),
+		"sessions": schemaDef("sessions", fk("app_users")),
+		"users":    schemaDef("app_users"),
+	}
+
+	ordered, err := orderSchemasByDependencies(schemas)
+	if err != nil {
+		t.Fatalf("orderSchemasByDependencies returned error: %v", err)
+	}
+
+	assertBefore(t, ordered, "users", "accounts")
+	assertBefore(t, ordered, "users", "sessions")
+}
+
+func TestOrderSchemasByDependenciesSortsIndependentSchemas(t *testing.T) {
+	schemas := limen.SchemaDefinitionMap{
+		"users":         schemaDef("users"),
+		"rate_limits":   schemaDef("rate_limits"),
+		"verifications": schemaDef("verifications"),
+	}
+
+	ordered, err := orderSchemasByDependencies(schemas)
+	if err != nil {
+		t.Fatalf("orderSchemasByDependencies returned error: %v", err)
+	}
+
+	want := []limen.SchemaName{"rate_limits", "users", "verifications"}
+	for i := range want {
+		if ordered[i] != want[i] {
+			t.Fatalf("ordered[%d] = %q, want %q; full order: %v", i, ordered[i], want[i], ordered)
+		}
+	}
+}
+
+func TestOrderSchemasByDependenciesDetectsCycles(t *testing.T) {
+	schemas := limen.SchemaDefinitionMap{
+		"a": schemaDef("a", fk("b")),
+		"b": schemaDef("b", fk("a")),
+	}
+
+	_, err := orderSchemasByDependencies(schemas)
+	if err == nil {
+		t.Fatal("expected cycle error")
+	}
+	if !strings.Contains(err.Error(), "dependency cycle") {
+		t.Fatalf("expected dependency cycle error, got %v", err)
+	}
+}
+
+func schemaDef(tableName string, foreignKeys ...limen.ForeignKeyDefinition) limen.SchemaDefinition {
+	return limen.SchemaDefinition{
+		TableName: limen.SchemaTableName(tableName),
+		Columns: []limen.ColumnDefinition{
+			{
+				Name:         "id",
+				LogicalField: limen.SchemaIDField,
+				Type:         limen.ColumnTypeInt64,
+				IsPrimaryKey: true,
+			},
+		},
+		ForeignKeys: foreignKeys,
+	}
+}
+
+func fk(referencedSchema limen.SchemaName) limen.ForeignKeyDefinition {
+	return limen.ForeignKeyDefinition{
+		Name:             "fk_test",
+		Column:           "user_id",
+		ReferencedSchema: referencedSchema,
+		ReferencedField:  limen.SchemaIDField,
+	}
+}
+
+func assertBefore(t *testing.T, ordered []limen.SchemaName, before, after limen.SchemaName) {
+	t.Helper()
+
+	beforeIndex := schemaIndex(ordered, before)
+	afterIndex := schemaIndex(ordered, after)
+	if beforeIndex == -1 {
+		t.Fatalf("%q not found in ordered schemas %v", before, ordered)
+	}
+	if afterIndex == -1 {
+		t.Fatalf("%q not found in ordered schemas %v", after, ordered)
+	}
+	if beforeIndex > afterIndex {
+		t.Fatalf("expected %q before %q, got %v", before, after, ordered)
+	}
+}
+
+func schemaIndex(ordered []limen.SchemaName, target limen.SchemaName) int {
+	for i, name := range ordered {
+		if name == target {
+			return i
+		}
+	}
+	return -1
+}

middlewares.go

@@ -55,16 +55,16 @@ func (httpCore *LimenHTTPCore) middlewareCheckOrigin() Middleware {
 				return
 			}
 
-			if len(httpCore.trustedOriginsPatterns) == 0 {
-				next.ServeHTTP(w, r)
-				return
-			}
-
 			origin := r.Header.Get("Origin")
 			if origin == "" {
 				origin = r.Header.Get("Referer")
 			}
 
+			if origin == "" {
+				next.ServeHTTP(w, r)
+				return
+			}
+
 			if httpCore.IsTrustedOrigin(origin) {
 				next.ServeHTTP(w, r)
 				return