@effect-auth/core 0.1.0-alpha.16 → 0.1.0-alpha.18

package/dist/internal/AuthFlowFinalizer.js

@@ -0,0 +1,182 @@
+import { Context, Effect, Layer, Option, Result } from "effect";
+import { compactAuthenticationEventsResult, deriveAssuranceResult, deriveMfaVerifiedAtResult, maximumSessionAuthenticationEvents, validateAuthenticationEvidenceTimestamps, } from "../Assurance.js";
+import { currentUnixMillis } from "../Internal.js";
+import { unknownLoginDeviceContext } from "../LoginApproval.js";
+import { LoginNotification } from "../LoginNotification.js";
+import { defaultLoginRiskContext } from "../LoginRisk.js";
+import { RecoveryRequirementPolicy, defaultRecoveryRemediationCapabilities, makeRecoveryRequirementPolicyAllow, recoveryPolicyInput, withRecoveryEnrollmentRequirement, withRecoveryRemediationRequirement, } from "../RecoveryPolicy.js";
+import { SessionCreateError, Sessions, sessionRequestMetadataKey, } from "../Sessions.js";
+const loginNotificationSession = (session) => ({
+    sessionId: session.sessionId,
+    userId: session.userId,
+    authTime: session.authTime,
+    expiresAt: session.expiresAt,
+    aal: session.aal,
+    amr: session.amr,
+    ...(session.claims === undefined ? {} : { claims: session.claims }),
+});
+const loginRequestContextFromMetadata = (metadata) => {
+    const value = metadata?.[sessionRequestMetadataKey];
+    return typeof value === "object" && value !== null && !Array.isArray(value)
+        ? value
+        : undefined;
+};
+const appMetadata = (metadata) => {
+    if (metadata === undefined) {
+        return undefined;
+    }
+    const { method: _method, evidence: _evidence, identity: _identity, emailDestination: _emailDestination, intent: _intent, deviceStatus: _deviceStatus, deviceKey: _deviceKey, locationKey: _locationKey, claims: _claims, [sessionRequestMetadataKey]: _request, ...rest } = metadata;
+    return Object.keys(rest).length === 0 ? undefined : rest;
+};
+const persistedSessionMetadata = (input) => input.request === undefined
+    ? input.metadata
+    : {
+        ...input.metadata,
+        [sessionRequestMetadataKey]: input.request,
+    };
+const fromEvidenceValidationResult = (result) => Effect.fromResult(result).pipe(Effect.mapError((cause) => new SessionCreateError({
+    message: "Session evidence policy validation failed",
+    cause,
+})));
+const primaryFactorNotEstablished = () => ({
+    _tag: "PolicyDenied",
+    reason: "Authentication evidence did not establish a primary factor",
+});
+export const makeAuthFlowTerminal = (dependencies) => {
+    const recoveryRequirementPolicy = dependencies.recoveryRequirementPolicy ??
+        makeRecoveryRequirementPolicyAllow();
+    const { customEvidencePolicies } = dependencies.sessions;
+    const derive = Effect.fn("auth.auth_flow.derive")(function* (input) {
+        const serverNow = yield* currentUnixMillis;
+        yield* fromEvidenceValidationResult(validateAuthenticationEvidenceTimestamps(input.evidence, serverNow));
+        const evidence = yield* fromEvidenceValidationResult(compactAuthenticationEventsResult(input.evidence, maximumSessionAuthenticationEvents, customEvidencePolicies));
+        const assurance = yield* fromEvidenceValidationResult(deriveAssuranceResult(evidence, { customEvidencePolicies }));
+        const mfaVerifiedAt = yield* fromEvidenceValidationResult(deriveMfaVerifiedAtResult(evidence, customEvidencePolicies));
+        return {
+            ...input,
+            evidence,
+            aal: assurance.level,
+            amr: assurance.amr,
+            primaryEstablished: assurance.primaryEstablished,
+            recoveryRemediation: assurance.recoveryRemediation,
+            ...(mfaVerifiedAt === undefined ? {} : { mfaVerifiedAt }),
+        };
+    });
+    const notifyLogin = (input, session) => dependencies.loginNotification === undefined
+        ? Effect.void
+        : dependencies.loginNotification
+            .notify({
+            userId: input.userId,
+            ...(input.identity === undefined
+                ? {}
+                : { identity: input.identity }),
+            ...(input.emailDestination === undefined
+                ? {}
+                : { emailDestination: input.emailDestination }),
+            ...(input.intent === undefined ? {} : { intent: input.intent }),
+            method: input.method,
+            amr: input.amr,
+            aal: input.aal,
+            session: loginNotificationSession(session),
+            device: input.device ?? unknownLoginDeviceContext,
+            risk: input.risk ?? defaultLoginRiskContext,
+            request: input.request ?? loginRequestContextFromMetadata(input.metadata),
+            ...(input.metadata === undefined
+                ? {}
+                : { metadata: input.metadata }),
+        })
+            .pipe(Effect.catchCause(() => Effect.void));
+    const recoveryClaims = (input) => Effect.gen(function* () {
+        const decision = yield* recoveryRequirementPolicy.decide(recoveryPolicyInput({
+            ...input,
+            request: input.request ?? loginRequestContextFromMetadata(input.metadata),
+            metadata: appMetadata(input.metadata),
+        }));
+        if (decision.type === "deny") {
+            return Option.none();
+        }
+        const policyClaims = decision.type === "require-enrollment"
+            ? withRecoveryEnrollmentRequirement(input.claims, decision.allowed)
+            : input.claims;
+        return Option.some(input.recoveryRemediation
+            ? withRecoveryRemediationRequirement(policyClaims, defaultRecoveryRemediationCapabilities)
+            : policyClaims);
+    });
+    return {
+        derive,
+        complete: Effect.fn("auth.auth_flow.complete")(function* (input) {
+            yield* Effect.annotateCurrentSpan({
+                "auth.method": input.method,
+                "auth.aal": input.aal,
+                "auth.amr_count": input.amr.length,
+            });
+            if (!input.primaryEstablished) {
+                yield* Effect.annotateCurrentSpan("auth.result", "PolicyDenied");
+                return primaryFactorNotEstablished();
+            }
+            const claims = yield* recoveryClaims(input);
+            if (Option.isNone(claims)) {
+                yield* Effect.annotateCurrentSpan("auth.result", "PolicyDenied");
+                return { _tag: "PolicyDenied" };
+            }
+            const session = yield* dependencies.sessions.create({
+                userId: input.userId,
+                authenticationEvents: input.evidence,
+                ...(Option.isNone(claims) ? {} : { claims: claims.value }),
+                ...(input.mfaVerifiedAt === undefined
+                    ? {}
+                    : { mfaVerifiedAt: input.mfaVerifiedAt }),
+                metadata: persistedSessionMetadata(input),
+            });
+            yield* notifyLogin(input, session);
+            yield* Effect.annotateCurrentSpan("auth.result", "Authenticated");
+            return { _tag: "Authenticated", session };
+        }),
+        prepare: Effect.fn("auth.auth_flow.prepare_complete")(function* (input) {
+            if (!input.primaryEstablished) {
+                return primaryFactorNotEstablished();
+            }
+            const claims = yield* recoveryClaims(input);
+            if (Option.isNone(claims)) {
+                return { _tag: "PolicyDenied" };
+            }
+            if (dependencies.sessions.prepareCreate === undefined) {
+                return {
+                    _tag: "PolicyDenied",
+                    reason: "Atomic recovery login is not configured",
+                };
+            }
+            const prepared = yield* dependencies.sessions.prepareCreate({
+                userId: input.userId,
+                authenticationEvents: input.evidence,
+                claims: claims.value,
+                metadata: persistedSessionMetadata(input),
+            });
+            return {
+                _tag: "PreparedAuthenticated",
+                prepared,
+                notify: notifyLogin(input, prepared.session),
+            };
+        }),
+    };
+};
+export class AuthFlowFinalizer extends Context.Service()("auth/internal/AuthFlowFinalizer") {
+}
+export const AuthFlowFinalizerLive = Layer.effect(AuthFlowFinalizer, Effect.gen(function* () {
+    const sessions = yield* Sessions;
+    const loginNotification = yield* Effect.serviceOption(LoginNotification);
+    const recoveryRequirementPolicy = yield* Effect.serviceOption(RecoveryRequirementPolicy);
+    const terminal = makeAuthFlowTerminal({
+        sessions,
+        ...(Option.isSome(loginNotification)
+            ? { loginNotification: loginNotification.value }
+            : {}),
+        ...(Option.isSome(recoveryRequirementPolicy)
+            ? { recoveryRequirementPolicy: recoveryRequirementPolicy.value }
+            : {}),
+    });
+    return AuthFlowFinalizer.of({
+        complete: (input) => terminal.derive(input).pipe(Effect.flatMap(terminal.complete)),
+    });
+}));
+//# sourceMappingURL=AuthFlowFinalizer.js.map

package/dist/internal/AuthFlowFinalizer.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"AuthFlowFinalizer.js","sourceRoot":"","sources":["../../src/internal/AuthFlowFinalizer.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,QAAQ,CAAC;AAEhE,OAAO,EACL,iCAAiC,EACjC,qBAAqB,EACrB,yBAAyB,EACzB,kCAAkC,EAClC,wCAAwC,GACzC,MAAM,iBAAiB,CAAC;AAQzB,OAAO,EAAE,iBAAiB,EAAE,MAAM,gBAAgB,CAAC;AACnD,OAAO,EAAE,yBAAyB,EAAE,MAAM,qBAAqB,CAAC;AAChE,OAAO,EAAE,iBAAiB,EAAE,MAAM,yBAAyB,CAAC;AAK5D,OAAO,EAAE,uBAAuB,EAAE,MAAM,iBAAiB,CAAC;AAE1D,OAAO,EACL,yBAAyB,EACzB,sCAAsC,EACtC,kCAAkC,EAClC,mBAAmB,EACnB,iCAAiC,EACjC,kCAAkC,GACnC,MAAM,sBAAsB,CAAC;AAE9B,OAAO,EACL,kBAAkB,EAClB,QAAQ,EACR,yBAAyB,GAC1B,MAAM,gBAAgB,CAAC;AAqCxB,MAAM,wBAAwB,GAAG,CAC/B,OAAsB,EACI,EAAE,CAAC,CAAC;IAC9B,SAAS,EAAE,OAAO,CAAC,SAAS;IAC5B,MAAM,EAAE,OAAO,CAAC,MAAM;IACtB,QAAQ,EAAE,OAAO,CAAC,QAAQ;IAC1B,SAAS,EAAE,OAAO,CAAC,SAAS;IAC5B,GAAG,EAAE,OAAO,CAAC,GAAG;IAChB,GAAG,EAAE,OAAO,CAAC,GAAG;IAChB,GAAG,CAAC,OAAO,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE,CAAC;CACpE,CAAC,CAAC;AAEH,MAAM,+BAA+B,GAAG,CACtC,QAAuD,EACtB,EAAE;IACnC,MAAM,KAAK,GAAG,QAAQ,EAAE,CAAC,yBAAyB,CAAC,CAAC;IAEpD,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;QACzE,CAAC,CAAE,KAA6B;QAChC,CAAC,CAAC,SAAS,CAAC;AAChB,CAAC,CAAC;AAEF,MAAM,WAAW,GAAG,CAClB,QAAuD,EACR,EAAE;IACjD,IAAI,QAAQ,KAAK,SAAS,EAAE,CAAC;QAC3B,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,MAAM,EACJ,MAAM,EAAE,OAAO,EACf,QAAQ,EAAE,SAAS,EACnB,QAAQ,EAAE,SAAS,EACnB,gBAAgB,EAAE,iBAAiB,EACnC,MAAM,EAAE,OAAO,EACf,YAAY,EAAE,aAAa,EAC3B,SAAS,EAAE,UAAU,EACrB,WAAW,EAAE,YAAY,EACzB,MAAM,EAAE,OAAO,EACf,CAAC,yBAAyB,CAAC,EAAE,QAAQ,EACrC,GAAG,IAAI,EACR,GAAG,QAAQ,CAAC;IAEb,OAAO,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC;AAC3D,CAAC,CAAC;AAEF,MAAM,wBAAwB,GAAG,CAC/B,KAA2B,EACoB,EAAE,CACjD,KAAK,CAAC,OAAO,KAAK,SAAS;IACzB,CAAC,CAAC,KAAK,CAAC,QAAQ;IAChB,CAAC,CAAC;QACE,GAAG,KAAK,CAAC,QAAQ;QACjB,CAAC,yBAAyB,CAAC,EAAE,KAAK,CAAC,OAAO;KAC3C,CAAC;AAER,MAAM,4BAA4B,GAAG,CACnC,MAA2B,EACW,EAAE,CACxC,MAAM,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC,IAAI,CAC5B,MAAM,CAAC,QAAQ,CACb,CAAC,KAAK,EAAE,EAAE,CACR,IAAI,kBAAkB,CAAC;IACrB,OAAO,EAAE,2CAA2C;IACpD,KAAK;CACN,CAAC,CACL,CACF,CAAC;AAEJ,MAAM,2BAA2B,GAAG,GAAG,EAAE,CAAC,CAAC;IACzC,IAAI,EAAE,cAAuB;IAC7B,MAAM,EAAE,4DAA4D;CACrE,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,oBAAoB,GAAG,CAClC,YAA0C,EACxB,EAAE;IACpB,MAAM,yBAAyB,GAC7B,YAAY,CAAC,yBAAyB;QACtC,kCAAkC,EAAE,CAAC;IACvC,MAAM,EAAE,sBAAsB,EAAE,GAAG,YAAY,CAAC,QAAQ,CAAC;IACzD,MAAM,MAAM,GAAG,MAAM,CAAC,EAAE,CAAC,uBAAuB,CAAC,CAAC,QAAQ,CAAC,EACzD,KAA4B;QAE5B,MAAM,SAAS,GAAG,KAAK,CAAC,CAAC,iBAAiB,CAAC;QAC3C,KAAK,CAAC,CAAC,4BAA4B,CACjC,wCAAwC,CAAC,KAAK,CAAC,QAAQ,EAAE,SAAS,CAAC,CACpE,CAAC;QACF,MAAM,QAAQ,GAAG,KAAK,CAAC,CAAC,4BAA4B,CAClD,iCAAiC,CAC/B,KAAK,CAAC,QAAQ,EACd,kCAAkC,EAClC,sBAAsB,CACvB,CACF,CAAC;QACF,MAAM,SAAS,GAAG,KAAK,CAAC,CAAC,4BAA4B,CACnD,qBAAqB,CAAC,QAAQ,EAAE,EAAE,sBAAsB,EAAE,CAAC,CAC5D,CAAC;QACF,MAAM,aAAa,GAAG,KAAK,CAAC,CAAC,4BAA4B,CACvD,yBAAyB,CAAC,QAAQ,EAAE,sBAAsB,CAAC,CAC5D,CAAC;QAEF,OAAO;YACL,GAAG,KAAK;YACR,QAAQ;YACR,GAAG,EAAE,SAAS,CAAC,KAAK;YACpB,GAAG,EAAE,SAAS,CAAC,GAAG;YAClB,kBAAkB,EAAE,SAAS,CAAC,kBAAkB;YAChD,mBAAmB,EAAE,SAAS,CAAC,mBAAmB;YAClD,GAAG,CAAC,aAAa,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,aAAa,EAAE,CAAC;SAC1D,CAAC;IACJ,CAAC,CAAC,CAAC;IACH,MAAM,WAAW,GAAG,CAAC,KAA2B,EAAE,OAAsB,EAAE,EAAE,CAC1E,YAAY,CAAC,iBAAiB,KAAK,SAAS;QAC1C,CAAC,CAAC,MAAM,CAAC,IAAI;QACb,CAAC,CAAC,YAAY,CAAC,iBAAiB;aAC3B,MAAM,CAAC;YACN,MAAM,EAAE,KAAK,CAAC,MAAM;YACpB,GAAG,CAAC,KAAK,CAAC,QAAQ,KAAK,SAAS;gBAC9B,CAAC,CAAC,EAAE;gBACJ,CAAC,CAAC,EAAE,QAAQ,EAAE,KAAK,CAAC,QAAQ,EAAE,CAAC;YACjC,GAAG,CAAC,KAAK,CAAC,gBAAgB,KAAK,SAAS;gBACtC,CAAC,CAAC,EAAE;gBACJ,CAAC,CAAC,EAAE,gBAAgB,EAAE,KAAK,CAAC,gBAAgB,EAAE,CAAC;YACjD,GAAG,CAAC,KAAK,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,KAAK,CAAC,MAAM,EAAE,CAAC;YAC/D,MAAM,EAAE,KAAK,CAAC,MAAM;YACpB,GAAG,EAAE,KAAK,CAAC,GAAG;YACd,GAAG,EAAE,KAAK,CAAC,GAAG;YACd,OAAO,EAAE,wBAAwB,CAAC,OAAO,CAAC;YAC1C,MAAM,EAAE,KAAK,CAAC,MAAM,IAAI,yBAAyB;YACjD,IAAI,EAAE,KAAK,CAAC,IAAI,IAAI,uBAAuB;YAC3C,OAAO,EACL,KAAK,CAAC,OAAO,IAAI,+BAA+B,CAAC,KAAK,CAAC,QAAQ,CAAC;YAClE,GAAG,CAAC,KAAK,CAAC,QAAQ,KAAK,SAAS;gBAC9B,CAAC,CAAC,EAAE;gBACJ,CAAC,CAAC,EAAE,QAAQ,EAAE,KAAK,CAAC,QAAQ,EAAE,CAAC;SAClC,CAAC;aACD,IAAI,CAAC,MAAM,CAAC,UAAU,CAAC,GAAG,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC;IACpD,MAAM,cAAc,GAAG,CAAC,KAA2B,EAAE,EAAE,CACrD,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC;QAClB,MAAM,QAAQ,GAAG,KAAK,CAAC,CAAC,yBAAyB,CAAC,MAAM,CACtD,mBAAmB,CAAC;YAClB,GAAG,KAAK;YACR,OAAO,EACL,KAAK,CAAC,OAAO,IAAI,+BAA+B,CAAC,KAAK,CAAC,QAAQ,CAAC;YAClE,QAAQ,EAAE,WAAW,CAAC,KAAK,CAAC,QAAQ,CAAC;SACtC,CAAC,CACH,CAAC;QACF,IAAI,QAAQ,CAAC,IAAI,KAAK,MAAM,EAAE,CAAC;YAC7B,OAAO,MAAM,CAAC,IAAI,EAAE,CAAC;QACvB,CAAC;QACD,MAAM,YAAY,GAChB,QAAQ,CAAC,IAAI,KAAK,oBAAoB;YACpC,CAAC,CAAC,iCAAiC,CAAC,KAAK,CAAC,MAAM,EAAE,QAAQ,CAAC,OAAO,CAAC;YACnE,CAAC,CAAC,KAAK,CAAC,MAAM,CAAC;QAEnB,OAAO,MAAM,CAAC,IAAI,CAChB,KAAK,CAAC,mBAAmB;YACvB,CAAC,CAAC,kCAAkC,CAChC,YAAY,EACZ,sCAAsC,CACvC;YACH,CAAC,CAAC,YAAY,CACjB,CAAC;IACJ,CAAC,CAAC,CAAC;IAEL,OAAO;QACL,MAAM;QACN,QAAQ,EAAE,MAAM,CAAC,EAAE,CAAC,yBAAyB,CAAC,CAAC,QAAQ,CAAC,EAAE,KAAK;YAC7D,KAAK,CAAC,CAAC,MAAM,CAAC,mBAAmB,CAAC;gBAChC,aAAa,EAAE,KAAK,CAAC,MAAM;gBAC3B,UAAU,EAAE,KAAK,CAAC,GAAG;gBACrB,gBAAgB,EAAE,KAAK,CAAC,GAAG,CAAC,MAAM;aACnC,CAAC,CAAC;YACH,IAAI,CAAC,KAAK,CAAC,kBAAkB,EAAE,CAAC;gBAC9B,KAAK,CAAC,CAAC,MAAM,CAAC,mBAAmB,CAAC,aAAa,EAAE,cAAc,CAAC,CAAC;gBACjE,OAAO,2BAA2B,EAAE,CAAC;YACvC,CAAC;YACD,MAAM,MAAM,GAAG,KAAK,CAAC,CAAC,cAAc,CAAC,KAAK,CAAC,CAAC;YAC5C,IAAI,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE,CAAC;gBAC1B,KAAK,CAAC,CAAC,MAAM,CAAC,mBAAmB,CAAC,aAAa,EAAE,cAAc,CAAC,CAAC;gBACjE,OAAO,EAAE,IAAI,EAAE,cAAuB,EAAE,CAAC;YAC3C,CAAC;YACD,MAAM,OAAO,GAAG,KAAK,CAAC,CAAC,YAAY,CAAC,QAAQ,CAAC,MAAM,CAAC;gBAClD,MAAM,EAAE,KAAK,CAAC,MAAM;gBACpB,oBAAoB,EAAE,KAAK,CAAC,QAAQ;gBACpC,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,MAAM,CAAC,KAAK,EAAE,CAAC;gBAC1D,GAAG,CAAC,KAAK,CAAC,aAAa,KAAK,SAAS;oBACnC,CAAC,CAAC,EAAE;oBACJ,CAAC,CAAC,EAAE,aAAa,EAAE,KAAK,CAAC,aAAa,EAAE,CAAC;gBAC3C,QAAQ,EAAE,wBAAwB,CAAC,KAAK,CAAC;aAC1C,CAAC,CAAC;YAEH,KAAK,CAAC,CAAC,WAAW,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC;YACnC,KAAK,CAAC,CAAC,MAAM,CAAC,mBAAmB,CAAC,aAAa,EAAE,eAAe,CAAC,CAAC;YAElE,OAAO,EAAE,IAAI,EAAE,eAAwB,EAAE,OAAO,EAAE,CAAC;QACrD,CAAC,CAAC;QACF,OAAO,EAAE,MAAM,CAAC,EAAE,CAAC,iCAAiC,CAAC,CAAC,QAAQ,CAAC,EAAE,KAAK;YACpE,IAAI,CAAC,KAAK,CAAC,kBAAkB,EAAE,CAAC;gBAC9B,OAAO,2BAA2B,EAAE,CAAC;YACvC,CAAC;YACD,MAAM,MAAM,GAAG,KAAK,CAAC,CAAC,cAAc,CAAC,KAAK,CAAC,CAAC;YAC5C,IAAI,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE,CAAC;gBAC1B,OAAO,EAAE,IAAI,EAAE,cAAuB,EAAE,CAAC;YAC3C,CAAC;YACD,IAAI,YAAY,CAAC,QAAQ,CAAC,aAAa,KAAK,SAAS,EAAE,CAAC;gBACtD,OAAO;oBACL,IAAI,EAAE,cAAuB;oBAC7B,MAAM,EAAE,yCAAyC;iBAClD,CAAC;YACJ,CAAC;YACD,MAAM,QAAQ,GAAG,KAAK,CAAC,CAAC,YAAY,CAAC,QAAQ,CAAC,aAAa,CAAC;gBAC1D,MAAM,EAAE,KAAK,CAAC,MAAM;gBACpB,oBAAoB,EAAE,KAAK,CAAC,QAAQ;gBACpC,MAAM,EAAE,MAAM,CAAC,KAAK;gBACpB,QAAQ,EAAE,wBAAwB,CAAC,KAAK,CAAC;aAC1C,CAAC,CAAC;YAEH,OAAO;gBACL,IAAI,EAAE,uBAAgC;gBACtC,QAAQ;gBACR,MAAM,EAAE,WAAW,CAAC,KAAK,EAAE,QAAQ,CAAC,OAAO,CAAC;aAC7C,CAAC;QACJ,CAAC,CAAC;KACH,CAAC;AACJ,CAAC,CAAC;AAWF,MAAM,OAAO,iBAAkB,SAAQ,OAAO,CAAC,OAAO,EAGnD,CAAC,iCAAiC,CAAC;CAAG;AAEzC,MAAM,CAAC,MAAM,qBAAqB,GAAG,KAAK,CAAC,MAAM,CAC/C,iBAAiB,EACjB,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC;IAClB,MAAM,QAAQ,GAAG,KAAK,CAAC,CAAC,QAAQ,CAAC;IACjC,MAAM,iBAAiB,GAAG,KAAK,CAAC,CAAC,MAAM,CAAC,aAAa,CAAC,iBAAiB,CAAC,CAAC;IACzE,MAAM,yBAAyB,GAAG,KAAK,CAAC,CAAC,MAAM,CAAC,aAAa,CAC3D,yBAAyB,CAC1B,CAAC;IACF,MAAM,QAAQ,GAAG,oBAAoB,CAAC;QACpC,QAAQ;QACR,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC,iBAAiB,CAAC;YAClC,CAAC,CAAC,EAAE,iBAAiB,EAAE,iBAAiB,CAAC,KAAK,EAAE;YAChD,CAAC,CAAC,EAAE,CAAC;QACP,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC,yBAAyB,CAAC;YAC1C,CAAC,CAAC,EAAE,yBAAyB,EAAE,yBAAyB,CAAC,KAAK,EAAE;YAChE,CAAC,CAAC,EAAE,CAAC;KACR,CAAC,CAAC;IAEH,OAAO,iBAAiB,CAAC,EAAE,CAAC;QAC1B,QAAQ,EAAE,CAAC,KAAK,EAAE,EAAE,CAClB,QAAQ,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;KACjE,CAAC,CAAC;AACL,CAAC,CAAC,CACH,CAAC"}

package/migrations/0001_auth_storage.sql

@@ -5,6 +5,7 @@ create table if not exists auth_session (
   created_at integer not null,
   expires_at integer not null,
   auth_time integer not null,
+  authentication_events text not null,
   aal text not null,
   amr text not null,
   mfa_verified_at integer,

package/migrations/0006_auth_totp_factor.sql

@@ -8,6 +8,7 @@ create table if not exists auth_totp_factor (
   created_at integer not null,
   confirmed_at integer,
   last_used_at integer,
+  last_accepted_counter integer,
   revoked_at integer,
   metadata text
 );

package/migrations/0024_auth_permission.sql

@@ -0,0 +1,39 @@
+create table if not exists auth_permission_grant (
+  subject_type text not null,
+  subject_id text not null,
+  permission_id text not null,
+  scope_type text not null,
+  scope_id_present integer not null,
+  scope_id text not null,
+  expires_at integer,
+  metadata text,
+  revoked_at integer,
+  primary key (subject_type, subject_id, permission_id, scope_type, scope_id_present, scope_id)
+);
+
+create index if not exists auth_permission_grant_check_idx on auth_permission_grant (subject_type, subject_id, permission_id, revoked_at, expires_at);
+
+create table if not exists auth_role_grant (
+  subject_type text not null,
+  subject_id text not null,
+  role_id text not null,
+  scope_type text not null,
+  scope_id_present integer not null,
+  scope_id text not null,
+  expires_at integer,
+  metadata text,
+  revoked_at integer,
+  primary key (subject_type, subject_id, role_id, scope_type, scope_id_present, scope_id)
+);
+
+create index if not exists auth_role_grant_check_idx on auth_role_grant (subject_type, subject_id, role_id, revoked_at, expires_at);
+
+create table if not exists auth_role_permission (
+  role_id text not null,
+  permission_id text not null,
+  scope_type_present integer not null,
+  scope_type text not null,
+  primary key (role_id, permission_id, scope_type_present, scope_type)
+);
+
+create index if not exists auth_role_permission_check_idx on auth_role_permission (permission_id, role_id, scope_type_present, scope_type);

package/migrations/0025_auth_permission_definition.sql

@@ -0,0 +1,19 @@
+create table if not exists auth_permission_definition (
+  id text primary key,
+  description text,
+  scope_type_present integer not null,
+  scope_type text not null,
+  created_at integer not null,
+  updated_at integer not null,
+  disabled_at integer,
+  deleted_at integer
+);
+
+create table if not exists auth_role_definition (
+  id text primary key,
+  description text,
+  created_at integer not null,
+  updated_at integer not null,
+  disabled_at integer,
+  deleted_at integer
+);

package/migrations/0026_auth_user_identity.sql

@@ -0,0 +1,59 @@
+create table if not exists auth_user_identity (
+  id text primary key,
+  user_id text not null,
+  scope_type text not null,
+  scope_id text not null,
+  kind text not null,
+  value text not null,
+  normalized_value text not null,
+  verified_at integer,
+  is_primary_login integer not null,
+  created_at integer not null,
+  updated_at integer not null,
+  revoked_at integer,
+  replaced_by_id text,
+  metadata text
+);
+
+insert into auth_user_identity (
+  id,
+  user_id,
+  scope_type,
+  scope_id,
+  kind,
+  value,
+  normalized_value,
+  verified_at,
+  is_primary_login,
+  created_at,
+  updated_at,
+  revoked_at,
+  replaced_by_id,
+  metadata
+)
+select
+  'legacy-email:' || id,
+  id,
+  'global',
+  '',
+  'email',
+  email,
+  substr(email, 1, instr(email, '@') - 1) || lower(substr(email, instr(email, '@'))),
+  case when email_verified <> 0 then updated_at else null end,
+  1,
+  created_at,
+  updated_at,
+  null,
+  null,
+  null
+from auth_user;
+
+drop index auth_user_email_idx;
+
+alter table auth_user drop column email;
+alter table auth_user drop column email_verified;
+
+create unique index auth_user_identity_active_value_idx on auth_user_identity (scope_type, scope_id, kind, normalized_value) where revoked_at is null;
+create index auth_user_identity_user_id_idx on auth_user_identity (user_id);
+create index auth_user_identity_replaced_by_id_idx on auth_user_identity (replaced_by_id);
+create unique index auth_user_identity_active_primary_idx on auth_user_identity (user_id) where revoked_at is null and is_primary_login = 1;

package/migrations/0027_auth_audit_log_storage_order.sql

@@ -0,0 +1,46 @@
+alter table auth_audit_log rename to auth_audit_log_legacy;
+
+create table auth_audit_log (
+  storage_id integer primary key autoincrement,
+  id text,
+  type text not null,
+  user_id text,
+  actor_user_id text,
+  occurred_at integer not null,
+  request_ip_hash text,
+  request_user_agent_hash text,
+  event text not null,
+  created_at integer not null
+);
+
+insert into auth_audit_log (
+  id,
+  type,
+  user_id,
+  actor_user_id,
+  occurred_at,
+  request_ip_hash,
+  request_user_agent_hash,
+  event,
+  created_at
+)
+select
+  id,
+  type,
+  user_id,
+  actor_user_id,
+  occurred_at,
+  request_ip_hash,
+  request_user_agent_hash,
+  event,
+  created_at
+from auth_audit_log_legacy
+order by rowid;
+
+drop table auth_audit_log_legacy;
+
+create index auth_audit_log_id_idx on auth_audit_log (id);
+create index auth_audit_log_user_occurred_at_idx on auth_audit_log (user_id, occurred_at);
+create index auth_audit_log_actor_user_occurred_at_idx on auth_audit_log (actor_user_id, occurred_at);
+create index auth_audit_log_type_occurred_at_idx on auth_audit_log (type, occurred_at);
+create index auth_audit_log_occurred_at_idx on auth_audit_log (occurred_at);

package/migrations/0028_auth_oauth_client_secret_key.sql

@@ -0,0 +1,39 @@
+alter table auth_oauth_client_secret rename to auth_oauth_client_secret_legacy;
+
+create table auth_oauth_client_secret (
+  prefix text not null,
+  client_id text not null,
+  secret_hash text not null,
+  authentication_methods text not null,
+  created_at integer not null,
+  expires_at integer,
+  last_used_at integer,
+  revoked_at integer,
+  metadata text,
+  primary key (client_id, prefix)
+);
+
+insert into auth_oauth_client_secret (
+  prefix,
+  client_id,
+  secret_hash,
+  authentication_methods,
+  created_at,
+  expires_at,
+  last_used_at,
+  revoked_at,
+  metadata
+)
+select
+  prefix,
+  client_id,
+  secret_hash,
+  authentication_methods,
+  created_at,
+  expires_at,
+  last_used_at,
+  revoked_at,
+  metadata
+from auth_oauth_client_secret_legacy;
+
+drop table auth_oauth_client_secret_legacy;

package/migrations/delegated-access/0001_auth_delegated_access.sql

@@ -0,0 +1,152 @@
+create table if not exists auth_invitation (
+  id text primary key,
+  kind text not null,
+  target_type text not null,
+  target_id text not null,
+  intent_type text not null,
+  intent_version integer not null,
+  intent_payload text not null,
+  recipient_type text,
+  recipient_reference text,
+  issued_by_type text,
+  issued_by_id text,
+  created_at integer not null,
+  expires_at integer not null,
+  token_hash text not null,
+  accepted_at integer,
+  accepted_by_type text,
+  accepted_by_id text,
+  revoked_at integer,
+  superseded_at integer,
+  superseded_by_id text,
+  metadata text,
+  check (length(id) = 22 and id not glob '*[^A-Za-z0-9_-]*'),
+  check (length(kind) > 0),
+  check (length(target_type) > 0 and length(target_id) > 0),
+  check (length(intent_type) > 0),
+  check (typeof(intent_version) = 'integer' and intent_version >= 1),
+  check (
+    case
+      when json_valid(intent_payload) then json_type(intent_payload) = 'object'
+      else 0
+    end
+  ),
+  check ((recipient_type is null) = (recipient_reference is null)),
+  check (recipient_type is null or (length(recipient_type) > 0 and length(recipient_reference) > 0)),
+  check ((issued_by_type is null) = (issued_by_id is null)),
+  check (issued_by_type is null or (length(issued_by_type) > 0 and length(issued_by_id) > 0)),
+  check (typeof(created_at) = 'integer' and created_at >= 0),
+  check (typeof(expires_at) = 'integer' and expires_at > created_at),
+  check (length(token_hash) > 7 and substr(token_hash, 1, 7) = 'sha256:'),
+  check ((accepted_at is null) = (accepted_by_type is null)),
+  check ((accepted_by_type is null) = (accepted_by_id is null)),
+  check (accepted_by_type is null or (length(accepted_by_type) > 0 and length(accepted_by_id) > 0)),
+  check ((superseded_at is null) = (superseded_by_id is null)),
+  check (
+    superseded_by_id is null or
+      (length(superseded_by_id) = 22 and superseded_by_id not glob '*[^A-Za-z0-9_-]*')
+  ),
+  check (
+    (accepted_at is not null) +
+      (revoked_at is not null) +
+      (superseded_at is not null) <= 1
+  ),
+  check (accepted_at is null or (typeof(accepted_at) = 'integer' and accepted_at >= created_at)),
+  check (revoked_at is null or (typeof(revoked_at) = 'integer' and revoked_at >= created_at)),
+  check (superseded_at is null or (typeof(superseded_at) = 'integer' and superseded_at >= created_at)),
+  check (
+    metadata is null or
+      case
+        when json_valid(metadata) then json_type(metadata) = 'object'
+        else 0
+      end
+  )
+);
+
+create index if not exists auth_invitation_created_at_idx
+  on auth_invitation (created_at, id);
+create index if not exists auth_invitation_kind_created_at_idx
+  on auth_invitation (kind, created_at, id);
+create index if not exists auth_invitation_target_created_at_idx
+  on auth_invitation (target_type, target_id, created_at, id);
+create index if not exists auth_invitation_recipient_created_at_idx
+  on auth_invitation (recipient_type, recipient_reference, created_at, id);
+create index if not exists auth_invitation_issued_by_created_at_idx
+  on auth_invitation (issued_by_type, issued_by_id, created_at, id);
+create index if not exists auth_invitation_pending_expires_at_idx
+  on auth_invitation (expires_at, created_at, id)
+  where accepted_at is null and revoked_at is null and superseded_at is null;
+
+create table if not exists auth_access_grant (
+  id text primary key,
+  target_type text not null,
+  target_id text not null,
+  capabilities text not null,
+  binding_type text not null,
+  binding_subject_type text,
+  binding_subject_id text,
+  issuer_type text,
+  issuer_id text,
+  created_at integer not null,
+  expires_at integer,
+  token_hash text,
+  revoked_at integer,
+  superseded_at integer,
+  superseded_by_id text,
+  metadata text,
+  check (length(id) = 22 and id not glob '*[^A-Za-z0-9_-]*'),
+  check (length(target_type) > 0 and length(target_id) > 0),
+  check (
+    case
+      when json_valid(capabilities) then
+        json_type(capabilities) = 'array' and json_array_length(capabilities) > 0
+      else 0
+    end
+  ),
+  check (binding_type in ('bearer', 'subject', 'subject-and-bearer')),
+  check ((binding_subject_type is null) = (binding_subject_id is null)),
+  check (binding_subject_type is null or (length(binding_subject_type) > 0 and length(binding_subject_id) > 0)),
+  check (
+    (binding_type = 'bearer' and binding_subject_type is null) or
+      (binding_type in ('subject', 'subject-and-bearer') and binding_subject_type is not null)
+  ),
+  check ((issuer_type is null) = (issuer_id is null)),
+  check (issuer_type is null or (length(issuer_type) > 0 and length(issuer_id) > 0)),
+  check (typeof(created_at) = 'integer' and created_at >= 0),
+  check (
+    expires_at is null or
+      (typeof(expires_at) = 'integer' and expires_at > created_at)
+  ),
+  check ((binding_type = 'subject') = (token_hash is null)),
+  check (
+    token_hash is null or
+      (length(token_hash) > 7 and substr(token_hash, 1, 7) = 'sha256:')
+  ),
+  check ((superseded_at is null) = (superseded_by_id is null)),
+  check (
+    superseded_by_id is null or
+      (length(superseded_by_id) = 22 and superseded_by_id not glob '*[^A-Za-z0-9_-]*')
+  ),
+  check ((revoked_at is not null) + (superseded_at is not null) <= 1),
+  check (revoked_at is null or (typeof(revoked_at) = 'integer' and revoked_at >= created_at)),
+  check (superseded_at is null or (typeof(superseded_at) = 'integer' and superseded_at >= created_at)),
+  check (
+    metadata is null or
+      case
+        when json_valid(metadata) then json_type(metadata) = 'object'
+        else 0
+      end
+  )
+);
+
+create index if not exists auth_access_grant_created_at_idx
+  on auth_access_grant (created_at, id);
+create index if not exists auth_access_grant_target_created_at_idx
+  on auth_access_grant (target_type, target_id, created_at, id);
+create index if not exists auth_access_grant_issuer_created_at_idx
+  on auth_access_grant (issuer_type, issuer_id, created_at, id);
+create index if not exists auth_access_grant_subject_created_at_idx
+  on auth_access_grant (binding_subject_type, binding_subject_id, created_at, id);
+create index if not exists auth_access_grant_active_expires_at_idx
+  on auth_access_grant (expires_at, created_at, id)
+  where revoked_at is null and superseded_at is null;

package/migrations/postgres/0001_auth_core.sql

@@ -0,0 +1,77 @@
+create table auth_user (
+  id text constraint auth_user_pkey primary key,
+  created_at bigint not null,
+  updated_at bigint not null,
+  disabled_at bigint,
+  metadata jsonb
+);
+
+create table auth_user_identity (
+  id text constraint auth_user_identity_pkey primary key,
+  user_id text not null,
+  scope_type text not null,
+  scope_id text not null,
+  kind text not null,
+  value text not null,
+  normalized_value text not null,
+  verified_at bigint,
+  is_primary_login boolean not null default false,
+  created_at bigint not null,
+  updated_at bigint not null,
+  revoked_at bigint,
+  replaced_by_id text,
+  metadata jsonb
+);
+create unique index auth_user_identity_active_value_idx
+  on auth_user_identity (scope_type, scope_id, kind, normalized_value)
+  where revoked_at is null;
+create unique index auth_user_identity_active_primary_idx
+  on auth_user_identity (user_id) where revoked_at is null and is_primary_login;
+create index auth_user_identity_user_id_idx on auth_user_identity (user_id);
+create index auth_user_identity_replaced_by_id_idx on auth_user_identity (replaced_by_id);
+
+create table auth_credential (
+  id text constraint auth_credential_pkey primary key,
+  user_id text not null,
+  type text not null,
+  password_hash text,
+  created_at bigint not null,
+  updated_at bigint not null,
+  revoked_at bigint,
+  metadata jsonb,
+  constraint auth_credential_user_type_key unique (user_id, type)
+);
+create index auth_credential_user_id_idx on auth_credential (user_id);
+
+create table auth_session (
+  id text constraint auth_session_pkey primary key,
+  user_id text not null,
+  secret_hash text not null,
+  created_at bigint not null,
+  expires_at bigint not null,
+  auth_time bigint not null,
+  authentication_events jsonb not null,
+  aal text not null,
+  amr jsonb not null,
+  claims jsonb,
+  mfa_verified_at bigint,
+  metadata jsonb,
+  revoked_at bigint,
+  last_seen_at bigint,
+  rotated_at bigint
+);
+create index auth_session_user_id_idx on auth_session (user_id);
+create index auth_session_expires_at_idx on auth_session (expires_at);
+
+create table auth_verification (
+  id text constraint auth_verification_pkey primary key,
+  type text not null,
+  subject text not null,
+  secret_hash text,
+  created_at bigint not null,
+  expires_at bigint not null,
+  metadata jsonb,
+  consumed_at bigint
+);
+create index auth_verification_type_subject_idx on auth_verification (type, subject);
+create index auth_verification_expires_at_idx on auth_verification (expires_at);