@effect-auth/core 0.1.0-alpha.16 → 0.1.0-alpha.19

package/dist/AccessGrant.js

@@ -0,0 +1,687 @@
+import { Array as EffectArray, Brand, Context, Data, Effect, Encoding, Layer, Option, Order, Redacted, Result, Schema, } from "effect";
+import { Crypto } from "./Crypto.js";
+import { UnixMillisSchema } from "./Identifiers.js";
+import { currentUnixMillis } from "./Internal.js";
+import { CurrentPrincipal, PermissionSubject } from "./Permission.js";
+export const AccessGrantId = Brand.nominal();
+export const AccessGrantIdSchema = Schema.String.check(Schema.isPattern(/^[A-Za-z0-9_-]{22}$/)).pipe(Schema.brand("auth/AccessGrantId"));
+export const AccessGrantToken = Brand.nominal();
+export const AccessGrantTokenHash = Brand.nominal();
+export const AccessGrantTokenHashSchema = Schema.String.check(Schema.isPattern(/^sha256:.+$/)).pipe(Schema.brand("auth/AccessGrantTokenHash"));
+export const accessGrantTokenVersion = "agr1";
+export const accessGrantIdBytes = 16;
+export const accessGrantSecretBytes = 32;
+const accessGrantIdEncodedLength = Math.ceil((accessGrantIdBytes * 4) / 3);
+const accessGrantSecretEncodedLength = Math.ceil((accessGrantSecretBytes * 4) / 3);
+const accessGrantTokenLength = accessGrantTokenVersion.length +
+    accessGrantIdEncodedLength +
+    accessGrantSecretEncodedLength +
+    2;
+const accessGrantHashDomain = "effect-auth:access-grant-token:v1\u0000";
+const textEncoder = new TextEncoder();
+export class AccessGrantTokenError extends Data.TaggedError("AccessGrantTokenError") {
+}
+const accessGrantTokenError = (operation, message, cause) => new AccessGrantTokenError({
+    operation,
+    message,
+    ...(cause === undefined ? {} : { cause }),
+});
+const parseTokenSegment = (segment, expectedBytes, expectedEncodedLength, label, operation) => {
+    if (segment.length !== expectedEncodedLength ||
+        !/^[A-Za-z0-9_-]+$/.test(segment)) {
+        return Effect.fail(accessGrantTokenError(operation, `Access grant ${label} is malformed`));
+    }
+    const decoded = Encoding.decodeBase64Url(segment);
+    if (Result.isFailure(decoded) ||
+        Encoding.encodeBase64Url(decoded.success) !== segment ||
+        decoded.success.length !== expectedBytes) {
+        return Effect.fail(accessGrantTokenError(operation, `Access grant ${label} is malformed`));
+    }
+    return Effect.succeed(decoded.success);
+};
+const parseAccessGrantTokenValue = (value, operation) => Effect.gen(function* () {
+    if (value.length !== accessGrantTokenLength) {
+        return yield* accessGrantTokenError(operation, "Access grant token is malformed");
+    }
+    const parts = value.split(".");
+    if (parts.length !== 3 || parts[0] !== accessGrantTokenVersion) {
+        return yield* accessGrantTokenError(operation, "Access grant token is malformed");
+    }
+    const id = parts[1] ?? "";
+    const secret = parts[2] ?? "";
+    yield* parseTokenSegment(id, accessGrantIdBytes, accessGrantIdEncodedLength, "id", operation);
+    yield* parseTokenSegment(secret, accessGrantSecretBytes, accessGrantSecretEncodedLength, "secret", operation);
+    return { id: AccessGrantId(id) };
+});
+const hashAccessGrantTokenValue = (crypto, value, operation) => crypto.digestSha256({ data: `${accessGrantHashDomain}${value}` }).pipe(Effect.map((hash) => AccessGrantTokenHash(`sha256:${hash}`)), Effect.mapError((cause) => accessGrantTokenError(operation, "Failed to hash access grant token", cause)));
+export class AccessGrantTokens extends Context.Service()("auth/AccessGrantTokens", {
+    make: Effect.gen(function* () {
+        const crypto = yield* Crypto;
+        const randomSegment = (byteLength) => Effect.gen(function* () {
+            const bytes = yield* crypto
+                .randomBytes(byteLength)
+                .pipe(Effect.mapError((cause) => accessGrantTokenError("generate", "Failed to generate access grant token", cause)));
+            if (bytes.length !== byteLength) {
+                return yield* accessGrantTokenError("generate", "Crypto returned an unexpected access grant token byte length");
+            }
+            return Encoding.encodeBase64Url(bytes);
+        });
+        const generateId = Effect.fn("auth.access_grant.tokens.generate_id")(function* () {
+            return AccessGrantId(yield* randomSegment(accessGrantIdBytes));
+        });
+        return {
+            generateId,
+            generate: Effect.fn("auth.access_grant.tokens.generate")(function* () {
+                const id = yield* generateId();
+                const secret = yield* randomSegment(accessGrantSecretBytes);
+                const token = AccessGrantToken(`${accessGrantTokenVersion}.${id}.${secret}`);
+                return { id, token: Redacted.make(token) };
+            }),
+            parse: Effect.fn("auth.access_grant.tokens.parse")(function* (token) {
+                return yield* parseAccessGrantTokenValue(Redacted.value(token), "parse");
+            }),
+            hash: Effect.fn("auth.access_grant.tokens.hash")(function* (input) {
+                const value = Redacted.value(input.token);
+                yield* parseAccessGrantTokenValue(value, "hash");
+                return yield* hashAccessGrantTokenValue(crypto, value, "hash");
+            }),
+            verify: Effect.fn("auth.access_grant.tokens.verify")(function* (input) {
+                const value = Redacted.value(input.token);
+                const parsed = yield* parseAccessGrantTokenValue(value, "verify").pipe(Effect.catchTag("AccessGrantTokenError", () => Effect.succeed(undefined)));
+                if (parsed === undefined) {
+                    return false;
+                }
+                const hash = yield* hashAccessGrantTokenValue(crypto, value, "verify");
+                return yield* crypto
+                    .timingSafeEqual({
+                    left: textEncoder.encode(hash),
+                    right: textEncoder.encode(input.tokenHash),
+                })
+                    .pipe(Effect.mapError((cause) => accessGrantTokenError("verify", "Failed to compare access grant token hashes", cause)));
+            }),
+        };
+    }),
+}) {
+}
+export const AccessGrantTokensSha256Live = Layer.effect(AccessGrantTokens)(AccessGrantTokens.make);
+export const AccessGrantTarget = {
+    make: (type, id) => ({ type, id }),
+};
+export const AccessGrantBinding = {
+    bearer: () => ({ type: "bearer" }),
+    subject: (subject) => ({
+        type: "subject",
+        subject,
+    }),
+    subjectAndBearer: (subject) => ({
+        type: "subject-and-bearer",
+        subject,
+    }),
+};
+const hasConsistentAccessGrantLifecycle = (record) => (record.supersededAt !== undefined) ===
+    (record.supersededById !== undefined) &&
+    Number(record.revokedAt !== undefined) +
+        Number(record.supersededAt !== undefined) <=
+        1;
+const NonEmptyStringSchema = Schema.String.check(Schema.isMinLength(1));
+const DelegatedUnixMillisSchema = UnixMillisSchema.check(Schema.isInt(), Schema.isGreaterThanOrEqualTo(0));
+const PermissionSubjectSchema = Schema.Struct({
+    type: NonEmptyStringSchema,
+    id: NonEmptyStringSchema,
+});
+export const AccessGrantJsonObjectSchema = Schema.Record(Schema.String, Schema.Json);
+export const AccessGrantTargetSchema = Schema.Struct({
+    type: NonEmptyStringSchema,
+    id: NonEmptyStringSchema,
+});
+export const AccessGrantBindingSchema = Schema.Union([
+    Schema.Struct({ type: Schema.Literal("bearer") }),
+    Schema.Struct({
+        type: Schema.Literal("subject"),
+        subject: PermissionSubjectSchema,
+    }),
+    Schema.Struct({
+        type: Schema.Literal("subject-and-bearer"),
+        subject: PermissionSubjectSchema,
+    }),
+]);
+const AccessGrantCapabilitiesSchema = Schema.Array(NonEmptyStringSchema).check(Schema.isMinLength(1), Schema.makeFilter((capabilities) => new Set(capabilities).size === capabilities.length
+    ? undefined
+    : "Access grant capabilities must be unique"));
+export const AccessGrantRecordSchema = Schema.Struct({
+    id: AccessGrantIdSchema,
+    target: AccessGrantTargetSchema,
+    capabilities: AccessGrantCapabilitiesSchema,
+    binding: AccessGrantBindingSchema,
+    issuer: Schema.optional(PermissionSubjectSchema),
+    createdAt: DelegatedUnixMillisSchema,
+    expiresAt: Schema.optional(DelegatedUnixMillisSchema),
+    tokenHash: Schema.optional(AccessGrantTokenHashSchema),
+    revokedAt: Schema.optional(DelegatedUnixMillisSchema),
+    supersededAt: Schema.optional(DelegatedUnixMillisSchema),
+    supersededById: Schema.optional(AccessGrantIdSchema),
+    metadata: Schema.optional(AccessGrantJsonObjectSchema),
+}).check(Schema.makeFilter((record) => {
+    if (!hasConsistentAccessGrantLifecycle(record)) {
+        return "Access grant terminal state is inconsistent";
+    }
+    if ((record.binding.type === "subject") ===
+        (record.tokenHash !== undefined)) {
+        return "Access grant credential shape does not match its binding";
+    }
+    if (record.expiresAt !== undefined &&
+        Number(record.expiresAt) <= Number(record.createdAt)) {
+        return "Access grant expiry must be later than creation";
+    }
+    for (const terminalAt of [record.revokedAt, record.supersededAt]) {
+        if (terminalAt !== undefined &&
+            Number(terminalAt) < Number(record.createdAt)) {
+            return "Access grant terminal time must not precede creation";
+        }
+    }
+    return undefined;
+}));
+export const isAccessGrantRecord = Schema.is(AccessGrantRecordSchema);
+const isAccessGrantJsonObject = Schema.is(AccessGrantJsonObjectSchema);
+const cloneMetadata = (metadata) => metadata === undefined ? undefined : structuredClone(metadata);
+const cloneSubject = (subject) => ({
+    type: subject.type,
+    id: subject.id,
+});
+const cloneTarget = (target) => ({
+    type: target.type,
+    id: target.id,
+});
+const cloneBinding = (binding) => {
+    switch (binding.type) {
+        case "bearer": {
+            return AccessGrantBinding.bearer();
+        }
+        case "subject": {
+            return AccessGrantBinding.subject(cloneSubject(binding.subject));
+        }
+        case "subject-and-bearer": {
+            return AccessGrantBinding.subjectAndBearer(cloneSubject(binding.subject));
+        }
+    }
+};
+const cloneAccessGrantBase = (grant) => ({
+    id: grant.id,
+    target: cloneTarget(grant.target),
+    capabilities: [...grant.capabilities],
+    ...(grant.issuer === undefined ? {} : { issuer: cloneSubject(grant.issuer) }),
+    createdAt: grant.createdAt,
+    ...(grant.expiresAt === undefined ? {} : { expiresAt: grant.expiresAt }),
+    ...(grant.revokedAt === undefined ? {} : { revokedAt: grant.revokedAt }),
+    ...(grant.supersededAt === undefined
+        ? {}
+        : { supersededAt: grant.supersededAt }),
+    ...(grant.supersededById === undefined
+        ? {}
+        : { supersededById: grant.supersededById }),
+    ...(grant.metadata === undefined
+        ? {}
+        : { metadata: cloneMetadata(grant.metadata) }),
+});
+const cloneAccessGrantRecord = (record) => {
+    const base = cloneAccessGrantBase(record);
+    if (record.binding.type === "subject") {
+        return {
+            ...base,
+            binding: cloneBinding(record.binding),
+        };
+    }
+    return {
+        ...base,
+        binding: cloneBinding(record.binding),
+        tokenHash: record.tokenHash,
+    };
+};
+const safeAccessGrant = (record) => {
+    const base = cloneAccessGrantBase(record);
+    if (record.binding.type === "subject") {
+        return {
+            ...base,
+            binding: cloneBinding(record.binding),
+        };
+    }
+    return {
+        ...base,
+        binding: cloneBinding(record.binding),
+    };
+};
+const subjectsMatch = (left, right) => left.type === right.type && left.id === right.id;
+const targetsMatch = (left, right) => left.type === right.type && left.id === right.id;
+const boundSubject = (binding) => binding.type === "bearer" ? undefined : binding.subject;
+const isAccessGrantActive = (record, now) => hasConsistentAccessGrantLifecycle(record) &&
+    record.revokedAt === undefined &&
+    record.supersededAt === undefined &&
+    (record.expiresAt === undefined || Number(now) < Number(record.expiresAt));
+export class AccessGrantStoreError extends Data.TaggedError("AccessGrantStoreError") {
+}
+export class AccessGrantStore extends Context.Service()("auth/AccessGrantStore") {
+}
+const compareAccessGrantRecords = (left, right) => {
+    const createdAt = Number(left.createdAt) - Number(right.createdAt);
+    if (createdAt !== 0) {
+        return createdAt < 0 ? -1 : 1;
+    }
+    return String(left.id) < String(right.id)
+        ? -1
+        : String(left.id) > String(right.id)
+            ? 1
+            : 0;
+};
+const AccessGrantRecordOrder = Order.make(compareAccessGrantRecords);
+const accessGrantStoreMemory = Effect.sync(() => {
+    const grants = new Map();
+    return {
+        insert: Effect.fn("auth.access_grant.store.insert")(function* (record) {
+            if (!isAccessGrantRecord(record)) {
+                return yield* new AccessGrantStoreError({
+                    operation: "insert",
+                    message: "Access grant record is invalid",
+                });
+            }
+            if (grants.has(record.id)) {
+                return false;
+            }
+            grants.set(record.id, cloneAccessGrantRecord(record));
+            return true;
+        }),
+        findById: Effect.fn("auth.access_grant.store.find_by_id")((id) => Effect.sync(() => {
+            const record = grants.get(id);
+            return record === undefined
+                ? Option.none()
+                : Option.some(cloneAccessGrantRecord(record));
+        })),
+        list: Effect.fn("auth.access_grant.store.list")((input) => Effect.sync(() => EffectArray.sort([...grants.values()].filter((record) => (input?.target === undefined ||
+            targetsMatch(record.target, input.target)) &&
+            (input?.issuer === undefined ||
+                (record.issuer !== undefined &&
+                    subjectsMatch(record.issuer, input.issuer))) &&
+            (input?.subject === undefined ||
+                (boundSubject(record.binding) !== undefined &&
+                    subjectsMatch(boundSubject(record.binding), input.subject)))), AccessGrantRecordOrder).map(cloneAccessGrantRecord))),
+        revoke: Effect.fn("auth.access_grant.store.revoke")(function* (input) {
+            const current = grants.get(input.id);
+            if (current === undefined ||
+                !isAccessGrantActive(current, input.revokedAt)) {
+                return Option.none();
+            }
+            const revoked = {
+                ...current,
+                revokedAt: input.revokedAt,
+            };
+            if (!isAccessGrantRecord(revoked)) {
+                return yield* new AccessGrantStoreError({
+                    operation: "revoke",
+                    message: "Revoked access grant record is invalid",
+                });
+            }
+            grants.set(input.id, revoked);
+            return Option.some(cloneAccessGrantRecord(revoked));
+        }),
+        supersede: Effect.fn("auth.access_grant.store.supersede")(function* (input) {
+            if (!isAccessGrantRecord(input.replacement)) {
+                return yield* new AccessGrantStoreError({
+                    operation: "supersede",
+                    message: "Replacement access grant record is invalid",
+                });
+            }
+            const current = grants.get(input.id);
+            if (current === undefined ||
+                grants.has(input.replacement.id) ||
+                !isAccessGrantActive(current, input.supersededAt)) {
+                return Option.none();
+            }
+            const previous = {
+                ...current,
+                supersededAt: input.supersededAt,
+                supersededById: input.replacement.id,
+            };
+            if (!isAccessGrantRecord(previous)) {
+                return yield* new AccessGrantStoreError({
+                    operation: "supersede",
+                    message: "Superseded access grant record is invalid",
+                });
+            }
+            const replacement = cloneAccessGrantRecord(input.replacement);
+            grants.set(previous.id, previous);
+            grants.set(replacement.id, replacement);
+            return Option.some({
+                previous: cloneAccessGrantRecord(previous),
+                replacement: cloneAccessGrantRecord(replacement),
+            });
+        }),
+    };
+});
+export const AccessGrantStoreMemoryLive = Layer.effect(AccessGrantStore)(accessGrantStoreMemory);
+export class AccessGrantManagementError extends Data.TaggedError("AccessGrantManagementError") {
+}
+const managementError = (operation, reason, message, cause) => new AccessGrantManagementError({
+    operation,
+    reason,
+    message,
+    ...(cause === undefined ? {} : { cause }),
+});
+const validateText = (value, label, operation) => value.trim().length > 0
+    ? Effect.void
+    : Effect.fail(managementError(operation, "invalid_input", `${label} must not be empty`));
+const validateTarget = (target, operation) => Effect.gen(function* () {
+    yield* validateText(target.type, "Access grant target type", operation);
+    yield* validateText(target.id, "Access grant target id", operation);
+});
+const validateSubject = (subject, label, operation) => Effect.gen(function* () {
+    yield* validateText(subject.type, `${label} type`, operation);
+    yield* validateText(subject.id, `${label} id`, operation);
+});
+const validateCapabilities = (capabilities, operation) => Effect.gen(function* () {
+    if (capabilities.length === 0) {
+        return yield* managementError(operation, "invalid_input", "Access grant capabilities must not be empty");
+    }
+    const seen = new Set();
+    for (const capability of capabilities) {
+        if (capability.trim().length === 0) {
+            return yield* managementError(operation, "invalid_input", "Access grant capability must not be empty");
+        }
+        if (seen.has(capability)) {
+            return yield* managementError(operation, "invalid_input", "Access grant capabilities must not contain duplicates");
+        }
+        seen.add(capability);
+    }
+    return [...capabilities];
+});
+const validateExpiry = (expiresAt, now, operation) => {
+    if (expiresAt === undefined) {
+        return Effect.void;
+    }
+    const value = Number(expiresAt);
+    return Number.isSafeInteger(value) && value > Number(now)
+        ? Effect.void
+        : Effect.fail(managementError(operation, "invalid_input", "Access grant expiry must be later than the current time"));
+};
+const validateMetadata = (metadata, operation) => metadata === undefined || isAccessGrantJsonObject(metadata)
+    ? Effect.void
+    : Effect.fail(managementError(operation, "invalid_input", "Access grant metadata must be JSON-compatible"));
+const prepareAccessGrantCredential = (tokens, binding, operation) => Effect.gen(function* () {
+    if (binding.type === "subject") {
+        const id = yield* tokens
+            .generateId()
+            .pipe(Effect.mapError((cause) => managementError(operation, "token", "Failed to generate access grant id", cause)));
+        return { type: "subject", id };
+    }
+    const generated = yield* tokens
+        .generate()
+        .pipe(Effect.mapError((cause) => managementError(operation, "token", "Failed to generate access grant token", cause)));
+    const tokenHash = yield* tokens
+        .hash({ token: generated.token })
+        .pipe(Effect.mapError((cause) => managementError(operation, "token", "Failed to hash access grant token", cause)));
+    return {
+        type: "bearer",
+        id: generated.id,
+        token: generated.token,
+        tokenHash,
+    };
+});
+const preparedAccessGrantRecord = (base, credential) => {
+    if (credential.type === "subject") {
+        return {
+            ...base,
+            id: credential.id,
+            target: cloneTarget(base.target),
+            capabilities: [...base.capabilities],
+            binding: cloneBinding(base.binding),
+        };
+    }
+    return {
+        ...base,
+        id: credential.id,
+        target: cloneTarget(base.target),
+        capabilities: [...base.capabilities],
+        binding: cloneBinding(base.binding),
+        tokenHash: credential.tokenHash,
+    };
+};
+const issuedAccessGrant = (record, credential) => {
+    const grant = safeAccessGrant(record);
+    return credential.type === "subject"
+        ? {
+            grant: grant,
+        }
+        : {
+            grant: grant,
+            token: credential.token,
+        };
+};
+const accessGrantLifecycleReason = (record, now) => !hasConsistentAccessGrantLifecycle(record)
+    ? "invalid-record"
+    : record.revokedAt !== undefined
+        ? "revoked"
+        : record.supersededAt !== undefined
+            ? "superseded"
+            : record.expiresAt !== undefined &&
+                Number(now) >= Number(record.expiresAt)
+                ? "expired"
+                : undefined;
+export class AccessGrantManagement extends Context.Service()("auth/AccessGrantManagement", {
+    make: Effect.gen(function* () {
+        const tokens = yield* AccessGrantTokens;
+        const store = yield* AccessGrantStore;
+        const storeError = (operation, message, effect) => effect.pipe(Effect.mapError((cause) => managementError(operation, "storage", message, cause)));
+        return {
+            issue: Effect.fn("auth.access_grant.management.issue")(function* (input) {
+                const now = yield* currentUnixMillis;
+                yield* validateTarget(input.target, "issue");
+                const capabilities = yield* validateCapabilities(input.capabilities, "issue");
+                if (input.binding.type !== "bearer") {
+                    yield* validateSubject(input.binding.subject, "Access grant binding subject", "issue");
+                }
+                if (input.issuer !== undefined) {
+                    yield* validateSubject(input.issuer, "Access grant issuer", "issue");
+                }
+                yield* validateExpiry(input.expiresAt, now, "issue");
+                yield* validateMetadata(input.metadata, "issue");
+                const credential = yield* prepareAccessGrantCredential(tokens, input.binding, "issue");
+                const record = preparedAccessGrantRecord({
+                    target: input.target,
+                    capabilities,
+                    binding: input.binding,
+                    ...(input.issuer === undefined ? {} : { issuer: input.issuer }),
+                    createdAt: now,
+                    ...(input.expiresAt === undefined
+                        ? {}
+                        : { expiresAt: input.expiresAt }),
+                    ...(input.metadata === undefined
+                        ? {}
+                        : { metadata: input.metadata }),
+                }, credential);
+                const inserted = yield* storeError("issue", "Failed to store access grant", store.insert(record));
+                if (!inserted) {
+                    return yield* managementError("issue", "conflict", "Access grant id already exists");
+                }
+                return issuedAccessGrant(record, credential);
+            }),
+            list: Effect.fn("auth.access_grant.management.list")(function* (input) {
+                const records = yield* storeError("list", "Failed to list access grants", store.list(input));
+                const activity = input?.activity ?? "active";
+                if (activity === "all") {
+                    return records.map(safeAccessGrant);
+                }
+                const now = yield* currentUnixMillis;
+                return records
+                    .filter((record) => (accessGrantLifecycleReason(record, now) === undefined) ===
+                    (activity === "active"))
+                    .map(safeAccessGrant);
+            }),
+            get: Effect.fn("auth.access_grant.management.get")(function* (id) {
+                const record = yield* storeError("get", "Failed to load access grant", store.findById(id));
+                return Option.map(record, safeAccessGrant);
+            }),
+            revoke: Effect.fn("auth.access_grant.management.revoke")(function* (input) {
+                const revokedAt = yield* currentUnixMillis;
+                const revoked = yield* storeError("revoke", "Failed to revoke access grant", store.revoke({ id: input.id, revokedAt }));
+                if (Option.isSome(revoked)) {
+                    return safeAccessGrant(revoked.value);
+                }
+                const current = yield* storeError("revoke", "Failed to reload access grant", store.findById(input.id));
+                return yield* managementError("revoke", Option.isNone(current) ? "not_found" : "inactive", Option.isNone(current)
+                    ? "Access grant was not found"
+                    : "Access grant is not active");
+            }),
+            supersede: Effect.fn("auth.access_grant.management.supersede")(function* (input) {
+                const now = yield* currentUnixMillis;
+                const currentOption = yield* storeError("supersede", "Failed to load access grant", store.findById(input.id));
+                if (Option.isNone(currentOption)) {
+                    return yield* managementError("supersede", "not_found", "Access grant was not found");
+                }
+                const current = currentOption.value;
+                if (accessGrantLifecycleReason(current, now) !== undefined) {
+                    return yield* managementError("supersede", "inactive", "Access grant is not active");
+                }
+                const expiresAt = input.expiresAt ?? current.expiresAt;
+                yield* validateExpiry(expiresAt, now, "supersede");
+                yield* validateMetadata(input.metadata, "supersede");
+                const credential = yield* prepareAccessGrantCredential(tokens, current.binding, "supersede");
+                const replacement = preparedAccessGrantRecord({
+                    target: current.target,
+                    capabilities: current.capabilities,
+                    binding: current.binding,
+                    ...(current.issuer === undefined
+                        ? {}
+                        : { issuer: current.issuer }),
+                    createdAt: now,
+                    ...(expiresAt === undefined ? {} : { expiresAt }),
+                    metadata: input.metadata ?? current.metadata,
+                }, credential);
+                const superseded = yield* storeError("supersede", "Failed to supersede access grant", store.supersede({
+                    id: current.id,
+                    supersededAt: now,
+                    replacement,
+                }));
+                if (Option.isNone(superseded)) {
+                    return yield* managementError("supersede", "conflict", "Access grant changed while it was being superseded");
+                }
+                const issued = issuedAccessGrant(superseded.value.replacement, credential);
+                return {
+                    ...issued,
+                    previous: safeAccessGrant(superseded.value.previous),
+                };
+            }),
+        };
+    }),
+}) {
+}
+export const AccessGrantManagementLive = Layer.effect(AccessGrantManagement)(AccessGrantManagement.make);
+export class AccessGrantAuthorizationError extends Data.TaggedError("AccessGrantAuthorizationError") {
+}
+/** Expected authorization denials from `require`; operational failures stay separate. */
+export class AccessGrantDeniedError extends Data.TaggedError("AccessGrantDeniedError") {
+}
+const denied = (reason, grantId) => ({
+    type: "denied",
+    reason,
+    ...(grantId === undefined ? {} : { grantId }),
+});
+const authorizationError = (kind, message, cause) => new AccessGrantAuthorizationError({
+    operation: "check",
+    kind,
+    message,
+    cause,
+});
+const resolveAccessGrantReference = (tokens, input) => Effect.gen(function* () {
+    if (input.bearerToken === undefined) {
+        return input.grantId ?? denied("grant-id-required");
+    }
+    const parsed = yield* tokens.parse(input.bearerToken).pipe(Effect.option);
+    if (Option.isNone(parsed)) {
+        return denied("malformed-token", input.grantId);
+    }
+    if (input.grantId !== undefined && input.grantId !== parsed.value.id) {
+        return denied("grant-reference-mismatch", input.grantId);
+    }
+    return input.grantId ?? parsed.value.id;
+});
+export class AccessGrants extends Context.Service()("auth/AccessGrants", {
+    make: Effect.gen(function* () {
+        const tokens = yield* AccessGrantTokens;
+        const store = yield* AccessGrantStore;
+        const check = Effect.fn("auth.access_grant.check")(function* (input) {
+            const reference = yield* resolveAccessGrantReference(tokens, input);
+            if (typeof reference !== "string") {
+                return reference;
+            }
+            const grantId = reference;
+            const recordOption = yield* store
+                .findById(grantId)
+                .pipe(Effect.mapError((cause) => authorizationError("store", "Failed to load access grant", cause)));
+            if (Option.isNone(recordOption)) {
+                return denied("grant-not-found", grantId);
+            }
+            const record = recordOption.value;
+            if (!isAccessGrantRecord(record)) {
+                return denied("invalid-record", grantId);
+            }
+            if (record.binding.type === "subject" && input.grantId === undefined) {
+                return denied("grant-id-required");
+            }
+            if (record.binding.type !== "subject") {
+                if (input.bearerToken === undefined) {
+                    return denied("bearer-required", grantId);
+                }
+                const valid = yield* tokens
+                    .verify({
+                    token: input.bearerToken,
+                    tokenHash: record.tokenHash,
+                })
+                    .pipe(Effect.mapError((cause) => authorizationError("token", "Failed to verify access grant token", cause)));
+                if (!valid) {
+                    return denied("invalid-bearer", grantId);
+                }
+            }
+            if (record.binding.type !== "bearer") {
+                const principal = yield* Effect.serviceOption(CurrentPrincipal);
+                if (Option.isNone(principal)) {
+                    return denied("subject-required", grantId);
+                }
+                if (!subjectsMatch(record.binding.subject, principal.value)) {
+                    return denied("subject-mismatch", grantId);
+                }
+            }
+            const now = yield* currentUnixMillis;
+            const lifecycleReason = accessGrantLifecycleReason(record, now);
+            if (lifecycleReason !== undefined) {
+                return denied(lifecycleReason, grantId);
+            }
+            if (!targetsMatch(record.target, input.target)) {
+                return denied("target-mismatch", grantId);
+            }
+            if (!record.capabilities.includes(input.action)) {
+                return denied("capability-missing", grantId);
+            }
+            return {
+                type: "allowed",
+                grant: safeAccessGrant(record),
+                principal: PermissionSubject.make("access-grant", record.id),
+            };
+        });
+        return {
+            check,
+            require: Effect.fn("auth.access_grant.require")(function* (input) {
+                const decision = yield* check(input);
+                if (decision.type === "denied") {
+                    return yield* new AccessGrantDeniedError({
+                        reason: decision.reason,
+                        ...(decision.grantId === undefined
+                            ? {}
+                            : { grantId: decision.grantId }),
+                    });
+                }
+                return decision;
+            }),
+        };
+    }),
+}) {
+}
+export const AccessGrantsLive = Layer.effect(AccessGrants)(AccessGrants.make);
+//# sourceMappingURL=AccessGrant.js.map