@effect-auth/core 0.1.0-alpha.16 → 0.1.0-alpha.19

package/dist/Sessions.js

@@ -1,15 +1,22 @@
-import { Context, Data, Duration, Effect, Layer, Option } from "effect";
+import { Context, Data, Duration, Effect, Layer, Option, Result } from "effect";
+import { AuthenticationEvidenceTimeError, CustomEvidencePolicies, CustomEvidencePolicyError, compactAuthenticationEventsResult, deriveAssuranceResult, deriveMfaVerifiedAtResult, emptyCustomEvidencePolicyRegistry, maximumSessionAuthenticationEvents, validateAuthenticationEvidenceTimestamps, } from "./Assurance.js";
 import { AuthSecrets, AuthSessionCookieConfig, AuthSessionsConfig, } from "./AuthConfig.js";
 import { Crypto } from "./Crypto.js";
-import { SessionId, SessionToken, UnixMillis } from "./Identifiers.js";
+import { SessionId, SessionToken, UnixMillis, } from "./Identifiers.js";
 import { addMillis, currentUnixMillis, timingSafeEqualString, } from "./Internal.js";
+import { RecoveryCodeSessionRotateStore } from "./RecoveryCode.js";
 import { SessionStore } from "./Storage.js";
+import { TotpSessionRotateStore } from "./Totp.js";
 export const sessionRequestMetadataKey = "__effectAuthRequest";
 export const defaultSessionTtlPolicy = {
     idleTtl: Duration.days(30),
     absoluteTtl: Duration.days(90),
     refreshAfter: Duration.days(1),
 };
+export class RecoveryCodeSessionRotation extends Context.Service()("auth/RecoveryCodeSessionRotation") {
+}
+export class TotpSessionRotation extends Context.Service()("auth/TotpSessionRotation") {
+}
 export class SessionCreateError extends Data.TaggedError("SessionCreateError") {
 }
 export class SessionValidateError extends Data.TaggedError("SessionValidateError") {
@@ -26,9 +33,6 @@ export class SessionRevokeError extends Data.TaggedError("SessionRevokeError") {
 }
 export class Sessions extends Context.Service()("auth/Sessions") {
 }
-(function (Sessions) {
-    Sessions.make = (service) => Sessions.of(service);
-})(Sessions || (Sessions = {}));
 const resolveTtl = (ttl) => ttl ?? defaultSessionTtlPolicy;
 const ttlMillis = (ttl) => Duration.toMillis(ttl);
 const sessionExpiresAt = (now, authTime, ttl) => UnixMillis(Math.min(Number(addMillis(now, ttlMillis(ttl.idleTtl))), Number(addMillis(authTime, ttlMillis(ttl.absoluteTtl)))));
@@ -59,9 +63,123 @@ const issuedFromRow = (row, token) => ({
     expiresAt: row.expiresAt,
     aal: row.aal,
     amr: row.amr,
-    ...(row.mfaVerifiedAt === undefined ? {} : { mfaVerifiedAt: row.mfaVerifiedAt }),
+    authenticationEvents: row.authenticationEvents,
+    ...(row.mfaVerifiedAt === undefined
+        ? {}
+        : { mfaVerifiedAt: row.mfaVerifiedAt }),
     claims: row.claims,
+    ...(row.rotatedAt === undefined ? {} : { rotatedAt: row.rotatedAt }),
+});
+const requirements = (claims) => {
+    const sorted = [];
+    for (const requirement of new Set(claims?.requirements)) {
+        const index = sorted.findIndex((item) => item.localeCompare(requirement) > 0);
+        if (index === -1) {
+            sorted.push(requirement);
+        }
+        else {
+            sorted.splice(index, 0, requirement);
+        }
+    }
+    return sorted;
+};
+const changedRequirements = (left, right) => left.filter((requirement) => !right.includes(requirement));
+/** Decorates only committed assurance rotations; audit failures never fail authentication. */
+export const makeSessionsAssuranceAudit = (dependencies) => ({
+    ...dependencies.sessions,
+    assureAndRotate: (input) => dependencies.sessions.validate(input.token).pipe(Effect.mapError((cause) => new SessionRotateError({
+        message: "Failed to load session before assurance rotation",
+        cause: cause.cause instanceof CustomEvidencePolicyError ||
+            cause.cause instanceof AuthenticationEvidenceTimeError
+            ? cause.cause
+            : cause,
+    })), Effect.flatMap((before) => dependencies.sessions.assureAndRotate(input).pipe(Effect.tap((result) => {
+        const transition = dependencies.options.transition(input, result);
+        const rotatedAt = result.rotatedAt ?? result.authTime;
+        const context = dependencies.options.context(result.userId, result.sessionId);
+        const oldRequirements = requirements(before.currentSession.claims);
+        const newRequirements = requirements(result.claims);
+        return dependencies.auditLog
+            .emit({
+            type: transition.type,
+            actor: context.actor,
+            userId: result.userId,
+            sessionId: result.sessionId,
+            oldAal: before.currentSession.aal,
+            newAal: result.aal,
+            amr: result.amr,
+            method: transition.method,
+            rotatedAt,
+            requirementsEntered: changedRequirements(newRequirements, oldRequirements),
+            requirementsCleared: changedRequirements(oldRequirements, newRequirements),
+            occurredAt: rotatedAt,
+            ...(context.request === undefined
+                ? {}
+                : { request: context.request }),
+            ...(dependencies.options.eventId === undefined
+                ? {}
+                : {
+                    id: dependencies.options.eventId(transition.type, result.sessionId, rotatedAt),
+                }),
+        })
+            .pipe(Effect.ignore);
+    })))),
 });
+const emitAtomicAssurance = (auditLog, options, type, method, before, result) => {
+    const rotatedAt = result.rotatedAt ?? result.authTime;
+    const context = options.context(result.userId, result.sessionId);
+    const newRequirements = requirements(result.claims);
+    const requirementsEntered = type === "auth.session.recovery_remediation.entered" &&
+        newRequirements.includes("recovery_remediation")
+        ? ["recovery_remediation"]
+        : [];
+    return auditLog
+        .emit({
+        type,
+        actor: context.actor,
+        userId: result.userId,
+        sessionId: result.sessionId,
+        oldAal: before.level,
+        newAal: result.aal,
+        amr: result.amr,
+        method,
+        rotatedAt,
+        requirementsEntered,
+        requirementsCleared: [],
+        occurredAt: rotatedAt,
+        ...(context.request === undefined ? {} : { request: context.request }),
+        ...(options.eventId === undefined
+            ? {}
+            : { id: options.eventId(type, result.sessionId, rotatedAt) }),
+    })
+        .pipe(Effect.ignore);
+};
+export const makeTotpSessionRotationAudit = (dependencies) => {
+    const customEvidencePolicies = dependencies.customEvidencePolicies ?? emptyCustomEvidencePolicyRegistry;
+    return TotpSessionRotation.of({
+        acceptAndRotate: (input) => Effect.fromResult(deriveAssuranceResult(input.expectedAuthenticationEvents, {
+            customEvidencePolicies,
+        })).pipe(Effect.mapError((cause) => new SessionRotateError({
+            message: "Session evidence policy validation failed",
+            cause,
+        })), Effect.flatMap((before) => dependencies.rotation
+            .acceptAndRotate(input)
+            .pipe(Effect.tap((result) => emitAtomicAssurance(dependencies.auditLog, dependencies.options, "auth.session.step_up_completed", "totp", before, result))))),
+    });
+};
+export const makeRecoveryCodeSessionRotationAudit = (dependencies) => {
+    const customEvidencePolicies = dependencies.customEvidencePolicies ?? emptyCustomEvidencePolicyRegistry;
+    return RecoveryCodeSessionRotation.of({
+        consumeAndRotate: (input) => Effect.fromResult(deriveAssuranceResult(input.expectedAuthenticationEvents, {
+            customEvidencePolicies,
+        })).pipe(Effect.mapError((cause) => new SessionRotateError({
+            message: "Session evidence policy validation failed",
+            cause,
+        })), Effect.flatMap((before) => dependencies.rotation
+            .consumeAndRotate(input)
+            .pipe(Effect.tap((result) => emitAtomicAssurance(dependencies.auditLog, dependencies.options, "auth.session.recovery_remediation.entered", "recovery_code", before, result))))),
+    });
+};
 const currentFromRow = (row) => ({
     sessionId: row.id,
     userId: row.userId,
@@ -69,7 +187,10 @@ const currentFromRow = (row) => ({
     expiresAt: row.expiresAt,
     aal: row.aal,
     amr: row.amr,
-    ...(row.mfaVerifiedAt === undefined ? {} : { mfaVerifiedAt: row.mfaVerifiedAt }),
+    authenticationEvents: row.authenticationEvents,
+    ...(row.mfaVerifiedAt === undefined
+        ? {}
+        : { mfaVerifiedAt: row.mfaVerifiedAt }),
     claims: row.claims,
 });
 const infoFromRow = (row) => ({
@@ -81,25 +202,44 @@ const infoFromRow = (row) => ({
     expiresAt: row.expiresAt,
     aal: row.aal,
     amr: row.amr,
-    ...(row.mfaVerifiedAt === undefined ? {} : { mfaVerifiedAt: row.mfaVerifiedAt }),
+    authenticationEvents: row.authenticationEvents,
+    ...(row.mfaVerifiedAt === undefined
+        ? {}
+        : { mfaVerifiedAt: row.mfaVerifiedAt }),
     claims: row.claims,
     ...(row.metadata === undefined ? {} : { metadata: row.metadata }),
 });
-const aalRank = {
-    aal1: 1,
-    aal2: 2,
-    aal3: 3,
+const asEvidence = (evidence) => Array.isArray(evidence) ? evidence : [evidence];
+const summarizeAuthenticationEventsResult = (events, customEvidencePolicies) => {
+    const assurance = deriveAssuranceResult(events, { customEvidencePolicies });
+    if (Result.isFailure(assurance)) {
+        return Result.fail(assurance.failure);
+    }
+    const mfaVerifiedAt = deriveMfaVerifiedAtResult(events, customEvidencePolicies);
+    if (Result.isFailure(mfaVerifiedAt)) {
+        return Result.fail(mfaVerifiedAt.failure);
+    }
+    return Result.succeed({
+        assurance: assurance.success,
+        mfaVerifiedAt: mfaVerifiedAt.success,
+    });
 };
-const strongerAal = (left, right) => (aalRank[left] >= aalRank[right] ? left : right);
-const asMethods = (method) => typeof method === "string" ? [method] : method;
-const appendMethods = (current, methods) => {
-    const next = [...current];
-    for (const method of methods) {
-        if (!next.includes(method)) {
-            next.push(method);
-        }
+const prepareSessionAssuranceResult = (events, customEvidencePolicies, serverNow) => {
+    const timestampValidation = validateAuthenticationEvidenceTimestamps(events, serverNow);
+    if (Result.isFailure(timestampValidation)) {
+        return Result.fail(timestampValidation.failure);
+    }
+    const authenticationEvents = compactAuthenticationEventsResult(events, maximumSessionAuthenticationEvents, customEvidencePolicies);
+    if (Result.isFailure(authenticationEvents)) {
+        return Result.fail(authenticationEvents.failure);
     }
-    return next;
+    const summary = summarizeAuthenticationEventsResult(authenticationEvents.success, customEvidencePolicies);
+    return Result.isFailure(summary)
+        ? Result.fail(summary.failure)
+        : Result.succeed({
+            authenticationEvents: authenticationEvents.success,
+            ...summary.success,
+        });
 };
 const sessionActivityTime = (row) => Number(row.lastSeenAt ?? row.createdAt);
 const activeSessionsForUser = (rows, now, ttl) => {
@@ -130,62 +270,116 @@ export const makeSessions = (dependencies) => {
     const ttl = resolveTtl(dependencies.ttl);
     const sessionIdBytes = dependencies.sessionIdBytes ?? 16;
     const sessionSecretBytes = dependencies.sessionSecretBytes ?? 32;
-    return Sessions.make({
-        create: Effect.fn("auth.session.create")(function* (input) {
-            yield* Effect.annotateCurrentSpan({
-                "auth.method": input.method,
-                "auth.aal": input.aal,
-                "auth.amr_count": input.amr.length,
+    const customEvidencePolicies = dependencies.customEvidencePolicies ?? emptyCustomEvidencePolicyRegistry;
+    const prepareAssurance = (events, serverNow) => prepareSessionAssuranceResult(events, customEvidencePolicies, serverNow);
+    const summarize = (events) => summarizeAuthenticationEventsResult(events, customEvidencePolicies);
+    const validateRowAssurance = (row, serverNow) => {
+        const timestampValidation = validateAuthenticationEvidenceTimestamps(row.authenticationEvents, serverNow);
+        if (Result.isFailure(timestampValidation)) {
+            return Result.fail(timestampValidation.failure);
+        }
+        const summary = summarize(row.authenticationEvents);
+        if (Result.isFailure(summary)) {
+            return Result.fail(summary.failure);
+        }
+        const { assurance, mfaVerifiedAt } = summary.success;
+        if (assurance.authenticatedAt === undefined ||
+            !assurance.primaryEstablished ||
+            assurance.level !== row.aal ||
+            JSON.stringify(assurance.amr) !== JSON.stringify(row.amr) ||
+            Number(assurance.authenticatedAt) !== Number(row.authTime) ||
+            mfaVerifiedAt !== row.mfaVerifiedAt) {
+            return Result.fail(new Error("Session assurance summary does not match registered evidence policy"));
+        }
+        return Result.void;
+    };
+    const prepareCreate = Effect.fn("auth.session.prepare_create")(function* (input) {
+        const serverNow = yield* currentUnixMillis;
+        const now = input.now ?? serverNow;
+        const preparedAssurance = yield* Effect.fromResult(prepareAssurance(input.authenticationEvents, serverNow)).pipe(Effect.mapError((cause) => new SessionCreateError({
+            message: "Session evidence policy validation failed",
+            cause,
+        })));
+        const { assurance, authenticationEvents, mfaVerifiedAt: derivedMfaVerifiedAt, } = preparedAssurance;
+        if (authenticationEvents.length === 0) {
+            return yield* new SessionCreateError({
+                message: "At least one authentication event is required",
             });
-            const now = input.now ?? (yield* currentUnixMillis);
-            const inputTtl = resolveTtl(input.ttl ?? ttl);
-            const sessionId = SessionId(yield* dependencies.crypto.randomToken(sessionIdBytes).pipe(Effect.mapError((cause) => new SessionCreateError({
-                message: "Failed to generate session id",
-                cause,
-            }))));
-            const secret = yield* dependencies.crypto
-                .randomToken(sessionSecretBytes)
-                .pipe(Effect.mapError((cause) => new SessionCreateError({
-                message: "Failed to generate session secret",
-                cause,
-            })));
-            const token = makeSessionToken(sessionId, secret);
-            const secretHash = yield* hashSessionSecret(dependencies.crypto, dependencies.secret, secret).pipe(Effect.mapError((cause) => new SessionCreateError({
-                message: "Failed to hash session secret",
-                cause,
-            })));
-            const expiresAt = sessionExpiresAt(now, now, inputTtl);
-            yield* dependencies.sessionStore
-                .insert({
-                id: sessionId,
-                userId: input.userId,
-                secretHash,
-                createdAt: now,
-                expiresAt,
-                authTime: now,
-                aal: input.aal,
-                amr: input.amr,
-                mfaVerifiedAt: input.mfaVerifiedAt,
-                claims: input.claims,
-                metadata: input.metadata,
-            })
-                .pipe(Effect.mapError((cause) => new SessionCreateError({
-                message: "Failed to store session",
-                cause,
-            })));
-            return {
+        }
+        if (!assurance.primaryEstablished) {
+            return yield* new SessionCreateError({
+                message: "Authentication events did not establish a primary factor",
+            });
+        }
+        const authTime = assurance.authenticatedAt;
+        if (authTime === undefined) {
+            return yield* new SessionCreateError({
+                message: "Authentication events did not establish an auth time",
+            });
+        }
+        yield* Effect.annotateCurrentSpan({
+            "auth.aal": assurance.level,
+            "auth.amr_count": assurance.amr.length,
+        });
+        const inputTtl = resolveTtl(input.ttl ?? ttl);
+        const sessionId = SessionId(yield* dependencies.crypto.randomToken(sessionIdBytes).pipe(Effect.mapError((cause) => new SessionCreateError({
+            message: "Failed to generate session id",
+            cause,
+        }))));
+        const secret = yield* dependencies.crypto
+            .randomToken(sessionSecretBytes)
+            .pipe(Effect.mapError((cause) => new SessionCreateError({
+            message: "Failed to generate session secret",
+            cause,
+        })));
+        const token = makeSessionToken(sessionId, secret);
+        const secretHash = yield* hashSessionSecret(dependencies.crypto, dependencies.secret, secret).pipe(Effect.mapError((cause) => new SessionCreateError({
+            message: "Failed to hash session secret",
+            cause,
+        })));
+        const expiresAt = sessionExpiresAt(now, authTime, inputTtl);
+        const row = {
+            id: sessionId,
+            userId: input.userId,
+            secretHash,
+            createdAt: now,
+            expiresAt,
+            authTime,
+            authenticationEvents,
+            aal: assurance.level,
+            amr: assurance.amr,
+            mfaVerifiedAt: derivedMfaVerifiedAt,
+            claims: input.claims,
+            metadata: input.metadata,
+        };
+        return {
+            row,
+            session: {
                 sessionId,
                 userId: input.userId,
                 token,
-                authTime: now,
+                authTime,
                 expiresAt,
-                aal: input.aal,
-                amr: input.amr,
-                ...(input.mfaVerifiedAt === undefined
+                aal: assurance.level,
+                amr: assurance.amr,
+                authenticationEvents,
+                ...(derivedMfaVerifiedAt === undefined
                     ? {}
-                    : { mfaVerifiedAt: input.mfaVerifiedAt }),
+                    : { mfaVerifiedAt: derivedMfaVerifiedAt }),
                 claims: input.claims,
-            };
+            },
+        };
+    });
+    return Sessions.of({
+        customEvidencePolicies,
+        prepareCreate,
+        create: Effect.fn("auth.session.create")(function* (input) {
+            const prepared = yield* prepareCreate(input);
+            yield* dependencies.sessionStore.insert(prepared.row).pipe(Effect.mapError((cause) => new SessionCreateError({
+                message: "Failed to store session",
+                cause,
+            })));
+            return prepared.session;
         }),
         validate: Effect.fn("auth.session.validate")(function* (token) {
             const parsed = parseSessionToken(token);
@@ -209,6 +403,10 @@ export const makeSessions = (dependencies) => {
                 });
             }
             const row = rowOption.value;
+            yield* Effect.fromResult(validateRowAssurance(row, now)).pipe(Effect.mapError((cause) => new SessionValidateError({
+                message: "Session evidence policy validation failed",
+                cause,
+            })));
             if (isExpired(row, now, ttl)) {
                 return yield* new SessionValidateError({ message: "Session expired" });
             }
@@ -247,6 +445,10 @@ export const makeSessions = (dependencies) => {
                 return yield* new SessionRefreshError({ message: "Session not found" });
             }
             const row = rowOption.value;
+            yield* Effect.fromResult(validateRowAssurance(row, now)).pipe(Effect.mapError((cause) => new SessionRefreshError({
+                message: "Session evidence policy validation failed",
+                cause,
+            })));
             if (isExpired(row, now, ttl)) {
                 return yield* new SessionRefreshError({ message: "Session expired" });
             }
@@ -285,6 +487,19 @@ export const makeSessions = (dependencies) => {
         }),
         rotate: Effect.fn("auth.session.rotate")(function* (input) {
             const now = yield* currentUnixMillis;
+            const rowOption = yield* dependencies.sessionStore
+                .findById(input.sessionId)
+                .pipe(Effect.mapError((cause) => new SessionRotateError({
+                message: "Failed to load session",
+                cause,
+            })));
+            if (Option.isNone(rowOption)) {
+                return yield* new SessionRotateError({ message: "Session not found" });
+            }
+            yield* Effect.fromResult(validateRowAssurance(rowOption.value, now)).pipe(Effect.mapError((cause) => new SessionRotateError({
+                message: "Session evidence policy validation failed",
+                cause,
+            })));
             const secret = yield* dependencies.crypto
                 .randomToken(sessionSecretBytes)
                 .pipe(Effect.mapError((cause) => new SessionRotateError({
@@ -324,6 +539,10 @@ export const makeSessions = (dependencies) => {
                     message: "Session not found",
                 });
             }
+            yield* Effect.fromResult(validateRowAssurance(rowOption.value, now)).pipe(Effect.mapError((cause) => new SessionUpdateClaimsError({
+                message: "Session evidence policy validation failed",
+                cause,
+            })));
             if (isExpired(rowOption.value, now, ttl)) {
                 return yield* new SessionUpdateClaimsError({
                     message: "Session expired",
@@ -333,11 +552,6 @@ export const makeSessions = (dependencies) => {
                 .updateClaims({
                 sessionId: input.sessionId,
                 ...(input.claims === undefined ? {} : { claims: input.claims }),
-                ...(input.aal === undefined ? {} : { aal: input.aal }),
-                ...(input.amr === undefined ? {} : { amr: input.amr }),
-                ...(input.mfaVerifiedAt === undefined
-                    ? {}
-                    : { mfaVerifiedAt: input.mfaVerifiedAt }),
             })
                 .pipe(Effect.mapError((cause) => new SessionUpdateClaimsError({
                 message: "Failed to update session claims",
@@ -350,12 +564,154 @@ export const makeSessions = (dependencies) => {
             }
             return currentFromRow(updated.value);
         }),
+        appendEvidence: Effect.fn("auth.session.append_evidence")(function* (sessionId, evidence, claims) {
+            const now = yield* currentUnixMillis;
+            const rowOption = yield* dependencies.sessionStore
+                .findById(sessionId)
+                .pipe(Effect.mapError((cause) => new SessionUpdateClaimsError({
+                message: "Failed to load session",
+                cause,
+            })));
+            if (Option.isNone(rowOption)) {
+                return yield* new SessionUpdateClaimsError({
+                    message: "Session not found",
+                });
+            }
+            yield* Effect.fromResult(validateRowAssurance(rowOption.value, now)).pipe(Effect.mapError((cause) => new SessionUpdateClaimsError({
+                message: "Session evidence policy validation failed",
+                cause,
+            })));
+            const preparedAssurance = yield* Effect.fromResult(prepareAssurance([...rowOption.value.authenticationEvents, ...asEvidence(evidence)], now)).pipe(Effect.mapError((cause) => new SessionUpdateClaimsError({
+                message: "Session evidence policy validation failed",
+                cause,
+            })));
+            const { assurance, authenticationEvents, mfaVerifiedAt } = preparedAssurance;
+            if (!assurance.primaryEstablished) {
+                return yield* new SessionUpdateClaimsError({
+                    message: "Session evidence did not establish a primary factor",
+                });
+            }
+            const updated = yield* dependencies.sessionStore
+                .appendEvidence({
+                sessionId,
+                authenticationEvents,
+                authTime: assurance.authenticatedAt ?? rowOption.value.authTime,
+                aal: assurance.level,
+                amr: assurance.amr,
+                mfaVerifiedAt,
+                ...(claims === undefined ? {} : { claims }),
+            })
+                .pipe(Effect.mapError((cause) => new SessionUpdateClaimsError({
+                message: "Failed to append session evidence",
+                cause,
+            })));
+            if (Option.isNone(updated)) {
+                return yield* new SessionUpdateClaimsError({
+                    message: "Session not found",
+                });
+            }
+            return currentFromRow(updated.value);
+        }),
+        assureAndRotate: Effect.fn("auth.session.assure_and_rotate")(function* (input) {
+            const parsed = parseSessionToken(input.token);
+            if (parsed === undefined) {
+                return yield* new SessionRotateError({
+                    message: "Invalid session token",
+                });
+            }
+            const now = yield* currentUnixMillis;
+            const current = yield* dependencies.sessionStore
+                .findById(parsed.sessionId)
+                .pipe(Effect.mapError((cause) => new SessionRotateError({
+                message: "Failed to load session",
+                cause,
+            })));
+            if (Option.isNone(current) || isExpired(current.value, now, ttl)) {
+                return yield* new SessionRotateError({
+                    message: "Session is not active",
+                });
+            }
+            yield* Effect.fromResult(validateRowAssurance(current.value, now)).pipe(Effect.mapError((cause) => new SessionRotateError({
+                message: "Session evidence policy validation failed",
+                cause,
+            })));
+            const expectedSecretHash = yield* hashSessionSecret(dependencies.crypto, dependencies.secret, parsed.secret).pipe(Effect.mapError((cause) => new SessionRotateError({
+                message: "Failed to hash session secret",
+                cause,
+            })));
+            const secretMatches = yield* timingSafeEqualString(dependencies.crypto, expectedSecretHash, current.value.secretHash).pipe(Effect.mapError((cause) => new SessionRotateError({
+                message: "Failed to compare session secret",
+                cause,
+            })));
+            if (!secretMatches) {
+                return yield* new SessionRotateError({
+                    message: "Invalid session token",
+                });
+            }
+            const secret = yield* dependencies.crypto
+                .randomToken(sessionSecretBytes)
+                .pipe(Effect.mapError((cause) => new SessionRotateError({
+                message: "Failed to generate session secret",
+                cause,
+            })));
+            const secretHash = yield* hashSessionSecret(dependencies.crypto, dependencies.secret, secret).pipe(Effect.mapError((cause) => new SessionRotateError({
+                message: "Failed to hash session secret",
+                cause,
+            })));
+            const activeEvents = input.supersedeRecoveryEvidence === true
+                ? current.value.authenticationEvents.filter((event) => event.type !== "recovery_code")
+                : current.value.authenticationEvents;
+            const preparedAssurance = yield* Effect.fromResult(prepareAssurance([...activeEvents, ...asEvidence(input.evidence)], now)).pipe(Effect.mapError((cause) => new SessionRotateError({
+                message: "Session evidence policy validation failed",
+                cause,
+            })));
+            const { assurance, authenticationEvents, mfaVerifiedAt } = preparedAssurance;
+            if (!assurance.primaryEstablished) {
+                return yield* new SessionRotateError({
+                    message: "Session evidence did not establish a primary factor",
+                });
+            }
+            const updated = yield* dependencies.sessionStore
+                .assureAndRotate({
+                sessionId: parsed.sessionId,
+                expectedSecretHash,
+                expectedAuthenticationEvents: current.value.authenticationEvents,
+                secretHash,
+                rotatedAt: now,
+                now,
+                authenticationEvents,
+                authTime: assurance.authenticatedAt ?? current.value.authTime,
+                aal: assurance.level,
+                amr: assurance.amr,
+                mfaVerifiedAt,
+                ...(input.claims === undefined ? {} : { claims: input.claims }),
+            })
+                .pipe(Effect.mapError((cause) => new SessionRotateError({
+                message: "Failed to update session assurance",
+                cause,
+            })));
+            if (Option.isNone(updated)) {
+                return yield* new SessionRotateError({
+                    message: "Session changed or is not active",
+                });
+            }
+            return issuedFromRow(updated.value, makeSessionToken(parsed.sessionId, secret));
+        }),
         listForUser: Effect.fn("auth.session.list_for_user")(function* (input) {
             const now = yield* currentUnixMillis;
             const rows = yield* dependencies.sessionStore.listByUser(input).pipe(Effect.mapError((cause) => new SessionListError({
                 message: "Failed to list user sessions",
                 cause,
             })));
+            for (const row of rows) {
+                if (isExpired(row, now, ttl)) {
+                    continue;
+                }
+                yield* Effect.fromResult(validateRowAssurance(row, now)).pipe(Effect.mapError((cause) => new SessionListError({
+                    message: "Session evidence policy validation failed",
+                    cause,
+                })));
+            }
             return activeSessionsForUser(rows, now, ttl);
         }),
         revoke: Effect.fn("auth.session.revoke")(function* (input) {
@@ -426,10 +782,194 @@ export const makeSessions = (dependencies) => {
         }),
     });
 };
+export const makeTotpSessionRotation = (dependencies) => {
+    const ttl = dependencies.ttl ?? defaultSessionTtlPolicy;
+    const sessionSecretBytes = dependencies.sessionSecretBytes ?? 32;
+    const customEvidencePolicies = dependencies.customEvidencePolicies ?? emptyCustomEvidencePolicyRegistry;
+    return TotpSessionRotation.of({
+        acceptAndRotate: Effect.fn("auth.totp.accept_and_rotate")(function* (input) {
+            const parsed = parseSessionToken(input.token);
+            if (parsed === undefined) {
+                return yield* new SessionRotateError({
+                    message: "Invalid session token",
+                });
+            }
+            const now = yield* currentUnixMillis;
+            const expectedSecretHash = yield* hashSessionSecret(dependencies.crypto, dependencies.secret, parsed.secret).pipe(Effect.mapError((cause) => new SessionRotateError({
+                message: "Failed to hash session secret",
+                cause,
+            })));
+            const secret = yield* dependencies.crypto
+                .randomToken(sessionSecretBytes)
+                .pipe(Effect.mapError((cause) => new SessionRotateError({
+                message: "Failed to generate session secret",
+                cause,
+            })));
+            const secretHash = yield* hashSessionSecret(dependencies.crypto, dependencies.secret, secret).pipe(Effect.mapError((cause) => new SessionRotateError({
+                message: "Failed to hash session secret",
+                cause,
+            })));
+            const preparedAssurance = yield* Effect.fromResult(prepareSessionAssuranceResult([
+                ...input.expectedAuthenticationEvents,
+                ...asEvidence(input.evidence),
+            ], customEvidencePolicies, now)).pipe(Effect.mapError((cause) => new SessionRotateError({
+                message: "Session evidence policy validation failed",
+                cause,
+            })));
+            const { assurance, authenticationEvents, mfaVerifiedAt } = preparedAssurance;
+            if (!assurance.primaryEstablished) {
+                return yield* new SessionRotateError({
+                    message: "Session evidence did not establish a primary factor",
+                });
+            }
+            const updated = yield* dependencies.store
+                .acceptAndRotate({
+                factorId: input.factorId,
+                userId: input.userId,
+                counter: input.acceptedCounter,
+                lastUsedAt: now,
+                ...(input.factorMetadata === undefined
+                    ? {}
+                    : { factorMetadata: input.factorMetadata }),
+                sessionId: parsed.sessionId,
+                expectedSecretHash,
+                expectedAuthenticationEvents: input.expectedAuthenticationEvents,
+                secretHash,
+                rotatedAt: now,
+                now,
+                authenticationEvents,
+                authTime: assurance.authenticatedAt ?? now,
+                aal: assurance.level,
+                amr: assurance.amr,
+                mfaVerifiedAt,
+                ...(input.claims === undefined ? {} : { claims: input.claims }),
+            })
+                .pipe(Effect.mapError((cause) => new SessionRotateError({
+                message: "Failed to accept TOTP counter",
+                cause,
+            })));
+            if (Option.isNone(updated) || isExpired(updated.value, now, ttl)) {
+                return yield* new SessionRotateError({
+                    message: "Session or TOTP factor changed",
+                });
+            }
+            return issuedFromRow(updated.value, makeSessionToken(parsed.sessionId, secret));
+        }),
+    });
+};
+export const makeRecoveryCodeSessionRotation = (dependencies) => {
+    const ttl = dependencies.ttl ?? defaultSessionTtlPolicy;
+    const sessionSecretBytes = dependencies.sessionSecretBytes ?? 32;
+    const customEvidencePolicies = dependencies.customEvidencePolicies ?? emptyCustomEvidencePolicyRegistry;
+    return RecoveryCodeSessionRotation.of({
+        consumeAndRotate: Effect.fn("auth.recovery_code.consume_and_rotate")(function* (input) {
+            const parsed = parseSessionToken(input.token);
+            if (parsed === undefined) {
+                return yield* new SessionRotateError({
+                    message: "Invalid session token",
+                });
+            }
+            const now = yield* currentUnixMillis;
+            const expectedSecretHash = yield* hashSessionSecret(dependencies.crypto, dependencies.secret, parsed.secret).pipe(Effect.mapError((cause) => new SessionRotateError({
+                message: "Failed to hash session secret",
+                cause,
+            })));
+            const secret = yield* dependencies.crypto
+                .randomToken(sessionSecretBytes)
+                .pipe(Effect.mapError((cause) => new SessionRotateError({
+                message: "Failed to generate session secret",
+                cause,
+            })));
+            const secretHash = yield* hashSessionSecret(dependencies.crypto, dependencies.secret, secret).pipe(Effect.mapError((cause) => new SessionRotateError({
+                message: "Failed to hash session secret",
+                cause,
+            })));
+            const preparedAssurance = yield* Effect.fromResult(prepareSessionAssuranceResult([
+                ...input.expectedAuthenticationEvents,
+                ...asEvidence(input.evidence),
+            ], customEvidencePolicies, now)).pipe(Effect.mapError((cause) => new SessionRotateError({
+                message: "Session evidence policy validation failed",
+                cause,
+            })));
+            const { assurance, authenticationEvents, mfaVerifiedAt } = preparedAssurance;
+            if (!assurance.primaryEstablished) {
+                return yield* new SessionRotateError({
+                    message: "Session evidence did not establish a primary factor",
+                });
+            }
+            const updated = yield* dependencies.store
+                .consumeAndRotate({
+                codeId: input.codeId,
+                userId: input.userId,
+                usedAt: now,
+                ...(input.codeMetadata === undefined
+                    ? {}
+                    : { codeMetadata: input.codeMetadata }),
+                sessionId: parsed.sessionId,
+                expectedSecretHash,
+                expectedAuthenticationEvents: input.expectedAuthenticationEvents,
+                secretHash,
+                rotatedAt: now,
+                now,
+                authenticationEvents,
+                authTime: assurance.authenticatedAt ?? now,
+                aal: assurance.level,
+                amr: assurance.amr,
+                mfaVerifiedAt,
+                ...(input.claims === undefined ? {} : { claims: input.claims }),
+            })
+                .pipe(Effect.mapError((cause) => new SessionRotateError({
+                message: "Failed to consume recovery code",
+                cause,
+            })));
+            if (Option.isNone(updated) || isExpired(updated.value, now, ttl)) {
+                return yield* new SessionRotateError({
+                    message: "Session changed or is not active",
+                });
+            }
+            return issuedFromRow(updated.value, makeSessionToken(parsed.sessionId, secret));
+        }),
+    });
+};
+export function RecoveryCodeSessionRotationLive(options) {
+    return Layer.effect(RecoveryCodeSessionRotation)(Effect.gen(function* () {
+        const crypto = yield* Crypto;
+        const store = yield* RecoveryCodeSessionRotateStore;
+        const customEvidencePolicies = yield* Effect.serviceOption(CustomEvidencePolicies);
+        const resolved = options ?? { secret: (yield* AuthSecrets).session };
+        return makeRecoveryCodeSessionRotation({
+            ...resolved,
+            crypto,
+            store,
+            ...(resolved.customEvidencePolicies === undefined &&
+                Option.isSome(customEvidencePolicies)
+                ? { customEvidencePolicies: customEvidencePolicies.value }
+                : {}),
+        });
+    }));
+}
+export function TotpSessionRotationLive(options) {
+    return Layer.effect(TotpSessionRotation)(Effect.gen(function* () {
+        const crypto = yield* Crypto;
+        const store = yield* TotpSessionRotateStore;
+        const customEvidencePolicies = yield* Effect.serviceOption(CustomEvidencePolicies);
+        const resolved = options ?? { secret: (yield* AuthSecrets).session };
+        return makeTotpSessionRotation({
+            ...resolved,
+            crypto,
+            store,
+            ...(resolved.customEvidencePolicies === undefined &&
+                Option.isSome(customEvidencePolicies)
+                ? { customEvidencePolicies: customEvidencePolicies.value }
+                : {}),
+        });
+    }));
+}
 export function SessionsLive(options) {
     return Layer.effect(Sessions)(Effect.gen(function* () {
         const crypto = yield* Crypto;
         const sessionStore = yield* SessionStore;
+        const customEvidencePolicies = yield* Effect.serviceOption(CustomEvidencePolicies);
         const resolvedOptions = options ??
             {
                 ...(yield* AuthSessionsConfig),
@@ -439,27 +979,25 @@ export function SessionsLive(options) {
             ...resolvedOptions,
             crypto,
             sessionStore,
+            ...(resolvedOptions.customEvidencePolicies === undefined &&
+                Option.isSome(customEvidencePolicies)
+                ? { customEvidencePolicies: customEvidencePolicies.value }
+                : {}),
         });
     }));
 }
 export const upgradeCurrentSession = (input) => Effect.gen(function* () {
     const current = yield* CurrentSession;
     const sessions = yield* Sessions;
-    const now = input.now ?? (yield* currentUnixMillis);
-    return yield* sessions.updateClaims({
-        sessionId: current.sessionId,
-        aal: strongerAal(current.aal, input.aal ?? "aal2"),
-        amr: appendMethods(current.amr, asMethods(input.method)),
-        mfaVerifiedAt: now,
-        ...(input.claims === undefined ? {} : { claims: input.claims }),
-        reason: input.reason ?? "mfa_verified",
-    });
+    return yield* sessions.appendEvidence(current.sessionId, input.evidence, input.claims);
+});
+export const reauthenticateCurrentSession = (input) => Effect.gen(function* () {
+    const current = yield* CurrentSession;
+    const sessions = yield* Sessions;
+    return yield* sessions.appendEvidence(current.sessionId, input.evidence, input.claims);
 });
 export class SessionCookie extends Context.Service()("auth/SessionCookie") {
 }
-(function (SessionCookie) {
-    SessionCookie.make = (service) => SessionCookie.of(service);
-})(SessionCookie || (SessionCookie = {}));
 export const defaultSessionCookieOptions = {
     name: "__Host-session",
     secure: true,
@@ -542,7 +1080,7 @@ const parseCookieHeader = (header, name) => {
 };
 export const makeSessionCookie = (options) => {
     const resolved = resolveSessionCookieOptions(options);
-    return SessionCookie.make({
+    return SessionCookie.of({
         read: Effect.fn("auth.session_cookie.read")((request) => Effect.succeed(parseCookieHeader(request.headers.get("Cookie"), resolved.name))),
         commit: Effect.fn("auth.session_cookie.commit")((issued) => Effect.succeed(serializeSessionCookie(resolved, issued.token, issued.expiresAt))),
         clear: Effect.fn("auth.session_cookie.clear")(() => Effect.succeed(serializeClearSessionCookie(resolved)))(),
@@ -554,12 +1092,6 @@ export const SessionCookieLive = (options) => Layer.effect(SessionCookie)(Effect
 }));
 export class CurrentSession extends Context.Service()("auth/CurrentSession") {
 }
-(function (CurrentSession) {
-    CurrentSession.make = (service) => CurrentSession.of(service);
-})(CurrentSession || (CurrentSession = {}));
 export class CurrentActor extends Context.Service()("auth/CurrentActor") {
 }
-(function (CurrentActor) {
-    CurrentActor.make = (service) => CurrentActor.of(service);
-})(CurrentActor || (CurrentActor = {}));
 //# sourceMappingURL=Sessions.js.map