@effect-auth/core 0.1.0-alpha.18 → 0.1.0-alpha.19

package/dist/EffectQbPostgresStorage.js

@@ -1,4 +1,4 @@
-// oxlint-disable complexity, typescript/no-explicit-any
+// oxlint-disable complexity, promise/prefer-await-to-then, typescript/no-explicit-any
 import { Cause, Data, Effect, Layer, Option, Redacted, Schema } from "effect";
 import { Column, Executor as CoreExecutor, Query, RowSet, Scalar, Table, } from "effect-qb";
 import { Column as PostgresColumn, Errors as PostgresErrors, Executor, Jsonb, Query as PostgresQuery, Renderer, } from "effect-qb/postgres";
@@ -14,6 +14,7 @@ import { JwtError, JwtRevocationStore } from "./Jwt.js";
 import { LoginApprovalReviewError, LoginApprovalReviewStore, } from "./LoginApproval.js";
 import { LoginRiskContext, LoginRiskHistory, LoginRiskHistoryError, LoginRiskSignal, maxLoginRiskLevel, } from "./LoginRisk.js";
 import { OAuthAuthorizationCodeStore, OAuthAuthorizationCodeStoreError, OAuthAccountStore, OAuthAccountStoreError, OAuthClientSecretHash, OAuthClientSecretPrefix, OAuthClientSecretStore, OAuthClientSecretStoreError, OAuthClientStore, OAuthClientStoreError, OAuthCodeChallenge, OAuthConsentStore, OAuthConsentStoreError, OAuthIdentityBridgeConflictError, OAuthIdentityBridgeStore, OAuthIdentityBridgeStoreError, OAuthProviderModeTokenStore, OAuthProviderModeTokenStoreError, OAuthProviderTokenVault, OAuthProviderTokenVaultError, } from "./OAuth.js";
+import { OAuthDeviceAuthorizationId, OAuthDeviceAuthorizationStore, OAuthDeviceAuthorizationStoreError, OAuthDeviceCodeTokenCommitStore, OAuthDeviceCodeTokenCommitStoreError, } from "./OAuthDeviceAuthorization.js";
 import { PasskeyCredentialId, PasskeyCredentialStore, PasskeyCredentialStoreError, } from "./Passkey.js";
 import { canonicalPermissionScope, normalizePermissionDefinitionListLimit, PermissionStore, PermissionStoreError, } from "./Permission.js";
 import { RecoveryCodeHash, RecoveryCodeLoginCommitStore, RecoveryCodeLoginCommitStoreError, RecoveryCodeSessionRotateStore, RecoveryCodeSessionRotateStoreError, RecoveryCodeStore, RecoveryCodeStoreError, } from "./RecoveryCode.js";
@@ -210,6 +211,25 @@ const authPostgresOAuthAuthorizationCode = Table.make("auth_oauth_authorization_
     consumed_at: nullableInt8(),
     metadata: jsonb(),
 });
+const authPostgresOAuthDeviceAuthorization = Table.make("auth_oauth_device_authorization", {
+    id: Column.text().pipe(Column.primaryKey),
+    device_code_hash: Column.text().pipe(Column.unique),
+    user_code_hash: Column.text().pipe(Column.unique),
+    client_id: Column.text(),
+    requested_scopes: PostgresColumn.jsonb(Schema.Unknown),
+    granted_scopes: jsonb(),
+    subject: Column.text().pipe(Column.nullable),
+    status: Column.text(),
+    issued_at: int8(),
+    expires_at: int8(),
+    poll_interval_seconds: Column.int(),
+    next_poll_at: int8(),
+    last_polled_at: nullableInt8(),
+    approved_at: nullableInt8(),
+    denied_at: nullableInt8(),
+    consumed_at: nullableInt8(),
+    metadata: jsonb(),
+});
 const authPostgresOAuthClientSecret = Table.make("auth_oauth_client_secret", {
     prefix: Column.text(),
     client_id: Column.text(),
@@ -415,6 +435,7 @@ export const effectQbPostgresTables = {
     oauthClient: authPostgresOAuthClient,
     oauthConsent: authPostgresOAuthConsent,
     oauthAuthorizationCode: authPostgresOAuthAuthorizationCode,
+    oauthDeviceAuthorization: authPostgresOAuthDeviceAuthorization,
     oauthClientSecret: authPostgresOAuthClientSecret,
     oauthProviderModeToken: authPostgresOAuthProviderModeToken,
     oauthProviderTokenVault: authPostgresOAuthProviderTokenVault,
@@ -607,6 +628,25 @@ const oauthAuthorizationCodeSelection = {
     consumedAt: authPostgresOAuthAuthorizationCode.consumed_at,
     metadata: authPostgresOAuthAuthorizationCode.metadata,
 };
+const oauthDeviceAuthorizationSelection = {
+    id: authPostgresOAuthDeviceAuthorization.id,
+    deviceCodeHash: authPostgresOAuthDeviceAuthorization.device_code_hash,
+    userCodeHash: authPostgresOAuthDeviceAuthorization.user_code_hash,
+    clientId: authPostgresOAuthDeviceAuthorization.client_id,
+    requestedScopes: authPostgresOAuthDeviceAuthorization.requested_scopes,
+    grantedScopes: authPostgresOAuthDeviceAuthorization.granted_scopes,
+    subject: authPostgresOAuthDeviceAuthorization.subject,
+    status: authPostgresOAuthDeviceAuthorization.status,
+    issuedAt: authPostgresOAuthDeviceAuthorization.issued_at,
+    expiresAt: authPostgresOAuthDeviceAuthorization.expires_at,
+    pollIntervalSeconds: authPostgresOAuthDeviceAuthorization.poll_interval_seconds,
+    nextPollAt: authPostgresOAuthDeviceAuthorization.next_poll_at,
+    lastPolledAt: authPostgresOAuthDeviceAuthorization.last_polled_at,
+    approvedAt: authPostgresOAuthDeviceAuthorization.approved_at,
+    deniedAt: authPostgresOAuthDeviceAuthorization.denied_at,
+    consumedAt: authPostgresOAuthDeviceAuthorization.consumed_at,
+    metadata: authPostgresOAuthDeviceAuthorization.metadata,
+};
 const oauthClientSecretSelection = {
     prefix: authPostgresOAuthClientSecret.prefix,
     clientId: authPostgresOAuthClientSecret.client_id,
@@ -1155,6 +1195,48 @@ const decodeOAuthAuthorizationCode = (row) => ({
         ? {}
         : { metadata: optionalRecord(row.metadata) }),
 });
+const decodeOAuthDeviceAuthorization = (row) => {
+    const base = {
+        id: OAuthDeviceAuthorizationId(String(row.id)),
+        deviceCodeHash: String(row.deviceCodeHash ?? row.device_code_hash),
+        userCodeHash: String(row.userCodeHash ?? row.user_code_hash),
+        clientId: OAuthClientId(String(row.clientId ?? row.client_id)),
+        requestedScopes: stringArray(row.requestedScopes ?? row.requested_scopes),
+        issuedAt: postgresBigintToUnixMillis(row.issuedAt ?? row.issued_at),
+        expiresAt: postgresBigintToUnixMillis(row.expiresAt ?? row.expires_at),
+        pollIntervalSeconds: Number(row.pollIntervalSeconds ?? row.poll_interval_seconds),
+        nextPollAt: postgresBigintToUnixMillis(row.nextPollAt ?? row.next_poll_at),
+        ...(optionalMillis(row.lastPolledAt ?? row.last_polled_at) === undefined
+            ? {}
+            : {
+                lastPolledAt: optionalMillis(row.lastPolledAt ?? row.last_polled_at),
+            }),
+        ...(optionalRecord(row.metadata) === undefined
+            ? {}
+            : { metadata: optionalRecord(row.metadata) }),
+    };
+    const status = String(row.status);
+    if (status === "approved") {
+        return {
+            ...base,
+            status: "approved",
+            subject: String(row.subject),
+            grantedScopes: stringArray(row.grantedScopes ?? row.granted_scopes),
+            approvedAt: postgresBigintToUnixMillis(row.approvedAt ?? row.approved_at),
+            ...(optionalMillis(row.consumedAt ?? row.consumed_at) === undefined
+                ? {}
+                : { consumedAt: optionalMillis(row.consumedAt ?? row.consumed_at) }),
+        };
+    }
+    if (status === "denied") {
+        return {
+            ...base,
+            status: "denied",
+            deniedAt: postgresBigintToUnixMillis(row.deniedAt ?? row.denied_at),
+        };
+    }
+    return { ...base, status: "pending" };
+};
 const decodeOAuthClientSecret = (row) => ({
     prefix: OAuthClientSecretPrefix(String(row.prefix)),
     clientId: OAuthClientId(String(row.clientId ?? row.client_id)),
@@ -1726,6 +1808,25 @@ const oauthAuthorizationCodeValues = (row) => ({
     consumed_at: row.consumedAt === undefined ? null : millisParam(row.consumedAt),
     metadata: row.metadata ?? null,
 });
+const oauthDeviceAuthorizationValues = (row) => ({
+    id: row.id,
+    device_code_hash: row.deviceCodeHash,
+    user_code_hash: row.userCodeHash,
+    client_id: row.clientId,
+    requested_scopes: row.requestedScopes,
+    granted_scopes: null,
+    subject: null,
+    status: "pending",
+    issued_at: millisParam(row.issuedAt),
+    expires_at: millisParam(row.expiresAt),
+    poll_interval_seconds: row.pollIntervalSeconds,
+    next_poll_at: millisParam(row.nextPollAt),
+    last_polled_at: row.lastPolledAt === undefined ? null : millisParam(row.lastPolledAt),
+    approved_at: null,
+    denied_at: null,
+    consumed_at: null,
+    metadata: row.metadata ?? null,
+});
 const oauthClientSecretValues = (row) => ({
     prefix: row.prefix,
     client_id: row.clientId,
@@ -2098,6 +2199,16 @@ const oauthAuthorizationCodeStoreError = (operation, cause) => new OAuthAuthoriz
     message: `OAuth authorization code ${operation} failed`,
     cause,
 });
+const oauthDeviceAuthorizationStoreError = (operation, cause) => new OAuthDeviceAuthorizationStoreError({
+    operation,
+    message: `OAuth device authorization ${operation} failed`,
+    cause,
+});
+const oauthDeviceCodeTokenCommitStoreError = (cause) => new OAuthDeviceCodeTokenCommitStoreError({
+    operation: "commit",
+    message: "OAuth device token commit failed",
+    cause,
+});
 const oauthClientSecretStoreError = (operation, cause) => new OAuthClientSecretStoreError({
     operation,
     message: `OAuth client secret ${operation} failed`,
@@ -3694,6 +3805,250 @@ export const makeEffectQbPostgresOAuthAuthorizationCodeStore = (executor, sql) =
         },
     });
 };
+export const makeEffectQbPostgresOAuthDeviceAuthorizationStore = (executor, sql) => {
+    const find = (column, value, operation) => {
+        const mapError = (cause) => oauthDeviceAuthorizationStoreError(operation, cause);
+        return executeMapped(executor, () => Query.select(oauthDeviceAuthorizationSelection).pipe(Query.from(authPostgresOAuthDeviceAuthorization), Query.where(eq(column, value))), mapError).pipe(Effect.flatMap((rows) => decodeMapped(() => firstOption(rows, decodeOAuthDeviceAuthorization), mapError)));
+    };
+    const selectedColumns = `
+    case when u.id is null then c.id else u.id end as id,
+    case when u.id is null then c.device_code_hash else u.device_code_hash end as device_code_hash,
+    case when u.id is null then c.user_code_hash else u.user_code_hash end as user_code_hash,
+    case when u.id is null then c.client_id else u.client_id end as client_id,
+    case when u.id is null then c.requested_scopes else u.requested_scopes end as requested_scopes,
+    case when u.id is null then c.granted_scopes else u.granted_scopes end as granted_scopes,
+    case when u.id is null then c.subject else u.subject end as subject,
+    case when u.id is null then c.status else u.status end as status,
+    case when u.id is null then c.issued_at else u.issued_at end as issued_at,
+    case when u.id is null then c.expires_at else u.expires_at end as expires_at,
+    case when u.id is null then c.poll_interval_seconds else u.poll_interval_seconds end as poll_interval_seconds,
+    case when u.id is null then c.next_poll_at else u.next_poll_at end as next_poll_at,
+    case when u.id is null then c.last_polled_at else u.last_polled_at end as last_polled_at,
+    case when u.id is null then c.approved_at else u.approved_at end as approved_at,
+    case when u.id is null then c.denied_at else u.denied_at end as denied_at,
+    case when u.id is null then c.consumed_at else u.consumed_at end as consumed_at,
+    case when u.id is null then c.metadata else u.metadata end as metadata`;
+    return OAuthDeviceAuthorizationStore.of({
+        insert: (record) => Effect.suspend(() => execute(executor, insert(authPostgresOAuthDeviceAuthorization, oauthDeviceAuthorizationValues(record)).pipe(Query.returning({ id: authPostgresOAuthDeviceAuthorization.id })))).pipe(Effect.as(true), Effect.catch((error) => postgresErrorDetails(error).code === "23505"
+            ? Effect.succeed(false)
+            : Effect.fail(oauthDeviceAuthorizationStoreError("insert", error)))),
+        findByDeviceCodeHash: (input) => find(authPostgresOAuthDeviceAuthorization.device_code_hash, input.deviceCodeHash, "find-by-device-code-hash"),
+        findByUserCodeHash: (input) => find(authPostgresOAuthDeviceAuthorization.user_code_hash, input.userCodeHash, "find-by-user-code-hash"),
+        findById: (id) => find(authPostgresOAuthDeviceAuthorization.id, id, "find-by-id"),
+        decide: (input) => {
+            const mapError = (cause) => oauthDeviceAuthorizationStoreError("decide", cause);
+            const status = input.decision === "approve" ? "approved" : "denied";
+            const subject = input.decision === "approve" ? input.subject : null;
+            const grantedScopes = input.decision === "approve"
+                ? JSON.stringify(input.grantedScopes)
+                : null;
+            return sql
+                .unsafe(`with candidate as materialized (
+  select * from auth_oauth_device_authorization where id = $1 for update
+), updated as (
+  update auth_oauth_device_authorization d set
+    status = $3,
+    subject = $4,
+    granted_scopes = $5::jsonb,
+    approved_at = case when $3 = 'approved' then $2::bigint else null end,
+    denied_at = case when $3 = 'denied' then $2::bigint else null end,
+    metadata = coalesce($6::jsonb, c.metadata)
+  from candidate c
+  where d.id = c.id and c.status = 'pending' and c.expires_at > $2::bigint
+  returning d.*
+)
+select
+  case when u.id is not null then $3 when c.expires_at <= $2::bigint then 'expired' else 'already_decided' end as action,
+  ${selectedColumns}
+from candidate c left join updated u on true`, [
+                input.id,
+                millisParam(input.decidedAt),
+                status,
+                subject,
+                grantedScopes,
+                input.metadata === undefined
+                    ? null
+                    : JSON.stringify(input.metadata),
+            ])
+                .pipe(Effect.mapError(mapError), Effect.flatMap((rows) => decodeMapped(() => {
+                const [row] = rows;
+                if (row === undefined) {
+                    return { status: "missing" };
+                }
+                const record = decodeOAuthDeviceAuthorization(row);
+                if (row.action === "expired") {
+                    return { status: "expired", record };
+                }
+                if (row.action === "already_decided") {
+                    return {
+                        status: "already_decided",
+                        record: record,
+                    };
+                }
+                return record.status === "approved"
+                    ? { status: "approved", record }
+                    : {
+                        status: "denied",
+                        record: record,
+                    };
+            }, mapError)));
+        },
+        poll: (input) => {
+            const mapError = (cause) => oauthDeviceAuthorizationStoreError("poll", cause);
+            return sql
+                .unsafe(`with candidate as materialized (
+  select d.*,
+    case
+      when d.consumed_at is not null then 'already_consumed'
+      when d.expires_at <= $3::bigint then 'expired'
+      when d.status = 'denied' then 'denied'
+      when d.status = 'approved' then 'approved'
+      when d.next_poll_at > $3::bigint then 'slow_down'
+      when d.status = 'pending' then 'pending'
+      else 'pending'
+    end as action
+  from auth_oauth_device_authorization d
+  where d.device_code_hash = $1 and d.client_id = $2
+  for update
+), updated as (
+  update auth_oauth_device_authorization d set
+    poll_interval_seconds = case when c.action = 'slow_down' then c.poll_interval_seconds + 5 else c.poll_interval_seconds end,
+    next_poll_at = $3::bigint + (case when c.action = 'slow_down' then c.poll_interval_seconds + 5 else c.poll_interval_seconds end) * 1000,
+    last_polled_at = $3::bigint
+  from candidate c
+  where d.id = c.id and c.action in ('slow_down', 'pending')
+  returning d.*
+)
+select c.action, ${selectedColumns}
+from candidate c left join updated u on true`, [input.deviceCodeHash, input.clientId, millisParam(input.now)])
+                .pipe(Effect.mapError(mapError), Effect.flatMap((rows) => decodeMapped(() => {
+                const [row] = rows;
+                if (row === undefined) {
+                    return { status: "missing" };
+                }
+                const record = decodeOAuthDeviceAuthorization(row);
+                switch (row.action) {
+                    case "expired": {
+                        return { status: "expired", record };
+                    }
+                    case "denied": {
+                        return {
+                            status: "denied",
+                            record: record,
+                        };
+                    }
+                    case "already_consumed": {
+                        return {
+                            status: "already_consumed",
+                            record: record,
+                        };
+                    }
+                    case "slow_down": {
+                        return {
+                            status: "slow_down",
+                            record,
+                            interval: record.pollIntervalSeconds,
+                        };
+                    }
+                    case "pending": {
+                        return {
+                            status: "pending",
+                            record: record,
+                        };
+                    }
+                    default: {
+                        return {
+                            status: "approved",
+                            record: record,
+                        };
+                    }
+                }
+            }, mapError)));
+        },
+        deleteExpired: (input) => {
+            const mapError = (cause) => oauthDeviceAuthorizationStoreError("delete-expired", cause);
+            return executeMapped(executor, () => Query.delete(authPostgresOAuthDeviceAuthorization).pipe(Query.where(lte(authPostgresOAuthDeviceAuthorization.expires_at, millisParam(input.beforeExpiresAt))), Query.returning({ id: authPostgresOAuthDeviceAuthorization.id })), mapError).pipe(Effect.map((rows) => rows.length));
+        },
+    });
+};
+export const makeEffectQbPostgresOAuthDeviceCodeTokenCommitStore = (sql) => {
+    const executor = makeEffectQbPostgresExecutor(sql);
+    const mapError = oauthDeviceCodeTokenCommitStoreError;
+    return OAuthDeviceCodeTokenCommitStore.of({
+        commit: (input) => sql
+            .withTransaction(Effect.gen(function* () {
+            const selected = yield* executeMapped(executor, () => selectForUpdate(oauthDeviceAuthorizationSelection, authPostgresOAuthDeviceAuthorization, eq(authPostgresOAuthDeviceAuthorization.id, input.authorization.id)), mapError);
+            const existing = yield* decodeMapped(() => selected[0] === undefined
+                ? undefined
+                : decodeOAuthDeviceAuthorization(selected[0]), mapError);
+            if (existing === undefined) {
+                return { status: "missing" };
+            }
+            if (existing.status !== "approved") {
+                return { status: "missing" };
+            }
+            if (existing.consumedAt !== undefined) {
+                return {
+                    status: "already_consumed",
+                    record: existing,
+                };
+            }
+            const expected = input.authorization;
+            const sameArray = (left, right) => left.length === right.length &&
+                left.every((value, index) => value === right[index]);
+            const matchesApprovedSnapshot = existing.id === expected.id &&
+                existing.deviceCodeHash === expected.deviceCodeHash &&
+                existing.userCodeHash === expected.userCodeHash &&
+                existing.clientId === expected.clientId &&
+                sameArray(existing.requestedScopes, expected.requestedScopes) &&
+                existing.subject === expected.subject &&
+                sameArray(existing.grantedScopes, expected.grantedScopes) &&
+                Number(existing.issuedAt) === Number(expected.issuedAt) &&
+                Number(existing.expiresAt) === Number(expected.expiresAt) &&
+                existing.pollIntervalSeconds === expected.pollIntervalSeconds &&
+                Number(existing.nextPollAt) === Number(expected.nextPollAt) &&
+                (existing.lastPolledAt === undefined
+                    ? expected.lastPolledAt === undefined
+                    : Number(existing.lastPolledAt) ===
+                        Number(expected.lastPolledAt)) &&
+                Number(existing.approvedAt) === Number(expected.approvedAt) &&
+                JSON.stringify(existing.metadata ?? null) ===
+                    JSON.stringify(expected.metadata ?? null);
+            if (!matchesApprovedSnapshot) {
+                return { status: "missing" };
+            }
+            if (Number(existing.expiresAt) <= Number(input.consumedAt)) {
+                return {
+                    status: "expired",
+                    record: existing,
+                };
+            }
+            yield* Effect.forEach(input.tokenRecords, (record) => executeMapped(executor, () => insert(authPostgresOAuthProviderModeToken, oauthProviderModeTokenValues(record)), mapError), { discard: true });
+            const updated = yield* executeMapped(executor, () => update(authPostgresOAuthDeviceAuthorization, {
+                consumed_at: millisParam(input.consumedAt),
+                last_polled_at: millisParam(input.consumedAt),
+                next_poll_at: millisParam(UnixMillis(Number(input.consumedAt) +
+                    existing.pollIntervalSeconds * 1000)),
+            }).pipe(Query.where(eq(authPostgresOAuthDeviceAuthorization.id, input.authorization.id)), Query.where(eq(authPostgresOAuthDeviceAuthorization.status, "approved")), Query.where(isNull(authPostgresOAuthDeviceAuthorization.consumed_at)), Query.where(gt(authPostgresOAuthDeviceAuthorization.expires_at, millisParam(input.consumedAt))), Query.returning({
+                ...oauthDeviceAuthorizationSelection,
+                consumedAt: withoutNullRefinement(authPostgresOAuthDeviceAuthorization.consumed_at),
+            })), mapError);
+            return yield* decodeMapped(() => {
+                const [row] = updated;
+                if (row === undefined) {
+                    throw new Error("OAuth device authorization consume CAS failed");
+                }
+                return {
+                    status: "committed",
+                    record: decodeOAuthDeviceAuthorization(row),
+                };
+            }, mapError);
+        }))
+            .pipe(Effect.mapError((cause) => cause instanceof OAuthDeviceCodeTokenCommitStoreError
+            ? cause
+            : mapError(cause))),
+    });
+};
 export const makeEffectQbPostgresOAuthClientSecretStore = (executor) => {
     const find = (input, operation = "find") => {
         const mapError = (cause) => oauthClientSecretStoreError(operation, cause);
@@ -4267,6 +4622,8 @@ export const makeEffectQbPostgresCoreStores = (sql, options = {}) => {
         oauthClientStore: makeEffectQbPostgresOAuthClientStore(executor),
         oauthConsentStore: makeEffectQbPostgresOAuthConsentStore(executor),
         oauthAuthorizationCodeStore: makeEffectQbPostgresOAuthAuthorizationCodeStore(executor, sql),
+        oauthDeviceAuthorizationStore: makeEffectQbPostgresOAuthDeviceAuthorizationStore(executor, sql),
+        oauthDeviceCodeTokenCommitStore: makeEffectQbPostgresOAuthDeviceCodeTokenCommitStore(sql),
         oauthClientSecretStore: makeEffectQbPostgresOAuthClientSecretStore(executor),
         oauthProviderModeTokenStore: makeEffectQbPostgresOAuthProviderModeTokenStore(executor),
         oauthProviderTokenVault: makeEffectQbPostgresOAuthProviderTokenVault(executor),
@@ -4275,6 +4632,6 @@ export const makeEffectQbPostgresCoreStores = (sql, options = {}) => {
 };
 export const EffectQbPostgresCoreStoresLive = (sql, options = {}) => {
     const stores = makeEffectQbPostgresCoreStores(sql, options);
-    return Layer.mergeAll(Layer.succeed(UserStore)(stores.userStore), Layer.succeed(IdentityStore)(stores.identityStore), Layer.succeed(RegistrationStore)(stores.registrationStore), Layer.succeed(CredentialStore)(stores.credentialStore), Layer.succeed(PasskeyCredentialStore)(stores.passkeyCredentialStore), Layer.succeed(SessionStore)(stores.sessionStore), Layer.succeed(VerificationStore)(stores.verificationStore), Layer.succeed(AuditLogStore)(stores.auditLogStore), Layer.succeed(LoginApprovalReviewStore)(stores.loginApprovalReviewStore), Layer.succeed(LoginRiskHistory)(stores.loginRiskHistoryStore), Layer.succeed(TrustedDeviceStore)(stores.trustedDeviceStore), Layer.succeed(DomainVerificationStore)(stores.domainVerificationStore), Layer.succeed(SecurityTimelineStore)(stores.securityTimelineStore), Layer.succeed(WebhookOutboxStore)(stores.webhookOutboxStore), Layer.succeed(WebhookReplayStore)(stores.webhookReplayStore), Layer.succeed(TotpFactorStore)(stores.totpFactorStore), Layer.succeed(TotpSessionRotateStore)(stores.totpSessionRotateStore), Layer.succeed(TotpLoginCommitStore)(stores.totpLoginCommitStore), Layer.succeed(RecoveryCodeStore)(stores.recoveryCodeStore), Layer.succeed(RecoveryCodeSessionRotateStore)(stores.recoveryCodeSessionRotateStore), Layer.succeed(RecoveryCodeLoginCommitStore)(stores.recoveryCodeLoginCommitStore), Layer.succeed(ApiKeyStore)(stores.apiKeyStore), Layer.succeed(RefreshTokenStore)(stores.refreshTokenStore), Layer.succeed(JwtRevocationStore)(stores.jwtRevocationStore), Layer.succeed(OAuthAccountStore)(stores.oauthAccountStore), Layer.succeed(OAuthIdentityBridgeStore)(stores.oauthIdentityBridgeStore), Layer.succeed(OAuthClientStore)(stores.oauthClientStore), Layer.succeed(OAuthConsentStore)(stores.oauthConsentStore), Layer.succeed(OAuthAuthorizationCodeStore)(stores.oauthAuthorizationCodeStore), Layer.succeed(OAuthClientSecretStore)(stores.oauthClientSecretStore), Layer.succeed(OAuthProviderModeTokenStore)(stores.oauthProviderModeTokenStore), Layer.succeed(OAuthProviderTokenVault)(stores.oauthProviderTokenVault), Layer.succeed(PermissionStore)(stores.permissionStore));
+    return Layer.mergeAll(Layer.succeed(UserStore)(stores.userStore), Layer.succeed(IdentityStore)(stores.identityStore), Layer.succeed(RegistrationStore)(stores.registrationStore), Layer.succeed(CredentialStore)(stores.credentialStore), Layer.succeed(PasskeyCredentialStore)(stores.passkeyCredentialStore), Layer.succeed(SessionStore)(stores.sessionStore), Layer.succeed(VerificationStore)(stores.verificationStore), Layer.succeed(AuditLogStore)(stores.auditLogStore), Layer.succeed(LoginApprovalReviewStore)(stores.loginApprovalReviewStore), Layer.succeed(LoginRiskHistory)(stores.loginRiskHistoryStore), Layer.succeed(TrustedDeviceStore)(stores.trustedDeviceStore), Layer.succeed(DomainVerificationStore)(stores.domainVerificationStore), Layer.succeed(SecurityTimelineStore)(stores.securityTimelineStore), Layer.succeed(WebhookOutboxStore)(stores.webhookOutboxStore), Layer.succeed(WebhookReplayStore)(stores.webhookReplayStore), Layer.succeed(TotpFactorStore)(stores.totpFactorStore), Layer.succeed(TotpSessionRotateStore)(stores.totpSessionRotateStore), Layer.succeed(TotpLoginCommitStore)(stores.totpLoginCommitStore), Layer.succeed(RecoveryCodeStore)(stores.recoveryCodeStore), Layer.succeed(RecoveryCodeSessionRotateStore)(stores.recoveryCodeSessionRotateStore), Layer.succeed(RecoveryCodeLoginCommitStore)(stores.recoveryCodeLoginCommitStore), Layer.succeed(ApiKeyStore)(stores.apiKeyStore), Layer.succeed(RefreshTokenStore)(stores.refreshTokenStore), Layer.succeed(JwtRevocationStore)(stores.jwtRevocationStore), Layer.succeed(OAuthAccountStore)(stores.oauthAccountStore), Layer.succeed(OAuthIdentityBridgeStore)(stores.oauthIdentityBridgeStore), Layer.succeed(OAuthClientStore)(stores.oauthClientStore), Layer.succeed(OAuthConsentStore)(stores.oauthConsentStore), Layer.succeed(OAuthAuthorizationCodeStore)(stores.oauthAuthorizationCodeStore), Layer.succeed(OAuthDeviceAuthorizationStore)(stores.oauthDeviceAuthorizationStore), Layer.succeed(OAuthDeviceCodeTokenCommitStore)(stores.oauthDeviceCodeTokenCommitStore), Layer.succeed(OAuthClientSecretStore)(stores.oauthClientSecretStore), Layer.succeed(OAuthProviderModeTokenStore)(stores.oauthProviderModeTokenStore), Layer.succeed(OAuthProviderTokenVault)(stores.oauthProviderTokenVault), Layer.succeed(PermissionStore)(stores.permissionStore));
 };
 //# sourceMappingURL=EffectQbPostgresStorage.js.map