@effect-auth/core 0.1.0-alpha.3 → 0.1.0-alpha.4

package/dist/AuthFlow.js

@@ -1,7 +1,16 @@
-import { Context, Data, Effect, Layer } from "effect";
+// oxlint-disable complexity
+import { Context, Data, Duration, Effect, Layer, Option, Redacted, } from "effect";
 import { AuthEmailVerificationSessionPolicyConfig } from "./AuthConfig.js";
-import { AuthFlowId } from "./Identifiers.js";
-import { Sessions } from "./Sessions.js";
+import { Challenge } from "./Challenge.js";
+import { Crypto } from "./Crypto.js";
+import { AuthFlowId, ChallengeId, Email, UserId } from "./Identifiers.js";
+import { currentUnixMillis } from "./Internal.js";
+import { LoginApprovalFlow, LoginApprovalPolicy, LoginApprovalReview, makeLoginApprovalPolicy, unknownLoginDeviceContext, } from "./LoginApproval.js";
+import { LoginNotification } from "./LoginNotification.js";
+import { LoginRiskEngine, defaultLoginRiskContext, makeLoginRiskEngineNoop, } from "./LoginRisk.js";
+import { Sessions, sessionRequestMetadataKey } from "./Sessions.js";
+import { TrustedDevice } from "./TrustedDevice.js";
+export const defaultLoginApprovalSameDeviceSecretBytes = 32;
 export class EmailVerificationSessionPolicy extends Context.Service()("auth/EmailVerificationSessionPolicy") {
 }
 (function (EmailVerificationSessionPolicy) {
@@ -10,13 +19,17 @@ export class EmailVerificationSessionPolicy extends Context.Service()("auth/Emai
 const addEmailVerificationRequirement = (requirements) => requirements?.includes("email_verification") === true
     ? requirements
     : [...(requirements ?? []), "email_verification"];
-const removeEmailVerificationRequirement = (requirements) => requirements?.filter((requirement) => requirement !== "email_verification");
+const removeEmailVerificationRequirement = (requirements) => {
+    const filtered = requirements?.filter((requirement) => requirement !== "email_verification");
+    return filtered?.length === 0 ? undefined : filtered;
+};
 const withEmailVerified = (claims, emailVerified) => {
+    const { requirements: _requirements, ...rest } = claims ?? {};
     const requirements = emailVerified
         ? removeEmailVerificationRequirement(claims?.requirements)
         : claims?.requirements;
     return {
-        ...claims,
+        ...rest,
         emailVerified,
         ...(requirements === undefined ? {} : { requirements }),
     };
@@ -52,9 +65,6 @@ export const makeEmailVerificationSessionPolicy = (options = {}) => {
                         claims: withEmailVerificationRequirement(input.claims),
                     };
                 }
-                case "require-before-session": {
-                    return { _tag: "RequiresEmailVerification" };
-                }
             }
         }),
     });
@@ -63,14 +73,389 @@ export const EmailVerificationSessionPolicyLive = (options) => Layer.succeed(Ema
 export const AuthResult = Data.taggedEnum();
 export class AuthFlowStateError extends Data.TaggedError("AuthFlowStateError") {
 }
+export class AuthFlowState extends Context.Service()("auth/AuthFlowState") {
+}
+(function (AuthFlowState) {
+    AuthFlowState.make = (service) => AuthFlowState.of(service);
+})(AuthFlowState || (AuthFlowState = {}));
+export const defaultAuthFlowStateTtl = Duration.minutes(10);
+const flowStateMetadata = (input) => ({
+    ...input.metadata,
+    method: input.method,
+    amr: input.amr,
+    aal: input.aal,
+    ...(input.email === undefined ? {} : { email: input.email }),
+    ...(input.intent === undefined ? {} : { intent: input.intent }),
+    ...(input.device === undefined ? {} : { deviceStatus: input.device.status }),
+    ...(input.claims === undefined ? {} : { claims: input.claims }),
+});
+const metadataString = (metadata, key) => {
+    const value = metadata?.[key];
+    return typeof value === "string" && value.length > 0 ? value : undefined;
+};
+const metadataStringArray = (metadata, key) => {
+    const value = metadata?.[key];
+    return Array.isArray(value) && value.every((item) => typeof item === "string")
+        ? value
+        : undefined;
+};
+const metadataClaims = (metadata) => {
+    const value = metadata?.claims;
+    if (value === undefined) {
+        return undefined;
+    }
+    if (typeof value !== "object" || value === null || Array.isArray(value)) {
+        return undefined;
+    }
+    const shape = value;
+    const { requirements } = shape;
+    if (shape.emailVerified !== undefined &&
+        typeof shape.emailVerified !== "boolean") {
+        return undefined;
+    }
+    if (requirements !== undefined &&
+        (!Array.isArray(requirements) ||
+            !requirements.every((item) => typeof item === "string"))) {
+        return undefined;
+    }
+    return {
+        ...(shape.emailVerified === undefined
+            ? {}
+            : { emailVerified: shape.emailVerified }),
+        ...(requirements === undefined ? {} : { requirements }),
+    };
+};
+const metadataAal = (metadata) => {
+    const value = metadataString(metadata, "aal");
+    return value === "aal1" || value === "aal2" || value === "aal3"
+        ? value
+        : undefined;
+};
+const metadataIntent = (metadata) => {
+    const value = metadataString(metadata, "intent");
+    return value === "sign-in" || value === "sign-up" ? value : undefined;
+};
+const metadataDevice = (metadata) => {
+    const value = metadataString(metadata, "deviceStatus");
+    return value === "known" || value === "new" || value === "unknown"
+        ? { status: value }
+        : undefined;
+};
+const appMetadata = (metadata) => {
+    if (metadata === undefined) {
+        return undefined;
+    }
+    const { method: _method, amr: _amr, aal: _aal, email: _email, intent: _intent, deviceStatus: _deviceStatus, claims: _claims, ...rest } = metadata;
+    return Object.keys(rest).length === 0 ? undefined : rest;
+};
+const authFlowStateFromChallenge = (flowId, verified) => Effect.gen(function* () {
+    const method = metadataString(verified.metadata, "method");
+    const amr = metadataStringArray(verified.metadata, "amr");
+    const aal = metadataAal(verified.metadata);
+    const email = metadataString(verified.metadata, "email");
+    const intent = metadataIntent(verified.metadata);
+    const device = metadataDevice(verified.metadata);
+    const claims = metadataClaims(verified.metadata);
+    if (method === undefined) {
+        return yield* new AuthFlowStateError({
+            message: "Auth flow state is missing method metadata",
+        });
+    }
+    if (amr === undefined) {
+        return yield* new AuthFlowStateError({
+            message: "Auth flow state is missing AMR metadata",
+        });
+    }
+    if (aal === undefined) {
+        return yield* new AuthFlowStateError({
+            message: "Auth flow state is missing AAL metadata",
+        });
+    }
+    if (verified.metadata?.claims !== undefined && claims === undefined) {
+        return yield* new AuthFlowStateError({
+            message: "Auth flow state has invalid claims metadata",
+        });
+    }
+    return {
+        flowId,
+        userId: UserId(verified.subject),
+        ...(email === undefined ? {} : { email: Email(email) }),
+        ...(intent === undefined ? {} : { intent }),
+        method,
+        amr,
+        aal,
+        ...(device === undefined ? {} : { device }),
+        ...(claims === undefined ? {} : { claims }),
+        metadata: appMetadata(verified.metadata),
+    };
+});
+export const makeAuthFlowState = (dependencies) => {
+    const ttl = dependencies.ttl ?? defaultAuthFlowStateTtl;
+    return AuthFlowState.make({
+        start: Effect.fn("auth.auth_flow_state.start")(function* (input) {
+            const issued = yield* dependencies.challenge
+                .issue({
+                type: "auth-flow-state",
+                subject: input.userId,
+                ttl: input.ttl ?? ttl,
+                secret: input.secret,
+                metadata: flowStateMetadata(input),
+            })
+                .pipe(Effect.mapError((cause) => new AuthFlowStateError({
+                message: "Failed to start auth flow state",
+                cause,
+            })));
+            return {
+                flowId: AuthFlowId(issued.id),
+                userId: input.userId,
+                expiresAt: issued.expiresAt,
+            };
+        }),
+        inspect: Effect.fn("auth.auth_flow_state.inspect")(function* (flowId, secret) {
+            const inspected = yield* dependencies.challenge
+                .inspect({
+                challengeId: ChallengeId(flowId),
+                type: "auth-flow-state",
+                secret,
+            })
+                .pipe(Effect.mapError((cause) => new AuthFlowStateError({
+                message: "Invalid auth flow state",
+                cause,
+            })));
+            const state = yield* authFlowStateFromChallenge(flowId, inspected);
+            return {
+                ...state,
+                expiresAt: inspected.expiresAt,
+            };
+        }),
+        consume: Effect.fn("auth.auth_flow_state.consume")(function* (flowId, secret) {
+            const verified = yield* dependencies.challenge
+                .verify({
+                challengeId: ChallengeId(flowId),
+                type: "auth-flow-state",
+                secret,
+            })
+                .pipe(Effect.mapError((cause) => new AuthFlowStateError({
+                message: "Invalid auth flow state",
+                cause,
+            })));
+            return yield* authFlowStateFromChallenge(flowId, verified);
+        }),
+    });
+};
+export const AuthFlowStateLive = (options) => Layer.effect(AuthFlowState)(Effect.gen(function* () {
+    const challenge = yield* Challenge;
+    return makeAuthFlowState({
+        ...options,
+        challenge,
+    });
+}));
 export class AuthFlow extends Context.Service()("auth/AuthFlow") {
 }
 (function (AuthFlow) {
     AuthFlow.make = (service) => AuthFlow.of(service);
 })(AuthFlow || (AuthFlow = {}));
+export class LoginApprovalFinalize extends Context.Service()("auth/LoginApprovalFinalize") {
+}
+(function (LoginApprovalFinalize) {
+    LoginApprovalFinalize.make = (service) => LoginApprovalFinalize.of(service);
+})(LoginApprovalFinalize || (LoginApprovalFinalize = {}));
+const loginApprovalFinalizeDenied = (reason) => AuthResult.PolicyDenied({ reason });
+export const makeLoginApprovalFinalize = (dependencies) => LoginApprovalFinalize.make({
+    complete: Effect.fn("auth.login_approval_finalize.complete")(function* (input) {
+        const recordOption = yield* dependencies.loginApprovalReview.status({
+            approvalChallengeId: input.approvalChallengeId,
+        });
+        if (Option.isNone(recordOption)) {
+            return loginApprovalFinalizeDenied("Login approval review was not found");
+        }
+        const record = recordOption.value;
+        if (record.flowId !== input.flowId) {
+            return loginApprovalFinalizeDenied("Invalid login approval review");
+        }
+        const now = yield* currentUnixMillis;
+        if (Number(record.expiresAt) <= Number(now)) {
+            return loginApprovalFinalizeDenied("Login approval expired");
+        }
+        if (record.status === "pending") {
+            return loginApprovalFinalizeDenied("Login approval is pending");
+        }
+        if (record.status === "denied") {
+            return loginApprovalFinalizeDenied(record.deniedReason ?? "Login approval denied");
+        }
+        const consumed = yield* dependencies.authFlowState.consume(input.flowId, input.sameDeviceSecret);
+        if (consumed.userId !== record.userId) {
+            return loginApprovalFinalizeDenied("Invalid login approval review");
+        }
+        return yield* dependencies.authFlow.complete(consumed);
+    }),
+});
+export const LoginApprovalFinalizeLive = Layer.effect(LoginApprovalFinalize)(Effect.gen(function* () {
+    const loginApprovalReview = yield* LoginApprovalReview;
+    const authFlowState = yield* AuthFlowState;
+    const authFlow = yield* AuthFlow;
+    return makeLoginApprovalFinalize({
+        loginApprovalReview,
+        authFlowState,
+        authFlow,
+    });
+}));
+const loginApprovalFlowIdMetadata = (flowId, metadata) => ({
+    ...metadata,
+    flowId,
+});
+const sessionMetadata = (metadata, request) => request === undefined
+    ? metadata
+    : {
+        ...metadata,
+        [sessionRequestMetadataKey]: request,
+    };
+const mergeMetadata = (left, right) => {
+    if (left === undefined) {
+        return right;
+    }
+    if (right === undefined) {
+        return left;
+    }
+    return { ...left, ...right };
+};
+const aalRank = {
+    aal1: 1,
+    aal2: 2,
+    aal3: 3,
+};
+const strongerAal = (left, right) => (aalRank[left] >= aalRank[right] ? left : right);
+const authMethodReference = (method) => {
+    switch (method) {
+        case "password": {
+            return "pwd";
+        }
+        case "email-otp": {
+            return "otp";
+        }
+        case "magic-link": {
+            return "magic_link";
+        }
+        case "backup-code": {
+            return "backup_code";
+        }
+        default: {
+            return method;
+        }
+    }
+};
+const appendAuthMethods = (current, methods) => {
+    const next = [...current];
+    for (const method of methods) {
+        if (!next.includes(method)) {
+            next.push(method);
+        }
+    }
+    return next;
+};
+const loginNotificationSession = (session) => ({
+    sessionId: session.sessionId,
+    userId: session.userId,
+    authTime: session.authTime,
+    expiresAt: session.expiresAt,
+    aal: session.aal,
+    amr: session.amr,
+    ...(session.claims === undefined ? {} : { claims: session.claims }),
+});
+const loginRequestContextFromMetadata = (metadata) => {
+    const value = metadata?.[sessionRequestMetadataKey];
+    return typeof value === "object" && value !== null && !Array.isArray(value)
+        ? value
+        : undefined;
+};
+const loginApprovalNotConfigured = () => AuthResult.PolicyDenied({
+    reason: "Login approval is not configured",
+});
+const loginApprovalEmailMissing = () => AuthResult.PolicyDenied({
+    reason: "Login approval requires an email address",
+});
+const loginApprovalSameDeviceNotConfigured = () => AuthResult.PolicyDenied({
+    reason: "Login approval same-device binding is not configured",
+});
+const loginApprovalReviewNotConfigured = () => AuthResult.PolicyDenied({
+    reason: "Login approval review is not configured",
+});
+const mfaFlowStateNotConfigured = () => AuthResult.PolicyDenied({
+    reason: "MFA flow state is not configured",
+});
+const mfaFlowUserMismatch = () => AuthResult.PolicyDenied({
+    reason: "MFA flow user mismatch",
+});
+const optionalLoginApprovalDependencies = Effect.gen(function* () {
+    const loginApprovalPolicy = yield* Effect.serviceOption(LoginApprovalPolicy);
+    const loginApprovalFlow = yield* Effect.serviceOption(LoginApprovalFlow);
+    const authFlowState = yield* Effect.serviceOption(AuthFlowState);
+    const crypto = yield* Effect.serviceOption(Crypto);
+    const trustedDevice = yield* Effect.serviceOption(TrustedDevice);
+    const loginRiskEngine = yield* Effect.serviceOption(LoginRiskEngine);
+    const loginApprovalReview = yield* Effect.serviceOption(LoginApprovalReview);
+    const loginNotification = yield* Effect.serviceOption(LoginNotification);
+    return {
+        ...(Option.isSome(loginApprovalPolicy)
+            ? { loginApprovalPolicy: loginApprovalPolicy.value }
+            : {}),
+        ...(Option.isSome(loginApprovalFlow)
+            ? { loginApprovalFlow: loginApprovalFlow.value }
+            : {}),
+        ...(Option.isSome(authFlowState)
+            ? { authFlowState: authFlowState.value }
+            : {}),
+        ...(Option.isSome(crypto) ? { crypto: crypto.value } : {}),
+        ...(Option.isSome(trustedDevice)
+            ? { trustedDevice: trustedDevice.value }
+            : {}),
+        ...(Option.isSome(loginRiskEngine)
+            ? { loginRiskEngine: loginRiskEngine.value }
+            : {}),
+        ...(Option.isSome(loginApprovalReview)
+            ? { loginApprovalReview: loginApprovalReview.value }
+            : {}),
+        ...(Option.isSome(loginNotification)
+            ? { loginNotification: loginNotification.value }
+            : {}),
+    };
+});
 export const makeAuthFlow = (dependencies) => {
     const emailVerificationSessionPolicy = dependencies.emailVerificationSessionPolicy ??
         makeEmailVerificationSessionPolicy();
+    const loginApprovalPolicy = dependencies.loginApprovalPolicy ?? makeLoginApprovalPolicy();
+    const loginRiskEngine = dependencies.loginRiskEngine ?? makeLoginRiskEngineNoop();
+    const loginApprovalSameDeviceSecretBytes = dependencies.loginApprovalSameDeviceSecretBytes ??
+        defaultLoginApprovalSameDeviceSecretBytes;
+    const resolveDevice = (input) => {
+        if (input.device !== undefined) {
+            return Effect.succeed(input.device);
+        }
+        if (dependencies.trustedDevice === undefined) {
+            return Effect.succeed(unknownLoginDeviceContext);
+        }
+        return dependencies.trustedDevice.status({
+            userId: input.userId,
+            token: input.trustedDeviceToken,
+        });
+    };
+    const notifyLogin = (input, session) => dependencies.loginNotification === undefined
+        ? Effect.void
+        : dependencies.loginNotification
+            .notify({
+            userId: input.userId,
+            ...(input.email === undefined ? {} : { email: input.email }),
+            ...(input.intent === undefined ? {} : { intent: input.intent }),
+            method: input.method,
+            amr: input.amr,
+            aal: input.aal,
+            session: loginNotificationSession(session),
+            device: input.device ?? unknownLoginDeviceContext,
+            risk: input.risk ?? defaultLoginRiskContext,
+            request: input.request ?? loginRequestContextFromMetadata(input.metadata),
+            ...(input.metadata === undefined ? {} : { metadata: input.metadata }),
+        })
+            .pipe(Effect.catchCause(() => Effect.void));
     const complete = Effect.fn("auth.auth_flow.complete")(function* (input) {
         yield* Effect.annotateCurrentSpan({
             "auth.method": input.method,
@@ -83,55 +468,198 @@ export const makeAuthFlow = (dependencies) => {
             amr: input.amr,
             aal: input.aal,
             claims: input.claims,
+            ...(input.mfaVerifiedAt === undefined
+                ? {}
+                : { mfaVerifiedAt: input.mfaVerifiedAt }),
+            metadata: input.metadata,
         });
+        yield* notifyLogin(input, session);
         yield* Effect.annotateCurrentSpan("auth.result", "Authenticated");
         return AuthResult.Authenticated({ session });
     });
     const completePrimaryFactor = Effect.fn("auth.auth_flow.complete_primary_factor")(function* (input) {
-        const decision = yield* emailVerificationSessionPolicy.decide({
+        const emailVerificationDecision = yield* emailVerificationSessionPolicy.decide({
             claims: input.claims,
         });
-        if (decision._tag === "RequiresEmailVerification") {
-            yield* Effect.annotateCurrentSpan("auth.result", "RequiresEmailVerification");
-            return AuthResult.RequiresEmailVerification({
-                flowId: AuthFlowId("email-verification"),
-                ...(input.email === undefined
-                    ? {}
-                    : { userId: input.userId, email: input.email }),
+        const metadata = sessionMetadata(input.metadata, input.request);
+        const device = yield* resolveDevice(input);
+        const risk = yield* loginRiskEngine.assess({
+            userId: input.userId,
+            ...(input.email === undefined ? {} : { email: input.email }),
+            emailVerified: emailVerificationDecision.claims?.emailVerified,
+            method: input.method,
+            amr: input.amr,
+            aal: input.aal,
+            device,
+            ...(input.request === undefined ? {} : { request: input.request }),
+            ...(metadata === undefined ? {} : { metadata }),
+        });
+        const loginApprovalDecision = yield* loginApprovalPolicy.decide({
+            ...(input.intent === undefined ? {} : { intent: input.intent }),
+            userId: input.userId,
+            ...(input.email === undefined ? {} : { email: input.email }),
+            emailVerified: emailVerificationDecision.claims?.emailVerified,
+            method: input.method,
+            amr: input.amr,
+            aal: input.aal,
+            device,
+            risk,
+            ...(metadata === undefined ? {} : { metadata }),
+        });
+        if (loginApprovalDecision._tag === "RequiresApproval") {
+            if (loginApprovalDecision.channel === "email" &&
+                input.email === undefined) {
+                yield* Effect.annotateCurrentSpan("auth.result", "PolicyDenied");
+                return loginApprovalEmailMissing();
+            }
+            if (dependencies.authFlowState === undefined ||
+                dependencies.loginApprovalFlow === undefined) {
+                yield* Effect.annotateCurrentSpan("auth.result", "PolicyDenied");
+                return loginApprovalNotConfigured();
+            }
+            const { loginApprovalReview } = dependencies;
+            if (loginApprovalDecision.sessionBinding === "none" &&
+                loginApprovalReview === undefined) {
+                yield* Effect.annotateCurrentSpan("auth.result", "PolicyDenied");
+                return loginApprovalReviewNotConfigured();
+            }
+            let sameDeviceSecret;
+            if (loginApprovalDecision.sameDeviceRequired) {
+                if (dependencies.crypto === undefined) {
+                    yield* Effect.annotateCurrentSpan("auth.result", "PolicyDenied");
+                    return loginApprovalSameDeviceNotConfigured();
+                }
+                sameDeviceSecret = Redacted.make(yield* dependencies.crypto
+                    .randomToken(loginApprovalSameDeviceSecretBytes)
+                    .pipe(Effect.mapError((cause) => new AuthFlowStateError({
+                    message: "Failed to create login approval same-device binding",
+                    cause,
+                }))));
+            }
+            const claims = loginApprovalDecision.markEmailVerified === true
+                ? withEmailVerified(emailVerificationDecision.claims, true)
+                : emailVerificationDecision.claims;
+            const flowState = yield* dependencies.authFlowState.start({
+                userId: input.userId,
+                method: input.method,
+                amr: input.amr,
+                aal: input.aal,
+                ...(input.email === undefined ? {} : { email: input.email }),
+                ...(input.intent === undefined ? {} : { intent: input.intent }),
+                device,
+                claims,
+                secret: sameDeviceSecret,
+                ...(metadata === undefined ? {} : { metadata }),
+            });
+            const approval = yield* dependencies.loginApprovalFlow.start({
+                userId: input.userId,
+                ...(input.email === undefined ? {} : { email: input.email }),
+                channel: loginApprovalDecision.channel,
+                reason: loginApprovalDecision.reason,
+                sessionBinding: loginApprovalDecision.sessionBinding,
+                sameDeviceRequired: loginApprovalDecision.sameDeviceRequired,
+                ...(loginApprovalDecision.markEmailVerified === true
+                    ? { markEmailVerified: true }
+                    : {}),
+                risk,
+                metadata: loginApprovalFlowIdMetadata(flowState.flowId, metadata),
+            });
+            if (approval.sessionBinding === "none" &&
+                loginApprovalReview !== undefined) {
+                yield* loginApprovalReview.start({
+                    approval,
+                    flowId: flowState.flowId,
+                    metadata,
+                });
+            }
+            yield* Effect.annotateCurrentSpan({
+                "auth.result": "RequiresLoginApproval",
+                "auth.login_approval.reason": approval.reason,
+                "auth.login_approval.session_binding": approval.sessionBinding,
+                "auth.login_approval.same_device_required": approval.sameDeviceRequired,
+            });
+            return AuthResult.RequiresLoginApproval({
+                flowId: flowState.flowId,
+                approvalChallengeId: approval.challengeId,
+                channel: approval.channel,
+                sessionBinding: approval.sessionBinding,
+                sameDeviceRequired: approval.sameDeviceRequired,
+                reason: approval.reason,
+                expiresAt: flowState.expiresAt,
+                ...(sameDeviceSecret === undefined ? {} : { sameDeviceSecret }),
             });
         }
         return yield* complete({
             userId: input.userId,
+            ...(input.email === undefined ? {} : { email: input.email }),
+            ...(input.intent === undefined ? {} : { intent: input.intent }),
             method: input.method,
             amr: input.amr,
             aal: input.aal,
-            claims: decision.claims,
+            device,
+            ...(input.request === undefined ? {} : { request: input.request }),
+            risk,
+            claims: emailVerificationDecision.claims,
+            metadata,
+        });
+    });
+    const completeMfa = Effect.fn("auth.auth_flow.complete_mfa")(function* (input) {
+        if (dependencies.authFlowState === undefined) {
+            yield* Effect.annotateCurrentSpan("auth.result", "PolicyDenied");
+            return mfaFlowStateNotConfigured();
+        }
+        const consumed = yield* dependencies.authFlowState.consume(input.flowId, input.secret);
+        if (input.userId !== undefined && consumed.userId !== input.userId) {
+            yield* Effect.annotateCurrentSpan("auth.result", "PolicyDenied");
+            return mfaFlowUserMismatch();
+        }
+        const mfaVerifiedAt = input.now ?? (yield* currentUnixMillis);
+        const amr = appendAuthMethods(consumed.amr, input.amr ?? [authMethodReference(input.method)]);
+        const aal = strongerAal(consumed.aal, input.aal ?? "aal2");
+        const metadata = mergeMetadata(consumed.metadata, input.metadata);
+        yield* Effect.annotateCurrentSpan({
+            "auth.result": "Authenticated",
+            "auth.mfa.method": input.method,
+            "auth.mfa.aal": aal,
+            "auth.mfa.amr_count": amr.length,
+        });
+        return yield* complete({
+            userId: consumed.userId,
+            ...(consumed.email === undefined ? {} : { email: consumed.email }),
+            ...(consumed.intent === undefined ? {} : { intent: consumed.intent }),
+            method: consumed.method,
+            amr,
+            aal,
+            ...(consumed.device === undefined ? {} : { device: consumed.device }),
+            claims: consumed.claims,
+            mfaVerifiedAt,
+            metadata,
         });
     });
     return AuthFlow.make({
         startPrimaryFactor: completePrimaryFactor,
         completePrimaryFactor,
-        completeMfa: Effect.fn("auth.auth_flow.complete_mfa")(function* () {
-            return yield* new AuthFlowStateError({
-                message: "MFA flow state is not implemented yet",
-            });
-        }),
+        completeMfa,
         complete,
     });
 };
 export const AuthFlowLive = Layer.effect(AuthFlow)(Effect.gen(function* () {
     const sessions = yield* Sessions;
     const emailVerificationSessionPolicyOptions = yield* AuthEmailVerificationSessionPolicyConfig;
+    const loginApprovalDependencies = yield* optionalLoginApprovalDependencies;
     return makeAuthFlow({
         sessions,
         emailVerificationSessionPolicy: makeEmailVerificationSessionPolicy(emailVerificationSessionPolicyOptions),
+        ...loginApprovalDependencies,
     });
 }));
 export const AuthFlowLiveWithEmailVerificationPolicy = (options) => Layer.effect(AuthFlow)(Effect.gen(function* () {
     const sessions = yield* Sessions;
+    const loginApprovalDependencies = yield* optionalLoginApprovalDependencies;
     return makeAuthFlow({
         sessions,
         emailVerificationSessionPolicy: makeEmailVerificationSessionPolicy(options),
+        ...loginApprovalDependencies,
     });
 }));
 //# sourceMappingURL=AuthFlow.js.map