@shivaedev/identity 0.0.0-stage → 0.1.0

package/src/server/adapters/betterAuthSessions.ts

@@ -0,0 +1,44 @@
+import { Effect, Option, Predicate } from "effect";
+import type { Headers } from "effect/http";
+import { redact } from "@shivaedev/errors/redact.ts";
+import { AuthUnavailable, Unauthorized } from "@shivaedev/errors/taxonomy.ts";
+import type { ProviderAccountValue } from "#identity.ts";
+import type { SessionProvider, SessionShape } from "#server/session.ts";
+export type GetSession<TSession extends SessionShape> = (headers: globalThis.Headers) => Promise<TSession | null>;
+export type GetProviderAccounts = (headers: globalThis.Headers) => Promise<readonly ProviderAccountValue[]>;
+export type SessionWithProviderAccounts<TSession extends SessionShape> = TSession & {
+	readonly user: TSession["user"] & { readonly providerAccounts: Effect.Effect<readonly ProviderAccountValue[], AuthUnavailable | Unauthorized> };
+};
+function unavailable(cause: unknown) {
+	return Effect.andThen(
+		Effect.logError("Authentication provider failed", redact(cause)),
+		Effect.fail(new AuthUnavailable({ message: "Authentication is temporarily unavailable" })),
+	);
+}
+export function betterAuthSessions<TSession extends SessionShape>(getSession: GetSession<TSession>): SessionProvider<TSession>;
+export function betterAuthSessions<TSession extends SessionShape>(
+	getSession: GetSession<TSession>,
+	getProviderAccounts: GetProviderAccounts,
+): SessionProvider<SessionWithProviderAccounts<TSession>>;
+export function betterAuthSessions<TSession extends SessionShape>(getSession: GetSession<TSession>, getProviderAccounts?: GetProviderAccounts) {
+	const betterAuthSession = Effect.fn("PlatformRpc.betterAuthSession")(function* (headers: Headers.Headers) {
+		const transport = new globalThis.Headers(headers);
+		const session = yield* Effect.tryPromise(() => getSession(transport)).pipe(Effect.catch((error) => unavailable(error.cause)));
+		if (session === null || getProviderAccounts === undefined) {
+			return Option.fromNullishOr(session);
+		}
+		const providerAccounts = Effect.tryPromise({
+			catch: (cause) => cause,
+			try: () => getProviderAccounts(transport),
+		}).pipe(
+			Effect.catch(
+				(cause): Effect.Effect<never, AuthUnavailable | Unauthorized> =>
+					Predicate.hasProperty(cause, "statusCode") && cause.statusCode === 401
+						? Effect.fail(new Unauthorized({ message: "Authentication required" }))
+						: unavailable(cause),
+			),
+		);
+		return Option.some({ ...session, user: { ...session.user, providerAccounts } });
+	});
+	return { get: betterAuthSession };
+}

package/src/server/better-auth/allowedAccounts.ts

@@ -0,0 +1,29 @@
+import { Config, Schema, SchemaGetter } from "effect";
+
+const ProviderAccount = Schema.Struct({ accountId: Schema.NonEmptyString, providerId: Schema.NonEmptyString });
+
+const AccountEntry = Schema.String.pipe(
+	Schema.decodeTo(ProviderAccount, {
+		decode: SchemaGetter.transform((entry) => {
+			const separator = entry.indexOf(":");
+			return separator < 0
+				? { accountId: "", providerId: entry }
+				: { accountId: entry.slice(separator + 1).trim(), providerId: entry.slice(0, separator).trim() };
+		}),
+		encode: SchemaGetter.transform(({ accountId, providerId }) => `${providerId}:${accountId}`),
+	}),
+);
+
+export const AllowedAccounts = Schema.String.pipe(
+	Schema.decodeTo(Schema.Array(AccountEntry).check(Schema.isMinLength(1)), {
+		decode: SchemaGetter.transform((value) =>
+			value
+				.split(",")
+				.map((entry) => entry.trim())
+				.filter((entry) => entry.length > 0),
+		),
+		encode: SchemaGetter.transform((entries) => entries.join(",")),
+	}),
+);
+
+export const allowedAccounts = Config.schema(AllowedAccounts, "AUTH_ALLOWED_ACCOUNTS");

package/src/server/better-auth/bearerSessions.ts

@@ -0,0 +1,50 @@
+import type { BetterAuthOptions } from "better-auth";
+import { bearer } from "better-auth/plugins/bearer";
+
+export interface BearerSessionsOptions {
+	readonly origins: readonly string[];
+}
+
+export function withBearerSessions<TOptions extends BetterAuthOptions>(options: TOptions, enabled: boolean): TOptions {
+	return enabled ? { ...options, plugins: [...(options.plugins ?? []), bearer({ requireSignature: true })] } : options;
+}
+
+export function hasSessionCookie(headers: Headers, cookieName: string): boolean {
+	return (
+		headers
+			.get("cookie")
+			?.split(";")
+			.some((cookie) => cookie.trim().startsWith(`${cookieName}=`)) === true
+	);
+}
+
+export function sessionHeaders(headers: Headers, cookieName: string): Headers {
+	const result = new Headers(headers);
+	if (hasSessionCookie(headers, cookieName)) {
+		result.delete("authorization");
+	} else if (/^bearer\s/iu.test(headers.get("authorization") ?? "")) {
+		result.delete("cookie");
+	}
+	return result;
+}
+
+export async function cookieSessionResponse(response: Response): Promise<Response> {
+	const headers = new Headers(response.headers);
+	headers.delete("set-auth-token");
+	const exposed = headers.get("access-control-expose-headers");
+	if (exposed !== null) {
+		headers.set(
+			"access-control-expose-headers",
+			exposed
+				.split(",")
+				.filter((header) => header.trim().toLowerCase() !== "set-auth-token")
+				.join(","),
+		);
+	}
+	if (!headers.get("content-type")?.includes("application/json")) {
+		return new Response(response.body, { headers, status: response.status });
+	}
+	const body: unknown = JSON.parse(await response.text(), (key, value: unknown) => (key === "token" ? undefined : value));
+	headers.delete("content-length");
+	return Response.json(body, { headers, status: response.status });
+}

package/src/server/better-auth/memoryRateLimit.ts

@@ -0,0 +1,56 @@
+import type { BetterAuthRateLimitOptions } from "better-auth";
+import { Clock, Effect } from "effect";
+
+interface Bucket {
+	readonly count: number;
+	readonly expiresAt: number;
+	readonly lastRequest: number;
+}
+
+const MAX_ENTRIES = 100_000;
+
+export const memoryRateLimit = Effect.gen(function* () {
+	const clock = yield* Clock.Clock;
+	const buckets = yield* Effect.acquireRelease(
+		Effect.sync(() => new Map<string, Bucket>()),
+		(entries) => Effect.sync(() => entries.clear()),
+	);
+	let nextExpiry = Number.POSITIVE_INFINITY;
+	function prune(now: number) {
+		if (now >= nextExpiry) {
+			nextExpiry = Number.POSITIVE_INFINITY;
+			for (const [entryKey, entry] of buckets) {
+				if (now >= entry.expiresAt) {
+					buckets.delete(entryKey);
+				} else {
+					nextExpiry = Math.min(nextExpiry, entry.expiresAt);
+				}
+			}
+		}
+	}
+	const storage: NonNullable<BetterAuthRateLimitOptions["customStorage"]> = {
+		consume(key, rule) {
+			const now = clock.currentTimeMillisUnsafe();
+			prune(now);
+			const bucket = buckets.get(key);
+			const window = rule.window * 1000;
+			if (bucket !== undefined && now - bucket.lastRequest < window && bucket.count >= rule.max) {
+				return Promise.resolve({ allowed: false, retryAfter: Math.ceil((bucket.lastRequest + window - now) / 1000) });
+			}
+			nextExpiry = Math.min(nextExpiry, now + window);
+			buckets.set(key, {
+				count: bucket === undefined || now - bucket.lastRequest >= window ? 1 : bucket.count + 1,
+				expiresAt: now + window,
+				lastRequest: now,
+			});
+			if (buckets.size > MAX_ENTRIES) {
+				for (const oldest of buckets.keys()) {
+					buckets.delete(oldest);
+					break;
+				}
+			}
+			return Promise.resolve({ allowed: true, retryAfter: null });
+		},
+	};
+	return storage;
+});

package/src/server/better-auth/mount.ts

@@ -0,0 +1,145 @@
+import { type BetterAuthOptions, betterAuth } from "better-auth";
+import { Config, Effect, Option, Redacted } from "effect";
+import { Pool, type PoolClient, type PoolConfig } from "pg";
+import type { RoleSet } from "@shivaedev/access/roleSet.ts";
+import type { GetSession } from "#server/adapters/betterAuthSessions.ts";
+import { type BearerSessionsOptions, sessionHeaders, withBearerSessions } from "#server/better-auth/bearerSessions.ts";
+import { memoryRateLimit } from "#server/better-auth/memoryRateLimit.ts";
+import { mountRoutes } from "#server/better-auth/mountRoutes.ts";
+import { type RevokeUnadmitted, revokeUnadmitted } from "#server/better-auth/revokeUnadmitted.ts";
+import { type PolicyStorage, type SignInPolicy, signInGate } from "#server/better-auth/signInGate.ts";
+import { signInPolicyOptions } from "#server/better-auth/signInPolicy.ts";
+import { trustedProxyRanges } from "#server/local.ts";
+import type { SessionShape } from "#server/session.ts";
+import { mountedSessions } from "./mountedSessions.ts";
+
+export interface BetterAuthMountOptions<E = never, R = never> {
+	readonly bearerSessions?: BearerSessionsOptions | undefined;
+	readonly roles?: RoleSet;
+	readonly signIn?: SignInPolicy<E, R> | undefined;
+}
+
+export const betterAuthMount = Effect.fn("Platform.betterAuthMount")(function* <const TOptions extends BetterAuthOptions, E = never, R = never>(
+	options: TOptions,
+	mount: BetterAuthMountOptions<E, R> = {},
+) {
+	const secret = options.secret ?? Redacted.value(yield* Config.Redacted("BETTER_AUTH_SECRET"));
+	const publicUrl = yield* Config.URL("PUBLIC_URL").pipe(Config.option);
+	const origin = Option.map(publicUrl, (url) => url.origin);
+	const trustedProxy = Option.getOrUndefined(yield* Config.String("TRUSTED_PROXY").pipe(Config.option));
+	const clientIpHeader = yield* Config.String("AUTH_CLIENT_IP_HEADER").pipe(Config.withDefault("x-forwarded-for"));
+	const rateLimitEnabled = yield* Config.Boolean("AUTH_RATE_LIMIT_ENABLED").pipe(Config.withDefault(true));
+	const trustedProxies = trustedProxyRanges(trustedProxy);
+	const context = yield* Effect.context<R>();
+	const run = Effect.runPromiseWith(context);
+	const policy = mount.signIn ?? {};
+	if (policy.accounts !== undefined) {
+		yield* policy.accounts;
+	}
+	const gate = yield* signInGate(policy);
+	const gated = signInPolicyOptions(options, gate, run, (): Promise<PolicyStorage> => auth.$context);
+	const rateLimit = options.rateLimit;
+	const customStorage =
+		rateLimit?.customStorage ?? (rateLimit?.storage === undefined || rateLimit.storage === "memory" ? yield* memoryRateLimit : undefined);
+	const auth = betterAuth({
+		...withBearerSessions(options, mount.bearerSessions !== undefined),
+		advanced: {
+			useSecureCookies: Option.isSome(publicUrl) && publicUrl.value.protocol === "https:",
+			...options.advanced,
+			ipAddress: {
+				...options.advanced?.ipAddress,
+				ipAddressHeaders: trustedProxies.length === 0 ? [] : [clientIpHeader],
+				trustedProxies,
+			},
+		},
+		"baseURL":
+			options.baseURL
+			?? Option.getOrElse(origin, () => ({
+				allowedHosts: ["127.0.0.1:*"],
+				protocol: "http" as const,
+			})),
+		databaseHooks: gate.active ? gated.databaseHooks : options.databaseHooks,
+		rateLimit: {
+			...rateLimit,
+			...(customStorage === undefined ? {} : { customStorage }),
+			enabled: rateLimitEnabled,
+		},
+		secret,
+		trustedOrigins: options.trustedOrigins ?? [Option.getOrElse(origin, () => "http://127.0.0.1:*")],
+		user: gate.active ? gated.user : options.user,
+	});
+	const authRoutes = mountRoutes(auth, {
+		bearerSessions: mount.bearerSessions,
+		clientIpHeader,
+		roles: mount.roles,
+		trustedProxy,
+	});
+	function admittedSessions<TSession extends SessionShape>(getSession: GetSession<TSession>): GetSession<TSession> {
+		if (!gate.active && mount.bearerSessions === undefined) {
+			return getSession;
+		}
+		return (headers) =>
+			run(
+				Effect.gen(function* () {
+					const { authCookies } = yield* Effect.promise(() => auth.$context);
+					const selected = mount.bearerSessions === undefined ? headers : sessionHeaders(headers, authCookies.sessionToken.name);
+					const session = yield* Effect.tryPromise(() => getSession(selected));
+					if (!gate.active || session === null) {
+						return session;
+					}
+					const storage = yield* Effect.tryPromise(() => auth.$context);
+					if (yield* gate.admitsUser(storage, session.user.id)) {
+						return session;
+					}
+					yield* Effect.tryPromise(() => storage.internalAdapter.deleteUserSessions(session.user.id));
+					yield* Effect.logInfo("The sign-in policy revoked a user's sessions").pipe(Effect.annotateLogs({ userId: session.user.id }));
+					return null;
+				}),
+			);
+	}
+	const revoke: RevokeUnadmitted<E> = Effect.provideContext(
+		revokeUnadmitted(gate, () => auth.$context),
+		context,
+	);
+	const lookupSession = Reflect.get(auth.api, "getSession");
+	const sessions = mountedSessions(
+		(headers) => lookupSession({ asResponse: false, headers, query: { disableCookieCache: true }, returnHeaders: false }),
+		admittedSessions,
+		mount.roles,
+	);
+	return { admittedSessions, auth, revokeUnadmitted: revoke, routes: authRoutes, sessions };
+});
+
+export const authDatabase = Effect.fn("Platform.authDatabase")(function* (
+	url: Redacted.Redacted<string>,
+	options: Pick<PoolConfig, "max" | "application_name"> = {},
+) {
+	const clients = new Set<PoolClient>();
+	const run = Effect.runForkWith(yield* Effect.context<never>());
+	return yield* Effect.acquireRelease(
+		Effect.sync(() => {
+			const pool = new Pool({
+				...options,
+				connectionString: Redacted.value(url),
+			});
+			pool.on("connect", (client) => clients.add(client));
+			pool.on("remove", (client) => clients.delete(client));
+			pool.on("error", (error) => {
+				run(
+					Effect.logDebug({
+						event: "auth_database_idle_client_failed",
+						message: error.message,
+					}),
+				);
+			});
+			return pool;
+		}),
+		(pool) =>
+			Effect.promise(async () => {
+				// pg-pool resolves end before its clients finish disconnecting.
+				const disconnected = [...clients].map((client) => new Promise<void>((resolve) => client.once("end", resolve)));
+				await pool.end();
+				await Promise.all(disconnected);
+			}),
+	);
+});

package/src/server/better-auth/mountRoutes.ts

@@ -0,0 +1,75 @@
+import { Effect, Option } from "effect";
+import { HttpRouter, HttpServerRequest, HttpServerResponse } from "effect/http";
+import type { RoleSet } from "@shivaedev/access/roleSet.ts";
+import { redact } from "@shivaedev/errors/redact.ts";
+import { type BearerSessionsOptions, cookieSessionResponse, hasSessionCookie, sessionHeaders } from "#server/better-auth/bearerSessions.ts";
+import { trustedProxyPeer } from "#server/local.ts";
+import { sessionPermissions } from "./sessionPermissions.ts";
+
+interface MountedAuth {
+	readonly $context: Promise<{ readonly authCookies: { readonly sessionToken: { readonly name: string } } }>;
+	readonly handler: (request: Request) => Promise<Response>;
+}
+interface MountRouteOptions {
+	readonly bearerSessions?: BearerSessionsOptions | undefined;
+	readonly clientIpHeader: string;
+	readonly roles?: RoleSet | undefined;
+	readonly trustedProxy?: string | undefined;
+}
+function replacesSession(request: Request, response: Response, native: boolean) {
+	return (
+		native
+		&& response.ok
+		&& response.headers.has("set-auth-token")
+		&& request.headers.has("authorization")
+		&& new URL(request.url).pathname.startsWith("/api/auth/sign-in/")
+	);
+}
+async function providerResponse(auth: MountedAuth, web: Request, options: MountRouteOptions) {
+	if (options.bearerSessions === undefined) {
+		return auth.handler(web);
+	}
+	const { authCookies } = await auth.$context;
+	const cookieName = authCookies.sessionToken.name;
+	const headers = sessionHeaders(web.headers, cookieName);
+	const native = options.bearerSessions.origins.includes(web.headers.get("origin") ?? "") && !hasSessionCookie(web.headers, cookieName);
+	const request = new Request(web, { headers });
+	const response = await auth.handler(request);
+	if (replacesSession(request, response, native)) {
+		const revoked = await auth.handler(new Request(new URL("/api/auth/sign-out", web.url), { body: "{}", headers, method: "POST" }));
+		await revoked.body?.cancel();
+		if (!revoked.ok) {
+			throw new Error("Session replacement failed");
+		}
+	}
+	return native ? response : cookieSessionResponse(response);
+}
+async function authResponse(auth: MountedAuth, web: Request, options: MountRouteOptions) {
+	const sessionRequest = options.roles !== undefined && new URL(web.url).pathname === "/api/auth/get-session";
+	const url = new URL(web.url);
+	if (sessionRequest) {
+		url.searchParams.set("disableCookieCache", "true");
+	}
+	const request = sessionRequest ? new Request(url, web) : web;
+	const response = await providerResponse(auth, request, options);
+	return sessionRequest && response.ok && options.roles !== undefined ? sessionPermissions(response, options.roles) : response;
+}
+export function mountRoutes(auth: MountedAuth, options: MountRouteOptions) {
+	const isTrustedProxy = trustedProxyPeer(options.trustedProxy);
+	return HttpRouter.use((router) =>
+		router.add("*", "/api/auth/*", (request) =>
+			Effect.gen(function* () {
+				const web = yield* HttpServerRequest.toWeb(request);
+				if (!Option.exists(request.remoteAddress, isTrustedProxy)) {
+					web.headers.delete("x-forwarded-for");
+					web.headers.delete(options.clientIpHeader);
+				}
+				return HttpServerResponse.fromWeb(
+					yield* Effect.tryPromise(() => authResponse(auth, web, options)).pipe(
+						Effect.tapError((error) => Effect.logError("Authentication provider failed", redact(error.cause))),
+					),
+				);
+			}).pipe(Effect.catch(() => Effect.succeed(HttpServerResponse.text("Authentication is temporarily unavailable", { status: 503 })))),
+		),
+	);
+}

package/src/server/better-auth/mountedSessions.ts

@@ -0,0 +1,21 @@
+import { Schema } from "effect";
+import type { RoleSet } from "@shivaedev/access/roleSet.ts";
+import { betterAuthSessions, type GetSession } from "#server/adapters/betterAuthSessions.ts";
+import type { SessionShape } from "#server/session.ts";
+
+const AuthSession = Schema.NullOr(
+	Schema.Struct({
+		user: Schema.Struct({ email: Schema.String, id: Schema.String, name: Schema.String, role: Schema.optionalKey(Schema.NullOr(Schema.String)) }),
+	}),
+);
+
+export function mountedSessions(
+	lookup: (headers: Headers) => Promise<unknown>,
+	admit: <TSession extends SessionShape>(getSession: GetSession<TSession>) => GetSession<TSession>,
+	roles?: RoleSet,
+) {
+	return {
+		...(roles === undefined ? {} : { roles }),
+		provider: betterAuthSessions(admit(async (headers) => Schema.decodeUnknownSync(AuthSession)(await lookup(headers)))),
+	};
+}

package/src/server/better-auth/revokeUnadmitted.ts

@@ -0,0 +1,41 @@
+import { type Config, Effect } from "effect";
+import type { AuthUnavailable } from "@shivaedev/errors/taxonomy.ts";
+import { fromStorage, type PolicyStorage, type SignInGate } from "#server/better-auth/signInGate.ts";
+
+export interface RevokedSessions {
+	readonly sessions: number;
+	readonly users: number;
+}
+
+export type RevokeUnadmitted<E> = Effect.Effect<RevokedSessions, E | Config.ConfigError | AuthUnavailable>;
+
+const PAGE_SIZE = 100;
+
+export const revokeUnadmitted = Effect.fnUntraced(function* <E>(
+	gate: SignInGate<E>,
+	storage: () => Promise<PolicyStorage>,
+): Effect.fn.Return<RevokedSessions, E | Config.ConfigError | AuthUnavailable> {
+	if (!gate.active) {
+		return { sessions: 0, users: 0 } satisfies RevokedSessions;
+	}
+	const auth = yield* fromStorage(storage);
+	const revoked: Array<{ readonly sessions: number; readonly userId: string }> = [];
+	for (let offset = 0; ; offset += PAGE_SIZE) {
+		const users = yield* fromStorage(() => auth.internalAdapter.listUsers(PAGE_SIZE, offset, { direction: "asc", field: "id" }));
+		for (const { id } of users) {
+			if (!(yield* gate.admitsUser(auth, id))) {
+				const sessions = Number(yield* fromStorage(() => auth.adapter.count({ model: "session", where: [{ field: "userId", value: id }] })));
+				if (sessions > 0) {
+					revoked.push({ sessions, userId: id });
+				}
+			}
+		}
+		if (users.length < PAGE_SIZE) {
+			break;
+		}
+	}
+	for (const { userId } of revoked) {
+		yield* fromStorage(() => auth.internalAdapter.deleteUserSessions(userId));
+	}
+	return { sessions: revoked.reduce((total, user) => total + user.sessions, 0), users: revoked.length } satisfies RevokedSessions;
+});

package/src/server/better-auth/sessionPermissions.ts

@@ -0,0 +1,18 @@
+import { Effect, Schema } from "effect";
+import type { RoleSet } from "@shivaedev/access/roleSet.ts";
+import { resolveRole } from "#server/resolveRole.ts";
+
+const Fields = Schema.Record(Schema.String, Schema.Unknown);
+const SessionPayload = Schema.NullOr(Schema.StructWithRest(Schema.Struct({ user: Fields }), [Fields]));
+
+export async function sessionPermissions(response: Response, roles: RoleSet): Promise<Response> {
+	const payload = Schema.decodeUnknownSync(SessionPayload)(await response.json());
+	if (payload === null) {
+		return Response.json(null, response);
+	}
+	const access = await Effect.runPromise(resolveRole(roles, payload.user.role));
+	const headers = new Headers(response.headers);
+	headers.delete("content-length");
+	headers.set("cache-control", "private, no-store");
+	return Response.json({ ...payload, user: { ...payload.user, ...access } }, { headers, status: response.status });
+}

package/src/server/better-auth/signInGate.ts

@@ -0,0 +1,77 @@
+import { Cache, type Config, Duration, Effect, Exit } from "effect";
+import { redact } from "@shivaedev/errors/redact.ts";
+import { AuthUnavailable } from "@shivaedev/errors/taxonomy.ts";
+import type { ProviderAccountValue } from "#identity.ts";
+
+export interface SignInPolicy<E = never, R = never> {
+	readonly accounts?: Config.Config<readonly ProviderAccountValue[]> | undefined;
+	readonly recheckInterval?: Duration.Input | undefined;
+	readonly rule?: ((account: ProviderAccountValue) => Effect.Effect<boolean, E, R>) | undefined;
+}
+
+export interface PolicyStorage {
+	readonly adapter: {
+		readonly count: (query: { readonly model: string; readonly where: Array<{ readonly field: string; readonly value: string }> }) => Promise<number>;
+	};
+	readonly internalAdapter: {
+		readonly deleteUserSessions: (userId: string) => Promise<void>;
+		readonly findAccounts: (userId: string) => Promise<readonly ProviderAccountValue[]>;
+		readonly listUsers: (
+			limit: number,
+			offset: number,
+			sortBy: { readonly direction: "asc" | "desc"; readonly field: string },
+		) => Promise<readonly { readonly id: string }[]>;
+	};
+}
+
+export interface SignInGate<E> {
+	readonly active: boolean;
+	readonly admits: (candidates: readonly ProviderAccountValue[]) => Effect.Effect<boolean, E | Config.ConfigError>;
+	readonly admitsUser: (storage: PolicyStorage, userId: string) => Effect.Effect<boolean, E | Config.ConfigError | AuthUnavailable>;
+}
+
+const RULE_CACHE_CAPACITY = 10_000;
+
+export function fromStorage<A>(read: () => Promise<A>) {
+	return Effect.tryPromise(read).pipe(
+		Effect.catch((error) =>
+			Effect.andThen(
+				Effect.logError("Sign-in policy storage failed", redact(error.cause)),
+				Effect.fail(new AuthUnavailable({ message: "Authentication is temporarily unavailable" })),
+			),
+		),
+	);
+}
+
+function sameAccount(left: ProviderAccountValue, right: ProviderAccountValue) {
+	return left.providerId === right.providerId && left.accountId === right.accountId;
+}
+
+export const signInGate = Effect.fnUntraced(function* <E, R>(policy: SignInPolicy<E, R>): Effect.fn.Return<SignInGate<E>, never, R> {
+	const { accounts, rule } = policy;
+	const recheckInterval = Duration.fromInputUnsafe(policy.recheckInterval ?? "5 minutes");
+	const verdicts =
+		rule === undefined
+			? undefined
+			: yield* Cache.makeWith(rule, {
+					capacity: RULE_CACHE_CAPACITY,
+					timeToLive: (exit) => (Exit.isSuccess(exit) ? recheckInterval : Duration.zero),
+				});
+	const admits = Effect.fnUntraced(function* (candidates: readonly ProviderAccountValue[]) {
+		const allowed = accounts === undefined ? undefined : yield* accounts;
+		const listed = allowed === undefined ? candidates : candidates.filter((candidate) => allowed.some((entry) => sameAccount(entry, candidate)));
+		if (verdicts === undefined) {
+			return listed.length > 0;
+		}
+		for (const { accountId, providerId } of listed) {
+			if (yield* Cache.get(verdicts, { accountId, providerId })) {
+				return true;
+			}
+		}
+		return false;
+	});
+	const admitsUser = Effect.fnUntraced(function* (storage: PolicyStorage, userId: string) {
+		return yield* admits(yield* fromStorage(() => storage.internalAdapter.findAccounts(userId)));
+	});
+	return { active: accounts !== undefined || rule !== undefined, admits, admitsUser };
+});

package/src/server/better-auth/signInPolicy.ts

@@ -0,0 +1,72 @@
+import type { BetterAuthOptions, ValidateUserInfoResult, ValidateUserInfoSource } from "better-auth";
+import { APIError } from "better-auth/api";
+import { Effect, Exit } from "effect";
+import { redact } from "@shivaedev/errors/redact.ts";
+import { fromStorage, type PolicyStorage, type SignInGate } from "#server/better-auth/signInGate.ts";
+
+type SessionCreateBefore = NonNullable<NonNullable<NonNullable<NonNullable<BetterAuthOptions["databaseHooks"]>["session"]>["create"]>["before"]>;
+type ValidateUserInfo = NonNullable<NonNullable<BetterAuthOptions["user"]>["validateUserInfo"]>;
+export type PolicyRun = <A, E>(effect: Effect.Effect<A, E>) => Promise<A>;
+
+const REFUSED_MESSAGE = "This account may not sign in";
+const UNAVAILABLE_MESSAGE = "Sign-in is temporarily unavailable";
+const refused: ValidateUserInfoResult = { error: "sign_in_refused", errorDescription: REFUSED_MESSAGE };
+const unavailable: ValidateUserInfoResult = { error: "sign_in_unavailable", errorDescription: UNAVAILABLE_MESSAGE };
+
+function logged<A, E>(effect: Effect.Effect<A, E>) {
+	return Effect.tapCause(effect, (cause) => Effect.logError("Sign-in policy check failed", redact(cause)));
+}
+
+async function signingInAccount(
+	source: ValidateUserInfoSource,
+	providers: readonly { readonly accountSubject: (context: { profile: object; tokens: object }) => unknown; readonly id: string }[],
+) {
+	const profile = source.oauth?.profile;
+	const provider = providers.find(({ id }) => id === source.oauth?.providerId);
+	if (source.method !== "oauth" || profile === undefined || provider === undefined) {
+		return undefined;
+	}
+	const subject = await provider.accountSubject({ profile, tokens: {} });
+	return typeof subject === "string" || typeof subject === "number" ? { accountId: String(subject), providerId: provider.id } : undefined;
+}
+
+export function signInPolicyOptions<E>(options: BetterAuthOptions, gate: SignInGate<E>, run: PolicyRun, storage: () => Promise<PolicyStorage>) {
+	const sessionBefore = options.databaseHooks?.session?.create?.before;
+	const before: SessionCreateBefore = async (session, endpoint) => {
+		const own = await sessionBefore?.(session, endpoint);
+		if (own === false) {
+			return own;
+		}
+		const userId = typeof own === "object" && typeof own.data.userId === "string" ? own.data.userId : session.userId;
+		const exit = await run(Effect.exit(logged(Effect.flatMap(fromStorage(storage), (auth) => gate.admitsUser(auth, userId)))));
+		if (Exit.isFailure(exit)) {
+			throw new APIError("SERVICE_UNAVAILABLE", { code: unavailable.error, message: UNAVAILABLE_MESSAGE });
+		}
+		if (!exit.value) {
+			throw new APIError("FORBIDDEN", { code: refused.error, message: REFUSED_MESSAGE });
+		}
+		return own;
+	};
+	const validateUserInfo: ValidateUserInfo = async (data, endpoint) => {
+		const own = await options.user?.validateUserInfo?.(data, endpoint);
+		if (own !== undefined || data.source.action !== "create-user") {
+			return own;
+		}
+		const account = await signingInAccount(data.source, endpoint.context.socialProviders).catch(() => undefined);
+		if (account === undefined) {
+			return refused;
+		}
+		const exit = await run(Effect.exit(logged(gate.admits([account]))));
+		if (Exit.isFailure(exit)) {
+			return unavailable;
+		}
+		return exit.value ? undefined : refused;
+	};
+	return {
+		databaseHooks: {
+			...options.databaseHooks,
+			session: { ...options.databaseHooks?.session, create: { ...options.databaseHooks?.session?.create, before } },
+		},
+		user: { ...options.user, validateUserInfo },
+	};
+}

package/src/server/better-auth/testDatabase.ts

@@ -0,0 +1,27 @@
+import { Effect } from "effect";
+import type { Pool } from "pg";
+
+export function authTestDatabase(pool: Pool) {
+	return {
+		expireSessions: Effect.tryPromise(async () => {
+			await pool.query('update "session" set "expiresAt" = now() - interval \'1 second\'');
+		}),
+		omitImageColumn: Effect.tryPromise(async () => {
+			await pool.query('alter table "user" drop column image');
+		}),
+		sessionIpAddresses: Effect.tryPromise(async () => {
+			const result = await pool.query<{ ipAddress: string | null }>('select "ipAddress" from "session" order by "createdAt", id');
+			return result.rows;
+		}),
+		sessions: Effect.tryPromise(async () => {
+			const result = await pool.query<{ email: string; id: string; userId: string }>(
+				'select s.id, s."userId", u.email from "session" s join "user" u on u.id = s."userId" order by u.email, s.id',
+			);
+			return result.rows;
+		}),
+		users: Effect.tryPromise(async () => {
+			const result = await pool.query<{ email: string; id: string }>('select id, email from "user" order by email');
+			return result.rows;
+		}),
+	};
+}