@shivaedev/identity 0.0.0 → 0.2.0

package/src/server/better-auth/mount.ts

@@ -0,0 +1,146 @@
+import { type BetterAuthOptions, betterAuth } from "better-auth";
+import { Config, Effect, Option, Redacted } from "effect";
+import { Pool, type PoolClient, type PoolConfig } from "pg";
+import type { RoleSet } from "@shivaedev/access/roleSet.ts";
+import type { GetSession } from "#server/adapters/betterAuthSessions.ts";
+import { type BearerSessionsOptions, sessionHeaders, withBearerSessions } from "#server/better-auth/bearerSessions.ts";
+import { PEER_IP_HEADER } from "#server/better-auth/clientIp.ts";
+import { memoryRateLimit } from "#server/better-auth/memoryRateLimit.ts";
+import { mountRoutes } from "#server/better-auth/mountRoutes.ts";
+import { type RevokeUnadmitted, revokeUnadmitted } from "#server/better-auth/revokeUnadmitted.ts";
+import { type PolicyStorage, type SignInPolicy, signInGate } from "#server/better-auth/signInGate.ts";
+import { signInPolicyOptions } from "#server/better-auth/signInPolicy.ts";
+import type { SessionShape } from "#server/session.ts";
+import { mountedSessions } from "./mountedSessions.ts";
+
+export interface BetterAuthMountOptions<E = never, R = never> {
+	readonly bearerSessions?: BearerSessionsOptions | undefined;
+	readonly roles?: RoleSet;
+	readonly signIn?: SignInPolicy<E, R> | undefined;
+}
+
+export const betterAuthMount = Effect.fn("Platform.betterAuthMount")(function* <const TOptions extends BetterAuthOptions, E = never, R = never>(
+	options: TOptions,
+	mount: BetterAuthMountOptions<E, R> = {},
+) {
+	const secret = options.secret ?? Redacted.value(yield* Config.Redacted("BETTER_AUTH_SECRET"));
+	const publicUrl = yield* Config.URL("PUBLIC_URL").pipe(Config.option);
+	const origin = Option.map(publicUrl, (url) => url.origin);
+	const trustedProxy = Option.getOrUndefined(yield* Config.String("TRUSTED_PROXY").pipe(Config.option));
+	const clientIpHeader = yield* Config.String("AUTH_CLIENT_IP_HEADER").pipe(Config.withDefault("x-forwarded-for"));
+	const rateLimitEnabled = yield* Config.Boolean("AUTH_RATE_LIMIT_ENABLED").pipe(Config.withDefault(true));
+	const context = yield* Effect.context<R>();
+	const run = Effect.runPromiseWith(context);
+	const policy = mount.signIn ?? {};
+	if (policy.accounts !== undefined) {
+		yield* policy.accounts;
+	}
+	const gate = yield* signInGate(policy);
+	const gated = signInPolicyOptions(options, gate, run, (): Promise<PolicyStorage> => auth.$context);
+	const rateLimit = options.rateLimit;
+	const customStorage =
+		rateLimit?.customStorage ?? (rateLimit?.storage === undefined || rateLimit.storage === "memory" ? yield* memoryRateLimit : undefined);
+	const auth = betterAuth({
+		...withBearerSessions(options, mount.bearerSessions !== undefined),
+		advanced: {
+			useSecureCookies: Option.isSome(publicUrl) && publicUrl.value.protocol === "https:",
+			...options.advanced,
+			ipAddress: {
+				...options.advanced?.ipAddress,
+				ipAddressHeaders: [PEER_IP_HEADER],
+				trustedProxies: [],
+			},
+		},
+		"baseURL":
+			options.baseURL
+			?? Option.getOrElse(origin, () => ({
+				allowedHosts: ["127.0.0.1:*", "localhost:*"],
+				protocol: "http" as const,
+			})),
+		databaseHooks: gate.active ? gated.databaseHooks : options.databaseHooks,
+		rateLimit: {
+			...rateLimit,
+			...(customStorage === undefined ? {} : { customStorage }),
+			enabled: rateLimitEnabled,
+		},
+		secret,
+		trustedOrigins:
+			options.trustedOrigins ?? Option.match(origin, { onNone: () => ["http://127.0.0.1:*", "http://localhost:*"], onSome: (url) => [url] }),
+		user: gate.active ? gated.user : options.user,
+	});
+	const authRoutes = mountRoutes(auth, {
+		bearerSessions: mount.bearerSessions,
+		clientIpHeader,
+		ipv6Subnet: options.advanced?.ipAddress?.ipv6Subnet,
+		roles: mount.roles,
+		trustedProxy,
+	});
+	function admittedSessions<TSession extends SessionShape>(getSession: GetSession<TSession>): GetSession<TSession> {
+		if (!gate.active && mount.bearerSessions === undefined) {
+			return getSession;
+		}
+		return (headers) =>
+			run(
+				Effect.gen(function* () {
+					const { authCookies } = yield* Effect.promise(() => auth.$context);
+					const selected = mount.bearerSessions === undefined ? headers : sessionHeaders(headers, authCookies.sessionToken.name);
+					const session = yield* Effect.tryPromise(() => getSession(selected));
+					if (!gate.active || session === null) {
+						return session;
+					}
+					const storage = yield* Effect.tryPromise(() => auth.$context);
+					if (yield* gate.admitsUser(storage, session.user.id)) {
+						return session;
+					}
+					yield* Effect.tryPromise(() => storage.internalAdapter.deleteUserSessions(session.user.id));
+					yield* Effect.logInfo("The sign-in policy revoked a user's sessions").pipe(Effect.annotateLogs({ userId: session.user.id }));
+					return null;
+				}),
+			);
+	}
+	const revoke: RevokeUnadmitted<E> = Effect.provideContext(
+		revokeUnadmitted(gate, () => auth.$context),
+		context,
+	);
+	const lookupSession = Reflect.get(auth.api, "getSession");
+	const sessions = mountedSessions(
+		(headers) => lookupSession({ asResponse: false, headers, query: { disableCookieCache: true }, returnHeaders: false }),
+		admittedSessions,
+		mount.roles,
+	);
+	return { admittedSessions, auth, revokeUnadmitted: revoke, routes: authRoutes, sessions };
+});
+
+export const authDatabase = Effect.fn("Platform.authDatabase")(function* (
+	url: Redacted.Redacted<string>,
+	options: Pick<PoolConfig, "max" | "application_name"> = {},
+) {
+	const clients = new Set<PoolClient>();
+	const run = Effect.runForkWith(yield* Effect.context<never>());
+	return yield* Effect.acquireRelease(
+		Effect.sync(() => {
+			const pool = new Pool({
+				...options,
+				connectionString: Redacted.value(url),
+			});
+			pool.on("connect", (client) => clients.add(client));
+			pool.on("remove", (client) => clients.delete(client));
+			pool.on("error", (error) => {
+				run(
+					Effect.logDebug({
+						event: "auth_database_idle_client_failed",
+						message: error.message,
+					}),
+				);
+			});
+			return pool;
+		}),
+		(pool) =>
+			Effect.promise(async () => {
+				// pg-pool resolves end before its clients finish disconnecting.
+				const disconnected = [...clients].map((client) => new Promise<void>((resolve) => client.once("end", resolve)));
+				await pool.end();
+				await Promise.all(disconnected);
+			}),
+	);
+});

package/src/server/better-auth/mountRoutes.ts

@@ -0,0 +1,73 @@
+import { Effect } from "effect";
+import { HttpRouter, HttpServerRequest, HttpServerResponse } from "effect/http";
+import type { RoleSet } from "@shivaedev/access/roleSet.ts";
+import { redact } from "@shivaedev/errors/redact.ts";
+import { type BearerSessionsOptions, cookieSessionResponse, hasSessionCookie, sessionHeaders } from "#server/better-auth/bearerSessions.ts";
+import { clientIpHeaders } from "./clientIp.ts";
+import { sessionPermissions } from "./sessionPermissions.ts";
+
+interface MountedAuth {
+	readonly $context: Promise<{ readonly authCookies: { readonly sessionToken: { readonly name: string } } }>;
+	readonly handler: (request: Request) => Promise<Response>;
+}
+interface MountRouteOptions {
+	readonly bearerSessions?: BearerSessionsOptions | undefined;
+	readonly clientIpHeader: string;
+	readonly ipv6Subnet?: number | undefined;
+	readonly roles?: RoleSet | undefined;
+	readonly trustedProxy?: string | undefined;
+}
+function replacesSession(request: Request, response: Response, native: boolean) {
+	return (
+		native
+		&& response.ok
+		&& response.headers.has("set-auth-token")
+		&& request.headers.has("authorization")
+		&& new URL(request.url).pathname.startsWith("/api/auth/sign-in/")
+	);
+}
+async function providerResponse(auth: MountedAuth, web: Request, options: MountRouteOptions) {
+	if (options.bearerSessions === undefined) {
+		return auth.handler(web);
+	}
+	const { authCookies } = await auth.$context;
+	const cookieName = authCookies.sessionToken.name;
+	const headers = sessionHeaders(web.headers, cookieName);
+	const native = options.bearerSessions.origins.includes(web.headers.get("origin") ?? "") && !hasSessionCookie(web.headers, cookieName);
+	const request = new Request(web, { headers });
+	const response = await auth.handler(request);
+	if (replacesSession(request, response, native)) {
+		const revoked = await auth.handler(new Request(new URL("/api/auth/sign-out", web.url), { body: "{}", headers, method: "POST" }));
+		await revoked.body?.cancel();
+		if (!revoked.ok) {
+			throw new Error("Session replacement failed");
+		}
+	}
+	return native ? response : cookieSessionResponse(response);
+}
+async function authResponse(auth: MountedAuth, web: Request, options: MountRouteOptions) {
+	const sessionRequest = options.roles !== undefined && new URL(web.url).pathname === "/api/auth/get-session";
+	const url = new URL(web.url);
+	if (sessionRequest) {
+		url.searchParams.set("disableCookieCache", "true");
+	}
+	const request = sessionRequest ? new Request(url, web) : web;
+	const response = await providerResponse(auth, request, options);
+	return sessionRequest && response.ok && options.roles !== undefined ? sessionPermissions(response, options.roles) : response;
+}
+export function mountRoutes(auth: MountedAuth, options: MountRouteOptions) {
+	const setClientIp = clientIpHeaders(options);
+	return HttpRouter.use((router) =>
+		router.add("*", "/api/auth/*", (request) =>
+			Effect.gen(function* () {
+				const web = yield* HttpServerRequest.toWeb(request);
+				setClientIp(request, web);
+				return HttpServerResponse.fromWeb(
+					yield* Effect.tryPromise(() => authResponse(auth, web, options)).pipe(
+						Effect.tapError((error) => Effect.logError("Authentication provider failed", redact(error.cause))),
+					),
+				);
+			}).pipe(Effect.catch(() => Effect.succeed(HttpServerResponse.text("Authentication is temporarily unavailable", { status: 503 })))),
+		),
+	);
+}

package/src/server/better-auth/mountedSessions.ts

@@ -0,0 +1,21 @@
+import { Schema } from "effect";
+import type { RoleSet } from "@shivaedev/access/roleSet.ts";
+import { betterAuthSessions, type GetSession } from "#server/adapters/betterAuthSessions.ts";
+import type { SessionShape } from "#server/session.ts";
+
+const AuthSession = Schema.NullOr(
+	Schema.Struct({
+		user: Schema.Struct({ email: Schema.String, id: Schema.String, name: Schema.String, role: Schema.optionalKey(Schema.NullOr(Schema.String)) }),
+	}),
+);
+
+export function mountedSessions(
+	lookup: (headers: Headers) => Promise<unknown>,
+	admit: <TSession extends SessionShape>(getSession: GetSession<TSession>) => GetSession<TSession>,
+	roles?: RoleSet,
+) {
+	return {
+		...(roles === undefined ? {} : { roles }),
+		provider: betterAuthSessions(admit(async (headers) => Schema.decodeUnknownSync(AuthSession)(await lookup(headers)))),
+	};
+}

package/src/server/better-auth/revokeUnadmitted.ts

@@ -0,0 +1,41 @@
+import { type Config, Effect } from "effect";
+import type { AuthUnavailable } from "@shivaedev/errors/taxonomy.ts";
+import { fromStorage, type PolicyStorage, type SignInGate } from "#server/better-auth/signInGate.ts";
+
+export interface RevokedSessions {
+	readonly sessions: number;
+	readonly users: number;
+}
+
+export type RevokeUnadmitted<E> = Effect.Effect<RevokedSessions, E | Config.ConfigError | AuthUnavailable>;
+
+const PAGE_SIZE = 100;
+
+export const revokeUnadmitted = Effect.fnUntraced(function* <E>(
+	gate: SignInGate<E>,
+	storage: () => Promise<PolicyStorage>,
+): Effect.fn.Return<RevokedSessions, E | Config.ConfigError | AuthUnavailable> {
+	if (!gate.active) {
+		return { sessions: 0, users: 0 } satisfies RevokedSessions;
+	}
+	const auth = yield* fromStorage(storage);
+	const revoked: Array<{ readonly sessions: number; readonly userId: string }> = [];
+	for (let offset = 0; ; offset += PAGE_SIZE) {
+		const users = yield* fromStorage(() => auth.internalAdapter.listUsers(PAGE_SIZE, offset, { direction: "asc", field: "id" }));
+		for (const { id } of users) {
+			if (!(yield* gate.admitsUser(auth, id))) {
+				const sessions = Number(yield* fromStorage(() => auth.adapter.count({ model: "session", where: [{ field: "userId", value: id }] })));
+				if (sessions > 0) {
+					revoked.push({ sessions, userId: id });
+				}
+			}
+		}
+		if (users.length < PAGE_SIZE) {
+			break;
+		}
+	}
+	for (const { userId } of revoked) {
+		yield* fromStorage(() => auth.internalAdapter.deleteUserSessions(userId));
+	}
+	return { sessions: revoked.reduce((total, user) => total + user.sessions, 0), users: revoked.length } satisfies RevokedSessions;
+});

package/src/server/better-auth/sessionPermissions.ts

@@ -0,0 +1,18 @@
+import { Effect, Schema } from "effect";
+import type { RoleSet } from "@shivaedev/access/roleSet.ts";
+import { resolveRole } from "#server/resolveRole.ts";
+
+const Fields = Schema.Record(Schema.String, Schema.Unknown);
+const SessionPayload = Schema.NullOr(Schema.StructWithRest(Schema.Struct({ user: Fields }), [Fields]));
+
+export async function sessionPermissions(response: Response, roles: RoleSet): Promise<Response> {
+	const payload = Schema.decodeUnknownSync(SessionPayload)(await response.json());
+	if (payload === null) {
+		return Response.json(null, response);
+	}
+	const access = await Effect.runPromise(resolveRole(roles, payload.user.role));
+	const headers = new Headers(response.headers);
+	headers.delete("content-length");
+	headers.set("cache-control", "private, no-store");
+	return Response.json({ ...payload, user: { ...payload.user, ...access } }, { headers, status: response.status });
+}

package/src/server/better-auth/signInGate.ts

@@ -0,0 +1,77 @@
+import { Cache, type Config, Duration, Effect, Exit } from "effect";
+import { redact } from "@shivaedev/errors/redact.ts";
+import { AuthUnavailable } from "@shivaedev/errors/taxonomy.ts";
+import type { ProviderAccountValue } from "#identity.ts";
+
+export interface SignInPolicy<E = never, R = never> {
+	readonly accounts?: Config.Config<readonly ProviderAccountValue[]> | undefined;
+	readonly recheckInterval?: Duration.Input | undefined;
+	readonly rule?: ((account: ProviderAccountValue) => Effect.Effect<boolean, E, R>) | undefined;
+}
+
+export interface PolicyStorage {
+	readonly adapter: {
+		readonly count: (query: { readonly model: string; readonly where: Array<{ readonly field: string; readonly value: string }> }) => Promise<number>;
+	};
+	readonly internalAdapter: {
+		readonly deleteUserSessions: (userId: string) => Promise<void>;
+		readonly findAccounts: (userId: string) => Promise<readonly ProviderAccountValue[]>;
+		readonly listUsers: (
+			limit: number,
+			offset: number,
+			sortBy: { readonly direction: "asc" | "desc"; readonly field: string },
+		) => Promise<readonly { readonly id: string }[]>;
+	};
+}
+
+export interface SignInGate<E> {
+	readonly active: boolean;
+	readonly admits: (candidates: readonly ProviderAccountValue[]) => Effect.Effect<boolean, E | Config.ConfigError>;
+	readonly admitsUser: (storage: PolicyStorage, userId: string) => Effect.Effect<boolean, E | Config.ConfigError | AuthUnavailable>;
+}
+
+const RULE_CACHE_CAPACITY = 10_000;
+
+export function fromStorage<A>(read: () => Promise<A>) {
+	return Effect.tryPromise(read).pipe(
+		Effect.catch((error) =>
+			Effect.andThen(
+				Effect.logError("Sign-in policy storage failed", redact(error.cause)),
+				Effect.fail(new AuthUnavailable({ message: "Authentication is temporarily unavailable" })),
+			),
+		),
+	);
+}
+
+function sameAccount(left: ProviderAccountValue, right: ProviderAccountValue) {
+	return left.providerId === right.providerId && left.accountId === right.accountId;
+}
+
+export const signInGate = Effect.fnUntraced(function* <E, R>(policy: SignInPolicy<E, R>): Effect.fn.Return<SignInGate<E>, never, R> {
+	const { accounts, rule } = policy;
+	const recheckInterval = Duration.fromInputUnsafe(policy.recheckInterval ?? "5 minutes");
+	const verdicts =
+		rule === undefined
+			? undefined
+			: yield* Cache.makeWith(rule, {
+					capacity: RULE_CACHE_CAPACITY,
+					timeToLive: (exit) => (Exit.isSuccess(exit) ? recheckInterval : Duration.zero),
+				});
+	const admits = Effect.fnUntraced(function* (candidates: readonly ProviderAccountValue[]) {
+		const allowed = accounts === undefined ? undefined : yield* accounts;
+		const listed = allowed === undefined ? candidates : candidates.filter((candidate) => allowed.some((entry) => sameAccount(entry, candidate)));
+		if (verdicts === undefined) {
+			return listed.length > 0;
+		}
+		for (const { accountId, providerId } of listed) {
+			if (yield* Cache.get(verdicts, { accountId, providerId })) {
+				return true;
+			}
+		}
+		return false;
+	});
+	const admitsUser = Effect.fnUntraced(function* (storage: PolicyStorage, userId: string) {
+		return yield* admits(yield* fromStorage(() => storage.internalAdapter.findAccounts(userId)));
+	});
+	return { active: accounts !== undefined || rule !== undefined, admits, admitsUser };
+});

package/src/server/better-auth/signInPolicy.ts

@@ -0,0 +1,72 @@
+import type { BetterAuthOptions, ValidateUserInfoResult, ValidateUserInfoSource } from "better-auth";
+import { APIError } from "better-auth/api";
+import { Effect, Exit } from "effect";
+import { redact } from "@shivaedev/errors/redact.ts";
+import { fromStorage, type PolicyStorage, type SignInGate } from "#server/better-auth/signInGate.ts";
+
+type SessionCreateBefore = NonNullable<NonNullable<NonNullable<NonNullable<BetterAuthOptions["databaseHooks"]>["session"]>["create"]>["before"]>;
+type ValidateUserInfo = NonNullable<NonNullable<BetterAuthOptions["user"]>["validateUserInfo"]>;
+export type PolicyRun = <A, E>(effect: Effect.Effect<A, E>) => Promise<A>;
+
+const REFUSED_MESSAGE = "This account may not sign in";
+const UNAVAILABLE_MESSAGE = "Sign-in is temporarily unavailable";
+const refused: ValidateUserInfoResult = { error: "sign_in_refused", errorDescription: REFUSED_MESSAGE };
+const unavailable: ValidateUserInfoResult = { error: "sign_in_unavailable", errorDescription: UNAVAILABLE_MESSAGE };
+
+function logged<A, E>(effect: Effect.Effect<A, E>) {
+	return Effect.tapCause(effect, (cause) => Effect.logError("Sign-in policy check failed", redact(cause)));
+}
+
+async function signingInAccount(
+	source: ValidateUserInfoSource,
+	providers: readonly { readonly accountSubject: (context: { profile: object; tokens: object }) => unknown; readonly id: string }[],
+) {
+	const profile = source.oauth?.profile;
+	const provider = providers.find(({ id }) => id === source.oauth?.providerId);
+	if (source.method !== "oauth" || profile === undefined || provider === undefined) {
+		return undefined;
+	}
+	const subject = await provider.accountSubject({ profile, tokens: {} });
+	return typeof subject === "string" || typeof subject === "number" ? { accountId: String(subject), providerId: provider.id } : undefined;
+}
+
+export function signInPolicyOptions<E>(options: BetterAuthOptions, gate: SignInGate<E>, run: PolicyRun, storage: () => Promise<PolicyStorage>) {
+	const sessionBefore = options.databaseHooks?.session?.create?.before;
+	const before: SessionCreateBefore = async (session, endpoint) => {
+		const own = await sessionBefore?.(session, endpoint);
+		if (own === false) {
+			return own;
+		}
+		const userId = typeof own === "object" && typeof own.data.userId === "string" ? own.data.userId : session.userId;
+		const exit = await run(Effect.exit(logged(Effect.flatMap(fromStorage(storage), (auth) => gate.admitsUser(auth, userId)))));
+		if (Exit.isFailure(exit)) {
+			throw new APIError("SERVICE_UNAVAILABLE", { code: unavailable.error, message: UNAVAILABLE_MESSAGE });
+		}
+		if (!exit.value) {
+			throw new APIError("FORBIDDEN", { code: refused.error, message: REFUSED_MESSAGE });
+		}
+		return own;
+	};
+	const validateUserInfo: ValidateUserInfo = async (data, endpoint) => {
+		const own = await options.user?.validateUserInfo?.(data, endpoint);
+		if (own !== undefined || data.source.action !== "create-user") {
+			return own;
+		}
+		const account = await signingInAccount(data.source, endpoint.context.socialProviders).catch(() => undefined);
+		if (account === undefined) {
+			return refused;
+		}
+		const exit = await run(Effect.exit(logged(gate.admits([account]))));
+		if (Exit.isFailure(exit)) {
+			return unavailable;
+		}
+		return exit.value ? undefined : refused;
+	};
+	return {
+		databaseHooks: {
+			...options.databaseHooks,
+			session: { ...options.databaseHooks?.session, create: { ...options.databaseHooks?.session?.create, before } },
+		},
+		user: { ...options.user, validateUserInfo },
+	};
+}

package/src/server/better-auth/testDatabase.ts

@@ -0,0 +1,27 @@
+import { Effect } from "effect";
+import type { Pool } from "pg";
+
+export function authTestDatabase(pool: Pool) {
+	return {
+		expireSessions: Effect.tryPromise(async () => {
+			await pool.query('update "session" set "expiresAt" = now() - interval \'1 second\'');
+		}),
+		omitImageColumn: Effect.tryPromise(async () => {
+			await pool.query('alter table "user" drop column image');
+		}),
+		sessionIpAddresses: Effect.tryPromise(async () => {
+			const result = await pool.query<{ ipAddress: string | null }>('select "ipAddress" from "session" order by "createdAt", id');
+			return result.rows;
+		}),
+		sessions: Effect.tryPromise(async () => {
+			const result = await pool.query<{ email: string; id: string; userId: string }>(
+				'select s.id, s."userId", u.email from "session" s join "user" u on u.id = s."userId" order by u.email, s.id',
+			);
+			return result.rows;
+		}),
+		users: Effect.tryPromise(async () => {
+			const result = await pool.query<{ email: string; id: string }>('select id, email from "user" order by email');
+			return result.rows;
+		}),
+	};
+}

package/src/server/better-auth/testing.ts

@@ -0,0 +1,35 @@
+import type { AuthContext } from "better-auth";
+import type { testUtils } from "better-auth/plugins";
+
+type TestContext = ReturnType<ReturnType<typeof testUtils>["init"]>["context"];
+type AccountContext = Pick<AuthContext, "internalAdapter">;
+
+export async function signedInUser(
+	auth: { readonly $context: Promise<TestContext & AccountContext> },
+	{
+		providerAccounts = [],
+		...fields
+	}: Parameters<TestContext["test"]["createUser"]>[0] & {
+		readonly providerAccounts?: readonly { readonly providerId: string; readonly accountId: string }[];
+	},
+) {
+	const { test, internalAdapter } = await auth.$context;
+	const user = await test.saveUser(test.createUser(fields));
+	for (const { providerId, accountId } of providerAccounts) {
+		await internalAdapter.createAccount({ accountId, providerId, userId: user.id });
+	}
+	return test.login({ userId: user.id });
+}
+
+export async function storedProviderAccounts(auth: { readonly $context: Promise<AccountContext> }, userId: string) {
+	const { internalAdapter } = await auth.$context;
+	const accounts = await internalAdapter.findAccounts(userId);
+	return accounts.map(({ providerId, accountId, accessToken, refreshToken, idToken, password }) => ({
+		accountId,
+		hasAccessToken: Boolean(accessToken),
+		hasIdToken: Boolean(idToken),
+		hasPassword: Boolean(password),
+		hasRefreshToken: Boolean(refreshToken),
+		providerId,
+	}));
+}

package/src/server/better-auth/userProfiles.ts

@@ -0,0 +1,37 @@
+import type { Auth } from "better-auth";
+import { Effect } from "effect";
+import { redact } from "@shivaedev/errors/redact.ts";
+import { AuthUnavailable } from "@shivaedev/errors/taxonomy.ts";
+
+export interface UserProfile {
+	readonly id: string;
+	readonly image: string | null;
+	readonly name: string;
+}
+
+export const userProfiles = Effect.fn("Platform.userProfiles")(function* (
+	auth: { readonly $context: Promise<{ readonly adapter: Pick<Awaited<Auth["$context"]>["adapter"], "findMany"> }> },
+	userIds: readonly string[],
+): Effect.fn.Return<readonly UserProfile[], AuthUnavailable> {
+	const ids = [...new Set(userIds)];
+	if (ids.length === 0) {
+		return [];
+	}
+	const users = yield* Effect.tryPromise(async () => {
+		const { adapter } = await auth.$context;
+		return adapter.findMany<UserProfile>({
+			limit: ids.length,
+			model: "user",
+			select: ["id", "name", "image"],
+			where: [{ field: "id", operator: "in", value: ids }],
+		});
+	}).pipe(
+		Effect.catch((error) =>
+			Effect.andThen(
+				Effect.logError("Authentication provider failed", redact(error.cause)),
+				Effect.fail(new AuthUnavailable({ message: "Authentication is temporarily unavailable" })),
+			),
+		),
+	);
+	return users.map(({ id, name, image }) => ({ id, image: image ?? null, name }));
+});

package/src/server/commandChanges.ts

@@ -0,0 +1,52 @@
+import { Context, Effect, Option } from "effect";
+import * as Reactivity from "effect/reactivity/Reactivity";
+import type { Rpc } from "effect/rpc";
+import { SqlClient } from "effect/sql";
+import { invalidationKeys } from "@shivaedev/contract/keys.ts";
+import { CommandInvalidation, KeyScope } from "@shivaedev/contract/serverMetadata.ts";
+import { ChangeObserver, invalidateOnCommit, transact } from "@shivaedev/sql/transact.ts";
+import { sessionKeyContext } from "#server/sessionKeys.ts";
+
+export function sessionCommandChanges<A, E, R>(effect: Effect.Effect<A, E, R>, rpc: Rpc.AnyWithProps, payload: unknown) {
+	return Option.isSome(Context.getOption(rpc.annotations, KeyScope)) ? commandChanges(effect, rpc, payload) : effect;
+}
+
+export function commandChanges<A, E, R>(effect: Effect.Effect<A, E, R>, rpc: Rpc.AnyWithProps, payload: unknown) {
+	const invalidates = Context.getOption(rpc.annotations, CommandInvalidation);
+	if (Option.isNone(invalidates)) {
+		return effect;
+	}
+	const declared = invalidates.value;
+	return Effect.gen(function* () {
+		const context = yield* sessionKeyContext(rpc);
+		const sql = yield* Effect.serviceOption(SqlClient.SqlClient);
+		const reactivity = yield* Effect.serviceOption(Reactivity.Reactivity);
+		if (Option.isNone(reactivity)) {
+			return yield* effect;
+		}
+		const published = new Set<unknown>();
+		const observer = yield* ChangeObserver;
+		const result = yield* effect.pipe(
+			Effect.provideService(ChangeObserver, (event) => {
+				if (event._tag === "Published") {
+					for (const key of event.changes) {
+						published.add(key);
+					}
+				}
+				return observer(event);
+			}),
+		);
+		const keys = invalidationKeys(declared(payload, result), context).filter((key) => !published.has(key));
+		if (keys.length > 0) {
+			const announce = Option.isNone(sql)
+				? reactivity.value.invalidate(keys)
+				: invalidateOnCommit(keys).pipe(
+						transact({ onSqlError: (error) => error }),
+						Effect.provideService(SqlClient.SqlClient, sql.value),
+						Effect.provideService(Reactivity.Reactivity, reactivity.value),
+					);
+			yield* announce.pipe(Effect.catchCause((cause) => Effect.logError("Committed command invalidation failed", cause)));
+		}
+		return result;
+	});
+}