@yielded/auth-persistence-drizzle 0.1.0-beta.0

package/src/index.ts

@@ -0,0 +1,378 @@
+export {
+  type AnyEmailAddressMapping,
+  type AnyEmailRegistrationMapping,
+  type AnyEmailSignInMapping,
+  type D1EmailAddressMapping,
+  type D1EmailRegistrationMapping,
+  type EmailAddressMapping,
+  type EmailAuthorityCredentialTable,
+  type EmailCommandTable,
+  type EmailCredentialReadTable,
+  type EmailCredentialTable,
+  type EmailD1Clock,
+  type EmailIdentifierReadTable,
+  type EmailIdentifierTable,
+  type EmailRegistrationAuthorityCredentialTable,
+  type EmailRegistrationCredentialTable,
+  type EmailRegistrationIdentifierTable,
+  type EmailRegistrationIntent,
+  type EmailRegistrationMapping,
+  type EmailRegistrationProvisioning,
+  type EmailRegistrationState,
+  type EmailRegistrationTable,
+  type EmailSignInMapping,
+  type EmailSubjectReadTable,
+  type EmailSubjectTable,
+  type RequiredEmailAddressConstraints,
+  type RequiredEmailRegistrationConstraints,
+  type RequiredEmailSignInConstraints,
+  requiredEmailAddressConstraints,
+  requiredEmailRegistrationConstraints,
+  requiredEmailSignInConstraints,
+} from "./drizzle/email-model";
+
+export {
+  type AnyPasswordPersistenceMapping,
+  type AnyPasswordRegistrationMapping,
+  type D1PasswordPersistenceMapping,
+  type PasswordAttemptAction,
+  type PasswordAttemptRecord,
+  type PasswordAttemptState,
+  type PasswordAttemptTable,
+  type PasswordAuthorityCredentialTable,
+  type PasswordChargeTable,
+  type PasswordCommandTable,
+  type PasswordConstraintClassifier,
+  type PasswordCredentialTable,
+  type PasswordD1Clock,
+  type PasswordIdentifierTable,
+  type PasswordPersistenceMapping,
+  type PasswordRateScopeKind,
+  type PasswordRateScopeTable,
+  type PasswordRegistrationConstraintClassifier,
+  type PasswordRegistrationIntent,
+  type PasswordRegistrationMapping,
+  type PasswordRegistrationProvisioning,
+  type PasswordRegistrationState,
+  type PasswordRegistrationTable,
+  type PasswordScopeKeys,
+  type PasswordSubjectTable,
+  type RequiredPasswordConstraints,
+  type RequiredPasswordRegistrationConstraints,
+  requiredPasswordConstraints,
+  requiredPasswordRegistrationConstraints,
+} from "./drizzle/password-model";
+
+export {
+  type AnyPasswordPreparedPersistenceMapping,
+  type D1PasswordPreparedPersistenceMapping,
+  type D1PasswordPreparedProofMapping,
+  type PasswordPreparedAdmissionTable,
+  type PasswordPreparedIntentTable,
+  type PasswordPreparedPersistenceMapping,
+  type PasswordPreparedProofMapping,
+  type PasswordPreparedState,
+  type RequiredPasswordPreparedConstraints,
+  requiredPasswordPreparedConstraints,
+} from "./drizzle/password-prepared-model";
+
+export {
+  type AnyProofPersistenceMapping,
+  type D1ProofPersistenceMapping,
+  type ProofAbuseEventTable,
+  type ProofAction,
+  type ProofAuthorityInput,
+  type ProofAuthorityTables,
+  type ProofCommandDecision,
+  type ProofCommandKind,
+  type ProofCommandTable,
+  type ProofConstraintClassifier,
+  type ProofContinuationRecord,
+  type ProofContinuationTable,
+  type ProofD1Clock,
+  type ProofDeliveryState,
+  type ProofFailureEventTable,
+  type ProofGenerationState,
+  type ProofGenerationTable,
+  type ProofPersistenceMapping,
+  type ProofRateScopeTable,
+  type ProofRequestTable,
+  type ProofScopeKeys,
+  type ProofScopeKind,
+  type ProofSeriesTable,
+  type RequiredProofConstraints,
+  requiredProofConstraints,
+} from "./drizzle/proof-model";
+
+export {
+  type AuthStoreTables,
+  type AuthTables,
+  type ChallengeColumns,
+  type ChallengeConsumeDecision,
+  type ChallengeInput,
+  type ChallengeRecord,
+  type ChallengeTableMapping,
+  type CommitMode,
+  type ConsumeDecision,
+  type D1ExternalIdentityMapping,
+  type D1GeneratedIdentityMapping,
+  type D1SubjectProvisioningMapping,
+  PersistenceMappingError,
+  type ExternalIdentityTables,
+  type IdentityTables,
+  type InstantCodec,
+  type OAuthStateColumns,
+  type OAuthStateTableMapping,
+  type OAuthStateTables,
+  type RegistrationColumns,
+  type RegistrationRecord,
+  type RegistrationTableMapping,
+  type RequiredAuthConstraints,
+  type RequiredAuthStoreConstraints,
+  type RequiredExternalIdentityConstraints,
+  type RequiredIdentityConstraints,
+  type RequiredOAuthStateConstraints,
+  type RequiredSubjectProvisioningConstraints,
+  type SubjectIdCodec,
+  type SubjectProvisioningTables,
+  authServicesLayer,
+  column,
+  identityServicesLayer,
+  isMappedConstraintConflict,
+  provisioningFingerprint,
+  requireStandaloneConsume,
+  requiredAuthConstraints,
+  requiredAuthStoreConstraints,
+  requiredExternalIdentityConstraints,
+  requiredIdentityConstraints,
+  requiredOAuthStateConstraints,
+  requiredSubjectProvisioningConstraints,
+  updateValues,
+} from "./drizzle/model";
+
+export {
+  type AuthenticationAuthorityMapping,
+  type D1AuthenticationAuthorityMapping,
+  type D1PendingAuthenticationMapping,
+  type D1SessionClockMapping,
+  type D1SignedSessionValidityMapping,
+  type D1StatefulSessionMapping,
+  type PendingAuthenticationMapping,
+  type PendingAuthenticationTables,
+  type RequiredPendingAuthenticationConstraints,
+  type RequiredSessionConstraints,
+  type RequiredSignedValidityConstraints,
+  type RequiredStatefulPendingConstraints,
+  type SessionAuthorityTables,
+  type SessionConstraintClassifier,
+  type SessionFlowTables,
+  type SessionIdCodec,
+  type SessionSubjectTables,
+  type SignedSessionValidityMapping,
+  type SignedSessionValidityTables,
+  type StatefulSessionMapping,
+  type StatefulSessionTables,
+  requiredPendingAuthenticationConstraints,
+  requiredSessionConstraints,
+  requiredSignedValidityConstraints,
+  requiredStatefulPendingConstraints,
+} from "./drizzle/session-model";
+
+export {
+  type D1PasskeyMapping,
+  type PasskeyAdmissionTable,
+  type PasskeyCeremonyMapping,
+  type PasskeyChargeInsert,
+  type PasskeyChargeKind,
+  type PasskeyChargeTable,
+  type PasskeyClock,
+  type PasskeyColumn,
+  type PasskeyCredentialMapping,
+  type PasskeyCredentialOwnershipTable,
+  type PasskeyCredentialReadTable,
+  type PasskeyCredentialServices,
+  type PasskeyEnrollmentContextMapping,
+  type PasskeyEnrollmentContextServices,
+  type PasskeyFactorReadTable,
+  type PasskeyFlowInsert,
+  type PasskeyFlowState,
+  type PasskeyFlowTable,
+  type PasskeyHandleOwnershipTable,
+  type PasskeyHandleReadTable,
+  type PasskeyHandleReservationTable,
+  type PasskeyMappingSource,
+  type PasskeyModuleTable,
+  type PasskeyPersistenceMapping,
+  type PasskeyPersistenceServices,
+  type PasskeyPolicyGuard,
+  type PasskeySubjectIdCodec,
+  type PasskeySubjectReadTable,
+  passkeyCredentialsLayer,
+  passkeyEnrollmentContextLayer,
+  passkeyPersistenceLayer,
+  passkeyPolicyGuard,
+  requiredPasskeyCredentialConstraints,
+  requiredPasskeyPersistenceConstraints,
+} from "./drizzle/passkey-model";
+
+export {
+  type D1SessionStepUpMapping,
+  type RequiredSessionStepUpConstraints,
+  type SessionStepUpIntentTables,
+  type SessionStepUpMapping,
+  type SessionStepUpSourceTables,
+  requiredSessionStepUpConstraints,
+} from "./drizzle/step-up-model";
+
+export {
+  type OAuthAccountsMapping,
+  type OAuthAction,
+  type OAuthAuthorityReadTable,
+  type OAuthAuthorityTable,
+  type OAuthCleanupDescriptor,
+  type OAuthCleanupTable,
+  type OAuthClock,
+  type OAuthCredentialReadTable,
+  type OAuthCredentialTable,
+  type OAuthD1Mapping,
+  type OAuthEligibilityDescriptor,
+  type OAuthEligibilityFact,
+  type OAuthEligibilityTable,
+  type OAuthFlowState,
+  type OAuthFlowTable,
+  type OAuthMetadataPolicy,
+  type OAuthOwnershipMutation,
+  type OAuthOwnershipReadTable,
+  type OAuthOwnershipTable,
+  type OAuthReferenceGuardDescriptor,
+  type OAuthReferenceGuardTable,
+  type OAuthRegistrationAuthority,
+  type OAuthRegistrationBase,
+  type OAuthRegistrationCommandTable,
+  type OAuthRegistrationEligibility,
+  type OAuthRegistrationGuardDescriptor,
+  type OAuthRegistrationGuardTable,
+  type OAuthRegistrationIntentMapping,
+  type OAuthRegistrationIntentTable,
+  type OAuthRegistrationMapping,
+  type OAuthRegistrationState,
+  type OAuthSignInMapping,
+  type OAuthSubjectReadTable,
+  type OAuthSubjectTable,
+  type OAuthTupleAuthorityTable,
+  type OAuthTupleState,
+  type OAuthUnlinkCommandTable,
+  oauthCleanupTable,
+  oauthEligibilityTable,
+  oauthReferenceGuardTable,
+  oauthRegistrationGuardTable,
+  requiredOAuthAccountsConstraints,
+  requiredOAuthRegistrationConstraints,
+  requiredOAuthSignInConstraints,
+  requiredOAuthTupleConstraints,
+} from "./drizzle/oauth-model";
+
+export {
+  type OAuthConnectedAction,
+  type OAuthConnectedAdmissionTable,
+  type OAuthConnectedAuthorityMapping,
+  type OAuthConnectedClientRegistrationTable,
+  type OAuthConnectedCohortTable,
+  type OAuthConnectedCommandTable,
+  type OAuthConnectedFlowTable,
+  type OAuthConnectedGrantTable,
+  type OAuthConnectedMapping,
+  type OAuthConnectedOrderCodec,
+  type OAuthConnectedOwnershipRead,
+  type OAuthConnectedPolicyGuard,
+  type OAuthConnectedPolicyGuardTable,
+  type OAuthConnectedPolicyInput,
+  type OAuthConnectedRevocationJobTable,
+  type OAuthConnectedRevocationMapping,
+  type OAuthConnectedSqlPolicy,
+  type OAuthConnectedSubjectTable,
+  oauthConnectedPolicyGuard,
+  requiredOAuthConnectedConstraints,
+  requiredOAuthConnectedRevocationConstraints,
+} from "./drizzle/oauth-connected-model";
+
+export {
+  type PasskeyRegistrationCeremonyCapabilities,
+  type PasskeyRegistrationCeremonyMapping,
+  type PasskeyRegistrationCeremonyServices,
+  type PasskeyRegistrationIntentReadTable,
+  requiredPasskeyRegistrationCeremonyConstraints,
+} from "./drizzle/passkey-registration-ceremony-model";
+
+export {
+  authenticationAuthorityLayer,
+  pendingAuthenticationLayer,
+  signedSessionValidityLayer,
+  statefulSessionLayers,
+} from "./drizzle/session-target";
+
+export {
+  emailAddressPersistenceLayer,
+  emailRegistrationLayer,
+  emailSignInTargetsLayer,
+} from "./drizzle/email-target";
+
+export {
+  oauthAccountsPersistenceLayer,
+  oauthRegistrationAuthorityLayer,
+  oauthRegistrationIntentsLayer,
+  oauthSignInPersistenceLayer,
+} from "./drizzle/oauth-target";
+
+export { oauthConnectedOwnershipReferences } from "./drizzle/oauth-connected-reference";
+
+export {
+  oauthConnectedPersistenceLayer,
+  oauthConnectedRevocationsLayer,
+} from "./drizzle/oauth-connected-target";
+
+export { passwordPersistenceLayer, passwordRegistrationLayer } from "./drizzle/password-target";
+export { passwordPreparedPersistenceLayer } from "./drizzle/password-prepared-target";
+export { proofPersistenceLayer } from "./drizzle/proof-target";
+export { AuthStoreDecisions } from "@yielded/auth/Persistence";
+
+export {
+  type TotpMapping,
+  type TotpMappingSource,
+  type D1TotpMapping,
+  type TotpPersistenceServices,
+  requiredTotpConstraints,
+  totpPersistenceLayer,
+} from "./drizzle/totp-model";
+
+export { encodeTotpRecord, decodeTotpRecord } from "./drizzle/totp-state";
+export { OAuthStateDecisions } from "@yielded/auth/OAuth";
+
+export {
+  type PasskeyCredentialInsert,
+  type PasskeyWriteTables,
+  type PasskeyInvalidationInput,
+  type PasskeyInvalidationMutation,
+  passkeyInvalidationMutation,
+  type PasskeyCommandTable,
+  type PasskeyManagementMapping,
+  requiredPasskeyManagementConstraints,
+  type PasskeyManagementServices,
+  type PasskeyRegistrationWriter,
+  type PasskeyRegistrationServices,
+  type PasskeyRegistrationMapping,
+  requiredPasskeyRegistrationWriteConstraints,
+} from "./drizzle/passkey-write-model";
+
+export { passkeyManagementPersistenceLayer } from "./drizzle/passkey-write-target";
+
+export {
+  type PhoneMapping,
+  type PhoneMappingSource,
+  type D1PhoneMapping,
+  type PhonePersistenceServices,
+  type PhoneProofCompletionMapping,
+  phoneProofCompletionMapping,
+  requiredPhoneConstraints,
+  phonePersistenceLayer,
+} from "./drizzle/phone-model";

package/src/internal/drizzle-migrations.ts

@@ -0,0 +1,29 @@
+import { PersistenceConfigurationError } from "@yielded/auth-persistence/Adapter";
+import { Effect, Layer } from "effect";
+
+/** Run Drizzle Kit output through the matching Drizzle driver. Loading files and
+ * acquiring the database are deferred until the Layer is built. Drizzle owns the
+ * migration journal and transaction; failed migrations prevent auth startup.
+ */
+export const drizzleMigrationsLayer =
+  <Database, Options, E, R>(
+    acquire: Effect.Effect<Database, never, R>,
+    migrator: Effect.Effect<(database: Database, options: Options) => Effect.Effect<void, E>>,
+  ) =>
+  (options: Options) =>
+    Layer.effectDiscard(
+      Effect.gen(function* () {
+        const database = yield* acquire;
+        const migrate = yield* migrator;
+
+        const migration = yield* Effect.try({
+          try: () => migrate(database, options),
+          catch: () =>
+            PersistenceConfigurationError.make({
+              reason: "Could not read Drizzle migrations; check the migration source and format",
+            }),
+        });
+
+        yield* migration;
+      }),
+    );

package/src/internal/drizzle-postgres.ts

@@ -0,0 +1,83 @@
+import {
+  PersistenceConfigurationError,
+  makeComposedPasskeys,
+  createPersistence,
+} from "@yielded/auth-persistence/Adapter";
+import type { StorageTable } from "@yielded/auth-persistence/Adapter";
+import { getTableColumns } from "drizzle-orm";
+import {
+  getTableConfig,
+  bigint,
+  boolean,
+  pgTable,
+  text,
+  uniqueIndex,
+  type PgTable,
+} from "drizzle-orm/pg-core";
+import type { Effect } from "effect";
+import type { SqlClient } from "effect/unstable/sql/SqlClient";
+
+import { drizzleQueryOperations } from "../drizzle/query-operations";
+
+const makeTable = (definition: StorageTable) =>
+  pgTable(
+    definition.name,
+    Object.fromEntries(
+      Object.entries(definition.columns).map(([key, column]) => {
+        const builder =
+          column.type === "text"
+            ? text(column.name)
+            : column.type === "boolean"
+              ? boolean(column.name)
+              : bigint(column.name, { mode: "number" });
+
+        return [key, column.nullable ? builder : builder.notNull()];
+      }),
+    ),
+    (columns) =>
+      definition.unique.map((keys, i) => {
+        const [first, ...rest] = keys;
+
+        if (first === undefined)
+          throw PersistenceConfigurationError.make({ reason: "An empty unique key is invalid" });
+
+        return uniqueIndex(`${definition.name}_key_${i}`).on(
+          columns[first],
+          ...rest.map((key) => columns[key]),
+        );
+      }),
+  );
+
+const describe = (table: PgTable): StorageTable => {
+  const config = getTableConfig(table);
+
+  return {
+    name: config.name,
+    ...(config.schema === undefined ? {} : { schema: config.schema }),
+    columns: Object.fromEntries(
+      Object.entries(getTableColumns(table)).map(([key, column]) => [
+        key,
+        {
+          name: column.name,
+          type:
+            column.dataType === "boolean"
+              ? "boolean"
+              : column.dataType === "number"
+                ? "integer"
+                : "text",
+          nullable: !column.notNull,
+        },
+      ]),
+    ),
+    unique: [],
+  };
+};
+
+export const postgresPersistence = <R>(acquire: Effect.Effect<object, never, R | SqlClient>) =>
+  createPersistence<PgTable, R>({
+    makeTable,
+    describe,
+    operations: drizzleQueryOperations,
+    acquire,
+    passkeys: makeComposedPasskeys(drizzleQueryOperations),
+  });

package/src/internal/drizzle-sqlite.ts

@@ -0,0 +1,81 @@
+import {
+  PersistenceConfigurationError,
+  makeComposedPasskeys,
+  createPersistence,
+} from "@yielded/auth-persistence/Adapter";
+import type { StorageTable } from "@yielded/auth-persistence/Adapter";
+import { getTableColumns } from "drizzle-orm";
+import {
+  getTableConfig,
+  integer,
+  sqliteTable,
+  text,
+  uniqueIndex,
+  type SQLiteTable,
+} from "drizzle-orm/sqlite-core";
+import type { Effect } from "effect";
+import type { SqlClient } from "effect/unstable/sql/SqlClient";
+
+import { drizzleQueryOperations } from "../drizzle/query-operations";
+
+const makeTable = (definition: StorageTable) =>
+  sqliteTable(
+    definition.name,
+    Object.fromEntries(
+      Object.entries(definition.columns).map(([key, column]) => {
+        const builder =
+          column.type === "text"
+            ? text(column.name)
+            : column.type === "boolean"
+              ? integer(column.name, { mode: "boolean" })
+              : integer(column.name);
+
+        return [key, column.nullable ? builder : builder.notNull()];
+      }),
+    ),
+    (columns) =>
+      definition.unique.map((keys, i) => {
+        const [first, ...rest] = keys;
+
+        if (first === undefined)
+          throw PersistenceConfigurationError.make({ reason: "An empty unique key is invalid" });
+
+        return uniqueIndex(`${definition.name}_key_${i}`).on(
+          columns[first],
+          ...rest.map((key) => columns[key]),
+        );
+      }),
+  );
+
+const describe = (table: SQLiteTable): StorageTable => {
+  const config = getTableConfig(table);
+
+  return {
+    name: config.name,
+    columns: Object.fromEntries(
+      Object.entries(getTableColumns(table)).map(([key, column]) => [
+        key,
+        {
+          name: column.name,
+          type:
+            column.dataType === "boolean"
+              ? "boolean"
+              : column.dataType === "number"
+                ? "integer"
+                : "text",
+          nullable: !column.notNull,
+        },
+      ]),
+    ),
+    unique: [],
+  };
+};
+
+export const sqlitePersistence = <R>(acquire: Effect.Effect<object, never, R | SqlClient>) =>
+  createPersistence<SQLiteTable, R>({
+    makeTable,
+    describe,
+    operations: drizzleQueryOperations,
+    acquire,
+    passkeys: makeComposedPasskeys(drizzleQueryOperations),
+  });