@yielded/auth-persistence-drizzle 0.1.0-beta.0

package/src/drizzle/passkey-drivers.ts

@@ -0,0 +1,385 @@
+import type { LifecycleHooks } from "@yielded/auth/Hooks";
+import { PasskeyPersistence } from "@yielded/auth/Passkey";
+import type { Table } from "drizzle-orm";
+import { Effect, Context } from "effect";
+
+import type {
+  PasskeyCredentialMapping,
+  PasskeyEnrollmentContextMapping,
+  PasskeyMappingSource,
+  PasskeyPersistenceMapping,
+  PasskeyPersistenceServices,
+} from "./passkey-model";
+import type {
+  PasskeyRegistrationCeremonyMapping,
+  PasskeyRegistrationCeremonyServices,
+} from "./passkey-registration-ceremony-model";
+import {
+  type PasskeyCoordinatorError,
+  coordinateTargetPasskey,
+  coordinateTargetPasskeyRegistration,
+  makeTargetPasskeyCredentials,
+  makeTargetPasskeyEnrollmentContext,
+  makeTargetPasskeyPersistence,
+  makeTargetPasskeyRegistration,
+  type PasskeyTargetConfiguration,
+} from "./passkey-target";
+import { makePasskeyWriteTarget } from "./passkey-write-drivers";
+import type { SuppliedService } from "./SuppliedService";
+
+// oxlint-disable-next-line no-explicit-any -- inspect only the concrete database's installed generic transaction callback.
+type TransactionOf<D> = D extends { readonly transaction: (...args: any[]) => any }
+  ? Parameters<Parameters<D["transaction"]>[0]>[0]
+  : never;
+
+export const makePasskeyTarget = <
+  D,
+  T extends Table,
+  Extra = unknown,
+  Synchronous extends boolean = false,
+>(
+  configuration: PasskeyTargetConfiguration,
+) => {
+  function coordinatePasskeyPersistence<
+    Database extends D,
+    S extends T,
+    C extends T,
+    F extends T,
+    O extends T,
+    H extends T,
+    M extends T,
+    Flow extends T,
+    Admission extends T,
+    Charge extends T,
+    N,
+    A,
+    E,
+    R,
+    RSetup = never,
+    DatabaseError = never,
+    DatabaseRequirements = never,
+  >(
+    acquire: Effect.Effect<Database, DatabaseError, DatabaseRequirements>,
+    options: {
+      readonly mapping: PasskeyMappingSource<
+        PasskeyPersistenceMapping<
+          PasskeyCredentialMapping<S, C, F, O, H, N>,
+          M,
+          Flow,
+          Admission,
+          Charge,
+          N
+        > &
+          Extra,
+        RSetup
+      >;
+      readonly transaction?: never;
+    },
+    body: Effect.Effect<A, E, Synchronous extends true ? NoInfer<PasskeyPersistence> : R>,
+  ): Effect.Effect<
+    A,
+    PasskeyCoordinatorError<E> | DatabaseError,
+    | (Synchronous extends true ? never : Exclude<R, PasskeyPersistence>)
+    | LifecycleHooks
+    | DatabaseRequirements
+    | RSetup
+  >;
+  function coordinatePasskeyPersistence<
+    Database extends D,
+    S extends T,
+    C extends T,
+    F extends T,
+    O extends T,
+    H extends T,
+    M extends T,
+    Flow extends T,
+    Admission extends T,
+    Charge extends T,
+    N,
+    A,
+    E,
+    R,
+    TxId,
+    TxShape,
+    RSetup = never,
+    DatabaseError = never,
+    DatabaseRequirements = never,
+  >(
+    acquire: Effect.Effect<Database, DatabaseError, DatabaseRequirements>,
+    options: {
+      readonly mapping: PasskeyMappingSource<
+        PasskeyPersistenceMapping<
+          PasskeyCredentialMapping<S, C, F, O, H, N>,
+          M,
+          Flow,
+          Admission,
+          Charge,
+          N
+        > &
+          Extra,
+        RSetup
+      >;
+      readonly transaction: SuppliedService<TxId, NoInfer<TransactionOf<Database>>, TxShape>;
+    },
+    body: Effect.Effect<A, E, Synchronous extends true ? NoInfer<PasskeyPersistence | TxId> : R>,
+  ): Effect.Effect<
+    A,
+    PasskeyCoordinatorError<E> | DatabaseError,
+    | (Synchronous extends true ? never : Exclude<R, PasskeyPersistence | TxId>)
+    | LifecycleHooks
+    | DatabaseRequirements
+    | RSetup
+  >;
+  function coordinatePasskeyPersistence<
+    Database extends D,
+    S extends T,
+    C extends T,
+    F extends T,
+    O extends T,
+    H extends T,
+    M extends T,
+    Flow extends T,
+    Admission extends T,
+    Charge extends T,
+    N,
+    A,
+    E,
+    R,
+    TxId,
+    TxShape,
+    RSetup = never,
+    DatabaseError = never,
+    DatabaseRequirements = never,
+  >(
+    acquire: Effect.Effect<Database, DatabaseError, DatabaseRequirements>,
+    options: {
+      readonly mapping: PasskeyMappingSource<
+        PasskeyPersistenceMapping<
+          PasskeyCredentialMapping<S, C, F, O, H, N>,
+          M,
+          Flow,
+          Admission,
+          Charge,
+          N
+        > &
+          Extra,
+        RSetup
+      >;
+      readonly transaction?: SuppliedService<TxId, NoInfer<TransactionOf<Database>>, TxShape>;
+    },
+    body: Effect.Effect<A, E, R>,
+  ): Effect.Effect<
+    A,
+    PasskeyCoordinatorError<E> | DatabaseError,
+    Exclude<R, PasskeyPersistence> | LifecycleHooks | DatabaseRequirements | RSetup
+  > {
+    return Effect.flatMap(acquire, (database) =>
+      coordinateTargetPasskey(
+        database,
+        options.mapping,
+        configuration,
+        (transaction: TransactionOf<Database>, services: PasskeyPersistenceServices) => {
+          const provided = Context.make(PasskeyPersistence, services.passkeyPersistence);
+          const work = Effect.provideContext(body, provided);
+
+          return options.transaction === undefined
+            ? work
+            : Effect.provideService(work, options.transaction, options.transaction.of(transaction));
+        },
+      ),
+    );
+  }
+  function coordinatePasskeyRegistrationCeremony<
+    Database extends D,
+    M extends T,
+    Flow extends T,
+    Admission extends T,
+    Charge extends T,
+    Intent extends T,
+    H extends T,
+    A,
+    E,
+    R,
+    RSetup = never,
+    DatabaseError = never,
+    DatabaseRequirements = never,
+  >(
+    acquire: Effect.Effect<Database, DatabaseError, DatabaseRequirements>,
+    options: {
+      readonly mapping: PasskeyMappingSource<
+        PasskeyRegistrationCeremonyMapping<M, Flow, Admission, Charge, Intent, H> & Extra,
+        RSetup
+      >;
+      readonly transaction?: never;
+    },
+    body: Effect.Effect<A, E, Synchronous extends true ? NoInfer<PasskeyPersistence> : R>,
+  ): Effect.Effect<
+    A,
+    PasskeyCoordinatorError<E> | DatabaseError,
+    | (Synchronous extends true ? never : Exclude<R, PasskeyPersistence>)
+    | LifecycleHooks
+    | DatabaseRequirements
+    | RSetup
+  >;
+  function coordinatePasskeyRegistrationCeremony<
+    Database extends D,
+    M extends T,
+    Flow extends T,
+    Admission extends T,
+    Charge extends T,
+    Intent extends T,
+    H extends T,
+    A,
+    E,
+    R,
+    TxId,
+    TxShape,
+    RSetup = never,
+    DatabaseError = never,
+    DatabaseRequirements = never,
+  >(
+    acquire: Effect.Effect<Database, DatabaseError, DatabaseRequirements>,
+    options: {
+      readonly mapping: PasskeyMappingSource<
+        PasskeyRegistrationCeremonyMapping<M, Flow, Admission, Charge, Intent, H> & Extra,
+        RSetup
+      >;
+      readonly transaction: SuppliedService<TxId, NoInfer<TransactionOf<Database>>, TxShape>;
+    },
+    body: Effect.Effect<A, E, Synchronous extends true ? NoInfer<PasskeyPersistence | TxId> : R>,
+  ): Effect.Effect<
+    A,
+    PasskeyCoordinatorError<E> | DatabaseError,
+    | (Synchronous extends true ? never : Exclude<R, PasskeyPersistence | TxId>)
+    | LifecycleHooks
+    | DatabaseRequirements
+    | RSetup
+  >;
+  function coordinatePasskeyRegistrationCeremony<
+    Database extends D,
+    M extends T,
+    Flow extends T,
+    Admission extends T,
+    Charge extends T,
+    Intent extends T,
+    H extends T,
+    A,
+    E,
+    R,
+    TxId,
+    TxShape,
+    RSetup = never,
+    DatabaseError = never,
+    DatabaseRequirements = never,
+  >(
+    acquire: Effect.Effect<Database, DatabaseError, DatabaseRequirements>,
+    options: {
+      readonly mapping: PasskeyMappingSource<
+        PasskeyRegistrationCeremonyMapping<M, Flow, Admission, Charge, Intent, H> & Extra,
+        RSetup
+      >;
+      readonly transaction?: SuppliedService<TxId, NoInfer<TransactionOf<Database>>, TxShape>;
+    },
+    body: Effect.Effect<A, E, R>,
+  ): Effect.Effect<
+    A,
+    PasskeyCoordinatorError<E> | DatabaseError,
+    Exclude<R, PasskeyPersistence> | LifecycleHooks | DatabaseRequirements | RSetup
+  > {
+    return Effect.flatMap(acquire, (database) =>
+      coordinateTargetPasskeyRegistration(
+        database,
+        options.mapping,
+        configuration,
+        (transaction: TransactionOf<Database>, services: PasskeyRegistrationCeremonyServices) => {
+          const provided = Context.make(PasskeyPersistence, services.passkeyPersistence);
+          const work = Effect.provideContext(body, provided);
+
+          return options.transaction === undefined
+            ? work
+            : Effect.provideService(work, options.transaction, options.transaction.of(transaction));
+        },
+      ),
+    );
+  }
+
+  return {
+    ...makePasskeyWriteTarget<D, T, Extra, Synchronous>(configuration),
+    makePasskeyCredentialServices: <
+      Database extends D,
+      S extends T,
+      C extends T,
+      F extends T,
+      O extends T,
+      H extends T,
+      N,
+      RSetup = never,
+    >(
+      database: Database,
+      mapping: PasskeyMappingSource<PasskeyCredentialMapping<S, C, F, O, H, N> & Extra, RSetup>,
+    ) => makeTargetPasskeyCredentials(database, mapping, configuration),
+    makePasskeyEnrollmentContextServices: <
+      Database extends D,
+      S extends T,
+      C extends T,
+      F extends T,
+      O extends T,
+      H extends T,
+      M extends T,
+      N,
+      RSetup = never,
+    >(
+      database: Database,
+      mapping: PasskeyMappingSource<
+        PasskeyEnrollmentContextMapping<PasskeyCredentialMapping<S, C, F, O, H, N>, M, N> & Extra,
+        RSetup
+      >,
+    ) => makeTargetPasskeyEnrollmentContext(database, mapping, configuration),
+    makePasskeyPersistenceServices: <
+      Database extends D,
+      S extends T,
+      C extends T,
+      F extends T,
+      O extends T,
+      H extends T,
+      M extends T,
+      Flow extends T,
+      Admission extends T,
+      Charge extends T,
+      N,
+      RSetup = never,
+    >(
+      database: Database,
+      mapping: PasskeyMappingSource<
+        PasskeyPersistenceMapping<
+          PasskeyCredentialMapping<S, C, F, O, H, N>,
+          M,
+          Flow,
+          Admission,
+          Charge,
+          N
+        > &
+          Extra,
+        RSetup
+      >,
+    ) => makeTargetPasskeyPersistence(database, mapping, configuration),
+    makePasskeyRegistrationCeremonyServices: <
+      Database extends D,
+      M extends T,
+      Flow extends T,
+      Admission extends T,
+      Charge extends T,
+      Intent extends T,
+      H extends T,
+      RSetup = never,
+    >(
+      database: Database,
+      mapping: PasskeyMappingSource<
+        PasskeyRegistrationCeremonyMapping<M, Flow, Admission, Charge, Intent, H> & Extra,
+        RSetup
+      >,
+    ) => makeTargetPasskeyRegistration(database, mapping, configuration),
+    coordinatePasskeyPersistence,
+    coordinatePasskeyRegistrationCeremony,
+  };
+};

package/src/drizzle/passkey-kernel.ts

@@ -0,0 +1,4 @@
+import { type PasskeyKernel, makePasskeyKernel } from "@yielded/auth-persistence/Adapter";
+
+import { drizzleQueryOperations } from "./query-operations";
+export const passkeyKernel: PasskeyKernel = makePasskeyKernel(drizzleQueryOperations);

package/src/drizzle/passkey-model.ts

@@ -0,0 +1,153 @@
+import * as Shared from "@yielded/auth-persistence/Adapter";
+import type { SQL, Table } from "drizzle-orm";
+
+import type { DrizzleTableModel } from "./table-model";
+
+export {
+  type PasskeyMappingSource,
+  type PasskeyCredentialServices,
+  type PasskeyPersistenceServices,
+  type PasskeyEnrollmentContextServices,
+  passkeyCredentialsLayer,
+  passkeyPersistenceLayer,
+  passkeyEnrollmentContextLayer,
+  type PasskeySubjectIdCodec,
+  requiredPasskeyCredentialConstraints,
+  type PasskeyFlowState,
+  type PasskeyFlowInsert,
+  type PasskeyChargeKind,
+  type PasskeyChargeInsert,
+  requiredPasskeyPersistenceConstraints,
+  type D1PasskeyMapping,
+} from "@yielded/auth-persistence/Adapter";
+
+export type PasskeyColumn<T extends Table> = Shared.PasskeyColumn<DrizzleTableModel<T>>;
+
+export type PasskeyClock = Shared.PasskeyClock<SQL>;
+
+export type PasskeySubjectReadTable<T extends Table, N> = Shared.PasskeySubjectReadTable<
+  DrizzleTableModel<T>,
+  N,
+  SQL
+>;
+
+export type PasskeyFactorReadTable<T extends Table> = Shared.PasskeyFactorReadTable<
+  DrizzleTableModel<T>,
+  SQL
+>;
+
+/** decode uses only these declared columns. Counter columns are native integral
+ * numbers; BS may use a consumer enum. Name/creation metadata is not required. */
+export type PasskeyCredentialReadTable<T extends Table, N> = Shared.PasskeyCredentialReadTable<
+  DrizzleTableModel<T>,
+  N,
+  SQL
+>;
+
+export type PasskeyCredentialOwnershipTable<
+  T extends Table,
+  N,
+> = Shared.PasskeyCredentialOwnershipTable<DrizzleTableModel<T>, N, SQL>;
+
+/** Reservations do not manufacture a subject; bound handles are RP-global. */
+export type PasskeyHandleReadTable<T extends Table> = Shared.PasskeyHandleReadTable<
+  DrizzleTableModel<T>
+>;
+
+export type PasskeyHandleReservationTable<T extends Table> = Shared.PasskeyHandleReservationTable<
+  DrizzleTableModel<T>,
+  SQL
+>;
+
+export type PasskeyHandleOwnershipTable<T extends Table, N> = Shared.PasskeyHandleOwnershipTable<
+  DrizzleTableModel<T>,
+  N,
+  SQL
+>;
+
+export type PasskeyCredentialMapping<
+  S extends Table,
+  C extends Table,
+  F extends Table,
+  Ownership extends Table,
+  Handle extends Table,
+  N,
+> = Shared.PasskeyCredentialMapping<
+  DrizzleTableModel<S>,
+  DrizzleTableModel<C>,
+  DrizzleTableModel<F>,
+  DrizzleTableModel<Ownership>,
+  DrizzleTableModel<Handle>,
+  N,
+  SQL
+>;
+
+export type PasskeyPolicyGuard = Shared.PasskeyPolicyGuard<SQL>;
+
+export const passkeyPolicyGuard = <T extends Table>(input: {
+  readonly scope: string;
+  readonly table: T;
+  readonly columns: ReadonlyArray<PasskeyColumn<T>>;
+  readonly where: (moduleId: string) => SQL;
+  readonly condition: (moduleId: string) => SQL;
+}): PasskeyPolicyGuard => Shared.passkeyPolicyGuard<DrizzleTableModel<T>, SQL>(input);
+
+export type PasskeyModuleTable<T extends Table> = Shared.PasskeyModuleTable<
+  DrizzleTableModel<T>,
+  SQL
+>;
+
+export type PasskeyFlowTable<T extends Table> = Shared.PasskeyFlowTable<DrizzleTableModel<T>>;
+
+export type PasskeyAdmissionTable<T extends Table> = Shared.PasskeyAdmissionTable<
+  DrizzleTableModel<T>
+>;
+
+/** Charge scope is canonical core identity text; this subject-free descriptor
+ * can count all purposes without decoding any unrelated native subject. */
+export type PasskeyChargeTable<T extends Table> = Shared.PasskeyChargeTable<DrizzleTableModel<T>>;
+
+export type PasskeyCeremonyMapping<
+  Module extends Table,
+  Flow extends Table,
+  Admission extends Table,
+  Charge extends Table,
+> = Shared.PasskeyCeremonyMapping<
+  DrizzleTableModel<Module>,
+  DrizzleTableModel<Flow>,
+  DrizzleTableModel<Admission>,
+  DrizzleTableModel<Charge>,
+  SQL
+>;
+
+type CredentialTable<Read> = Read extends {
+  readonly credential: {
+    readonly table: infer T extends Table;
+  };
+}
+  ? T
+  : never;
+
+export type PasskeyPersistenceMapping<
+  Read,
+  Module extends Table,
+  Flow extends Table,
+  Admission extends Table,
+  Charge extends Table,
+  N,
+> = Shared.PasskeyPersistenceMapping<
+  Read,
+  DrizzleTableModel<Module>,
+  DrizzleTableModel<Flow>,
+  DrizzleTableModel<Admission>,
+  DrizzleTableModel<Charge>,
+  N,
+  SQL,
+  DrizzleTableModel<CredentialTable<Read>>
+>;
+
+export type PasskeyEnrollmentContextMapping<
+  Read,
+  Module extends Table,
+  N,
+> = Shared.PasskeyEnrollmentContextMapping<Read, DrizzleTableModel<Module>, N, SQL>;

package/src/drizzle/passkey-registration-ceremony-model.ts

@@ -0,0 +1,32 @@
+import type * as Shared from "@yielded/auth-persistence/Adapter";
+import type { SQL, Table } from "drizzle-orm";
+
+import type { DrizzleTableModel } from "./table-model";
+
+export {
+  type PasskeyRegistrationCeremonyCapabilities,
+  type PasskeyRegistrationCeremonyServices,
+  requiredPasskeyRegistrationCeremonyConstraints,
+} from "@yielded/auth-persistence/Adapter";
+
+/** Read-only custody supplied by a separate registration issuance authority.
+ * No application payload codec, subject codec or provisioning callback runs here. */
+export type PasskeyRegistrationIntentReadTable<T extends Table> =
+  Shared.PasskeyRegistrationIntentReadTable<DrizzleTableModel<T>, SQL>;
+
+export type PasskeyRegistrationCeremonyMapping<
+  Module extends Table,
+  Flow extends Table,
+  Admission extends Table,
+  Charge extends Table,
+  Intent extends Table,
+  Handle extends Table,
+> = Shared.PasskeyRegistrationCeremonyMapping<
+  DrizzleTableModel<Module>,
+  DrizzleTableModel<Flow>,
+  DrizzleTableModel<Admission>,
+  DrizzleTableModel<Charge>,
+  DrizzleTableModel<Intent>,
+  DrizzleTableModel<Handle>,
+  SQL
+>;

package/src/drizzle/passkey-state.ts

@@ -0,0 +1,3 @@
+import { passkeyKernel } from "./passkey-kernel";
+export type { PasskeyOwner } from "@yielded/auth-persistence/Adapter";
+export const { unavailable } = passkeyKernel.state;

package/src/drizzle/passkey-target.ts

@@ -0,0 +1,23 @@
+import { passkeyKernel } from "./passkey-kernel";
+
+export type {
+  PasskeyTargetConfiguration,
+  PasskeyCoordinatorError,
+  PasskeyExecution,
+} from "@yielded/auth-persistence/Adapter";
+
+export const {
+  sqlClientPasskeyStandaloneGuard,
+  makePasskeyExecution,
+  capturedService,
+  prepareValue,
+  observationalContext,
+  makePasskeyPersistence,
+  capturedMapping,
+  makeTargetPasskeyCredentials,
+  makeTargetPasskeyEnrollmentContext,
+  makeTargetPasskeyPersistence,
+  makeTargetPasskeyRegistration,
+  coordinateTargetPasskey,
+  coordinateTargetPasskeyRegistration,
+} = passkeyKernel.target;