@yielded/auth-persistence-drizzle 0.1.0-beta.0

package/src/drizzle/password-registration.ts

@@ -0,0 +1,363 @@
+import {
+  coordinateCommit,
+  CurrentCommitJournal,
+  hasCommitScope,
+  LifecycleHooks,
+  HookConfigurationError,
+} from "@yielded/auth/Hooks";
+import type { LoginIdentifier } from "@yielded/auth/Identity";
+import {
+  PasswordUnavailable,
+  type PasswordReplacement,
+  type PasswordRegistrationDecision,
+  type PreparePasswordCommit,
+} from "@yielded/auth/Password";
+import { reportPersistenceFailure } from "@yielded/auth/Persistence";
+import { ProofUnavailable } from "@yielded/auth/Proofs";
+/* oxlint-disable no-explicit-any -- registration plans bridge consumer-owned Drizzle rows. */
+import { and, eq } from "drizzle-orm";
+import { Cause, Effect, Schema } from "effect";
+
+import { column, isMappedConstraintConflict, PersistenceMappingError } from "./model";
+import {
+  type AnyPasswordRegistrationMapping,
+  requiredPasswordRegistrationConstraints,
+} from "./password-model";
+import {
+  CurrentPasswordSql,
+  type PasswordSqlDatabase,
+  type PasswordSqlQuery,
+} from "./password-sql";
+import { CurrentProofSql, type ProofSqlDatabase } from "./proof-sql";
+
+type Database = PasswordSqlDatabase;
+type Mapping<Registration> = AnyPasswordRegistrationMapping<Registration>;
+const unavailable = () => PasswordUnavailable.make({});
+
+const translateFailure = <A, E, R>(
+  effect: Effect.Effect<A, E, R>,
+): Effect.Effect<A, PasswordUnavailable, R> =>
+  reportPersistenceFailure(
+    effect,
+    (error) =>
+      Schema.is(PasswordUnavailable)(error) ||
+      Schema.is(ProofUnavailable)(error) ||
+      Schema.is(HookConfigurationError)(error),
+  ).pipe(Effect.catchCause((cause) => Effect.failCause(Cause.map(cause, () => unavailable()))));
+
+import type { PasswordRegistrationAuthority } from "@yielded/auth-persistence/Adapter";
+export type { PasswordRegistrationAuthority } from "@yielded/auth-persistence/Adapter";
+
+export interface PasswordRegistrationConfiguration {
+  readonly mode: "interactive" | "synchronous";
+  readonly locking: boolean;
+  readonly standaloneGuard: Effect.Effect<void, PasswordUnavailable>;
+  readonly coordinated?: boolean;
+  readonly generatedSubjectRows: (query: PasswordSqlQuery) => PasswordSqlQuery;
+}
+
+const validConstraints = <Registration>(mapping: Mapping<Registration>) =>
+  Object.entries(requiredPasswordRegistrationConstraints).every(
+    ([key, value]) =>
+      mapping.constraints[key as keyof typeof requiredPasswordRegistrationConstraints] === value,
+  );
+
+const selectRows = (query: PasswordSqlQuery, locking: boolean) =>
+  locking && typeof query.for === "function" ? query.for("update") : query;
+
+const allocate = <A>(
+  mode: PasswordRegistrationConfiguration["mode"],
+  asyncValue: Effect.Effect<A, PersistenceMappingError> | undefined,
+  syncValue: (() => A) | undefined,
+) => {
+  if (mode === "synchronous")
+    return syncValue === undefined
+      ? Effect.fail(unavailable())
+      : Effect.try({
+          try: syncValue,
+          catch: (cause) => new PersistenceMappingError({ operation: "mapping", cause }),
+        });
+  if (asyncValue !== undefined) return asyncValue;
+
+  return syncValue === undefined
+    ? Effect.fail(unavailable())
+    : Effect.try({
+        try: syncValue,
+        catch: (cause) => new PersistenceMappingError({ operation: "mapping", cause }),
+      });
+};
+
+const registrationRows = Effect.fn("Drizzle.registrationRows")(function* <Registration>(
+  mapping: Mapping<Registration>,
+  moduleId: string,
+  requestId: string,
+  locking: boolean,
+) {
+  const database = yield* CurrentPasswordSql;
+
+  const module = column(mapping.registration.table, mapping.registration.moduleId);
+  const request = column(mapping.registration.table, mapping.registration.requestId);
+
+  const query = database
+    .select()
+    .from(mapping.registration.table)
+    .where(and(eq(module, moduleId), eq(request, requestId)))
+    .limit(1);
+
+  return yield* selectRows(query, locking);
+});
+
+const registerIn = Effect.fn("DrizzlePasswordRegistration.registerIn")(function* <Registration, A>(
+  mapping: Mapping<Registration>,
+  configuration: PasswordRegistrationConfiguration,
+  input: {
+    readonly moduleId: string;
+    readonly requestId: string;
+    readonly identifier: LoginIdentifier;
+    readonly registration: Registration;
+    readonly replacement: PasswordReplacement;
+  },
+  allocated: {
+    readonly credentialId: string;
+    readonly securityRevision: any;
+    readonly identifierRevision: any;
+    readonly credentialRevision: any;
+    readonly verifierVersion: any;
+    readonly nativeSubjectId?: unknown;
+    readonly recoveryReference?: any;
+  },
+  prepare: PreparePasswordCommit<PasswordRegistrationDecision, A>,
+) {
+  const database = yield* CurrentPasswordSql;
+  const journal = yield* CurrentCommitJournal;
+
+  const existing = (yield* registrationRows(
+    mapping,
+    input.moduleId,
+    input.requestId,
+    configuration.locking,
+  ))[0];
+
+  if (existing !== undefined)
+    return prepare(yield* mapping.registration.decodeReplay(existing), journal);
+
+  const intent = {
+    moduleId: input.moduleId,
+    requestId: input.requestId,
+    identifier: input.identifier,
+    registration: input.registration,
+    replacement: input.replacement,
+  };
+
+  if (mapping.mode === "pending") {
+    if (allocated.recoveryReference === undefined) return yield* unavailable();
+    const receipt = prepare({ _tag: "Pending", reference: allocated.recoveryReference }, journal);
+
+    yield* database.insert(mapping.registration.table).values(
+      mapping.registration.encodeInsert(intent, {
+        state: "pending",
+        recoveryReference: allocated.recoveryReference,
+      }),
+    );
+
+    return receipt;
+  }
+  let nativeSubjectId = allocated.nativeSubjectId;
+
+  const subjectInsert = database.insert(mapping.subject.table).values(
+    mapping.provisioning.encodeSubjectInsert(intent, {
+      nativeSubjectId,
+      securityRevision: allocated.securityRevision,
+    }),
+  );
+
+  if (mapping.provisioning.idMode === "generated") {
+    const rows = yield* configuration.generatedSubjectRows(subjectInsert);
+
+    nativeSubjectId = yield* mapping.provisioning.decodeGeneratedId(rows);
+  } else yield* subjectInsert;
+  if (nativeSubjectId === undefined) return yield* unavailable();
+  const subjectId = yield* mapping.subjectId.toSubject(nativeSubjectId);
+  const receipt = prepare({ _tag: "Created", subjectId }, journal);
+
+  yield* database
+    .insert(mapping.identifier.table)
+    .values(
+      mapping.identifier.encodeInitialInsert(
+        input.identifier,
+        nativeSubjectId,
+        allocated.identifierRevision,
+      ),
+    );
+  yield* database.insert(mapping.credential.table).values(
+    mapping.credential.encodeInsert({
+      moduleId: input.moduleId,
+      subjectId: nativeSubjectId,
+      credentialId: allocated.credentialId,
+      credentialRevision: allocated.credentialRevision,
+      verifierVersion: allocated.verifierVersion,
+      replacement: input.replacement,
+    }),
+  );
+  yield* database.insert(mapping.authorityCredential.table).values(
+    mapping.authorityCredential.encodeInsert({
+      subjectId: nativeSubjectId,
+      credentialId: allocated.credentialId,
+      revision: allocated.credentialRevision,
+    }),
+  );
+  yield* database.insert(mapping.registration.table).values(
+    mapping.registration.encodeInsert(intent, {
+      state: "created",
+      nativeSubjectId,
+    }),
+  );
+
+  return receipt;
+});
+
+export const makeSqlPasswordRegistrationAuthority = Effect.fn(
+  "makeSqlPasswordRegistrationAuthority",
+)(function* <Registration>(
+  database: Database,
+  mapping: Mapping<Registration>,
+  configuration: PasswordRegistrationConfiguration,
+): Effect.fn.Return<PasswordRegistrationAuthority<Registration>, never, LifecycleHooks> {
+  const hooks = yield* LifecycleHooks;
+
+  return {
+    register: (input, prepare) =>
+      Effect.gen(function* () {
+        if (!validConstraints(mapping)) return yield* unavailable();
+
+        const credentialId = yield* allocate(
+          configuration.mode,
+          mapping.allocateCredentialId,
+          mapping.allocateCredentialIdSync,
+        );
+
+        const securityRevision = yield* allocate(
+          configuration.mode,
+          mapping.allocateRevision,
+          mapping.allocateRevisionSync,
+        );
+
+        const credentialRevision = yield* allocate(
+          configuration.mode,
+          mapping.allocateRevision,
+          mapping.allocateRevisionSync,
+        );
+
+        const identifierRevision = yield* allocate(
+          configuration.mode,
+          mapping.allocateRevision,
+          mapping.allocateRevisionSync,
+        );
+
+        const verifierVersion = yield* allocate(
+          configuration.mode,
+          mapping.allocateRevision,
+          mapping.allocateRevisionSync,
+        );
+
+        const nativeSubjectId =
+          mapping.mode !== "atomic" || mapping.provisioning.idMode === "generated"
+            ? undefined
+            : yield* allocate(
+                configuration.mode,
+                mapping.provisioning.allocateSubjectId,
+                mapping.provisioning.allocateSubjectIdSync,
+              );
+
+        const recoveryReference =
+          mapping.mode === "pending"
+            ? yield* allocate(
+                configuration.mode,
+                mapping.allocateRecoveryReference,
+                mapping.allocateRecoveryReferenceSync,
+              )
+            : undefined;
+
+        const run = coordinateCommit(
+          () =>
+            database.transaction((transaction) =>
+              registerIn(
+                mapping,
+                configuration,
+                input,
+                {
+                  credentialId,
+                  securityRevision,
+                  identifierRevision,
+                  credentialRevision,
+                  verifierVersion,
+                  ...(nativeSubjectId === undefined ? {} : { nativeSubjectId }),
+                  ...(recoveryReference === undefined ? {} : { recoveryReference }),
+                },
+                prepare,
+              ).pipe(
+                Effect.provideService(CurrentPasswordSql, transaction),
+                Effect.provideService(CurrentProofSql, transaction as unknown as ProofSqlDatabase),
+              ),
+            ),
+          { mode: configuration.mode },
+        ).pipe(Effect.map((result) => result.value));
+
+        const guarded =
+          configuration.coordinated !== true
+            ? Effect.gen(function* () {
+                if (yield* hasCommitScope) return yield* unavailable();
+                yield* configuration.standaloneGuard;
+
+                return yield* run;
+              })
+            : run;
+
+        return yield* guarded.pipe(
+          Effect.catchCause((cause) => {
+            if (
+              (cause.reasons.every(Cause.isFailReason) &&
+                isMappedConstraintConflict(mapping.isRequestConflict, cause)) ||
+              (cause.reasons.every(Cause.isFailReason) &&
+                isMappedConstraintConflict(mapping.isIdentifierConflict, cause)) ||
+              (cause.reasons.every(Cause.isFailReason) &&
+                isMappedConstraintConflict(mapping.isCredentialConflict, cause))
+            )
+              return coordinateCommit(
+                (journal) =>
+                  database.transaction((transaction) =>
+                    Effect.gen(function* () {
+                      const row = (yield* registrationRows(
+                        mapping,
+                        input.moduleId,
+                        input.requestId,
+                        configuration.locking,
+                      ))[0];
+
+                      const decision =
+                        row === undefined
+                          ? ({ _tag: "Suppressed" } as const)
+                          : yield* mapping.registration.decodeReplay(row);
+
+                      return prepare(decision, journal);
+                    }).pipe(
+                      Effect.provideService(CurrentPasswordSql, transaction),
+                      Effect.provideService(
+                        CurrentProofSql,
+                        transaction as unknown as ProofSqlDatabase,
+                      ),
+                    ),
+                  ),
+                { mode: configuration.mode },
+              ).pipe(Effect.map((result) => result.value));
+
+            return Effect.failCause(cause);
+          }),
+        );
+      }).pipe(
+        Effect.provideService(CurrentPasswordSql, database),
+        Effect.provideService(LifecycleHooks, hooks),
+        translateFailure,
+      ),
+  };
+});

package/src/drizzle/password-sql.ts

@@ -0,0 +1,13 @@
+import { makePasswordKernel } from "@yielded/auth-persistence/Adapter";
+
+import { completeProofPlanIn } from "./proof-sql";
+import { drizzleQueryOperations } from "./query-operations";
+export type { PasswordSqlQuery } from "@yielded/auth-persistence/Adapter";
+export type { PasswordSqlDatabase } from "@yielded/auth-persistence/Adapter";
+export { CurrentPasswordSql } from "@yielded/auth-persistence/Adapter";
+export type { PasswordSqlConfiguration } from "@yielded/auth-persistence/Adapter";
+
+export const { makeSqlPasswordPersistence, passwordSqlKernel } = makePasswordKernel(
+  drizzleQueryOperations,
+  { completeProofPlanIn },
+);

package/src/drizzle/password-target.ts

@@ -0,0 +1,224 @@
+import {
+  coordinateCommit,
+  hasCommitScope,
+  LifecycleHooks,
+  type HookConfigurationError,
+} from "@yielded/auth/Hooks";
+import { PasswordUnavailable, PasswordPersistence } from "@yielded/auth/Password";
+/* oxlint-disable no-explicit-any -- public driver wrappers restore concrete Drizzle generics. */
+import { type Context, Effect, Layer } from "effect";
+import type * as SqlError from "effect/unstable/sql/SqlError";
+
+import {
+  makeSqlPasswordRegistrationAuthority,
+  type PasswordRegistrationAuthority,
+  type PasswordRegistrationConfiguration,
+} from "./password-registration";
+import {
+  makeSqlPasswordPersistence,
+  type PasswordSqlConfiguration,
+  type PasswordSqlDatabase,
+  type PasswordSqlQuery,
+} from "./password-sql";
+import type { ProofTargetConfiguration } from "./proof-target";
+import { sqlClientStandaloneGuard } from "./standalone-guard";
+
+export interface PasswordTargetConfiguration {
+  readonly mode: "interactive" | "synchronous";
+  readonly locking: boolean;
+  readonly standaloneGuard: Effect.Effect<void, PasswordUnavailable>;
+  readonly coordinatorGuard?: Effect.Effect<void, PasswordUnavailable>;
+  readonly insertIfAbsent: (
+    query: PasswordSqlQuery,
+    selfKey: string,
+    selfValue: unknown,
+  ) => PasswordSqlQuery;
+  readonly generatedSubjectRows: (query: PasswordSqlQuery) => PasswordSqlQuery;
+  readonly proof: ProofTargetConfiguration;
+}
+
+interface TransactionOwner<Transaction> {
+  readonly transaction: <A, E, R>(
+    body: (transaction: Transaction) => Effect.Effect<A, E, R>,
+  ) => Effect.Effect<A, E | SqlError.SqlError, R>;
+}
+
+export type PasswordCoordinatorError<E> =
+  | E
+  | PasswordUnavailable
+  | HookConfigurationError
+  | SqlError.SqlError;
+
+export const sqlClientPasswordStandaloneGuard = (
+  database: unknown,
+): Effect.Effect<void, PasswordUnavailable> =>
+  sqlClientStandaloneGuard(database, () => PasswordUnavailable.make({}));
+
+export const passwordOptions = (
+  configuration: PasswordTargetConfiguration,
+  proofMapping?: any,
+  coordinated = false,
+): PasswordSqlConfiguration => ({
+  mode: configuration.mode,
+  locking: configuration.locking,
+
+  standaloneGuard: !coordinated ? configuration.standaloneGuard : Effect.void,
+  insertIfAbsent: configuration.insertIfAbsent,
+  coordinated,
+  ...(proofMapping === undefined
+    ? {}
+    : {
+        proof: {
+          mapping: proofMapping,
+          configuration: {
+            mode: configuration.proof.mode,
+            locking: configuration.proof.locking,
+
+            standaloneGuard: Effect.void,
+
+            coordinated,
+            insertIfAbsent: configuration.proof.insertIfAbsent,
+          },
+        },
+      }),
+});
+
+const registrationOptions = (
+  configuration: PasswordTargetConfiguration,
+  coordinated = false,
+): PasswordRegistrationConfiguration => ({
+  mode: configuration.mode,
+  locking: configuration.locking,
+
+  standaloneGuard: !coordinated ? configuration.standaloneGuard : Effect.void,
+  generatedSubjectRows: configuration.generatedSubjectRows,
+  coordinated,
+});
+
+export const makeTargetPasswordPersistenceServices = (
+  database: any,
+  mapping: any,
+  configuration: PasswordTargetConfiguration,
+  proofMapping?: any,
+) =>
+  Effect.gen(function* () {
+    return {
+      passwordPersistence: yield* makeSqlPasswordPersistence(
+        database,
+        mapping,
+        passwordOptions(configuration, proofMapping),
+      ),
+    };
+  });
+
+export const makeTargetPasswordRegistrationServices = <Registration>(
+  database: any,
+  mapping: any,
+  configuration: PasswordTargetConfiguration,
+) =>
+  Effect.gen(function* () {
+    return {
+      registrationAuthority: yield* makeSqlPasswordRegistrationAuthority<Registration>(
+        database,
+        mapping,
+        registrationOptions(configuration),
+      ),
+    };
+  });
+
+/** Native transaction acquisition exposes SqlError; caller errors propagate unchanged. */
+export const coordinateTargetPasswordPersistence = <Transaction, A, E, R>(
+  database: TransactionOwner<Transaction>,
+  mapping: any,
+  configuration: PasswordTargetConfiguration,
+  proofMapping: any | undefined,
+  owner: (
+    transaction: Transaction,
+    services: { readonly passwordPersistence: PasswordPersistence["Service"] },
+  ) => Effect.Effect<A, E, R>,
+): Effect.Effect<A, PasswordCoordinatorError<E>, R | LifecycleHooks> =>
+  Effect.gen(function* (): Effect.fn.Return<A, PasswordCoordinatorError<E>, R | LifecycleHooks> {
+    const hooks = yield* LifecycleHooks;
+
+    if (yield* hasCommitScope) return yield* PasswordUnavailable.make({});
+    yield* configuration.coordinatorGuard ?? configuration.standaloneGuard;
+
+    const result = yield* coordinateCommit(
+      () =>
+        database.transaction((transaction) =>
+          Effect.gen(function* () {
+            return yield* owner(transaction, {
+              passwordPersistence: yield* makeSqlPasswordPersistence(
+                transaction as unknown as PasswordSqlDatabase,
+                mapping,
+                passwordOptions(configuration, proofMapping, true),
+              ),
+            });
+          }),
+        ),
+      { mode: configuration.mode },
+    ).pipe(Effect.provideService(LifecycleHooks, hooks));
+
+    return result.value;
+  });
+
+export const coordinateTargetPasswordRegistration = <Registration, Transaction, A, E, R>(
+  database: TransactionOwner<Transaction>,
+  mapping: any,
+  configuration: PasswordTargetConfiguration,
+  owner: (
+    transaction: Transaction,
+    services: {
+      readonly registrationAuthority: PasswordRegistrationAuthority<Registration>;
+    },
+  ) => Effect.Effect<A, E, R>,
+): Effect.Effect<A, PasswordCoordinatorError<E>, R | LifecycleHooks> =>
+  Effect.gen(function* (): Effect.fn.Return<A, PasswordCoordinatorError<E>, R | LifecycleHooks> {
+    const hooks = yield* LifecycleHooks;
+
+    if (yield* hasCommitScope) return yield* PasswordUnavailable.make({});
+    yield* configuration.coordinatorGuard ?? configuration.standaloneGuard;
+
+    const result = yield* coordinateCommit(
+      () =>
+        database.transaction((transaction) =>
+          Effect.gen(function* () {
+            return yield* owner(transaction, {
+              registrationAuthority: yield* makeSqlPasswordRegistrationAuthority<Registration>(
+                transaction as unknown as PasswordSqlDatabase,
+                mapping,
+                registrationOptions(configuration, true),
+              ),
+            });
+          }),
+        ),
+      { mode: configuration.mode },
+    ).pipe(Effect.provideService(LifecycleHooks, hooks));
+
+    return result.value;
+  });
+
+export const passwordPersistenceLayer = (
+  services: Effect.Effect<
+    { readonly passwordPersistence: PasswordPersistence["Service"] },
+    never,
+    LifecycleHooks
+  >,
+) =>
+  Layer.effect(
+    PasswordPersistence,
+    Effect.map(services, (value) => value.passwordPersistence),
+  );
+
+export const passwordRegistrationLayer = <Id, Registration>(
+  tag: Context.Key<Id, PasswordRegistrationAuthority<Registration>>,
+  services: Effect.Effect<
+    { readonly registrationAuthority: PasswordRegistrationAuthority<Registration> },
+    never,
+    LifecycleHooks
+  >,
+) =>
+  Layer.effect(
+    tag,
+    Effect.map(services, (value) => value.registrationAuthority),
+  );