@yielded/auth-persistence-drizzle 0.1.0-beta.14 → 0.1.0-beta.16

package/dist/drizzle/d1-sessions.d.mts

@@ -5,6 +5,7 @@ import { Database as Database$1 } from "./d1-database.mjs";
 import { D1BatchStatements } from "./D1BatchStatements.mjs";
 import { SuppliedService } from "./SuppliedService.mjs";
 import { D1PlanningDatabase } from "./d1-planning.mjs";
+import { NativeDatabase } from "@yielded/auth-persistence/Adapter";
 import { Context, DateTime, Effect, Schema } from "effect";
 import { HookConfigurationError, LifecycleHooks, PreparedCommit } from "@yielded/auth/Hooks";
 import { AuthenticationAuthority, AuthenticationEvidence, AuthenticationRequirement, AuthenticationRevision, PendingAuthentication, PendingAuthenticationInvalid, PendingConsumption, PrepareSessionCommit, SessionConflict, SessionInvalid, SessionRepository, SessionStepUpInvalid, SessionStepUpPersistence, SessionUnavailable, SignedSessionValidity, StaleAuthentication, StatefulSessionPersistence } from "@yielded/auth/Sessions";
@@ -29,17 +30,17 @@ export declare const makeD1AuthenticationAuthorityServices: <Claims, Subject ext
       readonly pending?: PendingConsumption;
     }, prepare: PrepareSessionCommit<void, A>) => Effect.Effect<PreparedCommit<A>, StaleAuthentication | PendingAuthenticationInvalid | SessionUnavailable>;
   };
-}, never, Database$1 | LifecycleHooks>;
+}, SessionUnavailable, Database$1 | LifecycleHooks>;
 export declare const makeD1PendingAuthenticationServices: <Claims, Subject extends AnySQLiteTable, Credential extends AnySQLiteTable, Pending extends AnySQLiteTable, Flow extends AnySQLiteTable, NativeSubjectId>(mapping: D1PendingAuthenticationMapping<Claims, Subject, Credential, Pending, Flow, NativeSubjectId>) => Effect.Effect<{
   pendingAuthentication: PendingAuthentication<Claims>;
-}, never, Database$1 | LifecycleHooks>;
+}, SessionUnavailable, Database$1 | LifecycleHooks>;
 export declare const makeD1StatefulSessionServices: <Claims, Subject extends AnySQLiteTable, Credential extends AnySQLiteTable, Session extends AnySQLiteTable, Flow extends AnySQLiteTable, Pending extends AnySQLiteTable, NativeSubjectId, NativeSessionId>(mapping: D1StatefulSessionMapping<Claims, Subject, Credential, Session, Flow, Pending, NativeSubjectId, NativeSessionId>) => Effect.Effect<{
   statefulSessionPersistence: StatefulSessionPersistence<Claims>;
   sessionRepository: SessionRepository;
-}, never, Database$1 | LifecycleHooks>;
+}, SessionUnavailable, Database$1 | LifecycleHooks>;
 export declare const makeD1SignedSessionValidityServices: <Subject extends AnySQLiteTable, Tombstone extends AnySQLiteTable, NativeSubjectId, NativeSessionId>(mapping: D1SignedSessionValidityMapping<Subject, Tombstone, NativeSubjectId, NativeSessionId>) => Effect.Effect<{
   signedSessionValidity: SignedSessionValidity;
-}, never, Database$1 | LifecycleHooks>;
+}, SessionUnavailable, Database$1 | LifecycleHooks>;
 export declare function coordinateD1AuthenticationAuthority<Claims, Subject extends AnySQLiteTable, Credential extends AnySQLiteTable, Flow extends AnySQLiteTable, Pending extends AnySQLiteTable, NativeSubjectId, A, E, R, DatabaseError, DatabaseRequirements>(acquire: Effect.Effect<Database, DatabaseError, DatabaseRequirements>, options: {
   readonly mapping: D1AuthenticationAuthorityMapping<Claims, Subject, Credential, Flow, Pending, NativeSubjectId>;
 }, body: Effect.Effect<A, E, R>): Effect.Effect<A, D1CoordinatorError<E> | DatabaseError, Exclude<R, AuthenticationAuthority | D1BatchStatements> | LifecycleHooks | DatabaseRequirements>;
@@ -58,7 +59,7 @@ export declare function coordinateD1SignedSessionValidity<TargetId, Subject exte
 }, body: Effect.Effect<A, E, R>): Effect.Effect<A, D1CoordinatorError<E> | DatabaseError, Exclude<R, TargetId | D1BatchStatements> | LifecycleHooks | DatabaseRequirements>;
 export declare const makeD1SessionStepUpServices: <Claims, Id, S extends AnySQLiteTable, C extends AnySQLiteTable, I extends AnySQLiteTable, Session extends AnySQLiteTable, T extends AnySQLiteTable, NativeId, NativeSessionId>(mapping: D1SessionStepUpMapping<NoInfer<Claims>, S, C, I, Session, T, NativeId, NativeSessionId>, target: Context.Service<Id, SessionStepUpPersistence<Claims>>) => Effect.Effect<{
   sessionStepUpPersistence: SessionStepUpPersistence<Claims>;
-}, never, Database$1 | LifecycleHooks>;
+}, SessionUnavailable, Database$1 | LifecycleHooks>;
 export declare function coordinateD1SessionStepUp<Claims, Id, S extends AnySQLiteTable, C extends AnySQLiteTable, I extends AnySQLiteTable, Session extends AnySQLiteTable, T extends AnySQLiteTable, NativeId, NativeSessionId, A, E, R, DatabaseError, DatabaseRequirements>(acquire: Effect.Effect<Database, DatabaseError, DatabaseRequirements>, options: {
   readonly mapping: D1SessionStepUpMapping<NoInfer<Claims>, S, C, I, Session, T, NativeId, NativeSessionId>;
   readonly target: SuppliedService<Id, SessionStepUpPersistence<Claims>>;

package/dist/drizzle/d1-sessions.mjs

@@ -1,9 +1,11 @@
 import { PersistenceMappingError as PersistenceMappingError$1, column, isMappedConstraintConflict, updateValues } from "./model.mjs";
 import { compactD1GeneratedStatement } from "./d1-generated-statement.mjs";
+import { validateDrizzleStorage } from "./storage-validation.mjs";
 import { Database } from "./d1-database.mjs";
 import { D1BatchStatements } from "./D1BatchStatements.mjs";
 import { CurrentD1PlanningDatabase, makeD1Owner } from "./d1-planning.mjs";
-import { decodeStepUpIntent, encodeStepUpIntent, stepUpIntentLive, validateStepUpPlan } from "@yielded/auth-persistence/Adapter";
+import { nativeDatabase } from "./native-database.mjs";
+import { NativeDatabase, decodeStepUpIntent, encodeStepUpIntent, stepUpIntentLive, validateStepUpPlan } from "@yielded/auth-persistence/Adapter";
 import { and, eq, getTableColumns, gt, inArray, not, or, sql } from "drizzle-orm";
 import { Cause, Context, Data, DateTime, Effect, Schema } from "effect";
 import { CurrentCommitJournal, LifecycleHooks, coordinateCommit, hasCommitScope } from "@yielded/auth/Hooks";
@@ -381,6 +383,7 @@ const makeD1StatefulSessions = (mapping) => {
 				if (input.pending === void 0 && (yield* hasActiveFlow(mapping, input.evidence.flowId))) return yield* SessionConflict.make({});
 				const nativeSessionId = yield* allocate(mapping.session.allocateId, mapping.session.allocateIdSync);
 				const sessionId = yield* mapping.sessionId.toSession(nativeSessionId);
+				if (sessionId === input.handoffSourceSessionId) return yield* SessionConflict.make({});
 				const version = yield* allocate(mapping.session.allocateVersion, mapping.session.allocateVersionSync);
 				const record = {
 					...input.session,
@@ -388,11 +391,12 @@ const makeD1StatefulSessions = (mapping) => {
 					version,
 					subjectId: input.evidence.revision.subjectId,
 					securityRevision: input.evidence.revision.securityRevision,
-					assurance: assessed.assurance,
+					assurance: input.handoffSourceSessionId === void 0 ? assessed.assurance : input.session.assurance,
 					provenance: yield* snapshotSessionAuthenticationProvenance({ evidence: input.evidence }),
 					issuedAt: DateTime.makeUnsafe(DateTime.toEpochMillis(input.session.issuedAt))
 				};
-				let condition = and(authorityCondition(mapping, nativeSubjectId, input.evidence), freshnessCondition(mapping, input.evidence, policy, true), sql`${DateTime.toEpochMillis(record.issuedAt)} <= ${mapping.d1.engineNowMillis}`, sql`${mapping.d1.engineNowMillis} < ${DateTime.toEpochMillis(record.expiresAt)}`, sql`${DateTime.toEpochMillis(record.expiresAt)} <= ${DateTime.toEpochMillis(record.absoluteExpiresAt)}`);
+				const commitCondition = and(authorityCondition(mapping, nativeSubjectId, input.evidence), freshnessCondition(mapping, input.evidence, policy, true), sql`${DateTime.toEpochMillis(record.issuedAt)} <= ${mapping.d1.engineNowMillis}`, sql`${mapping.d1.engineNowMillis} < ${DateTime.toEpochMillis(record.expiresAt)}`, sql`${DateTime.toEpochMillis(record.expiresAt)} <= ${DateTime.toEpochMillis(record.absoluteExpiresAt)}`);
+				let condition = commitCondition;
 				const statements = [];
 				if (input.pending === void 0) {
 					const f = flowColumns(mapping);
@@ -413,7 +417,7 @@ const makeD1StatefulSessions = (mapping) => {
 				statements.push(yield* statement(database.insert(mapping.session.table).values(mapping.session.encodeInsert(record, {
 					subjectId: nativeSubjectId,
 					sessionId: nativeSessionId
-				}))));
+				}))), yield* assertion(commitCondition));
 				return {
 					receipt: prepare(record, journal),
 					statements: [yield* assertion(condition), ...statements]
@@ -559,6 +563,7 @@ const makeD1SignedValidity = (mapping) => {
 const makeD1SessionServiceEffects = {
 	authority: (mapping) => Effect.gen(function* () {
 		const database = yield* CurrentD1PlanningDatabase;
+		yield* validateDrizzleStorage(mapping).pipe(Effect.mapError(unavailable));
 		const hooks = yield* LifecycleHooks;
 		const raw = makeD1AuthenticationAuthority(mapping);
 		const run = (effect) => Effect.gen(function* () {
@@ -573,6 +578,7 @@ const makeD1SessionServiceEffects = {
 	}),
 	pending: (mapping) => Effect.gen(function* () {
 		const database = yield* CurrentD1PlanningDatabase;
+		yield* validateDrizzleStorage(mapping).pipe(Effect.mapError(unavailable));
 		const hooks = yield* LifecycleHooks;
 		const raw = makeD1PendingAuthentication(mapping);
 		const run = (effect) => Effect.gen(function* () {
@@ -588,6 +594,7 @@ const makeD1SessionServiceEffects = {
 	}),
 	stateful: (mapping) => Effect.gen(function* () {
 		const database = yield* CurrentD1PlanningDatabase;
+		yield* validateDrizzleStorage(mapping).pipe(Effect.mapError(unavailable));
 		const hooks = yield* LifecycleHooks;
 		const raw = makeD1StatefulSessions(mapping);
 		const run = (effect) => Effect.gen(function* () {
@@ -608,6 +615,7 @@ const makeD1SessionServiceEffects = {
 	}),
 	validity: (mapping) => Effect.gen(function* () {
 		const database = yield* CurrentD1PlanningDatabase;
+		yield* validateDrizzleStorage(mapping).pipe(Effect.mapError(unavailable));
 		const hooks = yield* LifecycleHooks;
 		const raw = makeD1SignedValidity(mapping);
 		const run = (effect) => Effect.gen(function* () {
@@ -631,8 +639,9 @@ const makeD1SessionServiceEffects = {
 * Caller failures remain in the error channel. D1 batch/transport failures that
 * cannot be tied to this adapter's reserved guard become `SessionUnavailable`.
 */
-const coordinateD1SessionBatch = (database, make, owner) => Effect.gen(function* () {
+const coordinateD1SessionBatch = (database, mapping, make, owner) => Effect.gen(function* () {
 	if (yield* hasCommitScope) return yield* unavailable();
+	yield* validateDrizzleStorage(mapping).pipe(Effect.mapError(unavailable));
 	return (yield* coordinateCommit(() => Effect.gen(function* () {
 		const statements = [];
 		let mutation;
@@ -662,12 +671,12 @@ const coordinateD1SessionBatch = (database, make, owner) => Effect.gen(function*
 		return value;
 	}), { mode: "batch" }).pipe(Effect.catchCause(recoverCoordinatedD1BatchCause), Effect.provideService(CurrentD1PlanningDatabase, database))).value;
 });
-const makeD1AuthenticationAuthorityServices = (mapping) => makeD1SessionServiceEffects.authority(mapping).pipe(Effect.provideServiceEffect(CurrentD1PlanningDatabase, Database));
-const makeD1PendingAuthenticationServices = (mapping) => makeD1SessionServiceEffects.pending(mapping).pipe(Effect.provideServiceEffect(CurrentD1PlanningDatabase, Database));
-const makeD1StatefulSessionServices = (mapping) => makeD1SessionServiceEffects.stateful(mapping).pipe(Effect.provideServiceEffect(CurrentD1PlanningDatabase, Database));
-const makeD1SignedSessionValidityServices = (mapping) => makeD1SessionServiceEffects.validity(mapping).pipe(Effect.provideServiceEffect(CurrentD1PlanningDatabase, Database));
+const makeD1AuthenticationAuthorityServices = (mapping) => makeD1SessionServiceEffects.authority(mapping).pipe(Effect.provideServiceEffect(CurrentD1PlanningDatabase, Database), Effect.provideServiceEffect(NativeDatabase, nativeDatabase(Database)));
+const makeD1PendingAuthenticationServices = (mapping) => makeD1SessionServiceEffects.pending(mapping).pipe(Effect.provideServiceEffect(CurrentD1PlanningDatabase, Database), Effect.provideServiceEffect(NativeDatabase, nativeDatabase(Database)));
+const makeD1StatefulSessionServices = (mapping) => makeD1SessionServiceEffects.stateful(mapping).pipe(Effect.provideServiceEffect(CurrentD1PlanningDatabase, Database), Effect.provideServiceEffect(NativeDatabase, nativeDatabase(Database)));
+const makeD1SignedSessionValidityServices = (mapping) => makeD1SessionServiceEffects.validity(mapping).pipe(Effect.provideServiceEffect(CurrentD1PlanningDatabase, Database), Effect.provideServiceEffect(NativeDatabase, nativeDatabase(Database)));
 function coordinateD1AuthenticationAuthority(acquire, options, body) {
-	return Effect.flatMap(acquire, (database) => coordinateD1SessionBatch(database, (batch) => Effect.gen(function* () {
+	return Effect.flatMap(nativeDatabase(acquire), (database) => coordinateD1SessionBatch(database, options.mapping, (batch) => Effect.gen(function* () {
 		const hooks = yield* LifecycleHooks;
 		const raw = makeD1AuthenticationAuthority(options.mapping);
 		const run = (effect) => batch.owner.run(effect.pipe(Effect.provideService(CurrentD1PlanningDatabase, database), Effect.provideService(LifecycleHooks, hooks), Effect.provideService(CurrentD1SessionBatch, batch)));
@@ -679,10 +688,10 @@ function coordinateD1AuthenticationAuthority(acquire, options, body) {
 	}), (ownedServices, batch) => {
 		const provided = Context.make(AuthenticationAuthority, ownedServices.authenticationAuthority).pipe(Context.add(D1BatchStatements, batch.owner.collector));
 		return Effect.provideContext(body, provided);
-	}));
+	}).pipe(Effect.provideService(NativeDatabase, database)));
 }
 function coordinateD1PendingAuthentication(acquire, options, body) {
-	return Effect.flatMap(acquire, (database) => coordinateD1SessionBatch(database, (batch) => Effect.gen(function* () {
+	return Effect.flatMap(nativeDatabase(acquire), (database) => coordinateD1SessionBatch(database, options.mapping, (batch) => Effect.gen(function* () {
 		const hooks = yield* LifecycleHooks;
 		const raw = makeD1PendingAuthentication(options.mapping);
 		const run = (effect) => batch.owner.run(effect.pipe(Effect.provideService(CurrentD1PlanningDatabase, database), Effect.provideService(LifecycleHooks, hooks), Effect.provideService(CurrentD1SessionBatch, batch)));
@@ -695,10 +704,10 @@ function coordinateD1PendingAuthentication(acquire, options, body) {
 	}), (ownedServices, batch) => {
 		const provided = Context.make(options.target, ownedServices.pendingAuthentication).pipe(Context.add(D1BatchStatements, batch.owner.collector));
 		return Effect.provideContext(body, provided);
-	}));
+	}).pipe(Effect.provideService(NativeDatabase, database)));
 }
 function coordinateD1StatefulSessions(acquire, options, body) {
-	return Effect.flatMap(acquire, (database) => coordinateD1SessionBatch(database, (batch) => Effect.gen(function* () {
+	return Effect.flatMap(nativeDatabase(acquire), (database) => coordinateD1SessionBatch(database, options.mapping, (batch) => Effect.gen(function* () {
 		const hooks = yield* LifecycleHooks;
 		const raw = makeD1StatefulSessions(options.mapping);
 		const run = (effect) => batch.owner.run(effect.pipe(Effect.provideService(CurrentD1PlanningDatabase, database), Effect.provideService(LifecycleHooks, hooks), Effect.provideService(CurrentD1SessionBatch, batch)));
@@ -716,10 +725,10 @@ function coordinateD1StatefulSessions(acquire, options, body) {
 	}), (ownedServices, batch) => {
 		const provided = Context.make(options.persistence, ownedServices.statefulSessionPersistence).pipe(Context.add(options.repository, ownedServices.sessionRepository), Context.add(D1BatchStatements, batch.owner.collector));
 		return Effect.provideContext(body, provided);
-	}));
+	}).pipe(Effect.provideService(NativeDatabase, database)));
 }
 function coordinateD1SignedSessionValidity(acquire, options, body) {
-	return Effect.flatMap(acquire, (database) => coordinateD1SessionBatch(database, (batch) => Effect.gen(function* () {
+	return Effect.flatMap(nativeDatabase(acquire), (database) => coordinateD1SessionBatch(database, options.mapping, (batch) => Effect.gen(function* () {
 		const hooks = yield* LifecycleHooks;
 		const raw = makeD1SignedValidity(options.mapping);
 		const run = (effect) => batch.owner.run(effect.pipe(Effect.provideService(CurrentD1PlanningDatabase, database), Effect.provideService(LifecycleHooks, hooks), Effect.provideService(CurrentD1SessionBatch, batch)));
@@ -731,7 +740,7 @@ function coordinateD1SignedSessionValidity(acquire, options, body) {
 	}), (ownedServices, batch) => {
 		const provided = Context.make(options.target, ownedServices.signedSessionValidity).pipe(Context.add(D1BatchStatements, batch.owner.collector));
 		return Effect.provideContext(body, provided);
-	}));
+	}).pipe(Effect.provideService(NativeDatabase, database)));
 }
 const stepUpColumns = (mapping) => Object.fromEntries([
 	"digest",
@@ -934,6 +943,7 @@ const makeD1SessionStepUp = (mapping) => {
 };
 const makeD1SessionStepUpServices = Effect.fnUntraced(function* (mapping, target) {
 	const database = yield* Database;
+	yield* validateDrizzleStorage(mapping).pipe(Effect.provideServiceEffect(NativeDatabase, nativeDatabase(Database)), Effect.mapError(unavailable));
 	const hooks = yield* LifecycleHooks;
 	const raw = makeD1SessionStepUp(mapping);
 	const run = (effect) => Effect.gen(function* () {
@@ -949,7 +959,7 @@ const makeD1SessionStepUpServices = Effect.fnUntraced(function* (mapping, target
 	}) };
 });
 function coordinateD1SessionStepUp(acquire, options, body) {
-	return Effect.flatMap(acquire, (database) => coordinateD1SessionBatch(database, (batch) => Effect.gen(function* () {
+	return Effect.flatMap(nativeDatabase(acquire), (database) => coordinateD1SessionBatch(database, options.mapping, (batch) => Effect.gen(function* () {
 		const hooks = yield* LifecycleHooks;
 		const raw = makeD1SessionStepUp(options.mapping);
 		const run = (effect) => batch.owner.run(effect.pipe(Effect.provideService(CurrentD1PlanningDatabase, database), Effect.provideService(LifecycleHooks, hooks), Effect.provideService(CurrentD1SessionBatch, batch)));
@@ -963,7 +973,7 @@ function coordinateD1SessionStepUp(acquire, options, body) {
 	}), (ownedServices, batch) => {
 		const provided = Context.make(options.target, ownedServices.sessionStepUpPersistence).pipe(Context.add(D1BatchStatements, batch.owner.collector));
 		return Effect.provideContext(body, provided);
-	}));
+	}).pipe(Effect.provideService(NativeDatabase, database)));
 }
 //#endregion
 export { coordinateD1AuthenticationAuthority, coordinateD1PendingAuthentication, coordinateD1SessionBatch, coordinateD1SessionStepUp, coordinateD1SignedSessionValidity, coordinateD1StatefulSessions, makeD1AuthenticationAuthority, makeD1AuthenticationAuthorityServices, makeD1PendingAuthentication, makeD1PendingAuthenticationServices, makeD1SessionServiceEffects, makeD1SessionStepUp, makeD1SessionStepUpServices, makeD1SignedSessionValidityServices, makeD1SignedValidity, makeD1StatefulSessionServices, makeD1StatefulSessions };