@yielded/auth-persistence-drizzle 0.1.0-beta.22 → 0.1.0-beta.24

package/src/drizzle/d1-sessions.ts

@@ -17,6 +17,7 @@ import { reportPersistenceFailure } from "@yielded/auth/Persistence";
 import type { SubjectId, TokenDigest } from "@yielded/auth/Schema";
 import {
   assessAuthentication,
+  AuthenticationCapture,
   snapshotSessionAuthenticationProvenance,
   AuthenticationAuthority,
   PendingAuthenticationInvalid,
@@ -557,13 +558,18 @@ const capture = Effect.fn("DrizzleD1Session.capture")(function* (
   subjectId: SubjectId,
   credentialIds: ReadonlyArray<string>,
 ): Effect.fn.Return<
-  AuthenticationRevision,
+  AuthenticationCapture,
   StaleAuthentication | D1AdapterFailure,
   CurrentD1PlanningDatabase
 > {
   const details = yield* captureDetails(mapping, subjectId, credentialIds);
 
-  return details.revision;
+  const requirement = yield* mapping.subject.decodeRequirement(details.subject);
+
+  return yield* Schema.decodeEffect(AuthenticationCapture)({
+    revision: details.revision,
+    requirement,
+  });
 });
 
 const requirement = Effect.fn("DrizzleD1Session.requirement")(function* (
@@ -1122,7 +1128,11 @@ export const makeD1StatefulSessions = <Claims>(
             input.evidence.revision.subjectId,
           );
 
-          if (input.pending === undefined && (yield* hasActiveFlow(mapping, input.evidence.flowId)))
+          if (
+            input.pending === undefined &&
+            (input.fresh !== true || input.handoffSourceSessionId !== undefined) &&
+            (yield* hasActiveFlow(mapping, input.evidence.flowId))
+          )
             return yield* SessionConflict.make({});
 
           const nativeSessionId = yield* allocate(
@@ -1169,7 +1179,10 @@ export const makeD1StatefulSessions = <Claims>(
           let condition = commitCondition;
           const statements: Statement<any>[] = [];
 
-          if (input.pending === undefined) {
+          if (
+            input.pending === undefined &&
+            (input.fresh !== true || input.handoffSourceSessionId !== undefined)
+          ) {
             const f = flowColumns(mapping);
 
             condition = and(
@@ -1205,7 +1218,7 @@ export const makeD1StatefulSessions = <Claims>(
                 ),
               ),
             );
-          } else {
+          } else if (input.pending !== undefined) {
             if (mapping.pending === undefined) return yield* invalidPending();
             const stored = yield* readPending(mapping, input.pending.digest);
 
@@ -1244,7 +1257,9 @@ export const makeD1StatefulSessions = <Claims>(
           CurrentD1PlanningDatabase
         >(() =>
           input.pending === undefined
-            ? recoverFlowOrStale(mapping, input.evidence.flowId)
+            ? input.fresh === true && input.handoffSourceSessionId === undefined
+              ? Effect.fail(stale())
+              : recoverFlowOrStale(mapping, input.evidence.flowId)
             : recoverPendingOrStale(mapping, input.pending, input.evidence.revision.subjectId),
         ),
       ),

package/src/drizzle/mysql-password-prepared.ts

@@ -29,9 +29,6 @@ export const makeMySqlPasswordPreparedPersistenceServices = <
   I extends AnyMySqlTable,
   C extends AnyMySqlTable,
   AC extends AnyMySqlTable,
-  A extends AnyMySqlTable,
-  RS extends AnyMySqlTable,
-  CE extends AnyMySqlTable,
   M extends AnyMySqlTable,
   T extends AnyMySqlTable,
   B extends AnyMySqlTable,
@@ -44,7 +41,7 @@ export const makeMySqlPasswordPreparedPersistenceServices = <
   PCr extends AnyMySqlTable = AnyMySqlTable,
   PNativeId = unknown,
 >(
-  mapping: PasswordPreparedPersistenceMapping<S, I, C, AC, A, RS, CE, M, T, B, NativeId>,
+  mapping: PasswordPreparedPersistenceMapping<S, I, C, AC, M, T, B, NativeId>,
   proofMapping?: PasswordPreparedProofMapping<PS, PC, PM, PSub, PI, PCr, PNativeId>,
 ) =>
   Effect.flatMap(
@@ -63,9 +60,6 @@ export function coordinateMySqlPasswordPreparedPersistence<
   I extends AnyMySqlTable,
   C extends AnyMySqlTable,
   AC extends AnyMySqlTable,
-  A extends AnyMySqlTable,
-  RS extends AnyMySqlTable,
-  CE extends AnyMySqlTable,
   M extends AnyMySqlTable,
   T extends AnyMySqlTable,
   B extends AnyMySqlTable,
@@ -85,7 +79,7 @@ export function coordinateMySqlPasswordPreparedPersistence<
 >(
   acquire: Effect.Effect<D, DatabaseError, DatabaseRequirements>,
   options: {
-    readonly mapping: PasswordPreparedPersistenceMapping<S, I, C, AC, A, RS, CE, M, T, B, NativeId>;
+    readonly mapping: PasswordPreparedPersistenceMapping<S, I, C, AC, M, T, B, NativeId>;
     readonly proofMapping?:
       | PasswordPreparedProofMapping<PS, PC, PM, PSub, PI, PCr, PNativeId>
       | undefined;
@@ -106,9 +100,6 @@ export function coordinateMySqlPasswordPreparedPersistence<
   I extends AnyMySqlTable,
   C extends AnyMySqlTable,
   AC extends AnyMySqlTable,
-  A extends AnyMySqlTable,
-  RS extends AnyMySqlTable,
-  CE extends AnyMySqlTable,
   M extends AnyMySqlTable,
   T extends AnyMySqlTable,
   B extends AnyMySqlTable,
@@ -130,7 +121,7 @@ export function coordinateMySqlPasswordPreparedPersistence<
 >(
   acquire: Effect.Effect<D, DatabaseError, DatabaseRequirements>,
   options: {
-    readonly mapping: PasswordPreparedPersistenceMapping<S, I, C, AC, A, RS, CE, M, T, B, NativeId>;
+    readonly mapping: PasswordPreparedPersistenceMapping<S, I, C, AC, M, T, B, NativeId>;
     readonly proofMapping?:
       | PasswordPreparedProofMapping<PS, PC, PM, PSub, PI, PCr, PNativeId>
       | undefined;
@@ -151,9 +142,6 @@ export function coordinateMySqlPasswordPreparedPersistence<
   I extends AnyMySqlTable,
   C extends AnyMySqlTable,
   AC extends AnyMySqlTable,
-  A extends AnyMySqlTable,
-  RS extends AnyMySqlTable,
-  CE extends AnyMySqlTable,
   M extends AnyMySqlTable,
   T extends AnyMySqlTable,
   B extends AnyMySqlTable,
@@ -175,7 +163,7 @@ export function coordinateMySqlPasswordPreparedPersistence<
 >(
   acquire: Effect.Effect<D, DatabaseError, DatabaseRequirements>,
   options: {
-    readonly mapping: PasswordPreparedPersistenceMapping<S, I, C, AC, A, RS, CE, M, T, B, NativeId>;
+    readonly mapping: PasswordPreparedPersistenceMapping<S, I, C, AC, M, T, B, NativeId>;
     readonly proofMapping?:
       | PasswordPreparedProofMapping<PS, PC, PM, PSub, PI, PCr, PNativeId>
       | undefined;

package/src/drizzle/mysql-passwords.ts

@@ -55,25 +55,19 @@ type Mapping<
   I extends AnyMySqlTable,
   C extends AnyMySqlTable,
   AC extends AnyMySqlTable,
-  A extends AnyMySqlTable,
-  RS extends AnyMySqlTable,
-  CE extends AnyMySqlTable,
   M extends AnyMySqlTable,
   NativeId,
-> = PasswordPersistenceMapping<S, I, C, AC, A, RS, CE, M, NativeId>;
+> = PasswordPersistenceMapping<S, I, C, AC, M, NativeId>;
 
 export const makeMysqlPasswordPersistenceServices = <
   S extends AnyMySqlTable,
   I extends AnyMySqlTable,
   C extends AnyMySqlTable,
   AC extends AnyMySqlTable,
-  A extends AnyMySqlTable,
-  RS extends AnyMySqlTable,
-  CE extends AnyMySqlTable,
   M extends AnyMySqlTable,
   NativeId,
 >(
-  mapping: Mapping<S, I, C, AC, A, RS, CE, M, NativeId>,
+  mapping: Mapping<S, I, C, AC, M, NativeId>,
   proofMapping?: ProofPersistenceMapping<
     any,
     any,
@@ -103,9 +97,6 @@ export function coordinateMysqlPasswordPersistence<
   I extends AnyMySqlTable,
   C extends AnyMySqlTable,
   AC extends AnyMySqlTable,
-  A extends AnyMySqlTable,
-  RS extends AnyMySqlTable,
-  CE extends AnyMySqlTable,
   M extends AnyMySqlTable,
   NativeId,
   PM extends
@@ -119,7 +110,7 @@ export function coordinateMysqlPasswordPersistence<
 >(
   acquire: Effect.Effect<D, DatabaseError, DatabaseRequirements>,
   options: {
-    readonly mapping: Mapping<S, I, C, AC, A, RS, CE, M, NativeId>;
+    readonly mapping: Mapping<S, I, C, AC, M, NativeId>;
     readonly proofMapping?: PM;
     readonly transaction?: never;
   },
@@ -136,9 +127,6 @@ export function coordinateMysqlPasswordPersistence<
   I extends AnyMySqlTable,
   C extends AnyMySqlTable,
   AC extends AnyMySqlTable,
-  A extends AnyMySqlTable,
-  RS extends AnyMySqlTable,
-  CE extends AnyMySqlTable,
   M extends AnyMySqlTable,
   NativeId,
   PM extends
@@ -154,7 +142,7 @@ export function coordinateMysqlPasswordPersistence<
 >(
   acquire: Effect.Effect<D, DatabaseError, DatabaseRequirements>,
   options: {
-    readonly mapping: Mapping<S, I, C, AC, A, RS, CE, M, NativeId>;
+    readonly mapping: Mapping<S, I, C, AC, M, NativeId>;
     readonly proofMapping?: PM;
     readonly transaction: SuppliedService<TxId, NoInfer<TransactionOf<D>>, TxShape>;
   },
@@ -171,9 +159,6 @@ export function coordinateMysqlPasswordPersistence<
   I extends AnyMySqlTable,
   C extends AnyMySqlTable,
   AC extends AnyMySqlTable,
-  A extends AnyMySqlTable,
-  RS extends AnyMySqlTable,
-  CE extends AnyMySqlTable,
   M extends AnyMySqlTable,
   NativeId,
   PM extends
@@ -189,7 +174,7 @@ export function coordinateMysqlPasswordPersistence<
 >(
   acquire: Effect.Effect<D, DatabaseError, DatabaseRequirements>,
   options: {
-    readonly mapping: Mapping<S, I, C, AC, A, RS, CE, M, NativeId>;
+    readonly mapping: Mapping<S, I, C, AC, M, NativeId>;
     readonly proofMapping?: PM;
     readonly transaction?: SuppliedService<TxId, NoInfer<TransactionOf<D>>, TxShape>;
   },

package/src/drizzle/native-sql-table.ts

@@ -0,0 +1,259 @@
+import {
+  PersistenceMappingError,
+  makeNativeSqlTables,
+  nativeSqlAlias,
+  type NativeSqlTables,
+  type SqlTable,
+} from "@yielded/auth-persistence/Adapter";
+import {
+  getTableColumns,
+  getTableName,
+  is,
+  Param,
+  Placeholder,
+  type SQL,
+  Table,
+  sql,
+  type BuildQueryConfig,
+  type SQLWrapper,
+} from "drizzle-orm";
+import { getTableConfig as getMysqlTableConfig, MySqlTable } from "drizzle-orm/mysql-core";
+import { getTableConfig as getPgTableConfig, PgTable } from "drizzle-orm/pg-core";
+import { Predicate } from "effect";
+import type { SqlClient } from "effect/sql/SqlClient";
+import * as Statement from "effect/sql/Statement";
+
+type CapturedDialect = Pick<BuildQueryConfig, "escapeName" | "escapeString" | "codecs">;
+
+/** Foreign compiler boundary only: builders are used to materialize SQL, never
+ * executed. The select builder exposes the original dialect even through the
+ * Durable Object database projection, which retains bound query methods. */
+interface CapturedDatabase {
+  readonly select: () => { readonly dialect: CapturedDialect };
+  readonly insert: (table: Table) => {
+    readonly values: (values: Record<string, unknown>) => SQLWrapper;
+  };
+  readonly update: (table: Table) => {
+    readonly set: (values: Record<string, unknown>) => SQLWrapper;
+  };
+}
+
+const invalid = (cause: string): never => {
+  throw PersistenceMappingError.make({ operation: "mapping", cause });
+};
+
+const capture = (
+  database: object,
+): { readonly database: CapturedDatabase; readonly dialect: CapturedDialect } => {
+  if (
+    !Predicate.hasProperty(database, "select") ||
+    typeof database.select !== "function" ||
+    !Predicate.hasProperty(database, "insert") ||
+    typeof database.insert !== "function" ||
+    !Predicate.hasProperty(database, "update") ||
+    typeof database.update !== "function"
+  )
+    return invalid("Expected a captured Drizzle database");
+
+  const selection: unknown = database.select();
+
+  if (!Predicate.hasProperty(selection, "dialect"))
+    return invalid("Expected a captured Drizzle dialect");
+  const dialect = selection.dialect;
+
+  if (
+    !Predicate.hasProperty(dialect, "escapeName") ||
+    typeof dialect.escapeName !== "function" ||
+    !Predicate.hasProperty(dialect, "escapeString") ||
+    typeof dialect.escapeString !== "function"
+  )
+    return invalid("Expected Drizzle dialect escaping methods");
+
+  if (
+    Predicate.hasProperty(dialect, "codecs") &&
+    dialect.codecs !== undefined &&
+    (!Predicate.hasProperty(dialect.codecs, "apply") || typeof dialect.codecs.apply !== "function")
+  )
+    return invalid("Expected Drizzle dialect codecs");
+
+  // Drizzle's private dialect and generic query builders are erased only here.
+  return { database: database as CapturedDatabase, dialect: dialect as CapturedDialect };
+};
+
+const compileWith =
+  (dialect: CapturedDialect) =>
+  (expression: SQL): Statement.Fragment => {
+    const slots: string[] = [];
+
+    const query = expression.toQuery({
+      escapeName: (name) => {
+        if (name.includes("\0")) return invalid("NUL in SQL identifier");
+
+        return dialect.escapeName(name);
+      },
+      escapeString: (value) => {
+        if (value.includes("\0")) return invalid("NUL in SQL literal");
+
+        return dialect.escapeString(value);
+      },
+      escapeParam: (index) => {
+        if (index !== slots.length) return invalid("Invalid Drizzle parameter order");
+        const slot = `yielded_parameter_${index}`;
+
+        slots.push(slot);
+
+        return `\0${slot}\0`;
+      },
+      ...(dialect.codecs === undefined ? {} : { codecs: dialect.codecs }),
+    });
+
+    // Only compiler-emitted slots are translated. Native Statement parameters
+    // receive their final positions when composed; SQL literals containing $1 or
+    // ? are never inspected or rewritten. NUL is reserved for this compilation.
+    const parts = query.sql.split("\0");
+
+    if (parts.length !== slots.length * 2 + 1 || query.params.length !== slots.length)
+      return invalid("NUL or parameter marker collision in Drizzle SQL");
+
+    const segments: Statement.Segment[] = [];
+    const consumed = new Set<number>();
+
+    for (let offset = 0; offset < parts.length; offset += 2) {
+      segments.push(Statement.literal(parts[offset]));
+      if (offset + 1 === parts.length) break;
+      const index = slots.indexOf(parts[offset + 1]);
+
+      if (index < 0 || consumed.has(index))
+        return invalid("NUL or parameter marker collision in Drizzle SQL");
+      consumed.add(index);
+      const value: unknown = query.params[index];
+
+      if (is(value, Placeholder) || is(value, Param)) return invalid("Unbound Drizzle placeholder");
+      if (Statement.isFragment(value)) segments.push(...value.segments);
+      else segments.push(Statement.parameter(value));
+    }
+
+    return Statement.fragment(segments);
+  };
+
+/** Preserve native Statement expressions in writes without applying a column
+ * codec to them. Ordinary values still pass through Drizzle's own builders. */
+const writeValues = (values: Readonly<Record<string, unknown>>) =>
+  Object.fromEntries(
+    Object.entries(values).map(([key, value]) => [
+      key,
+      Statement.isFragment(value) ? sql`${sql.param(value)}` : value,
+    ]),
+  );
+
+/** Capture the root database's compiler, not a later transaction object's
+ * client. Call insert/update inside the operation to materialize hooks once. */
+export const makeDrizzleSqlTables = (
+  client: SqlClient,
+  capturedDatabase: object,
+): NativeSqlTables => {
+  const { database, dialect } = capture(capturedDatabase);
+  const compile = compileWith(dialect);
+
+  return makeNativeSqlTables(client, (_client, physical): SqlTable => {
+    if (!is(physical, Table)) return invalid("Expected a Drizzle table");
+    const columns = getTableColumns(physical);
+    const entries = Object.entries(columns);
+
+    const schema = is(physical, PgTable)
+      ? getPgTableConfig(physical).schema
+      : is(physical, MySqlTable)
+        ? getMysqlTableConfig(physical).schema
+        : undefined;
+
+    const table = { name: getTableName(physical), ...(schema === undefined ? {} : { schema }) };
+
+    const getColumn = (key: string) => {
+      const column = Object.hasOwn(columns, key) ? columns[key] : undefined;
+
+      if (column === undefined) return invalid("Missing Drizzle column");
+
+      return column;
+    };
+
+    const bind = (alias?: string): SqlTable => {
+      const reference = (key: string) => {
+        const column = getColumn(key);
+
+        return alias === undefined
+          ? sql`${column}`
+          : sql`${sql.identifier(alias)}.${sql.identifier(column.name)}`;
+      };
+
+      return {
+        name: compile(
+          alias === undefined ? sql`${physical}` : sql`${physical} AS ${sql.identifier(alias)}`,
+        ),
+        as: bind,
+        column: (key) => compile(reference(key)),
+        unencodedTextColumn: (key) => {
+          const column = getColumn(key);
+
+          return ["PgText", "PgVarchar", "SQLiteText", "MySqlText", "MySqlVarChar"].includes(
+            column.columnType,
+          ) &&
+            Predicate.hasProperty(column.mapToDriverValue, "isNoop") &&
+            column.mapToDriverValue.isNoop === true &&
+            Predicate.hasProperty(column.mapFromDriverValue, "isNoop") &&
+            column.mapFromDriverValue.isNoop === true &&
+            (dialect.codecs === undefined ||
+              (Predicate.hasProperty(dialect.codecs, "get") &&
+                typeof dialect.codecs.get === "function" &&
+                (["cast", "normalize", "castParam", "normalizeParam"] as const).every(
+                  (kind) => dialect.codecs?.get(column, kind) === undefined,
+                )))
+            ? { table, name: column.name }
+            : undefined;
+        },
+        fields: (prefix) =>
+          compile(
+            sql.join(
+              entries.map(([key, column], index) => {
+                const selection =
+                  dialect.codecs === undefined
+                    ? reference(key)
+                    : dialect.codecs.apply(column, "cast", reference(key));
+
+                return sql`${selection} as ${sql.identifier(nativeSqlAlias(prefix, index))}`;
+              }),
+              sql`, `,
+            ),
+          ),
+        decode: (row, prefix) =>
+          Object.fromEntries(
+            entries.map(([key, column], index) => {
+              const alias = nativeSqlAlias(prefix, index);
+
+              if (!Object.hasOwn(row, alias)) return invalid("Missing SQL projection field");
+              const value = row[alias];
+
+              return [
+                key,
+                value === null
+                  ? null
+                  : column.mapFromDriverValue(
+                      dialect.codecs === undefined
+                        ? value
+                        : dialect.codecs.apply(column, "normalize", value),
+                    ),
+              ];
+            }),
+          ),
+        value: (key, value) => {
+          const column = getColumn(key);
+
+          return Statement.isFragment(value) ? value : compile(sql`${sql.param(value, column)}`);
+        },
+        insert: (values) => compile(database.insert(physical).values(writeValues(values)).getSQL()),
+        update: (values) => compile(database.update(physical).set(writeValues(values)).getSQL()),
+      };
+    };
+
+    return bind();
+  });
+};