@yielded/auth-persistence-drizzle 0.1.0-beta.23 → 0.1.0-beta.25

package/dist/drizzle/d1-phone.d.mts

@@ -7,8 +7,8 @@ import { AnyRelations } from "drizzle-orm";
 import { Crypto, Effect } from "effect";
 import { LifecycleHooks } from "@yielded/auth/Hooks";
 import { PhoneAdmission, PhonePersistence, PhoneSignInTargets } from "@yielded/auth/PhoneOtp";
-import { EffectSQLiteD1Database } from "drizzle-orm/effect-d1";
 import { AnySQLiteTable } from "drizzle-orm/sqlite-core";
+import { EffectSQLiteD1Database } from "drizzle-orm/effect-d1";
 import { D1Client } from "@effect/sql-d1/D1Client";
 //#region src/drizzle/d1-phone.d.ts
 type Database = EffectSQLiteD1Database<AnyRelations> & {

package/dist/drizzle/d1-proofs.d.mts

@@ -8,8 +8,8 @@ import { Effect } from "effect";
 import { CurrentCommitJournal, HookConfigurationError, LifecycleHooks, PreparedCommit } from "@yielded/auth/Hooks";
 import { Statement } from "effect/sql/Statement";
 import { PrepareProofCommit, ProofAttemptDecision, ProofBinding, ProofCleanupResult, ProofCompletionDecision, ProofCompletionPlan, ProofDeliveryClaim, ProofDeliveryOutcome, ProofPersistence, ProofPolicy, ProofRequestConflict, ProofUnavailable, ProofVersion } from "@yielded/auth/Proofs";
-import { EffectSQLiteD1Database } from "drizzle-orm/effect-d1";
 import { AnySQLiteTable } from "drizzle-orm/sqlite-core";
+import { EffectSQLiteD1Database } from "drizzle-orm/effect-d1";
 import "drizzle-orm/effect-core";
 import { D1Client } from "@effect/sql-d1/D1Client";
 //#region src/drizzle/d1-proofs.d.ts

package/dist/drizzle/d1-sessions.d.mts

@@ -8,7 +8,7 @@ import { D1PlanningDatabase } from "./d1-planning.mjs";
 import { NativeDatabase } from "@yielded/auth-persistence/Adapter";
 import { Context, DateTime, Effect, Schema } from "effect";
 import { HookConfigurationError, LifecycleHooks, PreparedCommit } from "@yielded/auth/Hooks";
-import { AuthenticationAuthority, AuthenticationEvidence, AuthenticationRequirement, AuthenticationRevision, PendingAuthentication, PendingAuthenticationInvalid, PendingConsumption, PrepareSessionCommit, SessionConflict, SessionInvalid, SessionRepository, SessionStepUpInvalid, SessionStepUpPersistence, SessionUnavailable, SignedSessionValidity, StaleAuthentication, StatefulSessionPersistence } from "@yielded/auth/Sessions";
+import { AuthenticationAuthority, AuthenticationCapture, AuthenticationEvidence, AuthenticationRequirement, PendingAuthentication, PendingAuthenticationInvalid, PendingConsumption, PrepareSessionCommit, SessionConflict, SessionInvalid, SessionRepository, SessionStepUpInvalid, SessionStepUpPersistence, SessionUnavailable, SignedSessionValidity, StaleAuthentication, StatefulSessionPersistence } from "@yielded/auth/Sessions";
 import { Statement } from "effect/sql/Statement";
 import { SubjectId } from "@yielded/auth/Schema";
 import { AnySQLiteTable } from "drizzle-orm/sqlite-core";
@@ -20,7 +20,7 @@ type D1DomainError = SessionStepUpInvalid | PendingAuthenticationInvalid | Sessi
 type D1CoordinatorError<E> = E | D1DomainError | HookConfigurationError;
 export declare const makeD1AuthenticationAuthorityServices: <Claims, Subject extends AnySQLiteTable, Credential extends AnySQLiteTable, Flow extends AnySQLiteTable, Pending extends AnySQLiteTable, NativeSubjectId>(mapping: D1AuthenticationAuthorityMapping<Claims, Subject, Credential, Flow, Pending, NativeSubjectId>) => Effect.Effect<{
   authenticationAuthority: {
-    readonly capture: (subjectId: SubjectId, credentialIds: ReadonlyArray<string>) => Effect.Effect<AuthenticationRevision, StaleAuthentication | SessionUnavailable>;
+    readonly capture: (subjectId: SubjectId, credentialIds: ReadonlyArray<string>) => Effect.Effect<AuthenticationCapture, StaleAuthentication | SessionUnavailable>;
     readonly requirements: (evidence: AuthenticationEvidence) => Effect.Effect<AuthenticationRequirement, StaleAuthentication | SessionUnavailable>;
     readonly approve: <A>(input: {
       readonly evidence: AuthenticationEvidence;

package/dist/drizzle/d1-sessions.mjs

@@ -9,7 +9,7 @@ import { NativeDatabase, decodeStepUpIntent, encodeStepUpIntent, stepUpIntentLiv
 import { and, eq, getTableColumns, gt, inArray, not, or, sql } from "drizzle-orm";
 import { Cause, Context, Data, DateTime, Effect, Schema } from "effect";
 import { CurrentCommitJournal, LifecycleHooks, coordinateCommit, hasCommitScope } from "@yielded/auth/Hooks";
-import { AuthenticationAuthority, PendingAuthenticationInvalid, SessionConflict, SessionInvalid, SessionMetadata, SessionStepUpInvalid, SessionUnavailable, StaleAuthentication, assessAuthentication, pendingAuthenticationContext, snapshotPendingAuthenticationContext, snapshotSessionAuthenticationProvenance } from "@yielded/auth/Sessions";
+import { AuthenticationAuthority, AuthenticationCapture, PendingAuthenticationInvalid, SessionConflict, SessionInvalid, SessionMetadata, SessionStepUpInvalid, SessionUnavailable, StaleAuthentication, assessAuthentication, pendingAuthenticationContext, snapshotPendingAuthenticationContext, snapshotSessionAuthenticationProvenance } from "@yielded/auth/Sessions";
 import { reportPersistenceFailure } from "@yielded/auth/Persistence";
 //#region src/drizzle/d1-sessions.ts
 var CurrentD1SessionBatch = class extends Context.Service()("effect-auth/drizzle/CurrentD1SessionBatch") {};
@@ -194,7 +194,12 @@ const captureDetails = Effect.fn("DrizzleD1Session.captureDetails")(function* (m
 	};
 });
 const capture = Effect.fn("DrizzleD1Session.capture")(function* (mapping, subjectId, credentialIds) {
-	return (yield* captureDetails(mapping, subjectId, credentialIds)).revision;
+	const details = yield* captureDetails(mapping, subjectId, credentialIds);
+	const requirement = yield* mapping.subject.decodeRequirement(details.subject);
+	return yield* Schema.decodeEffect(AuthenticationCapture)({
+		revision: details.revision,
+		requirement
+	});
 });
 const requirement = Effect.fn("DrizzleD1Session.requirement")(function* (mapping, evidence) {
 	const current = yield* captureDetails(mapping, evidence.revision.subjectId, evidence.revision.credentials.map((item) => item.credentialId));
@@ -380,7 +385,7 @@ const makeD1StatefulSessions = (mapping) => {
 				const assessed = yield* assessAuthentication(input.evidence, policy);
 				if (!assessed.satisfied) return yield* stale();
 				const nativeSubjectId = yield* mapping.subjectId.toNative(input.evidence.revision.subjectId);
-				if (input.pending === void 0 && (yield* hasActiveFlow(mapping, input.evidence.flowId))) return yield* SessionConflict.make({});
+				if (input.pending === void 0 && (input.fresh !== true || input.handoffSourceSessionId !== void 0) && (yield* hasActiveFlow(mapping, input.evidence.flowId))) return yield* SessionConflict.make({});
 				const nativeSessionId = yield* allocate(mapping.session.allocateId, mapping.session.allocateIdSync);
 				const sessionId = yield* mapping.sessionId.toSession(nativeSessionId);
 				if (sessionId === input.handoffSourceSessionId) return yield* SessionConflict.make({});
@@ -398,7 +403,7 @@ const makeD1StatefulSessions = (mapping) => {
 				const commitCondition = and(authorityCondition(mapping, nativeSubjectId, input.evidence), freshnessCondition(mapping, input.evidence, policy, true), sql`${DateTime.toEpochMillis(record.issuedAt)} <= ${mapping.d1.engineNowMillis}`, sql`${mapping.d1.engineNowMillis} < ${DateTime.toEpochMillis(record.expiresAt)}`, sql`${DateTime.toEpochMillis(record.expiresAt)} <= ${DateTime.toEpochMillis(record.absoluteExpiresAt)}`);
 				let condition = commitCondition;
 				const statements = [];
-				if (input.pending === void 0) {
+				if (input.pending === void 0 && (input.fresh !== true || input.handoffSourceSessionId !== void 0)) {
 					const f = flowColumns(mapping);
 					condition = and(condition, not(sql`exists(select 1 from ${mapping.flow.table} where ${f.flowId} = ${sql.param(input.evidence.flowId, f.flowId)} and ${f.dedupUntil} > ${mapping.d1.engineNow})`));
 					if (mapping.pending !== void 0) statements.push(yield* statement(database.delete(mapping.pending.table).where(eq(column(mapping.pending.table, mapping.pending.flowId), input.evidence.flowId))));
@@ -407,7 +412,7 @@ const makeD1StatefulSessions = (mapping) => {
 						subjectId: nativeSubjectId,
 						dedupUntil: record.absoluteExpiresAt
 					}))));
-				} else {
+				} else if (input.pending !== void 0) {
 					if (mapping.pending === void 0) return yield* invalidPending();
 					const stored = yield* readPending(mapping, input.pending.digest);
 					if (stored === void 0 || !sameOriginalRevision(input.evidence, stored.evidence)) return yield* invalidPending();
@@ -422,7 +427,7 @@ const makeD1StatefulSessions = (mapping) => {
 					receipt: prepare(record, journal),
 					statements: [yield* assertion(condition), ...statements]
 				};
-			}), mapping.isConstraintConflict, Effect.suspend(() => input.pending === void 0 ? recoverFlowOrStale(mapping, input.evidence.flowId) : recoverPendingOrStale(mapping, input.pending, input.evidence.revision.subjectId))),
+			}), mapping.isConstraintConflict, Effect.suspend(() => input.pending === void 0 ? input.fresh === true && input.handoffSourceSessionId === void 0 ? Effect.fail(stale()) : recoverFlowOrStale(mapping, input.evidence.flowId) : recoverPendingOrStale(mapping, input.pending, input.evidence.revision.subjectId))),
 			verify: (input) => Effect.gen(function* () {
 				const rows = yield* (yield* CurrentD1PlanningDatabase).select({ ...getTableColumns(mapping.session.table) }).from(mapping.session.table).innerJoin(mapping.subject.table, and(eq(s.subjectId, subjectColumns(mapping).id), eq(s.securityRevision, subjectColumns(mapping).revision), eq(subjectColumns(mapping).status, mapping.d1.activeSubjectStatusValue))).where(and(eq(s.digest, input.digest), gt(s.expiresAt, mapping.d1.engineNow), gt(s.absoluteExpiresAt, mapping.d1.engineNow))).limit(1);
 				if (rows[0] === void 0) return yield* invalidSession();