@yielded/auth-persistence-drizzle 0.1.0-beta.23 → 0.1.0-beta.25

package/src/drizzle/storage-validation.ts

@@ -3,230 +3,24 @@ import {
   PersistenceMappingError,
   validateStorageBatch,
   type StorageValidation,
+  storageKeyPlans,
 } from "@yielded/auth-persistence/Adapter";
 import { getTableColumns, getTableName, is, Table } from "drizzle-orm";
 import { getTableConfig as getMysqlTableConfig, MySqlTable } from "drizzle-orm/mysql-core";
 import { getTableConfig as getPgTableConfig, PgTable } from "drizzle-orm/pg-core";
-import { Effect, Predicate, Schema } from "effect";
+import { Effect } from "effect";
 import { SqlClient } from "effect/sql/SqlClient";
 
-// These are mapping contracts, not a parser for arbitrary constraint declarations.
-// Role aliases are explicit because their documentation names differ from mapping fields.
-const uniquePlans: Readonly<Record<string, readonly [string, ReadonlyArray<string>]>> = {
-  "unique(abuseEvent.moduleId,abuseEvent.action,abuseEvent.scopeKind,abuseEvent.scopeKey,abuseEvent.commandId)":
-    ["abuseEvent", ["moduleId", "action", "scopeKind", "scopeKey", "commandId"]],
-  "unique(admission.moduleId)": ["admission", ["moduleId"]],
-  "unique(attempt.moduleId,attempt.attemptId)": ["attempt", ["moduleId", "attemptId"]],
-  "unique(authority.subjectId,authority.credentialId)": [
-    "authority",
-    ["subjectId", "credentialId"],
-  ],
-  "unique(authorityCredential.subjectId,authorityCredential.credentialId)": [
-    "authorityCredential",
-    ["subjectId", "credentialId"],
-  ],
-  "unique(command.moduleId,command.commandId)": ["command", ["moduleId", "commandId"]],
-  "unique(connectedAdmission.admissionId)": ["admission", ["admissionId"]],
-  "unique(connectedClient.clientKey)": ["client", ["clientKey"]],
-  "unique(connectedCohort.cohortKey)": ["cohort", ["cohortKey"]],
-  "unique(connectedCommand.moduleId,connectedCommand.commandId)": [
-    "command",
-    ["moduleId", "commandId"],
-  ],
-  "unique(connectedFlow.moduleId,connectedFlow.commandId)": ["flow", ["moduleId", "commandId"]],
-  "unique(connectedFlow.moduleId,connectedFlow.flowId)": ["flow", ["moduleId", "flowId"]],
-  "unique(connectedFlow.stateDigest)": ["flow", ["stateDigest"]],
-  "unique(connectedGrant.moduleId,connectedGrant.grantId)": ["grant", ["moduleId", "grantId"]],
-  "unique(connectedGrant.moduleId,connectedGrant.subjectId,connectedGrant.profileKey,connectedGrant.activeIdentityKey)":
-    ["grant", ["moduleId", "subjectId", "profileKey", "activeIdentityKey"]],
-  "unique(connectedRevocation.jobId)": ["job", ["jobId"]],
-  "unique(continuation.moduleId,continuation.continuationId)": [
-    "continuation",
-    ["moduleId", "continuationId"],
-  ],
-  "unique(continuation.moduleId,continuation.digest)": ["continuation", ["moduleId", "digest"]],
-  "unique(credential.credentialId)": ["credential", ["credentialId"]],
-  "unique(credential.identityKey)": ["credential", ["identityKey"]],
-  "unique(credential.moduleId,credential.credentialId)": [
-    "credential",
-    ["moduleId", "credentialId"],
-  ],
-  "unique(credential.moduleId,credential.subjectId)": ["credential", ["moduleId", "subjectId"]],
-  "unique(emailCommand.moduleId,emailCommand.commandId)": ["command", ["moduleId", "commandId"]],
-  "unique(emailCredential.moduleId,emailCredential.credentialId)": [
-    "credential",
-    ["moduleId", "credentialId"],
-  ],
-  "unique(emailCredential.moduleId,emailCredential.identifierNamespace,emailCredential.identifierValue)":
-    ["credential", ["moduleId", "identifierNamespace", "identifierValue"]],
-  "unique(emailRegistration.moduleId,emailRegistration.commandId)": [
-    "registration",
-    ["moduleId", "commandId"],
-  ],
-  "unique(emailRegistration.pendingReference)": ["registration", ["pendingReference"]],
-  "unique(failureEvent.moduleId,failureEvent.seriesKey,failureEvent.commandId)": [
-    "failureEvent",
-    ["moduleId", "seriesKey", "commandId"],
-  ],
-  "unique(flow.flowId)": ["flow", ["flowId"]],
-  "unique(flow.moduleId,flow.commandId)": ["flow", ["moduleId", "commandId"]],
-  "unique(flow.moduleId,flow.flowId)": ["flow", ["moduleId", "flowId"]],
-  "unique(flow.stateDigest)": ["flow", ["stateDigest"]],
-  "unique(generation.moduleId,generation.deliveryId)": ["generation", ["moduleId", "deliveryId"]],
-  "unique(generation.moduleId,generation.proofId)": ["generation", ["moduleId", "proofId"]],
-  "unique(identifier.namespace,identifier.value)": ["identifier", ["namespace", "value"]],
-  "unique(intent.digest)": ["intent", ["digest"]],
-  "unique(intent.flowId)": ["intent", ["flowId"]],
-  "unique(intent.moduleId,intent.commandId)": ["intent", ["moduleId", "commandId"]],
-  "unique(intent.moduleId,intent.flowId)": ["intent", ["moduleId", "flowId"]],
-  "unique(intent.moduleId,intent.intentId)": ["intent", ["moduleId", "intentId"]],
-  "unique(intent.moduleId,intent.reference)": ["intent", ["moduleId", "reference"]],
-  "unique(ownership.identityKey)": ["ownership", ["identityKey"]],
-  "unique(pending.digest)": ["pending", ["digest"]],
-  "unique(pending.flowId)": ["pending", ["flowId"]],
-  "unique(rateScope.moduleId,rateScope.purpose,rateScope.action,rateScope.scopeKind,rateScope.scopeKey)":
-    ["rateScope", ["moduleId", "purpose", "action", "scopeKind", "scopeKey"]],
-  "unique(registration.moduleId,registration.requestId)": [
-    "registration",
-    ["moduleId", "requestId"],
-  ],
-  "unique(registration.recoveryReference)": ["registration", ["recoveryReference"]],
-  "unique(registrationCommand.moduleId,registrationCommand.commandId)": [
-    "command",
-    ["moduleId", "commandId"],
-  ],
-  "unique(request.moduleId,request.requestId)": ["request", ["moduleId", "requestId"]],
-  "unique(series.moduleId,series.purpose,series.scopeKey)": [
-    "series",
-    ["moduleId", "purpose", "scopeKey"],
-  ],
-  "unique(session.digest)": ["session", ["digest"]],
-  "unique(tombstone.subjectId,tombstone.sessionId)": ["tombstone", ["subjectId", "sessionId"]],
-  "unique(tuple.identityKey)": ["ownership.tuple", ["identityKey"]],
-  "unique(unlinkCommand.moduleId,unlinkCommand.commandId)": ["command", ["moduleId", "commandId"]],
-};
-
-const arrayRoles: Readonly<Record<string, string>> = {
-  credentialId: "credential",
-  factor: "authority",
-  credentialOwnership: "credentialOwnership",
-  handleOwnership: "handleOwnership",
-  boundSubjectHandle: "handleOwnership",
-  flow: "flow",
-  command: "flow",
-  admission: "admission",
-  charge: "charge",
-  intentFlow: "intent",
-  intentCommand: "intent",
-  handle: "handle",
-};
-
-const nestedMappings = [
-  "read",
-  "signIn",
-  "password",
-  "proof",
-  "proofs",
-  "revocation",
-  "pending",
-  "session",
-  "source",
-];
-
-const constraintGroups = [
-  "constraints",
-  "tupleConstraints",
-  "registrationConstraints",
-  "managementConstraints",
-];
-
-const MappingRecord = Schema.Record(Schema.String, Schema.Unknown);
-const record = Schema.decodeUnknownSync(MappingRecord);
-
-const plans = (mapping: Readonly<Record<string, unknown>>) => {
-  const result: Array<{ readonly table: Table; readonly keys: ReadonlyArray<string> }> = [];
-
-  for (const group of constraintGroups) {
-    if (mapping[group] === undefined) continue;
-    for (const [name, declaration] of Object.entries(record(mapping[group]))) {
-      if (declaration === "notNull(provisioningRequest.subjectId)") continue;
-      let role: string;
-      let keys: ReadonlyArray<string>;
-
-      if (typeof declaration === "string") {
-        const plan = uniquePlans[declaration];
-
-        if (plan !== undefined) [role, keys] = plan;
-        else if (declaration === "unique(id)") {
-          role = "subject";
-          keys = ["id"];
-        } else if (declaration === "unique(scope)") {
-          role = name;
-          keys = ["scope"];
-        } else if (declaration === "unique(credentialId)") {
-          role = "credential";
-          keys = ["id"];
-        } else if (declaration === "unique(namespace,value)") {
-          role = "identifier";
-          keys = ["namespace", "value"];
-        } else if (declaration === "unique(provider,issuer,subject)") {
-          role = "externalIdentity";
-          keys = ["provider", "issuer", "subject"];
-        } else if (declaration === "unique(requestId)") {
-          role = "provisioningRequest";
-          keys = ["requestId"];
-        } else throw new Error("Unknown storage constraint");
-      } else if (Array.isArray(declaration) && declaration.every(Predicate.isString)) {
-        const mappedRole =
-          group === "managementConstraints" && name === "command" ? "command" : arrayRoles[name];
-
-        if (mappedRole === undefined) throw new Error("Unknown storage constraint");
-        role = mappedRole;
-        keys = declaration;
-      } else throw new Error("Invalid storage constraint");
-
-      let target: unknown = mapping;
-
-      for (const segment of role.split(".")) target = record(target)[segment];
-      // Session authority places its pending tables in one nested mapping.
-      if (target === undefined && Schema.is(MappingRecord)(mapping.pending))
-        target = mapping.pending[role];
-      let mapped = record(target);
-
-      if (role === "pending" && mapped.table === undefined) mapped = record(mapped.pending);
-      // OAuth ownership can be integrated into its tuple authority or separate.
-      if (role === "ownership" && mapped.table === undefined)
-        mapped = record(mapped.external ?? mapped.tuple);
-      if (!is(mapped.table, Table)) throw new Error("Missing storage table");
-      const columns = getTableColumns(mapped.table);
-
-      result.push({
-        table: mapped.table,
-        keys: keys.map((key) => {
-          const value = mapped[key];
-
-          if (typeof value !== "string" || columns[value] === undefined)
-            throw new Error("Missing mapped key");
-
-          return value;
-        }),
-      });
-    }
-  }
-  for (const nested of nestedMappings) {
-    const value = mapping[nested];
-
-    if (Schema.is(MappingRecord)(value) && value.table === undefined) result.push(...plans(value));
-  }
-
-  return result;
-};
-
 /** Validate at acquisition using the root database supplied by the adapter. */
 export const validateDrizzleStorage = Effect.fnUntraced(
   function* (mapping: unknown) {
     const physical = yield* Effect.try({
-      try: () => plans(record(mapping)),
+      try: () =>
+        storageKeyPlans(mapping, (table) => {
+          if (!is(table, Table)) throw new Error("Missing storage table");
+
+          return getTableColumns(table);
+        }),
       catch: () =>
         PersistenceMappingError.make({
           operation: "mapping",
@@ -239,6 +33,11 @@ export const validateDrizzleStorage = Effect.fnUntraced(
     const batches = new Map<"pg" | "mysql" | "sqlite", StorageValidation[]>();
 
     for (const plan of physical) {
+      if (!is(plan.table, Table))
+        return yield* PersistenceMappingError.make({
+          operation: "mapping",
+          cause: "Missing storage table",
+        });
       const pg = is(plan.table, PgTable);
       const mysql = is(plan.table, MySqlTable);
 

package/src/index.ts

@@ -1,3 +1,5 @@
+export type { OAuthProxyColumns } from "./drizzle/oauth-proxy";
+
 export {
   type AnyEmailAddressMapping,
   type AnyEmailRegistrationMapping,
@@ -35,10 +37,6 @@ export {
   type AnyPasswordPersistenceMapping,
   type AnyPasswordRegistrationMapping,
   type D1PasswordPersistenceMapping,
-  type PasswordAttemptAction,
-  type PasswordAttemptRecord,
-  type PasswordAttemptState,
-  type PasswordAttemptTable,
   type PasswordAuthorityCredentialTable,
   type PasswordCommandTable,
   type PasswordConstraintClassifier,

package/src/internal/drizzle-postgres-oauth-proxy.ts

@@ -0,0 +1,37 @@
+import { sql } from "drizzle-orm";
+import { bigint, check, pgTable, primaryKey, text, type PgTable } from "drizzle-orm/pg-core";
+
+import { oauthProxyLayer, type OAuthProxyColumns } from "../drizzle/oauth-proxy";
+
+/** Export the returned table from your Drizzle Kit schema before applying the Layer. */
+const table = (name: string) =>
+  pgTable(
+    name,
+    {
+      namespace: text("namespace").notNull(),
+      flowId: text("flow_id").notNull(),
+      version: text("version").notNull(),
+      stage: text("stage").notNull(),
+      context: text("context").notNull(),
+      expiresAtMillis: bigint("expires_at_millis", { mode: "number" }).notNull(),
+      handoffExpiresAtMillis: bigint("handoff_expires_at_millis", { mode: "number" }),
+      payload: text("payload").notNull(),
+    },
+    (columns) => [
+      primaryKey({ columns: [columns.namespace, columns.flowId] }),
+      check(
+        `${name}_stage`,
+        sql`${columns.stage} in ('Pending', 'Exchanging', 'Ready', 'Consumed')`,
+      ),
+      check(
+        `${name}_handoff`,
+        sql`(${columns.stage} = 'Ready' and ${columns.handoffExpiresAtMillis} is not null)
+    or (${columns.stage} <> 'Ready' and ${columns.handoffExpiresAtMillis} is null)`,
+      ),
+    ],
+  );
+
+const layer = <T extends PgTable>(table: T, columns?: OAuthProxyColumns<T>) =>
+  oauthProxyLayer("pg", table, columns);
+
+export const OAuthProxyPersistence = { table, layer };

package/src/internal/drizzle-sqlite-oauth-proxy.ts

@@ -0,0 +1,44 @@
+import { sql } from "drizzle-orm";
+import {
+  check,
+  integer,
+  primaryKey,
+  sqliteTable,
+  text,
+  type SQLiteTable,
+} from "drizzle-orm/sqlite-core";
+
+import { oauthProxyLayer, type OAuthProxyColumns } from "../drizzle/oauth-proxy";
+
+/** Export the returned table from your Drizzle Kit schema before applying the Layer. */
+const table = (name: string) =>
+  sqliteTable(
+    name,
+    {
+      namespace: text("namespace").notNull(),
+      flowId: text("flow_id").notNull(),
+      version: text("version").notNull(),
+      stage: text("stage").notNull(),
+      context: text("context").notNull(),
+      expiresAtMillis: integer("expires_at_millis").notNull(),
+      handoffExpiresAtMillis: integer("handoff_expires_at_millis"),
+      payload: text("payload").notNull(),
+    },
+    (columns) => [
+      primaryKey({ columns: [columns.namespace, columns.flowId] }),
+      check(
+        `${name}_stage`,
+        sql`${columns.stage} in ('Pending', 'Exchanging', 'Ready', 'Consumed')`,
+      ),
+      check(
+        `${name}_handoff`,
+        sql`(${columns.stage} = 'Ready' and ${columns.handoffExpiresAtMillis} is not null)
+    or (${columns.stage} <> 'Ready' and ${columns.handoffExpiresAtMillis} is null)`,
+      ),
+    ],
+  );
+
+const layer = <T extends SQLiteTable>(table: T, columns?: OAuthProxyColumns<T>) =>
+  oauthProxyLayer("sqlite", table, columns);
+
+export const OAuthProxyPersistence = { table, layer };

package/dist/_virtual/_rolldown/runtime.mjs

@@ -1,13 +0,0 @@
-//#region \0rolldown/runtime.js
-var __defProp = Object.defineProperty;
-var __exportAll = (all, no_symbols) => {
-	let target = {};
-	for (var name in all) __defProp(target, name, {
-		get: all[name],
-		enumerable: true
-	});
-	if (!no_symbols) __defProp(target, Symbol.toStringTag, { value: "Module" });
-	return target;
-};
-//#endregion
-export { __exportAll };