@yielded/auth-persistence-drizzle 0.1.0-beta.23 → 0.1.0-beta.25

package/src/drizzle/oauth-registration.ts

@@ -1,640 +0,0 @@
-import {
-  OAuthRegistrationAccess,
-  OAuthRegistrationDecision,
-  OAuthRegistrationFingerprint,
-  OAuthRegistrationInspection,
-  OAuthRegistrationIntent,
-  OAuthCredentialSnapshot,
-  OAuthDisplayProfile,
-  OAuthSignInTransactionContext,
-  type OAuthExternalIdentity,
-  snapshotOAuthSync,
-} from "@yielded/auth/OAuth";
-import type { SecurityRevision } from "@yielded/auth/Sessions";
-/* oxlint-disable no-explicit-any -- private owner kernel preserves Registration at the exported constructor. */
-import { eq, sql } from "drizzle-orm";
-import { Effect, Schema } from "effect";
-
-import type { PersistenceMappingError, SubjectIdCodec } from "./model";
-import { discoverOwned, exactClaim, resolveOwned, terminalFlow } from "./oauth-flow";
-import type { OAuthRegistrationBase } from "./oauth-model";
-import { both, col, equal, matchesNativeRow, CurrentOAuthTransaction } from "./oauth-owner";
-import { invariant, oauthIdentityKey, sameIdentity, storage } from "./oauth-state";
-
-export const intentStorage = storage(OAuthRegistrationIntent);
-const decisionStorage = storage(OAuthRegistrationDecision);
-const contextStorage = storage(OAuthSignInTransactionContext);
-const profileStorage = storage(Schema.NullOr(OAuthDisplayProfile));
-
-const reservationStorage = storage(
-  Schema.Struct({
-    moduleId: Schema.String,
-    reference: Schema.String,
-    commandId: Schema.String,
-    fingerprint: Schema.String,
-    provisioningIdentity: Schema.String,
-  }),
-);
-
-export const readTuple = (ownership: any, identity: typeof OAuthExternalIdentity.Type) =>
-  Effect.flatMap(CurrentOAuthTransaction, (owner) =>
-    Effect.gen(function* () {
-      const t = ownership.tuple,
-        key = yield* oauthIdentityKey(identity);
-
-      const where = { [t.identityKey]: key };
-      const observed = yield* owner.read(t.table, equal(t.table, where), { limit: 1 });
-
-      if (observed.rows.length === 0) {
-        const values = {
-          ...t.encodeInsert({ identityKey: key, identity }),
-          ...where,
-          [t.provider]: identity.provider,
-          [t.issuer]: identity.issuer,
-          [t.externalSubject]: identity.subject,
-          [t.state]: "Unowned",
-          [t.version]: owner.marker,
-          [t.subjectId]: null,
-          [t.reservation]: null,
-        };
-
-        const inserted = yield* owner.insert(t.table, values, where, true);
-
-        observed.rows = inserted.rows;
-      }
-      const row = observed.rows[0]!;
-
-      invariant(
-        row[t.provider] === identity.provider &&
-          row[t.issuer] === identity.issuer &&
-          row[t.externalSubject] === identity.subject &&
-          ["Unowned", "Reserved", "Owned"].includes(row[t.state]),
-      );
-      invariant(
-        row[t.state] === "Owned"
-          ? row[t.subjectId] !== null
-          : row[t.subjectId] === null &&
-              (row[t.state] === "Reserved"
-                ? typeof row[t.reservation] === "string"
-                : row[t.reservation] === null),
-      );
-      if (ownership.mode === "separate") {
-        const o = ownership.external;
-
-        const external = yield* owner.read(o.table, equal(o.table, { [o.identityKey]: key }), {
-          limit: 1,
-        });
-
-        if (row[t.state] === "Owned") {
-          const linked = external.rows[0];
-
-          invariant(
-            linked !== undefined &&
-              linked[o.provider] === identity.provider &&
-              linked[o.issuer] === identity.issuer &&
-              linked[o.externalSubject] === identity.subject &&
-              matchesNativeRow(o.table, linked, { [o.subjectId]: row[t.subjectId] }),
-          );
-          const owned = sql`exists(select 1 from ${o.table} where ${both(equal(o.table, { [o.identityKey]: key }), o.ownedCondition)})`;
-
-          invariant(yield* owner.check(owned));
-          owner.postconditions.push(owned);
-        } else invariant(external.rows.length === 0);
-      }
-
-      return { observed, row, key };
-    }),
-  );
-
-export const acquireTuple = (
-  ownership: any,
-  identity: typeof OAuthExternalIdentity.Type,
-  key: string,
-  subjectId: unknown,
-) =>
-  Effect.flatMap(CurrentOAuthTransaction, (owner) =>
-    Effect.gen(function* () {
-      const t = ownership.tuple;
-
-      yield* owner.update(
-        t.table,
-        { [t.identityKey]: key },
-        {
-          [t.state]: "Owned",
-          [t.subjectId]: subjectId,
-          [t.reservation]: null,
-          [t.version]: owner.marker,
-        },
-      );
-      if (ownership.mode === "separate") {
-        const o = ownership.external;
-
-        const values = {
-          ...o.encodeInsert({ identity, identityKey: key, subjectId }),
-          [o.identityKey]: key,
-          [o.provider]: identity.provider,
-          [o.issuer]: identity.issuer,
-          [o.externalSubject]: identity.subject,
-          [o.subjectId]: subjectId,
-        };
-
-        yield* owner.insert(o.table, values, { [o.identityKey]: key });
-      }
-    }),
-  );
-
-export const settleRegistrationIntent = (mapping: any, input: any) =>
-  Effect.flatMap(CurrentOAuthTransaction, (owner) =>
-    Effect.gen(function* () {
-      const identity = input.identity.identity,
-        context = input.claim.flow.context;
-
-      invariant(identity.provider === context.provider && identity.issuer === context.issuer);
-      const found = yield* discoverOwned(mapping.signIn, identity);
-      const tuple = found.owned ? undefined : yield* readTuple(mapping.ownership, identity);
-      const exact = yield* exactClaim(mapping.signIn, input.claim, "sign-in");
-
-      if (exact === undefined) return { _tag: "Rejected" } as const;
-      const credential = resolveOwned(mapping.signIn, context.moduleId, identity, found);
-
-      if (credential !== undefined) {
-        yield* terminalFlow(mapping.signIn, input.claim.flow, "Verified");
-
-        return { _tag: "Verified", credential } as const;
-      }
-      let decision: any = { _tag: "Rejected" };
-
-      if (
-        !found.owned &&
-        tuple?.row[mapping.ownership.tuple.state] === "Unowned" &&
-        input.intent !== undefined
-      ) {
-        const intent = snapshotOAuthSync(OAuthRegistrationIntent, input.intent);
-        const c = intent.context;
-
-        invariant(
-          sameIdentity(intent.identity, identity) &&
-            profileStorage.encode(intent.profile ?? null) ===
-              profileStorage.encode(input.identity.profile ?? null) &&
-            intent.claimId === input.claim.claimId &&
-            intent.claimedAtMillis === input.claim.claimedAtMillis &&
-            contextStorage.encode(c) === contextStorage.encode(context),
-        );
-
-        const allowed =
-          intent.issuedAtMillis >= intent.claimedAtMillis &&
-          intent.verifiedAtMillis <= intent.issuedAtMillis &&
-          intent.issuedAtMillis <= exact.now &&
-          exact.now < intent.expiresAtMillis &&
-          intent.expiresAtMillis <= c.requestBindingExpiresAtMillis &&
-          intent.retentionUntilMillis >= intent.expiresAtMillis &&
-          (yield* owner.check(mapping.eligibility.condition({ intent })));
-
-        if (allowed) {
-          const i = mapping.intent,
-            encode = mapping.signIn.clock.encodeInstant;
-
-          const key = { [i.moduleId]: c.moduleId, [i.reference]: intent.reference };
-
-          const values = {
-            ...i.encodeInsert(snapshotOAuthSync(OAuthRegistrationIntent, intent)),
-            ...key,
-            [i.flowId]: c.flowId,
-            [i.claimId]: intent.claimId,
-            [i.identityKey]: tuple.key,
-            [i.version]: owner.marker,
-            [i.state]: "Unbound",
-            [i.snapshot]: intentStorage.encode(intent),
-            [i.commandId]: null,
-            [i.fingerprint]: null,
-            [i.pendingReference]: null,
-            [i.expiresAt]: encode(intent.expiresAtMillis),
-            [i.retentionUntil]: encode(intent.retentionUntilMillis),
-          };
-
-          yield* owner.insert(i.table, values, key);
-          owner.postconditions.push(
-            mapping.eligibility.condition({ intent }),
-            sql`${mapping.signIn.clock.engineNowMillis} >= ${intent.issuedAtMillis} and
-            ${mapping.signIn.clock.engineNowMillis} < ${intent.expiresAtMillis}`,
-          );
-          decision = { _tag: "RegistrationIssued", intent };
-        }
-      }
-      yield* terminalFlow(mapping.signIn, input.claim.flow, decision._tag);
-
-      return decision;
-    }),
-  );
-
-export const inspectIntent = (
-  mapping: any,
-  original: typeof OAuthRegistrationAccess.Type,
-  discovery = false,
-) =>
-  Effect.flatMap(CurrentOAuthTransaction, (owner) =>
-    Effect.gen(function* () {
-      const access = snapshotOAuthSync(OAuthRegistrationAccess, original),
-        i = mapping.intent;
-
-      const observed = yield* owner.read(
-        i.table,
-        equal(i.table, {
-          [i.moduleId]: access.moduleId,
-          [i.reference]: access.reference,
-        }),
-        { limit: 1, ...(discovery ? { lock: false, observe: false } : {}) },
-      );
-
-      const row = observed.rows[0];
-
-      if (row === undefined) return undefined;
-
-      const intent = intentStorage.decode(row[i.snapshot]),
-        c = intent.context,
-        now = yield* owner.now(mapping.clock);
-
-      invariant(
-        row[i.moduleId] === c.moduleId &&
-          row[i.reference] === intent.reference &&
-          row[i.flowId] === c.flowId &&
-          row[i.claimId] === intent.claimId &&
-          row[i.identityKey] === (yield* oauthIdentityKey(intent.identity)) &&
-          mapping.clock.decodeInstant(row[i.expiresAt]) === intent.expiresAtMillis &&
-          mapping.clock.decodeInstant(row[i.retentionUntil]) === intent.retentionUntilMillis,
-      );
-      if (
-        access.moduleId !== c.moduleId ||
-        access.reference !== intent.reference ||
-        access.flowId !== c.flowId ||
-        access.requestBindingVerifier !== c.requestBindingVerifier ||
-        access.requestBindingExpiresAtMillis !== c.requestBindingExpiresAtMillis ||
-        access.credentialDigest !== intent.credentialDigest ||
-        now < intent.issuedAtMillis ||
-        now >= intent.expiresAtMillis
-      )
-        return undefined;
-      let application: any;
-
-      if (row[i.state] === "Unbound") {
-        invariant(
-          row[i.commandId] === null &&
-            row[i.fingerprint] === null &&
-            row[i.pendingReference] === null,
-        );
-        application = { _tag: "Unbound" };
-      } else {
-        application = {
-          _tag: row[i.state],
-          commandId: row[i.commandId],
-          fingerprint: row[i.fingerprint],
-          ...(row[i.state] === "ProvisioningPending" ? { reference: row[i.pendingReference] } : {}),
-        };
-      }
-      const inspection = snapshotOAuthSync(OAuthRegistrationInspection, { intent, application });
-
-      owner.postconditions.push(sql`${mapping.clock.engineNowMillis} >= ${intent.issuedAtMillis} and
-      ${mapping.clock.engineNowMillis} < ${intent.expiresAtMillis}`);
-
-      return { observed, row, inspection };
-    }),
-  );
-
-export interface RegistrationResources {
-  readonly provisioningIdentity: string;
-  readonly pendingReference?: string;
-  readonly subjectId?: unknown;
-  readonly credentialId?: string;
-  readonly revision?: string;
-}
-
-/** Public mapping callbacks are closed Effects; erasing native row shapes must
- * not erase their error or requirements channels. */
-export type RegistrationCallbacks<Registration> = Pick<
-  OAuthRegistrationBase<Registration, any, any, any, any, unknown>,
-  "snapshot" | "snapshotSync" | "inspect" | "inspectSync"
->;
-
-export const registrationResources = (mapping: any) =>
-  Effect.gen(function* () {
-    const provisioningIdentity = yield* mapping.allocateProvisioningIdentity as Effect.Effect<
-      string,
-      PersistenceMappingError
-    >;
-
-    invariant(
-      typeof provisioningIdentity === "string" &&
-        provisioningIdentity.length > 0 &&
-        provisioningIdentity.length <= 256,
-    );
-    if (mapping.mode === "pending") {
-      const pendingReference = yield* mapping.allocatePendingReference as Effect.Effect<
-        string,
-        PersistenceMappingError
-      >;
-
-      invariant(
-        typeof pendingReference === "string" &&
-          pendingReference.length > 0 &&
-          pendingReference.length <= 256,
-      );
-
-      return { provisioningIdentity, pendingReference } as RegistrationResources;
-    }
-
-    const subjectId = yield* mapping.allocateSubjectId as Effect.Effect<
-      unknown,
-      PersistenceMappingError
-    >;
-
-    const publicId = yield* (mapping.subjectId as SubjectIdCodec<unknown>).toSubject(subjectId);
-
-    invariant(
-      mapping.subjectId.equals(
-        subjectId,
-        yield* (mapping.subjectId as SubjectIdCodec<unknown>).toNative(publicId),
-      ),
-    );
-
-    const credentialId = snapshotOAuthSync(
-      OAuthCredentialSnapshot.fields.credentialId,
-      yield* mapping.allocateCredentialId as Effect.Effect<string, PersistenceMappingError>,
-    );
-
-    const revision = snapshotOAuthSync(
-      OAuthCredentialSnapshot.fields.credentialRevision,
-      yield* mapping.allocateRevision as Effect.Effect<SecurityRevision, PersistenceMappingError>,
-    );
-
-    return { provisioningIdentity, subjectId, credentialId, revision } as RegistrationResources;
-  });
-
-export const registrationData = <Registration>(
-  mapping: any,
-  input: {
-    readonly intent: OAuthRegistrationIntent;
-    readonly registration: Registration;
-    readonly fingerprint: string;
-  },
-  bound: boolean,
-) =>
-  Effect.gen(function* () {
-    const snapshot = bound
-      ? (invariant(mapping.snapshotSync !== undefined), mapping.snapshotSync(input.registration))
-      : yield* (mapping as RegistrationCallbacks<Registration>).snapshot(input.registration);
-
-    const encoded = mapping.application.encode(snapshot);
-
-    invariant(typeof encoded === "string" && new TextEncoder().encode(encoded).length <= 1048576);
-    const detached = mapping.application.decode(encoded);
-
-    invariant(mapping.application.encode(detached) === encoded);
-
-    const checked = bound
-      ? (invariant(mapping.inspectSync !== undefined),
-        mapping.inspectSync({
-          intent: snapshotOAuthSync(OAuthRegistrationIntent, input.intent),
-          registration: mapping.application.decode(encoded),
-        }))
-      : yield* (mapping as RegistrationCallbacks<Registration>).inspect({
-          intent: snapshotOAuthSync(OAuthRegistrationIntent, input.intent),
-          registration: mapping.application.decode(encoded),
-        });
-
-    const fingerprint = snapshotOAuthSync(OAuthRegistrationFingerprint, checked.fingerprint);
-
-    invariant(typeof checked.eligible === "boolean");
-
-    return {
-      encoded,
-      registration: detached as Registration,
-      fingerprint,
-      eligible: checked.eligible && fingerprint === input.fingerprint,
-    };
-  });
-
-export const register = (
-  mapping: any,
-  input: any,
-  data: { readonly encoded: string; readonly fingerprint: string; readonly eligible: boolean },
-  resources: RegistrationResources,
-) =>
-  Effect.flatMap(CurrentOAuthTransaction, (owner) =>
-    Effect.gen(function* () {
-      const intent = snapshotOAuthSync(OAuthRegistrationIntent, input.intent),
-        c = intent.context;
-
-      const discovered = yield* inspectIntent(mapping, input.access, true);
-
-      if (
-        discovered === undefined ||
-        intentStorage.encode(discovered.inspection.intent) !== intentStorage.encode(intent)
-      )
-        return { _tag: "Rejected" } as const;
-      const nativeSubjectId = resources.subjectId;
-
-      const policyInput = () => ({
-        intent: snapshotOAuthSync(OAuthRegistrationIntent, intent),
-        registration: mapping.application.decode(data.encoded),
-        ...(mapping.mode === "atomic" ? { nativeSubjectId } : {}),
-      });
-
-      invariant((mapping.eligibility.guards?.length ?? 0) <= 32);
-      for (const guard of mapping.eligibility.guards ?? []) {
-        const locked = yield* owner.read(guard.table, guard.condition(policyInput()), {
-          orderBy: col(guard.table, guard.orderBy),
-          admissionOnly: true,
-        });
-
-        invariant(locked.rows.length > 0);
-      }
-      const tuple = yield* readTuple(mapping.ownership, intent.identity);
-      const inspected = yield* inspectIntent(mapping, input.access);
-
-      if (
-        inspected === undefined ||
-        intentStorage.encode(inspected.inspection.intent) !== intentStorage.encode(intent)
-      )
-        return { _tag: "Rejected" } as const;
-
-      const r = mapping.command,
-        i = mapping.intent,
-        t = mapping.ownership.tuple;
-
-      const commandKey = { [r.moduleId]: c.moduleId, [r.commandId]: input.commandId };
-      const command = yield* owner.read(r.table, equal(r.table, commandKey), { limit: 1 });
-      const previous = command.rows[0];
-
-      if (previous !== undefined) {
-        if (
-          previous[r.reference] !== intent.reference ||
-          previous[r.identityKey] !== tuple.key ||
-          previous[r.fingerprint] !== data.fingerprint ||
-          previous[r.intentSnapshot] !== intentStorage.encode(intent) ||
-          previous[r.applicationSnapshot] !== data.encoded
-        )
-          return { _tag: "Conflict" } as const;
-        invariant(
-          mapping.application.encode(
-            mapping.application.decode(previous[r.applicationSnapshot]),
-          ) === data.encoded,
-        );
-        const old = decisionStorage.decode(previous[r.decision]);
-
-        invariant(inspected.inspection.application._tag === old._tag);
-
-        return old._tag === "Registered" || old._tag === "ProvisioningPending"
-          ? { ...old, replayed: true }
-          : old;
-      }
-      if (inspected.inspection.application._tag !== "Unbound" || tuple.row[t.state] !== "Unowned")
-        return { _tag: "Conflict" } as const;
-      if (data.fingerprint !== input.fingerprint) return { _tag: "Rejected" } as const;
-
-      const admitted =
-        data.eligible && (yield* owner.check(mapping.eligibility.admission(policyInput())));
-
-      let decision: typeof OAuthRegistrationDecision.Type;
-
-      if (!admitted) decision = { _tag: "Rejected" };
-      else if (mapping.mode === "pending") {
-        invariant(resources.pendingReference !== undefined);
-
-        const reservation = reservationStorage.encode({
-          moduleId: c.moduleId,
-          reference: intent.reference,
-          commandId: input.commandId,
-          fingerprint: data.fingerprint,
-          provisioningIdentity: resources.provisioningIdentity,
-        });
-
-        yield* owner.update(
-          t.table,
-          { [t.identityKey]: tuple.key },
-          {
-            [t.state]: "Reserved",
-            [t.version]: owner.marker,
-            [t.reservation]: reservation,
-          },
-        );
-        decision = {
-          _tag: "ProvisioningPending",
-          reference: resources.pendingReference,
-          replayed: false,
-        };
-      } else {
-        invariant(resources.credentialId !== undefined && resources.revision !== undefined);
-
-        const s = mapping.subject,
-          cr = mapping.credential,
-          a = mapping.authority;
-
-        const subjectValues = {
-          ...mapping.encodeSubjectInsert(policyInput(), {
-            subjectId: nativeSubjectId,
-            securityRevision: resources.revision,
-          }),
-          [s.id]: nativeSubjectId,
-          [s.securityRevision]: resources.revision,
-        };
-
-        yield* owner.insert(s.table, subjectValues, { [s.id]: nativeSubjectId });
-
-        const credentialValues = {
-          ...cr.encodeInsert({
-            moduleId: c.moduleId,
-            subjectId: nativeSubjectId,
-            identityKey: tuple.key,
-            credentialId: resources.credentialId,
-            credentialRevision: resources.revision,
-          }),
-          [cr.moduleId]: c.moduleId,
-          [cr.subjectId]: nativeSubjectId,
-          [cr.identityKey]: tuple.key,
-          [cr.credentialId]: resources.credentialId,
-          [cr.credentialRevision]: resources.revision,
-        };
-
-        invariant(
-          cr.isActiveStatus(credentialValues[cr.status]) &&
-            s.isActiveStatus(subjectValues[s.status]),
-        );
-        yield* owner.insert(cr.table, credentialValues, {
-          [cr.credentialId]: resources.credentialId,
-        });
-
-        const authorityValues = {
-          ...a.encodeInsert({
-            subjectId: nativeSubjectId,
-            credentialId: resources.credentialId,
-            revision: resources.revision,
-          }),
-          [a.subjectId]: nativeSubjectId,
-          [a.credentialId]: resources.credentialId,
-          [a.revision]: resources.revision,
-        };
-
-        invariant(a.isActiveStatus(authorityValues[a.status]));
-        yield* owner.insert(a.table, authorityValues, {
-          [a.subjectId]: nativeSubjectId,
-          [a.credentialId]: resources.credentialId,
-        });
-        yield* acquireTuple(mapping.ownership, intent.identity, tuple.key, nativeSubjectId);
-        owner.postconditions.push(
-          sql`exists(select 1 from ${s.table} where ${both(
-            eq(col(s.table, s.id), nativeSubjectId),
-            s.activeCondition,
-          )})`,
-          sql`exists(select 1 from ${cr.table} where ${both(eq(col(cr.table, cr.credentialId), resources.credentialId), cr.activeCondition)})`,
-          sql`exists(select 1 from ${a.table} where ${both(
-            eq(col(a.table, a.credentialId), resources.credentialId),
-            eq(col(a.table, a.subjectId), nativeSubjectId),
-            a.activeCondition,
-          )})`,
-        );
-        decision = { _tag: "Registered", replayed: false };
-      }
-      const now = yield* owner.now(mapping.clock);
-
-      invariant(Number.isSafeInteger(mapping.retentionMillis) && mapping.retentionMillis >= 120000);
-
-      const values = {
-        ...r.encodeInsert({
-          intent: snapshotOAuthSync(OAuthRegistrationIntent, intent),
-          commandId: input.commandId,
-          fingerprint: data.fingerprint,
-          registration: mapping.application.decode(data.encoded),
-          provisioningIdentity: resources.provisioningIdentity,
-        }),
-        ...commandKey,
-        [r.reference]: intent.reference,
-        [r.identityKey]: tuple.key,
-        [r.fingerprint]: data.fingerprint,
-        [r.intentSnapshot]: intentStorage.encode(intent),
-        [r.applicationSnapshot]: data.encoded,
-        [r.provisioningIdentity]: resources.provisioningIdentity,
-        [r.decision]: decisionStorage.encode(decision),
-        [r.retentionUntil]: mapping.clock.encodeInstant(
-          Math.max(intent.retentionUntilMillis, now + mapping.retentionMillis),
-        ),
-      };
-
-      const inserted = yield* owner.insert(r.table, values, commandKey);
-
-      command.rows = inserted.rows;
-      yield* owner.update(
-        i.table,
-        { [i.moduleId]: c.moduleId, [i.reference]: intent.reference },
-        {
-          [i.state]: decision._tag,
-          [i.commandId]: input.commandId,
-          [i.fingerprint]: data.fingerprint,
-          [i.version]: owner.marker,
-          [i.pendingReference]: decision._tag === "ProvisioningPending" ? decision.reference : null,
-        },
-      );
-      if (admitted) owner.postconditions.push(mapping.eligibility.postcondition(policyInput()));
-
-      return decision;
-    }),
-  );