@yielded/auth-persistence-drizzle 0.1.0-beta.24 → 0.1.0-beta.26

package/src/drizzle/session-model.ts

@@ -1,10 +1,12 @@
 import type * as Shared from "@yielded/auth-persistence/Adapter";
 import type { SQL, Table } from "drizzle-orm";
 
+import type { ClockMapping } from "./native-clock";
 import type { DrizzleTableModel } from "./table-model";
 
 export {
   type SessionIdCodec,
+  type SessionPendingInsert,
   type RequiredSessionConstraints,
   type RequiredPendingAuthenticationConstraints,
   type RequiredStatefulPendingConstraints,
@@ -13,7 +15,6 @@ export {
   requiredPendingAuthenticationConstraints,
   requiredStatefulPendingConstraints,
   requiredSignedValidityConstraints,
-  type SessionConstraintClassifier,
 } from "@yielded/auth-persistence/Adapter";
 
 export type SessionSubjectTables<Subject extends Table, NativeId> = Shared.SessionSubjectTables<
@@ -31,36 +32,28 @@ export type SessionAuthorityTables<
   NativeId
 >;
 
-export type SessionFlowTables<Flow extends Table, NativeSubjectId> = Shared.SessionFlowTables<
-  DrizzleTableModel<Flow>,
-  NativeSubjectId
->;
-
 export type StatefulSessionTables<
   Claims,
   Session extends Table,
-  Flow extends Table,
   NativeSubjectId,
   NativeSessionId,
 > = Shared.StatefulSessionTables<
   Claims,
   DrizzleTableModel<Session>,
-  DrizzleTableModel<Flow>,
   NativeSubjectId,
   NativeSessionId
 >;
 
+export type SessionPendingTables<
+  Pending extends Table,
+  NativeSubjectId,
+> = Shared.SessionPendingTables<DrizzleTableModel<Pending>, NativeSubjectId>;
+
 export type PendingAuthenticationTables<
   Claims,
   Pending extends Table,
-  Flow extends Table,
   NativeSubjectId,
-> = Shared.PendingAuthenticationTables<
-  Claims,
-  DrizzleTableModel<Pending>,
-  DrizzleTableModel<Flow>,
-  NativeSubjectId
->;
+> = Shared.PendingAuthenticationTables<Claims, DrizzleTableModel<Pending>, NativeSubjectId>;
 
 export type SignedSessionValidityTables<
   Tombstone extends Table,
@@ -76,16 +69,17 @@ export type AuthenticationAuthorityMapping<
   Claims,
   Subject extends Table,
   Credential extends Table,
-  Flow extends Table,
   Pending extends Table,
   NativeSubjectId,
-> = Shared.AuthenticationAuthorityMapping<
-  Claims,
-  DrizzleTableModel<Subject>,
-  DrizzleTableModel<Credential>,
-  DrizzleTableModel<Flow>,
-  DrizzleTableModel<Pending>,
-  NativeSubjectId
+> = ClockMapping<
+  Shared.AuthenticationAuthorityMapping<
+    Claims,
+    DrizzleTableModel<Subject>,
+    DrizzleTableModel<Credential>,
+    DrizzleTableModel<Pending>,
+    NativeSubjectId,
+    SQL
+  >
 >;
 
 export type StatefulSessionMapping<
@@ -93,19 +87,20 @@ export type StatefulSessionMapping<
   Subject extends Table,
   Credential extends Table,
   Session extends Table,
-  Flow extends Table,
   Pending extends Table,
   NativeSubjectId,
   NativeSessionId,
-> = Shared.StatefulSessionMapping<
-  Claims,
-  DrizzleTableModel<Subject>,
-  DrizzleTableModel<Credential>,
-  DrizzleTableModel<Session>,
-  DrizzleTableModel<Flow>,
-  DrizzleTableModel<Pending>,
-  NativeSubjectId,
-  NativeSessionId
+> = ClockMapping<
+  Shared.StatefulSessionMapping<
+    Claims,
+    DrizzleTableModel<Subject>,
+    DrizzleTableModel<Credential>,
+    DrizzleTableModel<Session>,
+    DrizzleTableModel<Pending>,
+    NativeSubjectId,
+    NativeSessionId,
+    SQL
+  >
 >;
 
 export type PendingAuthenticationMapping<
@@ -113,15 +108,16 @@ export type PendingAuthenticationMapping<
   Subject extends Table,
   Credential extends Table,
   Pending extends Table,
-  Flow extends Table,
   NativeSubjectId,
-> = Shared.PendingAuthenticationMapping<
-  Claims,
-  DrizzleTableModel<Subject>,
-  DrizzleTableModel<Credential>,
-  DrizzleTableModel<Pending>,
-  DrizzleTableModel<Flow>,
-  NativeSubjectId
+> = ClockMapping<
+  Shared.PendingAuthenticationMapping<
+    Claims,
+    DrizzleTableModel<Subject>,
+    DrizzleTableModel<Credential>,
+    DrizzleTableModel<Pending>,
+    NativeSubjectId,
+    SQL
+  >
 >;
 
 export type SignedSessionValidityMapping<
@@ -129,87 +125,27 @@ export type SignedSessionValidityMapping<
   Tombstone extends Table,
   NativeSubjectId,
   NativeSessionId,
-> = Shared.SignedSessionValidityMapping<
-  DrizzleTableModel<Subject>,
-  DrizzleTableModel<Tombstone>,
-  NativeSubjectId,
-  NativeSessionId
+> = ClockMapping<
+  Shared.SignedSessionValidityMapping<
+    DrizzleTableModel<Subject>,
+    DrizzleTableModel<Tombstone>,
+    NativeSubjectId,
+    NativeSessionId,
+    SQL
+  >
 >;
 
-/** D1 evaluates these expressions inside the atomic batch, after queueing delay.
- * `engineNow` must use the exact native representation of every mapped instant
- * column. `engineNowMillis` is Unix epoch milliseconds for proof freshness.
- * Changes to the consumer's factor policy MUST bump subject.securityRevision.
- * Supply the authoritative primary D1 database, never a replica-affined
- * `withSession` handle, because verification and security revision reads must
- * observe completed revocation writes across clients.
- */
-export type D1SessionClockMapping = Shared.D1SessionClockMapping<SQL>;
-
-export type D1AuthenticationAuthorityMapping<
-  Claims,
-  Subject extends Table,
-  Credential extends Table,
-  Flow extends Table,
+export type SessionCleanupMapping<
   Pending extends Table,
-  NativeSubjectId,
-> = Shared.D1AuthenticationAuthorityMapping<
-  Claims,
-  DrizzleTableModel<Subject>,
-  DrizzleTableModel<Credential>,
-  DrizzleTableModel<Flow>,
-  DrizzleTableModel<Pending>,
-  NativeSubjectId,
-  SQL
->;
-
-export type D1PendingAuthenticationMapping<
-  Claims,
-  Subject extends Table,
-  Credential extends Table,
-  Pending extends Table,
-  Flow extends Table,
-  NativeSubjectId,
-> = Shared.D1PendingAuthenticationMapping<
-  Claims,
-  DrizzleTableModel<Subject>,
-  DrizzleTableModel<Credential>,
-  DrizzleTableModel<Pending>,
-  DrizzleTableModel<Flow>,
-  NativeSubjectId,
-  SQL
->;
-
-export type D1StatefulSessionMapping<
-  Claims,
-  Subject extends Table,
-  Credential extends Table,
-  Session extends Table,
-  Flow extends Table,
-  Pending extends Table,
-  NativeSubjectId,
-  NativeSessionId,
-> = Shared.D1StatefulSessionMapping<
-  Claims,
-  DrizzleTableModel<Subject>,
-  DrizzleTableModel<Credential>,
-  DrizzleTableModel<Session>,
-  DrizzleTableModel<Flow>,
-  DrizzleTableModel<Pending>,
-  NativeSubjectId,
-  NativeSessionId,
-  SQL
->;
-
-export type D1SignedSessionValidityMapping<
-  Subject extends Table,
   Tombstone extends Table,
   NativeSubjectId,
   NativeSessionId,
-> = Shared.D1SignedSessionValidityMapping<
-  DrizzleTableModel<Subject>,
-  DrizzleTableModel<Tombstone>,
-  NativeSubjectId,
-  NativeSessionId,
-  SQL
+> = ClockMapping<
+  Shared.SessionCleanupMapping<
+    DrizzleTableModel<Pending>,
+    DrizzleTableModel<Tombstone>,
+    NativeSubjectId,
+    NativeSessionId,
+    SQL
+  >
 >;

package/src/drizzle/sqlite-do-database.ts

@@ -41,6 +41,14 @@ export type Transaction<T extends AnyRelations = AnyRelations> = DatabaseValue<T
   readonly rollback: () => EffectTransactionRollbackError;
 };
 
+/** Construct a query handle inside an existing asynchronous SQL owner. */
+export const makeTransactionHandle = <T extends AnyRelations>(
+  database: DatabaseValue<T>,
+): Transaction<T> => ({
+  ...database,
+  rollback: () => new EffectTransactionRollbackError(),
+});
+
 /**
  * Keep the application's Drizzle query configuration and capture its SQL client.
  * Effect SQL owns storage.transaction, so cryptography may suspend before commit.

package/src/drizzle/sqlite-identity.ts

@@ -1,4 +1,4 @@
-import { withStorageValidation, NativeDatabase } from "@yielded/auth-persistence/Adapter";
+import { withStorageValidation } from "@yielded/auth-persistence/Adapter";
 import {
   ExternalIdentityMutation,
   type ExternalIdentity,
@@ -26,6 +26,7 @@ import {
   type IdentityTables,
   type SubjectProvisioningTables,
 } from "./model";
+import { NativeDatabase } from "./native-database";
 import { validateDrizzleStorage } from "./storage-validation";
 
 type ClosedQueryEffectHKT = QueryEffectHKTBase & { readonly context: never };
@@ -75,12 +76,6 @@ export const makeSqliteSubjectProvisioningServices = Effect.fnUntraced(function*
 
   const identifierTable = mapping.identifier.table;
 
-  const identifierNamespaceColumn = column(
-    identifierTable,
-    mapping.identifier.namespace,
-  ) as SQLiteColumn;
-
-  const identifierValueColumn = column(identifierTable, mapping.identifier.value) as SQLiteColumn;
   const subjectIdColumn = column(mapping.subject.table, mapping.subject.id) as SQLiteColumn;
 
   const findReceipt = Effect.fn("DrizzleSqliteIdentity.findReceipt")(function* (requestId: string) {
@@ -167,21 +162,8 @@ export const makeSqliteSubjectProvisioningServices = Effect.fnUntraced(function*
             Effect.flatMap((receipt) => {
               if (receipt !== undefined && receipt.fingerprint === fingerprint)
                 return Effect.succeed(receipt.subjectId as NativeId);
-              if (input.identifier === undefined) return IdentityConflict.make();
-
-              return db
-                .select({
-                  subjectId: column(identifierTable, mapping.identifier.subjectId) as SQLiteColumn,
-                })
-                .from(identifierTable as any)
-                .where(
-                  and(
-                    eq(identifierNamespaceColumn, input.identifier.namespace),
-                    eq(identifierValueColumn, input.identifier.value),
-                  ),
-                )
-                .limit(1)
-                .pipe(Effect.flatMap(() => IdentityConflict.make()));
+
+              return IdentityConflict.make();
             }),
           );
         },

package/src/drizzle/step-up-model.ts

@@ -1,6 +1,7 @@
 import type * as Shared from "@yielded/auth-persistence/Adapter";
 import type { SQL, Table } from "drizzle-orm";
 
+import type { ClockMapping } from "./native-clock";
 import type { DrizzleTableModel } from "./table-model";
 
 export {
@@ -8,13 +9,6 @@ export {
   requiredSessionStepUpConstraints,
 } from "@yielded/auth-persistence/Adapter";
 
-/** Distinct from login-pending storage. Snapshot is TEXT encoded by the core's
- * SessionStepUpIntent schema; it contains no Claims and needs no consumer decoder. */
-export type SessionStepUpIntentTables<
-  Intent extends Table,
-  NativeSubjectId,
-> = Shared.SessionStepUpIntentTables<DrizzleTableModel<Intent>, NativeSubjectId>;
-
 /** Fixed source discriminator is checked against every stored intent. A minimal
  * pure-signed installation does not provide dummy session or tombstone tables. */
 export type SessionStepUpSourceTables<
@@ -40,34 +34,16 @@ export type SessionStepUpMapping<
   Tombstone extends Table,
   NativeSubjectId,
   NativeSessionId,
-> = Shared.SessionStepUpMapping<
-  Claims,
-  DrizzleTableModel<Subject>,
-  DrizzleTableModel<Credential>,
-  DrizzleTableModel<Intent>,
-  DrizzleTableModel<Session>,
-  DrizzleTableModel<Tombstone>,
-  NativeSubjectId,
-  NativeSessionId
->;
-
-export type D1SessionStepUpMapping<
-  Claims,
-  Subject extends Table,
-  Credential extends Table,
-  Intent extends Table,
-  Session extends Table,
-  Tombstone extends Table,
-  NativeSubjectId,
-  NativeSessionId,
-> = Shared.D1SessionStepUpMapping<
-  Claims,
-  DrizzleTableModel<Subject>,
-  DrizzleTableModel<Credential>,
-  DrizzleTableModel<Intent>,
-  DrizzleTableModel<Session>,
-  DrizzleTableModel<Tombstone>,
-  NativeSubjectId,
-  NativeSessionId,
-  SQL
+> = ClockMapping<
+  Shared.SessionStepUpMapping<
+    Claims,
+    DrizzleTableModel<Subject>,
+    DrizzleTableModel<Credential>,
+    DrizzleTableModel<Intent>,
+    DrizzleTableModel<Session>,
+    DrizzleTableModel<Tombstone>,
+    NativeSubjectId,
+    NativeSessionId,
+    SQL
+  >
 >;

package/src/drizzle/storage-validation.ts

@@ -1,5 +1,4 @@
 import {
-  NativeDatabase,
   PersistenceMappingError,
   validateStorageBatch,
   type StorageValidation,
@@ -11,6 +10,8 @@ import { getTableConfig as getPgTableConfig, PgTable } from "drizzle-orm/pg-core
 import { Effect } from "effect";
 import { SqlClient } from "effect/sql/SqlClient";
 
+import { NativeDatabase } from "./native-database";
+
 /** Validate at acquisition using the root database supplied by the adapter. */
 export const validateDrizzleStorage = Effect.fnUntraced(
   function* (mapping: unknown) {

package/src/drizzle/totp-model.ts

@@ -1,83 +1,26 @@
-import type { SubjectId } from "@yielded/auth/Schema";
-import type {
-  AuthenticationRequirement,
-  PendingAuthenticationContext,
-} from "@yielded/auth/Sessions";
-import { type TotpPolicy, TotpPersistence } from "@yielded/auth/Totp";
-import type { InferInsertModel, InferSelectModel, SQL, Table } from "drizzle-orm";
+import type * as Shared from "@yielded/auth-persistence/Adapter";
+import { TotpPersistence } from "@yielded/auth/Totp";
+import type { SQL, Table } from "drizzle-orm";
 import { Effect, Layer } from "effect";
 
-import type { PersistenceMappingError } from "./model";
-export type TotpColumn<T extends Table> = Extract<keyof T["_"]["columns"], string>;
-export type TotpMappingSource<M, R = never> = M | Effect.Effect<M, PersistenceMappingError, R>;
+import type { DrizzleTableModel } from "./table-model";
+export { requiredTotpConstraints, type TotpMappingSource } from "@yielded/auth-persistence/Adapter";
+export type TotpColumn<T extends Table> = DrizzleTableModel<T>["column"];
 
-export const requiredTotpConstraints = {
-  factor: "unique(scope)",
-  credential: "unique(credentialId)",
-  subject: "unique(id)",
-} as const;
-
-/** A dedicated encrypted factor row plus the shared authentication credential authority.
- * factorEnabled is the consumer's TOTP requirement bit; central primary methods must
- * read it when choosing their AuthenticationRequirement. Other factor policy is untouched.
- * State JSON stores ciphertext and recovery digests only. The same table retains
- * domain-separated management command tombstones; retain them while command IDs
- * can be replayed. Encoders and current requirement decoding cannot suspend.
- */
-export interface TotpMapping<S extends Table, F extends Table, C extends Table, N> {
-  readonly moduleId: string;
-  readonly policy: TotpPolicy;
-  readonly constraints: typeof requiredTotpConstraints;
-  readonly subjectIds: {
-    readonly toNative: (id: SubjectId) => N;
-    readonly toSubject: (id: N) => SubjectId;
-  };
-  readonly subject: {
-    readonly table: S;
-    readonly id: TotpColumn<S>;
-    readonly securityRevision: TotpColumn<S>;
-    readonly factorEnabled: TotpColumn<S>;
-    readonly activeCondition: SQL;
-    readonly encodeEnabled: (enabled: boolean) => unknown;
-    readonly decodeRequirement: (row: InferSelectModel<S>) => AuthenticationRequirement;
-  };
-  readonly factor: {
-    readonly table: F;
-    readonly scope: TotpColumn<F>;
-    readonly state: TotpColumn<F>;
-    readonly version: TotpColumn<F>;
-    readonly encodeInsert: (value: {
-      readonly scope: string;
-      readonly state: string;
-      readonly version: string;
-    }) => InferInsertModel<F>;
-  };
-  readonly credential: {
-    readonly table: C;
-    readonly id: TotpColumn<C>;
-    readonly subjectId: TotpColumn<C>;
-    readonly revision: TotpColumn<C>;
-    readonly status: TotpColumn<C>;
-    readonly activeCondition: SQL;
-    readonly encodeStatus: (active: boolean) => unknown;
-    readonly encodeInsert: (value: {
-      readonly credentialId: string;
-      readonly subjectId: N;
-      readonly revision: string;
-      readonly active: boolean;
-    }) => InferInsertModel<C>;
-  };
-  /** Unix epoch milliseconds, evaluated again at the final conditional write. */
-  readonly engineNowMillis: SQL;
-  /** Required for reset-with-recovery-code. Must assert the exact unconsumed,
-   * unexpired, unexhausted pending flow, binding digest and original credential
-   * revisions. No request-supplied SQL or external I/O is accepted. */
-  readonly pendingCondition?: (target: PendingAuthenticationContext, subjectId: N) => SQL;
-}
-
-export interface D1TotpMapping {
-  readonly d1: { readonly primary: true };
-}
+export type TotpMapping<
+  S extends Table,
+  F extends Table,
+  C extends Table,
+  N,
+  P extends Table = Table,
+> = Shared.TotpMapping<
+  DrizzleTableModel<S>,
+  DrizzleTableModel<F>,
+  DrizzleTableModel<C>,
+  N,
+  DrizzleTableModel<P>,
+  SQL
+>;
 
 export interface TotpPersistenceServices {
   readonly totpPersistence: TotpPersistence["Service"];