@yielded/auth-persistence-drizzle 0.1.0-beta.24 → 0.1.0-beta.26

package/src/drizzle/password-prepared-state.ts

@@ -1,231 +0,0 @@
-import {
-  PasswordUnavailable,
-  PasswordAction,
-  PasswordCommandId,
-  PasswordCredentialSnapshot,
-  PasswordPreparedConfiguration,
-  PasswordPreparedIntentId,
-  PasswordPreparedReservation,
-  PasswordPreparedReset,
-  PasswordPreparedRequirement,
-  snapshotPasswordPreparedReservation,
-  snapshotPasswordPreparedReady,
-  encodePasswordPreparedReady,
-  type PasswordPreparedReady,
-  type PasswordPreparedMutation,
-  type PasswordPreparedPersistence,
-} from "@yielded/auth/Password";
-import { ProofBinding, ProofContinuationId, ProofPurpose } from "@yielded/auth/Proofs";
-import { SubjectId, TokenDigest } from "@yielded/auth/Schema";
-import {
-  SessionInvalidationWindow,
-  AuthenticationProof,
-  AuthenticationRequirement,
-  type AuthenticationRevision,
-} from "@yielded/auth/Sessions";
-import { DateTime, Effect, Redacted, Schema } from "effect";
-
-import { passwordSqlKernel } from "./password-sql";
-
-export const unavailable = () => PasswordUnavailable.make({});
-const Instant = Schema.Int.check(Schema.isBetween({ minimum: 0, maximum: 8640000000000000 }));
-const Label = Schema.NonEmptyString.check(Schema.isMaxLength(256));
-
-export const CompletionInput = Schema.Struct({
-  moduleId: Label,
-  purpose: ProofPurpose,
-  continuationId: ProofContinuationId,
-  continuationDigest: TokenDigest.check(Schema.isMaxLength(256)),
-  binding: ProofBinding,
-  nowMillis: Instant,
-});
-
-export const ContextInput = Schema.Struct({
-  moduleId: Label,
-  generation: PasswordPreparedConfiguration.fields.generation,
-  digest: TokenDigest.check(Schema.isMaxLength(256)),
-  nowMillis: Instant,
-});
-
-const ReserveInput = Schema.Struct({
-  moduleId: Label,
-  generation: PasswordPreparedConfiguration.fields.generation,
-  intentId: PasswordPreparedIntentId,
-  commandId: PasswordCommandId,
-  action: PasswordAction,
-  subjectId: SubjectId.check(Schema.isMaxLength(256)),
-  nowMillis: Instant,
-  policy: PasswordPreparedConfiguration,
-  invalidation: SessionInvalidationWindow,
-  reset: Schema.optionalKey(PasswordPreparedReset),
-  completion: Schema.optionalKey(CompletionInput),
-});
-
-const reserveCodec = Schema.fromJsonString(ReserveInput);
-
-export const snapshotReserve = (input: Parameters<PasswordPreparedPersistence["reserve"]>[0]) =>
-  Schema.encodeEffect(reserveCodec)(input).pipe(
-    Effect.flatMap(Schema.decodeEffect(Schema.String.check(Schema.isMaxLength(131072)))),
-    Effect.flatMap(Schema.decodeEffect(reserveCodec)),
-    Effect.mapError(unavailable),
-  );
-
-const reservationCodec = Schema.fromJsonString(PasswordPreparedReservation);
-
-export const encodeReservation = (input: PasswordPreparedReservation) =>
-  snapshotPasswordPreparedReservation(input).pipe(
-    Effect.flatMap(Schema.encodeEffect(reservationCodec)),
-    Effect.mapError(unavailable),
-  );
-
-export const decodeReservation = (input: string) =>
-  Schema.decodeEffect(Schema.String.check(Schema.isMaxLength(131072)))(input).pipe(
-    Effect.flatMap(Schema.decodeEffect(reservationCodec)),
-    Effect.flatMap(snapshotPasswordPreparedReservation),
-    Effect.mapError(unavailable),
-  );
-
-export const reservationOf = (ready: PasswordPreparedReady): PasswordPreparedReservation => {
-  const {
-    replacement: _replacement,
-    challenge: _challenge,
-    baseEvidence: _evidence,
-    digest: _digest,
-    issuedAtMillis: _issued,
-    expiresAtMillis: _expires,
-    ...reservation
-  } = ready;
-
-  return { ...reservation, _tag: "Preparing" };
-};
-
-export const sameRevision = (a: AuthenticationRevision, b: AuthenticationRevision) =>
-  a.subjectId === b.subjectId &&
-  a.securityRevision === b.securityRevision &&
-  a.credentials.length === b.credentials.length &&
-  a.credentials.every((c) =>
-    b.credentials.some((d) => c.credentialId === d.credentialId && c.revision === d.revision),
-  );
-
-const scopeJson = Schema.encodeSync(Schema.fromJsonString(Schema.Array(Schema.String)));
-const invalidationJson = Schema.encodeSync(Schema.fromJsonString(SessionInvalidationWindow));
-const proofJson = Schema.encodeSync(Schema.fromJsonString(AuthenticationProof));
-
-export const identifierScope = (
-  record: Pick<PasswordPreparedReservation, "credential" | "revision">,
-) =>
-  record.credential === undefined
-    ? scopeJson(["prepared-subject", record.revision.subjectId])
-    : scopeJson([
-        "prepared-identifier",
-        record.credential.identifier.namespace,
-        record.credential.identifier.value,
-      ]);
-
-const credentialCodec = Schema.fromJsonString(PasswordCredentialSnapshot);
-
-const sameCredential = Effect.fn("DrizzlePasswordPrepared.sameCredential")(function* (
-  a: PasswordPreparedReservation["credential"],
-  b: PasswordPreparedReservation["credential"],
-) {
-  if (a === undefined || b === undefined) return a === b;
-
-  return (
-    (yield* Schema.encodeEffect(credentialCodec)(a).pipe(Effect.mapError(unavailable))) ===
-    (yield* Schema.encodeEffect(credentialCodec)(b).pipe(Effect.mapError(unavailable)))
-  );
-});
-
-const requirementJson = Schema.encodeSync(
-  Schema.fromJsonString(AuthenticationRequirement.fields.alternatives),
-);
-
-const requirementShape = (value: AuthenticationRequirement) => requirementJson(value.alternatives);
-
-export const snapshotMutation = Effect.fn("DrizzlePasswordPrepared.snapshotMutation")(function* (
-  input: PasswordPreparedMutation,
-) {
-  const intent = yield* snapshotPasswordPreparedReady(input.intent);
-  const mutation = yield* passwordSqlKernel.snapshotMutationInput(input.mutation);
-
-  const capturedRequirement = yield* Schema.decodeEffect(PasswordPreparedRequirement)(
-    input.capturedRequirement,
-  ).pipe(Effect.mapError(unavailable));
-
-  const currentRequirement = yield* Schema.decodeEffect(PasswordPreparedRequirement)(
-    input.currentRequirement,
-  ).pipe(Effect.mapError(unavailable));
-
-  const original = intent.challenge,
-    actual = mutation.authorization.challenge;
-
-  if (
-    mutation.moduleId !== intent.moduleId ||
-    mutation.commandId !== intent.commandId ||
-    !sameRevision(mutation.expectedRevision, intent.revision) ||
-    !(yield* sameCredential(mutation.credential, intent.credential)) ||
-    Redacted.value(mutation.replacement.verifier) !== Redacted.value(intent.replacement.verifier) ||
-    mutation.replacement.normalization !== intent.replacement.normalization ||
-    actual.moduleId !== original.moduleId ||
-    actual.action !== original.action ||
-    actual.commandId !== original.commandId ||
-    actual.bindingDigest !== original.bindingDigest ||
-    actual.targetCredentialId !== original.targetCredentialId ||
-    !sameRevision(actual.revision, original.revision) ||
-    invalidationJson(mutation.invalidation) !== invalidationJson(intent.invalidation) ||
-    requirementShape(capturedRequirement) !== requirementShape(intent.capturedRequirement) ||
-    capturedRequirement.maximumAgeMillis > intent.capturedRequirement.maximumAgeMillis
-  )
-    return yield* unavailable();
-
-  return { intent, mutation, capturedRequirement, currentRequirement, nowMillis: input.nowMillis };
-});
-
-export const evidenceCurrent = (
-  input: PasswordPreparedMutation,
-  current: AuthenticationRequirement,
-  now: number,
-) => {
-  const requirements = [
-    input.mutation.authorization.requirement,
-    input.intent.capturedRequirement,
-    input.capturedRequirement,
-    current,
-    input.currentRequirement,
-  ];
-
-  if (
-    requirementShape(input.currentRequirement) !== requirementShape(current) ||
-    input.currentRequirement.maximumAgeMillis > current.maximumAgeMillis ||
-    now < input.intent.issuedAtMillis ||
-    now >= input.intent.expiresAtMillis ||
-    !requirements.every((requirement) =>
-      passwordSqlKernel.evidenceSatisfiedAt(
-        input.mutation.authorization.evidence,
-        requirement,
-        now,
-      ),
-    )
-  )
-    return false;
-  const age = Math.min(...requirements.map((requirement) => requirement.maximumAgeMillis));
-
-  return (input.intent.baseEvidence?.proofs ?? []).every((proof) => {
-    const verified = DateTime.toEpochMillis(proof.verifiedAt);
-
-    return (
-      verified <= now &&
-      now - verified < age &&
-      input.mutation.authorization.evidence.proofs.some(
-        (actual) => proofJson(actual) === proofJson(proof),
-      )
-    );
-  });
-};
-
-export const sameReady = Effect.fn("DrizzlePasswordPrepared.sameReady")(function* (
-  a: PasswordPreparedReady,
-  b: PasswordPreparedReady,
-) {
-  return (yield* encodePasswordPreparedReady(a)) === (yield* encodePasswordPreparedReady(b));
-});

package/src/drizzle/password-prepared-target.ts

@@ -1,169 +0,0 @@
-import {
-  type NativeDatabase,
-  CurrentPasswordPreparedTransaction,
-  PasswordPreparedPostconditions,
-  PasswordPreparedJournalGuards,
-  type PasswordPreparedPostcondition,
-} from "@yielded/auth-persistence/Adapter";
-import {
-  coordinateCommit,
-  hasCommitScope,
-  type PreparedCommit,
-  LifecycleHooks,
-} from "@yielded/auth/Hooks";
-import { PasswordUnavailable, type PasswordPreparedPersistence } from "@yielded/auth/Password";
-/* oxlint-disable no-explicit-any -- concrete driver modules restore native table/database types. */
-import { type Context, Cause, Effect, Layer } from "effect";
-import type * as SqlError from "effect/sql/SqlError";
-
-import { makeSqlPasswordPreparedPersistence } from "./password-prepared-sql";
-import { CurrentPasswordSql } from "./password-sql";
-import type { PasswordSqlDatabase } from "./password-sql";
-import {
-  passwordOptions,
-  type PasswordTargetConfiguration,
-  type PasswordCoordinatorError,
-} from "./password-target";
-import { validateDrizzleStorage } from "./storage-validation";
-
-export const makeTargetPasswordPreparedPersistenceServices = (
-  mapping: any,
-  configuration: PasswordTargetConfiguration,
-  proofMapping?: any,
-) =>
-  Effect.gen(function* () {
-    return {
-      passwordPreparedPersistence: yield* makeSqlPasswordPreparedPersistence(
-        mapping,
-        passwordOptions(configuration, proofMapping),
-      ),
-    };
-  });
-
-export const coordinateTargetPasswordPreparedPersistence = <Transaction, A, E, R>(
-  database: {
-    readonly transaction: <Out, Err, Env>(
-      body: (transaction: Transaction) => Effect.Effect<Out, Err, Env>,
-    ) => Effect.Effect<Out, Err | SqlError.SqlError, Env>;
-  },
-  mapping: any,
-  configuration: PasswordTargetConfiguration,
-  proofMapping: any | undefined,
-  owner: (
-    transaction: Transaction,
-    services: { readonly passwordPreparedPersistence: PasswordPreparedPersistence },
-  ) => Effect.Effect<A, E, R>,
-): Effect.Effect<A, PasswordCoordinatorError<E>, R | LifecycleHooks | NativeDatabase> =>
-  Effect.gen(function* () {
-    const hooks = yield* LifecycleHooks;
-
-    if (yield* hasCommitScope) return yield* PasswordUnavailable.make({});
-    yield* configuration.coordinatorGuard ?? configuration.standaloneGuard;
-
-    yield* validateDrizzleStorage({ ...mapping, proof: proofMapping }).pipe(
-      Effect.mapError(() => PasswordUnavailable.make({})),
-    );
-
-    const result = yield* coordinateCommit(
-      () =>
-        database.transaction((transaction) =>
-          Effect.gen(function* () {
-            const guards: Array<PreparedCommit<void>> = [];
-            const postconditions: Array<PasswordPreparedPostcondition> = [];
-            let poisoned = false;
-            let acceptingPostconditions = true;
-
-            const services = yield* makeSqlPasswordPreparedPersistence(
-              mapping,
-              passwordOptions(configuration, proofMapping, true),
-            ).pipe(
-              Effect.provideService(
-                CurrentPasswordSql,
-                transaction as unknown as PasswordSqlDatabase,
-              ),
-            );
-
-            const protect = <Out, Err, Env>(effect: Effect.Effect<Out, Err, Env>) =>
-              effect.pipe(
-                Effect.onError(() =>
-                  Effect.sync(() => {
-                    poisoned = true;
-                  }),
-                ),
-              );
-
-            const value = yield* owner(transaction, {
-              passwordPreparedPersistence: {
-                reserve: (input, prepare) => protect(services.reserve(input, prepare)),
-                publishReady: (input, prepare) => protect(services.publishReady(input, prepare)),
-                context: (input) => protect(services.context(input)),
-                complete: (input, prepare) => protect(services.complete(input, prepare)),
-                resetWithProof: (input, prepare) =>
-                  protect(services.resetWithProof(input, prepare)),
-                cancel: (input, prepare) => protect(services.cancel(input, prepare)),
-                cleanup: (input, prepare) => protect(services.cleanup(input, prepare)),
-              },
-            }).pipe(
-              Effect.provideService(PasswordPreparedJournalGuards, {
-                register: (guard) => {
-                  if (!acceptingPostconditions) return false;
-                  guards.push(guard);
-
-                  return true;
-                },
-              }),
-              Effect.provideService(PasswordPreparedPostconditions, {
-                register: (check) => {
-                  if (!acceptingPostconditions) return false;
-                  postconditions.push(check);
-
-                  return true;
-                },
-              }),
-              Effect.ensuring(
-                Effect.sync(() => {
-                  acceptingPostconditions = false;
-                }),
-              ),
-            );
-
-            if (poisoned) return yield* PasswordUnavailable.make({});
-            for (const guard of guards) {
-              const status = yield* Effect.result(guard.read);
-
-              if (status._tag === "Success" || status.failure._tag !== "CommitPending")
-                return yield* PasswordUnavailable.make({});
-            }
-
-            for (const check of postconditions)
-              yield* check.pipe(
-                Effect.provideService(
-                  CurrentPasswordPreparedTransaction,
-                  transaction as unknown as PasswordSqlDatabase,
-                ),
-                Effect.catchCause((cause) =>
-                  Effect.failCause(Cause.map(cause, () => PasswordUnavailable.make({}))),
-                ),
-              );
-
-            return value;
-          }),
-        ),
-      { mode: configuration.mode },
-    ).pipe(Effect.provideService(LifecycleHooks, hooks));
-
-    return result.value;
-  });
-
-export const passwordPreparedPersistenceLayer = <Id, E, R>(
-  tag: Context.Key<Id, PasswordPreparedPersistence>,
-  services: Effect.Effect<
-    { readonly passwordPreparedPersistence: PasswordPreparedPersistence },
-    E,
-    R
-  >,
-) =>
-  Layer.effect(
-    tag,
-    Effect.map(services, (value) => value.passwordPreparedPersistence),
-  );