@yielded/auth-persistence-drizzle 0.1.0-beta.25 → 0.1.0-beta.26

package/src/drizzle/password-model.ts

@@ -1,13 +1,12 @@
 import type * as Shared from "@yielded/auth-persistence/Adapter";
 import type { SQL, Table } from "drizzle-orm";
 
+import type { ClockMapping } from "./native-clock";
 import type { DrizzleTableModel } from "./table-model";
 
 export {
   type RequiredPasswordConstraints,
   requiredPasswordConstraints,
-  type PasswordConstraintClassifier,
-  type PasswordRegistrationState,
   type PasswordRegistrationIntent,
   type RequiredPasswordRegistrationConstraints,
   requiredPasswordRegistrationConstraints,
@@ -41,52 +40,23 @@ export type PasswordCredentialTable<
   NativeSubjectId
 >;
 
-export type PasswordCommandTable<Command extends Table> = Shared.PasswordCommandTable<
-  DrizzleTableModel<Command>
->;
-
-export type PasswordD1Clock = Shared.PasswordD1Clock<SQL>;
-
 export type PasswordPersistenceMapping<
   Subject extends Table,
   Identifier extends Table,
   Credential extends Table,
   AuthorityCredential extends Table,
-  Command extends Table,
-  NativeSubjectId,
-> = Shared.PasswordPersistenceMapping<
-  DrizzleTableModel<Subject>,
-  DrizzleTableModel<Identifier>,
-  DrizzleTableModel<Credential>,
-  DrizzleTableModel<AuthorityCredential>,
-  DrizzleTableModel<Command>,
   NativeSubjectId,
-  SQL
+> = ClockMapping<
+  Shared.PasswordPersistenceMapping<
+    DrizzleTableModel<Subject>,
+    DrizzleTableModel<Identifier>,
+    DrizzleTableModel<Credential>,
+    DrizzleTableModel<AuthorityCredential>,
+    NativeSubjectId,
+    SQL
+  >
 >;
 
-export type D1PasswordPersistenceMapping<
-  Subject extends Table,
-  Identifier extends Table,
-  Credential extends Table,
-  AuthorityCredential extends Table,
-  Command extends Table,
-  NativeSubjectId,
-> = Shared.D1PasswordPersistenceMapping<
-  DrizzleTableModel<Subject>,
-  DrizzleTableModel<Identifier>,
-  DrizzleTableModel<Credential>,
-  DrizzleTableModel<AuthorityCredential>,
-  DrizzleTableModel<Command>,
-  NativeSubjectId,
-  SQL
->;
-
-export type PasswordRegistrationTable<
-  Registration,
-  Request extends Table,
-  NativeSubjectId,
-> = Shared.PasswordRegistrationTable<Registration, DrizzleTableModel<Request>, NativeSubjectId>;
-
 export type PasswordRegistrationProvisioning<
   Registration,
   Subject extends Table,
@@ -103,7 +73,6 @@ export type PasswordRegistrationMapping<
   Identifier extends Table,
   Credential extends Table,
   AuthorityCredential extends Table,
-  Request extends Table,
   NativeSubjectId,
 > = Shared.PasswordRegistrationMapping<
   Registration,
@@ -111,7 +80,6 @@ export type PasswordRegistrationMapping<
   DrizzleTableModel<Identifier>,
   DrizzleTableModel<Credential>,
   DrizzleTableModel<AuthorityCredential>,
-  DrizzleTableModel<Request>,
   NativeSubjectId,
   SQL
 >;
@@ -121,7 +89,6 @@ export type AnyPasswordPersistenceMapping = PasswordPersistenceMapping<
   Table,
   Table,
   Table,
-  Table,
   unknown
 >;
 
@@ -131,6 +98,5 @@ export type AnyPasswordRegistrationMapping<Registration = unknown> = PasswordReg
   Table,
   Table,
   Table,
-  Table,
   unknown
 >;

package/src/drizzle/password-target.ts

@@ -1,262 +1,108 @@
 import {
-  CurrentPasswordPreparedTransaction,
-  type NativeDatabase,
-  type PasswordPreparedPostcondition,
-  PasswordPreparedPostconditions,
+  makeNativePasswordServices,
+  makeNativePasswordRegistrationServices,
+  requireStandalone,
+  type AnyPasswordPersistenceMapping as SharedPasswordMapping,
+  type PasswordRegistrationAuthority,
 } from "@yielded/auth-persistence/Adapter";
-import {
-  coordinateCommit,
-  hasCommitScope,
-  LifecycleHooks,
-  type HookConfigurationError,
-} from "@yielded/auth/Hooks";
-import { PasswordUnavailable, PasswordPersistence } from "@yielded/auth/Password";
-/* oxlint-disable no-explicit-any -- public driver wrappers restore concrete Drizzle generics. */
-import { Cause, type Context, Effect, Layer } from "effect";
-import type * as SqlError from "effect/sql/SqlError";
+import { PasswordPersistence, PasswordUnavailable } from "@yielded/auth/Password";
+import { type Context, Effect, Layer } from "effect";
 
+import { nativeClock } from "./native-clock";
+import type { NativeDatabaseHandle } from "./native-database";
 import {
-  makeSqlPasswordRegistrationAuthority,
-  type PasswordRegistrationAuthority,
-  type PasswordRegistrationConfiguration,
-} from "./password-registration";
-import {
-  CurrentPasswordSql,
-  makeSqlPasswordPersistence,
-  type PasswordSqlConfiguration,
-  type PasswordSqlDatabase,
-  type PasswordSqlQuery,
-} from "./password-sql";
-import type { ProofTargetConfiguration } from "./proof-target";
-import { sqlClientStandaloneGuard, type TransactionService } from "./standalone-guard";
+  nativeTarget,
+  coordinateNativeTarget,
+  type NativeTargetConfiguration,
+} from "./native-target";
+import type {
+  AnyPasswordPersistenceMapping,
+  AnyPasswordRegistrationMapping,
+} from "./password-model";
+import type { AnyProofPersistenceMapping } from "./proof-model";
+import { nativeProofMapping } from "./proof-target";
 import { validateDrizzleStorage } from "./storage-validation";
 
-export interface PasswordTargetConfiguration {
-  readonly mode: "interactive" | "synchronous";
-  readonly locking: boolean;
-  readonly standaloneGuard: Effect.Effect<void, PasswordUnavailable>;
-  readonly coordinatorGuard?: Effect.Effect<void, PasswordUnavailable>;
-  readonly insertIfAbsent: (
-    query: PasswordSqlQuery,
-    selfKey: string,
-    selfValue: unknown,
-  ) => PasswordSqlQuery;
-  readonly generatedSubjectRows: (query: PasswordSqlQuery) => PasswordSqlQuery;
-  readonly proof: ProofTargetConfiguration;
-}
-
-interface TransactionOwner<Transaction> {
-  readonly transaction: <A, E, R>(
-    body: (transaction: Transaction) => Effect.Effect<A, E, R>,
-  ) => Effect.Effect<A, E | SqlError.SqlError, R>;
-}
-
-export type PasswordCoordinatorError<E> =
-  | E
-  | PasswordUnavailable
-  | HookConfigurationError
-  | SqlError.SqlError;
-
-export const sqlClientPasswordStandaloneGuard = (
-  service: TransactionService | undefined,
-): Effect.Effect<void, PasswordUnavailable> =>
-  sqlClientStandaloneGuard(service, () => PasswordUnavailable.make({}));
-
-export const passwordOptions = (
-  configuration: PasswordTargetConfiguration,
-  proofMapping?: any,
-  coordinated = false,
-): PasswordSqlConfiguration => ({
-  mode: configuration.mode,
-  locking: configuration.locking,
+const unavailable = () => PasswordUnavailable.make({});
 
-  standaloneGuard: !coordinated ? configuration.standaloneGuard : Effect.void,
-  insertIfAbsent: configuration.insertIfAbsent,
-  coordinated,
-  ...(proofMapping === undefined
-    ? {}
-    : {
-        proof: {
-          mapping: proofMapping,
-          configuration: {
-            mode: configuration.proof.mode,
-            locking: configuration.proof.locking,
+export const sqlClientPasswordStandaloneGuard = (marker: Parameters<typeof requireStandalone>[1]) =>
+  requireStandalone(unavailable, marker);
 
-            standaloneGuard: Effect.void,
-
-            coordinated,
-            insertIfAbsent: configuration.proof.insertIfAbsent,
-          },
-        },
-      }),
+const mapped = (value: AnyPasswordPersistenceMapping): SharedPasswordMapping => ({
+  ...value,
+  clock: nativeClock(value.clock),
 });
 
-const registrationOptions = (
-  configuration: PasswordTargetConfiguration,
-  coordinated = false,
-): PasswordRegistrationConfiguration => ({
-  mode: configuration.mode,
-  locking: configuration.locking,
-
-  standaloneGuard: !coordinated ? configuration.standaloneGuard : Effect.void,
-  generatedSubjectRows: configuration.generatedSubjectRows,
-  coordinated,
+export const makeTargetPasswordPersistenceServices = Effect.fnUntraced(function* (
+  mapping: AnyPasswordPersistenceMapping,
+  configuration: NativeTargetConfiguration,
+  proofs?: AnyProofPersistenceMapping,
+) {
+  yield* validateDrizzleStorage(mapping).pipe(Effect.mapError(unavailable));
+  if (proofs !== undefined)
+    yield* validateDrizzleStorage(proofs).pipe(Effect.mapError(unavailable));
+  if (
+    configuration.mode === "batch" &&
+    (mapping.d1?.primary !== true || (proofs !== undefined && proofs.d1?.primary !== true))
+  )
+    return yield* unavailable();
+  const target = yield* nativeTarget(configuration);
+
+  return yield* target.provide(
+    makeNativePasswordServices(
+      target.tables,
+      mapped(mapping),
+      proofs === undefined ? undefined : nativeProofMapping(proofs),
+    ),
+  );
 });
 
-export const makeTargetPasswordPersistenceServices = (
-  mapping: any,
-  configuration: PasswordTargetConfiguration,
-  proofMapping?: any,
-) =>
-  Effect.gen(function* () {
-    return {
-      passwordPersistence: yield* makeSqlPasswordPersistence(
-        mapping,
-        passwordOptions(configuration, proofMapping),
-      ),
-    };
-  });
+export const makeTargetPasswordRegistrationServices = Effect.fnUntraced(function* <Registration>(
+  mapping: AnyPasswordRegistrationMapping<Registration>,
+  configuration: NativeTargetConfiguration,
+) {
+  yield* validateDrizzleStorage(mapping).pipe(Effect.mapError(unavailable));
+  const target = yield* nativeTarget(configuration);
 
-export const makeTargetPasswordRegistrationServices = <Registration>(
-  mapping: any,
-  configuration: PasswordTargetConfiguration,
-) =>
-  Effect.gen(function* () {
-    return {
-      registrationAuthority: yield* makeSqlPasswordRegistrationAuthority<Registration>(
-        mapping,
-        registrationOptions(configuration),
-      ),
-    };
-  });
+  return yield* target.provide(
+    makeNativePasswordRegistrationServices(target.tables, mapping, target.batch),
+  );
+});
 
-/** Native transaction acquisition exposes SqlError; caller errors propagate unchanged. */
 export const coordinateTargetPasswordPersistence = <Transaction, A, E, R>(
-  database: TransactionOwner<Transaction>,
-  mapping: any,
-  configuration: PasswordTargetConfiguration,
-  proofMapping: any | undefined,
-  owner: (
+  database: NativeDatabaseHandle,
+  mapping: AnyPasswordPersistenceMapping,
+  configuration: NativeTargetConfiguration,
+  body: (
     transaction: Transaction,
     services: { readonly passwordPersistence: PasswordPersistence["Service"] },
   ) => Effect.Effect<A, E, R>,
-): Effect.Effect<A, PasswordCoordinatorError<E>, R | LifecycleHooks | NativeDatabase> =>
-  Effect.gen(function* (): Effect.fn.Return<
-    A,
-    PasswordCoordinatorError<E>,
-    R | LifecycleHooks | NativeDatabase
-  > {
-    const hooks = yield* LifecycleHooks;
-
-    if (yield* hasCommitScope) return yield* PasswordUnavailable.make({});
-    yield* configuration.coordinatorGuard ?? configuration.standaloneGuard;
-
-    yield* validateDrizzleStorage({ ...mapping, proof: proofMapping }).pipe(
-      Effect.mapError(() => PasswordUnavailable.make({})),
-    );
-
-    const result = yield* coordinateCommit(
-      () =>
-        database.transaction((transaction) =>
-          Effect.gen(function* () {
-            const postconditions: Array<PasswordPreparedPostcondition> = [];
-            let acceptingPostconditions = true;
-
-            const value = yield* owner(transaction, {
-              passwordPersistence: yield* makeSqlPasswordPersistence(
-                mapping,
-                passwordOptions(configuration, proofMapping, true),
-              ).pipe(
-                Effect.provideService(
-                  CurrentPasswordSql,
-                  transaction as unknown as PasswordSqlDatabase,
-                ),
-              ),
-            }).pipe(
-              Effect.provideService(PasswordPreparedPostconditions, {
-                register: (check) => {
-                  if (!acceptingPostconditions) return false;
-                  postconditions.push(check);
-
-                  return true;
-                },
-              }),
-              Effect.ensuring(
-                Effect.sync(() => {
-                  acceptingPostconditions = false;
-                }),
-              ),
-            );
-
-            // Application work in this transaction must not change what the
-            // password mutations committed to; a failure here rolls back both.
-            for (const check of postconditions)
-              yield* check.pipe(
-                Effect.provideService(
-                  CurrentPasswordPreparedTransaction,
-                  transaction as unknown as PasswordSqlDatabase,
-                ),
-                Effect.catchCause((cause) =>
-                  Effect.failCause(Cause.map(cause, () => PasswordUnavailable.make({}))),
-                ),
-              );
-
-            return value;
-          }),
-        ),
-      { mode: configuration.mode },
-    ).pipe(Effect.provideService(LifecycleHooks, hooks));
-
-    return result.value;
-  });
+  proofs?: AnyProofPersistenceMapping,
+) =>
+  coordinateNativeTarget(
+    unavailable,
+    database,
+    configuration,
+    makeTargetPasswordPersistenceServices(mapping, configuration, proofs),
+    body,
+  );
 
 export const coordinateTargetPasswordRegistration = <Registration, Transaction, A, E, R>(
-  database: TransactionOwner<Transaction>,
-  mapping: any,
-  configuration: PasswordTargetConfiguration,
-  owner: (
+  database: NativeDatabaseHandle,
+  mapping: AnyPasswordRegistrationMapping<Registration>,
+  configuration: NativeTargetConfiguration,
+  body: (
     transaction: Transaction,
-    services: {
-      readonly registrationAuthority: PasswordRegistrationAuthority<Registration>;
-    },
+    services: { readonly registrationAuthority: PasswordRegistrationAuthority<Registration> },
   ) => Effect.Effect<A, E, R>,
-): Effect.Effect<A, PasswordCoordinatorError<E>, R | LifecycleHooks | NativeDatabase> =>
-  Effect.gen(function* (): Effect.fn.Return<
-    A,
-    PasswordCoordinatorError<E>,
-    R | LifecycleHooks | NativeDatabase
-  > {
-    const hooks = yield* LifecycleHooks;
-
-    if (yield* hasCommitScope) return yield* PasswordUnavailable.make({});
-    yield* configuration.coordinatorGuard ?? configuration.standaloneGuard;
-
-    yield* validateDrizzleStorage(mapping).pipe(
-      Effect.mapError(() => PasswordUnavailable.make({})),
-    );
-
-    const result = yield* coordinateCommit(
-      () =>
-        database.transaction((transaction) =>
-          Effect.gen(function* () {
-            return yield* owner(transaction, {
-              registrationAuthority: yield* makeSqlPasswordRegistrationAuthority<Registration>(
-                mapping,
-                registrationOptions(configuration, true),
-              ).pipe(
-                Effect.provideService(
-                  CurrentPasswordSql,
-                  transaction as unknown as PasswordSqlDatabase,
-                ),
-              ),
-            });
-          }),
-        ),
-      { mode: configuration.mode },
-    ).pipe(Effect.provideService(LifecycleHooks, hooks));
-
-    return result.value;
-  });
+) =>
+  coordinateNativeTarget(
+    unavailable,
+    database,
+    configuration,
+    makeTargetPasswordRegistrationServices(mapping, configuration),
+    body,
+  );
 
 export const passwordPersistenceLayer = <E, R>(
   services: Effect.Effect<{ readonly passwordPersistence: PasswordPersistence["Service"] }, E, R>,
@@ -267,7 +113,7 @@ export const passwordPersistenceLayer = <E, R>(
   );
 
 export const passwordRegistrationLayer = <Id, Registration, E, R>(
-  tag: Context.Key<Id, PasswordRegistrationAuthority<Registration>>,
+  target: Context.Key<Id, PasswordRegistrationAuthority<Registration>>,
   services: Effect.Effect<
     { readonly registrationAuthority: PasswordRegistrationAuthority<Registration> },
     E,
@@ -275,6 +121,6 @@ export const passwordRegistrationLayer = <Id, Registration, E, R>(
   >,
 ) =>
   Layer.effect(
-    tag,
+    target,
     Effect.map(services, (value) => value.registrationAuthority),
   );

package/src/drizzle/pg-identity.ts

@@ -1,4 +1,4 @@
-import { withStorageValidation, NativeDatabase } from "@yielded/auth-persistence/Adapter";
+import { withStorageValidation } from "@yielded/auth-persistence/Adapter";
 import {
   ExternalIdentityMutation,
   IdentityConflict,
@@ -25,7 +25,7 @@ import {
   type IdentityTables,
   type SubjectProvisioningTables,
 } from "./model";
-import { nativeDatabase } from "./native-database";
+import { NativeDatabase, nativeDatabase } from "./native-database";
 import { Database as DatabaseService } from "./pg-database";
 import { validateDrizzleStorage } from "./storage-validation";
 
@@ -62,8 +62,6 @@ export const makePgSubjectProvisioningServices = Effect.fnUntraced(function* <
   const requestFingerprintColumn = column(requestTable, mapping.provisioningRequest.fingerprint);
   const requestSubjectColumn = column(requestTable, mapping.provisioningRequest.subjectId);
   const identifierTable = mapping.identifier.table;
-  const identifierNamespaceColumn = column(identifierTable, mapping.identifier.namespace);
-  const identifierValueColumn = column(identifierTable, mapping.identifier.value);
 
   const findReceipt = Effect.fn("DrizzlePgIdentity.findReceipt")(function* (requestId: string) {
     const rows = yield* db
@@ -151,21 +149,8 @@ export const makePgSubjectProvisioningServices = Effect.fnUntraced(function* <
               if (receipt !== undefined && receipt.fingerprint === fingerprint) {
                 return Effect.succeed(receipt.subjectId as NativeId);
               }
-              if (input.identifier === undefined) return IdentityConflict.make();
-
-              return db
-                .select({
-                  subjectId: column(identifierTable, mapping.identifier.subjectId) as PgColumn,
-                })
-                .from(identifierTable as any)
-                .where(
-                  and(
-                    eq(identifierNamespaceColumn, input.identifier.namespace),
-                    eq(identifierValueColumn, input.identifier.value),
-                  ),
-                )
-                .limit(1)
-                .pipe(Effect.flatMap(() => IdentityConflict.make()));
+
+              return IdentityConflict.make();
             }),
           );
         },

package/src/drizzle/phone-drivers.ts

@@ -0,0 +1,142 @@
+import type { LifecycleHooks } from "@yielded/auth/Hooks";
+import {
+  PhonePersistence,
+  PhoneSignInTargets,
+  type PhoneConfigurationError,
+  type PhoneOtpUnavailable,
+} from "@yielded/auth/PhoneOtp";
+import type { Table } from "drizzle-orm";
+import { type Context, Effect, type Crypto } from "effect";
+
+import type { NativeDriverDatabase, NativeDriverTransaction } from "./driver-types";
+import { NativeDatabase, nativeDatabase } from "./native-database";
+import type { NativeTargetConfiguration } from "./native-target";
+import type { AnyPhoneMapping, PhoneMapping } from "./phone-model";
+import {
+  coordinateTargetPhonePersistence,
+  makeTargetPhonePersistenceServices,
+} from "./phone-target";
+import type { SuppliedService } from "./SuppliedService";
+
+/** Physical driver selection; the phone workflow has one implementation.
+ * Erase only foreign table/ID callback variance at the validated mapping boundary;
+ * decoded phone and subject values still pass through their owning codecs. */
+export const makePhoneTarget = <DatabaseId, D extends NativeDriverDatabase>(
+  databaseService: Context.Service<DatabaseId, D>,
+  configuration: NativeTargetConfiguration,
+) => {
+  function coordinatePhonePersistence<
+    Database extends D,
+    Subject extends Table,
+    Identifier extends Table,
+    Credential extends Table,
+    Proof extends Table,
+    NativeId,
+    A,
+    E,
+    R,
+    DE,
+    DR,
+  >(
+    acquire: Effect.Effect<Database, DE, DR>,
+    options: {
+      readonly mapping: PhoneMapping<Subject, Identifier, Credential, Proof, NativeId>;
+      readonly transaction?: never;
+    },
+    body: Effect.Effect<A, E, R>,
+  ): Effect.Effect<
+    A,
+    E | DE | PhoneOtpUnavailable | PhoneConfigurationError,
+    Exclude<R, PhonePersistence | PhoneSignInTargets> | DR | LifecycleHooks | Crypto.Crypto
+  >;
+  function coordinatePhonePersistence<
+    Database extends D,
+    Subject extends Table,
+    Identifier extends Table,
+    Credential extends Table,
+    Proof extends Table,
+    NativeId,
+    A,
+    E,
+    R,
+    DE,
+    DR,
+    TxId,
+    TxShape,
+  >(
+    acquire: Effect.Effect<Database, DE, DR>,
+    options: {
+      readonly mapping: PhoneMapping<Subject, Identifier, Credential, Proof, NativeId>;
+      readonly transaction: SuppliedService<
+        TxId,
+        NoInfer<NativeDriverTransaction<Database>>,
+        TxShape
+      >;
+    },
+    body: Effect.Effect<A, E, R>,
+  ): Effect.Effect<
+    A,
+    E | DE | PhoneOtpUnavailable | PhoneConfigurationError,
+    Exclude<R, PhonePersistence | PhoneSignInTargets | TxId> | DR | LifecycleHooks | Crypto.Crypto
+  >;
+  function coordinatePhonePersistence<
+    Database extends D,
+    Subject extends Table,
+    Identifier extends Table,
+    Credential extends Table,
+    Proof extends Table,
+    NativeId,
+    A,
+    E,
+    R,
+    DE,
+    DR,
+    TxId,
+    TxShape,
+  >(
+    acquire: Effect.Effect<Database, DE, DR>,
+    options: {
+      readonly mapping: PhoneMapping<Subject, Identifier, Credential, Proof, NativeId>;
+      readonly transaction?: SuppliedService<
+        TxId,
+        NoInfer<NativeDriverTransaction<Database>>,
+        TxShape
+      >;
+    },
+    body: Effect.Effect<A, E, R>,
+  ) {
+    return Effect.flatMap(nativeDatabase(acquire), (database) =>
+      coordinateTargetPhonePersistence(
+        database,
+        options.mapping as unknown as AnyPhoneMapping,
+        configuration,
+        (transaction: NativeDriverTransaction<Database>, services) => {
+          const work = body.pipe(
+            Effect.provideService(PhonePersistence, services.phonePersistence),
+            Effect.provideService(PhoneSignInTargets, services.phoneSignInTargets),
+          );
+
+          return options.transaction === undefined
+            ? work
+            : Effect.provideService(work, options.transaction, options.transaction.of(transaction));
+        },
+      ),
+    );
+  }
+
+  return {
+    makePhonePersistenceServices: <
+      Subject extends Table,
+      Identifier extends Table,
+      Credential extends Table,
+      Proof extends Table,
+      NativeId,
+    >(
+      mapping: PhoneMapping<Subject, Identifier, Credential, Proof, NativeId>,
+    ) =>
+      makeTargetPhonePersistenceServices(mapping as unknown as AnyPhoneMapping, configuration).pipe(
+        Effect.provideServiceEffect(NativeDatabase, nativeDatabase(databaseService)),
+      ),
+    coordinatePhonePersistence,
+  };
+};