@yielded/auth-persistence-drizzle 0.1.0-beta.25 → 0.1.0-beta.27

package/src/drizzle/totp-target.ts

@@ -1,327 +1,187 @@
-import { NativeDatabase } from "@yielded/auth-persistence/Adapter";
-import { LifecycleHooks } from "@yielded/auth/Hooks";
+import { makeNativeTotpServices, type NativeTotpMapping } from "@yielded/auth-persistence/Adapter";
+import type { LifecycleHooks } from "@yielded/auth/Hooks";
 import {
   TotpConfigurationError,
-  type TotpUnavailable,
-  TotpMutation,
+  TotpUnavailable,
   TotpPolicy,
   TotpPersistence,
 } from "@yielded/auth/Totp";
 import type { Table } from "drizzle-orm";
-/* oxlint-disable no-explicit-any -- shared native implementation; driver entrypoints retain exact database and table types. */
-import { type Crypto, Context, Effect, Schema } from "effect";
-import type { Statement } from "effect/sql/Statement";
+import { Effect, Schema, type Context, type Crypto } from "effect";
 
-import { randomId } from "./crypto";
+import type { D1BatchStatements } from "./D1BatchStatements";
+import type { NativeDriverDatabase, NativeDriverTransaction } from "./driver-types";
 import type { PersistenceMappingError } from "./model";
-import { nativeDatabase } from "./native-database";
+import { nativeClock } from "./native-clock";
+import { NativeDatabase, nativeDatabase } from "./native-database";
+import {
+  nativeTarget,
+  coordinateNativeTarget,
+  type NativeTargetConfiguration,
+} from "./native-target";
 import { validateDrizzleStorage } from "./storage-validation";
 import type { SuppliedService } from "./SuppliedService";
-import {
-  type TotpMapping,
-  type TotpMappingSource,
-  type TotpPersistenceServices,
-  requiredTotpConstraints,
-} from "./totp-model";
-import {
-  captureTotp,
-  CurrentTotpTransaction,
-  invariant,
-  mutateTotp,
-  unavailable,
-} from "./totp-state";
-import {
-  coordinateTransactionOwner,
-  makeTransactionExecution,
-  sqlClientTransactionStandaloneGuard,
-  type TransactionExecution,
-  type TransactionTargetConfiguration,
-  type TransactionCoordinatorError,
-} from "./transaction-execution";
-import type { TransactionNativeDatabase } from "./transaction-owner";
-export type TotpTargetConfiguration = TransactionTargetConfiguration<TotpUnavailable>;
-
-export type TotpCoordinatorError<E> =
-  | TransactionCoordinatorError<E, TotpUnavailable>
-  | TotpConfigurationError
-  | PersistenceMappingError;
-
-export const sqlClientTotpStandaloneGuard = (
-  service: Parameters<typeof sqlClientTransactionStandaloneGuard>[1],
-) => sqlClientTransactionStandaloneGuard(unavailable, service);
-
-const validateMapping = <M>(original: M, configuration: TotpTargetConfiguration): M => {
-  const mapping = original as any;
-
-  invariant(mapping.moduleId.length > 0);
-  Schema.decodeSync(TotpPolicy)(mapping.policy);
-  for (const [key, value] of Object.entries(requiredTotpConstraints))
-    invariant(mapping.constraints?.[key] === value);
-  if (configuration.mode === "batch") invariant(mapping.d1?.primary === true);
-
-  return Object.freeze({
-    ...mapping,
-    policy: Object.freeze({ ...mapping.policy }),
-    subject: Object.freeze({ ...mapping.subject }),
-    factor: Object.freeze({ ...mapping.factor }),
-    credential: Object.freeze({ ...mapping.credential }),
-    subjectIds: Object.freeze({ ...mapping.subjectIds }),
-  });
-};
-
-const services = Effect.fnUntraced(function* (
-  mapping: any,
-  execution: TransactionExecution<TotpUnavailable, CurrentTotpTransaction>,
-): Effect.fn.Return<TotpPersistenceServices, never, LifecycleHooks> {
-  const hooks = yield* LifecycleHooks;
-
-  return {
-    totpPersistence: TotpPersistence.of({
-      snapshot: Effect.fn("TotpNative.snapshot")(
-        function* (input) {
-          const captured = { ...input };
-
-          invariant(captured.moduleId === mapping.moduleId);
-          yield* execution.admit;
-
-          return yield* execution
-            .run(
-              Effect.map(captureTotp(mapping, captured.subjectId), (value) => value?.snapshot),
-              false,
-            )
-            .pipe(Effect.provideService(LifecycleHooks, hooks));
-        },
-        Effect.catchDefect(() => Effect.fail(unavailable())),
-      ),
-      mutate: (original, prepare) =>
-        Effect.suspend(() => {
-          // Detach caller-owned payloads before any driver or hook can suspend.
-          const codec = Schema.toCodecIso(TotpMutation);
-          const input = Schema.decodeSync(codec)(Schema.encodeSync(codec)(original));
-
-          return execution.admit.pipe(
-            Effect.andThen(
-              execution.run(
-                Effect.gen(function* () {
-                  const decision = yield* mutateTotp(mapping, input),
-                    owner = yield* CurrentTotpTransaction;
-
-                  owner.guards.push(owner.journal.prepare(undefined));
-                  const receipt = prepare(decision, owner.journal);
-
-                  invariant(receipt?._tag === "PreparedCommit" && Effect.isEffect(receipt.read));
-                  owner.guards.push(receipt as any);
-
-                  return receipt;
-                }),
-              ),
-            ),
-            Effect.provideService(LifecycleHooks, hooks),
-          );
-        }).pipe(Effect.catchDefect(() => Effect.fail(unavailable()))),
-    }),
-  };
-});
-
-export const makeTargetTotpPersistence = <
-  S extends Table,
-  F extends Table,
-  C extends Table,
-  N,
-  RSetup = never,
->(
-  source: TotpMappingSource<TotpMapping<S, F, C, N>, RSetup>,
-  configuration: TotpTargetConfiguration,
-) =>
-  Effect.gen(function* () {
-    const original = yield* Effect.isEffect(source) ? source : Effect.succeed(source);
-
-    const mapping = yield* Effect.try({
-      try: () => validateMapping(original, configuration),
-      catch: () => TotpConfigurationError.make({}),
-    });
-
-    yield* validateDrizzleStorage(mapping).pipe(
-      Effect.mapError(() => TotpConfigurationError.make({})),
-    );
+import type { TotpMapping, TotpMappingSource } from "./totp-model";
 
-    const execution = yield* makeTransactionExecution(
-      CurrentTotpTransaction,
-      configuration,
-      unavailable,
-      randomId,
-    );
+const unavailable = () => TotpUnavailable.make({});
 
-    return yield* services(mapping, execution);
-  });
-
-export const coordinateTargetTotp = <M, A, E, R, RSetup = never>(
-  database: TransactionNativeDatabase,
-  source: TotpMappingSource<M, RSetup>,
-  configuration: TotpTargetConfiguration,
-  body: (
-    transaction: any,
-    services: TotpPersistenceServices,
-    append: (statement: Statement<any>) => void,
-  ) => Effect.Effect<A, E, R>,
-): Effect.Effect<
-  A,
-  TotpCoordinatorError<E>,
-  R | RSetup | Crypto.Crypto | LifecycleHooks | NativeDatabase
-> =>
-  Effect.gen(function* () {
-    const original = yield* Effect.isEffect(source) ? source : Effect.succeed(source);
-
-    const mapping = yield* Effect.try({
-      try: () => validateMapping(original, configuration),
-      catch: () => TotpConfigurationError.make({}),
-    });
+/** Driver metadata is compiled once; the factor workflow and commit owner are shared. */
+export const makeTotpTarget = <DatabaseId, D extends NativeDriverDatabase>(
+  databaseService: Context.Service<DatabaseId, D>,
+  configuration: NativeTargetConfiguration,
+) => {
+  const validate = Effect.fnUntraced(
+    function* (mapping: NativeTotpMapping) {
+      yield* validateDrizzleStorage(mapping);
+      yield* Schema.decodeEffect(TotpPolicy)(mapping.policy);
+      if (
+        mapping.moduleId.length === 0 ||
+        (configuration.mode === "batch" &&
+          (mapping.d1?.primary !== true || mapping.subject.requirementColumns === undefined))
+      )
+        return yield* TotpConfigurationError.make({});
+    },
+    Effect.mapError(() => TotpConfigurationError.make({})),
+  );
 
-    yield* validateDrizzleStorage(mapping).pipe(
-      Effect.mapError(() => TotpConfigurationError.make({})),
-    );
+  const services = Effect.fnUntraced(function* (mapping: NativeTotpMapping) {
+    const target = yield* nativeTarget(configuration);
 
-    return yield* coordinateTransactionOwner(
-      database,
-      CurrentTotpTransaction,
-      configuration,
-      Effect.void,
-      unavailable,
-      randomId,
-      (execution) => services(mapping, execution),
-      (transaction, acquireServices, append) =>
-        Effect.flatMap(acquireServices, (boundServices) =>
-          body(transaction, boundServices, append),
-        ),
-    );
+    return yield* target.provide(makeNativeTotpServices(target.tables, mapping));
   });
 
-type TransactionOf<D> = D extends { readonly transaction: (...args: any[]) => any }
-  ? Parameters<Parameters<D["transaction"]>[0]>[0]
-  : never;
+  const mapping = <S extends Table, F extends Table, C extends Table, N, P extends Table>(
+    value: TotpMapping<S, F, C, N, P>,
+  ): NativeTotpMapping =>
+    ({
+      ...value,
+      ...(value.pending === undefined
+        ? {}
+        : { pending: { ...value.pending, clock: nativeClock(value.pending.clock) } }),
+    }) as unknown as NativeTotpMapping;
 
-/** Concrete driver wrappers select transaction mode. */
-export const makeTotpTarget = <
-  DatabaseId,
-  D extends { readonly transaction: any },
-  T extends Table,
-  Extra = unknown,
-  Synchronous extends boolean = false,
->(
-  databaseService: Context.Service<DatabaseId, D>,
-  configuration: TotpTargetConfiguration,
-) => {
   function coordinateTotpPersistence<
-    Database extends D,
-    S extends T,
-    F extends T,
-    C extends T,
+    DB extends D,
+    S extends Table,
+    F extends Table,
+    C extends Table,
     N,
+    P extends Table,
     A,
     E,
     R,
-    RSetup = never,
-    DatabaseError = never,
-    DatabaseRequirements = never,
+    DE,
+    DR,
+    RS = never,
   >(
-    acquire: Effect.Effect<Database, DatabaseError, DatabaseRequirements>,
+    acquire: Effect.Effect<DB, DE, DR>,
     options: {
-      readonly mapping: TotpMappingSource<TotpMapping<S, F, C, N> & Extra, RSetup>;
+      readonly mapping: TotpMappingSource<TotpMapping<S, F, C, N, P>, RS>;
       readonly transaction?: never;
     },
-    body: Effect.Effect<A, E, Synchronous extends true ? NoInfer<TotpPersistence> : R>,
+    body: Effect.Effect<A, E, R>,
   ): Effect.Effect<
     A,
-    TotpCoordinatorError<E> | DatabaseError,
-    | (Synchronous extends true ? never : Exclude<R, TotpPersistence>)
-    | Crypto.Crypto
-    | LifecycleHooks
-    | RSetup
-    | DatabaseRequirements
+    E | DE | TotpUnavailable | TotpConfigurationError | PersistenceMappingError,
+    Exclude<R, TotpPersistence | D1BatchStatements> | DR | RS | LifecycleHooks | Crypto.Crypto
   >;
   function coordinateTotpPersistence<
-    Database extends D,
-    S extends T,
-    F extends T,
-    C extends T,
+    DB extends D,
+    S extends Table,
+    F extends Table,
+    C extends Table,
     N,
+    P extends Table,
     A,
     E,
     R,
+    DE,
+    DR,
     TxId,
     TxShape,
-    RSetup = never,
-    DatabaseError = never,
-    DatabaseRequirements = never,
+    RS = never,
   >(
-    acquire: Effect.Effect<Database, DatabaseError, DatabaseRequirements>,
+    acquire: Effect.Effect<DB, DE, DR>,
     options: {
-      readonly mapping: TotpMappingSource<TotpMapping<S, F, C, N> & Extra, RSetup>;
-      readonly transaction: SuppliedService<TxId, NoInfer<TransactionOf<Database>>, TxShape>;
+      readonly mapping: TotpMappingSource<TotpMapping<S, F, C, N, P>, RS>;
+      readonly transaction: SuppliedService<TxId, NoInfer<NativeDriverTransaction<DB>>, TxShape>;
     },
-    body: Effect.Effect<A, E, Synchronous extends true ? NoInfer<TotpPersistence | TxId> : R>,
+    body: Effect.Effect<A, E, R>,
   ): Effect.Effect<
     A,
-    TotpCoordinatorError<E> | DatabaseError,
-    | (Synchronous extends true ? never : Exclude<R, TotpPersistence | TxId>)
-    | Crypto.Crypto
+    E | DE | TotpUnavailable | TotpConfigurationError | PersistenceMappingError,
+    | Exclude<R, TotpPersistence | D1BatchStatements | TxId>
+    | DR
+    | RS
     | LifecycleHooks
-    | RSetup
-    | DatabaseRequirements
+    | Crypto.Crypto
   >;
   function coordinateTotpPersistence<
-    Database extends D,
-    S extends T,
-    F extends T,
-    C extends T,
+    DB extends D,
+    S extends Table,
+    F extends Table,
+    C extends Table,
     N,
+    P extends Table,
     A,
     E,
     R,
+    DE,
+    DR,
     TxId,
     TxShape,
-    RSetup = never,
-    DatabaseError = never,
-    DatabaseRequirements = never,
+    RS = never,
   >(
-    acquire: Effect.Effect<Database, DatabaseError, DatabaseRequirements>,
+    acquire: Effect.Effect<DB, DE, DR>,
     options: {
-      readonly mapping: TotpMappingSource<TotpMapping<S, F, C, N> & Extra, RSetup>;
-      readonly transaction?: SuppliedService<TxId, NoInfer<TransactionOf<Database>>, TxShape>;
+      readonly mapping: TotpMappingSource<TotpMapping<S, F, C, N, P>, RS>;
+      readonly transaction?: SuppliedService<TxId, NoInfer<NativeDriverTransaction<DB>>, TxShape>;
     },
     body: Effect.Effect<A, E, R>,
-  ): Effect.Effect<
-    A,
-    TotpCoordinatorError<E> | DatabaseError,
-    Exclude<R, TotpPersistence> | Crypto.Crypto | LifecycleHooks | RSetup | DatabaseRequirements
-  > {
-    return Effect.flatMap(nativeDatabase(acquire), (database) =>
-      coordinateTargetTotp(
-        database as any,
-        options.mapping,
+  ) {
+    return Effect.gen(function* () {
+      const value = mapping(
+        yield* Effect.isEffect(options.mapping) ? options.mapping : Effect.succeed(options.mapping),
+      );
+
+      const database = yield* nativeDatabase(acquire);
+
+      yield* validate(value).pipe(Effect.provideService(NativeDatabase, database));
+
+      return yield* coordinateNativeTarget(
+        unavailable,
+        database,
         configuration,
-        (
-          transaction: TransactionOf<Database>,
-          services,
-        ): Effect.Effect<A, E, Exclude<R, TotpPersistence>> => {
-          const provided = Context.make(TotpPersistence, services.totpPersistence);
-          const work = Effect.provideContext(body, provided);
+        services(value),
+        (transaction: NativeDriverTransaction<DB>, bound) => {
+          const work = body.pipe(Effect.provideService(TotpPersistence, bound.totpPersistence));
 
           return options.transaction === undefined
             ? work
             : Effect.provideService(work, options.transaction, options.transaction.of(transaction));
         },
-      ).pipe(Effect.provideService(NativeDatabase, database)),
-    );
+      );
+    });
   }
 
   return {
-    makeTotpPersistenceServices: <S extends T, F extends T, C extends T, N, RSetup = never>(
-      mapping: TotpMappingSource<TotpMapping<S, F, C, N> & Extra, RSetup>,
-    ) =>
-      makeTargetTotpPersistence(mapping, configuration).pipe(
-        Effect.provideServiceEffect(NativeDatabase, nativeDatabase(databaseService)),
-      ),
     coordinateTotpPersistence,
+    makeTotpPersistenceServices: <
+      S extends Table,
+      F extends Table,
+      C extends Table,
+      N,
+      P extends Table = Table,
+      RS = never,
+    >(
+      source: TotpMappingSource<TotpMapping<S, F, C, N, P>, RS>,
+    ) =>
+      Effect.gen(function* () {
+        const value = mapping(yield* Effect.isEffect(source) ? source : Effect.succeed(source));
+
+        yield* validate(value);
+
+        return yield* services(value);
+      }).pipe(Effect.provideServiceEffect(NativeDatabase, nativeDatabase(databaseService))),
   };
 };

package/src/drizzle/transaction-handle.ts

@@ -0,0 +1,41 @@
+import { PasskeyConfigurationError } from "@yielded/auth/Passkey";
+import { Predicate } from "effect";
+
+/** Only foreign constructor types are erased; this creates Drizzle's actual
+ * transaction handle while the shared SqlClient owner holds the transaction. */
+// oxlint-disable-next-line no-explicit-any
+// oxlint-disable-next-line no-explicit-any
+export type DrizzleTransactionFactory = (database: any) => object;
+
+// oxlint-disable-next-line no-explicit-any
+export type DrizzleTransactionConstructor = new (...arguments_: any[]) => object;
+
+export const makeDrizzleTransactionHandle = (
+  database: object,
+  constructor: DrizzleTransactionConstructor | undefined,
+): object => {
+  if (
+    constructor === undefined ||
+    !Predicate.hasProperty(database, "_") ||
+    !Predicate.hasProperty(database._, "session") ||
+    !Predicate.hasProperty(database._, "relations") ||
+    !Predicate.hasProperty(database, "select") ||
+    typeof database.select !== "function"
+  )
+    throw PasskeyConfigurationError.make({});
+  const selection: unknown = database.select();
+
+  if (!Predicate.hasProperty(selection, "dialect")) throw PasskeyConfigurationError.make({});
+
+  return new constructor(
+    selection.dialect,
+    database._.session,
+    database._.relations,
+    0,
+    Predicate.hasProperty(database, "forbidJsonb")
+      ? database.forbidJsonb
+      : Predicate.hasProperty(database, "parseRqbJson")
+        ? database.parseRqbJson
+        : undefined,
+  );
+};

package/src/drizzle/transaction-mysql.ts

@@ -1,20 +1,77 @@
 /* oxlint-disable no-explicit-any -- this private acquisition preserves the installed native transaction; public wrappers retain its exact type. */
-import { EffectMysql2Transaction } from "drizzle-orm/effect-mysql2";
-import { Effect } from "effect";
+import type { SqlNativeCommit } from "@yielded/auth-persistence/Adapter";
+import { PersistenceMappingError } from "@yielded/auth-persistence/Adapter";
+import { EffectMysql2Transaction } from "drizzle-orm/effect-mysql2/session";
+import { Context, Effect, Option } from "effect";
 import { makeWithTransaction, type SqlClient } from "effect/sql/SqlClient";
+import type { SqlError } from "effect/sql/SqlError";
+
+interface MysqlTransactionScope {
+  readonly client: SqlClient;
+  readonly transaction: SqlClient["withTransaction"];
+  active: boolean;
+}
+
+class CurrentMysqlTransaction extends Context.Service<
+  CurrentMysqlTransaction,
+  MysqlTransactionScope
+>()("@yielded/auth-persistence-drizzle/CurrentMysqlTransaction") {}
+
+/** The native handle reuses the physical owner's exact savepoint closure. */
+export const makeMysqlTransactionHandle = (
+  database: any,
+): Effect.Effect<EffectMysql2Transaction<any, any>> =>
+  Effect.map(Effect.serviceOption(CurrentMysqlTransaction), (current) => {
+    if (Option.isNone(current))
+      throw PersistenceMappingError.make({
+        operation: "transaction",
+        cause: "MySQL transaction owner is required",
+      });
+    const scope = current.value;
+
+    class NativeTransaction extends EffectMysql2Transaction<any, any> {
+      override transaction<A, E, R>(body: (transaction: any) => Effect.Effect<A, E, R>) {
+        return Effect.gen(function* () {
+          const current = yield* Effect.serviceOption(CurrentMysqlTransaction);
+
+          if (
+            !scope.active ||
+            Option.isNone(current) ||
+            current.value !== scope ||
+            scope.client.transactionService !== database.$client.transactionService
+          )
+            return yield* Effect.die(
+              PersistenceMappingError.make({
+                operation: "transaction",
+                cause: "MySQL transaction handle escaped its owner",
+              }),
+            );
+
+          return yield* scope.transaction(
+            Effect.suspend(() =>
+              body(
+                new NativeTransaction(database.dialect, database._.session, database._.relations),
+              ),
+            ),
+          );
+        });
+      }
+    }
+
+    return new NativeTransaction(database.dialect, database._.session, database._.relations);
+  });
 
 /** Locking discovery and later SQL policy predicates must see the same current
  * authority. MySQL's default repeatable-read snapshot is unsuitable after a
  * contended authority lock. Own one connection and one-shot transaction mode;
  * the pooled connection's session default is never changed. */
-export const mysqlTransaction = <A, E, R, Failure>(
+const withMysqlTransaction = <A, E, R, Failure>(
   unavailable: () => Failure,
-  database: any,
-  body: (transaction: any) => Effect.Effect<A, E, R>,
-) =>
+  client: SqlClient,
+  body: (transaction: SqlClient["withTransaction"]) => Effect.Effect<A, E, R>,
+): Effect.Effect<A, E | Failure | SqlError, R> =>
   Effect.scoped(
     Effect.gen(function* () {
-      const client: SqlClient = database.$client;
       const connection = yield* client.reserve;
 
       // Installed @effect/sql-mysql2 ConnectionImpl exposes its reserved native
@@ -71,31 +128,24 @@ export const mysqlTransaction = <A, E, R, Failure>(
           statement(`ROLLBACK TO SAVEPOINT effect_auth_oauth_${id}`),
       });
 
-      class NativeTransaction extends EffectMysql2Transaction<any, any> {
-        override transaction<A2, E2, R2>(nested: (tx: any) => Effect.Effect<A2, E2, R2>) {
-          return transaction(
-            Effect.suspend(() =>
-              nested(
-                new NativeTransaction(database.dialect, database._.session, database._.relations),
-              ),
-            ),
-          );
-        }
-      }
-
-      const native = new NativeTransaction(
-        database.dialect,
-        database._.session,
-        database._.relations,
-      );
-
       const cleanup = statement("ROLLBACK").pipe(
         Effect.andThen(statement(`SET TRANSACTION ISOLATION LEVEL ${isolation}`)),
         Effect.onExit((exit) => (exit._tag === "Failure" ? Effect.sync(destroy) : Effect.void)),
         Effect.orDie,
       );
 
-      return yield* transaction(Effect.suspend(() => body(native))).pipe(
+      const scope: MysqlTransactionScope = { client, transaction, active: true };
+
+      return yield* transaction(
+        Effect.suspend(() => body(transaction)).pipe(
+          Effect.provideService(CurrentMysqlTransaction, scope),
+        ),
+      ).pipe(
+        Effect.ensuring(
+          Effect.sync(() => {
+            scope.active = false;
+          }),
+        ),
         // BEGIN/COMMIT acknowledgments can be lost after the server acted.
         // Roll back any surviving transaction before resetting one-shot mode.
         // Failed cleanup destroys the connection before its reserve is released;
@@ -104,3 +154,18 @@ export const mysqlTransaction = <A, E, R, Failure>(
       );
     }),
   );
+
+/** Shared owner capability: one reserved connection, one-shot READ COMMITTED. */
+export const mysqlNativeCommit = (client: SqlClient): SqlNativeCommit["Service"] => ({
+  client,
+  withTransaction: (effect) =>
+    withMysqlTransaction(
+      () =>
+        PersistenceMappingError.make({
+          operation: "transaction",
+          cause: "Unable to acquire MySQL transaction ownership",
+        }),
+      client,
+      () => effect,
+    ),
+});