@yielded/auth-persistence-drizzle 0.1.0-beta.30 → 0.1.0-beta.32

package/src/drizzle/passkey/target.ts

@@ -85,7 +85,11 @@ interface PasskeyMapped<M> {
   readonly provide: <A, E, R>(
     effect: Effect.Effect<A, E, R>,
   ) => Effect.Effect<A, E, Exclude<Exclude<R, SqlClient.SqlClient>, SqlBatchCommit>>;
-  readonly base: () => Effect.Effect<NativePasskeyServices, never, Crypto.Crypto | LifecycleHooks>;
+  readonly base: () => Effect.Effect<
+    NativePasskeyServices,
+    PasskeyUnavailable,
+    Crypto.Crypto | LifecycleHooks
+  >;
 }
 
 export const makePasskeyMapped = Effect.fnUntraced(function* <M, R>(

package/src/drizzle/session-drivers.ts

@@ -12,6 +12,7 @@ import {
   makeNativeSessionCleanupServices,
 } from "@yielded/auth-persistence/Adapter";
 import type { LifecycleHooks } from "@yielded/auth/Hooks";
+import { reportAuthDiagnostic } from "@yielded/auth/Persistence";
 import {
   AuthenticationAuthority,
   SessionUnavailable,
@@ -63,7 +64,9 @@ export const makeSessionTarget = <DatabaseId, D extends NativeDriverDatabase>(
         configuration.mode === "batch" &&
         (mapping.d1?.primary !== true || mapping.subject.requirementColumns === undefined)
       )
-        return yield* unavailable();
+        return yield* reportAuthDiagnostic("persistence-validation", "configuration").pipe(
+          Effect.andThen(unavailable()),
+        );
       const target = yield* nativeTarget(configuration);
 
       return yield* target.provide(
@@ -171,7 +174,9 @@ export const makeSessionTarget = <DatabaseId, D extends NativeDriverDatabase>(
         configuration.mode === "batch" &&
         (mapping.d1?.primary !== true || mapping.subject.requirementColumns === undefined)
       )
-        return yield* unavailable();
+        return yield* reportAuthDiagnostic("persistence-validation", "configuration").pipe(
+          Effect.andThen(unavailable()),
+        );
       const target = yield* nativeTarget(configuration);
 
       return yield* target.provide(makeNativePendingAuthenticationServices(target.tables, mapping));
@@ -275,7 +280,9 @@ export const makeSessionTarget = <DatabaseId, D extends NativeDriverDatabase>(
         configuration.mode === "batch" &&
         (mapping.d1?.primary !== true || mapping.subject.requirementColumns === undefined)
       )
-        return yield* unavailable();
+        return yield* reportAuthDiagnostic("persistence-validation", "configuration").pipe(
+          Effect.andThen(unavailable()),
+        );
       const target = yield* nativeTarget(configuration);
 
       return yield* target.provide(makeNativeStatefulSessionServices(target.tables, mapping));
@@ -397,7 +404,9 @@ export const makeSessionTarget = <DatabaseId, D extends NativeDriverDatabase>(
     Effect.gen(function* () {
       yield* validateDrizzleStorage(mapping).pipe(Effect.mapError(unavailable));
       if (configuration.mode === "batch" && mapping.d1?.primary !== true)
-        return yield* unavailable();
+        return yield* reportAuthDiagnostic("persistence-validation", "configuration").pipe(
+          Effect.andThen(unavailable()),
+        );
       const target = yield* nativeTarget(configuration);
 
       return yield* target.provide(makeNativeSignedSessionValidityServices(target.tables, mapping));
@@ -498,7 +507,9 @@ export const makeSessionTarget = <DatabaseId, D extends NativeDriverDatabase>(
         configuration.mode === "batch" &&
         (mapping.d1?.primary !== true || mapping.subject.requirementColumns === undefined)
       )
-        return yield* unavailable();
+        return yield* reportAuthDiagnostic("persistence-validation", "configuration").pipe(
+          Effect.andThen(unavailable()),
+        );
       const target = yield* nativeTarget(configuration);
 
       return yield* target.provide(makeNativeSessionStepUpServices(target.tables, mapping));

package/src/drizzle/storage-validation.ts

@@ -4,6 +4,7 @@ import {
   type StorageValidation,
   storageKeyPlans,
 } from "@yielded/auth-persistence/Adapter";
+import { reportAuthDiagnostic } from "@yielded/auth/Persistence";
 import { getTableColumns, getTableName, is, Table } from "drizzle-orm";
 import { getTableConfig as getMysqlTableConfig, MySqlTable } from "drizzle-orm/mysql-core";
 import { getTableConfig as getPgTableConfig, PgTable } from "drizzle-orm/pg-core";
@@ -83,4 +84,5 @@ export const validateDrizzleStorage = Effect.fnUntraced(
       }),
     ),
   ),
+  Effect.tapError(() => reportAuthDiagnostic("persistence-validation", "mapping")),
 );

package/src/internal/drizzle-d1-migrations.ts

@@ -0,0 +1,150 @@
+import { D1Client } from "@effect/sql-d1/D1Client";
+import { PersistenceConfigurationError } from "@yielded/auth-persistence/Adapter";
+import { sql } from "drizzle-orm";
+import { drizzle } from "drizzle-orm/d1";
+import { formatToMillis, getMigrationsToRun } from "drizzle-orm/migrator.utils";
+import { Crypto, DateTime, Effect, Layer, Schema } from "effect";
+
+const MigrationFiles = Schema.Record(Schema.String, Schema.NonEmptyString);
+const MigrationName = Schema.String.check(Schema.isPattern(/^\d{14}_.+$/));
+const JournalColumns = Schema.Array(Schema.Struct({ name: Schema.String }));
+
+const configurationError = () =>
+  PersistenceConfigurationError.make({
+    reason: "Could not apply D1 migrations; check the bundled SQL and database binding",
+  });
+
+const JournalRows = Schema.Array(
+  Schema.Struct({
+    id: Schema.Int,
+    hash: Schema.String,
+    created_at: Schema.String,
+    name: Schema.NullOr(Schema.String),
+  }),
+);
+
+/** Drizzle's D1 migration journal and selection, with bundled SQL in place of
+ * filesystem loading. Pending statements and journal entries share one D1 batch.
+ * Applications own when migrations run; do not run competing migration owners.
+ */
+export const d1MigrationsLayer = (options: {
+  readonly migrations: Readonly<Record<string, string>>;
+  readonly migrationsTable?: string;
+}) =>
+  Layer.effectDiscard(
+    Effect.gen(function* () {
+      const files = yield* Schema.decodeEffect(MigrationFiles)(options.migrations);
+      const client = yield* D1Client;
+      const crypto = yield* Crypto.Crypto;
+      const appliedAt = DateTime.formatIso(yield* DateTime.now);
+
+      const migrations = yield* Effect.forEach(
+        Object.entries(files).sort(([left], [right]) => left.localeCompare(right)),
+        Effect.fnUntraced(function* ([name, contents]) {
+          yield* Schema.decodeEffect(MigrationName)(name);
+
+          const folderMillis = yield* Schema.decodeEffect(Schema.Int)(
+            formatToMillis(name.slice(0, 14)),
+          );
+
+          const digest = yield* crypto.digest("SHA-256", new TextEncoder().encode(contents));
+
+          return {
+            name,
+            folderMillis,
+            hash: Array.from(digest, (byte) => byte.toString(16).padStart(2, "0")).join(""),
+            sql: contents.split("--> statement-breakpoint"),
+            bps: true,
+          };
+        }),
+      );
+
+      yield* Effect.tryPromise({
+        try: async () => {
+          const db = drizzle(client.config.db);
+          const name = options.migrationsTable ?? "__drizzle_migrations";
+          const table = sql.identifier(name);
+
+          const columns = Schema.decodeUnknownSync(JournalColumns)(
+            await db.all(sql`select name from pragma_table_info(${name})`),
+          ).map((column) => column.name);
+
+          const newDb = columns.length === 0;
+          const legacy = !newDb && !columns.includes("name");
+
+          if (
+            !newDb &&
+            (!["id", "hash", "created_at"].every((column) => columns.includes(column)) ||
+              legacy === columns.includes("applied_at"))
+          )
+            throw configurationError();
+
+          // Original Drizzle SQLite journals can have NULL serial IDs. Use the
+          // physical rowid to backfill each retained entry without changing it.
+          const journal = newDb
+            ? []
+            : Schema.decodeUnknownSync(JournalRows)(
+                await db.all(sql`select rowid as id, hash, cast(created_at as text) as created_at,
+              ${legacy ? sql`null` : sql`name`} as name from ${table} order by rowid`),
+              ).map((entry) => ({ ...entry }));
+
+          const journalStatements = newDb
+            ? [
+                db.run(sql`create table ${table} (
+                id integer primary key, hash text not null, created_at numeric,
+                name text, applied_at text
+              )`),
+              ]
+            : [];
+
+          if (legacy) {
+            // Match retained entries using Drizzle's timestamp/hash convention,
+            // but stage the upgrade with pending SQL: D1 cannot run BEGIN.
+            journalStatements.push(
+              db.run(sql`alter table ${table} add column name text`),
+              db.run(sql`alter table ${table} add column applied_at text`),
+            );
+            for (const entry of journal) {
+              const millis = Math.floor(Number(entry.created_at) / 1000) * 1000;
+
+              const candidates = migrations.filter(
+                (migration) => migration.folderMillis === millis,
+              );
+
+              const matches =
+                candidates.length === 1
+                  ? candidates
+                  : (candidates.length === 0 ? migrations : candidates).filter(
+                      (migration) => migration.hash === entry.hash,
+                    );
+
+              const match = matches[0];
+
+              if (matches.length !== 1 || match === undefined) throw configurationError();
+              entry.name = match.name;
+              journalStatements.push(
+                db.run(sql`update ${table} set name = ${match.name} where rowid = ${entry.id}`),
+              );
+            }
+          }
+
+          const statements = [
+            ...journalStatements,
+            ...getMigrationsToRun({
+              localMigrations: migrations,
+              dbMigrations: [...journal],
+            }).flatMap((migration) => [
+              ...migration.sql.map((statement) => db.run(sql.raw(statement))),
+              db.run(sql`insert into ${table} (hash, created_at, name, applied_at)
+                values (${migration.hash}, ${migration.folderMillis}, ${migration.name}, ${appliedAt})`),
+            ]),
+          ];
+
+          const [first, ...rest] = statements;
+
+          if (first !== undefined) await db.batch([first, ...rest]);
+        },
+        catch: configurationError,
+      });
+    }).pipe(Effect.mapError(configurationError)),
+  );

package/src/internal/drizzle-sqlite.ts

@@ -12,7 +12,7 @@ import {
   uniqueIndex,
   type SQLiteTable,
 } from "drizzle-orm/sqlite-core";
-import type { Effect } from "effect";
+import { Effect } from "effect";
 import type { SqlClient } from "effect/sql/SqlClient";
 
 import { nativeDatabase, type NativeDatabaseHandle } from "../drizzle/native-database";
@@ -71,10 +71,22 @@ const describe = (table: SQLiteTable): StorageTable => {
   };
 };
 
-export const sqlitePersistence = <R>(acquire: Effect.Effect<object, never, R | SqlClient>) =>
+export const sqlitePersistence = <R>(
+  acquire: Effect.Effect<object, never, R | SqlClient>,
+  options?: { readonly batch: true },
+) =>
   createPersistence<SQLiteTable, R, NativeDatabaseHandle>({
     nativeTables: (database) => makeDrizzleSqlTables(database.$client, database),
     makeTable,
     describe,
     acquire: nativeDatabase(acquire),
+    ...(options?.batch === true
+      ? {
+          batch: (database: NativeDatabaseHandle) => ({
+            client: database.$client,
+            execute: (statements: Parameters<typeof database.$client.batch>[0]) =>
+              database.$client.batch(statements).pipe(Effect.asVoid),
+          }),
+        }
+      : {}),
   });