@yielded/auth-persistence 0.1.0-beta.10

package/dist/internal/password-kernel.d.mts

@@ -0,0 +1,290 @@
+import { QueryFailure, QueryOperations, SqlColumn, SqlFragment } from "./query-operations.mjs";
+import { PersistenceMappingError } from "./mapping-error.mjs";
+import { AnyPasswordPersistenceMapping } from "./models/password-model.mjs";
+import { CurrentProofSql, ProofSqlConfiguration, makeProofKernel } from "./proof-kernel.mjs";
+import { Context, DateTime, Effect, Option, Redacted } from "effect";
+import { CurrentCommitJournal, HookConfigurationError, LifecycleHooks, PreparedCommit } from "@yielded/auth/Hooks";
+import { AuthenticationEvidence, AuthenticationRequirement, SecurityRevision } from "@yielded/auth/Sessions";
+import { PasswordAttemptDecision, PasswordAttemptPolicy, PasswordCredentialSnapshot, PasswordMutationDecision, PasswordMutationInput, PasswordUnavailable } from "@yielded/auth/Password";
+import { ProofCompletionInput, ProofCompletionPlan } from "@yielded/auth/Proofs";
+import { LoginIdentifier } from "@yielded/auth/Identity";
+import * as SqlError$1 from "effect/unstable/sql/SqlError";
+//#region src/internal/password-kernel.d.ts
+type AdapterFailure = QueryFailure | PersistenceMappingError | SqlError$1.SqlError;
+export interface PasswordSqlQuery<A = ReadonlyArray<any>> extends Effect.Effect<A, AdapterFailure> {
+  readonly getSQL: () => ReturnType<QueryOperations["sql"]>;
+  readonly from: (...args: ReadonlyArray<any>) => PasswordSqlQuery<A>;
+  readonly where: (...args: ReadonlyArray<any>) => PasswordSqlQuery<A>;
+  readonly limit: (...args: ReadonlyArray<any>) => PasswordSqlQuery<A>;
+  readonly orderBy: (...args: ReadonlyArray<any>) => PasswordSqlQuery<A>;
+  readonly for: (...args: ReadonlyArray<any>) => PasswordSqlQuery<A>;
+  readonly set: (...args: ReadonlyArray<any>) => PasswordSqlQuery<A>;
+  readonly values: (...args: ReadonlyArray<any>) => PasswordSqlQuery<A>;
+  readonly returning: (...args: ReadonlyArray<any>) => PasswordSqlQuery<A>;
+  readonly $returningId: (...args: ReadonlyArray<any>) => PasswordSqlQuery<A>;
+  readonly onConflictDoNothing: (...args: ReadonlyArray<any>) => PasswordSqlQuery<A>;
+  readonly onDuplicateKeyUpdate: (...args: ReadonlyArray<any>) => PasswordSqlQuery<A>;
+}
+export interface PasswordSqlDatabase {
+  readonly select: (...args: ReadonlyArray<any>) => PasswordSqlQuery;
+  readonly insert: (...args: ReadonlyArray<any>) => PasswordSqlQuery;
+  readonly update: (...args: ReadonlyArray<any>) => PasswordSqlQuery;
+  readonly delete: (...args: ReadonlyArray<any>) => PasswordSqlQuery;
+  readonly transaction: <A, E, R>(body: (transaction: PasswordSqlDatabase) => Effect.Effect<A, E, R>) => Effect.Effect<A, E | SqlError$1.SqlError, R>;
+}
+declare const CurrentPasswordSql_base: Context.ServiceClass<CurrentPasswordSql, "effect-auth/CurrentPasswordSql", PasswordSqlDatabase>;
+export declare class CurrentPasswordSql extends CurrentPasswordSql_base {}
+export interface PasswordSqlConfiguration {
+  readonly mode: "interactive" | "synchronous";
+  readonly locking: boolean;
+  readonly standaloneGuard: Effect.Effect<void, PasswordUnavailable>;
+  readonly coordinated?: boolean;
+  readonly insertIfAbsent: (query: PasswordSqlQuery, selfKey: string, selfValue: unknown) => PasswordSqlQuery;
+  readonly proof?: {
+    readonly mapping: any;
+    readonly configuration: ProofSqlConfiguration;
+  };
+}
+type Database = PasswordSqlDatabase;
+export declare const makePasswordKernel: <Fragment extends SqlFragment = SqlFragment, Column extends SqlColumn = SqlColumn>(operations: QueryOperations<Fragment, Column>, proofs: Pick<ReturnType<typeof makeProofKernel>, "completeProofPlanIn">) => {
+  makeSqlPasswordPersistence: (database: PasswordSqlDatabase, mapping: AnyPasswordPersistenceMapping<Fragment>, configuration: PasswordSqlConfiguration) => Effect.Effect<{
+    readonly admitAttempt: <A>(input: {
+      readonly moduleId: string;
+      readonly action: "sign-in" | "change";
+      readonly identifier: LoginIdentifier;
+      readonly subjectId?: import("@yielded/auth/Schema").SubjectId;
+      readonly policy: PasswordAttemptPolicy;
+    }, prepare: import("@yielded/auth/Password").PreparePasswordCommit<import("@yielded/auth/Password").PasswordAttemptAdmission, A>) => Effect.Effect<PreparedCommit<A>, PasswordUnavailable>;
+    readonly settleAttempt: <A>(input: {
+      readonly moduleId: string;
+      readonly attemptId: import("@yielded/auth/Password").PasswordAttemptId;
+      readonly captured?: PasswordCredentialSnapshot;
+      readonly outcome: PasswordAttemptDecision;
+      readonly rehash?: {
+        readonly expectedVersion: SecurityRevision;
+        readonly expectedVerifier: Redacted.Redacted<import("@yielded/auth/Password").EncodedPasswordHash>;
+        readonly nextVerifier: Redacted.Redacted<import("@yielded/auth/Password").EncodedPasswordHash>;
+      };
+    }, prepare: import("@yielded/auth/Password").PreparePasswordCommit<PasswordAttemptDecision, A>) => Effect.Effect<PreparedCommit<A>, PasswordUnavailable>;
+    readonly readForSubject: (input: {
+      readonly moduleId: string;
+      readonly subjectId: import("@yielded/auth/Schema").SubjectId;
+    }) => Effect.Effect<Option.Option<PasswordCredentialSnapshot>, PasswordUnavailable>;
+    readonly recoveryTarget: (input: {
+      readonly moduleId: string;
+      readonly identifier: LoginIdentifier;
+    }) => Effect.Effect<Option.Option<PasswordCredentialSnapshot>, PasswordUnavailable>;
+    readonly addIfAbsent: <A>(input: PasswordMutationInput, prepare: import("@yielded/auth/Password").PreparePasswordCommit<PasswordMutationDecision, A>) => Effect.Effect<PreparedCommit<A>, PasswordUnavailable>;
+    readonly replaceIfCurrent: <A>(input: PasswordMutationInput, prepare: import("@yielded/auth/Password").PreparePasswordCommit<PasswordMutationDecision, A>) => Effect.Effect<PreparedCommit<A>, PasswordUnavailable>;
+    readonly checkReset: (input: ProofCompletionInput) => Effect.Effect<boolean, PasswordUnavailable>;
+    readonly resetWithProof: <A>(input: PasswordMutationInput & {
+      readonly completion: ProofCompletionPlan;
+    }, prepare: import("@yielded/auth/Password").PreparePasswordCommit<PasswordMutationDecision, A>) => Effect.Effect<PreparedCommit<A>, PasswordUnavailable>;
+    readonly cleanupAttempts: <A>(input: {
+      readonly moduleId: string;
+      readonly limit: number;
+    }, prepare: import("@yielded/auth/Password").PreparePasswordCommit<{
+      readonly removed: number;
+      readonly hasMore: boolean;
+    }, A>) => Effect.Effect<PreparedCommit<A>, PasswordUnavailable>;
+  }, never, LifecycleHooks>;
+  passwordSqlKernel: {
+    allocate: <A>(mode: PasswordSqlConfiguration["mode"], asyncValue: Effect.Effect<A, PersistenceMappingError> | undefined, syncValue: (() => A) | undefined) => Effect.Effect<A, PasswordUnavailable | PersistenceMappingError>;
+    allocateNextSecurityRevision: (mapping: AnyPasswordPersistenceMapping<Fragment>, mode: PasswordSqlConfiguration["mode"], current: SecurityRevision) => Effect.Effect<string & import("effect/Brand").Brand<"effect-auth/SecurityRevision">, PasswordUnavailable | PersistenceMappingError, never>;
+    owned: <A, E, R>(database: Database, mapping: AnyPasswordPersistenceMapping<Fragment>, configuration: PasswordSqlConfiguration, body: Effect.Effect<A, E, R>) => Effect.Effect<A, E | HookConfigurationError | PasswordUnavailable | SqlError$1.SqlError, LifecycleHooks | Exclude<Exclude<Exclude<R, CurrentPasswordSql>, CurrentProofSql>, CurrentCommitJournal>>;
+    safeRead: <A, E, R>(database: Database, configuration: PasswordSqlConfiguration, body: Effect.Effect<A, E, R>) => Effect.Effect<A, E | PasswordUnavailable | SqlError$1.SqlError, Exclude<Exclude<R, CurrentPasswordSql>, CurrentProofSql>>;
+    snapshotMutationInput: (input: PasswordMutationInput) => Effect.Effect<Readonly<{
+      moduleId: string;
+      commandId: import("@yielded/auth/Password").PasswordCommandId;
+      credential?: Readonly<{
+        moduleId: string;
+        credentialId: string;
+        credentialRevision: string & import("effect/Brand").Brand<"effect-auth/SecurityRevision">;
+        verifierVersion: string & import("effect/Brand").Brand<"effect-auth/SecurityRevision">;
+        verifier: Redacted.Redacted<string & import("effect/Brand").Brand<"effect-auth/EncodedPasswordHash">>;
+        normalization: "NFC" | "none";
+        identifierBindingRevision: string & import("effect/Brand").Brand<"effect-auth/SecurityRevision">;
+        identifierVerifiedAtMillis?: number | undefined;
+        revision: {
+          readonly subjectId: string & import("effect/Brand").Brand<"effect-auth/SubjectId">;
+          readonly securityRevision: string & import("effect/Brand").Brand<"effect-auth/SecurityRevision">;
+          readonly credentials: readonly {
+            readonly credentialId: string;
+            readonly revision: string & import("effect/Brand").Brand<"effect-auth/SecurityRevision">;
+          }[];
+        };
+        identifier: Readonly<LoginIdentifier>;
+      }> | undefined;
+      expectedRevision: {
+        readonly subjectId: string & import("effect/Brand").Brand<"effect-auth/SubjectId">;
+        readonly securityRevision: string & import("effect/Brand").Brand<"effect-auth/SecurityRevision">;
+        readonly credentials: readonly {
+          readonly credentialId: string;
+          readonly revision: string & import("effect/Brand").Brand<"effect-auth/SecurityRevision">;
+        }[];
+      };
+      replacement: Readonly<{
+        verifier: Redacted.Redacted<string & import("effect/Brand").Brand<"effect-auth/EncodedPasswordHash">>;
+        normalization: "NFC" | "none";
+      }>;
+      invalidation: Readonly<{
+        trigger: "all-session-revocation" | "credential-change" | "factor-reset" | "identifier-change" | "password-reset" | "subject-delete" | "subject-disable";
+        existingSessions: "immediate" | "original-absolute-expiry";
+        maximumExposureMillis: number;
+        oldAuthenticationEvidence: "rejected";
+      }>;
+      authorization: Readonly<{
+        challenge: Readonly<{
+          moduleId: string;
+          action: "add-password" | "change-password" | "reset-password";
+          commandId: string & import("effect/Brand").Brand<"effect-auth/PasswordCommandId">;
+          targetCredentialId?: string | undefined;
+          bindingDigest: string & import("effect/Brand").Brand<"effect-auth/TokenDigest">;
+          revision: {
+            readonly subjectId: string & import("effect/Brand").Brand<"effect-auth/SubjectId">;
+            readonly securityRevision: string & import("effect/Brand").Brand<"effect-auth/SecurityRevision">;
+            readonly credentials: readonly {
+              readonly credentialId: string;
+              readonly revision: string & import("effect/Brand").Brand<"effect-auth/SecurityRevision">;
+            }[];
+          };
+        }>;
+        evidence: Readonly<{
+          flowId: string & import("effect/Brand").Brand<"effect-auth/AuthenticationFlowId">;
+          bindingDigest: string & import("effect/Brand").Brand<"effect-auth/TokenDigest">;
+          revision: Readonly<{
+            subjectId: string & import("effect/Brand").Brand<"effect-auth/SubjectId">;
+            securityRevision: string & import("effect/Brand").Brand<"effect-auth/SecurityRevision">;
+            credentials: readonly Readonly<{
+              credentialId: string;
+              revision: string & import("effect/Brand").Brand<"effect-auth/SecurityRevision">;
+            }>[];
+          }>;
+          proofs: readonly [Readonly<{
+            method: string;
+            credentialId: string;
+            userVerified: boolean;
+            phishingResistant: boolean;
+            factors: readonly ("inherence" | "knowledge" | "possession")[];
+            verifiedAt: DateTime.Utc;
+          }>, ...Readonly<{
+            method: string;
+            credentialId: string;
+            userVerified: boolean;
+            phishingResistant: boolean;
+            factors: readonly ("inherence" | "knowledge" | "possession")[];
+            verifiedAt: DateTime.Utc;
+          }>[]];
+        }>;
+        requirement: Readonly<{
+          maximumAgeMillis: number;
+          alternatives: readonly [Readonly<{
+            userVerified: boolean;
+            phishingResistant: boolean;
+            minimumCredentials: number;
+            factors: readonly ("inherence" | "knowledge" | "possession")[];
+          }>, ...Readonly<{
+            userVerified: boolean;
+            phishingResistant: boolean;
+            minimumCredentials: number;
+            factors: readonly ("inherence" | "knowledge" | "possession")[];
+          }>[]];
+        }>;
+      }>;
+    }>, PasswordUnavailable, never>;
+    lockSubject: (mapping: AnyPasswordPersistenceMapping<Fragment>, subjectId: string, locking: boolean) => Effect.Effect<{
+      nativeSubjectId: unknown;
+      row: any;
+    }, AdapterFailure, CurrentPasswordSql>;
+    lockIdentifier: (mapping: AnyPasswordPersistenceMapping<Fragment>, identifier: LoginIdentifier, locking: boolean) => Effect.Effect<readonly any[], AdapterFailure, CurrentPasswordSql>;
+    readPasswordCredential: (mapping: AnyPasswordPersistenceMapping<Fragment>, moduleId: string, nativeSubjectId: unknown, locking: boolean) => Effect.Effect<readonly any[], AdapterFailure, CurrentPasswordSql>;
+    resolveCredential: (mapping: AnyPasswordPersistenceMapping<Fragment>, moduleId: string, identifier: LoginIdentifier, requestedSubjectId: string | undefined, locking: boolean) => Effect.Effect<{
+      nativeSubjectId: any;
+      subject: any;
+      identifier: any;
+      snapshot?: undefined;
+      readonly credential?: undefined;
+    } | {
+      nativeSubjectId: any;
+      subject: any;
+      identifier: any;
+      credential: any;
+      snapshot: Readonly<{
+        moduleId: string;
+        credentialId: string;
+        credentialRevision: string & import("effect/Brand").Brand<"effect-auth/SecurityRevision">;
+        verifierVersion: string & import("effect/Brand").Brand<"effect-auth/SecurityRevision">;
+        verifier: Redacted.Redacted<string & import("effect/Brand").Brand<"effect-auth/EncodedPasswordHash">>;
+        normalization: "NFC" | "none";
+        identifierBindingRevision: string & import("effect/Brand").Brand<"effect-auth/SecurityRevision">;
+        identifierVerifiedAtMillis?: number | undefined;
+        revision: {
+          readonly subjectId: string & import("effect/Brand").Brand<"effect-auth/SubjectId">;
+          readonly securityRevision: string & import("effect/Brand").Brand<"effect-auth/SecurityRevision">;
+          readonly credentials: readonly {
+            readonly credentialId: string;
+            readonly revision: string & import("effect/Brand").Brand<"effect-auth/SecurityRevision">;
+          }[];
+        };
+        identifier: Readonly<LoginIdentifier>;
+      }>;
+    } | undefined, PasswordUnavailable | QueryFailure, CurrentPasswordSql>;
+    validateMutationAuthority: (mapping: AnyPasswordPersistenceMapping<Fragment>, configuration: PasswordSqlConfiguration, input: PasswordMutationInput, action: "add-password" | "change-password" | "reset-password") => Effect.Effect<{
+      nativeSubjectId: unknown;
+      row: any;
+      now: number;
+    } | undefined, AdapterFailure, CurrentPasswordSql>;
+    currentExpectedCredential: (mapping: AnyPasswordPersistenceMapping<Fragment>, input: PasswordMutationInput, nativeSubjectId: unknown) => Effect.Effect<boolean, AdapterFailure, CurrentPasswordSql>;
+    commandExists: (mapping: AnyPasswordPersistenceMapping<Fragment>, moduleId: string, commandId: string, locking: boolean) => Effect.Effect<readonly any[], AdapterFailure, CurrentPasswordSql>;
+    addPasswordIn: (mapping: AnyPasswordPersistenceMapping<Fragment>, configuration: PasswordSqlConfiguration, input: PasswordMutationInput, revisions: {
+      readonly credentialId: string;
+      readonly credentialRevision: SecurityRevision;
+      readonly verifierVersion: SecurityRevision;
+      readonly nextSecurityRevision: SecurityRevision;
+    }, commandNow?: number | undefined) => Effect.Effect<boolean, PasswordUnavailable | QueryFailure, CurrentPasswordSql>;
+    checkMutationApplied: (mapping: AnyPasswordPersistenceMapping<Fragment>, input: PasswordMutationInput, nativeSubjectId: unknown, revisions: {
+      readonly credentialId: string;
+      readonly credentialRevision: SecurityRevision;
+      readonly verifierVersion: SecurityRevision;
+      readonly nextSecurityRevision: SecurityRevision;
+    }, now: number) => Effect.Effect<boolean, AdapterFailure, CurrentPasswordSql>;
+    writeReplacement: (mapping: AnyPasswordPersistenceMapping<Fragment>, input: PasswordMutationInput, nativeSubjectId: unknown, revisions: {
+      readonly credentialRevision: SecurityRevision;
+      readonly verifierVersion: SecurityRevision;
+      readonly nextSecurityRevision: SecurityRevision;
+    }, now: number) => Effect.Effect<boolean, AdapterFailure, CurrentPasswordSql>;
+    evidenceSatisfiedAt: (evidence: AuthenticationEvidence, requirement: AuthenticationRequirement, now: number) => boolean;
+    sameCredentialSnapshot: (left: PasswordCredentialSnapshot, right: PasswordCredentialSnapshot) => boolean;
+    subjectColumns: (mapping: AnyPasswordPersistenceMapping<Fragment>) => {
+      id: Column;
+      status: Column;
+      securityRevision: Column;
+    };
+    identifierColumns: (mapping: AnyPasswordPersistenceMapping<Fragment>) => {
+      namespace: Column;
+      value: Column;
+      subjectId: Column;
+      verifiedAt: Column;
+      bindingRevision: Column;
+    };
+    credentialColumns: (mapping: AnyPasswordPersistenceMapping<Fragment>) => {
+      moduleId: Column;
+      subjectId: Column;
+      credentialId: Column;
+      credentialRevision: Column;
+      verifierVersion: Column;
+      verifier: Column;
+      normalization: Column;
+    };
+    authorityCredentialColumns: (mapping: AnyPasswordPersistenceMapping<Fragment>) => {
+      subjectId: Column;
+      credentialId: Column;
+      revision: Column;
+    };
+    proofCompletionMatchesPassword: (input: PasswordMutationInput & {
+      readonly completion: ProofCompletionPlan;
+    }) => boolean;
+  };
+};
+//#endregion
+//# sourceMappingURL=password-kernel.d.mts.map