@yielded/auth-persistence 0.1.0-beta.10

package/src/Adapter.ts

@@ -0,0 +1,291 @@
+/** Shared storage contracts and kernels for persistence adapter authors. */
+export {
+  type EmailSubjectReadTable,
+  type EmailSubjectTable,
+  type EmailIdentifierReadTable,
+  type EmailIdentifierTable,
+  type EmailCredentialReadTable,
+  type EmailCredentialTable,
+  type EmailAuthorityCredentialTable,
+  type EmailCommandTable,
+  type RequiredEmailSignInConstraints,
+  requiredEmailSignInConstraints,
+  type EmailSignInMapping,
+  type RequiredEmailAddressConstraints,
+  requiredEmailAddressConstraints,
+  type EmailD1Clock,
+  type EmailAddressMapping,
+  type D1EmailAddressMapping,
+  type EmailRegistrationState,
+  type EmailRegistrationIntent,
+  type EmailRegistrationTable,
+  type EmailRegistrationProvisioning,
+  type EmailRegistrationIdentifierTable,
+  type EmailRegistrationCredentialTable,
+  type EmailRegistrationAuthorityCredentialTable,
+  type RequiredEmailRegistrationConstraints,
+  requiredEmailRegistrationConstraints,
+  type EmailRegistrationMapping,
+  type AnyEmailSignInMapping,
+  type AnyEmailAddressMapping,
+  type AnyEmailRegistrationMapping,
+  type D1EmailRegistrationMapping,
+} from "./internal/models/email-model";
+
+export {
+  type PasskeyColumn,
+  type PasskeyMappingSource,
+  type PasskeyCredentialServices,
+  type PasskeyPersistenceServices,
+  type PasskeyEnrollmentContextServices,
+  passkeyCredentialsLayer,
+  passkeyPersistenceLayer,
+  passkeyEnrollmentContextLayer,
+  type PasskeySubjectIdCodec,
+  type PasskeyClock,
+  type PasskeySubjectReadTable,
+  type PasskeyFactorReadTable,
+  type PasskeyCredentialReadTable,
+  type PasskeyCredentialOwnershipTable,
+  type PasskeyHandleReadTable,
+  type PasskeyHandleReservationTable,
+  type PasskeyHandleOwnershipTable,
+  requiredPasskeyCredentialConstraints,
+  type PasskeyCredentialMapping,
+  type PasskeyPolicyGuard,
+  passkeyPolicyGuard,
+  type PasskeyModuleTable,
+  type PasskeyFlowState,
+  type PasskeyFlowInsert,
+  type PasskeyFlowTable,
+  type PasskeyAdmissionTable,
+  type PasskeyChargeKind,
+  type PasskeyChargeInsert,
+  type PasskeyChargeTable,
+  requiredPasskeyPersistenceConstraints,
+  type PasskeyCeremonyMapping,
+  type PasskeyPersistenceMapping,
+  type PasskeyEnrollmentContextMapping,
+  type D1PasskeyMapping,
+} from "./internal/models/passkey-model";
+
+export {
+  type PasskeyRegistrationCeremonyCapabilities,
+  type PasskeyRegistrationCeremonyServices,
+  type PasskeyRegistrationIntentReadTable,
+  requiredPasskeyRegistrationCeremonyConstraints,
+  type PasskeyRegistrationCeremonyMapping,
+} from "./internal/models/passkey-registration-ceremony-model";
+
+export {
+  type PasskeyCredentialInsert,
+  type PasskeyWriteTables,
+  type PasskeyInvalidationInput,
+  type PasskeyInvalidationMutation,
+  passkeyInvalidationMutation,
+  type PasskeyCommandTable,
+  type PasskeyManagementMapping,
+  requiredPasskeyManagementConstraints,
+  type PasskeyManagementServices,
+  type PasskeyRegistrationWriter,
+  type PasskeyRegistrationServices,
+  type PasskeyRegistrationMapping,
+  requiredPasskeyRegistrationWriteConstraints,
+} from "./internal/models/passkey-write-model";
+
+export {
+  type PasswordAttemptAction,
+  type PasswordAttemptState,
+  type PasswordRateScopeKind,
+  type PasswordScopeKeys,
+  type PasswordSubjectTable,
+  type PasswordIdentifierTable,
+  type PasswordAuthorityCredentialTable,
+  type PasswordCredentialTable,
+  type PasswordAttemptRecord,
+  type PasswordAttemptTable,
+  type PasswordRateScopeTable,
+  type PasswordChargeTable,
+  type PasswordCommandTable,
+  type RequiredPasswordConstraints,
+  requiredPasswordConstraints,
+  type PasswordConstraintClassifier,
+  type PasswordD1Clock,
+  type PasswordPersistenceMapping,
+  type D1PasswordPersistenceMapping,
+  type PasswordRegistrationState,
+  type PasswordRegistrationIntent,
+  type PasswordRegistrationTable,
+  type PasswordRegistrationProvisioning,
+  type RequiredPasswordRegistrationConstraints,
+  requiredPasswordRegistrationConstraints,
+  type PasswordRegistrationConstraintClassifier,
+  type PasswordRegistrationMapping,
+  type AnyPasswordPersistenceMapping,
+  type AnyPasswordRegistrationMapping,
+} from "./internal/models/password-model";
+
+export {
+  type ProofAction,
+  type ProofScopeKind,
+  type ProofGenerationState,
+  type ProofDeliveryState,
+  type ProofCommandKind,
+  type ProofCommandDecision,
+  type ProofScopeKeys,
+  type ProofAuthorityInput,
+  type ProofAuthorityTables,
+  type ProofRequestTable,
+  type ProofSeriesTable,
+  type ProofGenerationTable,
+  type ProofContinuationRecord,
+  type ProofContinuationTable,
+  type ProofRateScopeTable,
+  type ProofAbuseEventTable,
+  type ProofFailureEventTable,
+  type ProofCommandTable,
+  type RequiredProofConstraints,
+  requiredProofConstraints,
+  type ProofConstraintClassifier,
+  type ProofD1Clock,
+  type ProofPersistenceMapping,
+  type D1ProofPersistenceMapping,
+  type AnyProofPersistenceMapping,
+} from "./internal/models/proof-model";
+
+export {
+  type SessionIdCodec,
+  type SessionSubjectTables,
+  type SessionAuthorityTables,
+  type SessionFlowTables,
+  type StatefulSessionTables,
+  type PendingAuthenticationTables,
+  type SignedSessionValidityTables,
+  type RequiredSessionConstraints,
+  type RequiredPendingAuthenticationConstraints,
+  type RequiredStatefulPendingConstraints,
+  type RequiredSignedValidityConstraints,
+  requiredSessionConstraints,
+  requiredPendingAuthenticationConstraints,
+  requiredStatefulPendingConstraints,
+  requiredSignedValidityConstraints,
+  type SessionConstraintClassifier,
+  type AuthenticationAuthorityMapping,
+  type StatefulSessionMapping,
+  type PendingAuthenticationMapping,
+  type SignedSessionValidityMapping,
+  type D1SessionClockMapping,
+  type D1AuthenticationAuthorityMapping,
+  type D1PendingAuthenticationMapping,
+  type D1StatefulSessionMapping,
+  type D1SignedSessionValidityMapping,
+} from "./internal/models/session-model";
+
+export {
+  type SessionStepUpIntentTables,
+  type RequiredSessionStepUpConstraints,
+  requiredSessionStepUpConstraints,
+  type SessionStepUpSourceTables,
+  type SessionStepUpMapping,
+  type D1SessionStepUpMapping,
+} from "./internal/models/step-up-model";
+
+export { requireStandalone } from "./internal/standalone";
+
+export {
+  decodeStepUpIntent,
+  encodeStepUpIntent,
+  stepUpIntentLive,
+  validateStepUpPlan,
+} from "./internal/step-up-state";
+
+export {
+  type CurrentAddress,
+  CurrentEmailSql,
+  type EmailSqlConfiguration,
+  type EmailSqlDatabase,
+  type EmailSqlQuery,
+  makeEmailKernel,
+} from "./internal/email-kernel";
+
+export { PersistenceMappingError, isMappedConstraintConflict } from "./internal/mapping-error";
+export { type PasskeyKernel, makePasskeyKernel } from "./internal/passkey-kernel";
+export { type PasskeyOwner, CurrentPasskeyTransaction } from "./internal/passkey/state";
+
+export {
+  type PasskeyCoordinatorError,
+  type PasskeyExecution,
+  type PasskeyTargetConfiguration,
+} from "./internal/passkey/target";
+
+export {
+  CurrentPasswordPreparedTransaction,
+  PasswordPreparedJournalGuards,
+  type PasswordPreparedPostcondition,
+  PasswordPreparedPostconditions,
+} from "./internal/PasswordPreparedPostconditions";
+
+export {
+  CurrentPasswordSql,
+  type PasswordSqlConfiguration,
+  type PasswordSqlDatabase,
+  type PasswordSqlQuery,
+  makePasswordKernel,
+} from "./internal/password-kernel";
+
+export { CurrentPhoneTransaction, makePhoneKernel } from "./internal/phone-kernel";
+
+export {
+  CurrentProofSql,
+  type ProofSqlConfiguration,
+  type ProofSqlDatabase,
+  type ProofSqlQuery,
+  makeProofKernel,
+} from "./internal/proof-kernel";
+
+export {
+  type QueryFailure,
+  type QueryOperations,
+  type SqlColumn,
+  type SqlExpression,
+  type SqlFragment,
+  type TableModel,
+} from "./internal/query-operations";
+
+export {
+  CurrentSessionSql,
+  type SessionSqlDatabase,
+  type SessionSqlOptions,
+  makeSessionKernel,
+} from "./internal/session-kernel";
+
+export {
+  type TransactionBound,
+  type TransactionCoordinatorError,
+  type TransactionExecution,
+  type TransactionTargetConfiguration,
+  makeTransactionExecutionKernel,
+} from "./internal/transaction-execution-kernel";
+
+export {
+  type GuardedUpdate,
+  type Observation,
+  type Row,
+  type TransactionNativeDatabase,
+  type TransactionOwner,
+  makeTransactionKernel,
+} from "./internal/transaction-kernel";
+
+export { PersistenceConfigurationError } from "./internal/configuration";
+export { makeComposedPasskeys } from "./internal/passkeys";
+export { createPersistence } from "./internal/persistence";
+export { type StorageTable } from "./internal/storage-tables";
+export type { SubjectIdCodec } from "./internal/models/common";
+export type { PasswordRegistrationAuthority } from "./internal/registration-contract";
+
+export type {
+  BoundPersistence,
+  ClaimsCodec,
+  Definition,
+  PersistenceApi,
+} from "./internal/configuration";

package/src/index.ts

@@ -0,0 +1,6 @@
+export { AuthPersistence } from "./internal/sql-persistence";
+export { OAuthAppPersistence } from "./internal/oauth-app";
+export { OAuthServerPersistence } from "./internal/oauth-server";
+export { PersistenceConfigurationError } from "./internal/configuration";
+export { PersistenceMappingError } from "./internal/mapping-error";
+export { StorageColumn, StorageTable } from "./internal/storage-tables";

package/src/internal/PasswordPreparedPostconditions.ts

@@ -0,0 +1,30 @@
+import type { PreparedCommit } from "@yielded/auth/Hooks";
+import type { PasswordUnavailable } from "@yielded/auth/Password";
+import type { ProofUnavailable } from "@yielded/auth/Proofs";
+import { Context, type Effect } from "effect";
+
+import type { PasswordSqlDatabase } from "./password-kernel";
+
+/** Final reads resolve the current physical owner, never a released savepoint. */
+export class CurrentPasswordPreparedTransaction extends Context.Service<
+  CurrentPasswordPreparedTransaction,
+  PasswordSqlDatabase
+>()("effect-auth/drizzle/CurrentPasswordPreparedTransaction") {}
+
+export type PasswordPreparedPostcondition = Effect.Effect<
+  void,
+  PasswordUnavailable | ProofUnavailable,
+  CurrentPasswordPreparedTransaction
+>;
+
+/** Registration ends when the application owner returns, before final validation. */
+export class PasswordPreparedPostconditions extends Context.Service<
+  PasswordPreparedPostconditions,
+  { readonly register: (check: PasswordPreparedPostcondition) => boolean }
+>()("effect-auth/drizzle/PasswordPreparedPostconditions") {}
+
+/** Journal registration closes with the prepared-password owner callback. */
+export class PasswordPreparedJournalGuards extends Context.Service<
+  PasswordPreparedJournalGuards,
+  { readonly register: (guard: PreparedCommit<void>) => boolean }
+>()("effect-auth/drizzle/PasswordPreparedJournalGuards") {}

package/src/internal/configuration.ts

@@ -0,0 +1,282 @@
+import type { EmailAction, EmailAddressPersistence } from "@yielded/auth/Email";
+import type { LoginIdentifier } from "@yielded/auth/Identity";
+import type {
+  PasskeyActionChallenge,
+  PasskeyConfig,
+  PasskeyCredentials,
+  PasskeyEnrollmentContext,
+  PasskeyManagementPersistence,
+  PasskeyManagementPolicy,
+  PasskeyMethodPolicy,
+  PasskeyPersistence,
+  PasskeyConfigurationError,
+} from "@yielded/auth/Passkey";
+import type {
+  PasswordAction,
+  PasswordPersistence,
+  PasswordUnavailable,
+} from "@yielded/auth/Password";
+import type { PhoneAdmission, PhoneSignInTargets } from "@yielded/auth/PhoneOtp";
+import type { ProofPersistence } from "@yielded/auth/Proofs";
+import type { SubjectId } from "@yielded/auth/Schema";
+import type {
+  AuthenticationAuthority,
+  AuthenticationRequirement,
+  make as makeSessions,
+} from "@yielded/auth/Sessions";
+import { type Context, type Effect, type Layer, Schema } from "effect";
+import type { SqlClient } from "effect/unstable/sql";
+
+import type { PersistenceMappingError } from "./mapping-error";
+import type { StorageRole } from "./storage-tables";
+
+export class PersistenceConfigurationError extends Schema.TaggedError<PersistenceConfigurationError>()(
+  "PersistenceConfigurationError",
+  { reason: Schema.String },
+) {}
+
+export type ClaimsCodec = Schema.Codec<unknown, unknown, never, never>;
+
+export interface PasskeyFeature {
+  readonly kind: "passkey";
+  readonly moduleId: string;
+  readonly policy: Effect.Effect<PasskeyMethodPolicy, PasskeyConfigurationError, PasskeyConfig>;
+  readonly management?: boolean;
+  readonly managementPolicy?: PasskeyManagementPolicy;
+}
+
+export interface Strategy {
+  readonly strategy: object;
+  readonly persistence?:
+    | PasskeyFeature
+    | {
+        readonly kind: "password" | "phone" | "email";
+        readonly moduleId: string;
+        readonly lifecycle?: boolean;
+        readonly management?: boolean;
+        readonly addresses?: boolean;
+      };
+  readonly RegistrationAuthority?: Context.Key<unknown, unknown>;
+}
+
+export interface Definition<C extends ClaimsCodec, Id extends string> {
+  readonly namespace: string;
+  readonly claims: C;
+  readonly sessionMode?: string;
+  readonly sessions: ReturnType<typeof makeSessions<C, Id>>;
+  readonly strategies: Readonly<Record<string, Strategy>>;
+}
+
+type KeyId<T> = T extends Context.Key<infer Id, infer _Service> ? Id : never;
+type Enabled<
+  A extends { readonly strategies: Readonly<Record<string, Strategy>> },
+  Kind extends "password" | "phone" | "email" | "passkey",
+> = Extract<A["strategies"][keyof A["strategies"]], { persistence: { kind: Kind } }>;
+
+type ManagedPassword<A extends { readonly strategies: Readonly<Record<string, Strategy>> }> =
+  Extract<Enabled<A, "password">, { persistence: { management: true } }>;
+
+type ManagedPasskey<A extends { readonly strategies: Readonly<Record<string, Strategy>> }> =
+  Extract<Enabled<A, "passkey">, { persistence: { management: true } }>;
+
+export type PasskeyRequirement<
+  A extends { readonly strategies: Readonly<Record<string, Strategy>> },
+> = Enabled<A, "passkey"> extends never ? never : PasskeyConfig;
+
+type RegistrationKey<S> = S extends { readonly RegistrationAuthority: infer K } ? K : never;
+type Registration<S> =
+  RegistrationKey<S> extends Context.Key<infer _Id, infer Service>
+    ? Service extends { readonly register: (input: infer Input, ...args: never[]) => unknown }
+      ? Input extends { readonly registration: infer Value }
+        ? Value
+        : never
+      : never
+    : never;
+
+export interface ProvisioningId<Id extends string> {
+  readonly authNamespace: Id;
+  readonly service: "PersistenceProvisioning";
+}
+
+export type Provisioning<A extends { readonly strategies: Readonly<Record<string, Strategy>> }> = {
+  readonly [
+    K in keyof A["strategies"] as A["strategies"][K] extends {
+      persistence: { kind: "password"; management: true };
+    }
+      ? K
+      : never
+  ]: (input: {
+    readonly identifier: LoginIdentifier;
+    readonly registration: Registration<A["strategies"][K]>;
+  }) => Effect.Effect<SubjectId, PasswordUnavailable>;
+};
+
+export type ProvisioningRequirement<
+  A extends { readonly namespace: string; readonly strategies: Readonly<Record<string, Strategy>> },
+> = ManagedPassword<A> extends never ? never : ProvisioningId<A["namespace"]>;
+
+type ProofRoles =
+  | "proofRequests"
+  | "proofSeries"
+  | "proofGenerations"
+  | "proofContinuations"
+  | "proofScopes"
+  | "proofAbuse"
+  | "proofFailures"
+  | "proofCommands";
+
+type UsesProofs<A extends { readonly strategies: Readonly<Record<string, Strategy>> }> =
+  | Enabled<A, "phone">
+  | Enabled<A, "email">
+  | ManagedPassword<A>;
+
+export type Ports<C extends ClaimsCodec, Id extends string, A extends Definition<C, Id>> =
+  | AuthenticationAuthority
+  | KeyId<A["sessions"]["StatefulSessionPersistence"]>
+  | KeyId<A["sessions"]["SessionRepository"]>
+  | (Enabled<A, "password"> extends never ? never : PasswordPersistence)
+  | KeyId<RegistrationKey<ManagedPassword<A>>>
+  | (Enabled<A, "passkey"> extends never ? never : PasskeyPersistence | PasskeyCredentials)
+  | (ManagedPasskey<A> extends never
+      ? never
+      : PasskeyManagementPersistence | PasskeyEnrollmentContext)
+  | (Enabled<A, "email"> extends never ? never : EmailAddressPersistence)
+  | (UsesProofs<A> extends never ? never : ProofPersistence)
+  | (Enabled<A, "phone"> extends never ? never : PhoneAdmission | PhoneSignInTargets);
+
+export type Roles<C extends ClaimsCodec, Id extends string, A extends Definition<C, Id>> =
+  | "identifiers"
+  | "credentials"
+  | "sessions"
+  | "sessionFlows"
+  | (Enabled<A, "password"> extends never
+      ? never
+      :
+          | "passwords"
+          | "passwordAttempts"
+          | "passwordScopes"
+          | "passwordCharges"
+          | "passwordCommands")
+  | (ManagedPassword<A> extends never ? never : "passwordRegistrations")
+  | (Enabled<A, "phone"> extends never ? never : "phoneState")
+  | (Enabled<A, "email"> extends never ? never : "emailCredentials" | "emailCommands")
+  | (Enabled<A, "passkey"> extends never
+      ? never
+      :
+          | "passkeyCredentials"
+          | "passkeyOwnership"
+          | "passkeyHandles"
+          | "passkeyModules"
+          | "passkeyFlows"
+          | "passkeyAdmissions"
+          | "passkeyCharges")
+  | (ManagedPasskey<A> extends never ? never : "passkeyCommands")
+  | (UsesProofs<A> extends never ? never : ProofRoles);
+
+export interface SubjectOptions<T extends object, NativeId> {
+  readonly table: T;
+  readonly id: string;
+  readonly status: string;
+  readonly activeValue: unknown;
+  readonly securityRevision: string;
+  readonly idCodec: Schema.Codec<SubjectId, NativeId>;
+  readonly requirements: (
+    row: Readonly<Record<string, unknown>>,
+  ) => Effect.Effect<AuthenticationRequirement, PersistenceMappingError>;
+  /** Defaults to sign-in requirements. Recovery can have a distinct application policy. */
+  readonly actionRequirements?: (
+    row: Readonly<Record<string, unknown>>,
+    action: PasswordAction | EmailAction | PasskeyActionChallenge["action"],
+  ) => Effect.Effect<AuthenticationRequirement, PersistenceMappingError>;
+}
+
+/** Codecs at the application-owned subject and timestamp boundary. */
+export interface SubjectMapping {
+  readonly table: object;
+  readonly id: string;
+  readonly status: string;
+  readonly securityRevision: string;
+  readonly activeValue: unknown;
+  readonly requirements: SubjectOptions<object, unknown>["requirements"];
+  readonly actionRequirements: NonNullable<SubjectOptions<object, unknown>["actionRequirements"]>;
+  readonly toSubject: (value: unknown) => Effect.Effect<SubjectId, PersistenceMappingError>;
+  readonly toNative: (value: SubjectId) => Effect.Effect<unknown, PersistenceMappingError>;
+  readonly toSubjectSync: (value: unknown) => SubjectId;
+  readonly toNativeSync: (value: SubjectId) => unknown;
+}
+
+export interface MappingInput {
+  readonly tables: Partial<Record<StorageRole, object>>;
+  readonly subjects: SubjectMapping;
+  readonly encodeInstant: (millis: number) => unknown;
+  readonly decodeInstant: (value: unknown) => Effect.Effect<number, PersistenceMappingError>;
+  readonly decodeInstantSync: (value: unknown) => number;
+}
+
+export interface StorageLayout<
+  T extends object,
+  Role extends StorageRole = StorageRole,
+> extends MappingInput {
+  readonly namespace: string;
+  readonly schema: Readonly<Record<Role, T>>;
+}
+
+export interface ConfigId<Id extends string> {
+  readonly authNamespace: Id;
+  readonly service: "PersistenceConfig";
+}
+
+export interface TimestampOptions<Instant> {
+  readonly type: "text" | "integer";
+  readonly codec: Schema.Codec<number, Instant>;
+}
+
+export interface BoundPersistence<
+  T extends object,
+  R,
+  C extends ClaimsCodec,
+  Id extends string,
+  A extends Definition<C, Id>,
+> {
+  readonly Config: Context.Service<ConfigId<A["namespace"]>, StorageLayout<T, Roles<C, Id, A>>> & {
+    readonly layer: (
+      value: StorageLayout<T, Roles<C, Id, A>>,
+    ) => Layer.Layer<ConfigId<A["namespace"]>>;
+  };
+  /** Create only the application subject. Runs inside the owning auth SQL transaction;
+   * use that SqlClient (including Drizzle over it), and return the new subject ID.
+   * Do not perform external side effects or open an independent transaction here.
+   */
+  readonly Provisioning: Context.Service<ProvisioningRequirement<A>, Provisioning<A>>;
+  readonly layer: Layer.Layer<
+    Ports<C, Id, A>,
+    PersistenceConfigurationError,
+    | ConfigId<A["namespace"]>
+    | ProvisioningRequirement<A>
+    | PasskeyRequirement<A>
+    | SqlClient.SqlClient
+    | R
+  >;
+  readonly managed: <N, Instant = number>(options: {
+    readonly subjects: SubjectOptions<T, N>;
+    readonly tables?: Partial<Record<Roles<C, Id, A>, T>>;
+    readonly prefix?: string;
+    readonly timestamps?: TimestampOptions<Instant>;
+  }) => StorageLayout<T, Roles<C, Id, A>>;
+  readonly map: <N, Instant = number>(options: {
+    readonly subjects: SubjectOptions<T, N>;
+    readonly tables: Readonly<Record<Roles<C, Id, A>, T>>;
+    readonly timestamps?: TimestampOptions<Instant>;
+  }) => StorageLayout<T, Roles<C, Id, A>>;
+}
+
+/** Shared configuration shape. The backend chooses table types and service requirements. */
+export interface PersistenceApi<T extends object, R = never> {
+  readonly make: <
+    C extends ClaimsCodec,
+    const Id extends string,
+    const A extends Definition<C, Id>,
+  >(
+    auth: A & Definition<C, Id>,
+  ) => BoundPersistence<T, R, C, Id, A>;
+}