@yielded/auth-persistence 0.1.0-beta.10

package/src/internal/query-operations.ts

@@ -0,0 +1,81 @@
+import type { Statement } from "effect/unstable/sql/Statement";
+
+/** Adapter-owned table metadata. No driver or ORM type enters the shared models. */
+export interface TableModel {
+  readonly table: object;
+  readonly column: string;
+  readonly select: Record<string, unknown>;
+  readonly insert: Record<string, unknown>;
+}
+
+/** Kernels erase the physical table handle after the adapter validates its
+ * mapping. Rows and insert values still pass through their declared codecs. */
+export interface AnyTableModel extends TableModel {
+  // oxlint-disable-next-line no-explicit-any -- physical compiler handle, never a domain value or an Effect error.
+  readonly table: any;
+}
+
+/** Opaque compiler expression; only the owning compiler interprets its contents. */
+export interface SqlExpression {
+  readonly getSQL: () => SqlExpression;
+}
+
+export interface SqlFragment extends SqlExpression {
+  readonly mapWith: (decode: (value: unknown) => unknown) => SqlFragment;
+  readonly as: (name: string) => SqlExpression;
+}
+
+export interface SqlColumn extends SqlExpression {
+  readonly mapToDriverValue: (value: unknown) => unknown;
+}
+
+/** Native query failures stay in E until the owning kernel reports and redacts
+ * them. Drivers may carry a more specific tag; the cause remains available to
+ * the application's constraint classifier and is never public telemetry. */
+export interface QueryFailure {
+  readonly _tag: string;
+  readonly cause: unknown;
+}
+
+type Predicate<Fragment> = (
+  ...parts: ReadonlyArray<SqlExpression | undefined>
+) => Fragment | undefined;
+type Comparison<Fragment> = (left: unknown, right: unknown) => Fragment;
+
+/** Compiler operations shared by the SQL state machines; no driver is acquired here. */
+export interface QueryOperations<
+  Fragment extends SqlFragment = SqlFragment,
+  Column extends SqlColumn = SqlColumn,
+> {
+  readonly and: Predicate<Fragment>;
+  readonly or: Predicate<Fragment>;
+  readonly balancedD1And: Predicate<Fragment>;
+  readonly asc: (value: unknown) => Fragment;
+  readonly eq: Comparison<Fragment>;
+  readonly gt: Comparison<Fragment>;
+  readonly gte: Comparison<Fragment>;
+  readonly lte: Comparison<Fragment>;
+  readonly inArray: (value: unknown, values: ReadonlyArray<unknown>) => Fragment;
+  readonly isNull: (value: unknown) => Fragment;
+  readonly notExists: (value: SqlExpression) => Fragment;
+  readonly sql: {
+    (parts: TemplateStringsArray, ...values: ReadonlyArray<unknown>): Fragment;
+    readonly param: (value: unknown, column: SqlColumn) => unknown;
+    readonly join: (values: ReadonlyArray<unknown>, separator: SqlExpression) => Fragment;
+  };
+  readonly getTableColumns: (table: object) => Readonly<Record<string, Column>>;
+  readonly column: (table: object, key: string) => Column;
+  readonly updateValues: (
+    entries: ReadonlyArray<readonly [string, unknown]>,
+  ) => Record<string, unknown>;
+  readonly compactD1GeneratedStatement: <A extends object>(
+    client: {
+      readonly unsafe: <Row extends object>(
+        sql: string,
+        params?: ReadonlyArray<unknown>,
+      ) => Statement<Row>;
+    },
+    statement: Statement<A>,
+    invalid: () => unknown,
+  ) => Statement<A>;
+}

package/src/internal/registration-contract.ts

@@ -0,0 +1,22 @@
+import type { PreparedCommit } from "@yielded/auth/Hooks";
+import type { LoginIdentifier } from "@yielded/auth/Identity";
+import type {
+  PasswordUnavailable,
+  PasswordReplacement,
+  PasswordRegistrationDecision,
+  PreparePasswordCommit,
+} from "@yielded/auth/Password";
+import type { Effect } from "effect";
+
+export interface PasswordRegistrationAuthority<Registration> {
+  readonly register: <A>(
+    input: {
+      readonly moduleId: string;
+      readonly requestId: string;
+      readonly identifier: LoginIdentifier;
+      readonly registration: Registration;
+      readonly replacement: PasswordReplacement;
+    },
+    prepare: PreparePasswordCommit<PasswordRegistrationDecision, A>,
+  ) => Effect.Effect<PreparedCommit<A>, PasswordUnavailable>;
+}

package/src/internal/registration.ts

@@ -0,0 +1,161 @@
+import { randomId } from "@yielded/auth-crypto";
+import { coordinateCommit, hasCommitScope, LifecycleHooks } from "@yielded/auth/Hooks";
+import type { LoginIdentifier } from "@yielded/auth/Identity";
+import { PasswordUnavailable } from "@yielded/auth/Password";
+import { reportPersistenceFailure } from "@yielded/auth/Persistence";
+import type { SubjectId } from "@yielded/auth/Schema";
+import { SecurityRevision } from "@yielded/auth/Sessions";
+import { Effect, Schema } from "effect";
+
+import type { PasswordSqlDatabase } from "./password-kernel";
+import type { QueryOperations } from "./query-operations";
+import type { PasswordRegistrationAuthority } from "./registration-contract";
+import type { makeMappings } from "./storage-mapping";
+
+class IdentifierTaken extends Schema.TaggedError<IdentifierTaken>()("IdentifierTaken", {}) {}
+
+export type CreateSubject = (input: {
+  readonly identifier: LoginIdentifier;
+  readonly registration: unknown;
+}) => Effect.Effect<SubjectId, PasswordUnavailable>;
+
+/** Registration reserves the command, provisions the application's subject, and
+ * creates the unverified identifier and password in one SQL transaction. Replays
+ * always suppress; a public request ID never recovers a private password intent.
+ */
+export const makeRegistrationAuthority = Effect.fn("makeRegistrationAuthority")(function* (
+  database: PasswordSqlDatabase,
+  mappings: ReturnType<typeof makeMappings>,
+  operations: QueryOperations,
+  standalone: Effect.Effect<void, PasswordUnavailable>,
+  createSubject: CreateSubject,
+): Effect.fn.Return<PasswordRegistrationAuthority<unknown>, never, LifecycleHooks> {
+  const hooks = yield* LifecycleHooks;
+  const { and, eq, column } = operations;
+  const mapping = mappings.passwords();
+  const receipts = mappings.table("passwordRegistrations");
+
+  return {
+    register: (input, prepare) =>
+      Effect.gen(function* () {
+        if (yield* hasCommitScope) return yield* PasswordUnavailable.make({});
+        yield* standalone;
+
+        const receipt = { moduleId: input.moduleId, requestId: input.requestId };
+
+        const suppress = coordinateCommit(
+          (journal) =>
+            database.transaction((tx) =>
+              Effect.gen(function* () {
+                yield* tx.insert(receipts).values(receipt).onConflictDoNothing();
+
+                return prepare({ _tag: "Suppressed" }, journal);
+              }),
+            ),
+          { mode: "interactive" },
+        );
+
+        const committed = yield* coordinateCommit(
+          (journal) =>
+            database.transaction((tx) =>
+              Effect.gen(function* () {
+                const reserved = yield* tx
+                  .insert(receipts)
+                  .values(receipt)
+                  .onConflictDoNothing()
+                  .returning();
+
+                if (reserved.length === 0) return prepare({ _tag: "Suppressed" }, journal);
+
+                const identifiers = yield* tx
+                  .select()
+                  .from(mapping.identifier.table)
+                  .where(
+                    and(
+                      eq(
+                        column(mapping.identifier.table, mapping.identifier.namespace),
+                        input.identifier.namespace,
+                      ),
+                      eq(
+                        column(mapping.identifier.table, mapping.identifier.value),
+                        input.identifier.value,
+                      ),
+                    ),
+                  )
+                  .limit(1);
+
+                if (identifiers.length !== 0) return prepare({ _tag: "Suppressed" }, journal);
+
+                const subjectId = yield* createSubject({
+                  identifier: input.identifier,
+                  registration: input.registration,
+                });
+
+                const nativeId = yield* mapping.subjectId.toNative(subjectId);
+
+                const subjects = yield* tx
+                  .select()
+                  .from(mapping.subject.table)
+                  .where(eq(column(mapping.subject.table, mapping.subject.id), nativeId))
+                  .limit(1);
+
+                if (
+                  subjects.length !== 1 ||
+                  !mapping.subject.isActiveStatus(subjects[0][mapping.subject.status])
+                )
+                  return yield* PasswordUnavailable.make({});
+                yield* Schema.decodeUnknownEffect(SecurityRevision)(
+                  subjects[0][mapping.subject.securityRevision],
+                );
+
+                const bound = yield* tx
+                  .insert(mapping.identifier.table)
+                  .values(
+                    mapping.identifier.encodeInitialInsert(
+                      input.identifier,
+                      nativeId,
+                      SecurityRevision.make(randomId()),
+                    ),
+                  )
+                  .onConflictDoNothing()
+                  .returning();
+
+                // A concurrent registration won the identifier. Roll back the application
+                // subject too, then persist a non-authorizing receipt in a new transaction.
+                if (bound.length !== 1) return yield* new IdentifierTaken({});
+
+                const credentialId = randomId();
+                const credentialRevision = SecurityRevision.make(randomId());
+
+                yield* tx.insert(mapping.credential.table).values(
+                  mapping.credential.encodeInsert({
+                    moduleId: input.moduleId,
+                    subjectId: nativeId,
+                    credentialId,
+                    credentialRevision,
+                    verifierVersion: SecurityRevision.make(randomId()),
+                    replacement: input.replacement,
+                  }),
+                );
+                yield* tx.insert(mapping.authorityCredential.table).values(
+                  mapping.authorityCredential.encodeInsert({
+                    subjectId: nativeId,
+                    credentialId,
+                    revision: credentialRevision,
+                  }),
+                );
+
+                return prepare({ _tag: "Created", subjectId }, journal);
+              }),
+            ),
+          { mode: "interactive" },
+        ).pipe(Effect.catchTag("IdentifierTaken", () => suppress));
+
+        return committed.value;
+      }).pipe(
+        Effect.provideService(LifecycleHooks, hooks),
+        (work) => reportPersistenceFailure(work, Schema.is(PasswordUnavailable)),
+        Effect.mapError(() => PasswordUnavailable.make({})),
+      ),
+  };
+});