@yielded/auth-persistence 0.1.0-beta.13 → 0.1.0-beta.15

package/dist/internal/session-kernel.mjs

@@ -181,6 +181,7 @@ const makeSessionKernel = (operations) => {
 	};
 	const makeSqlAuthenticationAuthority = Effect.fnUntraced(function* (mapping, options) {
 		const database = yield* CurrentSessionSql;
+		if (!options.coordinated) yield* (operations.validateStorage?.(mapping) ?? Effect.void).pipe(Effect.mapError(unavailable));
 		const hooks = yield* LifecycleHooks;
 		const service = {
 			capture: (subjectId, credentialIds) => safeTransaction(inTransaction(database, captureIn(mapping, subjectId, credentialIds, true))),
@@ -237,6 +238,7 @@ const makeSessionKernel = (operations) => {
 	});
 	const makeSqlPendingAuthentication = Effect.fnUntraced(function* (mapping, options) {
 		const database = yield* CurrentSessionSql;
+		if (!options.coordinated) yield* (operations.validateStorage?.(mapping) ?? Effect.void).pipe(Effect.mapError(unavailable));
 		const hooks = yield* LifecycleHooks;
 		const service = {
 			create: (input, _inputNow, prepare) => owned(database, options, mapping.isConstraintConflict, Effect.gen(function* () {
@@ -308,6 +310,7 @@ const makeSessionKernel = (operations) => {
 	});
 	const makeSqlStatefulSessions = Effect.fnUntraced(function* (mapping, options) {
 		const database = yield* CurrentSessionSql;
+		if (!options.coordinated) yield* (operations.validateStorage?.(mapping) ?? Effect.void).pipe(Effect.mapError(unavailable));
 		const hooks = yield* LifecycleHooks;
 		const c = sessionColumns(mapping);
 		const persistence = {
@@ -326,6 +329,7 @@ const makeSessionKernel = (operations) => {
 				}
 				const nativeSessionId = yield* allocate(options.mode, mapping.session.allocateId, mapping.session.allocateIdSync);
 				const sessionId = yield* mapping.sessionId.toSession(nativeSessionId);
+				if (sessionId === input.handoffSourceSessionId) return yield* SessionConflict.make({});
 				const version = yield* allocate(options.mode, mapping.session.allocateVersion, mapping.session.allocateVersionSync);
 				const assessed = yield* assessAuthentication(input.evidence, requirement);
 				const now = yield* freshNow;
@@ -336,7 +340,7 @@ const makeSessionKernel = (operations) => {
 					version,
 					subjectId: input.evidence.revision.subjectId,
 					securityRevision: input.evidence.revision.securityRevision,
-					assurance: assessed.assurance,
+					assurance: input.handoffSourceSessionId === void 0 ? assessed.assurance : input.session.assurance,
 					provenance: yield* snapshotSessionAuthenticationProvenance({ evidence: input.evidence }),
 					issuedAt: now
 				};
@@ -350,6 +354,8 @@ const makeSessionKernel = (operations) => {
 					subjectId: nativeSubjectId,
 					sessionId: nativeSessionId
 				}));
+				const commitNow = yield* freshNow;
+				if (DateTime.toEpochMillis(commitNow) < DateTime.toEpochMillis(record.issuedAt) || DateTime.toEpochMillis(commitNow) >= DateTime.toEpochMillis(record.expiresAt) || !(yield* assessAuthentication(input.evidence, requirement)).satisfied) return yield* stale();
 				return receipt;
 			}).pipe(normalizeMutation(mapping))),
 			verify: (input) => safeTransaction(inTransaction(database, Effect.gen(function* () {
@@ -457,6 +463,7 @@ const makeSessionKernel = (operations) => {
 	});
 	const makeSqlSignedValidity = Effect.fnUntraced(function* (mapping, options) {
 		const database = yield* CurrentSessionSql;
+		if (!options.coordinated) yield* (operations.validateStorage?.(mapping) ?? Effect.void).pipe(Effect.mapError(unavailable));
 		const hooks = yield* LifecycleHooks;
 		const subject = subjectColumns(mapping);
 		const tombstone = {
@@ -595,6 +602,7 @@ const makeSessionKernel = (operations) => {
 		makeSqlSignedValidity,
 		makeSqlSessionStepUp: Effect.fnUntraced(function* (mapping, options) {
 			const database = yield* CurrentSessionSql;
+			if (!options.coordinated) yield* (operations.validateStorage?.(mapping) ?? Effect.void).pipe(Effect.mapError(unavailable));
 			const hooks = yield* LifecycleHooks;
 			const m = mapping.intent, c = stepUpColumns(mapping);
 			const read = (digest) => mapFailureCause(safeTransaction(inTransaction(database, readSqlStepUp(mapping, digest, options.locking))), (error) => error._tag === "StaleAuthentication" ? SessionStepUpInvalid.make({}) : error);