@yielded/auth-persistence 0.1.0-beta.14 → 0.1.0-beta.16

package/src/internal/proof-kernel.ts

@@ -43,6 +43,7 @@ import {
 import type { TableModel as Table } from "./query-operations";
 import type { QueryFailure } from "./query-operations";
 import type { QueryOperations, SqlFragment, SqlColumn } from "./query-operations";
+import type { NativeDatabase } from "./transaction-kernel";
 
 type AdapterFailure = QueryFailure | PersistenceMappingError | SqlError.SqlError;
 
@@ -661,8 +662,17 @@ export const makeProofKernel = <
   const makeSqlProofPersistence = Effect.fn("makeSqlProofPersistence")(function* (
     mapping: Mapping,
     configuration: ProofSqlConfiguration,
-  ): Effect.fn.Return<ProofPersistence["Service"], never, LifecycleHooks | CurrentProofSql> {
+  ): Effect.fn.Return<
+    ProofPersistence["Service"],
+    ProofUnavailable,
+    LifecycleHooks | CurrentProofSql | NativeDatabase
+  > {
     const database = yield* CurrentProofSql;
+
+    if (!configuration.coordinated)
+      yield* (operations.validateStorage?.(mapping) ?? Effect.void).pipe(
+        Effect.mapError(unavailable),
+      );
     const hooks = yield* LifecycleHooks;
 
     return ProofPersistence.of({
@@ -835,6 +845,34 @@ export const makeProofKernel = <
               | null
               | undefined;
 
+            const activeGeneration =
+              activeProofId === null || activeProofId === undefined
+                ? undefined
+                : (yield* readGeneration(
+                    mapping,
+                    input.record.moduleId,
+                    activeProofId,
+                    configuration.locking,
+                  ))[0];
+
+            if (
+              activeProofId !== null &&
+              activeProofId !== undefined &&
+              (activeGeneration === undefined ||
+                activeGeneration[mapping.generation.purpose] !== input.record.purpose)
+            )
+              return yield* unavailable();
+
+            const replacementAuthorized =
+              activeGeneration === undefined ||
+              activeGeneration[mapping.generation.state] !== "active" ||
+              (yield* mapping.decodeInstant(activeGeneration[mapping.generation.expiresAt])) <=
+                now ||
+              sameBinding(
+                yield* mapping.generation.decodeBinding(activeGeneration),
+                input.record.binding,
+              );
+
             const supersedesCurrent =
               input.supersedes === undefined || input.supersedes === activeProofId;
 
@@ -844,6 +882,7 @@ export const makeProofKernel = <
               admitted.length === scopes.length &&
               input.record.issuedAtMillis <= now &&
               input.record.expiresAtMillis > now &&
+              replacementAuthorized &&
               supersedesCurrent &&
               (lastIssueAt === undefined ||
                 now - lastIssueAt >= input.policy.abuse.resendCooldownMillis);
@@ -864,18 +903,17 @@ export const makeProofKernel = <
               journal,
             );
 
-            if (admitted.length > 0)
-              yield* insertScopeEvents(
-                mapping,
-                input.record.moduleId,
-                input.record.purpose,
-                "issue",
-                input.record.requestId,
-                admitted,
-                now,
-                retentionUntil,
-              );
             if (!allowed) return prepared;
+            yield* insertScopeEvents(
+              mapping,
+              input.record.moduleId,
+              input.record.purpose,
+              "issue",
+              input.record.requestId,
+              scopes,
+              now,
+              retentionUntil,
+            );
             if (activeProofId !== null && activeProofId !== undefined)
               yield* transaction
                 .update(mapping.generation.table)

package/src/internal/query-operations.ts

@@ -1,5 +1,9 @@
+import type { Effect } from "effect";
 import type { Statement } from "effect/sql/Statement";
 
+import type { PersistenceMappingError } from "./mapping-error";
+import type { NativeDatabase } from "./transaction-kernel";
+
 /** Adapter-owned table metadata. No driver or ORM type enters the shared models. */
 export interface TableModel {
   readonly table: object;
@@ -47,6 +51,10 @@ export interface QueryOperations<
   Fragment extends SqlFragment = SqlFragment,
   Column extends SqlColumn = SqlColumn,
 > {
+  /** Acquisition-only validation; adapters provide their captured root database. */
+  readonly validateStorage?: (
+    mapping: unknown,
+  ) => Effect.Effect<void, PersistenceMappingError, NativeDatabase>;
   readonly and: Predicate<Fragment>;
   readonly or: Predicate<Fragment>;
   readonly balancedD1And: Predicate<Fragment>;

package/src/internal/session-kernel.ts

@@ -61,6 +61,7 @@ import {
   validateStepUpPlan,
   stepUpRotationMatches,
 } from "./step-up-state";
+import type { NativeDatabase } from "./transaction-kernel";
 
 type CommitMode = "interactive" | "synchronous";
 
@@ -109,6 +110,7 @@ export class CurrentSessionSql extends Context.Service<CurrentSessionSql, Sessio
 type Guard = Effect.Effect<void, SessionUnavailable>;
 
 export interface SessionSqlOptions {
+  readonly coordinated?: boolean;
   readonly mode: CommitMode;
   readonly locking: boolean;
   /** Target-specific ambient transaction preflight. It runs before IDs or writes. */
@@ -630,10 +632,15 @@ export const makeSessionKernel = (operations: QueryOperations) => {
     options: SessionSqlOptions,
   ): Effect.fn.Return<
     AuthenticationAuthority["Service"],
-    never,
-    LifecycleHooks | CurrentSessionSql
+    SessionUnavailable,
+    LifecycleHooks | CurrentSessionSql | NativeDatabase
   > {
     const database = yield* CurrentSessionSql;
+
+    if (!options.coordinated)
+      yield* (operations.validateStorage?.(mapping) ?? Effect.void).pipe(
+        Effect.mapError(unavailable),
+      );
     const hooks = yield* LifecycleHooks;
 
     const service = {
@@ -790,8 +797,17 @@ export const makeSessionKernel = (operations: QueryOperations) => {
   const makeSqlPendingAuthentication = Effect.fnUntraced(function* <Claims>(
     mapping: PendingAuthenticationMapping<Claims, any, any, any, any, any>,
     options: SessionSqlOptions,
-  ): Effect.fn.Return<PendingAuthentication<Claims>, never, LifecycleHooks | CurrentSessionSql> {
+  ): Effect.fn.Return<
+    PendingAuthentication<Claims>,
+    SessionUnavailable,
+    LifecycleHooks | CurrentSessionSql | NativeDatabase
+  > {
     const database = yield* CurrentSessionSql;
+
+    if (!options.coordinated)
+      yield* (operations.validateStorage?.(mapping) ?? Effect.void).pipe(
+        Effect.mapError(unavailable),
+      );
     const hooks = yield* LifecycleHooks;
 
     const service = {
@@ -964,10 +980,15 @@ export const makeSessionKernel = (operations: QueryOperations) => {
       readonly statefulSessionPersistence: StatefulSessionPersistence<Claims>;
       readonly sessionRepository: SessionRepository;
     },
-    never,
-    LifecycleHooks | CurrentSessionSql
+    SessionUnavailable,
+    LifecycleHooks | CurrentSessionSql | NativeDatabase
   > {
     const database = yield* CurrentSessionSql;
+
+    if (!options.coordinated)
+      yield* (operations.validateStorage?.(mapping) ?? Effect.void).pipe(
+        Effect.mapError(unavailable),
+      );
     const hooks = yield* LifecycleHooks;
 
     const c = sessionColumns(mapping);
@@ -1018,6 +1039,8 @@ export const makeSessionKernel = (operations: QueryOperations) => {
 
             const sessionId = yield* mapping.sessionId.toSession(nativeSessionId);
 
+            if (sessionId === input.handoffSourceSessionId) return yield* SessionConflict.make({});
+
             const version = yield* allocate(
               options.mode,
               mapping.session.allocateVersion,
@@ -1043,7 +1066,10 @@ export const makeSessionKernel = (operations: QueryOperations) => {
               version,
               subjectId: input.evidence.revision.subjectId,
               securityRevision: input.evidence.revision.securityRevision,
-              assurance: assessed.assurance,
+              assurance:
+                input.handoffSourceSessionId === undefined
+                  ? assessed.assurance
+                  : input.session.assurance,
               provenance: yield* snapshotSessionAuthenticationProvenance({
                 evidence: input.evidence,
               }),
@@ -1067,6 +1093,17 @@ export const makeSessionKernel = (operations: QueryOperations) => {
               }),
             );
 
+            // Writes can suspend after prepare. Recheck the capped lifetime and
+            // original proof freshness while the authority rows remain locked.
+            const commitNow = yield* freshNow;
+
+            if (
+              DateTime.toEpochMillis(commitNow) < DateTime.toEpochMillis(record.issuedAt) ||
+              DateTime.toEpochMillis(commitNow) >= DateTime.toEpochMillis(record.expiresAt) ||
+              !(yield* assessAuthentication(input.evidence, requirement)).satisfied
+            )
+              return yield* stale();
+
             return receipt;
           }).pipe(normalizeMutation(mapping)),
         ),
@@ -1388,8 +1425,17 @@ export const makeSessionKernel = (operations: QueryOperations) => {
   const makeSqlSignedValidity = Effect.fnUntraced(function* (
     mapping: SignedSessionValidityMapping<any, any, any, any>,
     options: SessionSqlOptions,
-  ): Effect.fn.Return<SignedSessionValidity, never, LifecycleHooks | CurrentSessionSql> {
+  ): Effect.fn.Return<
+    SignedSessionValidity,
+    SessionUnavailable,
+    LifecycleHooks | CurrentSessionSql | NativeDatabase
+  > {
     const database = yield* CurrentSessionSql;
+
+    if (!options.coordinated)
+      yield* (operations.validateStorage?.(mapping) ?? Effect.void).pipe(
+        Effect.mapError(unavailable),
+      );
     const hooks = yield* LifecycleHooks;
 
     const subject = subjectColumns(mapping);
@@ -1780,8 +1826,17 @@ export const makeSessionKernel = (operations: QueryOperations) => {
   const makeSqlSessionStepUp = Effect.fnUntraced(function* <Claims>(
     mapping: SessionStepUpMapping<Claims, any, any, any, any, any, any, any>,
     options: SessionSqlOptions,
-  ): Effect.fn.Return<SessionStepUpPersistence<Claims>, never, LifecycleHooks | CurrentSessionSql> {
+  ): Effect.fn.Return<
+    SessionStepUpPersistence<Claims>,
+    SessionUnavailable,
+    LifecycleHooks | CurrentSessionSql | NativeDatabase
+  > {
     const database = yield* CurrentSessionSql;
+
+    if (!options.coordinated)
+      yield* (operations.validateStorage?.(mapping) ?? Effect.void).pipe(
+        Effect.mapError(unavailable),
+      );
     const hooks = yield* LifecycleHooks;
 
     const m = mapping.intent,

package/src/internal/storage-mapping.ts

@@ -76,6 +76,11 @@ const ProofContinuation = Schema.Struct({
   version: ProofVersion,
 });
 
+/** Derive shared row mappings from a managed or custom storage layout.
+ * Each factory requires its role tables to exist. Adapter authors supply typed
+ * table handles and dialect-specific clocks/commit predicates, and may refine
+ * authority policy for explicit services. This does not alter composed defaults.
+ */
 export const makeMappings = (input: MappingInput) => {
   const table = (role: StorageRole) => {
     const found = input.tables[role];

package/src/internal/storage-validation.ts

@@ -11,6 +11,13 @@ const PgColumns = Schema.Array(Schema.Struct({ name: Schema.String }));
 const PgKeys = Schema.Array(Schema.Struct({ columns: Schema.Array(Schema.String) }));
 const quote = (value: string) => '"' + value.replaceAll('"', '""') + '"';
 
+/** Physical metadata needed for catalog validation; value codecs remain adapter-owned. */
+export interface PhysicalStorageTable {
+  readonly name: string;
+  readonly schema?: string;
+  readonly columns: Readonly<Record<string, { readonly name: string }>>;
+}
+
 export const qualifiedTableName = (table: Pick<StorageTable, "name" | "schema">) =>
   (table.schema === undefined ? "" : quote(table.schema) + ".") + quote(table.name);
 
@@ -18,8 +25,8 @@ export const qualifiedTableName = (table: Pick<StorageTable, "name" | "schema">)
  * partial or expression index cannot establish these unconditional guarantees. */
 export const validateStorage = Effect.fnUntraced(
   function* (
-    dialect: "pg" | "sqlite",
-    table: StorageTable,
+    dialect: "pg" | "mysql" | "sqlite",
+    table: PhysicalStorageTable,
     required: ReadonlyArray<ReadonlyArray<string>>,
   ) {
     const client = yield* SqlClient;
@@ -64,22 +71,76 @@ export const validateStorage = Effect.fnUntraced(
 
           return keys;
         })
-      : Effect.gen(function* () {
-          const relation = qualifiedTableName(table);
-
-          const columns =
-            yield* client`select attname as name from pg_attribute where attrelid = to_regclass(${relation}) and attnum > 0 and not attisdropped`.pipe(
-              Effect.flatMap(Schema.decodeUnknownEffect(PgColumns)),
+      : dialect === "mysql"
+        ? Effect.gen(function* () {
+            const columns = yield* client`
+              select column_name as name from information_schema.columns
+              where table_schema = coalesce(${table.schema ?? null}, database())
+                and table_name = ${table.name}
+            `.pipe(Effect.flatMap(Schema.decodeUnknownEffect(PgColumns)));
+
+            for (const column of Object.values(table.columns)) {
+              if (!columns.some((actual) => actual.name === column.name))
+                return yield* PersistenceConfigurationError.make({
+                  reason: `Missing SQL column ${table.name}.${column.name}`,
+                });
+            }
+
+            const indexes = yield* client`
+              select index_name as name, column_name as columnName, sub_part as prefix
+              from information_schema.statistics
+              where table_schema = coalesce(${table.schema ?? null}, database())
+                and table_name = ${table.name} and non_unique = 0
+              order by index_name, seq_in_index
+            `.pipe(
+              Effect.flatMap(
+                Schema.decodeUnknownEffect(
+                  Schema.Array(
+                    Schema.Struct({
+                      name: Schema.String,
+                      columnName: Schema.NullOr(Schema.String),
+                      prefix: Schema.NullOr(Schema.Number),
+                    }),
+                  ),
+                ),
+              ),
             );
 
-          for (const column of Object.values(table.columns)) {
-            if (!columns.some((actual) => actual.name === column.name))
-              return yield* PersistenceConfigurationError.make({
-                reason: `Missing SQL column ${relation}.${column.name}`,
-              });
-          }
-
-          const indexes = yield* client`
+            const keys = new Map<string, Array<(typeof indexes)[number]>>();
+
+            for (const index of indexes) {
+              const columns = keys.get(index.name) ?? [];
+
+              columns.push(index);
+              keys.set(index.name, columns);
+            }
+
+            return [...keys.values()]
+              .filter((columns) =>
+                columns.every((column) => column.columnName !== null && column.prefix === null),
+              )
+              .map((columns) =>
+                columns.flatMap((column) =>
+                  column.columnName === null ? [] : [column.columnName],
+                ),
+              );
+          })
+        : Effect.gen(function* () {
+            const relation = qualifiedTableName(table);
+
+            const columns =
+              yield* client`select attname as name from pg_attribute where attrelid = to_regclass(${relation}) and attnum > 0 and not attisdropped`.pipe(
+                Effect.flatMap(Schema.decodeUnknownEffect(PgColumns)),
+              );
+
+            for (const column of Object.values(table.columns)) {
+              if (!columns.some((actual) => actual.name === column.name))
+                return yield* PersistenceConfigurationError.make({
+                  reason: `Missing SQL column ${relation}.${column.name}`,
+                });
+            }
+
+            const indexes = yield* client`
           select array_agg(a.attname order by k.ordinality) as columns
           from pg_index i
           cross join lateral unnest(i.indkey) with ordinality as k(attnum, ordinality)
@@ -90,8 +151,8 @@ export const validateStorage = Effect.fnUntraced(
           group by i.indexrelid
         `.pipe(Effect.flatMap(Schema.decodeUnknownEffect(PgKeys)));
 
-          return indexes.map((index) => index.columns);
-        });
+            return indexes.map((index) => index.columns);
+          });
 
     for (const keys of required) {
       const columns = keys.map((key) => table.columns[key]?.name);
@@ -99,8 +160,11 @@ export const validateStorage = Effect.fnUntraced(
       if (
         columns.some((column) => column === undefined) ||
         !physicalKeys.some(
+          // A stronger key also guarantees the required tuple's uniqueness.
           (actual) =>
-            actual.length === columns.length && actual.every((column) => columns.includes(column)),
+            actual.length > 0 &&
+            actual.length <= columns.length &&
+            actual.every((column) => columns.includes(column)),
         )
       )
         return yield* PersistenceConfigurationError.make({

package/src/internal/transaction-execution-kernel.ts

@@ -203,6 +203,7 @@ export const makeTransactionExecutionKernel = (
     OwnerId,
     Resources,
     AllocationError,
+    AllocationRequirements,
     Services,
     Transaction,
     A,
@@ -212,7 +213,7 @@ export const makeTransactionExecutionKernel = (
     database: TransactionNativeDatabase,
     ownerTag: Context.Key<OwnerId, TransactionOwner<Failure>>,
     configuration: TransactionTargetConfiguration<Failure>,
-    allocate: Effect.Effect<Resources, AllocationError>,
+    allocate: Effect.Effect<Resources, AllocationError, AllocationRequirements>,
     unavailable: () => Failure,
     nonce: () => string,
     services: (execution: TransactionExecution<Failure, OwnerId>, resources: Resources) => Services,
@@ -224,7 +225,7 @@ export const makeTransactionExecutionKernel = (
   ): Effect.Effect<
     A,
     TransactionCoordinatorError<E, Failure>,
-    Exclude<R, CurrentCommitJournal> | LifecycleHooks
+    Exclude<R, CurrentCommitJournal> | LifecycleHooks | AllocationRequirements
   > => {
     return Effect.gen(function* () {
       if (yield* hasCommitScope) return yield* Effect.fail(unavailable());

package/src/internal/transaction-kernel.ts

@@ -31,7 +31,7 @@ export interface TransactionNativeDatabase {
   ) => Effect.Effect<A, E | SqlError, R>;
 }
 
-/** Root native database required only while constructing standalone services.
+/** Captured root database for service construction and pre-transaction catalog checks.
  * Active transactions remain owned by their coordinator and journal. */
 export class NativeDatabase extends Context.Service<NativeDatabase, TransactionNativeDatabase>()(
   "effect-auth/persistence/NativeDatabase",