@yielded/auth-persistence 0.1.0-beta.20 → 0.1.0-beta.22
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/dist/internal/oauth-server.d.mts +1 -1
- package/dist/internal/oauth-server.mjs +13 -3
- package/dist/internal/oauth-server.mjs.map +1 -1
- package/dist/internal/passkeys.mjs +1 -1
- package/dist/internal/passkeys.mjs.map +1 -1
- package/package.json +1 -1
- package/src/internal/oauth-server.ts +24 -4
- package/src/internal/passkeys.ts +1 -1
|
@@ -3,7 +3,7 @@ import { SqlClient } from "effect/sql";
|
|
|
3
3
|
import { Persistence, Unavailable } from "@yielded/auth/OAuthServer";
|
|
4
4
|
//#region src/internal/oauth-server.d.ts
|
|
5
5
|
export declare const OAuthServerPersistence: {
|
|
6
|
-
|
|
6
|
+
migrations: string[];
|
|
7
7
|
layer: Layer.Layer<Persistence, Unavailable, SqlClient.SqlClient>;
|
|
8
8
|
};
|
|
9
9
|
//#endregion
|
|
@@ -1,7 +1,7 @@
|
|
|
1
1
|
import { requireStandalone } from "./standalone.mjs";
|
|
2
2
|
import { Effect, Layer, Schema } from "effect";
|
|
3
3
|
import { SqlClient } from "effect/sql";
|
|
4
|
-
import { Persistence, Record, Unavailable } from "@yielded/auth/OAuthServer";
|
|
4
|
+
import { AssertionReceipt, Persistence, Record, Unavailable } from "@yielded/auth/OAuthServer";
|
|
5
5
|
//#region src/internal/oauth-server.ts
|
|
6
6
|
const codec = Schema.fromJsonString(Record);
|
|
7
7
|
const Row = Schema.Struct({
|
|
@@ -10,7 +10,7 @@ const Row = Schema.Struct({
|
|
|
10
10
|
revoked: Schema.Literals([0, 1])
|
|
11
11
|
});
|
|
12
12
|
const OAuthServerPersistence = {
|
|
13
|
-
|
|
13
|
+
migrations: [`CREATE TABLE yielded_oauth_server (
|
|
14
14
|
namespace TEXT NOT NULL,
|
|
15
15
|
grant_id TEXT NOT NULL,
|
|
16
16
|
version TEXT NOT NULL,
|
|
@@ -18,7 +18,12 @@ const OAuthServerPersistence = {
|
|
|
18
18
|
expires_at_millis BIGINT NOT NULL,
|
|
19
19
|
payload TEXT NOT NULL,
|
|
20
20
|
PRIMARY KEY (namespace, grant_id)
|
|
21
|
-
)`,
|
|
21
|
+
)`, `CREATE TABLE yielded_oauth_client_assertion (
|
|
22
|
+
namespace TEXT NOT NULL,
|
|
23
|
+
assertion_id TEXT NOT NULL,
|
|
24
|
+
expires_at_millis BIGINT NOT NULL,
|
|
25
|
+
PRIMARY KEY (namespace, assertion_id)
|
|
26
|
+
)`],
|
|
22
27
|
layer: Layer.effect(Persistence, Effect.gen(function* () {
|
|
23
28
|
const sql = yield* SqlClient.SqlClient;
|
|
24
29
|
if (!sql.onDialectOrElse({
|
|
@@ -29,6 +34,11 @@ const OAuthServerPersistence = {
|
|
|
29
34
|
const standalone = requireStandalone(() => Unavailable.make({}), sql.transactionService);
|
|
30
35
|
const failure = (effect) => effect.pipe(Effect.mapError(() => Unavailable.make({})));
|
|
31
36
|
return Persistence.of({
|
|
37
|
+
consumeAssertion: Effect.fn("OAuthServerPersistence.consumeAssertion")(function* (namespace, input) {
|
|
38
|
+
yield* standalone;
|
|
39
|
+
const receipt = yield* Schema.decodeEffect(AssertionReceipt)(input);
|
|
40
|
+
return (yield* sql`INSERT INTO yielded_oauth_client_assertion (namespace, assertion_id, expires_at_millis) VALUES (${namespace}, ${receipt.id}, ${receipt.expiresAtMillis}) ON CONFLICT (namespace, assertion_id) DO NOTHING RETURNING assertion_id`).length === 1;
|
|
41
|
+
}, failure),
|
|
32
42
|
get: Effect.fn("OAuthServerPersistence.get")(function* (namespace, id) {
|
|
33
43
|
yield* standalone;
|
|
34
44
|
const rows = yield* sql`SELECT payload, version, revoked FROM yielded_oauth_server WHERE namespace = ${namespace} AND grant_id = ${id}`;
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"oauth-server.mjs","names":[],"sources":["../../src/internal/oauth-server.ts"],"sourcesContent":["import { Persistence, Record, Unavailable } from \"@yielded/auth/OAuthServer\";\nimport { Effect, Layer, Schema } from \"effect\";\nimport { SqlClient } from \"effect/sql\";\n\nimport { requireStandalone } from \"./standalone\";\n\nconst codec = Schema.fromJsonString(Record);\n\nconst Row = Schema.Struct({\n payload: Schema.String,\n version: Schema.String,\n revoked: Schema.Literals([0, 1]),\n});\n\n/** SQLite (including D1) and PostgreSQL. Apply once through application migrations.\n * Expired records may be deleted when expires_at_millis <= the current time.\n * Revocation has its own monotonic column so it cannot lose a race with rotation.\n */\nconst
|
|
1
|
+
{"version":3,"file":"oauth-server.mjs","names":[],"sources":["../../src/internal/oauth-server.ts"],"sourcesContent":["import { AssertionReceipt, Persistence, Record, Unavailable } from \"@yielded/auth/OAuthServer\";\nimport { Effect, Layer, Schema } from \"effect\";\nimport { SqlClient } from \"effect/sql\";\n\nimport { requireStandalone } from \"./standalone\";\n\nconst codec = Schema.fromJsonString(Record);\n\nconst Row = Schema.Struct({\n payload: Schema.String,\n version: Schema.String,\n revoked: Schema.Literals([0, 1]),\n});\n\n/** SQLite (including D1) and PostgreSQL. Apply once through application migrations.\n * Expired records may be deleted when expires_at_millis <= the current time.\n * Revocation has its own monotonic column so it cannot lose a race with rotation.\n */\nconst migrations = [\n `CREATE TABLE yielded_oauth_server (\n namespace TEXT NOT NULL,\n grant_id TEXT NOT NULL,\n version TEXT NOT NULL,\n revoked INTEGER NOT NULL DEFAULT 0,\n expires_at_millis BIGINT NOT NULL,\n payload TEXT NOT NULL,\n PRIMARY KEY (namespace, grant_id)\n)`,\n `CREATE TABLE yielded_oauth_client_assertion (\n namespace TEXT NOT NULL,\n assertion_id TEXT NOT NULL,\n expires_at_millis BIGINT NOT NULL,\n PRIMARY KEY (namespace, assertion_id)\n)`,\n];\n\nconst layer = Layer.effect(\n Persistence,\n Effect.gen(function* () {\n const sql = yield* SqlClient.SqlClient;\n\n if (!sql.onDialectOrElse({ sqlite: () => true, pg: () => true, orElse: () => false }))\n return yield* Unavailable.make({});\n const standalone = requireStandalone(() => Unavailable.make({}), sql.transactionService);\n\n const failure = <A, E, R>(effect: Effect.Effect<A, E, R>) =>\n effect.pipe(Effect.mapError(() => Unavailable.make({})));\n\n return Persistence.of({\n consumeAssertion: Effect.fn(\"OAuthServerPersistence.consumeAssertion\")(function* (\n namespace,\n input,\n ) {\n yield* standalone;\n const receipt = yield* Schema.decodeEffect(AssertionReceipt)(input);\n\n const rows =\n yield* sql`INSERT INTO yielded_oauth_client_assertion (namespace, assertion_id, expires_at_millis) VALUES (${namespace}, ${receipt.id}, ${receipt.expiresAtMillis}) ON CONFLICT (namespace, assertion_id) DO NOTHING RETURNING assertion_id`;\n\n return rows.length === 1;\n }, failure),\n get: Effect.fn(\"OAuthServerPersistence.get\")(function* (namespace, id) {\n yield* standalone;\n\n const rows =\n yield* sql`SELECT payload, version, revoked FROM yielded_oauth_server WHERE namespace = ${namespace} AND grant_id = ${id}`;\n\n if (rows.length === 0) return undefined;\n if (rows.length !== 1) return yield* Unavailable.make({});\n const row = yield* Schema.decodeUnknownEffect(Row)(rows[0]);\n const record = yield* Schema.decodeEffect(codec)(row.payload);\n\n if (record.version !== row.version) return yield* Unavailable.make({});\n\n return row.revoked === 1 ? { ...record, status: \"Revoked\" as const } : record;\n }, failure),\n insert: Effect.fn(\"OAuthServerPersistence.insert\")(function* (namespace, id, record) {\n yield* standalone;\n const payload = yield* Schema.encodeEffect(codec)(record);\n\n const rows =\n yield* sql`INSERT INTO yielded_oauth_server (namespace, grant_id, version, revoked, expires_at_millis, payload) VALUES (${namespace}, ${id}, ${record.version}, ${record.status === \"Revoked\" ? 1 : 0}, ${record.expiresAtMillis}, ${payload}) ON CONFLICT (namespace, grant_id) DO NOTHING RETURNING version`;\n\n return rows.length === 1;\n }, failure),\n compareAndSet: Effect.fn(\"OAuthServerPersistence.compareAndSet\")(function* (\n namespace,\n id,\n version,\n record,\n ) {\n yield* standalone;\n if (version === record.version) return yield* Unavailable.make({});\n const payload = yield* Schema.encodeEffect(codec)(record);\n\n const rows =\n yield* sql`UPDATE yielded_oauth_server SET version = ${record.version}, revoked = ${record.status === \"Revoked\" ? 1 : 0}, expires_at_millis = ${record.expiresAtMillis}, payload = ${payload} WHERE namespace = ${namespace} AND grant_id = ${id} AND version = ${version} AND revoked = 0 RETURNING version`;\n\n return rows.length === 1;\n }, failure),\n revoke: Effect.fn(\"OAuthServerPersistence.revoke\")(function* (namespace, id) {\n yield* standalone;\n yield* sql`UPDATE yielded_oauth_server SET revoked = 1 WHERE namespace = ${namespace} AND grant_id = ${id}`;\n }, failure),\n });\n }),\n);\n\nexport const OAuthServerPersistence = { migrations, layer };\n"],"mappings":";;;;;AAMA,MAAM,QAAQ,OAAO,eAAe,MAAM;AAE1C,MAAM,MAAM,OAAO,OAAO;CACxB,SAAS,OAAO;CAChB,SAAS,OAAO;CAChB,SAAS,OAAO,SAAS,CAAC,GAAG,CAAC,CAAC;AACjC,CAAC;AAgGD,MAAa,yBAAyB;CAAE,aAzFtC;;;;;;;;IASA;;;;;EAgFsC;CAAY,OAxEtC,MAAM,OAClB,aACA,OAAO,IAAI,aAAa;EACtB,MAAM,MAAM,OAAO,UAAU;EAE7B,IAAI,CAAC,IAAI,gBAAgB;GAAE,cAAc;GAAM,UAAU;GAAM,cAAc;EAAM,CAAC,GAClF,OAAO,OAAO,YAAY,KAAK,CAAC,CAAC;EACnC,MAAM,aAAa,wBAAwB,YAAY,KAAK,CAAC,CAAC,GAAG,IAAI,kBAAkB;EAEvF,MAAM,WAAoB,WACxB,OAAO,KAAK,OAAO,eAAe,YAAY,KAAK,CAAC,CAAC,CAAC,CAAC;EAEzD,OAAO,YAAY,GAAG;GACpB,kBAAkB,OAAO,GAAG,yCAAyC,CAAC,CAAC,WACrE,WACA,OACA;IACA,OAAO;IACP,MAAM,UAAU,OAAO,OAAO,aAAa,gBAAgB,CAAC,CAAC,KAAK;IAKlE,QAAO,OAFE,GAAG,mGAAmG,UAAU,IAAI,QAAQ,GAAG,IAAI,QAAQ,gBAAgB,2EAAA,CAExJ,WAAW;GACzB,GAAG,OAAO;GACV,KAAK,OAAO,GAAG,4BAA4B,CAAC,CAAC,WAAW,WAAW,IAAI;IACrE,OAAO;IAEP,MAAM,OACJ,OAAO,GAAG,gFAAgF,UAAU,kBAAkB;IAExH,IAAI,KAAK,WAAW,GAAG,OAAO,KAAA;IAC9B,IAAI,KAAK,WAAW,GAAG,OAAO,OAAO,YAAY,KAAK,CAAC,CAAC;IACxD,MAAM,MAAM,OAAO,OAAO,oBAAoB,GAAG,CAAC,CAAC,KAAK,EAAE;IAC1D,MAAM,SAAS,OAAO,OAAO,aAAa,KAAK,CAAC,CAAC,IAAI,OAAO;IAE5D,IAAI,OAAO,YAAY,IAAI,SAAS,OAAO,OAAO,YAAY,KAAK,CAAC,CAAC;IAErE,OAAO,IAAI,YAAY,IAAI;KAAE,GAAG;KAAQ,QAAQ;IAAmB,IAAI;GACzE,GAAG,OAAO;GACV,QAAQ,OAAO,GAAG,+BAA+B,CAAC,CAAC,WAAW,WAAW,IAAI,QAAQ;IACnF,OAAO;IACP,MAAM,UAAU,OAAO,OAAO,aAAa,KAAK,CAAC,CAAC,MAAM;IAKxD,QAAO,OAFE,GAAG,gHAAgH,UAAU,IAAI,GAAG,IAAI,OAAO,QAAQ,IAAI,OAAO,WAAW,YAAY,IAAI,EAAE,IAAI,OAAO,gBAAgB,IAAI,QAAQ,kEAAA,CAEnO,WAAW;GACzB,GAAG,OAAO;GACV,eAAe,OAAO,GAAG,sCAAsC,CAAC,CAAC,WAC/D,WACA,IACA,SACA,QACA;IACA,OAAO;IACP,IAAI,YAAY,OAAO,SAAS,OAAO,OAAO,YAAY,KAAK,CAAC,CAAC;IACjE,MAAM,UAAU,OAAO,OAAO,aAAa,KAAK,CAAC,CAAC,MAAM;IAKxD,QAAO,OAFE,GAAG,6CAA6C,OAAO,QAAQ,cAAc,OAAO,WAAW,YAAY,IAAI,EAAE,wBAAwB,OAAO,gBAAgB,cAAc,QAAQ,qBAAqB,UAAU,kBAAkB,GAAG,iBAAiB,QAAQ,oCAAA,CAEhQ,WAAW;GACzB,GAAG,OAAO;GACV,QAAQ,OAAO,GAAG,+BAA+B,CAAC,CAAC,WAAW,WAAW,IAAI;IAC3E,OAAO;IACP,OAAO,GAAG,iEAAiE,UAAU,kBAAkB;GACzG,GAAG,OAAO;EACZ,CAAC;CACH,CAAC,CAGiD;AAAM"}
|
|
@@ -221,7 +221,7 @@ const makeComposedPasskeys = (operations) => {
|
|
|
221
221
|
metadata,
|
|
222
222
|
action: metadata,
|
|
223
223
|
remainingSignIn: (subjectId, excluded, row) => Effect.gen(function* () {
|
|
224
|
-
const requirement = yield* Schema.
|
|
224
|
+
const requirement = yield* Schema.decodeEffect(PasskeyRequirement)(yield* s.requirements(row));
|
|
225
225
|
const alternatives = [];
|
|
226
226
|
if (requirement.alternatives.some((alternative) => alternative.minimumCredentials === 1 && alternative.factors.every((factor) => factor === "possession"))) {
|
|
227
227
|
const profiles = signInProfiles.map((profile) => Schema.encodeSync(profileJson)(profile));
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"passkeys.mjs","names":[],"sources":["../../src/internal/passkeys.ts"],"sourcesContent":["import {\n PasskeyCredentials,\n PasskeyCredential,\n PasskeyEnrollmentContext,\n PasskeyManagementPersistence,\n PasskeyManagementPolicy,\n PasskeyMethodPolicy,\n PasskeyPersistence,\n PasskeyProfile,\n PasskeyRequirement,\n PasskeyUnavailable,\n} from \"@yielded/auth/Passkey\";\nimport { Context, Effect, Schema } from \"effect\";\nimport { SqlClient } from \"effect/sql\";\n\nimport {\n PersistenceConfigurationError,\n type MappingInput,\n type PasskeyFeature,\n} from \"./configuration\";\nimport { digest } from \"./crypto\";\nimport { PersistenceMappingError } from \"./mapping-error\";\nimport {\n requiredPasskeyCredentialConstraints,\n requiredPasskeyPersistenceConstraints,\n type PasskeyCredentialMapping,\n type PasskeyPersistenceMapping,\n} from \"./models/passkey-model\";\nimport {\n requiredPasskeyManagementConstraints,\n type PasskeyManagementMapping,\n} from \"./models/passkey-write-model\";\nimport { makePasskeyKernel } from \"./passkey-kernel\";\nimport type { PasskeyTargetConfiguration } from \"./passkey/target\";\nimport type { Backend } from \"./persistence\";\nimport { CurrentProofSql } from \"./proof-kernel\";\nimport type { SqlExpression as SQL, QueryOperations, TableModel } from \"./query-operations\";\nimport { requireStandalone } from \"./standalone\";\nimport { storageTables, type StorageRole } from \"./storage-tables\";\n\nconst profileJson = Schema.fromJsonString(PasskeyProfile);\nconst policyJson = Schema.fromJsonString(PasskeyMethodPolicy);\n\nconst seedJson = Schema.fromJsonString(\n Schema.Struct({\n policy: PasskeyMethodPolicy,\n management: Schema.optionalKey(PasskeyManagementPolicy),\n }),\n);\n\nconst ModuleRow = Schema.Struct({\n active: Schema.Boolean,\n policy: Schema.String,\n policyRevision: Schema.String,\n});\n\nconst ConfiguredModuleRow = Schema.Struct({\n moduleId: Schema.String,\n active: Schema.Boolean,\n policyRevision: Schema.String,\n admitted: Schema.Literals([\"present\", \"missing\"]),\n});\n\nconst credentialData = PasskeyCredential.mapFields(\n ({ revision: _revision, active: _active, ...fields }) => fields,\n);\n\nconst unavailable = () => PasskeyUnavailable.make({});\nconst configurationError = (reason: string) => PersistenceConfigurationError.make({ reason });\n\ntype ReadMapping = PasskeyCredentialMapping<\n TableModel,\n TableModel,\n TableModel,\n TableModel,\n TableModel,\n unknown\n>;\ntype BaseMapping = PasskeyPersistenceMapping<\n ReadMapping,\n TableModel,\n TableModel,\n TableModel,\n TableModel,\n unknown\n>;\ntype ManagementMapping = PasskeyManagementMapping<\n TableModel,\n TableModel,\n TableModel,\n TableModel,\n TableModel,\n TableModel,\n TableModel,\n TableModel,\n TableModel,\n TableModel,\n unknown\n>;\n\n/** Share the same passkey algorithms across raw SQL and Drizzle compilers. */\nexport const makeComposedPasskeys = (\n operations: QueryOperations,\n): Backend<object, never>[\"passkeys\"] => {\n const { and, eq, getTableColumns, inArray, or, sql } = operations;\n const { target, writeTarget } = makePasskeyKernel(operations);\n\n const {\n makeTargetPasskeyCredentials,\n makeTargetPasskeyEnrollmentContext,\n makeTargetPasskeyPersistence,\n } = target;\n\n const { makeTargetPasskeyManagement } = writeTarget;\n\n const mappings = (\n storage: MappingInput,\n namespace: string,\n dialect: \"pg\" | \"sqlite\",\n passwordModules: ReadonlyArray<string>,\n signInProfiles: ReadonlyArray<PasskeyProfile>,\n ) => {\n const table = (role: StorageRole) => {\n const value = storage.tables[role];\n\n if (value === undefined) throw configurationError(`Missing ${role} mapping`);\n\n // Backend validation owns the foreign table shape. Row values are decoded below.\n return value;\n };\n\n const mapped = <Role extends StorageRole>(role: Role) => ({\n table: table(role),\n ...(Object.fromEntries(Object.keys(storageTables[role].columns).map((key) => [key, key])) as {\n readonly [Key in keyof (typeof storageTables)[Role][\"columns\"]]: Key;\n }),\n });\n\n const column = (role: StorageRole, key: string) => getTableColumns(table(role))[key];\n const s = storage.subjects;\n const subject = s.table;\n const sc = getTableColumns(subject);\n const active = (value: unknown) => value === true;\n const owned = (value: unknown) => value === \"owned\";\n\n const read: ReadMapping = {\n subject: {\n table: subject,\n id: s.id,\n status: s.status,\n securityRevision: s.securityRevision,\n decodeId: (row) => row[s.id],\n isActiveStatus: (value) => Object.is(value, s.activeValue),\n activeCondition: eq(sc[s.status], s.activeValue),\n },\n credential: {\n ...mapped(\"passkeyCredentials\"),\n status: \"active\",\n decode: (row) =>\n Schema.decodeUnknownSync(credentialData)({\n ...row,\n profile: Schema.decodeUnknownSync(profileJson)(row.profile),\n }),\n decodeSubjectId: (row) => row.subjectId,\n isActiveStatus: active,\n activeCondition: eq(column(\"passkeyCredentials\", \"active\"), true),\n },\n authority: {\n ...mapped(\"credentials\"),\n status: \"active\",\n isActiveStatus: active,\n activeCondition: eq(column(\"credentials\", \"active\"), true),\n },\n credentialOwnership: {\n ...mapped(\"passkeyOwnership\"),\n isOwnedState: owned,\n ownedCondition: eq(column(\"passkeyOwnership\", \"state\"), \"owned\"),\n decodeSubjectId: (row) => row.subjectId,\n },\n handleOwnership: {\n ...mapped(\"passkeyHandles\"),\n isOwnedState: owned,\n ownedCondition: eq(column(\"passkeyHandles\", \"state\"), \"owned\"),\n decodeSubjectId: (row) => row.subjectId,\n },\n subjectIds: { toNative: s.toNativeSync, toSubject: s.toSubjectSync, equals: Object.is },\n constraints: requiredPasskeyCredentialConstraints,\n };\n\n const base = (feature: PasskeyFeature): BaseMapping => ({\n moduleId: feature.moduleId,\n authorityScope: namespace,\n read,\n module: {\n ...mapped(\"passkeyModules\"),\n status: \"active\",\n policyColumns: [\"policy\", \"policyRevision\"],\n isActiveStatus: active,\n activeCondition: eq(column(\"passkeyModules\", \"active\"), true),\n decodeMethodPolicy: (row) => Schema.decodeUnknownSync(policyJson)(row.policy),\n },\n flow: {\n ...mapped(\"passkeyFlows\"),\n states: {\n Pending: \"Pending\",\n Claimed: \"Claimed\",\n Verified: \"Verified\",\n Rejected: \"Rejected\",\n Ambiguous: \"Ambiguous\",\n RegistrationAccepted: \"RegistrationAccepted\",\n ProvisioningPending: \"ProvisioningPending\",\n },\n encodeInsert: () => ({}),\n },\n admission: mapped(\"passkeyAdmissions\"),\n charge: { ...mapped(\"passkeyCharges\"), encodeInsert: () => ({}) },\n clock: {\n encodeInstant: storage.encodeInstant,\n decodeInstant: storage.decodeInstantSync,\n engineNowMillis:\n dialect === \"pg\"\n ? sql`cast(extract(epoch from clock_timestamp()) * 1000 as bigint)`\n : sql`cast(round((julianday('now') - 2440587.5) * 86400000) as integer)`,\n toMillis: (expression) => expression,\n fromMillis: (expression) => expression,\n },\n telemetry: { lastUsedAt: \"lastUsedAt\", encodeBackupState: (value) => value },\n constraints: requiredPasskeyPersistenceConstraints,\n });\n\n const management = (feature: PasskeyFeature): ManagementMapping => {\n const policy = feature.managementPolicy;\n\n if (policy === undefined)\n throw configurationError(`Missing passkey management policy for ${feature.moduleId}`);\n const c = getTableColumns(table(\"passkeyCredentials\"));\n const f = getTableColumns(table(\"credentials\"));\n\n const metadata = (subjectId: unknown) =>\n sql`exists(select 1 from ${subject} where ${sc[s.id]} = ${subjectId} and ${sc[s.status]} = ${s.activeValue})`;\n\n return {\n ...base(feature),\n write: {\n credential: {\n name: \"name\",\n createdAt: \"createdAt\",\n encodeInsert: ({ credential, subjectId, summary, marker }) => ({\n credentialId: credential.credentialId,\n subjectId,\n rpId: credential.rpId,\n protocolCredentialId: credential.protocolCredentialId,\n userHandle: credential.userHandle,\n credentialKey: \"\",\n handleKey: \"\",\n publicKey: credential.publicKey,\n algorithm: credential.algorithm,\n profile: Schema.encodeSync(profileJson)(credential.profile),\n credentialRevision: marker,\n active: true,\n primarySignIn: credential.primarySignIn,\n enrollmentUserVerified: credential.enrollmentUserVerified,\n backupEligible: credential.backupEligible,\n backupState: credential.backupState,\n counter: credential.counter,\n maximumCounter: credential.maximumCounter,\n name: summary.name,\n createdAt: storage.encodeInstant(summary.createdAtMillis),\n }),\n encodePrimarySignIn: (value) => value,\n encodeEnrollmentUserVerified: (value) => value,\n encodeBackupEligible: (value) => value,\n activeStatus: true,\n removedStatus: false,\n },\n authority: {\n encodeInsert: ({ subjectId, credential, marker }) => ({\n subjectId,\n credentialId: credential.credentialId,\n revision: marker,\n active: true,\n }),\n activeStatus: true,\n removedStatus: false,\n },\n credentialOwnership: {\n encodeInsert: ({ credential, marker }) => ({\n credentialKey: \"\",\n rpId: credential.rpId,\n protocolCredentialId: credential.protocolCredentialId,\n state: \"owned\",\n version: marker,\n }),\n ownedState: \"owned\",\n removedState: \"removed\",\n },\n handleOwnership: {\n encodeInsert: ({ subjectId, rpId, userHandle, marker }) => ({\n subjectId,\n rpId,\n userHandle,\n handleKey: \"\",\n state: \"owned\",\n version: marker,\n }),\n ownedState: \"owned\",\n },\n policy: {\n subjectColumns: Object.keys(sc),\n management: () => policy,\n requirement: s.actionRequirements,\n metadata,\n action: metadata,\n remainingSignIn: (subjectId, excluded, row) =>\n Effect.gen(function* () {\n const requirement = yield* Schema.decodeUnknownEffect(PasskeyRequirement)(\n yield* s.requirements(row),\n );\n\n const alternatives: SQL[] = [];\n\n // Only retain complete sign-in paths enabled by this Auth definition.\n // More involved combinations require an explicit application's predicate.\n if (\n requirement.alternatives.some(\n (alternative) =>\n alternative.minimumCredentials === 1 &&\n alternative.factors.every((factor) => factor === \"possession\"),\n )\n ) {\n const profiles = signInProfiles.map((profile) =>\n Schema.encodeSync(profileJson)(profile),\n );\n\n alternatives.push(sql`exists(\n select 1 from ${table(\"passkeyCredentials\")} join ${table(\"credentials\")}\n on ${f.credentialId} = ${c.credentialId} and ${f.subjectId} = ${c.subjectId}\n and ${f.revision} = ${c.credentialRevision} and ${f.active} = ${true}\n where ${c.subjectId} = ${subjectId} and ${c.credentialId} <> ${excluded}\n and ${c.active} = ${true} and ${c.primarySignIn} = ${true}\n and ${c.enrollmentUserVerified} = ${true} and ${inArray(c.profile, profiles)}\n )`);\n }\n if (\n passwordModules.length > 0 &&\n requirement.alternatives.some(\n (alternative) =>\n alternative.minimumCredentials === 1 &&\n !alternative.userVerified &&\n !alternative.phishingResistant &&\n alternative.factors.every((factor) => factor === \"knowledge\"),\n )\n ) {\n const p = getTableColumns(table(\"passwords\"));\n const i = getTableColumns(table(\"identifiers\"));\n\n alternatives.push(sql`exists(\n select 1 from ${table(\"passwords\")} join ${table(\"credentials\")}\n on ${f.credentialId} = ${p.credentialId} and ${f.subjectId} = ${p.subjectId}\n and ${f.revision} = ${p.credentialRevision} and ${f.active} = ${true}\n join ${table(\"identifiers\")} on ${i.subjectId} = ${p.subjectId}\n and ${i.active} = ${true} and ${i.namespace} = 'email'\n where ${p.subjectId} = ${subjectId} and ${p.credentialId} <> ${excluded}\n and ${inArray(p.moduleId, passwordModules)}\n )`);\n }\n\n return or(...alternatives) ?? sql`false`;\n }).pipe(\n Effect.mapError((cause) =>\n PersistenceMappingError.make({ operation: \"mapping\", cause }),\n ),\n ),\n },\n },\n command: { ...mapped(\"passkeyCommands\"), encodeInsert: (input) => ({ ...input }) },\n managementConstraints: requiredPasskeyManagementConstraints,\n invalidation: {\n window: {\n trigger: \"credential-change\",\n existingSessions: \"immediate\",\n maximumExposureMillis: 0,\n oldAuthenticationEvidence: \"rejected\",\n },\n mutations: [],\n postcondition: ({ subjectId, securityRevision }) =>\n sql`exists(select 1 from ${subject} where ${sc[s.id]} = ${subjectId} and ${sc[s.securityRevision]} = ${securityRevision})`,\n },\n };\n };\n\n return { read, base, management, table };\n };\n\n const make: Backend<object, never>[\"passkeys\"] = Effect.fn(\"AuthPersistence.passkeys\")(\n function* ({ storage, namespace, dialect, features, passwordModules }) {\n const client = yield* SqlClient.SqlClient;\n\n const policies = yield* Effect.forEach(features, (feature) =>\n Effect.gen(function* () {\n const policy = yield* feature.policy;\n const encoded = yield* Schema.encodeEffect(policyJson)(policy);\n\n const policyRevision = yield* digest(\n yield* Schema.encodeEffect(seedJson)({\n policy,\n ...(feature.managementPolicy === undefined\n ? {}\n : { management: feature.managementPolicy }),\n }),\n );\n\n return { feature, policy, encoded, policyRevision };\n }),\n );\n\n const m = yield* Effect.try({\n try: () =>\n mappings(\n storage,\n namespace,\n dialect,\n passwordModules,\n policies.flatMap(({ feature, policy }) => (feature.management ? [] : policy.profiles)),\n ),\n catch: () => configurationError(\"Invalid passkey table mappings\"),\n });\n\n const configuration: PasskeyTargetConfiguration = {\n mode: \"interactive\",\n dialect,\n locking: dialect === \"pg\",\n standaloneGuard: () => requireStandalone(unavailable, client.transactionService),\n };\n\n const native = yield* CurrentProofSql;\n const module = m.table(\"passkeyModules\");\n const columns = getTableColumns(module);\n const admission = m.table(\"passkeyAdmissions\");\n const ac = getTableColumns(admission);\n\n // Read live configuration on every acquisition. Matching modules and\n // admission ownership need no initialization writes or advisory lock.\n const configured = yield* native\n .select({\n moduleId: columns.moduleId,\n active: columns.active,\n policyRevision: columns.policyRevision,\n // Predicate SQL preserves qualifiers through single-table projections.\n admitted: sql`case when exists(select 1 from ${admission}\n where ${and(eq(ac.authorityScope, namespace), eq(ac.moduleId, columns.moduleId))})\n then 'present' else 'missing' end`,\n })\n .from(module)\n .where(\n inArray(\n columns.moduleId,\n policies.map(({ feature }) => feature.moduleId),\n ),\n )\n .pipe(\n Effect.flatMap(Schema.decodeUnknownEffect(Schema.Array(ConfiguredModuleRow))),\n Effect.map((rows) =>\n policies.every(({ feature, policyRevision }) =>\n rows.some(\n (row) =>\n row.moduleId === feature.moduleId &&\n row.active &&\n row.admitted === \"present\" &&\n row.policyRevision === policyRevision,\n ),\n ),\n ),\n );\n\n if (!configured)\n yield* client.withTransaction(\n Effect.gen(function* () {\n if (dialect === \"pg\")\n yield* client`select pg_advisory_xact_lock(hashtext(${`${namespace}/passkeys`}))`;\n for (const { feature, policy, encoded, policyRevision } of policies) {\n yield* native\n .insert(module)\n .values({\n moduleId: feature.moduleId,\n active: true,\n policy: encoded,\n policyRevision,\n })\n .onConflictDoNothing();\n\n const rows = yield* native\n .select()\n .from(module)\n .where(eq(columns.moduleId, feature.moduleId));\n\n const row = yield* Schema.decodeUnknownEffect(ModuleRow)(rows[0]);\n\n if (!row.active)\n return yield* configurationError(`Passkey module ${feature.moduleId} is disabled`);\n if (row.policyRevision !== policyRevision) {\n const previous = yield* Schema.decodeEffect(policyJson)(row.policy);\n\n if (policy.generation <= previous.generation)\n return yield* configurationError(\n `Increase the passkey policy generation to change ${feature.moduleId}`,\n );\n yield* native\n .update(module)\n .set({ policy: encoded, policyRevision })\n .where(\n and(\n eq(columns.moduleId, feature.moduleId),\n eq(columns.policyRevision, row.policyRevision),\n eq(columns.active, true),\n ),\n );\n\n const updated = yield* native\n .select()\n .from(module)\n .where(eq(columns.moduleId, feature.moduleId));\n\n const applied = yield* Schema.decodeUnknownEffect(ModuleRow)(updated[0]);\n\n if (!applied.active || applied.policyRevision !== policyRevision)\n return yield* configurationError(\n `Passkey policy changed while configuring ${feature.moduleId}`,\n );\n }\n yield* native\n .insert(m.table(\"passkeyAdmissions\"))\n .values({\n authorityScope: namespace,\n moduleId: feature.moduleId,\n version: policyRevision,\n ownerMarker: policyRevision,\n })\n .onConflictDoNothing();\n }\n }),\n );\n\n const credential = yield* makeTargetPasskeyCredentials<ReadMapping, never>(\n m.read,\n configuration,\n );\n\n const persistence = new Map<string, PasskeyPersistence[\"Service\"]>();\n const managers = new Map<string, PasskeyManagementPersistence[\"Service\"]>();\n const enrollment = new Map<string, PasskeyEnrollmentContext[\"Service\"]>();\n\n for (const feature of features) {\n if (feature.management) {\n const mapping = yield* Effect.try({\n try: () => m.management(feature),\n catch: () =>\n configurationError(`Invalid passkey management mapping for ${feature.moduleId}`),\n });\n\n const services = yield* makeTargetPasskeyManagement<ManagementMapping, never>(\n mapping,\n configuration,\n );\n\n persistence.set(feature.moduleId, services.passkeyPersistence);\n managers.set(feature.moduleId, services.passkeyManagementPersistence);\n enrollment.set(\n feature.moduleId,\n (yield* makeTargetPasskeyEnrollmentContext<ManagementMapping, never>(\n mapping,\n configuration,\n )).passkeyEnrollmentContext,\n );\n } else {\n persistence.set(\n feature.moduleId,\n (yield* makeTargetPasskeyPersistence<BaseMapping, never>(\n m.base(feature),\n configuration,\n )).passkeyPersistence,\n );\n }\n }\n\n const service = <A>(services: ReadonlyMap<string, A>, moduleId: string) => {\n const value = services.get(moduleId);\n\n return value === undefined ? Effect.fail(unavailable()) : Effect.succeed(value);\n };\n\n let context: Context.Context<never> = Context.make(\n PasskeyCredentials,\n credential.passkeyCredentials,\n ).pipe(\n Context.add(PasskeyPersistence, {\n issue: (input, prepare) =>\n Effect.flatMap(service(persistence, input.ceremony.moduleId), (s) =>\n s.issue(input, prepare),\n ),\n context: (input) =>\n Effect.flatMap(service(persistence, input.moduleId), (s) => s.context(input)),\n claim: (input, prepare) =>\n Effect.flatMap(service(persistence, input.ceremony.moduleId), (s) =>\n s.claim(input, prepare),\n ),\n settle: (input, prepare) =>\n Effect.flatMap(service(persistence, input.claim.ceremony.moduleId), (s) =>\n s.settle(input, prepare),\n ),\n cleanup: (input, prepare) =>\n Effect.flatMap(service(persistence, input.moduleId), (s) => s.cleanup(input, prepare)),\n }),\n );\n\n if (managers.size > 0)\n context = context.pipe(\n Context.add(PasskeyEnrollmentContext, {\n capture: (input) =>\n Effect.flatMap(service(enrollment, input.moduleId), (s) => s.capture(input)),\n }),\n Context.add(PasskeyManagementPersistence, {\n issueEnrollment: (input, prepare) =>\n Effect.flatMap(service(managers, input.ceremony.moduleId), (s) =>\n s.issueEnrollment(input, prepare),\n ),\n completeEnrollment: (input, prepare) =>\n Effect.flatMap(service(managers, input.claim.ceremony.moduleId), (s) =>\n s.completeEnrollment(input, prepare),\n ),\n list: (input) =>\n Effect.flatMap(service(managers, input.moduleId), (s) => s.list(input)),\n inspectRemove: (input) =>\n Effect.flatMap(service(managers, input.moduleId), (s) => s.inspectRemove(input)),\n rename: (input, prepare) =>\n Effect.flatMap(service(managers, input.moduleId), (s) => s.rename(input, prepare)),\n remove: (input, prepare) =>\n Effect.flatMap(service(managers, input.moduleId), (s) => s.remove(input, prepare)),\n }),\n );\n\n return context;\n },\n Effect.mapError((error) =>\n Schema.is(PersistenceConfigurationError)(error)\n ? error\n : configurationError(\"Unable to configure passkey persistence\"),\n ),\n );\n\n return make;\n};\n"],"mappings":";;;;;;;;;;;;;AAwCA,MAAM,cAAc,OAAO,eAAe,cAAc;AACxD,MAAM,aAAa,OAAO,eAAe,mBAAmB;AAE5D,MAAM,WAAW,OAAO,eACtB,OAAO,OAAO;CACZ,QAAQ;CACR,YAAY,OAAO,YAAY,uBAAuB;AACxD,CAAC,CACH;AAEA,MAAM,YAAY,OAAO,OAAO;CAC9B,QAAQ,OAAO;CACf,QAAQ,OAAO;CACf,gBAAgB,OAAO;AACzB,CAAC;AAED,MAAM,sBAAsB,OAAO,OAAO;CACxC,UAAU,OAAO;CACjB,QAAQ,OAAO;CACf,gBAAgB,OAAO;CACvB,UAAU,OAAO,SAAS,CAAC,WAAW,SAAS,CAAC;AAClD,CAAC;AAED,MAAM,iBAAiB,kBAAkB,WACtC,EAAE,UAAU,WAAW,QAAQ,SAAS,GAAG,aAAa,MAC3D;AAEA,MAAM,oBAAoB,mBAAmB,KAAK,CAAC,CAAC;AACpD,MAAM,sBAAsB,WAAmB,8BAA8B,KAAK,EAAE,OAAO,CAAC;;AAiC5F,MAAa,wBACX,eACuC;CACvC,MAAM,EAAE,KAAK,IAAI,iBAAiB,SAAS,IAAI,QAAQ;CACvD,MAAM,EAAE,QAAQ,gBAAgB,kBAAkB,UAAU;CAE5D,MAAM,EACJ,8BACA,oCACA,iCACE;CAEJ,MAAM,EAAE,gCAAgC;CAExC,MAAM,YACJ,SACA,WACA,SACA,iBACA,mBACG;EACH,MAAM,SAAS,SAAsB;GACnC,MAAM,QAAQ,QAAQ,OAAO;GAE7B,IAAI,UAAU,KAAA,GAAW,MAAM,mBAAmB,WAAW,KAAK,SAAS;GAG3E,OAAO;EACT;EAEA,MAAM,UAAoC,UAAgB;GACxD,OAAO,MAAM,IAAI;GACjB,GAAI,OAAO,YAAY,OAAO,KAAK,cAAc,KAAK,CAAC,OAAO,CAAC,CAAC,KAAK,QAAQ,CAAC,KAAK,GAAG,CAAC,CAAC;EAG1F;EAEA,MAAM,UAAU,MAAmB,QAAgB,gBAAgB,MAAM,IAAI,CAAC,CAAC,CAAC;EAChF,MAAM,IAAI,QAAQ;EAClB,MAAM,UAAU,EAAE;EAClB,MAAM,KAAK,gBAAgB,OAAO;EAClC,MAAM,UAAU,UAAmB,UAAU;EAC7C,MAAM,SAAS,UAAmB,UAAU;EAE5C,MAAM,OAAoB;GACxB,SAAS;IACP,OAAO;IACP,IAAI,EAAE;IACN,QAAQ,EAAE;IACV,kBAAkB,EAAE;IACpB,WAAW,QAAQ,IAAI,EAAE;IACzB,iBAAiB,UAAU,OAAO,GAAG,OAAO,EAAE,WAAW;IACzD,iBAAiB,GAAG,GAAG,EAAE,SAAS,EAAE,WAAW;GACjD;GACA,YAAY;IACV,GAAG,OAAO,oBAAoB;IAC9B,QAAQ;IACR,SAAS,QACP,OAAO,kBAAkB,cAAc,CAAC,CAAC;KACvC,GAAG;KACH,SAAS,OAAO,kBAAkB,WAAW,CAAC,CAAC,IAAI,OAAO;IAC5D,CAAC;IACH,kBAAkB,QAAQ,IAAI;IAC9B,gBAAgB;IAChB,iBAAiB,GAAG,OAAO,sBAAsB,QAAQ,GAAG,IAAI;GAClE;GACA,WAAW;IACT,GAAG,OAAO,aAAa;IACvB,QAAQ;IACR,gBAAgB;IAChB,iBAAiB,GAAG,OAAO,eAAe,QAAQ,GAAG,IAAI;GAC3D;GACA,qBAAqB;IACnB,GAAG,OAAO,kBAAkB;IAC5B,cAAc;IACd,gBAAgB,GAAG,OAAO,oBAAoB,OAAO,GAAG,OAAO;IAC/D,kBAAkB,QAAQ,IAAI;GAChC;GACA,iBAAiB;IACf,GAAG,OAAO,gBAAgB;IAC1B,cAAc;IACd,gBAAgB,GAAG,OAAO,kBAAkB,OAAO,GAAG,OAAO;IAC7D,kBAAkB,QAAQ,IAAI;GAChC;GACA,YAAY;IAAE,UAAU,EAAE;IAAc,WAAW,EAAE;IAAe,QAAQ,OAAO;GAAG;GACtF,aAAa;EACf;EAEA,MAAM,QAAQ,aAA0C;GACtD,UAAU,QAAQ;GAClB,gBAAgB;GAChB;GACA,QAAQ;IACN,GAAG,OAAO,gBAAgB;IAC1B,QAAQ;IACR,eAAe,CAAC,UAAU,gBAAgB;IAC1C,gBAAgB;IAChB,iBAAiB,GAAG,OAAO,kBAAkB,QAAQ,GAAG,IAAI;IAC5D,qBAAqB,QAAQ,OAAO,kBAAkB,UAAU,CAAC,CAAC,IAAI,MAAM;GAC9E;GACA,MAAM;IACJ,GAAG,OAAO,cAAc;IACxB,QAAQ;KACN,SAAS;KACT,SAAS;KACT,UAAU;KACV,UAAU;KACV,WAAW;KACX,sBAAsB;KACtB,qBAAqB;IACvB;IACA,qBAAqB,CAAC;GACxB;GACA,WAAW,OAAO,mBAAmB;GACrC,QAAQ;IAAE,GAAG,OAAO,gBAAgB;IAAG,qBAAqB,CAAC;GAAG;GAChE,OAAO;IACL,eAAe,QAAQ;IACvB,eAAe,QAAQ;IACvB,iBACE,YAAY,OACR,GAAG,iEACH,GAAG;IACT,WAAW,eAAe;IAC1B,aAAa,eAAe;GAC9B;GACA,WAAW;IAAE,YAAY;IAAc,oBAAoB,UAAU;GAAM;GAC3E,aAAa;EACf;EAEA,MAAM,cAAc,YAA+C;GACjE,MAAM,SAAS,QAAQ;GAEvB,IAAI,WAAW,KAAA,GACb,MAAM,mBAAmB,yCAAyC,QAAQ,UAAU;GACtF,MAAM,IAAI,gBAAgB,MAAM,oBAAoB,CAAC;GACrD,MAAM,IAAI,gBAAgB,MAAM,aAAa,CAAC;GAE9C,MAAM,YAAY,cAChB,GAAG,wBAAwB,QAAQ,SAAS,GAAG,EAAE,IAAI,KAAK,UAAU,OAAO,GAAG,EAAE,QAAQ,KAAK,EAAE,YAAY;GAE7G,OAAO;IACL,GAAG,KAAK,OAAO;IACf,OAAO;KACL,YAAY;MACV,MAAM;MACN,WAAW;MACX,eAAe,EAAE,YAAY,WAAW,SAAS,cAAc;OAC7D,cAAc,WAAW;OACzB;OACA,MAAM,WAAW;OACjB,sBAAsB,WAAW;OACjC,YAAY,WAAW;OACvB,eAAe;OACf,WAAW;OACX,WAAW,WAAW;OACtB,WAAW,WAAW;OACtB,SAAS,OAAO,WAAW,WAAW,CAAC,CAAC,WAAW,OAAO;OAC1D,oBAAoB;OACpB,QAAQ;OACR,eAAe,WAAW;OAC1B,wBAAwB,WAAW;OACnC,gBAAgB,WAAW;OAC3B,aAAa,WAAW;OACxB,SAAS,WAAW;OACpB,gBAAgB,WAAW;OAC3B,MAAM,QAAQ;OACd,WAAW,QAAQ,cAAc,QAAQ,eAAe;MAC1D;MACA,sBAAsB,UAAU;MAChC,+BAA+B,UAAU;MACzC,uBAAuB,UAAU;MACjC,cAAc;MACd,eAAe;KACjB;KACA,WAAW;MACT,eAAe,EAAE,WAAW,YAAY,cAAc;OACpD;OACA,cAAc,WAAW;OACzB,UAAU;OACV,QAAQ;MACV;MACA,cAAc;MACd,eAAe;KACjB;KACA,qBAAqB;MACnB,eAAe,EAAE,YAAY,cAAc;OACzC,eAAe;OACf,MAAM,WAAW;OACjB,sBAAsB,WAAW;OACjC,OAAO;OACP,SAAS;MACX;MACA,YAAY;MACZ,cAAc;KAChB;KACA,iBAAiB;MACf,eAAe,EAAE,WAAW,MAAM,YAAY,cAAc;OAC1D;OACA;OACA;OACA,WAAW;OACX,OAAO;OACP,SAAS;MACX;MACA,YAAY;KACd;KACA,QAAQ;MACN,gBAAgB,OAAO,KAAK,EAAE;MAC9B,kBAAkB;MAClB,aAAa,EAAE;MACf;MACA,QAAQ;MACR,kBAAkB,WAAW,UAAU,QACrC,OAAO,IAAI,aAAa;OACtB,MAAM,cAAc,OAAO,OAAO,oBAAoB,kBAAkB,CAAC,CACvE,OAAO,EAAE,aAAa,GAAG,CAC3B;OAEA,MAAM,eAAsB,CAAC;OAI7B,IACE,YAAY,aAAa,MACtB,gBACC,YAAY,uBAAuB,KACnC,YAAY,QAAQ,OAAO,WAAW,WAAW,YAAY,CACjE,GACA;QACA,MAAM,WAAW,eAAe,KAAK,YACnC,OAAO,WAAW,WAAW,CAAC,CAAC,OAAO,CACxC;QAEA,aAAa,KAAK,GAAG;kCACL,MAAM,oBAAoB,EAAE,QAAQ,MAAM,aAAa,EAAE;uBACpE,EAAE,aAAa,KAAK,EAAE,aAAa,OAAO,EAAE,UAAU,KAAK,EAAE,UAAU;0BACpE,EAAE,SAAS,KAAK,EAAE,mBAAmB,OAAO,EAAE,OAAO,KAAK,KAAK;0BAC/D,EAAE,UAAU,KAAK,UAAU,OAAO,EAAE,aAAa,MAAM,SAAS;0BAChE,EAAE,OAAO,KAAK,KAAK,OAAO,EAAE,cAAc,KAAK,KAAK;0BACpD,EAAE,uBAAuB,KAAK,KAAK,OAAO,QAAQ,EAAE,SAAS,QAAQ,EAAE;kBAC/E;OACF;OACA,IACE,gBAAgB,SAAS,KACzB,YAAY,aAAa,MACtB,gBACC,YAAY,uBAAuB,KACnC,CAAC,YAAY,gBACb,CAAC,YAAY,qBACb,YAAY,QAAQ,OAAO,WAAW,WAAW,WAAW,CAChE,GACA;QACA,MAAM,IAAI,gBAAgB,MAAM,WAAW,CAAC;QAC5C,MAAM,IAAI,gBAAgB,MAAM,aAAa,CAAC;QAE9C,aAAa,KAAK,GAAG;kCACL,MAAM,WAAW,EAAE,QAAQ,MAAM,aAAa,EAAE;uBAC3D,EAAE,aAAa,KAAK,EAAE,aAAa,OAAO,EAAE,UAAU,KAAK,EAAE,UAAU;0BACpE,EAAE,SAAS,KAAK,EAAE,mBAAmB,OAAO,EAAE,OAAO,KAAK,KAAK;yBAChE,MAAM,aAAa,EAAE,MAAM,EAAE,UAAU,KAAK,EAAE,UAAU;0BACvD,EAAE,OAAO,KAAK,KAAK,OAAO,EAAE,UAAU;0BACtC,EAAE,UAAU,KAAK,UAAU,OAAO,EAAE,aAAa,MAAM,SAAS;0BAChE,QAAQ,EAAE,UAAU,eAAe,EAAE;kBAC7C;OACF;OAEA,OAAO,GAAG,GAAG,YAAY,KAAK,GAAG;MACnC,CAAC,CAAC,CAAC,KACD,OAAO,UAAU,UACf,wBAAwB,KAAK;OAAE,WAAW;OAAW;MAAM,CAAC,CAC9D,CACF;KACJ;IACF;IACA,SAAS;KAAE,GAAG,OAAO,iBAAiB;KAAG,eAAe,WAAW,EAAE,GAAG,MAAM;IAAG;IACjF,uBAAuB;IACvB,cAAc;KACZ,QAAQ;MACN,SAAS;MACT,kBAAkB;MAClB,uBAAuB;MACvB,2BAA2B;KAC7B;KACA,WAAW,CAAC;KACZ,gBAAgB,EAAE,WAAW,uBAC3B,GAAG,wBAAwB,QAAQ,SAAS,GAAG,EAAE,IAAI,KAAK,UAAU,OAAO,GAAG,EAAE,kBAAkB,KAAK,iBAAiB;IAC5H;GACF;EACF;EAEA,OAAO;GAAE;GAAM;GAAM;GAAY;EAAM;CACzC;CAkQA,OAhQiD,OAAO,GAAG,0BAA0B,CAAC,CACpF,WAAW,EAAE,SAAS,WAAW,SAAS,UAAU,mBAAmB;EACrE,MAAM,SAAS,OAAO,UAAU;EAEhC,MAAM,WAAW,OAAO,OAAO,QAAQ,WAAW,YAChD,OAAO,IAAI,aAAa;GACtB,MAAM,SAAS,OAAO,QAAQ;GAY9B,OAAO;IAAE;IAAS;IAAQ,SAAA,OAXH,OAAO,aAAa,UAAU,CAAC,CAAC,MAAM;IAW1B,gBAAA,OATL,OAC5B,OAAO,OAAO,aAAa,QAAQ,CAAC,CAAC;KACnC;KACA,GAAI,QAAQ,qBAAqB,KAAA,IAC7B,CAAC,IACD,EAAE,YAAY,QAAQ,iBAAiB;IAC7C,CAAC,CACH;GAEkD;EACpD,CAAC,CACH;EAEA,MAAM,IAAI,OAAO,OAAO,IAAI;GAC1B,WACE,SACE,SACA,WACA,SACA,iBACA,SAAS,SAAS,EAAE,SAAS,aAAc,QAAQ,aAAa,CAAC,IAAI,OAAO,QAAS,CACvF;GACF,aAAa,mBAAmB,gCAAgC;EAClE,CAAC;EAED,MAAM,gBAA4C;GAChD,MAAM;GACN;GACA,SAAS,YAAY;GACrB,uBAAuB,kBAAkB,aAAa,OAAO,kBAAkB;EACjF;EAEA,MAAM,SAAS,OAAO;EACtB,MAAM,SAAS,EAAE,MAAM,gBAAgB;EACvC,MAAM,UAAU,gBAAgB,MAAM;EACtC,MAAM,YAAY,EAAE,MAAM,mBAAmB;EAC7C,MAAM,KAAK,gBAAgB,SAAS;EAoCpC,IAAI,EAAC,OAhCqB,OACvB,OAAO;GACN,UAAU,QAAQ;GAClB,QAAQ,QAAQ;GAChB,gBAAgB,QAAQ;GAExB,UAAU,GAAG,kCAAkC,UAAU;oBAC/C,IAAI,GAAG,GAAG,gBAAgB,SAAS,GAAG,GAAG,GAAG,UAAU,QAAQ,QAAQ,CAAC,EAAE;;EAErF,CAAC,CAAC,CACD,KAAK,MAAM,CAAC,CACZ,MACC,QACE,QAAQ,UACR,SAAS,KAAK,EAAE,cAAc,QAAQ,QAAQ,CAChD,CACF,CAAC,CACA,KACC,OAAO,QAAQ,OAAO,oBAAoB,OAAO,MAAM,mBAAmB,CAAC,CAAC,GAC5E,OAAO,KAAK,SACV,SAAS,OAAO,EAAE,SAAS,qBACzB,KAAK,MACF,QACC,IAAI,aAAa,QAAQ,YACzB,IAAI,UACJ,IAAI,aAAa,aACjB,IAAI,mBAAmB,cAC3B,CACF,CACF,CACF,IAGA,OAAO,OAAO,gBACZ,OAAO,IAAI,aAAa;GACtB,IAAI,YAAY,MACd,OAAO,MAAM,yCAAyC,GAAG,UAAU,WAAW;GAChF,KAAK,MAAM,EAAE,SAAS,QAAQ,SAAS,oBAAoB,UAAU;IACnE,OAAO,OACJ,OAAO,MAAM,CAAC,CACd,OAAO;KACN,UAAU,QAAQ;KAClB,QAAQ;KACR,QAAQ;KACR;IACF,CAAC,CAAC,CACD,oBAAoB;IAEvB,MAAM,OAAO,OAAO,OACjB,OAAO,CAAC,CACR,KAAK,MAAM,CAAC,CACZ,MAAM,GAAG,QAAQ,UAAU,QAAQ,QAAQ,CAAC;IAE/C,MAAM,MAAM,OAAO,OAAO,oBAAoB,SAAS,CAAC,CAAC,KAAK,EAAE;IAEhE,IAAI,CAAC,IAAI,QACP,OAAO,OAAO,mBAAmB,kBAAkB,QAAQ,SAAS,aAAa;IACnF,IAAI,IAAI,mBAAmB,gBAAgB;KACzC,MAAM,WAAW,OAAO,OAAO,aAAa,UAAU,CAAC,CAAC,IAAI,MAAM;KAElE,IAAI,OAAO,cAAc,SAAS,YAChC,OAAO,OAAO,mBACZ,oDAAoD,QAAQ,UAC9D;KACF,OAAO,OACJ,OAAO,MAAM,CAAC,CACd,IAAI;MAAE,QAAQ;MAAS;KAAe,CAAC,CAAC,CACxC,MACC,IACE,GAAG,QAAQ,UAAU,QAAQ,QAAQ,GACrC,GAAG,QAAQ,gBAAgB,IAAI,cAAc,GAC7C,GAAG,QAAQ,QAAQ,IAAI,CACzB,CACF;KAEF,MAAM,UAAU,OAAO,OACpB,OAAO,CAAC,CACR,KAAK,MAAM,CAAC,CACZ,MAAM,GAAG,QAAQ,UAAU,QAAQ,QAAQ,CAAC;KAE/C,MAAM,UAAU,OAAO,OAAO,oBAAoB,SAAS,CAAC,CAAC,QAAQ,EAAE;KAEvE,IAAI,CAAC,QAAQ,UAAU,QAAQ,mBAAmB,gBAChD,OAAO,OAAO,mBACZ,4CAA4C,QAAQ,UACtD;IACJ;IACA,OAAO,OACJ,OAAO,EAAE,MAAM,mBAAmB,CAAC,CAAC,CACpC,OAAO;KACN,gBAAgB;KAChB,UAAU,QAAQ;KAClB,SAAS;KACT,aAAa;IACf,CAAC,CAAC,CACD,oBAAoB;GACzB;EACF,CAAC,CACH;EAEF,MAAM,aAAa,OAAO,6BACxB,EAAE,MACF,aACF;EAEA,MAAM,8BAAc,IAAI,IAA2C;EACnE,MAAM,2BAAW,IAAI,IAAqD;EAC1E,MAAM,6BAAa,IAAI,IAAiD;EAExE,KAAK,MAAM,WAAW,UACpB,IAAI,QAAQ,YAAY;GACtB,MAAM,UAAU,OAAO,OAAO,IAAI;IAChC,WAAW,EAAE,WAAW,OAAO;IAC/B,aACE,mBAAmB,0CAA0C,QAAQ,UAAU;GACnF,CAAC;GAED,MAAM,WAAW,OAAO,4BACtB,SACA,aACF;GAEA,YAAY,IAAI,QAAQ,UAAU,SAAS,kBAAkB;GAC7D,SAAS,IAAI,QAAQ,UAAU,SAAS,4BAA4B;GACpE,WAAW,IACT,QAAQ,WACP,OAAO,mCACN,SACA,aACF,EAAA,CAAG,wBACL;EACF,OACE,YAAY,IACV,QAAQ,WACP,OAAO,6BACN,EAAE,KAAK,OAAO,GACd,aACF,EAAA,CAAG,kBACL;EAIJ,MAAM,WAAc,UAAkC,aAAqB;GACzE,MAAM,QAAQ,SAAS,IAAI,QAAQ;GAEnC,OAAO,UAAU,KAAA,IAAY,OAAO,KAAK,YAAY,CAAC,IAAI,OAAO,QAAQ,KAAK;EAChF;EAEA,IAAI,UAAkC,QAAQ,KAC5C,oBACA,WAAW,kBACb,CAAC,CAAC,KACA,QAAQ,IAAI,oBAAoB;GAC9B,QAAQ,OAAO,YACb,OAAO,QAAQ,QAAQ,aAAa,MAAM,SAAS,QAAQ,IAAI,MAC7D,EAAE,MAAM,OAAO,OAAO,CACxB;GACF,UAAU,UACR,OAAO,QAAQ,QAAQ,aAAa,MAAM,QAAQ,IAAI,MAAM,EAAE,QAAQ,KAAK,CAAC;GAC9E,QAAQ,OAAO,YACb,OAAO,QAAQ,QAAQ,aAAa,MAAM,SAAS,QAAQ,IAAI,MAC7D,EAAE,MAAM,OAAO,OAAO,CACxB;GACF,SAAS,OAAO,YACd,OAAO,QAAQ,QAAQ,aAAa,MAAM,MAAM,SAAS,QAAQ,IAAI,MACnE,EAAE,OAAO,OAAO,OAAO,CACzB;GACF,UAAU,OAAO,YACf,OAAO,QAAQ,QAAQ,aAAa,MAAM,QAAQ,IAAI,MAAM,EAAE,QAAQ,OAAO,OAAO,CAAC;EACzF,CAAC,CACH;EAEA,IAAI,SAAS,OAAO,GAClB,UAAU,QAAQ,KAChB,QAAQ,IAAI,0BAA0B,EACpC,UAAU,UACR,OAAO,QAAQ,QAAQ,YAAY,MAAM,QAAQ,IAAI,MAAM,EAAE,QAAQ,KAAK,CAAC,EAC/E,CAAC,GACD,QAAQ,IAAI,8BAA8B;GACxC,kBAAkB,OAAO,YACvB,OAAO,QAAQ,QAAQ,UAAU,MAAM,SAAS,QAAQ,IAAI,MAC1D,EAAE,gBAAgB,OAAO,OAAO,CAClC;GACF,qBAAqB,OAAO,YAC1B,OAAO,QAAQ,QAAQ,UAAU,MAAM,MAAM,SAAS,QAAQ,IAAI,MAChE,EAAE,mBAAmB,OAAO,OAAO,CACrC;GACF,OAAO,UACL,OAAO,QAAQ,QAAQ,UAAU,MAAM,QAAQ,IAAI,MAAM,EAAE,KAAK,KAAK,CAAC;GACxE,gBAAgB,UACd,OAAO,QAAQ,QAAQ,UAAU,MAAM,QAAQ,IAAI,MAAM,EAAE,cAAc,KAAK,CAAC;GACjF,SAAS,OAAO,YACd,OAAO,QAAQ,QAAQ,UAAU,MAAM,QAAQ,IAAI,MAAM,EAAE,OAAO,OAAO,OAAO,CAAC;GACnF,SAAS,OAAO,YACd,OAAO,QAAQ,QAAQ,UAAU,MAAM,QAAQ,IAAI,MAAM,EAAE,OAAO,OAAO,OAAO,CAAC;EACrF,CAAC,CACH;EAEF,OAAO;CACT,GACA,OAAO,UAAU,UACf,OAAO,GAAG,6BAA6B,CAAC,CAAC,KAAK,IAC1C,QACA,mBAAmB,yCAAyC,CAClE,CAGQ;AACZ"}
|
|
1
|
+
{"version":3,"file":"passkeys.mjs","names":[],"sources":["../../src/internal/passkeys.ts"],"sourcesContent":["import {\n PasskeyCredentials,\n PasskeyCredential,\n PasskeyEnrollmentContext,\n PasskeyManagementPersistence,\n PasskeyManagementPolicy,\n PasskeyMethodPolicy,\n PasskeyPersistence,\n PasskeyProfile,\n PasskeyRequirement,\n PasskeyUnavailable,\n} from \"@yielded/auth/Passkey\";\nimport { Context, Effect, Schema } from \"effect\";\nimport { SqlClient } from \"effect/sql\";\n\nimport {\n PersistenceConfigurationError,\n type MappingInput,\n type PasskeyFeature,\n} from \"./configuration\";\nimport { digest } from \"./crypto\";\nimport { PersistenceMappingError } from \"./mapping-error\";\nimport {\n requiredPasskeyCredentialConstraints,\n requiredPasskeyPersistenceConstraints,\n type PasskeyCredentialMapping,\n type PasskeyPersistenceMapping,\n} from \"./models/passkey-model\";\nimport {\n requiredPasskeyManagementConstraints,\n type PasskeyManagementMapping,\n} from \"./models/passkey-write-model\";\nimport { makePasskeyKernel } from \"./passkey-kernel\";\nimport type { PasskeyTargetConfiguration } from \"./passkey/target\";\nimport type { Backend } from \"./persistence\";\nimport { CurrentProofSql } from \"./proof-kernel\";\nimport type { SqlExpression as SQL, QueryOperations, TableModel } from \"./query-operations\";\nimport { requireStandalone } from \"./standalone\";\nimport { storageTables, type StorageRole } from \"./storage-tables\";\n\nconst profileJson = Schema.fromJsonString(PasskeyProfile);\nconst policyJson = Schema.fromJsonString(PasskeyMethodPolicy);\n\nconst seedJson = Schema.fromJsonString(\n Schema.Struct({\n policy: PasskeyMethodPolicy,\n management: Schema.optionalKey(PasskeyManagementPolicy),\n }),\n);\n\nconst ModuleRow = Schema.Struct({\n active: Schema.Boolean,\n policy: Schema.String,\n policyRevision: Schema.String,\n});\n\nconst ConfiguredModuleRow = Schema.Struct({\n moduleId: Schema.String,\n active: Schema.Boolean,\n policyRevision: Schema.String,\n admitted: Schema.Literals([\"present\", \"missing\"]),\n});\n\nconst credentialData = PasskeyCredential.mapFields(\n ({ revision: _revision, active: _active, ...fields }) => fields,\n);\n\nconst unavailable = () => PasskeyUnavailable.make({});\nconst configurationError = (reason: string) => PersistenceConfigurationError.make({ reason });\n\ntype ReadMapping = PasskeyCredentialMapping<\n TableModel,\n TableModel,\n TableModel,\n TableModel,\n TableModel,\n unknown\n>;\ntype BaseMapping = PasskeyPersistenceMapping<\n ReadMapping,\n TableModel,\n TableModel,\n TableModel,\n TableModel,\n unknown\n>;\ntype ManagementMapping = PasskeyManagementMapping<\n TableModel,\n TableModel,\n TableModel,\n TableModel,\n TableModel,\n TableModel,\n TableModel,\n TableModel,\n TableModel,\n TableModel,\n unknown\n>;\n\n/** Share the same passkey algorithms across raw SQL and Drizzle compilers. */\nexport const makeComposedPasskeys = (\n operations: QueryOperations,\n): Backend<object, never>[\"passkeys\"] => {\n const { and, eq, getTableColumns, inArray, or, sql } = operations;\n const { target, writeTarget } = makePasskeyKernel(operations);\n\n const {\n makeTargetPasskeyCredentials,\n makeTargetPasskeyEnrollmentContext,\n makeTargetPasskeyPersistence,\n } = target;\n\n const { makeTargetPasskeyManagement } = writeTarget;\n\n const mappings = (\n storage: MappingInput,\n namespace: string,\n dialect: \"pg\" | \"sqlite\",\n passwordModules: ReadonlyArray<string>,\n signInProfiles: ReadonlyArray<PasskeyProfile>,\n ) => {\n const table = (role: StorageRole) => {\n const value = storage.tables[role];\n\n if (value === undefined) throw configurationError(`Missing ${role} mapping`);\n\n // Backend validation owns the foreign table shape. Row values are decoded below.\n return value;\n };\n\n const mapped = <Role extends StorageRole>(role: Role) => ({\n table: table(role),\n ...(Object.fromEntries(Object.keys(storageTables[role].columns).map((key) => [key, key])) as {\n readonly [Key in keyof (typeof storageTables)[Role][\"columns\"]]: Key;\n }),\n });\n\n const column = (role: StorageRole, key: string) => getTableColumns(table(role))[key];\n const s = storage.subjects;\n const subject = s.table;\n const sc = getTableColumns(subject);\n const active = (value: unknown) => value === true;\n const owned = (value: unknown) => value === \"owned\";\n\n const read: ReadMapping = {\n subject: {\n table: subject,\n id: s.id,\n status: s.status,\n securityRevision: s.securityRevision,\n decodeId: (row) => row[s.id],\n isActiveStatus: (value) => Object.is(value, s.activeValue),\n activeCondition: eq(sc[s.status], s.activeValue),\n },\n credential: {\n ...mapped(\"passkeyCredentials\"),\n status: \"active\",\n decode: (row) =>\n Schema.decodeUnknownSync(credentialData)({\n ...row,\n profile: Schema.decodeUnknownSync(profileJson)(row.profile),\n }),\n decodeSubjectId: (row) => row.subjectId,\n isActiveStatus: active,\n activeCondition: eq(column(\"passkeyCredentials\", \"active\"), true),\n },\n authority: {\n ...mapped(\"credentials\"),\n status: \"active\",\n isActiveStatus: active,\n activeCondition: eq(column(\"credentials\", \"active\"), true),\n },\n credentialOwnership: {\n ...mapped(\"passkeyOwnership\"),\n isOwnedState: owned,\n ownedCondition: eq(column(\"passkeyOwnership\", \"state\"), \"owned\"),\n decodeSubjectId: (row) => row.subjectId,\n },\n handleOwnership: {\n ...mapped(\"passkeyHandles\"),\n isOwnedState: owned,\n ownedCondition: eq(column(\"passkeyHandles\", \"state\"), \"owned\"),\n decodeSubjectId: (row) => row.subjectId,\n },\n subjectIds: { toNative: s.toNativeSync, toSubject: s.toSubjectSync, equals: Object.is },\n constraints: requiredPasskeyCredentialConstraints,\n };\n\n const base = (feature: PasskeyFeature): BaseMapping => ({\n moduleId: feature.moduleId,\n authorityScope: namespace,\n read,\n module: {\n ...mapped(\"passkeyModules\"),\n status: \"active\",\n policyColumns: [\"policy\", \"policyRevision\"],\n isActiveStatus: active,\n activeCondition: eq(column(\"passkeyModules\", \"active\"), true),\n decodeMethodPolicy: (row) => Schema.decodeUnknownSync(policyJson)(row.policy),\n },\n flow: {\n ...mapped(\"passkeyFlows\"),\n states: {\n Pending: \"Pending\",\n Claimed: \"Claimed\",\n Verified: \"Verified\",\n Rejected: \"Rejected\",\n Ambiguous: \"Ambiguous\",\n RegistrationAccepted: \"RegistrationAccepted\",\n ProvisioningPending: \"ProvisioningPending\",\n },\n encodeInsert: () => ({}),\n },\n admission: mapped(\"passkeyAdmissions\"),\n charge: { ...mapped(\"passkeyCharges\"), encodeInsert: () => ({}) },\n clock: {\n encodeInstant: storage.encodeInstant,\n decodeInstant: storage.decodeInstantSync,\n engineNowMillis:\n dialect === \"pg\"\n ? sql`cast(extract(epoch from clock_timestamp()) * 1000 as bigint)`\n : sql`cast(round((julianday('now') - 2440587.5) * 86400000) as integer)`,\n toMillis: (expression) => expression,\n fromMillis: (expression) => expression,\n },\n telemetry: { lastUsedAt: \"lastUsedAt\", encodeBackupState: (value) => value },\n constraints: requiredPasskeyPersistenceConstraints,\n });\n\n const management = (feature: PasskeyFeature): ManagementMapping => {\n const policy = feature.managementPolicy;\n\n if (policy === undefined)\n throw configurationError(`Missing passkey management policy for ${feature.moduleId}`);\n const c = getTableColumns(table(\"passkeyCredentials\"));\n const f = getTableColumns(table(\"credentials\"));\n\n const metadata = (subjectId: unknown) =>\n sql`exists(select 1 from ${subject} where ${sc[s.id]} = ${subjectId} and ${sc[s.status]} = ${s.activeValue})`;\n\n return {\n ...base(feature),\n write: {\n credential: {\n name: \"name\",\n createdAt: \"createdAt\",\n encodeInsert: ({ credential, subjectId, summary, marker }) => ({\n credentialId: credential.credentialId,\n subjectId,\n rpId: credential.rpId,\n protocolCredentialId: credential.protocolCredentialId,\n userHandle: credential.userHandle,\n credentialKey: \"\",\n handleKey: \"\",\n publicKey: credential.publicKey,\n algorithm: credential.algorithm,\n profile: Schema.encodeSync(profileJson)(credential.profile),\n credentialRevision: marker,\n active: true,\n primarySignIn: credential.primarySignIn,\n enrollmentUserVerified: credential.enrollmentUserVerified,\n backupEligible: credential.backupEligible,\n backupState: credential.backupState,\n counter: credential.counter,\n maximumCounter: credential.maximumCounter,\n name: summary.name,\n createdAt: storage.encodeInstant(summary.createdAtMillis),\n }),\n encodePrimarySignIn: (value) => value,\n encodeEnrollmentUserVerified: (value) => value,\n encodeBackupEligible: (value) => value,\n activeStatus: true,\n removedStatus: false,\n },\n authority: {\n encodeInsert: ({ subjectId, credential, marker }) => ({\n subjectId,\n credentialId: credential.credentialId,\n revision: marker,\n active: true,\n }),\n activeStatus: true,\n removedStatus: false,\n },\n credentialOwnership: {\n encodeInsert: ({ credential, marker }) => ({\n credentialKey: \"\",\n rpId: credential.rpId,\n protocolCredentialId: credential.protocolCredentialId,\n state: \"owned\",\n version: marker,\n }),\n ownedState: \"owned\",\n removedState: \"removed\",\n },\n handleOwnership: {\n encodeInsert: ({ subjectId, rpId, userHandle, marker }) => ({\n subjectId,\n rpId,\n userHandle,\n handleKey: \"\",\n state: \"owned\",\n version: marker,\n }),\n ownedState: \"owned\",\n },\n policy: {\n subjectColumns: Object.keys(sc),\n management: () => policy,\n requirement: s.actionRequirements,\n metadata,\n action: metadata,\n remainingSignIn: (subjectId, excluded, row) =>\n Effect.gen(function* () {\n const requirement = yield* Schema.decodeEffect(PasskeyRequirement)(\n yield* s.requirements(row),\n );\n\n const alternatives: SQL[] = [];\n\n // Only retain complete sign-in paths enabled by this Auth definition.\n // More involved combinations require an explicit application's predicate.\n if (\n requirement.alternatives.some(\n (alternative) =>\n alternative.minimumCredentials === 1 &&\n alternative.factors.every((factor) => factor === \"possession\"),\n )\n ) {\n const profiles = signInProfiles.map((profile) =>\n Schema.encodeSync(profileJson)(profile),\n );\n\n alternatives.push(sql`exists(\n select 1 from ${table(\"passkeyCredentials\")} join ${table(\"credentials\")}\n on ${f.credentialId} = ${c.credentialId} and ${f.subjectId} = ${c.subjectId}\n and ${f.revision} = ${c.credentialRevision} and ${f.active} = ${true}\n where ${c.subjectId} = ${subjectId} and ${c.credentialId} <> ${excluded}\n and ${c.active} = ${true} and ${c.primarySignIn} = ${true}\n and ${c.enrollmentUserVerified} = ${true} and ${inArray(c.profile, profiles)}\n )`);\n }\n if (\n passwordModules.length > 0 &&\n requirement.alternatives.some(\n (alternative) =>\n alternative.minimumCredentials === 1 &&\n !alternative.userVerified &&\n !alternative.phishingResistant &&\n alternative.factors.every((factor) => factor === \"knowledge\"),\n )\n ) {\n const p = getTableColumns(table(\"passwords\"));\n const i = getTableColumns(table(\"identifiers\"));\n\n alternatives.push(sql`exists(\n select 1 from ${table(\"passwords\")} join ${table(\"credentials\")}\n on ${f.credentialId} = ${p.credentialId} and ${f.subjectId} = ${p.subjectId}\n and ${f.revision} = ${p.credentialRevision} and ${f.active} = ${true}\n join ${table(\"identifiers\")} on ${i.subjectId} = ${p.subjectId}\n and ${i.active} = ${true} and ${i.namespace} = 'email'\n where ${p.subjectId} = ${subjectId} and ${p.credentialId} <> ${excluded}\n and ${inArray(p.moduleId, passwordModules)}\n )`);\n }\n\n return or(...alternatives) ?? sql`false`;\n }).pipe(\n Effect.mapError((cause) =>\n PersistenceMappingError.make({ operation: \"mapping\", cause }),\n ),\n ),\n },\n },\n command: { ...mapped(\"passkeyCommands\"), encodeInsert: (input) => ({ ...input }) },\n managementConstraints: requiredPasskeyManagementConstraints,\n invalidation: {\n window: {\n trigger: \"credential-change\",\n existingSessions: \"immediate\",\n maximumExposureMillis: 0,\n oldAuthenticationEvidence: \"rejected\",\n },\n mutations: [],\n postcondition: ({ subjectId, securityRevision }) =>\n sql`exists(select 1 from ${subject} where ${sc[s.id]} = ${subjectId} and ${sc[s.securityRevision]} = ${securityRevision})`,\n },\n };\n };\n\n return { read, base, management, table };\n };\n\n const make: Backend<object, never>[\"passkeys\"] = Effect.fn(\"AuthPersistence.passkeys\")(\n function* ({ storage, namespace, dialect, features, passwordModules }) {\n const client = yield* SqlClient.SqlClient;\n\n const policies = yield* Effect.forEach(features, (feature) =>\n Effect.gen(function* () {\n const policy = yield* feature.policy;\n const encoded = yield* Schema.encodeEffect(policyJson)(policy);\n\n const policyRevision = yield* digest(\n yield* Schema.encodeEffect(seedJson)({\n policy,\n ...(feature.managementPolicy === undefined\n ? {}\n : { management: feature.managementPolicy }),\n }),\n );\n\n return { feature, policy, encoded, policyRevision };\n }),\n );\n\n const m = yield* Effect.try({\n try: () =>\n mappings(\n storage,\n namespace,\n dialect,\n passwordModules,\n policies.flatMap(({ feature, policy }) => (feature.management ? [] : policy.profiles)),\n ),\n catch: () => configurationError(\"Invalid passkey table mappings\"),\n });\n\n const configuration: PasskeyTargetConfiguration = {\n mode: \"interactive\",\n dialect,\n locking: dialect === \"pg\",\n standaloneGuard: () => requireStandalone(unavailable, client.transactionService),\n };\n\n const native = yield* CurrentProofSql;\n const module = m.table(\"passkeyModules\");\n const columns = getTableColumns(module);\n const admission = m.table(\"passkeyAdmissions\");\n const ac = getTableColumns(admission);\n\n // Read live configuration on every acquisition. Matching modules and\n // admission ownership need no initialization writes or advisory lock.\n const configured = yield* native\n .select({\n moduleId: columns.moduleId,\n active: columns.active,\n policyRevision: columns.policyRevision,\n // Predicate SQL preserves qualifiers through single-table projections.\n admitted: sql`case when exists(select 1 from ${admission}\n where ${and(eq(ac.authorityScope, namespace), eq(ac.moduleId, columns.moduleId))})\n then 'present' else 'missing' end`,\n })\n .from(module)\n .where(\n inArray(\n columns.moduleId,\n policies.map(({ feature }) => feature.moduleId),\n ),\n )\n .pipe(\n Effect.flatMap(Schema.decodeUnknownEffect(Schema.Array(ConfiguredModuleRow))),\n Effect.map((rows) =>\n policies.every(({ feature, policyRevision }) =>\n rows.some(\n (row) =>\n row.moduleId === feature.moduleId &&\n row.active &&\n row.admitted === \"present\" &&\n row.policyRevision === policyRevision,\n ),\n ),\n ),\n );\n\n if (!configured)\n yield* client.withTransaction(\n Effect.gen(function* () {\n if (dialect === \"pg\")\n yield* client`select pg_advisory_xact_lock(hashtext(${`${namespace}/passkeys`}))`;\n for (const { feature, policy, encoded, policyRevision } of policies) {\n yield* native\n .insert(module)\n .values({\n moduleId: feature.moduleId,\n active: true,\n policy: encoded,\n policyRevision,\n })\n .onConflictDoNothing();\n\n const rows = yield* native\n .select()\n .from(module)\n .where(eq(columns.moduleId, feature.moduleId));\n\n const row = yield* Schema.decodeUnknownEffect(ModuleRow)(rows[0]);\n\n if (!row.active)\n return yield* configurationError(`Passkey module ${feature.moduleId} is disabled`);\n if (row.policyRevision !== policyRevision) {\n const previous = yield* Schema.decodeEffect(policyJson)(row.policy);\n\n if (policy.generation <= previous.generation)\n return yield* configurationError(\n `Increase the passkey policy generation to change ${feature.moduleId}`,\n );\n yield* native\n .update(module)\n .set({ policy: encoded, policyRevision })\n .where(\n and(\n eq(columns.moduleId, feature.moduleId),\n eq(columns.policyRevision, row.policyRevision),\n eq(columns.active, true),\n ),\n );\n\n const updated = yield* native\n .select()\n .from(module)\n .where(eq(columns.moduleId, feature.moduleId));\n\n const applied = yield* Schema.decodeUnknownEffect(ModuleRow)(updated[0]);\n\n if (!applied.active || applied.policyRevision !== policyRevision)\n return yield* configurationError(\n `Passkey policy changed while configuring ${feature.moduleId}`,\n );\n }\n yield* native\n .insert(m.table(\"passkeyAdmissions\"))\n .values({\n authorityScope: namespace,\n moduleId: feature.moduleId,\n version: policyRevision,\n ownerMarker: policyRevision,\n })\n .onConflictDoNothing();\n }\n }),\n );\n\n const credential = yield* makeTargetPasskeyCredentials<ReadMapping, never>(\n m.read,\n configuration,\n );\n\n const persistence = new Map<string, PasskeyPersistence[\"Service\"]>();\n const managers = new Map<string, PasskeyManagementPersistence[\"Service\"]>();\n const enrollment = new Map<string, PasskeyEnrollmentContext[\"Service\"]>();\n\n for (const feature of features) {\n if (feature.management) {\n const mapping = yield* Effect.try({\n try: () => m.management(feature),\n catch: () =>\n configurationError(`Invalid passkey management mapping for ${feature.moduleId}`),\n });\n\n const services = yield* makeTargetPasskeyManagement<ManagementMapping, never>(\n mapping,\n configuration,\n );\n\n persistence.set(feature.moduleId, services.passkeyPersistence);\n managers.set(feature.moduleId, services.passkeyManagementPersistence);\n enrollment.set(\n feature.moduleId,\n (yield* makeTargetPasskeyEnrollmentContext<ManagementMapping, never>(\n mapping,\n configuration,\n )).passkeyEnrollmentContext,\n );\n } else {\n persistence.set(\n feature.moduleId,\n (yield* makeTargetPasskeyPersistence<BaseMapping, never>(\n m.base(feature),\n configuration,\n )).passkeyPersistence,\n );\n }\n }\n\n const service = <A>(services: ReadonlyMap<string, A>, moduleId: string) => {\n const value = services.get(moduleId);\n\n return value === undefined ? Effect.fail(unavailable()) : Effect.succeed(value);\n };\n\n let context: Context.Context<never> = Context.make(\n PasskeyCredentials,\n credential.passkeyCredentials,\n ).pipe(\n Context.add(PasskeyPersistence, {\n issue: (input, prepare) =>\n Effect.flatMap(service(persistence, input.ceremony.moduleId), (s) =>\n s.issue(input, prepare),\n ),\n context: (input) =>\n Effect.flatMap(service(persistence, input.moduleId), (s) => s.context(input)),\n claim: (input, prepare) =>\n Effect.flatMap(service(persistence, input.ceremony.moduleId), (s) =>\n s.claim(input, prepare),\n ),\n settle: (input, prepare) =>\n Effect.flatMap(service(persistence, input.claim.ceremony.moduleId), (s) =>\n s.settle(input, prepare),\n ),\n cleanup: (input, prepare) =>\n Effect.flatMap(service(persistence, input.moduleId), (s) => s.cleanup(input, prepare)),\n }),\n );\n\n if (managers.size > 0)\n context = context.pipe(\n Context.add(PasskeyEnrollmentContext, {\n capture: (input) =>\n Effect.flatMap(service(enrollment, input.moduleId), (s) => s.capture(input)),\n }),\n Context.add(PasskeyManagementPersistence, {\n issueEnrollment: (input, prepare) =>\n Effect.flatMap(service(managers, input.ceremony.moduleId), (s) =>\n s.issueEnrollment(input, prepare),\n ),\n completeEnrollment: (input, prepare) =>\n Effect.flatMap(service(managers, input.claim.ceremony.moduleId), (s) =>\n s.completeEnrollment(input, prepare),\n ),\n list: (input) =>\n Effect.flatMap(service(managers, input.moduleId), (s) => s.list(input)),\n inspectRemove: (input) =>\n Effect.flatMap(service(managers, input.moduleId), (s) => s.inspectRemove(input)),\n rename: (input, prepare) =>\n Effect.flatMap(service(managers, input.moduleId), (s) => s.rename(input, prepare)),\n remove: (input, prepare) =>\n Effect.flatMap(service(managers, input.moduleId), (s) => s.remove(input, prepare)),\n }),\n );\n\n return context;\n },\n Effect.mapError((error) =>\n Schema.is(PersistenceConfigurationError)(error)\n ? error\n : configurationError(\"Unable to configure passkey persistence\"),\n ),\n );\n\n return make;\n};\n"],"mappings":";;;;;;;;;;;;;AAwCA,MAAM,cAAc,OAAO,eAAe,cAAc;AACxD,MAAM,aAAa,OAAO,eAAe,mBAAmB;AAE5D,MAAM,WAAW,OAAO,eACtB,OAAO,OAAO;CACZ,QAAQ;CACR,YAAY,OAAO,YAAY,uBAAuB;AACxD,CAAC,CACH;AAEA,MAAM,YAAY,OAAO,OAAO;CAC9B,QAAQ,OAAO;CACf,QAAQ,OAAO;CACf,gBAAgB,OAAO;AACzB,CAAC;AAED,MAAM,sBAAsB,OAAO,OAAO;CACxC,UAAU,OAAO;CACjB,QAAQ,OAAO;CACf,gBAAgB,OAAO;CACvB,UAAU,OAAO,SAAS,CAAC,WAAW,SAAS,CAAC;AAClD,CAAC;AAED,MAAM,iBAAiB,kBAAkB,WACtC,EAAE,UAAU,WAAW,QAAQ,SAAS,GAAG,aAAa,MAC3D;AAEA,MAAM,oBAAoB,mBAAmB,KAAK,CAAC,CAAC;AACpD,MAAM,sBAAsB,WAAmB,8BAA8B,KAAK,EAAE,OAAO,CAAC;;AAiC5F,MAAa,wBACX,eACuC;CACvC,MAAM,EAAE,KAAK,IAAI,iBAAiB,SAAS,IAAI,QAAQ;CACvD,MAAM,EAAE,QAAQ,gBAAgB,kBAAkB,UAAU;CAE5D,MAAM,EACJ,8BACA,oCACA,iCACE;CAEJ,MAAM,EAAE,gCAAgC;CAExC,MAAM,YACJ,SACA,WACA,SACA,iBACA,mBACG;EACH,MAAM,SAAS,SAAsB;GACnC,MAAM,QAAQ,QAAQ,OAAO;GAE7B,IAAI,UAAU,KAAA,GAAW,MAAM,mBAAmB,WAAW,KAAK,SAAS;GAG3E,OAAO;EACT;EAEA,MAAM,UAAoC,UAAgB;GACxD,OAAO,MAAM,IAAI;GACjB,GAAI,OAAO,YAAY,OAAO,KAAK,cAAc,KAAK,CAAC,OAAO,CAAC,CAAC,KAAK,QAAQ,CAAC,KAAK,GAAG,CAAC,CAAC;EAG1F;EAEA,MAAM,UAAU,MAAmB,QAAgB,gBAAgB,MAAM,IAAI,CAAC,CAAC,CAAC;EAChF,MAAM,IAAI,QAAQ;EAClB,MAAM,UAAU,EAAE;EAClB,MAAM,KAAK,gBAAgB,OAAO;EAClC,MAAM,UAAU,UAAmB,UAAU;EAC7C,MAAM,SAAS,UAAmB,UAAU;EAE5C,MAAM,OAAoB;GACxB,SAAS;IACP,OAAO;IACP,IAAI,EAAE;IACN,QAAQ,EAAE;IACV,kBAAkB,EAAE;IACpB,WAAW,QAAQ,IAAI,EAAE;IACzB,iBAAiB,UAAU,OAAO,GAAG,OAAO,EAAE,WAAW;IACzD,iBAAiB,GAAG,GAAG,EAAE,SAAS,EAAE,WAAW;GACjD;GACA,YAAY;IACV,GAAG,OAAO,oBAAoB;IAC9B,QAAQ;IACR,SAAS,QACP,OAAO,kBAAkB,cAAc,CAAC,CAAC;KACvC,GAAG;KACH,SAAS,OAAO,kBAAkB,WAAW,CAAC,CAAC,IAAI,OAAO;IAC5D,CAAC;IACH,kBAAkB,QAAQ,IAAI;IAC9B,gBAAgB;IAChB,iBAAiB,GAAG,OAAO,sBAAsB,QAAQ,GAAG,IAAI;GAClE;GACA,WAAW;IACT,GAAG,OAAO,aAAa;IACvB,QAAQ;IACR,gBAAgB;IAChB,iBAAiB,GAAG,OAAO,eAAe,QAAQ,GAAG,IAAI;GAC3D;GACA,qBAAqB;IACnB,GAAG,OAAO,kBAAkB;IAC5B,cAAc;IACd,gBAAgB,GAAG,OAAO,oBAAoB,OAAO,GAAG,OAAO;IAC/D,kBAAkB,QAAQ,IAAI;GAChC;GACA,iBAAiB;IACf,GAAG,OAAO,gBAAgB;IAC1B,cAAc;IACd,gBAAgB,GAAG,OAAO,kBAAkB,OAAO,GAAG,OAAO;IAC7D,kBAAkB,QAAQ,IAAI;GAChC;GACA,YAAY;IAAE,UAAU,EAAE;IAAc,WAAW,EAAE;IAAe,QAAQ,OAAO;GAAG;GACtF,aAAa;EACf;EAEA,MAAM,QAAQ,aAA0C;GACtD,UAAU,QAAQ;GAClB,gBAAgB;GAChB;GACA,QAAQ;IACN,GAAG,OAAO,gBAAgB;IAC1B,QAAQ;IACR,eAAe,CAAC,UAAU,gBAAgB;IAC1C,gBAAgB;IAChB,iBAAiB,GAAG,OAAO,kBAAkB,QAAQ,GAAG,IAAI;IAC5D,qBAAqB,QAAQ,OAAO,kBAAkB,UAAU,CAAC,CAAC,IAAI,MAAM;GAC9E;GACA,MAAM;IACJ,GAAG,OAAO,cAAc;IACxB,QAAQ;KACN,SAAS;KACT,SAAS;KACT,UAAU;KACV,UAAU;KACV,WAAW;KACX,sBAAsB;KACtB,qBAAqB;IACvB;IACA,qBAAqB,CAAC;GACxB;GACA,WAAW,OAAO,mBAAmB;GACrC,QAAQ;IAAE,GAAG,OAAO,gBAAgB;IAAG,qBAAqB,CAAC;GAAG;GAChE,OAAO;IACL,eAAe,QAAQ;IACvB,eAAe,QAAQ;IACvB,iBACE,YAAY,OACR,GAAG,iEACH,GAAG;IACT,WAAW,eAAe;IAC1B,aAAa,eAAe;GAC9B;GACA,WAAW;IAAE,YAAY;IAAc,oBAAoB,UAAU;GAAM;GAC3E,aAAa;EACf;EAEA,MAAM,cAAc,YAA+C;GACjE,MAAM,SAAS,QAAQ;GAEvB,IAAI,WAAW,KAAA,GACb,MAAM,mBAAmB,yCAAyC,QAAQ,UAAU;GACtF,MAAM,IAAI,gBAAgB,MAAM,oBAAoB,CAAC;GACrD,MAAM,IAAI,gBAAgB,MAAM,aAAa,CAAC;GAE9C,MAAM,YAAY,cAChB,GAAG,wBAAwB,QAAQ,SAAS,GAAG,EAAE,IAAI,KAAK,UAAU,OAAO,GAAG,EAAE,QAAQ,KAAK,EAAE,YAAY;GAE7G,OAAO;IACL,GAAG,KAAK,OAAO;IACf,OAAO;KACL,YAAY;MACV,MAAM;MACN,WAAW;MACX,eAAe,EAAE,YAAY,WAAW,SAAS,cAAc;OAC7D,cAAc,WAAW;OACzB;OACA,MAAM,WAAW;OACjB,sBAAsB,WAAW;OACjC,YAAY,WAAW;OACvB,eAAe;OACf,WAAW;OACX,WAAW,WAAW;OACtB,WAAW,WAAW;OACtB,SAAS,OAAO,WAAW,WAAW,CAAC,CAAC,WAAW,OAAO;OAC1D,oBAAoB;OACpB,QAAQ;OACR,eAAe,WAAW;OAC1B,wBAAwB,WAAW;OACnC,gBAAgB,WAAW;OAC3B,aAAa,WAAW;OACxB,SAAS,WAAW;OACpB,gBAAgB,WAAW;OAC3B,MAAM,QAAQ;OACd,WAAW,QAAQ,cAAc,QAAQ,eAAe;MAC1D;MACA,sBAAsB,UAAU;MAChC,+BAA+B,UAAU;MACzC,uBAAuB,UAAU;MACjC,cAAc;MACd,eAAe;KACjB;KACA,WAAW;MACT,eAAe,EAAE,WAAW,YAAY,cAAc;OACpD;OACA,cAAc,WAAW;OACzB,UAAU;OACV,QAAQ;MACV;MACA,cAAc;MACd,eAAe;KACjB;KACA,qBAAqB;MACnB,eAAe,EAAE,YAAY,cAAc;OACzC,eAAe;OACf,MAAM,WAAW;OACjB,sBAAsB,WAAW;OACjC,OAAO;OACP,SAAS;MACX;MACA,YAAY;MACZ,cAAc;KAChB;KACA,iBAAiB;MACf,eAAe,EAAE,WAAW,MAAM,YAAY,cAAc;OAC1D;OACA;OACA;OACA,WAAW;OACX,OAAO;OACP,SAAS;MACX;MACA,YAAY;KACd;KACA,QAAQ;MACN,gBAAgB,OAAO,KAAK,EAAE;MAC9B,kBAAkB;MAClB,aAAa,EAAE;MACf;MACA,QAAQ;MACR,kBAAkB,WAAW,UAAU,QACrC,OAAO,IAAI,aAAa;OACtB,MAAM,cAAc,OAAO,OAAO,aAAa,kBAAkB,CAAC,CAChE,OAAO,EAAE,aAAa,GAAG,CAC3B;OAEA,MAAM,eAAsB,CAAC;OAI7B,IACE,YAAY,aAAa,MACtB,gBACC,YAAY,uBAAuB,KACnC,YAAY,QAAQ,OAAO,WAAW,WAAW,YAAY,CACjE,GACA;QACA,MAAM,WAAW,eAAe,KAAK,YACnC,OAAO,WAAW,WAAW,CAAC,CAAC,OAAO,CACxC;QAEA,aAAa,KAAK,GAAG;kCACL,MAAM,oBAAoB,EAAE,QAAQ,MAAM,aAAa,EAAE;uBACpE,EAAE,aAAa,KAAK,EAAE,aAAa,OAAO,EAAE,UAAU,KAAK,EAAE,UAAU;0BACpE,EAAE,SAAS,KAAK,EAAE,mBAAmB,OAAO,EAAE,OAAO,KAAK,KAAK;0BAC/D,EAAE,UAAU,KAAK,UAAU,OAAO,EAAE,aAAa,MAAM,SAAS;0BAChE,EAAE,OAAO,KAAK,KAAK,OAAO,EAAE,cAAc,KAAK,KAAK;0BACpD,EAAE,uBAAuB,KAAK,KAAK,OAAO,QAAQ,EAAE,SAAS,QAAQ,EAAE;kBAC/E;OACF;OACA,IACE,gBAAgB,SAAS,KACzB,YAAY,aAAa,MACtB,gBACC,YAAY,uBAAuB,KACnC,CAAC,YAAY,gBACb,CAAC,YAAY,qBACb,YAAY,QAAQ,OAAO,WAAW,WAAW,WAAW,CAChE,GACA;QACA,MAAM,IAAI,gBAAgB,MAAM,WAAW,CAAC;QAC5C,MAAM,IAAI,gBAAgB,MAAM,aAAa,CAAC;QAE9C,aAAa,KAAK,GAAG;kCACL,MAAM,WAAW,EAAE,QAAQ,MAAM,aAAa,EAAE;uBAC3D,EAAE,aAAa,KAAK,EAAE,aAAa,OAAO,EAAE,UAAU,KAAK,EAAE,UAAU;0BACpE,EAAE,SAAS,KAAK,EAAE,mBAAmB,OAAO,EAAE,OAAO,KAAK,KAAK;yBAChE,MAAM,aAAa,EAAE,MAAM,EAAE,UAAU,KAAK,EAAE,UAAU;0BACvD,EAAE,OAAO,KAAK,KAAK,OAAO,EAAE,UAAU;0BACtC,EAAE,UAAU,KAAK,UAAU,OAAO,EAAE,aAAa,MAAM,SAAS;0BAChE,QAAQ,EAAE,UAAU,eAAe,EAAE;kBAC7C;OACF;OAEA,OAAO,GAAG,GAAG,YAAY,KAAK,GAAG;MACnC,CAAC,CAAC,CAAC,KACD,OAAO,UAAU,UACf,wBAAwB,KAAK;OAAE,WAAW;OAAW;MAAM,CAAC,CAC9D,CACF;KACJ;IACF;IACA,SAAS;KAAE,GAAG,OAAO,iBAAiB;KAAG,eAAe,WAAW,EAAE,GAAG,MAAM;IAAG;IACjF,uBAAuB;IACvB,cAAc;KACZ,QAAQ;MACN,SAAS;MACT,kBAAkB;MAClB,uBAAuB;MACvB,2BAA2B;KAC7B;KACA,WAAW,CAAC;KACZ,gBAAgB,EAAE,WAAW,uBAC3B,GAAG,wBAAwB,QAAQ,SAAS,GAAG,EAAE,IAAI,KAAK,UAAU,OAAO,GAAG,EAAE,kBAAkB,KAAK,iBAAiB;IAC5H;GACF;EACF;EAEA,OAAO;GAAE;GAAM;GAAM;GAAY;EAAM;CACzC;CAkQA,OAhQiD,OAAO,GAAG,0BAA0B,CAAC,CACpF,WAAW,EAAE,SAAS,WAAW,SAAS,UAAU,mBAAmB;EACrE,MAAM,SAAS,OAAO,UAAU;EAEhC,MAAM,WAAW,OAAO,OAAO,QAAQ,WAAW,YAChD,OAAO,IAAI,aAAa;GACtB,MAAM,SAAS,OAAO,QAAQ;GAY9B,OAAO;IAAE;IAAS;IAAQ,SAAA,OAXH,OAAO,aAAa,UAAU,CAAC,CAAC,MAAM;IAW1B,gBAAA,OATL,OAC5B,OAAO,OAAO,aAAa,QAAQ,CAAC,CAAC;KACnC;KACA,GAAI,QAAQ,qBAAqB,KAAA,IAC7B,CAAC,IACD,EAAE,YAAY,QAAQ,iBAAiB;IAC7C,CAAC,CACH;GAEkD;EACpD,CAAC,CACH;EAEA,MAAM,IAAI,OAAO,OAAO,IAAI;GAC1B,WACE,SACE,SACA,WACA,SACA,iBACA,SAAS,SAAS,EAAE,SAAS,aAAc,QAAQ,aAAa,CAAC,IAAI,OAAO,QAAS,CACvF;GACF,aAAa,mBAAmB,gCAAgC;EAClE,CAAC;EAED,MAAM,gBAA4C;GAChD,MAAM;GACN;GACA,SAAS,YAAY;GACrB,uBAAuB,kBAAkB,aAAa,OAAO,kBAAkB;EACjF;EAEA,MAAM,SAAS,OAAO;EACtB,MAAM,SAAS,EAAE,MAAM,gBAAgB;EACvC,MAAM,UAAU,gBAAgB,MAAM;EACtC,MAAM,YAAY,EAAE,MAAM,mBAAmB;EAC7C,MAAM,KAAK,gBAAgB,SAAS;EAoCpC,IAAI,EAAC,OAhCqB,OACvB,OAAO;GACN,UAAU,QAAQ;GAClB,QAAQ,QAAQ;GAChB,gBAAgB,QAAQ;GAExB,UAAU,GAAG,kCAAkC,UAAU;oBAC/C,IAAI,GAAG,GAAG,gBAAgB,SAAS,GAAG,GAAG,GAAG,UAAU,QAAQ,QAAQ,CAAC,EAAE;;EAErF,CAAC,CAAC,CACD,KAAK,MAAM,CAAC,CACZ,MACC,QACE,QAAQ,UACR,SAAS,KAAK,EAAE,cAAc,QAAQ,QAAQ,CAChD,CACF,CAAC,CACA,KACC,OAAO,QAAQ,OAAO,oBAAoB,OAAO,MAAM,mBAAmB,CAAC,CAAC,GAC5E,OAAO,KAAK,SACV,SAAS,OAAO,EAAE,SAAS,qBACzB,KAAK,MACF,QACC,IAAI,aAAa,QAAQ,YACzB,IAAI,UACJ,IAAI,aAAa,aACjB,IAAI,mBAAmB,cAC3B,CACF,CACF,CACF,IAGA,OAAO,OAAO,gBACZ,OAAO,IAAI,aAAa;GACtB,IAAI,YAAY,MACd,OAAO,MAAM,yCAAyC,GAAG,UAAU,WAAW;GAChF,KAAK,MAAM,EAAE,SAAS,QAAQ,SAAS,oBAAoB,UAAU;IACnE,OAAO,OACJ,OAAO,MAAM,CAAC,CACd,OAAO;KACN,UAAU,QAAQ;KAClB,QAAQ;KACR,QAAQ;KACR;IACF,CAAC,CAAC,CACD,oBAAoB;IAEvB,MAAM,OAAO,OAAO,OACjB,OAAO,CAAC,CACR,KAAK,MAAM,CAAC,CACZ,MAAM,GAAG,QAAQ,UAAU,QAAQ,QAAQ,CAAC;IAE/C,MAAM,MAAM,OAAO,OAAO,oBAAoB,SAAS,CAAC,CAAC,KAAK,EAAE;IAEhE,IAAI,CAAC,IAAI,QACP,OAAO,OAAO,mBAAmB,kBAAkB,QAAQ,SAAS,aAAa;IACnF,IAAI,IAAI,mBAAmB,gBAAgB;KACzC,MAAM,WAAW,OAAO,OAAO,aAAa,UAAU,CAAC,CAAC,IAAI,MAAM;KAElE,IAAI,OAAO,cAAc,SAAS,YAChC,OAAO,OAAO,mBACZ,oDAAoD,QAAQ,UAC9D;KACF,OAAO,OACJ,OAAO,MAAM,CAAC,CACd,IAAI;MAAE,QAAQ;MAAS;KAAe,CAAC,CAAC,CACxC,MACC,IACE,GAAG,QAAQ,UAAU,QAAQ,QAAQ,GACrC,GAAG,QAAQ,gBAAgB,IAAI,cAAc,GAC7C,GAAG,QAAQ,QAAQ,IAAI,CACzB,CACF;KAEF,MAAM,UAAU,OAAO,OACpB,OAAO,CAAC,CACR,KAAK,MAAM,CAAC,CACZ,MAAM,GAAG,QAAQ,UAAU,QAAQ,QAAQ,CAAC;KAE/C,MAAM,UAAU,OAAO,OAAO,oBAAoB,SAAS,CAAC,CAAC,QAAQ,EAAE;KAEvE,IAAI,CAAC,QAAQ,UAAU,QAAQ,mBAAmB,gBAChD,OAAO,OAAO,mBACZ,4CAA4C,QAAQ,UACtD;IACJ;IACA,OAAO,OACJ,OAAO,EAAE,MAAM,mBAAmB,CAAC,CAAC,CACpC,OAAO;KACN,gBAAgB;KAChB,UAAU,QAAQ;KAClB,SAAS;KACT,aAAa;IACf,CAAC,CAAC,CACD,oBAAoB;GACzB;EACF,CAAC,CACH;EAEF,MAAM,aAAa,OAAO,6BACxB,EAAE,MACF,aACF;EAEA,MAAM,8BAAc,IAAI,IAA2C;EACnE,MAAM,2BAAW,IAAI,IAAqD;EAC1E,MAAM,6BAAa,IAAI,IAAiD;EAExE,KAAK,MAAM,WAAW,UACpB,IAAI,QAAQ,YAAY;GACtB,MAAM,UAAU,OAAO,OAAO,IAAI;IAChC,WAAW,EAAE,WAAW,OAAO;IAC/B,aACE,mBAAmB,0CAA0C,QAAQ,UAAU;GACnF,CAAC;GAED,MAAM,WAAW,OAAO,4BACtB,SACA,aACF;GAEA,YAAY,IAAI,QAAQ,UAAU,SAAS,kBAAkB;GAC7D,SAAS,IAAI,QAAQ,UAAU,SAAS,4BAA4B;GACpE,WAAW,IACT,QAAQ,WACP,OAAO,mCACN,SACA,aACF,EAAA,CAAG,wBACL;EACF,OACE,YAAY,IACV,QAAQ,WACP,OAAO,6BACN,EAAE,KAAK,OAAO,GACd,aACF,EAAA,CAAG,kBACL;EAIJ,MAAM,WAAc,UAAkC,aAAqB;GACzE,MAAM,QAAQ,SAAS,IAAI,QAAQ;GAEnC,OAAO,UAAU,KAAA,IAAY,OAAO,KAAK,YAAY,CAAC,IAAI,OAAO,QAAQ,KAAK;EAChF;EAEA,IAAI,UAAkC,QAAQ,KAC5C,oBACA,WAAW,kBACb,CAAC,CAAC,KACA,QAAQ,IAAI,oBAAoB;GAC9B,QAAQ,OAAO,YACb,OAAO,QAAQ,QAAQ,aAAa,MAAM,SAAS,QAAQ,IAAI,MAC7D,EAAE,MAAM,OAAO,OAAO,CACxB;GACF,UAAU,UACR,OAAO,QAAQ,QAAQ,aAAa,MAAM,QAAQ,IAAI,MAAM,EAAE,QAAQ,KAAK,CAAC;GAC9E,QAAQ,OAAO,YACb,OAAO,QAAQ,QAAQ,aAAa,MAAM,SAAS,QAAQ,IAAI,MAC7D,EAAE,MAAM,OAAO,OAAO,CACxB;GACF,SAAS,OAAO,YACd,OAAO,QAAQ,QAAQ,aAAa,MAAM,MAAM,SAAS,QAAQ,IAAI,MACnE,EAAE,OAAO,OAAO,OAAO,CACzB;GACF,UAAU,OAAO,YACf,OAAO,QAAQ,QAAQ,aAAa,MAAM,QAAQ,IAAI,MAAM,EAAE,QAAQ,OAAO,OAAO,CAAC;EACzF,CAAC,CACH;EAEA,IAAI,SAAS,OAAO,GAClB,UAAU,QAAQ,KAChB,QAAQ,IAAI,0BAA0B,EACpC,UAAU,UACR,OAAO,QAAQ,QAAQ,YAAY,MAAM,QAAQ,IAAI,MAAM,EAAE,QAAQ,KAAK,CAAC,EAC/E,CAAC,GACD,QAAQ,IAAI,8BAA8B;GACxC,kBAAkB,OAAO,YACvB,OAAO,QAAQ,QAAQ,UAAU,MAAM,SAAS,QAAQ,IAAI,MAC1D,EAAE,gBAAgB,OAAO,OAAO,CAClC;GACF,qBAAqB,OAAO,YAC1B,OAAO,QAAQ,QAAQ,UAAU,MAAM,MAAM,SAAS,QAAQ,IAAI,MAChE,EAAE,mBAAmB,OAAO,OAAO,CACrC;GACF,OAAO,UACL,OAAO,QAAQ,QAAQ,UAAU,MAAM,QAAQ,IAAI,MAAM,EAAE,KAAK,KAAK,CAAC;GACxE,gBAAgB,UACd,OAAO,QAAQ,QAAQ,UAAU,MAAM,QAAQ,IAAI,MAAM,EAAE,cAAc,KAAK,CAAC;GACjF,SAAS,OAAO,YACd,OAAO,QAAQ,QAAQ,UAAU,MAAM,QAAQ,IAAI,MAAM,EAAE,OAAO,OAAO,OAAO,CAAC;GACnF,SAAS,OAAO,YACd,OAAO,QAAQ,QAAQ,UAAU,MAAM,QAAQ,IAAI,MAAM,EAAE,OAAO,OAAO,OAAO,CAAC;EACrF,CAAC,CACH;EAEF,OAAO;CACT,GACA,OAAO,UAAU,UACf,OAAO,GAAG,6BAA6B,CAAC,CAAC,KAAK,IAC1C,QACA,mBAAmB,yCAAyC,CAClE,CAGQ;AACZ"}
|
package/package.json
CHANGED
|
@@ -1 +1 @@
|
|
|
1
|
-
{"name":"@yielded/auth-persistence","version":"0.1.0-beta.
|
|
1
|
+
{"name":"@yielded/auth-persistence","version":"0.1.0-beta.22","dependencies":{"@yielded/auth":"0.1.0-beta.22"},"devDependencies":{"@effect/platform-node":"4.0.0","@effect/sql-libsql":"4.0.0","@effect/sql-sqlite-node":"4.0.0","@effect/vitest":"4.0.0","@yielded/crypto":"0.1.0-beta.22","@yielded/jose":"0.1.0-beta.22","effect":"4.0.0","typescript":"7.0.2","vite-plus":"0.3.3"},"peerDependencies":{"effect":"^4.0.0"},"exports":{".":{"types":"./dist/index.d.mts","default":"./dist/index.mjs"},"./Adapter":{"types":"./dist/Adapter.d.mts","default":"./dist/Adapter.mjs"}},"description":"Direct Effect SQL persistence and shared storage contracts for Yielded Auth.","homepage":"https://yielded.dev/auth/","bugs":{"url":"https://github.com/yielded-dev/auth/issues"},"license":"MIT","repository":{"type":"git","url":"git+https://github.com/yielded-dev/auth.git","directory":"packages/auth-persistence"},"files":["dist","src"],"type":"module","sideEffects":[],"publishConfig":{"access":"public"},"scripts":{"build":"vp pack","check":"tsc --noEmit -p tsconfig.json","test":"vp test --passWithNoTests"}}
|
|
@@ -1,4 +1,4 @@
|
|
|
1
|
-
import { Persistence, Record, Unavailable } from "@yielded/auth/OAuthServer";
|
|
1
|
+
import { AssertionReceipt, Persistence, Record, Unavailable } from "@yielded/auth/OAuthServer";
|
|
2
2
|
import { Effect, Layer, Schema } from "effect";
|
|
3
3
|
import { SqlClient } from "effect/sql";
|
|
4
4
|
|
|
@@ -16,7 +16,8 @@ const Row = Schema.Struct({
|
|
|
16
16
|
* Expired records may be deleted when expires_at_millis <= the current time.
|
|
17
17
|
* Revocation has its own monotonic column so it cannot lose a race with rotation.
|
|
18
18
|
*/
|
|
19
|
-
const
|
|
19
|
+
const migrations = [
|
|
20
|
+
`CREATE TABLE yielded_oauth_server (
|
|
20
21
|
namespace TEXT NOT NULL,
|
|
21
22
|
grant_id TEXT NOT NULL,
|
|
22
23
|
version TEXT NOT NULL,
|
|
@@ -24,7 +25,14 @@ const migration = `CREATE TABLE yielded_oauth_server (
|
|
|
24
25
|
expires_at_millis BIGINT NOT NULL,
|
|
25
26
|
payload TEXT NOT NULL,
|
|
26
27
|
PRIMARY KEY (namespace, grant_id)
|
|
27
|
-
)
|
|
28
|
+
)`,
|
|
29
|
+
`CREATE TABLE yielded_oauth_client_assertion (
|
|
30
|
+
namespace TEXT NOT NULL,
|
|
31
|
+
assertion_id TEXT NOT NULL,
|
|
32
|
+
expires_at_millis BIGINT NOT NULL,
|
|
33
|
+
PRIMARY KEY (namespace, assertion_id)
|
|
34
|
+
)`,
|
|
35
|
+
];
|
|
28
36
|
|
|
29
37
|
const layer = Layer.effect(
|
|
30
38
|
Persistence,
|
|
@@ -39,6 +47,18 @@ const layer = Layer.effect(
|
|
|
39
47
|
effect.pipe(Effect.mapError(() => Unavailable.make({})));
|
|
40
48
|
|
|
41
49
|
return Persistence.of({
|
|
50
|
+
consumeAssertion: Effect.fn("OAuthServerPersistence.consumeAssertion")(function* (
|
|
51
|
+
namespace,
|
|
52
|
+
input,
|
|
53
|
+
) {
|
|
54
|
+
yield* standalone;
|
|
55
|
+
const receipt = yield* Schema.decodeEffect(AssertionReceipt)(input);
|
|
56
|
+
|
|
57
|
+
const rows =
|
|
58
|
+
yield* sql`INSERT INTO yielded_oauth_client_assertion (namespace, assertion_id, expires_at_millis) VALUES (${namespace}, ${receipt.id}, ${receipt.expiresAtMillis}) ON CONFLICT (namespace, assertion_id) DO NOTHING RETURNING assertion_id`;
|
|
59
|
+
|
|
60
|
+
return rows.length === 1;
|
|
61
|
+
}, failure),
|
|
42
62
|
get: Effect.fn("OAuthServerPersistence.get")(function* (namespace, id) {
|
|
43
63
|
yield* standalone;
|
|
44
64
|
|
|
@@ -86,4 +106,4 @@ const layer = Layer.effect(
|
|
|
86
106
|
}),
|
|
87
107
|
);
|
|
88
108
|
|
|
89
|
-
export const OAuthServerPersistence = {
|
|
109
|
+
export const OAuthServerPersistence = { migrations, layer };
|
package/src/internal/passkeys.ts
CHANGED
|
@@ -313,7 +313,7 @@ export const makeComposedPasskeys = (
|
|
|
313
313
|
action: metadata,
|
|
314
314
|
remainingSignIn: (subjectId, excluded, row) =>
|
|
315
315
|
Effect.gen(function* () {
|
|
316
|
-
const requirement = yield* Schema.
|
|
316
|
+
const requirement = yield* Schema.decodeEffect(PasskeyRequirement)(
|
|
317
317
|
yield* s.requirements(row),
|
|
318
318
|
);
|
|
319
319
|
|