@yielded/auth-persistence 0.1.0-beta.22 → 0.1.0-beta.23

package/src/internal/persistence.ts

@@ -29,6 +29,7 @@ import {
 import { randomId } from "./crypto";
 import { makeEmailKernel, CurrentEmailSql, type EmailSqlDatabase } from "./email-kernel";
 import { PersistenceMappingError } from "./mapping-error";
+import type { NativeSqlTables } from "./native-sql-table";
 import {
   makePasswordKernel,
   CurrentPasswordSql,
@@ -69,6 +70,7 @@ export interface Backend<T extends object, R> {
   readonly describe: (table: T) => StorageTable;
   readonly acquire: Effect.Effect<object, PersistenceConfigurationError, R | SqlClient.SqlClient>;
   readonly operations: QueryOperations;
+  readonly nativeTables: (client: SqlClient.SqlClient, database: object) => NativeSqlTables;
   readonly passkeys: (input: {
     readonly storage: MappingInput;
     readonly namespace: string;
@@ -112,9 +114,9 @@ export const createPersistence = <T extends object, R>(
   backend: Backend<T, R>,
 ): PersistenceApi<T, R> => {
   const proofKernel = makeProofKernel(backend.operations);
-  const passwordKernel = makePasswordKernel(backend.operations, proofKernel);
+  const passwordKernel = makePasswordKernel(backend.operations, proofKernel, backend.nativeTables);
   const emailKernel = makeEmailKernel(backend.operations, proofKernel);
-  const sessionKernel = makeSessionKernel(backend.operations);
+  const sessionKernel = makeSessionKernel(backend.operations, backend.nativeTables);
   const transactionKernel = makeTransactionKernel(backend.operations);
   const executionKernel = makeTransactionExecutionKernel(transactionKernel);
   const phoneKernel = makePhoneKernel(backend.operations, transactionKernel);
@@ -139,14 +141,7 @@ export const createPersistence = <T extends object, R>(
 
     const roles: StorageRole[] = ["identifiers", "credentials", "sessions", "sessionFlows"];
 
-    if (password)
-      roles.push(
-        "passwords",
-        "passwordAttempts",
-        "passwordScopes",
-        "passwordCharges",
-        "passwordCommands",
-      );
+    if (password) roles.push("passwords", "passwordAttempts", "passwordCommands");
     if (management) roles.push("passwordRegistrations");
     if (email) roles.push("emailCredentials", "emailCommands");
     if (phone) roles.push("phoneState");

package/src/internal/session-kernel.ts

@@ -36,8 +36,10 @@ import {
   type SessionStepUpPersistence,
 } from "@yielded/auth/Sessions";
 import { Cause, Context, DateTime, Effect, Option, Schema } from "effect";
+import type { SqlClient } from "effect/sql/SqlClient";
 import type * as SqlError from "effect/sql/SqlError";
 
+import { makeAuthoritySnapshot } from "./authority-snapshot";
 import { PersistenceMappingError, isMappedConstraintConflict } from "./mapping-error";
 import type {
   AuthenticationAuthorityMapping,
@@ -50,6 +52,7 @@ import type {
   StatefulSessionMapping,
 } from "./models/session-model";
 import type { SessionStepUpMapping } from "./models/step-up-model";
+import { makeNativeSqlTables, sqlMapping, type NativeSqlTables } from "./native-sql-table";
 /* oxlint-disable no-explicit-any -- existing storage kernels erase foreign table shapes; domain errors remain typed. */
 import type { QueryFailure } from "./query-operations";
 import type { QueryOperations } from "./query-operations";
@@ -61,7 +64,7 @@ import {
   validateStepUpPlan,
   stepUpRotationMatches,
 } from "./step-up-state";
-import type { NativeDatabase } from "./transaction-kernel";
+import { NativeDatabase } from "./transaction-kernel";
 
 type CommitMode = "interactive" | "synchronous";
 
@@ -139,7 +142,11 @@ type SqlStepUpRejectAbsence = SessionStepUpInvalid | StaleAuthentication;
 
 type SqlStepUpReadFailure = AdapterFailure | SqlStepUpRejectAbsence | SessionUnavailable;
 
-export const makeSessionKernel = (operations: QueryOperations) => {
+export const makeSessionKernel = (
+  operations: QueryOperations,
+  nativeTables: (client: SqlClient, database: object) => NativeSqlTables = (client) =>
+    makeNativeSqlTables(client),
+) => {
   const { and, eq, gt, lte, inArray, or, sql, column, updateValues } = operations;
   const unavailable = () => SessionUnavailable.make({});
 
@@ -396,15 +403,6 @@ export const makeSessionKernel = (operations: QueryOperations) => {
     };
   });
 
-  const captureIn = Effect.fn("DrizzleSession.capture")(function* (
-    mapping: AnyAuthorityMapping,
-    subjectId: SubjectId,
-    credentialIds: ReadonlyArray<string>,
-    locking: boolean,
-  ) {
-    return (yield* captureDetailsIn(mapping, subjectId, credentialIds, locking)).revision;
-  });
-
   const validateEvidenceIn = Effect.fn("DrizzleSession.validateEvidence")(function* (
     mapping: AnyAuthorityMapping,
     evidence: AuthenticationEvidence,
@@ -417,6 +415,17 @@ export const makeSessionKernel = (operations: QueryOperations) => {
       locking,
     );
 
+    return yield* validateCapturedEvidence(mapping, evidence, captured);
+  });
+
+  const validateCapturedEvidence = Effect.fnUntraced(function* (
+    mapping: AnyAuthorityMapping,
+    evidence: AuthenticationEvidence,
+    captured: {
+      readonly subject: Record<string, unknown>;
+      readonly revision: AuthenticationRevision;
+    },
+  ) {
     if (
       captured.revision.securityRevision !== evidence.revision.securityRevision ||
       captured.revision.credentials.length !== evidence.revision.credentials.length ||
@@ -643,18 +652,28 @@ export const makeSessionKernel = (operations: QueryOperations) => {
       );
     const hooks = yield* LifecycleHooks;
 
+    const root = yield* NativeDatabase;
+    const sqlClient = root.$client.withoutTransforms();
+
+    const tables = yield* sqlMapping(() => nativeTables(sqlClient, root)).pipe(
+      Effect.mapError(unavailable),
+    );
+
+    const readSnapshot = makeAuthoritySnapshot(tables, mapping);
+
     const service = {
       capture: (subjectId: SubjectId, credentialIds: ReadonlyArray<string>) =>
         safeTransaction(
-          inTransaction(database, captureIn(mapping, subjectId, credentialIds, true)),
+          readSnapshot(subjectId, credentialIds).pipe(Effect.map((value) => value.revision)),
         ),
       requirements: (evidence: AuthenticationEvidence) =>
         safeTransaction(
-          inTransaction(
-            database,
-            validateEvidenceIn(mapping, evidence, true).pipe(
-              Effect.map((result) => result.requirement),
-            ),
+          readSnapshot(
+            evidence.revision.subjectId,
+            evidence.revision.credentials.map((item) => item.credentialId),
+          ).pipe(
+            Effect.flatMap((captured) => validateCapturedEvidence(mapping, evidence, captured)),
+            Effect.map((value) => value.requirement),
           ),
         ),
       approve: <A>(
@@ -667,7 +686,20 @@ export const makeSessionKernel = (operations: QueryOperations) => {
           mapping.isConstraintConflict,
           Effect.gen(function* () {
             const journal = yield* CurrentCommitJournal;
-            const { requirement } = yield* validateEvidenceIn(mapping, input.evidence, true);
+
+            // With row locks, lock the subject before its credentials in separate
+            // reads: a joined FOR UPDATE does not fix that order on every table
+            // layout, and a coordinated application may already hold the subject
+            // lock. Without row locks one native snapshot is already serialized.
+            const { requirement } = yield* options.locking
+              ? validateEvidenceIn(mapping, input.evidence, true)
+              : Effect.flatMap(
+                  readSnapshot(
+                    input.evidence.revision.subjectId,
+                    input.evidence.revision.credentials.map((item) => item.credentialId),
+                  ),
+                  (captured) => validateCapturedEvidence(mapping, input.evidence, captured),
+                );
 
             if (input.pending === undefined) {
               const assessed = yield* assessAuthentication(input.evidence, requirement).pipe(
@@ -720,11 +752,24 @@ export const makeSessionKernel = (operations: QueryOperations) => {
       capture: (subjectId, credentialIds) =>
         service
           .capture(subjectId, credentialIds)
-          .pipe(Effect.provideService(LifecycleHooks, hooks)),
+          .pipe(
+            Effect.provideService(NativeDatabase, root),
+            Effect.provideService(LifecycleHooks, hooks),
+          ),
       requirements: (evidence) =>
-        service.requirements(evidence).pipe(Effect.provideService(LifecycleHooks, hooks)),
+        service
+          .requirements(evidence)
+          .pipe(
+            Effect.provideService(NativeDatabase, root),
+            Effect.provideService(LifecycleHooks, hooks),
+          ),
       approve: (input, prepare) =>
-        service.approve(input, prepare).pipe(Effect.provideService(LifecycleHooks, hooks)),
+        service
+          .approve(input, prepare)
+          .pipe(
+            Effect.provideService(NativeDatabase, root),
+            Effect.provideService(LifecycleHooks, hooks),
+          ),
     } satisfies AuthenticationAuthority["Service"];
   });
 
@@ -991,6 +1036,13 @@ export const makeSessionKernel = (operations: QueryOperations) => {
       );
     const hooks = yield* LifecycleHooks;
 
+    const root = yield* NativeDatabase;
+
+    const tables = yield* sqlMapping(() =>
+      nativeTables(root.$client.withoutTransforms(), root),
+    ).pipe(Effect.mapError(unavailable));
+
+    const readSnapshot = makeAuthoritySnapshot(tables, mapping);
     const c = sessionColumns(mapping);
 
     const persistence = {
@@ -1006,11 +1058,16 @@ export const makeSessionKernel = (operations: QueryOperations) => {
             const transaction = yield* CurrentSessionSql;
             const journal = yield* CurrentCommitJournal;
 
-            const { nativeSubjectId, requirement } = yield* validateEvidenceIn(
-              mapping,
-              input.evidence,
-              true,
-            );
+            // Ordered locks with row locks; one serialized snapshot without (see approve).
+            const { nativeSubjectId, requirement } = yield* options.locking
+              ? validateEvidenceIn(mapping, input.evidence, true)
+              : Effect.flatMap(
+                  readSnapshot(
+                    input.evidence.revision.subjectId,
+                    input.evidence.revision.credentials.map((item) => item.credentialId),
+                  ),
+                  (captured) => validateCapturedEvidence(mapping, input.evidence, captured),
+                );
 
             let flowInsert: unknown | undefined;
             let pendingExpiresAt: DateTime.Utc | undefined;
@@ -1403,7 +1460,12 @@ export const makeSessionKernel = (operations: QueryOperations) => {
     return {
       statefulSessionPersistence: {
         establish: (input, prepare) =>
-          persistence.establish(input, prepare).pipe(Effect.provideService(LifecycleHooks, hooks)),
+          persistence
+            .establish(input, prepare)
+            .pipe(
+              Effect.provideService(NativeDatabase, root),
+              Effect.provideService(LifecycleHooks, hooks),
+            ),
         verify: (input) =>
           persistence.verify(input).pipe(Effect.provideService(LifecycleHooks, hooks)),
         rotate: (input, prepare) =>

package/src/internal/sql-persistence.ts

@@ -2,6 +2,7 @@ import { Effect } from "effect";
 import { SqlClient } from "effect/sql";
 
 import { PersistenceConfigurationError, type PersistenceApi } from "./configuration";
+import { makeNativeSqlTables } from "./native-sql-table";
 import { makeComposedPasskeys } from "./passkeys";
 import { createPersistence } from "./persistence";
 import { makeSqlDatabase, sqlQueryOperations } from "./sql-query";
@@ -23,6 +24,7 @@ export const AuthPersistence: PersistenceApi<Table> & { readonly table: typeof t
       unique: table.unique,
     }),
     operations: sqlQueryOperations,
+    nativeTables: (client) => makeNativeSqlTables(client),
     passkeys: makeComposedPasskeys(sqlQueryOperations),
     acquire: Effect.gen(function* () {
       const sql = yield* SqlClient.SqlClient;

package/src/internal/storage-mapping.ts

@@ -373,12 +373,6 @@ export const makeMappings = Effect.fnUntraced(function* (input: MappingInput) {
       authorityCredential: authorityCredential(),
       constraints: requiredPasswordConstraints,
       isCommandConflict: () => false,
-      isRateScopeConflict: () => false,
-      scopeKeys: ({ moduleId, action, identifier, subjectId }) => ({
-        action: tuple([moduleId, action]),
-        identifier: tuple([identifier.namespace, identifier.value]),
-        ...(subjectId === undefined ? {} : { subject: subjectId }),
-      }),
       encodeInstant: instant,
       decodeInstant: readInstant,
       allocateAttemptId: allocate.pipe(Effect.map(PasswordAttemptId.make)),
@@ -485,29 +479,6 @@ export const makeMappings = Effect.fnUntraced(function* (input: MappingInput) {
           state,
         }),
       },
-      rateScope: {
-        ...mapped("passwordScopes"),
-        moduleId: "moduleId",
-        action: "action",
-        scopeKind: "scopeKind",
-        scopeKey: "scopeKey",
-        encodeInsert: (row) => ({ ...row }),
-      },
-      charge: {
-        ...mapped("passwordCharges"),
-        moduleId: "moduleId",
-        action: "action",
-        scopeKind: "scopeKind",
-        scopeKey: "scopeKey",
-        attemptId: "attemptId",
-        occurredAt: "occurredAt",
-        retentionUntil: "retentionUntil",
-        encodeInsert: (row) => ({
-          ...row,
-          occurredAt: instant(row.occurredAtMillis),
-          retentionUntil: instant(row.retentionUntilMillis),
-        }),
-      },
       command: {
         ...mapped("passwordCommands"),
         moduleId: "moduleId",

package/src/internal/storage-tables.ts

@@ -78,21 +78,6 @@ export const storageTables = {
     },
     [["moduleId", "attemptId"]],
   ),
-  passwordScopes: spec({ moduleId: text, action: text, scopeKind: text, scopeKey: text }, [
-    ["moduleId", "action", "scopeKind", "scopeKey"],
-  ]),
-  passwordCharges: spec(
-    {
-      moduleId: text,
-      action: text,
-      scopeKind: text,
-      scopeKey: text,
-      attemptId: text,
-      occurredAt: integer,
-      retentionUntil: integer,
-    },
-    [["moduleId", "action", "scopeKind", "scopeKey", "attemptId"]],
-  ),
   passwordCommands: spec(
     {
       moduleId: text,