@yielded/auth-persistence 0.1.0-beta.22 → 0.1.0-beta.24

package/src/internal/models/password-model.ts

@@ -1,7 +1,6 @@
 import { type RecoveryReference, type LoginIdentifier } from "@yielded/auth/Identity";
 import type {
   PasswordAction,
-  PasswordAttemptId,
   PasswordCredentialSnapshot,
   PasswordReplacement,
   PasswordRegistrationDecision,
@@ -15,18 +14,6 @@ import type { PersistenceMappingError, SubjectIdCodec } from "./common";
 
 type ColumnKey<T extends Table> = T["column"];
 
-export type PasswordAttemptAction = "sign-in" | "change";
-
-export type PasswordAttemptState = "pending" | "verified" | "rejected";
-
-export type PasswordRateScopeKind = "action" | "identifier" | "subject";
-
-export interface PasswordScopeKeys {
-  readonly action: string;
-  readonly identifier: string;
-  readonly subject?: string;
-}
-
 export interface PasswordSubjectTable<Subject extends Table, _NativeSubjectId> {
   readonly table: Subject["table"];
   readonly id: ColumnKey<Subject>;
@@ -129,82 +116,6 @@ export interface PasswordCredentialTable<
   }) => Effect.Effect<PasswordCredentialSnapshot, PersistenceMappingError>;
 }
 
-export interface PasswordAttemptRecord {
-  readonly moduleId: string;
-  readonly action: PasswordAttemptAction;
-  readonly attemptId: PasswordAttemptId;
-  readonly identifier: LoginIdentifier;
-  readonly subjectId?: string;
-  readonly credentialId?: string;
-  readonly securityRevision?: SecurityRevision;
-  readonly credentialRevision?: SecurityRevision;
-  readonly verifierVersion?: SecurityRevision;
-  readonly identifierBindingRevision?: SecurityRevision;
-  readonly admittedAtMillis: number;
-  readonly deadlineMillis: number;
-  readonly retentionUntilMillis: number;
-}
-
-export interface PasswordAttemptTable<Attempt extends Table, NativeSubjectId> {
-  readonly table: Attempt["table"];
-  readonly moduleId: ColumnKey<Attempt>;
-  readonly action: ColumnKey<Attempt>;
-  readonly attemptId: ColumnKey<Attempt>;
-  readonly identifierNamespace: ColumnKey<Attempt>;
-  readonly identifierValue: ColumnKey<Attempt>;
-  readonly subjectId: ColumnKey<Attempt>;
-  readonly credentialId: ColumnKey<Attempt>;
-  readonly securityRevision: ColumnKey<Attempt>;
-  readonly credentialRevision: ColumnKey<Attempt>;
-  readonly verifierVersion: ColumnKey<Attempt>;
-  readonly identifierBindingRevision: ColumnKey<Attempt>;
-  readonly admittedAt: ColumnKey<Attempt>;
-  readonly deadline: ColumnKey<Attempt>;
-  readonly retentionUntil: ColumnKey<Attempt>;
-  readonly state: ColumnKey<Attempt>;
-  readonly encodeInsert: (
-    record: PasswordAttemptRecord,
-    input: {
-      readonly nativeSubjectId?: NativeSubjectId;
-      readonly state: "pending";
-    },
-  ) => Attempt["insert"];
-}
-
-export interface PasswordRateScopeTable<RateScope extends Table> {
-  readonly table: RateScope["table"];
-  readonly moduleId: ColumnKey<RateScope>;
-  readonly action: ColumnKey<RateScope>;
-  readonly scopeKind: ColumnKey<RateScope>;
-  readonly scopeKey: ColumnKey<RateScope>;
-  readonly encodeInsert: (input: {
-    readonly moduleId: string;
-    readonly action: PasswordAttemptAction;
-    readonly scopeKind: PasswordRateScopeKind;
-    readonly scopeKey: string;
-  }) => RateScope["insert"];
-}
-
-export interface PasswordChargeTable<Charge extends Table> {
-  readonly table: Charge["table"];
-  readonly moduleId: ColumnKey<Charge>;
-  readonly action: ColumnKey<Charge>;
-  readonly scopeKind: ColumnKey<Charge>;
-  readonly scopeKey: ColumnKey<Charge>;
-  readonly attemptId: ColumnKey<Charge>;
-  readonly occurredAt: ColumnKey<Charge>;
-  readonly retentionUntil: ColumnKey<Charge>;
-  readonly encodeInsert: (input: {
-    readonly moduleId: string;
-    readonly action: PasswordAttemptAction;
-    readonly scopeKind: PasswordRateScopeKind;
-    readonly scopeKey: string;
-    readonly attemptId: PasswordAttemptId;
-    readonly occurredAtMillis: number;
-    readonly retentionUntilMillis: number;
-  }) => Charge["insert"];
-}
-
 export interface PasswordCommandTable<Command extends Table> {
   readonly table: Command["table"];
   readonly moduleId: ColumnKey<Command>;
@@ -228,9 +139,6 @@ export interface RequiredPasswordConstraints {
   readonly authorityCredential: "unique(authorityCredential.subjectId,authorityCredential.credentialId)";
   readonly credentialSubject: "unique(credential.moduleId,credential.subjectId)";
   readonly credentialId: "unique(credential.moduleId,credential.credentialId)";
-  readonly attempt: "unique(attempt.moduleId,attempt.attemptId)";
-  readonly rateScope: "unique(rateScope.moduleId,rateScope.action,rateScope.scopeKind,rateScope.scopeKey)";
-  readonly charge: "unique(charge.moduleId,charge.action,charge.scopeKind,charge.scopeKey,charge.attemptId)";
   readonly command: "unique(command.moduleId,command.commandId)";
 }
 
@@ -239,17 +147,12 @@ export const requiredPasswordConstraints: RequiredPasswordConstraints = {
   authorityCredential: "unique(authorityCredential.subjectId,authorityCredential.credentialId)",
   credentialSubject: "unique(credential.moduleId,credential.subjectId)",
   credentialId: "unique(credential.moduleId,credential.credentialId)",
-  attempt: "unique(attempt.moduleId,attempt.attemptId)",
-  rateScope: "unique(rateScope.moduleId,rateScope.action,rateScope.scopeKind,rateScope.scopeKey)",
-  charge: "unique(charge.moduleId,charge.action,charge.scopeKind,charge.scopeKey,charge.attemptId)",
   command: "unique(command.moduleId,command.commandId)",
 };
 
 export interface PasswordConstraintClassifier {
   /** Match only the mapped command uniqueness constraint. */
   readonly isCommandConflict: (cause: unknown) => boolean;
-  /** Match only the mapped rate-scope uniqueness constraint. */
-  readonly isRateScopeConflict: (cause: unknown) => boolean;
 }
 
 export interface PasswordD1Clock<Expression extends SqlExpression = SqlExpression> {
@@ -264,9 +167,6 @@ export interface PasswordPersistenceMapping<
   Identifier extends Table,
   Credential extends Table,
   AuthorityCredential extends Table,
-  Attempt extends Table,
-  RateScope extends Table,
-  Charge extends Table,
   Command extends Table,
   NativeSubjectId,
   Expression extends SqlExpression = SqlExpression,
@@ -279,22 +179,11 @@ export interface PasswordPersistenceMapping<
     AuthorityCredential,
     NativeSubjectId
   >;
-  readonly attempt: PasswordAttemptTable<Attempt, NativeSubjectId>;
-  readonly rateScope: PasswordRateScopeTable<RateScope>;
-  readonly charge: PasswordChargeTable<Charge>;
   readonly command: PasswordCommandTable<Command>;
   readonly subjectId: SubjectIdCodec<NativeSubjectId>;
   readonly constraints: RequiredPasswordConstraints;
-  readonly scopeKeys: (input: {
-    readonly moduleId: string;
-    readonly action: PasswordAttemptAction;
-    readonly identifier: LoginIdentifier;
-    readonly subjectId?: string;
-  }) => PasswordScopeKeys;
   readonly encodeInstant: (epochMillis: number) => unknown;
   readonly decodeInstant: (native: unknown) => Effect.Effect<number, PersistenceMappingError>;
-  readonly allocateAttemptId?: Effect.Effect<PasswordAttemptId, PersistenceMappingError>;
-  readonly allocateAttemptIdSync?: () => PasswordAttemptId;
   readonly allocateCredentialId?: Effect.Effect<string, PersistenceMappingError>;
   readonly allocateCredentialIdSync?: () => string;
   readonly allocateRevision?: Effect.Effect<SecurityRevision, PersistenceMappingError>;
@@ -310,9 +199,6 @@ export type D1PasswordPersistenceMapping<
   Identifier extends Table,
   Credential extends Table,
   AuthorityCredential extends Table,
-  Attempt extends Table,
-  RateScope extends Table,
-  Charge extends Table,
   Command extends Table,
   NativeSubjectId,
   Expression extends SqlExpression = SqlExpression,
@@ -321,9 +207,6 @@ export type D1PasswordPersistenceMapping<
   Identifier,
   Credential,
   AuthorityCredential,
-  Attempt,
-  RateScope,
-  Charge,
   Command,
   NativeSubjectId,
   Expression
@@ -491,9 +374,6 @@ export type AnyPasswordPersistenceMapping<Expression extends SqlExpression = Sql
     AnyTableModel,
     AnyTableModel,
     AnyTableModel,
-    AnyTableModel,
-    AnyTableModel,
-    AnyTableModel,
     unknown,
     Expression
   >;

package/src/internal/native-sql-table.ts

@@ -0,0 +1,178 @@
+import { Effect } from "effect";
+import type { SqlClient } from "effect/sql/SqlClient";
+import * as Statement from "effect/sql/Statement";
+
+import { PersistenceMappingError } from "./mapping-error";
+import { Table, identifier } from "./sql-table";
+import type { PhysicalTextColumn } from "./storage-validation";
+
+/** Capture synchronous mapping callbacks without changing SQL execution errors. */
+export const sqlMapping = <A>(thunk: () => A): Effect.Effect<A, PersistenceMappingError> =>
+  Effect.try({
+    try: thunk,
+    catch: (cause) => PersistenceMappingError.make({ operation: "mapping", cause }),
+  });
+
+/** Physical SQL representation only. Semantic row codecs and policy remain in
+ * the owning mapping. Execute assembled statements without name/result transforms. */
+export interface SqlTable {
+  readonly name: Statement.Fragment;
+  /** Alias reads only; writes continue to target the original physical table. */
+  readonly as: (alias: string) => SqlTable;
+  readonly column: (key: string) => Statement.Fragment;
+  /** Optional codec-free text candidate. Physical type/collation compatibility
+   * must still be checked against the database before comparing columns. */
+  readonly unencodedTextColumn?: (key: string) => PhysicalTextColumn | undefined;
+  /** Project every column under an ordinal alias, using a distinct prefix per table. */
+  readonly fields: (prefix: string) => Statement.Fragment;
+  readonly decode: (
+    row: Readonly<Record<string, unknown>>,
+    prefix: string,
+  ) => Record<string, unknown>;
+  readonly value: (key: string, value: unknown) => Statement.Fragment;
+  /** Complete INSERT prefix; append conflict/returning clauses in the owning operation. */
+  readonly insert: (values: Readonly<Record<string, unknown>>) => Statement.Fragment;
+  /** Complete UPDATE ... SET prefix; the owning operation supplies its predicate. */
+  readonly update: (values: Readonly<Record<string, unknown>>) => Statement.Fragment;
+}
+
+export type NativeSqlTables = (table: object) => SqlTable;
+
+/** Prefixes are short ASCII identifiers so ordinal aliases cannot be truncated
+ * by PostgreSQL. Callers distinguish tables by prefix, never by physical names. */
+export const nativeSqlAlias = (prefix: string, index: number): string => {
+  if (!/^[A-Za-z_][A-Za-z0-9_]{0,39}$/.test(prefix))
+    throw PersistenceMappingError.make({ operation: "mapping", cause: "Invalid SQL alias prefix" });
+
+  return `${prefix}${index}`;
+};
+
+const directTable = (client: SqlClient, physical: object): SqlTable => {
+  if (!(physical instanceof Table))
+    throw PersistenceMappingError.make({ operation: "mapping", cause: "Expected a SQL table" });
+
+  const quote = (name: string) => {
+    if (name.includes("\0"))
+      throw PersistenceMappingError.make({ operation: "mapping", cause: "NUL in SQL identifier" });
+
+    return client.literal(identifier(name));
+  };
+
+  const name =
+    physical.schema === undefined
+      ? quote(physical.name)
+      : client`${quote(physical.schema)}.${quote(physical.name)}`;
+
+  const columns = Object.entries(physical.columns);
+
+  const getColumn = (key: string) => {
+    const column = Object.hasOwn(physical.columns, key) ? physical.columns[key] : undefined;
+
+    if (column === undefined)
+      throw PersistenceMappingError.make({ operation: "column", cause: "Missing SQL column" });
+
+    return column;
+  };
+
+  const value = (key: string, input: unknown): Statement.Fragment => {
+    const mapped = getColumn(key);
+
+    if (Statement.isFragment(input)) return input;
+    const encoded = input === null ? null : mapped.mapToDriverValue(input);
+
+    return Statement.fragment([
+      Statement.parameter(
+        typeof encoded === "boolean"
+          ? client.onDialectOrElse({ sqlite: () => Number(encoded), orElse: () => encoded })
+          : encoded,
+      ),
+    ]);
+  };
+
+  const entries = (values: Readonly<Record<string, unknown>>) =>
+    Object.entries(values).filter(
+      ([key, input]) => Object.hasOwn(physical.columns, key) && input !== undefined,
+    );
+
+  const bind = (alias?: string): SqlTable => {
+    const reference = alias === undefined ? name : quote(alias);
+    const column = (key: string) => client`${reference}.${quote(getColumn(key).options.name)}`;
+
+    return {
+      name: alias === undefined ? name : client`${name} AS ${reference}`,
+      as: bind,
+      column,
+      unencodedTextColumn: (key) =>
+        getColumn(key).options.type === "text"
+          ? {
+              table: {
+                name: physical.name,
+                ...(physical.schema === undefined ? {} : { schema: physical.schema }),
+              },
+              name: getColumn(key).options.name,
+            }
+          : undefined,
+      value,
+      fields: (prefix) =>
+        client.join(
+          ", ",
+          false,
+        )(
+          columns.map(
+            ([key], index) => client`${column(key)} AS ${quote(nativeSqlAlias(prefix, index))}`,
+          ),
+        ),
+      decode: (row, prefix) =>
+        Object.fromEntries(
+          columns.map(([key, field], index) => {
+            const alias = nativeSqlAlias(prefix, index);
+
+            if (!Object.hasOwn(row, alias))
+              throw PersistenceMappingError.make({
+                operation: "decode",
+                cause: "Missing SQL projection field",
+              });
+
+            return [key, field.decode(row[alias])];
+          }),
+        ),
+      insert: (values) => {
+        const fields = entries(values);
+
+        if (fields.length === 0) return client`INSERT INTO ${name} DEFAULT VALUES`;
+
+        return client`INSERT INTO ${name} (${client.join(", ", false)(fields.map(([key]) => quote(getColumn(key).options.name)))}) VALUES (${client.join(", ", false)(fields.map(([key, input]) => value(key, input)))})`;
+      },
+      update: (values) => {
+        const fields = entries(values);
+
+        if (fields.length === 0)
+          throw PersistenceMappingError.make({ operation: "mapping", cause: "Empty SQL update" });
+
+        return client`UPDATE ${name} SET ${client.join(", ", false)(fields.map(([key, input]) => client`${quote(getColumn(key).options.name)} = ${value(key, input)}`))}`;
+      },
+    };
+  };
+
+  return bind();
+};
+
+/** Cache physical metadata only; insert/update materialize values and hooks at
+ * each call. Construction acquires no client and owns no transaction. */
+export const makeNativeSqlTables = (
+  client: SqlClient,
+  convert: (client: SqlClient, table: object) => SqlTable = directTable,
+): NativeSqlTables => {
+  const tables = new WeakMap<object, SqlTable>();
+
+  return (table) => {
+    const existing = tables.get(table);
+
+    if (existing !== undefined) return existing;
+    const mapped = convert(client, table);
+
+    tables.set(table, mapped);
+
+    return mapped;
+  };
+};