@yielded/auth-persistence 0.1.0-beta.22 → 0.1.0-beta.24

package/src/internal/storage-plans.ts

@@ -0,0 +1,218 @@
+import { Predicate, Schema } from "effect";
+
+// These are mapping contracts, not a parser for arbitrary constraint declarations.
+// Role aliases are explicit because their documentation names differ from mapping fields.
+const uniquePlans: Readonly<Record<string, readonly [string, ReadonlyArray<string>]>> = {
+  "unique(abuseEvent.moduleId,abuseEvent.action,abuseEvent.scopeKind,abuseEvent.scopeKey,abuseEvent.commandId)":
+    ["abuseEvent", ["moduleId", "action", "scopeKind", "scopeKey", "commandId"]],
+  "unique(admission.moduleId)": ["admission", ["moduleId"]],
+  "unique(attempt.moduleId,attempt.attemptId)": ["attempt", ["moduleId", "attemptId"]],
+  "unique(authority.subjectId,authority.credentialId)": [
+    "authority",
+    ["subjectId", "credentialId"],
+  ],
+  "unique(authorityCredential.subjectId,authorityCredential.credentialId)": [
+    "authorityCredential",
+    ["subjectId", "credentialId"],
+  ],
+  "unique(command.moduleId,command.commandId)": ["command", ["moduleId", "commandId"]],
+  "unique(connectedAdmission.admissionId)": ["admission", ["admissionId"]],
+  "unique(connectedClient.clientKey)": ["client", ["clientKey"]],
+  "unique(connectedCohort.cohortKey)": ["cohort", ["cohortKey"]],
+  "unique(connectedCommand.moduleId,connectedCommand.commandId)": [
+    "command",
+    ["moduleId", "commandId"],
+  ],
+  "unique(connectedFlow.moduleId,connectedFlow.commandId)": ["flow", ["moduleId", "commandId"]],
+  "unique(connectedFlow.moduleId,connectedFlow.flowId)": ["flow", ["moduleId", "flowId"]],
+  "unique(connectedFlow.stateDigest)": ["flow", ["stateDigest"]],
+  "unique(connectedGrant.moduleId,connectedGrant.grantId)": ["grant", ["moduleId", "grantId"]],
+  "unique(connectedGrant.moduleId,connectedGrant.subjectId,connectedGrant.profileKey,connectedGrant.activeIdentityKey)":
+    ["grant", ["moduleId", "subjectId", "profileKey", "activeIdentityKey"]],
+  "unique(connectedRevocation.jobId)": ["job", ["jobId"]],
+  "unique(continuation.moduleId,continuation.continuationId)": [
+    "continuation",
+    ["moduleId", "continuationId"],
+  ],
+  "unique(continuation.moduleId,continuation.digest)": ["continuation", ["moduleId", "digest"]],
+  "unique(credential.credentialId)": ["credential", ["credentialId"]],
+  "unique(credential.identityKey)": ["credential", ["identityKey"]],
+  "unique(credential.moduleId,credential.credentialId)": [
+    "credential",
+    ["moduleId", "credentialId"],
+  ],
+  "unique(credential.moduleId,credential.subjectId)": ["credential", ["moduleId", "subjectId"]],
+  "unique(emailCommand.moduleId,emailCommand.commandId)": ["command", ["moduleId", "commandId"]],
+  "unique(emailCredential.moduleId,emailCredential.credentialId)": [
+    "credential",
+    ["moduleId", "credentialId"],
+  ],
+  "unique(emailCredential.moduleId,emailCredential.identifierNamespace,emailCredential.identifierValue)":
+    ["credential", ["moduleId", "identifierNamespace", "identifierValue"]],
+  "unique(emailRegistration.moduleId,emailRegistration.commandId)": [
+    "registration",
+    ["moduleId", "commandId"],
+  ],
+  "unique(emailRegistration.pendingReference)": ["registration", ["pendingReference"]],
+  "unique(failureEvent.moduleId,failureEvent.seriesKey,failureEvent.commandId)": [
+    "failureEvent",
+    ["moduleId", "seriesKey", "commandId"],
+  ],
+  "unique(flow.flowId)": ["flow", ["flowId"]],
+  "unique(flow.moduleId,flow.commandId)": ["flow", ["moduleId", "commandId"]],
+  "unique(flow.moduleId,flow.flowId)": ["flow", ["moduleId", "flowId"]],
+  "unique(flow.stateDigest)": ["flow", ["stateDigest"]],
+  "unique(generation.moduleId,generation.deliveryId)": ["generation", ["moduleId", "deliveryId"]],
+  "unique(generation.moduleId,generation.proofId)": ["generation", ["moduleId", "proofId"]],
+  "unique(identifier.namespace,identifier.value)": ["identifier", ["namespace", "value"]],
+  "unique(intent.digest)": ["intent", ["digest"]],
+  "unique(intent.flowId)": ["intent", ["flowId"]],
+  "unique(intent.moduleId,intent.commandId)": ["intent", ["moduleId", "commandId"]],
+  "unique(intent.moduleId,intent.flowId)": ["intent", ["moduleId", "flowId"]],
+  "unique(intent.moduleId,intent.intentId)": ["intent", ["moduleId", "intentId"]],
+  "unique(intent.moduleId,intent.reference)": ["intent", ["moduleId", "reference"]],
+  "unique(ownership.identityKey)": ["ownership", ["identityKey"]],
+  "unique(pending.digest)": ["pending", ["digest"]],
+  "unique(pending.flowId)": ["pending", ["flowId"]],
+  "unique(rateScope.moduleId,rateScope.purpose,rateScope.action,rateScope.scopeKind,rateScope.scopeKey)":
+    ["rateScope", ["moduleId", "purpose", "action", "scopeKind", "scopeKey"]],
+  "unique(registration.moduleId,registration.requestId)": [
+    "registration",
+    ["moduleId", "requestId"],
+  ],
+  "unique(registration.recoveryReference)": ["registration", ["recoveryReference"]],
+  "unique(registrationCommand.moduleId,registrationCommand.commandId)": [
+    "command",
+    ["moduleId", "commandId"],
+  ],
+  "unique(request.moduleId,request.requestId)": ["request", ["moduleId", "requestId"]],
+  "unique(series.moduleId,series.purpose,series.scopeKey)": [
+    "series",
+    ["moduleId", "purpose", "scopeKey"],
+  ],
+  "unique(session.digest)": ["session", ["digest"]],
+  "unique(tombstone.subjectId,tombstone.sessionId)": ["tombstone", ["subjectId", "sessionId"]],
+  "unique(tuple.identityKey)": ["ownership.tuple", ["identityKey"]],
+  "unique(unlinkCommand.moduleId,unlinkCommand.commandId)": ["command", ["moduleId", "commandId"]],
+};
+
+const arrayRoles: Readonly<Record<string, string>> = {
+  credentialId: "credential",
+  factor: "authority",
+  credentialOwnership: "credentialOwnership",
+  handleOwnership: "handleOwnership",
+  boundSubjectHandle: "handleOwnership",
+  flow: "flow",
+  command: "flow",
+  admission: "admission",
+  charge: "charge",
+  intentFlow: "intent",
+  intentCommand: "intent",
+  handle: "handle",
+};
+
+const nestedMappings = [
+  "read",
+  "signIn",
+  "password",
+  "proof",
+  "proofs",
+  "revocation",
+  "pending",
+  "session",
+  "source",
+];
+
+const constraintGroups = [
+  "constraints",
+  "tupleConstraints",
+  "registrationConstraints",
+  "managementConstraints",
+];
+
+const MappingRecord = Schema.Record(Schema.String, Schema.Unknown);
+const record = Schema.decodeUnknownSync(MappingRecord);
+
+export const storageKeyPlans = (
+  input: unknown,
+  columnsFor: (table: object) => Readonly<Record<string, unknown>>,
+) => {
+  const mapping = record(input);
+  const result: Array<{ readonly table: object; readonly keys: ReadonlyArray<string> }> = [];
+
+  for (const group of constraintGroups) {
+    if (mapping[group] === undefined) continue;
+    for (const [name, declaration] of Object.entries(record(mapping[group]))) {
+      if (declaration === "notNull(provisioningRequest.subjectId)") continue;
+      let role: string;
+      let keys: ReadonlyArray<string>;
+
+      if (typeof declaration === "string") {
+        const plan = uniquePlans[declaration];
+
+        if (plan !== undefined) [role, keys] = plan;
+        else if (declaration === "unique(id)") {
+          role = "subject";
+          keys = ["id"];
+        } else if (declaration === "unique(scope)") {
+          role = name;
+          keys = ["scope"];
+        } else if (declaration === "unique(credentialId)") {
+          role = "credential";
+          keys = ["id"];
+        } else if (declaration === "unique(namespace,value)") {
+          role = "identifier";
+          keys = ["namespace", "value"];
+        } else if (declaration === "unique(provider,issuer,subject)") {
+          role = "externalIdentity";
+          keys = ["provider", "issuer", "subject"];
+        } else if (declaration === "unique(requestId)") {
+          role = "provisioningRequest";
+          keys = ["requestId"];
+        } else throw new Error("Unknown storage constraint");
+      } else if (Array.isArray(declaration) && declaration.every(Predicate.isString)) {
+        const mappedRole =
+          group === "managementConstraints" && name === "command" ? "command" : arrayRoles[name];
+
+        if (mappedRole === undefined) throw new Error("Unknown storage constraint");
+        role = mappedRole;
+        keys = declaration;
+      } else throw new Error("Invalid storage constraint");
+
+      let target: unknown = mapping;
+
+      for (const segment of role.split(".")) target = record(target)[segment];
+      // Session authority places its pending tables in one nested mapping.
+      if (target === undefined && Schema.is(MappingRecord)(mapping.pending))
+        target = mapping.pending[role];
+      let mapped = record(target);
+
+      if (role === "pending" && mapped.table === undefined) mapped = record(mapped.pending);
+      // OAuth ownership can be integrated into its tuple authority or separate.
+      if (role === "ownership" && mapped.table === undefined)
+        mapped = record(mapped.external ?? mapped.tuple);
+      if (!Predicate.isObject(mapped.table)) throw new Error("Missing storage table");
+      const columns = columnsFor(mapped.table);
+
+      result.push({
+        table: mapped.table,
+        keys: keys.map((key) => {
+          const value = mapped[key];
+
+          if (typeof value !== "string" || columns[value] === undefined)
+            throw new Error("Missing mapped key");
+
+          return value;
+        }),
+      });
+    }
+  }
+  for (const nested of nestedMappings) {
+    const value = mapping[nested];
+
+    if (Schema.is(MappingRecord)(value) && value.table === undefined)
+      result.push(...storageKeyPlans(value, columnsFor));
+  }
+
+  return result;
+};

package/src/internal/storage-tables.ts

@@ -58,41 +58,6 @@ export const storageTables = {
       ["moduleId", "credentialId"],
     ],
   ),
-  passwordAttempts: spec(
-    {
-      moduleId: text,
-      action: text,
-      attemptId: text,
-      identifierNamespace: text,
-      identifierValue: text,
-      subjectId: optionalText,
-      credentialId: optionalText,
-      securityRevision: optionalText,
-      credentialRevision: optionalText,
-      verifierVersion: optionalText,
-      identifierBindingRevision: optionalText,
-      admittedAt: integer,
-      deadline: integer,
-      retentionUntil: integer,
-      state: text,
-    },
-    [["moduleId", "attemptId"]],
-  ),
-  passwordScopes: spec({ moduleId: text, action: text, scopeKind: text, scopeKey: text }, [
-    ["moduleId", "action", "scopeKind", "scopeKey"],
-  ]),
-  passwordCharges: spec(
-    {
-      moduleId: text,
-      action: text,
-      scopeKind: text,
-      scopeKey: text,
-      attemptId: text,
-      occurredAt: integer,
-      retentionUntil: integer,
-    },
-    [["moduleId", "action", "scopeKind", "scopeKey", "attemptId"]],
-  ),
   passwordCommands: spec(
     {
       moduleId: text,

package/src/internal/storage-validation.ts

@@ -3,6 +3,7 @@ import { SqlClient } from "effect/sql/SqlClient";
 
 import { PersistenceConfigurationError } from "./configuration";
 import type { StorageTable } from "./storage-tables";
+import { NativeDatabase } from "./transaction-kernel";
 
 const Columns = Schema.Array(Schema.String);
 const Keys = Schema.Array(Columns);
@@ -40,6 +41,63 @@ export interface PhysicalStorageTable {
 export const qualifiedTableName = (table: Pick<StorageTable, "name" | "schema">) =>
   (table.schema === undefined ? "" : quote(table.schema) + ".") + quote(table.name);
 
+export interface PhysicalTextColumn {
+  readonly table: Pick<PhysicalStorageTable, "name" | "schema">;
+  readonly name: string;
+}
+
+const TextColumns = Schema.Array(Schema.Struct({ type: Schema.String, collation: Schema.String }));
+
+/** One acquisition-only read: presence/unique-key validation does not establish
+ * equality compatibility. SQLite's pragma omits column collations, so only
+ * ordinary TEXT tables with no COLLATE declaration qualify (default BINARY). */
+export const canJoinTextColumns = Effect.fnUntraced(function* (
+  left: PhysicalTextColumn | undefined,
+  right: PhysicalTextColumn | undefined,
+) {
+  if (left === undefined || right === undefined) return false;
+  const { $client } = yield* NativeDatabase;
+  const client = $client.withoutTransforms();
+  const columns = [left, right];
+
+  if (
+    client.onDialectOrElse({ sqlite: () => true, orElse: () => false }) &&
+    columns.some((c) => c.table.schema !== undefined && c.table.schema !== "main")
+  )
+    return false;
+
+  const query = client.onDialectOrElse({
+    pg: () => client`
+      select a.atttypid::text as type, a.attcollation::text as collation
+      from (values ${client.join(", ", false)(columns.map((c) => client`(${qualifiedTableName(c.table)}::text, ${c.name}::text)`))}) requested(relation, name)
+      join pg_attribute a on a.attrelid = to_regclass(requested.relation)
+        and a.attname = requested.name and a.attnum > 0 and not a.attisdropped
+      where a.atttypid in ('text'::regtype, 'varchar'::regtype)`,
+    sqlite: () => client`
+      with requested(relation, name) as (values ${client.join(", ", false)(columns.map((c) => client`(${c.table.name}, ${c.name})`))})
+      select 'text' as type, 'BINARY' as collation from requested
+      join sqlite_schema s on s.name = requested.relation and s.type = 'table'
+      join pragma_table_info(requested.relation) c on c.name = requested.name
+      where upper(c.type) = 'TEXT' and instr(lower(s.sql), 'collate') = 0`,
+    mysql: () => client`
+      select c.data_type as type, c.collation_name as collation
+      from (${client.join(" union all ", false)(columns.map((c) => client`select ${c.table.schema ?? null} as schema_name, ${c.table.name} as table_name, ${c.name} as column_name`))}) requested
+      join information_schema.columns c
+        on c.table_schema = coalesce(requested.schema_name, database())
+        and c.table_name = requested.table_name and c.column_name = requested.column_name
+      where c.data_type in ('varchar', 'text', 'tinytext', 'mediumtext', 'longtext')`,
+    orElse: () => Effect.succeed([]),
+  });
+
+  const rows = yield* query.pipe(Effect.flatMap(Schema.decodeUnknownEffect(TextColumns)));
+
+  return (
+    rows.length === 2 &&
+    rows[0]?.type === rows[1]?.type &&
+    rows[0]?.collation === rows[1]?.collation
+  );
+});
+
 const validateKeys = Effect.fnUntraced(function* (
   table: PhysicalStorageTable,
   required: ReadonlyArray<ReadonlyArray<string>>,

package/src/internal/transaction-kernel.ts

@@ -366,9 +366,13 @@ export const makeTransactionKernel = <
           ? toStatement(query)
           : (query as NativeQuery<Row[]>);
 
-        invariant(rows.length === 1);
+        const row = rows[0];
 
-        return rows[0]!.value === 1;
+        invariant(rows.length === 1 && row !== undefined);
+
+        // SQLite executes the raw statement, before logical field decoding.
+        // This query projects one value; its alias belongs to the adapter compiler.
+        return Object.values(row)[0] === 1;
       });
 
     const guardedQuery = (table: Table, where: SQL, values: Row, guard: GuardedUpdate) => {