@yielded/auth-persistence 0.1.0-beta.23 → 0.1.0-beta.24

package/src/internal/oauth/accounts.ts

@@ -0,0 +1,838 @@
+/* oxlint-disable no-explicit-any -- compiler table shapes are erased; domain codecs and error channels remain typed. */
+import {
+  OAuthAccountRevision,
+  OAuthActionAuthorization,
+  OAuthLinkAccess,
+  OAuthLinkClaim,
+  OAuthLinkPendingFlow,
+  OAuthLinkTransactionContext,
+  OAuthUnlinked,
+  OAuthCredentialSnapshot,
+  snapshotOAuthSync,
+} from "@yielded/auth/OAuth";
+import {
+  SessionInvalidationWindow,
+  AuthenticationRequirement,
+  SecurityRevision,
+} from "@yielded/auth/Sessions";
+import { DateTime, Effect, Context, Layer } from "effect";
+
+import type { SubjectIdCodec } from "../models/common";
+import type { OAuthReferenceGuardDescriptor, OAuthEligibilityFact } from "../models/oauth-model";
+import { OAuthFlow } from "./flow";
+import { CurrentOAuthTransaction } from "./owner";
+import { OAuthQueryCompiler } from "./query-compiler";
+import { OAuthRegistration } from "./registration";
+import {
+  invariant,
+  oauthIdentityKey,
+  sameRevision,
+  satisfies,
+  storage,
+  validAction,
+} from "./state";
+
+const make = Effect.gen(function* () {
+  const operations = yield* OAuthQueryCompiler;
+  const flow = yield* OAuthFlow;
+  const registration = yield* OAuthRegistration;
+
+  const { eq, sql } = operations;
+
+  const {
+    claimFlow,
+    credentialStorage,
+    currentSubject,
+    exactClaim,
+    issueFlow,
+    linkStorage,
+    matchesAccess,
+    readFlow,
+    terminalFlow,
+  } = flow;
+
+  const { both, col, copiedRow, equal } = operations;
+  const { acquireTuple, readTuple } = registration;
+
+  const contextStorage = storage(OAuthLinkTransactionContext);
+
+  const unlinkedStorage = storage(OAuthUnlinked);
+
+  const accountCurrent = (mapping: any, subjectId: OAuthAccountRevision["subjectId"]) =>
+    Effect.gen(function* () {
+      const native = yield* (mapping.subjectId as SubjectIdCodec<unknown>).toNative(subjectId);
+
+      return yield* currentSubject(mapping, native);
+    });
+
+  const authorization = (
+    mapping: any,
+    current: any,
+    auth: OAuthActionAuthorization,
+    action: OAuthActionAuthorization["challenge"]["action"],
+    flowId: string,
+    commandId: string,
+    intent: string,
+    maximumAge: number,
+  ) =>
+    Effect.flatMap(CurrentOAuthTransaction, (owner) =>
+      Effect.gen(function* () {
+        const now = yield* owner.now(mapping.clock);
+
+        const currentRequirement = snapshotOAuthSync(
+          AuthenticationRequirement,
+          mapping.subject.decodeActionRequirement(copiedRow(current.row), action),
+        );
+
+        const accepted = yield* validAction(
+          auth,
+          {
+            moduleId: auth.challenge.moduleId,
+            action,
+            flowId,
+            commandId,
+            revision: current.revision,
+            intent,
+          },
+          currentRequirement,
+          now,
+          maximumAge,
+        );
+
+        if (!accepted) return false;
+
+        const age = Math.min(
+          maximumAge,
+          auth.requirement.maximumAgeMillis,
+          currentRequirement.maximumAgeMillis,
+        );
+
+        const fresh = auth.evidence.proofs.filter(
+          (proof) => now - DateTime.toEpochMillis(proof.verifiedAt) < age,
+        );
+
+        invariant(fresh.length > 0);
+
+        const deadline = Math.min(
+          ...fresh.map((proof) => DateTime.toEpochMillis(proof.verifiedAt) + age),
+        );
+
+        owner.postconditions.push(
+          sql`${mapping.clock.engineNowMillis} >= ${now} and ${mapping.clock.engineNowMillis} < ${deadline}`,
+        );
+
+        return true;
+      }),
+    );
+
+  const currentLink = (mapping: any, flow: typeof OAuthLinkPendingFlow.Type) =>
+    Effect.gen(function* () {
+      const current = yield* accountCurrent(mapping, flow.context.revision.subjectId);
+
+      return current !== undefined && sameRevision(current.revision, flow.context.revision)
+        ? current
+        : undefined;
+    });
+
+  const issueLink = (mapping: any, input: any) =>
+    Effect.gen(function* () {
+      const flow = snapshotOAuthSync(OAuthLinkPendingFlow, input.flow),
+        c = flow.context;
+
+      const current = yield* currentLink(mapping, flow);
+      const auth = snapshotOAuthSync(OAuthActionAuthorization, input.authorization);
+
+      if (
+        current === undefined ||
+        auth.challenge.moduleId !== c.moduleId ||
+        !(yield* authorization(
+          mapping,
+          current,
+          auth,
+          "link-begin",
+          c.flowId,
+          c.commandId,
+          contextStorage.encode(c),
+          c.maximumEvidenceAgeMillis,
+        ))
+      )
+        return { _tag: "Rejected" } as const;
+
+      return yield* issueFlow(mapping, flow, "link");
+    });
+
+  const preflightLink = (mapping: any, original: typeof OAuthLinkAccess.Type) =>
+    Effect.flatMap(CurrentOAuthTransaction, (owner) =>
+      Effect.gen(function* () {
+        const input = snapshotOAuthSync(OAuthLinkAccess, original);
+        // The authenticated subject is known before discovering/locking any flow.
+        const current = yield* accountCurrent(mapping, input.subjectId);
+        const found = yield* readFlow(mapping, input, "link");
+        const now = yield* owner.now(mapping.clock);
+
+        if (
+          current === undefined ||
+          found.flow === undefined ||
+          found.row?.[mapping.flow.state] !== "Pending" ||
+          !matchesAccess(found.flow, input)
+        )
+          return undefined;
+
+        const flow = snapshotOAuthSync(OAuthLinkPendingFlow, found.flow as never),
+          c = flow.context;
+
+        if (
+          c.revision.subjectId !== input.subjectId ||
+          !sameRevision(current.revision, c.revision) ||
+          now < c.issuedAtMillis ||
+          now >= c.expiresAtMillis
+        )
+          return undefined;
+        owner.postconditions.push(
+          sql`${mapping.clock.engineNowMillis} >= ${c.issuedAtMillis} and ${mapping.clock.engineNowMillis} < ${c.expiresAtMillis}`,
+        );
+
+        return { current, flow, row: found.row };
+      }),
+    );
+
+  const claimLink = (mapping: any, input: any) =>
+    Effect.gen(function* () {
+      const found = yield* preflightLink(mapping, input.access);
+      const flow = snapshotOAuthSync(OAuthLinkPendingFlow, input.flow);
+
+      const auth = snapshotOAuthSync(OAuthActionAuthorization, input.authorization),
+        c = flow.context;
+
+      if (
+        found === undefined ||
+        linkStorage.encode(found.flow) !== linkStorage.encode(flow) ||
+        auth.challenge.moduleId !== c.moduleId ||
+        !(yield* authorization(
+          mapping,
+          found.current,
+          auth,
+          "link-complete",
+          c.flowId,
+          c.commandId,
+          contextStorage.encode(c),
+          c.maximumEvidenceAgeMillis,
+        ))
+      )
+        return { _tag: "Rejected" } as const;
+      const claim = yield* claimFlow(mapping, { row: found.row!, flow }, input.claimId);
+
+      return claim === undefined
+        ? ({ _tag: "Rejected" } as const)
+        : ({ _tag: "Claimed", claim } as const);
+    });
+
+  const checkInvalidation = (mapping: any, original: SessionInvalidationWindow) => {
+    const value = snapshotOAuthSync(SessionInvalidationWindow, original);
+
+    invariant(
+      value.trigger === "credential-change" &&
+        value.oldAuthenticationEvidence === "rejected" &&
+        (mapping.sessionInvalidation === "same-authority-immediate"
+          ? value.existingSessions === "immediate" && value.maximumExposureMillis === 0
+          : value.existingSessions === "original-absolute-expiry"),
+    );
+
+    return value;
+  };
+
+  const advance = (mapping: any, current: any, removed?: string) =>
+    Effect.flatMap(CurrentOAuthTransaction, (owner) =>
+      Effect.gen(function* () {
+        const revision = mapping.subject.nextSecurityRevision(current.revision.securityRevision);
+
+        invariant(
+          typeof revision === "string" &&
+            revision.length > 0 &&
+            revision.length <= 256 &&
+            revision !== current.revision.securityRevision,
+        );
+        const subject = mapping.subject;
+
+        yield* owner.update(
+          subject.table,
+          { [subject.id]: current.nativeId },
+          { [subject.securityRevision]: revision },
+        );
+        for (const cleanup of mapping.cleanup) {
+          const condition = both(
+            eq(col(cleanup.table, cleanup.subjectId), current.nativeId),
+            cleanup.condition({
+              subjectId: current.nativeId,
+              revision: snapshotOAuthSync(OAuthAccountRevision, current.revision),
+              ...(removed === undefined ? {} : { removedCredentialId: removed }),
+            }),
+          );
+
+          yield* owner.write(owner.database.delete(cleanup.table).where(condition));
+          owner.postconditions.push(
+            sql`not exists(select 1 from ${cleanup.table} where ${condition})`,
+          );
+        }
+
+        return SecurityRevision.make(revision);
+      }),
+    );
+
+  const settleLink = (
+    mapping: any,
+    input: any,
+    allocated: { readonly credentialId: string; readonly revision: SecurityRevision },
+  ) =>
+    Effect.flatMap(CurrentOAuthTransaction, (owner) =>
+      Effect.gen(function* () {
+        const claim = snapshotOAuthSync(OAuthLinkClaim, input.claim),
+          flow = claim.flow,
+          c = flow.context;
+
+        const current = yield* currentLink(mapping, flow);
+
+        // Known subject is always locked before tuple/flow; even a rejected outcome
+        // settles its exact original claim without adopting a newer revision.
+        const identity =
+          input.outcome._tag === "Verified" ? input.outcome.identity.identity : undefined;
+
+        if (identity !== undefined)
+          invariant(identity.provider === c.provider && identity.issuer === c.issuer);
+
+        const tuple =
+          identity !== undefined && current !== undefined
+            ? yield* readTuple(mapping.ownership, identity)
+            : undefined;
+
+        const exact = yield* exactClaim(mapping, claim, "link");
+
+        if (exact === undefined) return { _tag: "Rejected" } as const;
+        let decision: any = { _tag: input.outcome._tag };
+
+        if (input.outcome._tag === "Verified") {
+          decision = { _tag: "Rejected" };
+          const auth = snapshotOAuthSync(OAuthActionAuthorization, input.authorization);
+
+          if (
+            current !== undefined &&
+            tuple !== undefined &&
+            auth.challenge.moduleId === c.moduleId &&
+            (yield* authorization(
+              mapping,
+              current,
+              auth,
+              "link-complete",
+              c.flowId,
+              c.commandId,
+              contextStorage.encode(c),
+              c.maximumEvidenceAgeMillis,
+            ))
+          ) {
+            const t = mapping.ownership.tuple,
+              cr = mapping.credential,
+              a = mapping.authority;
+
+            const login = yield* owner.read(
+              cr.table,
+              eq(col(cr.table, cr.identityKey), tuple.key),
+              {
+                limit: 1,
+              },
+            );
+
+            const previous = login.rows[0];
+
+            if (
+              tuple.row[t.state] === "Reserved" ||
+              (tuple.row[t.state] === "Owned" &&
+                !mapping.subjectId.equals(tuple.row[t.subjectId], current.nativeId)) ||
+              (previous !== undefined &&
+                (previous[cr.moduleId] !== c.moduleId ||
+                  !mapping.subjectId.equals(previous[cr.subjectId], current.nativeId) ||
+                  !cr.isActiveStatus(previous[cr.status])))
+            )
+              decision = { _tag: "Conflict" };
+            else if (previous !== undefined) {
+              const shared = current.revision.credentials.find(
+                (item: any) => item.credentialId === previous[cr.credentialId],
+              );
+
+              if (
+                tuple.row[t.state] !== "Owned" ||
+                shared?.revision !== previous[cr.credentialRevision] ||
+                !(yield* owner.check(
+                  sql`exists(select 1 from ${cr.table} where ${both(eq(col(cr.table, cr.identityKey), tuple.key), cr.activeCondition)})`,
+                ))
+              )
+                decision = { _tag: "Conflict" };
+              else
+                decision = {
+                  _tag: "Linked",
+                  changed: false,
+                  credential: snapshotOAuthSync(OAuthCredentialSnapshot, {
+                    moduleId: c.moduleId,
+                    identity,
+                    credentialId: previous[cr.credentialId],
+                    credentialRevision: previous[cr.credentialRevision],
+                    revision: current.revision,
+                  }),
+                };
+            } else {
+              checkInvalidation(mapping, input.invalidation);
+
+              const values = {
+                ...cr.encodeInsert({
+                  moduleId: c.moduleId,
+                  subjectId: current.nativeId,
+                  identityKey: tuple.key,
+                  credentialId: allocated.credentialId,
+                  credentialRevision: allocated.revision,
+                }),
+                [cr.moduleId]: c.moduleId,
+                [cr.subjectId]: current.nativeId,
+                [cr.identityKey]: tuple.key,
+                [cr.credentialId]: allocated.credentialId,
+                [cr.credentialRevision]: allocated.revision,
+              };
+
+              invariant(cr.isActiveStatus(values[cr.status]));
+
+              const inserted = yield* owner.insert(cr.table, values, {
+                [cr.credentialId]: allocated.credentialId,
+              });
+
+              login.rows = inserted.rows;
+
+              const sharedValues = {
+                ...a.encodeInsert({
+                  subjectId: current.nativeId,
+                  credentialId: allocated.credentialId,
+                  revision: allocated.revision,
+                }),
+                [a.subjectId]: current.nativeId,
+                [a.credentialId]: allocated.credentialId,
+                [a.revision]: allocated.revision,
+              };
+
+              invariant(a.isActiveStatus(sharedValues[a.status]));
+
+              const shared = yield* owner.insert(a.table, sharedValues, {
+                [a.subjectId]: current.nativeId,
+                [a.credentialId]: allocated.credentialId,
+              });
+
+              current.authorities.rows = [...current.authorities.rows, ...shared.rows];
+              owner.postconditions.push(
+                sql`exists(select 1 from ${cr.table} where ${both(
+                  eq(col(cr.table, cr.credentialId), allocated.credentialId),
+                  cr.activeCondition,
+                )})`,
+                sql`exists(select 1 from ${a.table} where ${both(
+                  eq(col(a.table, a.subjectId), current.nativeId),
+                  eq(col(a.table, a.credentialId), allocated.credentialId),
+                  a.activeCondition,
+                )})`,
+              );
+              if (tuple.row[t.state] === "Unowned")
+                yield* acquireTuple(mapping.ownership, identity, tuple.key, current.nativeId);
+              const next = yield* advance(mapping, current);
+
+              const revision = snapshotOAuthSync(OAuthAccountRevision, {
+                ...current.revision,
+                securityRevision: next,
+                credentials: [
+                  ...current.revision.credentials,
+                  { credentialId: allocated.credentialId, revision: allocated.revision },
+                ],
+              });
+
+              decision = {
+                _tag: "Linked",
+                changed: true,
+                credential: snapshotOAuthSync(OAuthCredentialSnapshot, {
+                  moduleId: c.moduleId,
+                  identity,
+                  credentialId: allocated.credentialId,
+                  credentialRevision: allocated.revision as never,
+                  revision,
+                }),
+              };
+            }
+          }
+        }
+        yield* terminalFlow(mapping, flow, decision._tag);
+
+        return decision;
+      }),
+    );
+
+  const targetCredential = (mapping: any, moduleId: string, credentialId: string, current: any) =>
+    Effect.flatMap(CurrentOAuthTransaction, (owner) =>
+      Effect.gen(function* () {
+        const cr = mapping.credential;
+
+        const found = yield* owner.read(
+          cr.table,
+          eq(col(cr.table, cr.credentialId), credentialId),
+          {
+            limit: 1,
+          },
+        );
+
+        const row = found.rows[0];
+
+        if (
+          row === undefined ||
+          row[cr.moduleId] !== moduleId ||
+          !mapping.subjectId.equals(row[cr.subjectId], current.nativeId) ||
+          !cr.isActiveStatus(row[cr.status])
+        )
+          return undefined;
+        const t = mapping.ownership.tuple;
+
+        const tuple = yield* owner.read(
+          t.table,
+          eq(col(t.table, t.identityKey), row[cr.identityKey]),
+          {
+            limit: 1,
+          },
+        );
+
+        const ownership = tuple.rows[0];
+
+        if (
+          ownership === undefined ||
+          ownership[t.state] !== "Owned" ||
+          !mapping.subjectId.equals(ownership[t.subjectId], current.nativeId)
+        )
+          return undefined;
+
+        const identity = {
+          provider: ownership[t.provider],
+          issuer: ownership[t.issuer],
+          subject: ownership[t.externalSubject],
+        };
+
+        invariant((yield* oauthIdentityKey(identity)) === row[cr.identityKey]);
+
+        const shared = current.revision.credentials.find(
+          (item: any) => item.credentialId === credentialId,
+        );
+
+        if (
+          shared?.revision !== row[cr.credentialRevision] ||
+          !(yield* owner.check(
+            sql`exists(select 1 from ${cr.table} where ${both(eq(col(cr.table, cr.credentialId), credentialId), cr.activeCondition)})`,
+          ))
+        )
+          return undefined;
+
+        return snapshotOAuthSync(OAuthCredentialSnapshot, {
+          moduleId: moduleId as never,
+          identity,
+          credentialId,
+          credentialRevision: row[cr.credentialRevision],
+          revision: current.revision,
+        });
+      }),
+    );
+
+  const unlinkCommand = (mapping: any, moduleId: string, commandId: string) =>
+    Effect.flatMap(CurrentOAuthTransaction, (owner) =>
+      owner.read(
+        mapping.command.table,
+        equal(mapping.command.table, {
+          [mapping.command.moduleId]: moduleId,
+          [mapping.command.commandId]: commandId,
+        }),
+        { limit: 1 },
+      ),
+    );
+
+  const inspectUnlink = (mapping: any, input: any) =>
+    Effect.flatMap(CurrentOAuthTransaction, (owner) =>
+      Effect.gen(function* () {
+        const current = yield* accountCurrent(mapping, input.subjectId);
+
+        if (current === undefined) return { _tag: "Rejected" } as const;
+
+        const command = yield* unlinkCommand(mapping, input.moduleId, input.commandId),
+          r = mapping.command;
+
+        const old = command.rows[0];
+
+        if (old !== undefined) {
+          const intent = credentialStorage.decode(old[r.intentSnapshot]);
+
+          if (
+            intent.moduleId !== input.moduleId ||
+            intent.revision.subjectId !== input.subjectId ||
+            intent.credentialId !== input.credentialId ||
+            !mapping.subjectId.equals(old[r.subjectId], current.nativeId) ||
+            old[r.credentialId] !== input.credentialId
+          )
+            return { _tag: "Conflict" } as const;
+          const metadata = mapping.metadata.condition(current.nativeId);
+
+          if (!(yield* owner.check(metadata))) return { _tag: "Rejected" } as const;
+          owner.postconditions.push(metadata);
+
+          return { _tag: "Replay", result: unlinkedStorage.decode(old[r.decision]) } as const;
+        }
+
+        const credential = yield* targetCredential(
+          mapping,
+          input.moduleId,
+          input.credentialId,
+          current,
+        );
+
+        return credential === undefined
+          ? ({ _tag: "Rejected" } as const)
+          : ({ _tag: "Target", credential } as const);
+      }),
+    );
+
+  const remainingEligibility = (mapping: any, current: any, removed: string) =>
+    Effect.flatMap(CurrentOAuthTransaction, (owner) =>
+      Effect.gen(function* () {
+        invariant(mapping.eligibility.length > 0 && mapping.eligibility.length <= 32);
+        const facts = new Map<string, OAuthEligibilityFact>();
+
+        const revisions = new Map(
+          current.revision.credentials.map((item: any) => [item.credentialId, item.revision]),
+        );
+
+        for (const descriptor of mapping.eligibility) {
+          const observed = yield* owner.read(
+            descriptor.table,
+            both(
+              eq(col(descriptor.table, descriptor.subjectId), current.nativeId),
+              descriptor.condition(current.nativeId),
+            ),
+            { orderBy: col(descriptor.table, descriptor.credentialId) },
+          );
+
+          for (const row of observed.rows) {
+            const fact = descriptor.decode(copiedRow(row)) as OAuthEligibilityFact | undefined;
+
+            if (fact === undefined || fact.credentialId === removed) continue;
+            invariant(
+              fact.credentialId === row[descriptor.credentialId] &&
+                fact.revision === row[descriptor.revision] &&
+                revisions.get(fact.credentialId) === fact.revision &&
+                fact.factors.length <= 8 &&
+                fact.factors.every((factor) =>
+                  ["knowledge", "possession", "inherence"].includes(factor),
+                ),
+            );
+            invariant(
+              typeof fact.usablePrimary === "boolean" &&
+                typeof fact.userVerified === "boolean" &&
+                typeof fact.phishingResistant === "boolean",
+            );
+
+            const normalized = {
+              credentialId: fact.credentialId,
+              revision: fact.revision,
+              usablePrimary: fact.usablePrimary,
+              factors: [...new Set(fact.factors)].sort(),
+              userVerified: fact.userVerified,
+              phishingResistant: fact.phishingResistant,
+            };
+
+            const prior = facts.get(fact.credentialId);
+
+            // oxlint-disable-next-line no-restricted-properties -- Canonical bounded eligibility fact fingerprint rejects contradictory duplicate IDs.
+            invariant(prior === undefined || JSON.stringify(prior) === JSON.stringify(normalized));
+            facts.set(fact.credentialId, normalized);
+          }
+        }
+        const available = [...facts.values()];
+
+        const requirement = snapshotOAuthSync(
+          AuthenticationRequirement,
+          mapping.subject.decodeAuthenticationRequirement(copiedRow(current.row)),
+        );
+
+        return available.some((fact) => fact.usablePrimary) && satisfies(available, requirement);
+      }),
+    );
+
+  const unlink = (mapping: any, input: any) =>
+    Effect.flatMap(CurrentOAuthTransaction, (owner) =>
+      Effect.gen(function* () {
+        const expected = snapshotOAuthSync(OAuthCredentialSnapshot, input.credential);
+
+        invariant(expected.moduleId === input.moduleId);
+        const current = yield* accountCurrent(mapping, expected.revision.subjectId);
+
+        if (current === undefined) return { _tag: "Rejected" } as const;
+
+        const guards: ReadonlyArray<OAuthReferenceGuardDescriptor<unknown>> =
+          mapping.connectedReferenceGuards ?? [];
+
+        invariant(guards.length <= 32);
+        let referencesGuarded = mapping.connectedReference !== undefined && guards.length > 0;
+
+        if (mapping.connectedReference !== undefined)
+          for (const guard of guards) {
+            const condition = guard.condition({
+              identity: snapshotOAuthSync(
+                OAuthCredentialSnapshot.fields.identity,
+                expected.identity,
+              ),
+              identityKey: yield* oauthIdentityKey(expected.identity),
+              subjectId: copiedRow({ value: current.nativeId }).value,
+            });
+
+            const read = yield* owner.read(
+              guard.table,
+              Effect.isEffect(condition) ? yield* condition : condition,
+              { orderBy: col(guard.table, guard.orderBy) },
+            );
+
+            if (read.rows.length === 0) referencesGuarded = false;
+          }
+
+        const command = yield* unlinkCommand(mapping, input.moduleId, input.commandId),
+          r = mapping.command;
+
+        const previous = command.rows[0];
+
+        if (previous !== undefined) {
+          if (
+            previous[r.intentSnapshot] !== credentialStorage.encode(expected) ||
+            previous[r.credentialId] !== expected.credentialId ||
+            !mapping.subjectId.equals(previous[r.subjectId], current.nativeId)
+          )
+            return { _tag: "Conflict" } as const;
+          const metadata = mapping.metadata.condition(current.nativeId);
+
+          if (!(yield* owner.check(metadata))) return { _tag: "Rejected" } as const;
+          owner.postconditions.push(metadata);
+
+          return {
+            _tag: "Unlinked",
+            replayed: true,
+            result: unlinkedStorage.decode(previous[r.decision]),
+          } as const;
+        }
+
+        const actual = yield* targetCredential(
+          mapping,
+          input.moduleId,
+          expected.credentialId,
+          current,
+        );
+
+        if (
+          actual === undefined ||
+          credentialStorage.encode(actual) !== credentialStorage.encode(expected)
+        )
+          return { _tag: "Rejected" } as const;
+        const auth = snapshotOAuthSync(OAuthActionAuthorization, input.authorization);
+
+        if (
+          auth.challenge.moduleId !== input.moduleId ||
+          !(yield* authorization(
+            mapping,
+            current,
+            auth,
+            "unlink",
+            input.commandId,
+            input.commandId,
+            credentialStorage.encode(expected),
+            auth.requirement.maximumAgeMillis,
+          ))
+        )
+          return { _tag: "Rejected" } as const;
+        if (!(yield* remainingEligibility(mapping, current, expected.credentialId)))
+          return { _tag: "LastSignInMethod" } as const;
+
+        const invalidation = checkInvalidation(mapping, input.invalidation),
+          cr = mapping.credential,
+          a = mapping.authority;
+
+        const key = yield* oauthIdentityKey(expected.identity),
+          t = mapping.ownership.tuple;
+
+        const connected = mapping.connectedReference?.({
+          identityKey: key,
+          subjectId: copiedRow({ value: current.nativeId }).value,
+        });
+
+        const retain =
+          connected !== undefined && (!referencesGuarded || (yield* owner.check(connected)));
+
+        if (connected !== undefined && referencesGuarded)
+          owner.postconditions.push(retain ? connected : sql`not (${connected})`);
+        yield* owner.remove(cr.table, { [cr.credentialId]: expected.credentialId });
+        yield* owner.remove(a.table, {
+          [a.subjectId]: current.nativeId,
+          [a.credentialId]: expected.credentialId,
+        });
+        if (!retain) {
+          yield* owner.update(
+            t.table,
+            { [t.identityKey]: key },
+            {
+              [t.state]: "Unowned",
+              [t.subjectId]: null,
+              [t.reservation]: null,
+              [t.version]: owner.marker,
+            },
+          );
+          if (mapping.ownership.mode === "separate")
+            yield* owner.remove(mapping.ownership.external.table, {
+              [mapping.ownership.external.identityKey]: key,
+            });
+        }
+        yield* advance(mapping, current, expected.credentialId);
+
+        const result = snapshotOAuthSync(OAuthUnlinked, {
+          _tag: "Unlinked",
+          credentialId: expected.credentialId,
+          invalidation,
+        });
+
+        const now = yield* owner.now(mapping.clock);
+
+        invariant(
+          Number.isSafeInteger(input.retentionUntilMillis) &&
+            input.retentionUntilMillis > now &&
+            input.retentionUntilMillis >= input.nowMillis + 120000,
+        );
+        const commandKey = { [r.moduleId]: input.moduleId, [r.commandId]: input.commandId };
+
+        const values = {
+          ...r.encodeInsert({
+            moduleId: input.moduleId,
+            commandId: input.commandId,
+            credential: snapshotOAuthSync(OAuthCredentialSnapshot, expected),
+          }),
+          ...commandKey,
+          [r.subjectId]: current.nativeId,
+          [r.credentialId]: expected.credentialId,
+          [r.intentSnapshot]: credentialStorage.encode(expected),
+          [r.decision]: unlinkedStorage.encode(result),
+          [r.retentionUntil]: mapping.clock.encodeInstant(input.retentionUntilMillis),
+        };
+
+        const inserted = yield* owner.insert(r.table, values, commandKey);
+
+        command.rows = inserted.rows;
+
+        return { _tag: "Unlinked", result, replayed: false } as const;
+      }),
+    );
+
+  return { accountCurrent, issueLink, preflightLink, claimLink, settleLink, inspectUnlink, unlink };
+});
+
+export class OAuthAccounts extends Context.Service<OAuthAccounts, Effect.Success<typeof make>>()(
+  "effect-auth/persistence/OAuthAccounts",
+) {
+  static readonly layer = Layer.effect(OAuthAccounts, make);
+}