@yielded/auth-persistence 0.1.0-beta.23 → 0.1.0-beta.24

package/src/internal/password-credentials.ts

@@ -0,0 +1,245 @@
+import { CurrentCommitJournal, hasCommitScope } from "@yielded/auth/Hooks";
+import type { LoginIdentifier } from "@yielded/auth/Identity";
+import {
+  EncodedPasswordHash,
+  type PasswordPersistence,
+  PasswordUnavailable,
+  snapshotPasswordCredential,
+  type PasswordCredentialSnapshot,
+} from "@yielded/auth/Password";
+import { reportPersistenceFailure } from "@yielded/auth/Persistence";
+import { Effect, Option, Redacted, Schema } from "effect";
+
+import type { PersistenceMappingError } from "./mapping-error";
+import type { AnyPasswordPersistenceMapping } from "./models/password-model";
+import { sqlMapping, type SqlTable } from "./native-sql-table";
+import type { PasswordSqlConfiguration } from "./password-kernel";
+import { NativeDatabase } from "./transaction-kernel";
+
+type Row = Readonly<Record<string, unknown>>;
+const unavailable = () => PasswordUnavailable.make({});
+
+const failure = <A, E, R>(effect: Effect.Effect<A, E, R>) =>
+  reportPersistenceFailure(effect, Schema.is(PasswordUnavailable)).pipe(
+    Effect.mapError(unavailable),
+  );
+
+export const samePasswordCredentialSnapshot = (
+  a: PasswordCredentialSnapshot,
+  b: PasswordCredentialSnapshot,
+) =>
+  a.moduleId === b.moduleId &&
+  a.revision.subjectId === b.revision.subjectId &&
+  a.revision.securityRevision === b.revision.securityRevision &&
+  a.revision.credentials.length === b.revision.credentials.length &&
+  new Set(a.revision.credentials.map((entry) => entry.credentialId)).size ===
+    a.revision.credentials.length &&
+  new Set(b.revision.credentials.map((entry) => entry.credentialId)).size ===
+    b.revision.credentials.length &&
+  a.revision.credentials.every((entry) =>
+    b.revision.credentials.some(
+      (other) => entry.credentialId === other.credentialId && entry.revision === other.revision,
+    ),
+  ) &&
+  a.credentialId === b.credentialId &&
+  a.credentialRevision === b.credentialRevision &&
+  a.verifierVersion === b.verifierVersion &&
+  Redacted.value(a.verifier) === Redacted.value(b.verifier) &&
+  a.normalization === b.normalization &&
+  a.identifier.namespace === b.identifier.namespace &&
+  a.identifier.value === b.identifier.value &&
+  a.identifierBindingRevision === b.identifierBindingRevision &&
+  a.identifierVerifiedAtMillis === b.identifierVerifiedAtMillis;
+
+/** Lookup is read-only; rehash is one conditional maintenance write, never authentication. */
+export const makePasswordCredentials = Effect.fnUntraced(function* (
+  table: (table: object) => SqlTable,
+  mapping: AnyPasswordPersistenceMapping,
+  options: PasswordSqlConfiguration,
+): Effect.fn.Return<
+  Pick<PasswordPersistence["Service"], "findCredential" | "rehashIfCurrent">,
+  PasswordUnavailable,
+  NativeDatabase
+> {
+  const sql = (yield* NativeDatabase).$client.withoutTransforms();
+  const parent = yield* Effect.serviceOption(CurrentCommitJournal);
+
+  const [s, i, c] = yield* sqlMapping(
+    () =>
+      [
+        table(mapping.subject.table),
+        table(mapping.identifier.table),
+        table(mapping.credential.table),
+      ] as const,
+  ).pipe(failure);
+
+  const standalone = Effect.gen(function* () {
+    if (options.coordinated) {
+      const current = yield* Effect.serviceOption(CurrentCommitJournal);
+
+      if (Option.isNone(parent) || Option.isNone(current) || parent.value !== current.value)
+        return yield* unavailable();
+    } else {
+      if (yield* hasCommitScope) return yield* unavailable();
+      yield* options.standaloneGuard;
+    }
+  });
+
+  const allocate = <A>(
+    asynchronous: Effect.Effect<A, PersistenceMappingError> | undefined,
+    sync: (() => A) | undefined,
+  ) => {
+    if (options.mode !== "synchronous" && asynchronous !== undefined) return asynchronous;
+
+    return sync === undefined
+      ? Effect.fail(unavailable())
+      : Effect.try({ try: sync, catch: unavailable });
+  };
+
+  // Bind each native ID through its own column codec. Physical encodings of the
+  // same application ID need not match across subject, identifier and password.
+  const snapshot = Effect.fnUntraced(function* (
+    nativeId: unknown,
+    moduleId: string,
+    identifier: LoginIdentifier,
+  ) {
+    const subjectTable = s.as("password_subject");
+    const identifierTable = i.as("password_identifier");
+    const credentialTable = c.as("password_credential");
+
+    const rows = yield* sqlMapping(
+      () =>
+        sql<Row>`select ${subjectTable.fields("subject_")}, ${identifierTable.fields("identifier_")}, ${credentialTable.fields("credential_")}
+      from ${subjectTable.name}
+      inner join ${identifierTable.name} on ${identifierTable.column(mapping.identifier.namespace)} = ${identifierTable.value(mapping.identifier.namespace, identifier.namespace)}
+        and ${identifierTable.column(mapping.identifier.value)} = ${identifierTable.value(mapping.identifier.value, identifier.value)}
+        and ${identifierTable.column(mapping.identifier.subjectId)} = ${identifierTable.value(mapping.identifier.subjectId, nativeId)}
+      inner join ${credentialTable.name} on ${credentialTable.column(mapping.credential.moduleId)} = ${credentialTable.value(mapping.credential.moduleId, moduleId)}
+        and ${credentialTable.column(mapping.credential.subjectId)} = ${credentialTable.value(mapping.credential.subjectId, nativeId)}
+      where ${subjectTable.column(mapping.subject.id)} = ${subjectTable.value(mapping.subject.id, nativeId)}
+      `,
+    ).pipe(Effect.flatten);
+
+    if (rows.length !== 1) return undefined;
+
+    const [subject, identifierRow, credential] = yield* sqlMapping(
+      () =>
+        [
+          s.decode(rows[0]!, "subject_"),
+          i.decode(rows[0]!, "identifier_"),
+          c.decode(rows[0]!, "credential_"),
+        ] as const,
+    );
+
+    if (
+      yield* sqlMapping(
+        () =>
+          !mapping.subject.isActiveStatus(subject[mapping.subject.status]) ||
+          !mapping.identifier.isCurrent(identifierRow) ||
+          !mapping.subjectId.equals(nativeId, identifierRow[mapping.identifier.subjectId]) ||
+          !mapping.subjectId.equals(nativeId, subject[mapping.subject.id]) ||
+          !mapping.subjectId.equals(nativeId, credential[mapping.credential.subjectId]),
+      )
+    )
+      return undefined;
+
+    const captured = yield* sqlMapping(() =>
+      mapping.credential.decode({ moduleId, subject, identifier: identifierRow, credential }),
+    ).pipe(Effect.flatten, Effect.flatMap(snapshotPasswordCredential));
+
+    return captured;
+  });
+
+  return {
+    findCredential: (uncaptured) =>
+      Effect.gen(function* () {
+        const input = { ...uncaptured, identifier: { ...uncaptured.identifier } };
+
+        yield* standalone;
+
+        const identifiers = yield* sqlMapping(
+          () => sql<Row>`select ${i.fields("i_")} from ${i.name}
+          where ${i.column(mapping.identifier.namespace)} = ${i.value(mapping.identifier.namespace, input.identifier.namespace)}
+            and ${i.column(mapping.identifier.value)} = ${i.value(mapping.identifier.value, input.identifier.value)}`,
+        ).pipe(Effect.flatten);
+
+        const identifier =
+          identifiers.length === 1
+            ? yield* sqlMapping(() => i.decode(identifiers[0]!, "i_"))
+            : undefined;
+
+        if (
+          identifier === undefined ||
+          !(yield* sqlMapping(() => mapping.identifier.isCurrent(identifier)))
+        )
+          return Option.none();
+
+        const credential = yield* snapshot(
+          identifier[mapping.identifier.subjectId],
+          input.moduleId,
+          input.identifier,
+        );
+
+        return credential === undefined ||
+          (input.subjectId !== undefined && credential.revision.subjectId !== input.subjectId)
+          ? Option.none()
+          : Option.some(credential);
+      }).pipe(failure),
+    rehashIfCurrent: (input) =>
+      Effect.gen(function* () {
+        const nextVerifier = Redacted.make(
+          yield* Schema.decodeEffect(EncodedPasswordHash)(Redacted.value(input.nextVerifier)),
+        );
+
+        const credential = yield* snapshotPasswordCredential(input.credential);
+
+        yield* standalone;
+        const nativeId = yield* mapping.subjectId.toNative(credential.revision.subjectId);
+        const version = yield* allocate(mapping.allocateRevision, mapping.allocateRevisionSync);
+
+        if (version === credential.verifierVersion) return yield* unavailable();
+        yield* sqlMapping(() => {
+          const encoded = mapping.credential.encodeVerifier(nextVerifier, version);
+
+          // A custom encoder cannot turn maintenance into a semantic credential change.
+          const values = {
+            [mapping.credential.verifier]: encoded[mapping.credential.verifier],
+            [mapping.credential.verifierVersion]: encoded[mapping.credential.verifierVersion],
+          };
+
+          if (Object.values(values).some((value) => value === undefined)) throw unavailable();
+
+          // Ordinary identity predicates retain index use; the full CAS ignores text collation.
+          const exact = sql.and(
+            Object.entries({
+              [mapping.credential.moduleId]: credential.moduleId,
+              [mapping.credential.subjectId]: nativeId,
+              [mapping.credential.credentialId]: credential.credentialId,
+              [mapping.credential.credentialRevision]: credential.credentialRevision,
+              [mapping.credential.verifierVersion]: credential.verifierVersion,
+              [mapping.credential.verifier]: Redacted.value(credential.verifier),
+              [mapping.credential.normalization]: credential.normalization,
+            }).map(([key, value]) => {
+              const column = c.column(key),
+                bound = c.value(key, value);
+
+              if (typeof value !== "string") return sql`${column} = ${bound}`;
+
+              return sql.onDialectOrElse({
+                mysql: () => sql`binary ${column} = binary ${bound}`,
+                pg: () =>
+                  sql`convert_to(cast(${column} as text), 'UTF8') = convert_to(cast(${bound} as text), 'UTF8')`,
+                orElse: () => sql`cast(${column} as blob) = cast(${bound} as blob)`,
+              });
+            }),
+          );
+
+          return sql`${c.update(values)}
+          where ${c.column(mapping.credential.moduleId)} = ${c.value(mapping.credential.moduleId, credential.moduleId)}
+            and ${c.column(mapping.credential.subjectId)} = ${c.value(mapping.credential.subjectId, nativeId)}
+            and ${c.column(mapping.credential.credentialId)} = ${c.value(mapping.credential.credentialId, credential.credentialId)}
+            and ${exact}`;
+        }).pipe(Effect.flatten);
+      }).pipe(failure),
+  } satisfies Pick<PasswordPersistence["Service"], "findCredential" | "rehashIfCurrent">;
+});

package/src/internal/password-kernel.ts

@@ -41,9 +41,9 @@ import {
 } from "./models/password-model";
 import { makeNativeSqlTables, sqlMapping, type NativeSqlTables } from "./native-sql-table";
 import {
-  makePasswordAttempts,
+  makePasswordCredentials,
   samePasswordCredentialSnapshot as sameCredentialSnapshot,
-} from "./password-attempts";
+} from "./password-credentials";
 import {
   CurrentPasswordPreparedTransaction,
   PasswordPreparedPostconditions,
@@ -119,7 +119,7 @@ export const makePasswordKernel = <
 ) => {
   type Mapping = AnyPasswordPersistenceMapping<Fragment>;
 
-  const { and, eq, inArray, lte, column, updateValues } = operations;
+  const { and, eq, inArray, column, updateValues } = operations;
   const { completeProofPlanIn } = proofs;
   const unavailable = () => PasswordUnavailable.make({});
 
@@ -178,27 +178,6 @@ export const makePasswordKernel = <
     revision: column(mapping.authorityCredential.table, mapping.authorityCredential.revision),
   });
 
-  const attemptColumns = (mapping: Mapping) => ({
-    moduleId: column(mapping.attempt.table, mapping.attempt.moduleId),
-    action: column(mapping.attempt.table, mapping.attempt.action),
-    attemptId: column(mapping.attempt.table, mapping.attempt.attemptId),
-    identifierNamespace: column(mapping.attempt.table, mapping.attempt.identifierNamespace),
-    identifierValue: column(mapping.attempt.table, mapping.attempt.identifierValue),
-    subjectId: column(mapping.attempt.table, mapping.attempt.subjectId),
-    credentialId: column(mapping.attempt.table, mapping.attempt.credentialId),
-    securityRevision: column(mapping.attempt.table, mapping.attempt.securityRevision),
-    credentialRevision: column(mapping.attempt.table, mapping.attempt.credentialRevision),
-    verifierVersion: column(mapping.attempt.table, mapping.attempt.verifierVersion),
-    identifierBindingRevision: column(
-      mapping.attempt.table,
-      mapping.attempt.identifierBindingRevision,
-    ),
-    admittedAt: column(mapping.attempt.table, mapping.attempt.admittedAt),
-    deadline: column(mapping.attempt.table, mapping.attempt.deadline),
-    retentionUntil: column(mapping.attempt.table, mapping.attempt.retentionUntil),
-    state: column(mapping.attempt.table, mapping.attempt.state),
-  });
-
   const commandColumns = (mapping: Mapping) => ({
     moduleId: column(mapping.command.table, mapping.command.moduleId),
     commandId: column(mapping.command.table, mapping.command.commandId),
@@ -943,7 +922,7 @@ export const makePasswordKernel = <
     if (!validConstraints(mapping)) return yield* unavailable();
     const root = yield* NativeDatabase;
 
-    const attempts = yield* makePasswordAttempts(
+    const credentials = yield* makePasswordCredentials(
       yield* sqlMapping(() => nativeTables(root.$client.withoutTransforms(), root)).pipe(
         translateFailure,
       ),
@@ -952,7 +931,7 @@ export const makePasswordKernel = <
     );
 
     return PasswordPersistence.of({
-      ...attempts,
+      ...credentials,
       readForSubject: (input) =>
         safeRead(
           database,
@@ -1288,78 +1267,6 @@ export const makePasswordKernel = <
           Effect.provideService(LifecycleHooks, hooks),
           translateFailure,
         ),
-      cleanupAttempts: (input, prepare) =>
-        owned(
-          database,
-          mapping,
-          configuration,
-          Effect.gen(function* () {
-            const transaction = yield* CurrentPasswordSql;
-            const journal = yield* CurrentCommitJournal;
-
-            const now = yield* nowMillis;
-            const nativeNow = mapping.encodeInstant(now);
-            const a = attemptColumns(mapping);
-
-            const attempts = yield* selectRows(
-              transaction
-                .select({ attemptId: a.attemptId })
-                .from(mapping.attempt.table)
-                .where(and(eq(a.moduleId, input.moduleId), lte(a.retentionUntil, nativeNow)))
-                .limit(input.limit + 1),
-              false,
-            );
-
-            const hasMore = attempts.length > input.limit;
-            const attemptCandidates = attempts.slice(0, input.limit);
-            const selectedAttempts: typeof attemptCandidates = [];
-
-            for (const candidate of attemptCandidates) {
-              const locked = yield* selectRows(
-                transaction
-                  .select({ attemptId: a.attemptId })
-                  .from(mapping.attempt.table)
-                  .where(
-                    and(
-                      eq(a.moduleId, input.moduleId),
-                      eq(a.attemptId, candidate.attemptId),
-                      lte(a.retentionUntil, nativeNow),
-                    ),
-                  )
-                  .limit(1),
-                configuration.locking,
-              );
-
-              if (locked[0] !== undefined) selectedAttempts.push(locked[0] as any);
-            }
-
-            const prepared = prepare(
-              {
-                removed: selectedAttempts.length,
-                hasMore,
-              },
-              journal,
-            );
-
-            if (selectedAttempts.length > 0)
-              yield* transaction.delete(mapping.attempt.table).where(
-                and(
-                  eq(a.moduleId, input.moduleId),
-                  inArray(
-                    a.attemptId,
-                    selectedAttempts.map((row: any) => row.attemptId),
-                  ),
-                  lte(a.retentionUntil, nativeNow),
-                ),
-              );
-
-            return prepared;
-          }),
-        ).pipe(
-          Effect.provideService(CurrentPasswordSql, database),
-          Effect.provideService(LifecycleHooks, hooks),
-          translateFailure,
-        ),
     });
   });
 

package/src/internal/persistence.ts

@@ -141,7 +141,7 @@ export const createPersistence = <T extends object, R>(
 
     const roles: StorageRole[] = ["identifiers", "credentials", "sessions", "sessionFlows"];
 
-    if (password) roles.push("passwords", "passwordAttempts", "passwordCommands");
+    if (password) roles.push("passwords", "passwordCommands");
     if (management) roles.push("passwordRegistrations");
     if (email) roles.push("emailCredentials", "emailCommands");
     if (phone) roles.push("phoneState");

package/src/internal/query-operations.ts

@@ -60,10 +60,12 @@ export interface QueryOperations<
   readonly balancedD1And: Predicate<Fragment>;
   readonly asc: (value: unknown) => Fragment;
   readonly eq: Comparison<Fragment>;
+  readonly ne: Comparison<Fragment>;
   readonly gt: Comparison<Fragment>;
   readonly gte: Comparison<Fragment>;
   readonly lte: Comparison<Fragment>;
   readonly inArray: (value: unknown, values: ReadonlyArray<unknown>) => Fragment;
+  readonly isNotNull: (value: unknown) => Fragment;
   readonly isNull: (value: unknown) => Fragment;
   readonly notExists: (value: SqlExpression) => Fragment;
   readonly sql: {