@yielded/auth-persistence 0.1.0-beta.23 → 0.1.0-beta.25

package/dist/internal/session-kernel.d.mts

@@ -6,7 +6,7 @@ import { NativeSqlTables } from "./native-sql-table.mjs";
 import { Context, DateTime, Effect } from "effect";
 import { SubjectId } from "@yielded/auth/Schema";
 import { LifecycleHooks } from "@yielded/auth/Hooks";
-import { AuthenticationEvidence, AuthenticationRevision, PendingAuthentication, PendingAuthenticationInvalid, PendingConsumption, PrepareSessionCommit, SessionRepository, SessionStepUpPersistence, SessionUnavailable, SignedSessionValidity, StaleAuthentication, StatefulSessionPersistence } from "@yielded/auth/Sessions";
+import { AuthenticationCapture, AuthenticationEvidence, PendingAuthentication, PendingAuthenticationInvalid, PendingConsumption, PrepareSessionCommit, SessionRepository, SessionStepUpPersistence, SessionUnavailable, SignedSessionValidity, StaleAuthentication, StatefulSessionPersistence } from "@yielded/auth/Sessions";
 import { SqlClient } from "effect/sql/SqlClient";
 import * as SqlError$1 from "effect/sql/SqlError";
 //#region src/internal/session-kernel.d.ts
@@ -40,7 +40,7 @@ export interface SessionSqlOptions {
 }
 export declare const makeSessionKernel: (operations: QueryOperations, nativeTables?: (client: SqlClient, database: object) => NativeSqlTables) => {
   makeSqlAuthenticationAuthority: <Claims>(mapping: AuthenticationAuthorityMapping<Claims, any, any, any, any, any>, options: SessionSqlOptions) => Effect.Effect<{
-    readonly capture: (subjectId: SubjectId, credentialIds: ReadonlyArray<string>) => Effect.Effect<AuthenticationRevision, StaleAuthentication | SessionUnavailable>;
+    readonly capture: (subjectId: SubjectId, credentialIds: ReadonlyArray<string>) => Effect.Effect<AuthenticationCapture, StaleAuthentication | SessionUnavailable>;
     readonly requirements: (evidence: AuthenticationEvidence) => Effect.Effect<import("@yielded/auth/Sessions").AuthenticationRequirement, StaleAuthentication | SessionUnavailable>;
     readonly approve: <A>(input: {
       readonly evidence: AuthenticationEvidence;

package/dist/internal/session-kernel.mjs

@@ -3,11 +3,20 @@ import { makeNativeSqlTables, sqlMapping } from "./native-sql-table.mjs";
 import { NativeDatabase } from "./transaction-kernel.mjs";
 import { makeAuthoritySnapshot } from "./authority-snapshot.mjs";
 import { decodeStepUpIntent, encodeStepUpIntent, sameStepUpRevision, stepUpIntentLive, stepUpRotationMatches, validateStepUpPlan } from "./step-up-state.mjs";
+import { canJoinTextColumns } from "./storage-validation.mjs";
 import { Cause, Context, DateTime, Effect, Option, Schema } from "effect";
 import { CurrentCommitJournal, LifecycleHooks, coordinateCommit, hasCommitScope } from "@yielded/auth/Hooks";
-import { PendingAuthenticationInvalid, SessionConflict, SessionInvalid, SessionMetadata, SessionStepUpInvalid, SessionUnavailable, StaleAuthentication, assessAuthentication, pendingAuthenticationContext, snapshotPendingAuthenticationContext, snapshotSessionAuthenticationProvenance } from "@yielded/auth/Sessions";
+import { AuthenticationCapture, PendingAuthenticationInvalid, SessionConflict, SessionInvalid, SessionMetadata, SessionStepUpInvalid, SessionUnavailable, StaleAuthentication, assessAuthentication, pendingAuthenticationContext, snapshotPendingAuthenticationContext, snapshotSessionAuthenticationProvenance } from "@yielded/auth/Sessions";
 import { reportPersistenceFailure } from "@yielded/auth/Persistence";
 //#region src/internal/session-kernel.ts
+const decodeRevocationFlag = Schema.decodeUnknownEffect(Schema.Literals([0, 1]));
+/** Reads need no transaction of their own. A caller-owned transaction still
+* needs a savepoint so catching an SQL failure does not leave it aborted. */
+const withVerificationSavepoint = Effect.fnUntraced(function* (effect) {
+	const { $client } = yield* NativeDatabase;
+	const transaction = yield* Effect.serviceOption($client.transactionService);
+	return yield* Option.isSome(transaction) ? $client.withTransaction(effect) : effect;
+});
 /** Native SQL authority for the current transaction or savepoint. */
 var CurrentSessionSql = class extends Context.Service()("effect-auth/drizzle/CurrentSessionSql") {};
 const makeSessionKernel = (operations, nativeTables = (client) => makeNativeSqlTables(client)) => {
@@ -191,7 +200,10 @@ const makeSessionKernel = (operations, nativeTables = (client) => makeNativeSqlT
 		const tables = yield* sqlMapping(() => nativeTables(sqlClient, root)).pipe(Effect.mapError(unavailable));
 		const readSnapshot = makeAuthoritySnapshot(tables, mapping);
 		const service = {
-			capture: (subjectId, credentialIds) => safeTransaction(readSnapshot(subjectId, credentialIds).pipe(Effect.map((value) => value.revision))),
+			capture: (subjectId, credentialIds) => safeTransaction(readSnapshot(subjectId, credentialIds).pipe(Effect.flatMap((value) => Effect.flatMap(mapping.subject.decodeRequirement(value.subject), (requirement) => Schema.decodeEffect(AuthenticationCapture)({
+				revision: value.revision,
+				requirement
+			}))))),
 			requirements: (evidence) => safeTransaction(readSnapshot(evidence.revision.subjectId, evidence.revision.credentials.map((item) => item.credentialId)).pipe(Effect.flatMap((captured) => validateCapturedEvidence(mapping, evidence, captured)), Effect.map((value) => value.requirement))),
 			approve: (input, prepare) => owned(database, options, mapping.isConstraintConflict, Effect.gen(function* () {
 				const journal = yield* CurrentCommitJournal;
@@ -323,6 +335,18 @@ const makeSessionKernel = (operations, nativeTables = (client) => makeNativeSqlT
 		const tables = yield* sqlMapping(() => nativeTables(root.$client.withoutTransforms(), root)).pipe(Effect.mapError(unavailable));
 		const readSnapshot = makeAuthoritySnapshot(tables, mapping);
 		const c = sessionColumns(mapping);
+		const verification = yield* safeTransaction(Effect.gen(function* () {
+			const { session, subject } = yield* sqlMapping(() => ({
+				session: tables(mapping.session.table).as("auth_session"),
+				subject: tables(mapping.subject.table).as("auth_subject")
+			}));
+			const [sessionOwner, subjectOwner] = yield* sqlMapping(() => [session.unencodedTextColumn?.(mapping.session.subjectId), subject.unencodedTextColumn?.(mapping.subject.id)]);
+			return {
+				session,
+				subject,
+				canJoinOwner: yield* canJoinTextColumns(sessionOwner, subjectOwner)
+			};
+		}));
 		const persistence = {
 			establish: (input, prepare) => owned(database, options, mapping.isConstraintConflict, Effect.gen(function* () {
 				const transaction = yield* CurrentSessionSql;
@@ -330,8 +354,9 @@ const makeSessionKernel = (operations, nativeTables = (client) => makeNativeSqlT
 				const { nativeSubjectId, requirement } = yield* options.locking ? validateEvidenceIn(mapping, input.evidence, true) : Effect.flatMap(readSnapshot(input.evidence.revision.subjectId, input.evidence.revision.credentials.map((item) => item.credentialId)), (captured) => validateCapturedEvidence(mapping, input.evidence, captured));
 				let flowInsert;
 				let pendingExpiresAt;
-				if (input.pending === void 0) flowInsert = yield* ensureDirectFlowAvailable(mapping, input.evidence, nativeSubjectId, input.session.absoluteExpiresAt);
-				else {
+				if (input.pending === void 0) {
+					if (input.fresh !== true || input.handoffSourceSessionId !== void 0) flowInsert = yield* ensureDirectFlowAvailable(mapping, input.evidence, nativeSubjectId, input.session.absoluteExpiresAt);
+				} else {
 					if (mapping.pending === void 0) return yield* invalidPending();
 					const pending = yield* validatePending(mapping, input.pending);
 					if (!preservesRevision(input.evidence, pending.evidence)) return yield* invalidPending();
@@ -356,7 +381,7 @@ const makeSessionKernel = (operations, nativeTables = (client) => makeNativeSqlT
 				};
 				const receipt = prepare(record, journal);
 				if (flowInsert !== void 0) yield* transaction.insert(mapping.flow.table).values(flowInsert);
-				else yield* consumePending({
+				else if (input.pending !== void 0) yield* consumePending({
 					...mapping,
 					pending: mapping.pending
 				}, input.pending, input.session.absoluteExpiresAt);
@@ -368,14 +393,23 @@ const makeSessionKernel = (operations, nativeTables = (client) => makeNativeSqlT
 				if (DateTime.toEpochMillis(commitNow) < DateTime.toEpochMillis(record.issuedAt) || DateTime.toEpochMillis(commitNow) >= DateTime.toEpochMillis(record.expiresAt) || !(yield* assessAuthentication(input.evidence, requirement)).satisfied) return yield* stale();
 				return receipt;
 			}).pipe(normalizeMutation(mapping))),
-			verify: (input) => safeTransaction(inTransaction(database, Effect.gen(function* () {
-				const row = (yield* (yield* CurrentSessionSql).select().from(mapping.session.table).where(eq(c.digest, input.digest)).limit(1))[0];
+			verify: (input) => safeTransaction(withVerificationSavepoint(Effect.gen(function* () {
+				const sql = root.$client.withoutTransforms();
+				const { session, subject, canJoinOwner } = verification;
+				const owner = canJoinOwner ? void 0 : (yield* database.select({ subjectId: c.subjectId }).from(mapping.session.table).where(eq(c.digest, input.digest)).limit(1))[0];
+				if (!canJoinOwner && owner === void 0) return yield* invalidSession();
+				const row = (yield* sqlMapping(() => sql`select ${session.fields("v_")}, ${subject.fields("s_")}
+              from ${session.name} inner join ${subject.name} on
+                ${subject.column(mapping.subject.id)} = ${owner === void 0 ? session.column(mapping.session.subjectId) : subject.value(mapping.subject.id, owner.subjectId)}
+              where ${session.column(mapping.session.digest)} = ${session.value(mapping.session.digest, input.digest)}
+              limit 1`).pipe(Effect.flatten))[0];
 				if (row === void 0) return yield* invalidSession();
-				const record = yield* mapping.session.decode(row);
+				const sessionRow = yield* sqlMapping(() => session.decode(row, "v_"));
+				const subjectRow = yield* sqlMapping(() => subject.decode(row, "s_"));
+				const record = yield* mapping.session.decode(sessionRow);
 				const nativeSubjectId = yield* mapping.subjectId.toNative(record.subjectId);
-				const subject = (yield* readSubject(mapping, nativeSubjectId, false))[0];
 				const now = yield* freshNow;
-				if (subject === void 0 || !mapping.subject.isActiveStatus(subject[mapping.subject.status]) || subject[mapping.subject.securityRevision] !== record.securityRevision || DateTime.toEpochMillis(now) >= DateTime.toEpochMillis(record.expiresAt) || DateTime.toEpochMillis(now) >= DateTime.toEpochMillis(record.absoluteExpiresAt)) return yield* invalidSession();
+				if (!mapping.subjectId.equals(nativeSubjectId, sessionRow[mapping.session.subjectId]) || !mapping.subjectId.equals(nativeSubjectId, subjectRow[mapping.subject.id]) || !mapping.subject.isActiveStatus(subjectRow[mapping.subject.status]) || subjectRow[mapping.subject.securityRevision] !== record.securityRevision || DateTime.toEpochMillis(now) >= DateTime.toEpochMillis(record.expiresAt) || DateTime.toEpochMillis(now) >= DateTime.toEpochMillis(record.absoluteExpiresAt)) return yield* invalidSession();
 				return record;
 			}))),
 			rotate: (input, prepare) => owned(database, options, mapping.isConstraintConflict, Effect.gen(function* () {
@@ -463,7 +497,7 @@ const makeSessionKernel = (operations, nativeTables = (client) => makeNativeSqlT
 		return {
 			statefulSessionPersistence: {
 				establish: (input, prepare) => persistence.establish(input, prepare).pipe(Effect.provideService(NativeDatabase, root), Effect.provideService(LifecycleHooks, hooks)),
-				verify: (input) => persistence.verify(input).pipe(Effect.provideService(LifecycleHooks, hooks)),
+				verify: (input) => persistence.verify(input).pipe(Effect.provideService(NativeDatabase, root), Effect.provideService(LifecycleHooks, hooks)),
 				rotate: (input, prepare) => persistence.rotate(input, prepare).pipe(Effect.provideService(LifecycleHooks, hooks)),
 				revokeDigest: (digest, prepare) => persistence.revokeDigest(digest, prepare).pipe(Effect.provideService(LifecycleHooks, hooks)),
 				revoke: (input, prepare) => persistence.revoke(input, prepare).pipe(Effect.provideService(LifecycleHooks, hooks)),
@@ -482,16 +516,38 @@ const makeSessionKernel = (operations, nativeTables = (client) => makeNativeSqlT
 			sessionId: column(mapping.tombstone.table, mapping.tombstone.sessionId),
 			absoluteExpiresAt: column(mapping.tombstone.table, mapping.tombstone.absoluteExpiresAt)
 		};
+		const root = yield* NativeDatabase;
+		const tables = yield* sqlMapping(() => nativeTables(root.$client.withoutTransforms(), root)).pipe(Effect.mapError(unavailable));
 		const service = {
-			verify: (session, _now) => safeTransaction(inTransaction(database, Effect.gen(function* () {
-				const read = yield* CurrentSessionSql;
+			verify: (session, _now) => safeTransaction(withVerificationSavepoint(Effect.gen(function* () {
+				const sql = root.$client.withoutTransforms();
 				const nativeSubjectId = yield* mapping.subjectId.toNative(session.subjectId);
 				const nativeSessionId = yield* mapping.sessionId.toNative(session.sessionId);
-				const row = (yield* readSubject(mapping, nativeSubjectId, false))[0];
-				if (row === void 0 || !mapping.subject.isActiveStatus(row[mapping.subject.status]) || row[mapping.subject.securityRevision] !== session.securityRevision) return yield* invalidSession();
+				const readNow = yield* freshNow;
+				const { subjectTable, rows } = yield* sqlMapping(() => {
+					const subjectTable = tables(mapping.subject.table).as("auth_subject");
+					const revoked = tables(mapping.tombstone.table).as("auth_revocation");
+					return {
+						subjectTable,
+						rows: sql`
+                  select ${subjectTable.fields("s_")},
+                    case when exists (
+                      select 1 from ${revoked.name}
+                      where ${revoked.column(mapping.tombstone.subjectId)} = ${revoked.value(mapping.tombstone.subjectId, nativeSubjectId)}
+                        and ${revoked.column(mapping.tombstone.sessionId)} = ${revoked.value(mapping.tombstone.sessionId, nativeSessionId)}
+                        and ${revoked.column(mapping.tombstone.absoluteExpiresAt)} > ${revoked.value(mapping.tombstone.absoluteExpiresAt, mapping.tombstone.encodeInstant(readNow))}
+                    ) then 1 else 0 end as auth_revoked
+                  from ${subjectTable.name}
+                  where ${subjectTable.column(mapping.subject.id)} = ${subjectTable.value(mapping.subject.id, nativeSubjectId)}
+                  limit 1`
+					};
+				});
+				const result = (yield* rows)[0];
+				if (result === void 0) return yield* invalidSession();
+				const row = yield* sqlMapping(() => subjectTable.decode(result, "s_"));
+				const revoked = yield* decodeRevocationFlag(result.auth_revoked);
 				const authoritativeNow = yield* freshNow;
-				if (DateTime.toEpochMillis(authoritativeNow) >= DateTime.toEpochMillis(session.expiresAt) || DateTime.toEpochMillis(authoritativeNow) >= DateTime.toEpochMillis(session.absoluteExpiresAt)) return yield* invalidSession();
-				if ((yield* read.select({ sessionId: tombstone.sessionId }).from(mapping.tombstone.table).where(and(eq(tombstone.subjectId, nativeSubjectId), eq(tombstone.sessionId, nativeSessionId), gt(tombstone.absoluteExpiresAt, mapping.tombstone.encodeInstant(authoritativeNow)))).limit(1)).length > 0) return yield* invalidSession();
+				if (!mapping.subjectId.equals(nativeSubjectId, row[mapping.subject.id]) || !mapping.subject.isActiveStatus(row[mapping.subject.status]) || row[mapping.subject.securityRevision] !== session.securityRevision || revoked === 1 || DateTime.toEpochMillis(authoritativeNow) >= DateTime.toEpochMillis(session.expiresAt) || DateTime.toEpochMillis(authoritativeNow) >= DateTime.toEpochMillis(session.absoluteExpiresAt)) return yield* invalidSession();
 			}))),
 			revoke: (input, prepare) => owned(database, options, mapping.isConstraintConflict, Effect.gen(function* () {
 				const transaction = yield* CurrentSessionSql;
@@ -527,7 +583,7 @@ const makeSessionKernel = (operations, nativeTables = (client) => makeNativeSqlT
 			}))
 		};
 		return {
-			verify: (session, now) => service.verify(session, now).pipe(Effect.provideService(LifecycleHooks, hooks)),
+			verify: (session, now) => service.verify(session, now).pipe(Effect.provideService(NativeDatabase, root), Effect.provideService(LifecycleHooks, hooks)),
 			revoke: (input, prepare) => service.revoke(input, prepare).pipe(Effect.provideService(LifecycleHooks, hooks)),
 			revokeAll: (input, prepare) => service.revokeAll(input, prepare).pipe(Effect.provideService(LifecycleHooks, hooks))
 		};