@yielded/auth-persistence 0.1.0-beta.23 → 0.1.0-beta.25

package/src/internal/models/password-model.ts

@@ -1,7 +1,6 @@
 import { type RecoveryReference, type LoginIdentifier } from "@yielded/auth/Identity";
 import type {
   PasswordAction,
-  PasswordAttemptId,
   PasswordCredentialSnapshot,
   PasswordReplacement,
   PasswordRegistrationDecision,
@@ -15,10 +14,6 @@ import type { PersistenceMappingError, SubjectIdCodec } from "./common";
 
 type ColumnKey<T extends Table> = T["column"];
 
-export type PasswordAttemptAction = "sign-in" | "change";
-
-export type PasswordAttemptState = "pending" | "verified" | "rejected";
-
 export interface PasswordSubjectTable<Subject extends Table, _NativeSubjectId> {
   readonly table: Subject["table"];
   readonly id: ColumnKey<Subject>;
@@ -121,48 +116,6 @@ export interface PasswordCredentialTable<
   }) => Effect.Effect<PasswordCredentialSnapshot, PersistenceMappingError>;
 }
 
-export interface PasswordAttemptRecord {
-  readonly moduleId: string;
-  readonly action: PasswordAttemptAction;
-  readonly attemptId: PasswordAttemptId;
-  readonly identifier: LoginIdentifier;
-  readonly subjectId?: string;
-  readonly credentialId?: string;
-  readonly securityRevision?: SecurityRevision;
-  readonly credentialRevision?: SecurityRevision;
-  readonly verifierVersion?: SecurityRevision;
-  readonly identifierBindingRevision?: SecurityRevision;
-  readonly admittedAtMillis: number;
-  readonly deadlineMillis: number;
-  readonly retentionUntilMillis: number;
-}
-
-export interface PasswordAttemptTable<Attempt extends Table, NativeSubjectId> {
-  readonly table: Attempt["table"];
-  readonly moduleId: ColumnKey<Attempt>;
-  readonly action: ColumnKey<Attempt>;
-  readonly attemptId: ColumnKey<Attempt>;
-  readonly identifierNamespace: ColumnKey<Attempt>;
-  readonly identifierValue: ColumnKey<Attempt>;
-  readonly subjectId: ColumnKey<Attempt>;
-  readonly credentialId: ColumnKey<Attempt>;
-  readonly securityRevision: ColumnKey<Attempt>;
-  readonly credentialRevision: ColumnKey<Attempt>;
-  readonly verifierVersion: ColumnKey<Attempt>;
-  readonly identifierBindingRevision: ColumnKey<Attempt>;
-  readonly admittedAt: ColumnKey<Attempt>;
-  readonly deadline: ColumnKey<Attempt>;
-  readonly retentionUntil: ColumnKey<Attempt>;
-  readonly state: ColumnKey<Attempt>;
-  readonly encodeInsert: (
-    record: PasswordAttemptRecord,
-    input: {
-      readonly nativeSubjectId?: NativeSubjectId;
-      readonly state: "pending";
-    },
-  ) => Attempt["insert"];
-}
-
 export interface PasswordCommandTable<Command extends Table> {
   readonly table: Command["table"];
   readonly moduleId: ColumnKey<Command>;
@@ -186,7 +139,6 @@ export interface RequiredPasswordConstraints {
   readonly authorityCredential: "unique(authorityCredential.subjectId,authorityCredential.credentialId)";
   readonly credentialSubject: "unique(credential.moduleId,credential.subjectId)";
   readonly credentialId: "unique(credential.moduleId,credential.credentialId)";
-  readonly attempt: "unique(attempt.moduleId,attempt.attemptId)";
   readonly command: "unique(command.moduleId,command.commandId)";
 }
 
@@ -195,7 +147,6 @@ export const requiredPasswordConstraints: RequiredPasswordConstraints = {
   authorityCredential: "unique(authorityCredential.subjectId,authorityCredential.credentialId)",
   credentialSubject: "unique(credential.moduleId,credential.subjectId)",
   credentialId: "unique(credential.moduleId,credential.credentialId)",
-  attempt: "unique(attempt.moduleId,attempt.attemptId)",
   command: "unique(command.moduleId,command.commandId)",
 };
 
@@ -216,7 +167,6 @@ export interface PasswordPersistenceMapping<
   Identifier extends Table,
   Credential extends Table,
   AuthorityCredential extends Table,
-  Attempt extends Table,
   Command extends Table,
   NativeSubjectId,
   Expression extends SqlExpression = SqlExpression,
@@ -229,20 +179,18 @@ export interface PasswordPersistenceMapping<
     AuthorityCredential,
     NativeSubjectId
   >;
-  readonly attempt: PasswordAttemptTable<Attempt, NativeSubjectId>;
   readonly command: PasswordCommandTable<Command>;
   readonly subjectId: SubjectIdCodec<NativeSubjectId>;
   readonly constraints: RequiredPasswordConstraints;
   readonly encodeInstant: (epochMillis: number) => unknown;
   readonly decodeInstant: (native: unknown) => Effect.Effect<number, PersistenceMappingError>;
-  readonly allocateAttemptId?: Effect.Effect<PasswordAttemptId, PersistenceMappingError>;
-  readonly allocateAttemptIdSync?: () => PasswordAttemptId;
   readonly allocateCredentialId?: Effect.Effect<string, PersistenceMappingError>;
   readonly allocateCredentialIdSync?: () => string;
   readonly allocateRevision?: Effect.Effect<SecurityRevision, PersistenceMappingError>;
   readonly allocateRevisionSync?: () => SecurityRevision;
   readonly commandRetentionMillis: number;
-  /** All semantic replacements still bump subject revision. This flag only declares bearer invalidation latency. */
+  /** All semantic replacements still bump subject revision. This flag declares
+   * authoritative verification's invalidation latency; cookie exposure is separate. */
   readonly sessionInvalidation: "same-authority-immediate" | "original-absolute-expiry";
   readonly d1?: PasswordD1Clock<Expression>;
 }
@@ -252,7 +200,6 @@ export type D1PasswordPersistenceMapping<
   Identifier extends Table,
   Credential extends Table,
   AuthorityCredential extends Table,
-  Attempt extends Table,
   Command extends Table,
   NativeSubjectId,
   Expression extends SqlExpression = SqlExpression,
@@ -261,7 +208,6 @@ export type D1PasswordPersistenceMapping<
   Identifier,
   Credential,
   AuthorityCredential,
-  Attempt,
   Command,
   NativeSubjectId,
   Expression
@@ -429,7 +375,6 @@ export type AnyPasswordPersistenceMapping<Expression extends SqlExpression = Sql
     AnyTableModel,
     AnyTableModel,
     AnyTableModel,
-    AnyTableModel,
     unknown,
     Expression
   >;

package/src/internal/native-sql-table.ts

@@ -4,6 +4,7 @@ import * as Statement from "effect/sql/Statement";
 
 import { PersistenceMappingError } from "./mapping-error";
 import { Table, identifier } from "./sql-table";
+import type { PhysicalTextColumn } from "./storage-validation";
 
 /** Capture synchronous mapping callbacks without changing SQL execution errors. */
 export const sqlMapping = <A>(thunk: () => A): Effect.Effect<A, PersistenceMappingError> =>
@@ -19,6 +20,9 @@ export interface SqlTable {
   /** Alias reads only; writes continue to target the original physical table. */
   readonly as: (alias: string) => SqlTable;
   readonly column: (key: string) => Statement.Fragment;
+  /** Optional codec-free text candidate. Physical type/collation compatibility
+   * must still be checked against the database before comparing columns. */
+  readonly unencodedTextColumn?: (key: string) => PhysicalTextColumn | undefined;
   /** Project every column under an ordinal alias, using a distinct prefix per table. */
   readonly fields: (prefix: string) => Statement.Fragment;
   readonly decode: (
@@ -98,6 +102,16 @@ const directTable = (client: SqlClient, physical: object): SqlTable => {
       name: alias === undefined ? name : client`${name} AS ${reference}`,
       as: bind,
       column,
+      unencodedTextColumn: (key) =>
+        getColumn(key).options.type === "text"
+          ? {
+              table: {
+                name: physical.name,
+                ...(physical.schema === undefined ? {} : { schema: physical.schema }),
+              },
+              name: getColumn(key).options.name,
+            }
+          : undefined,
       value,
       fields: (prefix) =>
         client.join(