@yielded/auth-persistence 0.1.0-beta.23 → 0.1.0-beta.25

package/src/internal/oauth/connected-collection.ts

@@ -0,0 +1,345 @@
+import { Effect, Context, Layer } from "effect";
+
+import { OAuthConnectedCustody } from "./connected-custody";
+import { OAuthConnectedFlow } from "./connected-flow";
+import { OAuthConnectedState } from "./connected-state";
+import type * as STypes from "./connected-state";
+import { CurrentOAuthTransaction } from "./owner";
+import type { Row } from "./owner";
+import { OAuthQueryCompiler } from "./query-compiler";
+import { invariant, oauthIdentityKey } from "./state";
+
+export interface Candidates {
+  readonly jobs: ReadonlyArray<Row>;
+  readonly grants: ReadonlyArray<Row>;
+  readonly cohorts: ReadonlyArray<Row>;
+  readonly tuples: ReadonlyArray<Row>;
+}
+
+const make = Effect.gen(function* () {
+  const operations = yield* OAuthQueryCompiler;
+  const C = yield* OAuthConnectedCustody;
+  const F = yield* OAuthConnectedFlow;
+  const S = yield* OAuthConnectedState;
+
+  const { asc, eq, lte, sql } = operations;
+  const { connectedReferenceCondition } = operations;
+  const { both, col, equal } = operations;
+
+  const discover = Effect.fn("oauthConnected.collectionCandidates")(function* (
+    mapping: STypes.Mapping,
+    moduleId: string,
+    limit: number,
+  ) {
+    const owner = yield* CurrentOAuthTransaction;
+
+    const g = mapping.grant,
+      j = S.jobTable(mapping),
+      h = mapping.cohort,
+      at = yield* owner.now(mapping.clock);
+
+    const jobs =
+      j === undefined
+        ? { rows: [] }
+        : yield* owner.read(
+            j.table,
+            both(
+              eq(col(j.table, j.moduleId), moduleId),
+              eq(col(j.table, j.state), "Confirmed"),
+              lte(col(j.table, j.retentionUntil), mapping.clock.encodeInstant(at)),
+            ),
+            {
+              limit: limit + 1,
+              takeOnly: true,
+              observe: false,
+              lock: false,
+              orderBy: asc(col(j.table, j.jobId)),
+            },
+          );
+
+    const grants = yield* owner.read(
+      g.table,
+      both(
+        eq(col(g.table, g.moduleId), moduleId),
+        sql`${col(g.table, g.state)} in ('Disconnected','ReauthorizationRequired')`,
+        sql`${col(g.table, g.sealed)} is null`,
+        sql`${col(g.table, g.refreshWork)} <> 'Unresolved'`,
+        lte(col(g.table, g.retentionUntil), mapping.clock.encodeInstant(at)),
+        sql`${col(g.table, g.revocationJobId)} is null`,
+        sql`not exists(select 1 from ${mapping.admission.table} where ${col(mapping.admission.table, mapping.admission.moduleId)} = ${col(g.table, g.moduleId)} and ${col(mapping.admission.table, mapping.admission.grantId)} = ${col(g.table, g.grantId)})`,
+        sql`not exists(select 1 from ${mapping.command.table} where ${col(mapping.command.table, mapping.command.moduleId)} = ${col(g.table, g.moduleId)} and ${col(mapping.command.table, mapping.command.grantId)} = ${col(g.table, g.grantId)})`,
+        j === undefined
+          ? undefined
+          : sql`not exists(select 1 from ${j.table} where ${col(j.table, j.moduleId)} = ${col(g.table, g.moduleId)} and ${col(j.table, j.grantId)} = ${col(g.table, g.grantId)})`,
+      ),
+      {
+        limit: limit + 1,
+        takeOnly: true,
+        observe: false,
+        lock: false,
+        orderBy: asc(col(g.table, g.grantId)),
+      },
+    );
+
+    const cohorts =
+      j === undefined
+        ? { rows: [] }
+        : yield* owner.read(
+            h.table,
+            both(
+              equal(h.table, { [h.state]: "Blocked" }),
+              C.clearableCondition(
+                mapping,
+                sql`${col(h.table, h.cohortKey)}`,
+                sql`${col(h.table, h.clientKey)}`,
+              ),
+            ),
+            {
+              limit: limit + 1,
+              takeOnly: true,
+              observe: false,
+              lock: false,
+              orderBy: asc(col(h.table, h.cohortKey)),
+            },
+          );
+
+    const t = mapping.ownership.tuple;
+
+    const tuples =
+      mapping.externalReference === undefined
+        ? { rows: [] }
+        : yield* owner.read(
+            t.table,
+            both(
+              eq(col(t.table, t.state), "Owned"),
+              sql`not (${connectedReferenceCondition(mapping, sql`${col(t.table, t.identityKey)}`, { provider: sql`${col(t.table, t.provider)}`, issuer: sql`${col(t.table, t.issuer)}` })})`,
+              sql`not (${mapping.externalReference({ identityKey: sql`${col(t.table, t.identityKey)}`, subjectId: sql`${col(t.table, t.subjectId)}` })})`,
+            ),
+            {
+              limit: limit + 1,
+              takeOnly: true,
+              observe: false,
+              lock: false,
+              orderBy: asc(col(t.table, t.identityKey)),
+            },
+          );
+
+    return { jobs: jobs.rows, grants: grants.rows, cohorts: cohorts.rows, tuples: tuples.rows };
+  });
+
+  const collect = Effect.fn("oauthConnected.collect")(function* (
+    mapping: STypes.Mapping,
+    moduleId: string,
+    limit: number,
+    discovered: Candidates,
+  ) {
+    const owner = yield* CurrentOAuthTransaction;
+
+    let visited = 0,
+      removed = 0,
+      hasMore = false;
+
+    if (limit === 0) return { visited, removed, hasMore: true };
+
+    const g = mapping.grant,
+      j = S.jobTable(mapping),
+      h = mapping.cohort;
+
+    if (j !== undefined) {
+      const candidates = { rows: discovered.jobs };
+
+      hasMore = candidates.rows.length > limit;
+      for (const candidate of candidates.rows.slice(0, limit)) {
+        visited++;
+
+        const job = S.jobStorage.decode(candidate[j.snapshot]),
+          token = job.context.token;
+
+        const client = yield* S.client(mapping, token.configuration, false);
+
+        invariant(client !== undefined);
+        const tuple = yield* F.inspectTuple(mapping, token.identity);
+        const cohort = yield* S.cohort(mapping, client.id, tuple.key, false);
+
+        invariant(cohort.row !== undefined);
+        const grant = yield* S.readGrant(mapping, token.moduleId, token.grantId);
+
+        const read = yield* owner.read(j.table, equal(j.table, { [j.jobId]: job.context.jobId }), {
+            limit: 1,
+          }),
+          row = read.rows[0];
+
+        if (row === undefined) continue;
+        const native = yield* mapping.subjectId.toNative(token.subjectId);
+
+        invariant(
+          row[j.snapshot] === S.jobStorage.encode(job) &&
+            row[j.moduleId] === moduleId &&
+            row[j.identityKey] === tuple.key &&
+            row[j.clientKey] === client.id &&
+            row[j.cohortKey] === cohort.id &&
+            row[j.grantId] === token.grantId &&
+            mapping.subjectId.equals(row[j.subjectId], native),
+        );
+
+        const now = yield* owner.now(mapping.clock),
+          until = mapping.clock.decodeInstant(row[j.retentionUntil]);
+
+        if (row[j.state] !== "Confirmed" || now < until) continue;
+        if (grant?.row[g.revocationJobId] === job.context.jobId) {
+          const summary = S.summaryStorage.decode(grant.row[g.summary]);
+
+          yield* owner.update(
+            g.table,
+            { [g.moduleId]: token.moduleId, [g.grantId]: token.grantId },
+            {
+              [g.revocationJobId]: null,
+              [g.summary]: S.summaryStorage.encode({ ...summary, remoteRevocation: "Confirmed" }),
+              [g.version]: owner.marker,
+            },
+          );
+        }
+        yield* owner.remove(j.table, {
+          [j.jobId]: job.context.jobId,
+          [j.state]: "Confirmed",
+          [j.version]: row[j.version],
+        });
+        owner.postconditions.push(sql`${mapping.clock.engineNowMillis} >= ${until}`);
+        removed++;
+      }
+    }
+    if (visited < limit) {
+      const candidates = { rows: discovered.grants };
+      const remaining = limit - visited;
+
+      if (candidates.rows.length > remaining) hasMore = true;
+      for (const candidate of candidates.rows.slice(0, remaining)) {
+        visited++;
+        const context = S.tokenContextStorage.decode(candidate[g.context]);
+        const client = yield* S.client(mapping, context.configuration, false);
+
+        invariant(client !== undefined);
+        const tuple = yield* F.inspectTuple(mapping, context.identity);
+        const cohort = yield* S.cohort(mapping, client.id, tuple.key, false);
+
+        invariant(cohort.row !== undefined);
+        const grant = yield* S.readGrant(mapping, moduleId, context.grantId);
+
+        if (grant === undefined) continue;
+
+        const now = yield* owner.now(mapping.clock),
+          until = mapping.clock.decodeInstant(grant.row[g.retentionUntil]);
+
+        if (
+          !["Disconnected", "ReauthorizationRequired"].includes(grant.row[g.state]) ||
+          grant.row[g.sealed] !== null ||
+          grant.row[g.refreshWork] === "Unresolved" ||
+          grant.row[g.revocationJobId] !== null ||
+          now < until
+        )
+          continue;
+
+        const a = mapping.admission,
+          d = mapping.command;
+
+        const references = both(
+          sql`not exists(select 1 from ${a.table} where ${equal(a.table, { [a.moduleId]: moduleId, [a.grantId]: context.grantId })})`,
+          sql`not exists(select 1 from ${d.table} where ${equal(d.table, { [d.moduleId]: moduleId, [d.grantId]: context.grantId })})`,
+          ...(j === undefined
+            ? []
+            : [
+                sql`not exists(select 1 from ${j.table} where ${equal(j.table, { [j.moduleId]: moduleId, [j.grantId]: context.grantId })})`,
+              ]),
+        );
+
+        if (!(yield* owner.check(references))) continue;
+        yield* owner.remove(g.table, {
+          [g.moduleId]: moduleId,
+          [g.grantId]: context.grantId,
+          [g.version]: grant.row[g.version],
+        });
+        owner.postconditions.push(references, sql`${mapping.clock.engineNowMillis} >= ${until}`);
+        removed++;
+      }
+    }
+    // Clearing is global remote authority, independent of the module which happens
+    // to run cleanup. No subject filter may hide a former owner's unresolved work.
+    if (visited < limit && j !== undefined) {
+      const candidates = { rows: discovered.cohorts };
+      const remaining = limit - visited;
+
+      if (candidates.rows.length > remaining) hasMore = true;
+      for (const candidate of candidates.rows.slice(0, remaining)) {
+        visited++;
+        const id = candidate[h.clientKey];
+        const client = yield* S.lockClientById(mapping, id);
+        const cohort = yield* S.cohort(mapping, id, candidate[h.identityKey], false);
+
+        invariant(cohort.id === candidate[h.cohortKey] && cohort.row !== undefined);
+        yield* C.clear(mapping, client, cohort);
+      }
+    }
+    if (visited < limit && mapping.externalReference !== undefined) {
+      const t = mapping.ownership.tuple,
+        remaining = limit - visited;
+
+      if (discovered.tuples.length > remaining) hasMore = true;
+      for (const candidate of discovered.tuples.slice(0, remaining)) {
+        visited++;
+        const scope = yield* S.heldScope(mapping, candidate[t.provider], candidate[t.issuer]);
+
+        if (scope === undefined) continue;
+
+        const identity = {
+          provider: candidate[t.provider],
+          issuer: candidate[t.issuer],
+          subject: candidate[t.externalSubject],
+        };
+
+        invariant((yield* oauthIdentityKey(identity)) === candidate[t.identityKey]);
+
+        const tuple = yield* F.inspectTuple(mapping, identity),
+          row = tuple.row;
+
+        if (row === undefined || row[t.state] !== "Owned") continue;
+        const native = row[t.subjectId];
+
+        invariant(native !== null);
+
+        const noRefs = both(
+          sql`not (${connectedReferenceCondition(mapping, tuple.key)})`,
+          sql`not (${mapping.externalReference({ identityKey: tuple.key, subjectId: S.nativeCopy(native) })})`,
+        );
+
+        if (!(yield* owner.check(noRefs))) continue;
+        yield* S.touchScope(mapping, scope);
+        yield* owner.update(
+          t.table,
+          { [t.identityKey]: tuple.key, [t.state]: "Owned", [t.subjectId]: native },
+          {
+            [t.state]: "Unowned",
+            [t.subjectId]: null,
+            [t.reservation]: null,
+            [t.version]: owner.marker,
+          },
+        );
+        if (mapping.ownership.mode === "separate")
+          yield* owner.remove(mapping.ownership.external.table, {
+            [mapping.ownership.external.identityKey]: tuple.key,
+          });
+        owner.postconditions.push(noRefs);
+      }
+    }
+
+    return { visited, removed, hasMore };
+  });
+
+  return { discover, collect };
+});
+
+export class OAuthConnectedCollection extends Context.Service<
+  OAuthConnectedCollection,
+  Effect.Success<typeof make>
+>()("effect-auth/persistence/OAuthConnectedCollection") {
+  static readonly layer = Layer.effect(OAuthConnectedCollection, make);
+}

package/src/internal/oauth/connected-custody.ts

@@ -0,0 +1,308 @@
+import * as M from "@yielded/auth/OAuth";
+import { snapshotOAuthSync } from "@yielded/auth/OAuth";
+import { Effect, Context, Layer } from "effect";
+
+import type { SqlExpression as SQL } from "../query-operations";
+import { OAuthConnectedState } from "./connected-state";
+import type * as STypes from "./connected-state";
+import { CurrentOAuthTransaction } from "./owner";
+import { OAuthQueryCompiler } from "./query-compiler";
+import { invariant, oauthIdentityKey } from "./state";
+
+type Client = NonNullable<Effect.Success<ReturnType<OAuthConnectedState["Service"]["client"]>>>;
+
+type Cohort = Effect.Success<ReturnType<OAuthConnectedState["Service"]["cohort"]>>;
+
+const make = Effect.gen(function* () {
+  const operations = yield* OAuthQueryCompiler;
+  const S = yield* OAuthConnectedState;
+
+  const { eq, isNotNull, ne, sql } = operations;
+  const { both, col, equal } = operations;
+
+  const sameContext = (a: M.OAuthConnectedTokenContext, b: M.OAuthConnectedTokenContext) =>
+    S.tokenContextStorage.encode(a) === S.tokenContextStorage.encode(b);
+
+  const sameGrant = (a: M.OAuthConnectedStoredGrant, b: M.OAuthConnectedStoredGrant) =>
+    S.grantStorage.encode(a) === S.grantStorage.encode(b);
+
+  const summary = (context: M.OAuthConnectedTokenContext) =>
+    snapshotOAuthSync(M.OAuthConnectedSummary, {
+      grantId: context.grantId,
+      provider: context.identity.provider,
+      issuer: context.identity.issuer,
+      profileKey: context.configuration.profile.key,
+      status: "Active",
+      scopes: context.metadata.scopes,
+      ...(context.metadata.accessExpiresAtMillis === undefined
+        ? {}
+        : { accessExpiresAtMillis: context.metadata.accessExpiresAtMillis }),
+      useUntilMillis: context.metadata.useUntilMillis,
+      ...(context.metadata.profile === undefined ? {} : { profile: context.metadata.profile }),
+      remoteRevocation:
+        context.configuration.profile.revocation === "cohort" ? "Pending" : "Unsupported",
+    });
+
+  /** A generation fences every sibling, including those beyond a bounded metadata page. */
+  const fence = Effect.fn("oauthConnected.fence")(function* (
+    mapping: STypes.Authority,
+    client: Client,
+    cohort: Cohort,
+  ) {
+    const owner = yield* CurrentOAuthTransaction;
+
+    invariant(cohort.row !== undefined);
+
+    const g = mapping.grant,
+      h = mapping.cohort;
+
+    const active = both(
+      eq(col(g.table, g.cohortKey), cohort.id),
+      isNotNull(col(g.table, g.activeIdentityKey)),
+    );
+
+    const affected = yield* S.rowCount(g.table, active);
+
+    invariant(yield* owner.check(S.countCondition(g.table, active, affected)));
+    const cutoff = yield* S.nextOrder(mapping, client);
+    const generation = M.OAuthConnectedTarget.fields.cohortGeneration.make(owner.marker);
+
+    yield* owner.update(
+      h.table,
+      { [h.cohortKey]: cohort.id },
+      {
+        [h.generation]: generation,
+        [h.cutoff]: mapping.order.encode(cutoff),
+        [h.state]: "Blocked",
+        [h.version]: owner.marker,
+      },
+    );
+    yield* owner.write(
+      owner.database
+        .update(g.table)
+        .set({
+          [g.activeIdentityKey]: null,
+          [g.state]: "ReauthorizationRequired",
+          [g.version]: owner.marker,
+        })
+        .where(active),
+    );
+    for (const observation of owner.observations)
+      if (observation.table === g.table)
+        observation.rows = observation.rows.map((row) =>
+          row[g.cohortKey] === cohort.id && row[g.activeIdentityKey] !== null
+            ? {
+                ...row,
+                [g.activeIdentityKey]: null,
+                [g.state]: "ReauthorizationRequired",
+                [g.version]: owner.marker,
+              }
+            : row,
+        );
+    owner.postconditions.push(sql`not exists(select 1 from ${g.table} where ${active})`);
+    cohort.generation = generation;
+    cohort.cutoff = cutoff;
+    cohort.blocked = true;
+
+    return affected;
+  });
+
+  const storeJob = Effect.fn("oauthConnected.storeJob")(function* (
+    mapping: STypes.Mapping,
+    job: M.OAuthConnectedRevocationJob,
+    token: M.OAuthConnectedTokenContext,
+    native: unknown,
+    now: number,
+  ) {
+    const owner = yield* CurrentOAuthTransaction;
+
+    invariant(
+      mapping.revocation.mode === "cohort" &&
+        token.configuration.profile.revocation === "cohort" &&
+        sameContext(job.context.token, token),
+    );
+
+    const j = mapping.revocation.job,
+      identity = yield* oauthIdentityKey(token.identity),
+      client = yield* S.clientKey(token.configuration),
+      cohort = yield* S.cohortKey(client, identity);
+
+    const h = mapping.cohort;
+
+    owner.postconditions.push(
+      sql`exists(select 1 from ${h.table} where ${both(equal(h.table, { [h.cohortKey]: cohort, [h.clientKey]: client, [h.identityKey]: identity, [h.state]: "Blocked" }))})`,
+    );
+    const key = { [j.jobId]: job.context.jobId };
+    const prior = yield* owner.read(j.table, equal(j.table, key), { limit: 1 });
+
+    if (prior.rows.length) {
+      const row = prior.rows[0]!;
+
+      invariant(
+        row[j.snapshot] === S.jobStorage.encode(job) &&
+          row[j.moduleId] === token.moduleId &&
+          mapping.subjectId.equals(row[j.subjectId], native) &&
+          row[j.identityKey] === identity &&
+          row[j.clientKey] === client &&
+          row[j.cohortKey] === cohort &&
+          row[j.grantId] === token.grantId &&
+          ["Pending", "Claimed", "Confirmed", "Unknown"].includes(row[j.state]),
+      );
+      invariant(
+        row[j.state] === "Pending"
+          ? row[j.claimId] === null && row[j.claimedAt] === null && row[j.claimExpiresAt] === null
+          : typeof row[j.claimId] === "string" &&
+              mapping.clock.decodeInstant(row[j.claimExpiresAt]) >
+                mapping.clock.decodeInstant(row[j.claimedAt]),
+      );
+
+      return;
+    }
+
+    const inserted = yield* owner.insert(
+      j.table,
+      {
+        ...j.encodeInsert({
+          job: snapshotOAuthSync(M.OAuthConnectedRevocationJob, job),
+          subjectId: S.nativeCopy(native),
+        }),
+        ...key,
+        [j.moduleId]: token.moduleId,
+        [j.subjectId]: native,
+        [j.identityKey]: identity,
+        [j.clientKey]: client,
+        [j.cohortKey]: cohort,
+        [j.grantId]: token.grantId,
+        [j.snapshot]: S.jobStorage.encode(job),
+        [j.state]: "Pending",
+        [j.claimId]: null,
+        [j.claimedAt]: null,
+        [j.claimExpiresAt]: null,
+        [j.retentionUntil]: mapping.clock.encodeInstant(S.retainedUntil(mapping, now)),
+        [j.version]: owner.marker,
+      },
+      key,
+    );
+
+    prior.rows = inserted.rows;
+  });
+
+  const noJobs = (mapping: STypes.Authority, id: string | SQL, except?: string) => {
+    const j = S.jobTable(mapping);
+
+    return j === undefined
+      ? sql`1 = 1`
+      : sql`not exists(select 1 from ${j.table} where ${both(eq(col(j.table, j.cohortKey), id), ne(col(j.table, j.state), "Confirmed"), except === undefined ? undefined : ne(col(j.table, j.jobId), except))})`;
+  };
+
+  const clearableCondition = (
+    mapping: STypes.Authority,
+    cohortId: string | SQL,
+    clientId: string | SQL,
+  ) => {
+    const f = mapping.flow;
+
+    return both(
+      sql`not exists(select 1 from ${f.table} where ${S.unknownWork(mapping, clientId)})`,
+      S.cohortWork(mapping, cohortId),
+      noJobs(mapping, cohortId),
+    );
+  };
+
+  /** Clearing owns a NEW cutoff. Claims made while the remote revoke was pending
+   * cannot enter the next generation even if they finish after that revoke. */
+  const clear = Effect.fn("oauthConnected.clear")(function* (
+    mapping: STypes.Authority,
+    client: Client,
+    cohort: Cohort,
+    confirmedJob?: string,
+    provenOpenWithoutNewJob = false,
+  ) {
+    const owner = yield* CurrentOAuthTransaction;
+
+    if (
+      !cohort.blocked ||
+      cohort.row === undefined ||
+      (S.jobTable(mapping) === undefined && !provenOpenWithoutNewJob)
+    )
+      return false;
+    const f = mapping.flow;
+    const noUnknown = sql`not exists(select 1 from ${f.table} where ${S.unknownWork(mapping, client.id)})`;
+    const work = S.cohortWork(mapping, cohort.id);
+
+    if (!(yield* owner.check(both(noUnknown, work, noJobs(mapping, cohort.id, confirmedJob)))))
+      return false;
+
+    const cutoff = yield* S.nextOrder(mapping, client),
+      h = mapping.cohort;
+
+    const generation = M.OAuthConnectedTarget.fields.cohortGeneration.make(owner.marker + ":open");
+
+    yield* owner.update(
+      h.table,
+      { [h.cohortKey]: cohort.id },
+      {
+        [h.generation]: generation,
+        [h.cutoff]: mapping.order.encode(cutoff),
+        [h.state]: "Open",
+        [h.version]: owner.marker,
+      },
+    );
+    owner.postconditions.push(noUnknown, work, noJobs(mapping, cohort.id));
+    cohort.generation = generation;
+    cohort.cutoff = cutoff;
+    cohort.blocked = false;
+
+    return true;
+  });
+
+  /** Former local owners remain visible. A foreign historical dependency cannot be
+   * ignored simply because the global tuple was changed outside this authority. */
+  const noFormerOwner = (
+    mapping: STypes.Authority,
+    identity: string,
+    client: string,
+    native: unknown,
+  ) =>
+    Effect.gen(function* () {
+      const owner = yield* CurrentOAuthTransaction;
+
+      const g = mapping.grant,
+        f = mapping.flow,
+        j = S.jobTable(mapping);
+
+      const condition = both(
+        sql`not exists(select 1 from ${g.table} where ${both(eq(col(g.table, g.identityKey), identity), sql`not (${owner.exact(g.table, { [g.subjectId]: native })})`)})`,
+        sql`not exists(select 1 from ${f.table} where ${both(eq(col(f.table, f.cohortKey), yield* S.cohortKey(client, identity)), eq(col(f.table, f.work), "Unresolved"), sql`not (${owner.exact(f.table, { [f.subjectId]: native })})`)})`,
+        ...(j === undefined
+          ? []
+          : [
+              sql`not exists(select 1 from ${j.table} where ${both(eq(col(j.table, j.identityKey), identity), sql`not (${owner.exact(j.table, { [j.subjectId]: native })})`)})`,
+            ]),
+      );
+
+      return yield* Effect.map(owner.check(condition), (accepted) => {
+        if (accepted) owner.postconditions.push(condition);
+
+        return accepted;
+      });
+    });
+
+  return {
+    sameContext,
+    sameGrant,
+    summary,
+    fence,
+    storeJob,
+    clearableCondition,
+    clear,
+    noFormerOwner,
+  };
+});
+
+export class OAuthConnectedCustody extends Context.Service<
+  OAuthConnectedCustody,
+  Effect.Success<typeof make>
+>()("effect-auth/persistence/OAuthConnectedCustody") {
+  static readonly layer = Layer.effect(OAuthConnectedCustody, make);
+}