@yielded/auth-persistence 0.1.0-beta.23 → 0.1.0-beta.25

package/src/internal/oauth/connected-management.ts

@@ -0,0 +1,391 @@
+import * as M from "@yielded/auth/OAuth";
+import { snapshotOAuthSync } from "@yielded/auth/OAuth";
+import { Effect, Context, Layer } from "effect";
+
+import { OAuthConnectedAccess } from "./connected-access";
+import { OAuthConnectedCustody } from "./connected-custody";
+import { OAuthConnectedFlow } from "./connected-flow";
+import type * as FTypes from "./connected-flow";
+import { OAuthConnectedState } from "./connected-state";
+import type * as STypes from "./connected-state";
+import { CurrentOAuthTransaction } from "./owner";
+import { OAuthQueryCompiler } from "./query-compiler";
+import { digest, invariant } from "./state";
+
+const make = Effect.gen(function* () {
+  const operations = yield* OAuthQueryCompiler;
+  const A = yield* OAuthConnectedAccess;
+  const C = yield* OAuthConnectedCustody;
+  const F = yield* OAuthConnectedFlow;
+  const S = yield* OAuthConnectedState;
+
+  const { asc, eq, gt, lte } = operations;
+  const { both, col, equal } = operations;
+
+  const list = Effect.fn("oauthConnected.list")(function* (
+    mapping: STypes.Mapping,
+    input: FTypes.Input<"list">,
+  ) {
+    const owner = yield* CurrentOAuthTransaction;
+    const found = yield* S.useAuthority(mapping, input.authorization, "metadata");
+
+    if (found === undefined) return { items: [] };
+    invariant(Number.isSafeInteger(input.limit) && input.limit >= 1 && input.limit <= 100);
+
+    const g = mapping.grant,
+      h = mapping.cohort,
+      j = S.jobTable(mapping);
+
+    const cursor = input.cursor === undefined ? undefined : M.OAuthGrantId.make(input.cursor);
+
+    const where = both(
+      equal(g.table, { [g.moduleId]: input.authorization.moduleId, [g.subjectId]: found.nativeId }),
+      cursor === undefined ? undefined : gt(col(g.table, g.grantId), cursor),
+      input.authorization.grantId === undefined
+        ? undefined
+        : eq(col(g.table, g.grantId), input.authorization.grantId),
+      input.authorization.profileKey === undefined
+        ? undefined
+        : eq(col(g.table, g.profileKey), input.authorization.profileKey),
+    );
+
+    const columns = [
+      g.moduleId,
+      g.grantId,
+      g.subjectId,
+      g.identityKey,
+      g.clientKey,
+      g.cohortKey,
+      g.cohortGeneration,
+      g.profileKey,
+      g.state,
+      g.summary,
+      g.revocationJobId,
+      g.version,
+    ];
+
+    const read = yield* owner.read(g.table, where, {
+      columns,
+      limit: input.limit + 1,
+      takeOnly: true,
+      observe: false,
+      lock: false,
+      orderBy: asc(col(g.table, g.grantId)),
+    });
+
+    const more = read.rows.length > input.limit,
+      rows = read.rows.slice(0, input.limit),
+      last = rows.at(-1)?.[g.grantId];
+
+    owner.observations.push({
+      table: g.table,
+      where: more ? both(where, lte(col(g.table, g.grantId), last)) : where,
+      rows,
+    });
+    const items: Array<typeof M.OAuthConnectedSummary.Type> = [];
+
+    for (const row of rows) {
+      const summary = S.summaryStorage.decode(row[g.summary]);
+
+      invariant(
+        summary.grantId === row[g.grantId] &&
+          summary.profileKey === row[g.profileKey] &&
+          mapping.subjectId.equals(found.nativeId, row[g.subjectId]),
+      );
+
+      const co = yield* owner.read(h.table, equal(h.table, { [h.cohortKey]: row[g.cohortKey] }), {
+        limit: 1,
+        lock: false,
+      });
+
+      const cr = co.rows[0];
+
+      invariant(
+        cr !== undefined &&
+          cr[h.clientKey] === row[g.clientKey] &&
+          cr[h.identityKey] === row[g.identityKey],
+      );
+      let status = row[g.state] as (typeof M.OAuthConnectedSummary.Type)["status"];
+
+      if (
+        status !== "Disconnected" &&
+        (cr[h.state] !== "Open" || cr[h.generation] !== row[g.cohortGeneration])
+      )
+        status = "ReauthorizationRequired";
+      let remote = summary.remoteRevocation;
+
+      if (row[g.revocationJobId] !== null) {
+        if (j === undefined) remote = "Unknown";
+        else {
+          const job = yield* owner.read(
+            j.table,
+            equal(j.table, { [j.jobId]: row[g.revocationJobId] }),
+            {
+              limit: 1,
+              lock: false,
+              columns: [j.jobId, j.moduleId, j.grantId, j.cohortKey, j.state],
+            },
+          );
+
+          const jr = job.rows[0];
+
+          invariant(
+            jr !== undefined &&
+              jr[j.moduleId] === row[g.moduleId] &&
+              jr[j.grantId] === row[g.grantId] &&
+              jr[j.cohortKey] === row[g.cohortKey],
+          );
+          remote =
+            jr[j.state] === "Confirmed"
+              ? "Confirmed"
+              : jr[j.state] === "Unknown"
+                ? "Unknown"
+                : "Pending";
+        }
+      }
+      items.push(
+        snapshotOAuthSync(M.OAuthConnectedSummary, {
+          ...summary,
+          status,
+          remoteRevocation: remote,
+        }),
+      );
+    }
+
+    return { items, ...(more ? { cursor: last as string } : {}) };
+  });
+
+  const command = Effect.fn("oauthConnected.disconnectCommand")(function* (
+    mapping: STypes.Mapping,
+    moduleId: string,
+    commandId: string,
+    lock = true,
+  ) {
+    const owner = yield* CurrentOAuthTransaction;
+
+    const d = mapping.command,
+      read = yield* owner.read(
+        d.table,
+        equal(d.table, { [d.moduleId]: moduleId, [d.commandId]: commandId }),
+        { limit: 1, lock, observe: lock },
+      );
+
+    const row = read.rows[0];
+
+    if (row === undefined) return { read };
+
+    const grant = S.commandStorage.decode(row[d.intent]),
+      result = S.disconnectedStorage.decode(row[d.decision]);
+
+    const native = yield* mapping.subjectId.toNative(grant.context.subjectId);
+
+    invariant(
+      grant.context.moduleId === moduleId &&
+        grant.context.grantId === row[d.grantId] &&
+        result.grantId === grant.context.grantId &&
+        mapping.subjectId.equals(native, row[d.subjectId]) &&
+        !result.replayed,
+    );
+
+    return { read, row, grant, result };
+  });
+
+  const inspectDisconnect = Effect.fn("oauthConnected.inspectDisconnect")(function* (
+    mapping: STypes.Mapping,
+    input: FTypes.Input<"inspectDisconnect">,
+  ) {
+    const found = yield* S.useAuthority(mapping, input.authorization, "metadata");
+
+    if (
+      found === undefined ||
+      input.subjectId !== found.revision.subjectId ||
+      input.moduleId !== input.authorization.moduleId
+    )
+      return { _tag: "Rejected" } as const;
+    const discovered = yield* command(mapping, input.moduleId, input.commandId, false);
+
+    if (discovered.row !== undefined) {
+      if (
+        discovered.grant.context.subjectId !== input.subjectId ||
+        discovered.grant.context.grantId !== input.grantId
+      )
+        return { _tag: "Conflict" } as const;
+      if (
+        (yield* S.useAuthority(
+          mapping,
+          input.authorization,
+          "metadata",
+          discovered.grant.context,
+        )) === undefined
+      )
+        return { _tag: "Rejected" } as const;
+      const prior = yield* command(mapping, input.moduleId, input.commandId);
+      const d = mapping.command;
+
+      if (
+        prior.row === undefined ||
+        prior.row[d.intent] !== discovered.row[d.intent] ||
+        prior.row[d.decision] !== discovered.row[d.decision] ||
+        prior.row[d.version] !== discovered.row[d.version]
+      )
+        return { _tag: "Rejected" } as const;
+
+      return { _tag: "Replay", result: { ...prior.result, replayed: true } } as const;
+    }
+    const read = yield* A.locked(mapping, input.authorization, input.grantId, "metadata");
+
+    if (read === undefined) return { _tag: "Rejected" } as const;
+    const finalCommand = yield* command(mapping, input.moduleId, input.commandId);
+
+    if (finalCommand.row !== undefined) return { _tag: "Rejected" } as const;
+
+    return {
+      _tag: "Target",
+      grant: {
+        context: read.grant.context,
+        ...(read.grant.sealed === undefined ? {} : { sealed: read.grant.sealed }),
+      },
+      revision: read.found.revision,
+    } as const;
+  });
+
+  const disconnect = Effect.fn("oauthConnected.disconnect")(function* (
+    mapping: STypes.Mapping,
+    input: FTypes.Input<"disconnect">,
+  ) {
+    const owner = yield* CurrentOAuthTransaction;
+
+    const token = input.grant.context,
+      found = yield* S.current(mapping, token.subjectId);
+
+    if (
+      found === undefined ||
+      input.moduleId !== token.moduleId ||
+      !(yield* S.action(mapping, found, input.authorization, "disconnect", {
+        moduleId: input.moduleId,
+        flowId: input.commandId,
+        commandId: input.commandId,
+        revision: input.authorization.challenge.revision,
+        intent: S.disconnectStorage.encode(input.grant),
+        maximumAgeMillis: 300000,
+        configuration: token.configuration,
+        grant: token,
+      }))
+    )
+      return { _tag: "Rejected" } as const;
+    const client = yield* S.client(mapping, token.configuration, false);
+
+    if (client === undefined) return { _tag: "Rejected" } as const;
+
+    const tuple = yield* F.inspectTuple(mapping, token.identity),
+      t = mapping.ownership.tuple;
+
+    if (
+      tuple.row?.[t.state] !== "Owned" ||
+      !mapping.subjectId.equals(tuple.row[t.subjectId], found.nativeId)
+    )
+      return { _tag: "Conflict" } as const;
+    const cohort = yield* S.cohort(mapping, client.id, tuple.key, false);
+
+    invariant(cohort.row !== undefined);
+
+    const read = yield* S.readGrant(mapping, input.moduleId, token.grantId),
+      g = mapping.grant;
+
+    if (
+      read === undefined ||
+      !C.sameContext(read.context, token) ||
+      S.disconnectStorage.encode({
+        context: read.context,
+        ...(read.sealed === undefined ? {} : { sealed: read.sealed }),
+      }) !== S.disconnectStorage.encode(input.grant)
+    )
+      return { _tag: "Conflict" } as const;
+    const prior = yield* command(mapping, input.moduleId, input.commandId);
+
+    // Only inspectDisconnect exposes replay. Mutation replay cannot repeat effects.
+    if (prior.row !== undefined) return { _tag: "Conflict" } as const;
+
+    const now = yield* owner.now(mapping.clock),
+      wasOpen = !cohort.blocked;
+
+    invariant(input.retentionUntilMillis >= now && input.retentionUntilMillis <= now + 2592000000);
+    const affected = yield* C.fence(mapping, client, cohort);
+    let remote: (typeof M.OAuthConnectedSummary.Type)["remoteRevocation"] = "Unsupported";
+
+    if (input.revocation !== undefined) {
+      yield* C.storeJob(mapping, input.revocation, token, found.nativeId, now);
+      remote = "Pending";
+    } else if (token.configuration.profile.revocation === "cohort") {
+      invariant(read.sealed === undefined);
+      remote = "Unknown";
+    }
+
+    const result = snapshotOAuthSync(M.OAuthConnectedDisconnected, {
+      _tag: "Disconnected",
+      grantId: token.grantId,
+      remoteRevocation: remote,
+      affectedGrantCount: affected,
+      replayed: false,
+    });
+
+    yield* owner.update(
+      g.table,
+      { [g.moduleId]: input.moduleId, [g.grantId]: token.grantId },
+      {
+        [g.state]: "Disconnected",
+        [g.activeIdentityKey]: null,
+        [g.sealed]: null,
+        [g.revocationJobId]: input.revocation?.context.jobId ?? read.row[g.revocationJobId],
+        [g.version]: owner.marker,
+      },
+    );
+
+    const d = mapping.command,
+      key = { [d.moduleId]: input.moduleId, [d.commandId]: input.commandId };
+
+    const inserted = yield* owner.insert(
+      d.table,
+      {
+        ...d.encodeInsert({
+          commandId: input.commandId,
+          grant: snapshotOAuthSync(M.OAuthConnectedDisconnectGrant, input.grant),
+          subjectId: S.nativeCopy(found.nativeId),
+        }),
+        ...key,
+        [d.subjectId]: found.nativeId,
+        [d.grantId]: token.grantId,
+        [d.intent]: S.commandStorage.encode({
+          context: token,
+          originalDigest: yield* digest(S.disconnectStorage.encode(input.grant)),
+          ...(input.revocation === undefined
+            ? {}
+            : { revocationJobId: input.revocation.context.jobId }),
+        }),
+        [d.decision]: S.disconnectedStorage.encode(result),
+        [d.retentionUntil]: mapping.clock.encodeInstant(input.retentionUntilMillis),
+        [d.version]: owner.marker,
+      },
+      key,
+    );
+
+    prior.read.rows = inserted.rows;
+    if (
+      wasOpen &&
+      input.revocation === undefined &&
+      token.configuration.profile.revocation === "unsupported"
+    )
+      yield* C.clear(mapping, client, cohort, undefined, true);
+
+    return result;
+  });
+
+  return { list, inspectDisconnect, disconnect };
+});
+
+export class OAuthConnectedManagement extends Context.Service<
+  OAuthConnectedManagement,
+  Effect.Success<typeof make>
+>()("effect-auth/persistence/OAuthConnectedManagement") {
+  static readonly layer = Layer.effect(OAuthConnectedManagement, make);
+}

package/src/internal/oauth/connected-reference.ts

@@ -0,0 +1,135 @@
+import { Effect } from "effect";
+
+import type { OAuthConnectedMapping } from "../models/oauth-connected-model";
+import {
+  oauthReferenceGuardTable,
+  type OAuthReferenceGuardDescriptor,
+} from "../models/oauth-model";
+/* oxlint-disable no-explicit-any -- only adapter SQL expression handles are erased. */
+import type { SqlExpression as SQL } from "../query-operations";
+import type { QueryOperations } from "../query-operations";
+import type { TableModel } from "../query-operations";
+import { makeTransactionKernel } from "../transaction-kernel";
+import { scopeKey } from "./connected-keys";
+import type { Mapping } from "./connected-state";
+import { unavailable, captureOAuthMapping } from "./state";
+type Table = object;
+
+export const makeOAuthConnectedReferenceKernel = (
+  operations: QueryOperations,
+  dialect: (table: object) => "pg" | "sqlite" | "mysql",
+) => {
+  const { eq, sql } = operations;
+  const transactions = makeTransactionKernel(operations);
+  const { both } = transactions;
+  const { col, equal } = transactions.makeTransactionRows(unavailable);
+
+  const exactText = (table: Table, key: string, value: string) => {
+    const column = col(table, key),
+      bound = sql.param(value, column);
+
+    return dialect(table) === "mysql"
+      ? sql`binary ${column} = binary ${bound}`
+      : dialect(table) === "pg"
+        ? sql`convert_to(cast(${column} as text),'UTF8') = convert_to(cast(${bound} as text),'UTF8')`
+        : sql`cast(${column} as blob) = cast(${bound} as blob)`;
+  };
+
+  /** Compose Accounts.Unlink with this connected authority. The stable scope lock
+   * serializes unknown claims across every client registration for an issuer. */
+  const oauthConnectedOwnershipReferences = <
+    S extends TableModel,
+    AC extends TableModel,
+    T extends TableModel,
+    O extends TableModel,
+    F extends TableModel,
+    G extends TableModel,
+    C extends TableModel,
+    H extends TableModel,
+    A extends TableModel,
+    D extends TableModel,
+    N,
+    J extends TableModel,
+  >(
+    original: OAuthConnectedMapping<S, AC, T, O, F, G, C, H, A, D, N, J, any>,
+  ): {
+    readonly connectedReferenceGuards: ReadonlyArray<OAuthReferenceGuardDescriptor<N>>;
+    readonly connectedReference: (input: {
+      readonly identityKey: string;
+      readonly subjectId: N;
+    }) => SQL;
+  } => {
+    const mapping = captureOAuthMapping(original),
+      c = mapping.client;
+
+    return Object.freeze({
+      connectedReferenceGuards: [
+        oauthReferenceGuardTable<C, N>({
+          table: c.table,
+          orderBy: c.clientKey,
+          condition: (input) =>
+            Effect.gen(function* () {
+              const key = yield* scopeKey(input.identity.provider, input.identity.issuer);
+
+              return both(
+                equal(c.table, {
+                  [c.clientKey]: key,
+                  [c.counter]: mapping.order.encode(0),
+                }),
+                exactText(c.table, c.provider, input.identity.provider),
+                exactText(c.table, c.issuer, input.identity.issuer),
+                exactText(c.table, c.clientRegistrationId, ""),
+              );
+            }),
+        }),
+      ],
+      connectedReference: (input) => connectedReferenceCondition(mapping, input.identityKey),
+    });
+  };
+
+  const connectedReferenceCondition = (
+    mapping: Mapping,
+    identityKey: string | SQL,
+    knownIdentity?: { readonly provider: string | SQL; readonly issuer: string | SQL },
+  ) => {
+    const c = mapping.client,
+      t = mapping.ownership.tuple,
+      f = mapping.flow,
+      g = mapping.grant,
+      h = mapping.cohort,
+      a = mapping.admission,
+      j = mapping.revocation.mode === "cohort" ? mapping.revocation.job : undefined;
+
+    const tuple = equal(t.table, { [t.identityKey]: identityKey });
+    const knownFlow = sql`exists(select 1 from ${h.table} where ${col(h.table, h.cohortKey)} = ${col(f.table, f.cohortKey)} and ${col(h.table, h.identityKey)} = ${identityKey})`;
+
+    const unknownFlow =
+      knownIdentity === undefined
+        ? sql`${col(f.table, f.cohortKey)} is null and exists(select 1 from ${c.table} where ${col(c.table, c.clientKey)} = ${col(f.table, f.clientKey)} and exists(select 1 from ${t.table} where ${tuple} and ${col(c.table, c.provider)} = ${col(t.table, t.provider)} and ${col(c.table, c.issuer)} = ${col(t.table, t.issuer)}))`
+        : sql`${col(f.table, f.cohortKey)} is null and exists(select 1 from ${c.table} where ${col(c.table, c.clientKey)} = ${col(f.table, f.clientKey)} and ${col(c.table, c.provider)} = ${knownIdentity.provider} and ${col(c.table, c.issuer)} = ${knownIdentity.issuer})`;
+
+    const related = [f, g, h, ...(j === undefined ? [] : [j])];
+
+    return sql`(${sql.join(
+      [
+        sql`exists(select 1 from ${g.table} where ${eq(col(g.table, g.identityKey), identityKey)})`,
+        sql`exists(select 1 from ${a.table} where ${eq(col(a.table, a.identityKey), identityKey)})`,
+        sql`exists(select 1 from ${h.table} where ${both(eq(col(h.table, h.identityKey), identityKey), eq(col(h.table, h.state), "Blocked"))})`,
+        sql`exists(select 1 from ${f.table} where ${col(f.table, f.work)} = 'Unresolved' and (${knownFlow} or (${unknownFlow})))`,
+        ...(j === undefined
+          ? []
+          : [
+              sql`exists(select 1 from ${j.table} where ${eq(col(j.table, j.identityKey), identityKey)})`,
+            ]),
+        // A missing real client cannot turn erased unknown work into absence.
+        ...related.map(
+          (v) =>
+            sql`exists(select 1 from ${v.table} where not exists(select 1 from ${c.table} where ${col(c.table, c.clientKey)} = ${col(v.table, v.clientKey)}))`,
+        ),
+      ],
+      sql` or `,
+    )})`;
+  };
+
+  return { oauthConnectedOwnershipReferences, connectedReferenceCondition };
+};