@yielded/auth-persistence 0.1.0-beta.23 → 0.1.0-beta.25

package/src/internal/oauth/connected-sign-in.ts

@@ -0,0 +1,472 @@
+import * as M from "@yielded/auth/OAuth";
+import { snapshotOAuthSync } from "@yielded/auth/OAuth";
+import { Effect, Schema, Context, Layer } from "effect";
+
+import { OAuthConnectedCustody } from "./connected-custody";
+import { OAuthConnectedFlow } from "./connected-flow";
+import type * as FTypes from "./connected-flow";
+import { OAuthConnectedSettlement } from "./connected-settlement";
+import { OAuthConnectedState } from "./connected-state";
+import type * as STypes from "./connected-state";
+import { OAuthFlow } from "./flow";
+import { CurrentOAuthTransaction } from "./owner";
+import { OAuthQueryCompiler } from "./query-compiler";
+import {
+  digest,
+  invariant,
+  oauthIdentityKey,
+  sameIdentity,
+  sameRevision,
+  storage,
+  unavailable,
+} from "./state";
+
+const make = Effect.gen(function* () {
+  const operations = yield* OAuthQueryCompiler;
+  const C = yield* OAuthConnectedCustody;
+  const F = yield* OAuthConnectedFlow;
+  const connectedSettlement = yield* OAuthConnectedSettlement;
+  const S = yield* OAuthConnectedState;
+  const flow = yield* OAuthFlow;
+
+  const { sql } = operations;
+  const { activateGrant, validMetadata } = connectedSettlement;
+  const { exactClaim } = flow;
+  const { both, equal } = operations;
+
+  const reservationStorage = storage(M.OAuthSignInAccessClaim);
+
+  const configurationStorage = storage(M.OAuthConnectedConfiguration);
+
+  /** Reservation rows share the connected-work ledger, but have no browser
+   * snapshot or subject. They can never enter the authenticated connect flow. */
+  const claimSignIn = Effect.fn("oauthConnected.claimSignIn")(function* (
+    mapping: STypes.Mapping,
+    input: FTypes.Input<"claimSignIn">,
+  ) {
+    const owner = yield* CurrentOAuthTransaction;
+    const signIn = mapping.signIn;
+    const encode = mapping.flow.encodeSignIn;
+
+    if (signIn === undefined || encode === undefined) return yield* unavailable();
+    const { claim, configuration } = input;
+    const c = claim.flow.context;
+
+    invariant(
+      c.access !== undefined &&
+        configurationStorage.encode(configuration) ===
+          configurationStorage.encode({ ...c, profile: c.access }),
+    );
+    if (configuration.profile.revocation === "cohort")
+      invariant(mapping.revocation.mode === "cohort");
+    const client = yield* S.client(mapping, configuration, true);
+
+    invariant(client !== undefined);
+    const exact = yield* exactClaim({ ...mapping, flow: signIn.flow }, claim, "sign-in");
+
+    if (exact === undefined) return yield* unavailable();
+    const f = mapping.flow;
+    const key = { [f.moduleId]: c.moduleId, [f.flowId]: c.flowId };
+    const prior = yield* owner.read(f.table, equal(f.table, key), { limit: 1 });
+
+    const command = yield* owner.read(
+      f.table,
+      equal(f.table, { [f.moduleId]: c.moduleId, [f.commandId]: c.commandId }),
+      { limit: 1 },
+    );
+
+    if (prior.rows.length || command.rows.length) return yield* unavailable();
+    yield* S.touchScope(mapping, client.scope);
+    const order = yield* S.nextOrder(mapping, client);
+
+    const reservation = snapshotOAuthSync(M.OAuthSignInAccessClaim, {
+      claim,
+      configuration,
+      order: String(order),
+    });
+
+    const inserted = yield* owner.insert(
+      f.table,
+      {
+        ...encode(reservation),
+        ...key,
+        [f.commandId]: c.commandId,
+        [f.subjectId]: null,
+        [f.clientKey]: client.id,
+        [f.cohortKey]: null,
+        [f.state]: "Claimed",
+        [f.version]: owner.marker,
+        [f.stateDigest]: c.stateDigest,
+        [f.snapshot]: null,
+        [f.claimId]: claim.claimId,
+        [f.claimDigest]: yield* digest(reservationStorage.encode(reservation)),
+        [f.claimOrder]: mapping.order.encode(order),
+        [f.claimedAt]: mapping.clock.encodeInstant(claim.claimedAtMillis),
+        [f.claimExpiresAt]: mapping.clock.encodeInstant(claim.claimExpiresAtMillis),
+        [f.expiresAt]: mapping.clock.encodeInstant(c.expiresAtMillis),
+        [f.retentionUntil]: mapping.clock.encodeInstant(claim.flow.retentionUntilMillis),
+        [f.work]: "Unresolved",
+        [f.custody]: null,
+      },
+      key,
+    );
+
+    prior.rows = inserted.rows;
+    command.rows = inserted.rows;
+
+    return reservation;
+  });
+
+  const exact = Effect.fn("oauthConnected.exactSignIn")(function* (
+    mapping: STypes.Mapping,
+    reservation: M.OAuthSignInAccessClaim,
+  ) {
+    const owner = yield* CurrentOAuthTransaction;
+    const f = mapping.flow;
+    const c = reservation.claim.flow.context;
+    const key = { [f.moduleId]: c.moduleId, [f.flowId]: c.flowId };
+    const read = yield* owner.read(f.table, equal(f.table, key), { limit: 1 });
+    const row = read.rows[0];
+
+    if (
+      row === undefined ||
+      row[f.work] !== "Unresolved" ||
+      row[f.claimId] !== reservation.claim.claimId ||
+      row[f.claimDigest] !== (yield* digest(reservationStorage.encode(reservation)))
+    )
+      return undefined;
+    invariant(
+      row[f.subjectId] === null &&
+        row[f.commandId] === c.commandId &&
+        row[f.clientKey] === (yield* S.clientKey(reservation.configuration)) &&
+        S.nativeOrder(mapping, row[f.claimOrder]) === S.orderNumber(reservation.order),
+    );
+    const now = yield* owner.now(mapping.clock);
+
+    invariant(now >= reservation.claim.claimedAtMillis);
+
+    return {
+      key,
+      row,
+      now,
+      active: row[f.state] === "Claimed" && now < reservation.claim.claimExpiresAtMillis,
+    };
+  });
+
+  const credential = Effect.fn("oauthConnected.signInCredential")(function* (
+    mapping: STypes.Mapping,
+    reservation: M.OAuthSignInAccessClaim,
+    input: M.OAuthCredentialSnapshot,
+  ) {
+    const owner = yield* CurrentOAuthTransaction;
+    const signIn = mapping.signIn;
+
+    if (signIn === undefined) return undefined;
+    const context = reservation.claim.flow.context;
+
+    if (
+      input.moduleId !== context.moduleId ||
+      input.identity.provider !== context.provider ||
+      input.identity.issuer !== context.issuer
+    )
+      return undefined;
+    const found = yield* S.current(mapping, input.revision.subjectId);
+
+    if (found === undefined || !sameRevision(found.revision, input.revision)) return undefined;
+    const c = signIn.credential;
+
+    const loginWhere = both(
+      equal(c.table, {
+        [c.moduleId]: context.moduleId,
+        [c.credentialId]: input.credentialId,
+        [c.subjectId]: found.nativeId,
+        [c.identityKey]: yield* oauthIdentityKey(input.identity),
+        [c.credentialRevision]: input.credentialRevision,
+      }),
+      c.activeCondition,
+    );
+
+    const login = yield* owner.read(c.table, loginWhere, { limit: 1 });
+
+    if (login.rows.length !== 1 || !c.isActiveStatus(login.rows[0]![c.status])) return undefined;
+    const f = signIn.flow;
+
+    const verifiedWhere = equal(f.table, {
+      [f.moduleId]: context.moduleId,
+      [f.flowId]: context.flowId,
+      [f.state]: "Verified",
+      [f.claimId]: reservation.claim.claimId,
+      [f.stateDigest]: context.stateDigest,
+      [f.claimedAt]: mapping.clock.encodeInstant(reservation.claim.claimedAtMillis),
+      [f.claimExpiresAt]: mapping.clock.encodeInstant(reservation.claim.claimExpiresAtMillis),
+    });
+
+    const verified = yield* owner.read(f.table, verifiedWhere, { limit: 1 });
+
+    if (verified.rows.length !== 1) return undefined;
+    owner.postconditions.push(
+      sql`exists(select 1 from ${c.table} where ${loginWhere})`,
+      sql`exists(select 1 from ${f.table} where ${verifiedWhere})`,
+    );
+    if (
+      !(yield* S.policy(mapping, {
+        kind: "sign-in",
+        subjectId: found.nativeId,
+        revision: found.revision,
+        credential: snapshotOAuthSync(M.OAuthCredentialSnapshot, input),
+        configuration: reservation.configuration,
+      }))
+    )
+      return undefined;
+
+    return found;
+  });
+
+  const slot = Effect.fn("oauthConnected.signInSlot")(function* (
+    mapping: STypes.Mapping,
+    moduleId: string,
+    native: unknown,
+    identityKey: string,
+    profileKey: string,
+  ) {
+    const owner = yield* CurrentOAuthTransaction;
+    const g = mapping.grant;
+
+    const rows = yield* owner.read(
+      g.table,
+      equal(g.table, {
+        [g.moduleId]: moduleId,
+        [g.subjectId]: native,
+        [g.profileKey]: profileKey,
+        [g.activeIdentityKey]: identityKey,
+      }),
+      { limit: 1, admissionOnly: true },
+    );
+
+    const row = rows.rows[0];
+
+    if (row === undefined) return undefined;
+
+    return yield* S.readGrant(
+      mapping,
+      moduleId,
+      yield* Schema.decodeUnknownEffect(M.OAuthGrantId)(row[g.grantId]).pipe(
+        Effect.mapError(unavailable),
+      ),
+    );
+  });
+
+  /** Orders belong to one client registration. Moving a profile to another client
+   * requires a newer profile generation; retired clients cannot replace it later. */
+  const canReplace = Effect.fnUntraced(function* (
+    reservation: M.OAuthSignInAccessClaim,
+    previous: M.OAuthConnectedTokenContext,
+  ) {
+    const generation = reservation.configuration.profile.generation;
+    const oldGeneration = previous.configuration.profile.generation;
+
+    return (yield* S.clientKey(reservation.configuration)) ===
+      (yield* S.clientKey(previous.configuration))
+      ? generation >= oldGeneration &&
+          S.orderNumber(reservation.order) > S.orderNumber(previous.exchangeOrder)
+      : generation > oldGeneration;
+  });
+
+  const inspectSignIn = Effect.fn("oauthConnected.inspectSignIn")(function* (
+    mapping: STypes.Mapping,
+    input: FTypes.Input<"inspectSignIn">,
+  ) {
+    const found = yield* credential(mapping, input.reservation, input.credential);
+
+    if (found === undefined) return { _tag: "Rejected" } as const;
+    const r = input.reservation;
+    const cl = yield* S.client(mapping, r.configuration, false);
+
+    if (cl === undefined) return { _tag: "Rejected" } as const;
+    const tuple = yield* F.inspectTuple(mapping, input.credential.identity);
+    const t = mapping.ownership.tuple;
+
+    if (
+      tuple.row?.[t.state] !== "Owned" ||
+      !mapping.subjectId.equals(tuple.row[t.subjectId], found.nativeId)
+    )
+      return { _tag: "Rejected" } as const;
+    const co = yield* S.cohort(mapping, cl.id, tuple.key, false);
+
+    const previous = yield* slot(
+      mapping,
+      r.claim.flow.context.moduleId,
+      found.nativeId,
+      tuple.key,
+      r.configuration.profile.key,
+    );
+
+    const held = yield* exact(mapping, r);
+
+    if (held === undefined) return { _tag: "Rejected" } as const;
+
+    const quarantine =
+      !held.active ||
+      co.blocked ||
+      S.orderNumber(r.order) <= co.cutoff ||
+      previous?.row[mapping.grant.refreshWork] === "Unresolved" ||
+      (previous !== undefined && !(yield* canReplace(r, previous.context)));
+
+    return snapshotOAuthSync(M.OAuthSignInAccessInspection, {
+      _tag: quarantine ? "Quarantine" : "Target",
+      grantId: previous?.context.grantId ?? input.grantId,
+      cohortGeneration: co.generation,
+      ...(previous === undefined
+        ? {}
+        : { previous: snapshotOAuthSync(M.OAuthConnectedTarget, previous.context) }),
+    });
+  });
+
+  const settleSignIn = Effect.fn("oauthConnected.settleSignIn")(function* (
+    mapping: STypes.Mapping,
+    input: FTypes.Input<"settleSignIn">,
+  ) {
+    const owner = yield* CurrentOAuthTransaction;
+    const r = input.reservation;
+    const out = input.outcome;
+
+    const found =
+      out._tag === "Verified" ? yield* credential(mapping, r, out.credential) : undefined;
+
+    const cl = yield* S.client(mapping, r.configuration, false);
+
+    if (cl === undefined) return { _tag: "Rejected" } as const;
+    const f = mapping.flow;
+
+    if (out._tag !== "Verified") {
+      const held = yield* exact(mapping, r);
+
+      if (held === undefined) return { _tag: "Rejected" } as const;
+      // Unissued means the provider definitely returned no token. Resolve that
+      // reservation. A Rejected outcome can follow a real exchange, so it stays open.
+      const state = out._tag === "Unissued" ? "Rejected" : out._tag;
+
+      yield* owner.update(f.table, held.key, {
+        [f.state]: state,
+        [f.work]: out._tag === "Cancelled" || out._tag === "Unissued" ? "Resolved" : "Unresolved",
+        [f.version]: owner.marker,
+      });
+
+      return { _tag: state };
+    }
+    const token = out.grant.context;
+
+    invariant(
+      token.moduleId === r.claim.flow.context.moduleId &&
+        token.subjectId === out.credential.revision.subjectId &&
+        sameIdentity(token.identity, out.credential.identity) &&
+        configurationStorage.encode(token.configuration) ===
+          configurationStorage.encode(r.configuration),
+    );
+    const native = yield* mapping.subjectId.toNative(token.subjectId);
+    const tuple = yield* F.readTuple(mapping.ownership, token.identity);
+    const t = mapping.ownership.tuple;
+
+    const owned =
+      tuple.row[t.state] === "Owned" && mapping.subjectId.equals(tuple.row[t.subjectId], native);
+
+    const co = yield* S.cohort(mapping, cl.id, tuple.key, true);
+    const previous = yield* S.readGrant(mapping, token.moduleId, token.grantId);
+
+    const activeSlot = yield* slot(
+      mapping,
+      token.moduleId,
+      native,
+      tuple.key,
+      token.configuration.profile.key,
+    );
+
+    const held = yield* exact(mapping, r);
+
+    if (held === undefined) return { _tag: "Rejected" } as const;
+    invariant(
+      token.exchangeOrder === r.order &&
+        validMetadata(token, held.now) &&
+        token.metadata.obtainedAtMillis >= r.claim.claimedAtMillis,
+    );
+
+    const target =
+      out.previous === undefined
+        ? previous === undefined
+        : previous !== undefined &&
+          F.sameTarget(out.previous, previous.context) &&
+          sameIdentity(previous.context.identity, token.identity) &&
+          previous.row[mapping.grant.refreshWork] !== "Unresolved" &&
+          (yield* canReplace(r, previous.context));
+
+    const previousSafe = yield* C.noFormerOwner(mapping, tuple.key, cl.id, native);
+
+    if (!owned || !previousSafe) {
+      yield* owner.update(f.table, held.key, { [f.state]: "Conflict", [f.version]: owner.marker });
+
+      return { _tag: "Conflict" } as const;
+    }
+    if (
+      out.quarantine ||
+      found === undefined ||
+      !held.active ||
+      !target ||
+      (activeSlot !== undefined && activeSlot.context.grantId !== token.grantId) ||
+      co.blocked ||
+      S.orderNumber(r.order) <= co.cutoff ||
+      co.generation !== token.cohortGeneration ||
+      token.metadata.useUntilMillis <= held.now ||
+      token.configuration.profile.issuance !== "active"
+    ) {
+      if (token.configuration.profile.revocation === "unsupported") {
+        // No remote cleanup can run for this profile. Discard the losing material;
+        // it must neither replace nor revoke the currently installed grant.
+        yield* owner.update(f.table, held.key, {
+          [f.state]: "Rejected",
+          [f.work]: "Resolved",
+          [f.subjectId]: native,
+          [f.cohortKey]: co.id,
+          [f.custody]: null,
+          [f.version]: owner.marker,
+        });
+      } else {
+        yield* C.fence(mapping, cl, co);
+        if (out.cleanup === undefined) return yield* unavailable();
+        yield* C.storeJob(mapping, out.cleanup, token, native, held.now);
+        yield* owner.update(f.table, held.key, {
+          [f.state]: "Quarantined",
+          [f.work]: "Resolved",
+          [f.subjectId]: native,
+          [f.cohortKey]: co.id,
+          [f.custody]: null,
+          [f.version]: owner.marker,
+        });
+      }
+
+      return { _tag: "Rejected" } as const;
+    }
+    yield* activateGrant(mapping, out.grant, native, held.now, previous !== undefined);
+    yield* owner.update(f.table, held.key, {
+      [f.state]: "Connected",
+      [f.work]: "Resolved",
+      [f.subjectId]: native,
+      [f.cohortKey]: co.id,
+      [f.custody]: null,
+      [f.version]: owner.marker,
+    });
+    owner.postconditions.push(
+      sql`${mapping.clock.engineNowMillis} >= ${held.now} and ${mapping.clock.engineNowMillis} < ${Math.min(r.claim.claimExpiresAtMillis, token.metadata.useUntilMillis)}`,
+    );
+
+    return { _tag: "Connected", grant: out.grant } as const;
+  });
+
+  return { claimSignIn, inspectSignIn, settleSignIn };
+});
+
+export class OAuthConnectedSignIn extends Context.Service<
+  OAuthConnectedSignIn,
+  Effect.Success<typeof make>
+>()("effect-auth/persistence/OAuthConnectedSignIn") {
+  static readonly layer = Layer.effect(OAuthConnectedSignIn, make);
+}