@yielded/auth-persistence 0.1.0-beta.23 → 0.1.0-beta.25

package/src/internal/oauth-kernel.ts

@@ -0,0 +1,294 @@
+import { Effect, Layer } from "effect";
+import type { SqlClient } from "effect/sql/SqlClient";
+
+import { OAuthAccounts } from "./oauth/accounts";
+import { OAuthConnectedAccess } from "./oauth/connected-access";
+import { OAuthConnectedCollection } from "./oauth/connected-collection";
+import { OAuthConnectedCustody } from "./oauth/connected-custody";
+import { OAuthConnectedFlow } from "./oauth/connected-flow";
+import { OAuthConnectedMaintenance } from "./oauth/connected-maintenance";
+import { OAuthConnectedManagement } from "./oauth/connected-management";
+import { makeOAuthConnectedReferenceKernel } from "./oauth/connected-reference";
+import { OAuthConnectedSettlement } from "./oauth/connected-settlement";
+import { OAuthConnectedSignIn } from "./oauth/connected-sign-in";
+import { OAuthConnectedState } from "./oauth/connected-state";
+import {
+  OAuthConnectedTarget,
+  oauthConnectedPersistenceLayer,
+  oauthConnectedRevocationsLayer,
+} from "./oauth/connected-target";
+import { OAuthFlow } from "./oauth/flow";
+import { OAuthTransactionExecution } from "./oauth/owner";
+import { OAuthQueryCompiler } from "./oauth/query-compiler";
+import { OAuthRegistration } from "./oauth/registration";
+import { captureOAuthMapping, unavailable } from "./oauth/state";
+import {
+  OAuthTarget,
+  oauthAccountsPersistenceLayer,
+  oauthSignInPersistenceLayer,
+  oauthRegistrationIntentsLayer,
+  oauthRegistrationAuthorityLayer,
+} from "./oauth/target";
+import type { QueryOperations } from "./query-operations";
+import { requireStandalone } from "./standalone";
+import { makeTransactionExecutionKernel } from "./transaction-execution-kernel";
+import { makeTransactionKernel } from "./transaction-kernel";
+
+export type OAuthKernel = ReturnType<typeof makeOAuthKernel>;
+
+/** Adapter composition root. Shared operation Layers acquire their dependencies;
+ * database and transaction services are still resolved by each operation. */
+export const makeOAuthKernel = (
+  operations: QueryOperations,
+  dialect: (table: object) => "pg" | "sqlite" | "mysql",
+) => {
+  const transactions = makeTransactionKernel(operations);
+  const connectedReference = makeOAuthConnectedReferenceKernel(operations, dialect);
+
+  const compilerLive = Layer.succeed(OAuthQueryCompiler, {
+    ...operations,
+    ...transactions.makeTransactionRows(unavailable),
+    both: transactions.both,
+    connectedReferenceCondition: connectedReference.connectedReferenceCondition,
+  });
+
+  const executionLive = Layer.succeed(
+    OAuthTransactionExecution,
+    makeTransactionExecutionKernel(transactions),
+  );
+
+  const flowLive = OAuthFlow.layer.pipe(Layer.provide([compilerLive]));
+  const registrationLive = OAuthRegistration.layer.pipe(Layer.provide([compilerLive, flowLive]));
+
+  const accountsLive = OAuthAccounts.layer.pipe(
+    Layer.provide([compilerLive, flowLive, registrationLive]),
+  );
+
+  const targetLive = OAuthTarget.layer.pipe(
+    Layer.provide([compilerLive, accountsLive, flowLive, registrationLive, executionLive]),
+  );
+
+  const connectedStateLive = OAuthConnectedState.layer.pipe(
+    Layer.provide([compilerLive, flowLive]),
+  );
+
+  const connectedFlowLive = OAuthConnectedFlow.layer.pipe(
+    Layer.provide([compilerLive, connectedStateLive, registrationLive]),
+  );
+
+  const connectedCustodyLive = OAuthConnectedCustody.layer.pipe(
+    Layer.provide([compilerLive, connectedStateLive]),
+  );
+
+  const connectedCollectionLive = OAuthConnectedCollection.layer.pipe(
+    Layer.provide([compilerLive, connectedCustodyLive, connectedFlowLive, connectedStateLive]),
+  );
+
+  const connectedSettlementLive = OAuthConnectedSettlement.layer.pipe(
+    Layer.provide([compilerLive, connectedCustodyLive, connectedFlowLive, connectedStateLive]),
+  );
+
+  const connectedAccessLive = OAuthConnectedAccess.layer.pipe(
+    Layer.provide([
+      compilerLive,
+      connectedCustodyLive,
+      connectedFlowLive,
+      connectedSettlementLive,
+      connectedStateLive,
+    ]),
+  );
+
+  const connectedManagementLive = OAuthConnectedManagement.layer.pipe(
+    Layer.provide([
+      compilerLive,
+      connectedAccessLive,
+      connectedCustodyLive,
+      connectedFlowLive,
+      connectedStateLive,
+    ]),
+  );
+
+  const connectedMaintenanceLive = OAuthConnectedMaintenance.layer.pipe(
+    Layer.provide([
+      compilerLive,
+      connectedCollectionLive,
+      connectedCustodyLive,
+      connectedFlowLive,
+      connectedStateLive,
+    ]),
+  );
+
+  const connectedSignInLive = OAuthConnectedSignIn.layer.pipe(
+    Layer.provide([
+      compilerLive,
+      connectedCustodyLive,
+      connectedFlowLive,
+      connectedSettlementLive,
+      connectedStateLive,
+      flowLive,
+    ]),
+  );
+
+  const connectedTargetLive = OAuthConnectedTarget.layer.pipe(
+    Layer.provide([
+      connectedAccessLive,
+      connectedFlowLive,
+      connectedMaintenanceLive,
+      connectedManagementLive,
+      connectedSettlementLive,
+      connectedSignInLive,
+      connectedStateLive,
+      targetLive,
+    ]),
+  );
+
+  // Keep shared operation Layers local to this adapter compiler, even inside another
+  // coordinator. Preserve constructor-time snapshots before deferred acquisition.
+  const makeTargetOAuthSignInServices: OAuthTarget["Service"]["makeTargetOAuthSignInServices"] = (
+    mapping,
+    configuration,
+  ) => {
+    const captured = captureOAuthMapping(mapping);
+
+    return Effect.flatMap(OAuthTarget, (service) =>
+      service.makeTargetOAuthSignInServices(captured, configuration),
+    ).pipe(Effect.provide(targetLive, { local: true }));
+  };
+
+  const makeTargetOAuthRegistrationIntentServices: OAuthTarget["Service"]["makeTargetOAuthRegistrationIntentServices"] =
+    (mapping, configuration) => {
+      const captured = captureOAuthMapping(mapping);
+
+      return Effect.flatMap(OAuthTarget, (service) =>
+        service.makeTargetOAuthRegistrationIntentServices(captured, configuration),
+      ).pipe(Effect.provide(targetLive, { local: true }));
+    };
+
+  const makeTargetOAuthRegistrationServices: OAuthTarget["Service"]["makeTargetOAuthRegistrationServices"] =
+    (mapping, configuration) => {
+      const captured = captureOAuthMapping(mapping);
+
+      return Effect.flatMap(OAuthTarget, (service) =>
+        service.makeTargetOAuthRegistrationServices(captured, configuration),
+      ).pipe(Effect.provide(targetLive, { local: true }));
+    };
+
+  const makeTargetOAuthAccountsServices: OAuthTarget["Service"]["makeTargetOAuthAccountsServices"] =
+    (mapping, configuration) => {
+      const captured = captureOAuthMapping(mapping);
+
+      return Effect.flatMap(OAuthTarget, (service) =>
+        service.makeTargetOAuthAccountsServices(captured, configuration),
+      ).pipe(Effect.provide(targetLive, { local: true }));
+    };
+
+  const coordinateTargetOAuthRegistration: OAuthTarget["Service"]["coordinateTargetOAuthRegistration"] =
+    (database, mapping, configuration, owner) => {
+      const captured = captureOAuthMapping(mapping);
+
+      return Effect.flatMap(OAuthTarget, (service) =>
+        service.coordinateTargetOAuthRegistration(database, captured, configuration, owner),
+      ).pipe(Effect.provide(targetLive, { local: true }));
+    };
+
+  const coordinateTargetOAuthSignIn: OAuthTarget["Service"]["coordinateTargetOAuthSignIn"] = (
+    database,
+    mapping,
+    configuration,
+    owner,
+  ) => {
+    const captured = captureOAuthMapping(mapping);
+
+    return Effect.flatMap(OAuthTarget, (service) =>
+      service.coordinateTargetOAuthSignIn(database, captured, configuration, owner),
+    ).pipe(Effect.provide(targetLive, { local: true }));
+  };
+
+  const coordinateTargetOAuthRegistrationIntents: OAuthTarget["Service"]["coordinateTargetOAuthRegistrationIntents"] =
+    (database, mapping, configuration, owner) => {
+      const captured = captureOAuthMapping(mapping);
+
+      return Effect.flatMap(OAuthTarget, (service) =>
+        service.coordinateTargetOAuthRegistrationIntents(database, captured, configuration, owner),
+      ).pipe(Effect.provide(targetLive, { local: true }));
+    };
+
+  const coordinateTargetOAuthAccounts: OAuthTarget["Service"]["coordinateTargetOAuthAccounts"] = (
+    database,
+    mapping,
+    configuration,
+    owner,
+  ) => {
+    const captured = captureOAuthMapping(mapping);
+
+    return Effect.flatMap(OAuthTarget, (service) =>
+      service.coordinateTargetOAuthAccounts(database, captured, configuration, owner),
+    ).pipe(Effect.provide(targetLive, { local: true }));
+  };
+
+  const makeTargetOAuthConnectedServices: OAuthConnectedTarget["Service"]["makeTargetOAuthConnectedServices"] =
+    (mapping, configuration) => {
+      const captured = captureOAuthMapping(mapping);
+
+      return Effect.flatMap(OAuthConnectedTarget, (service) =>
+        service.makeTargetOAuthConnectedServices(captured, configuration),
+      ).pipe(Effect.provide(connectedTargetLive, { local: true }));
+    };
+
+  const makeTargetOAuthConnectedRevocationServices: OAuthConnectedTarget["Service"]["makeTargetOAuthConnectedRevocationServices"] =
+    (mapping, configuration) => {
+      const captured = captureOAuthMapping(mapping);
+
+      return Effect.flatMap(OAuthConnectedTarget, (service) =>
+        service.makeTargetOAuthConnectedRevocationServices(captured, configuration),
+      ).pipe(Effect.provide(connectedTargetLive, { local: true }));
+    };
+
+  const coordinateTargetOAuthConnected: OAuthConnectedTarget["Service"]["coordinateTargetOAuthConnected"] =
+    (database, mapping, configuration, owner) => {
+      const captured = captureOAuthMapping(mapping);
+
+      return Effect.flatMap(OAuthConnectedTarget, (service) =>
+        service.coordinateTargetOAuthConnected(database, captured, configuration, owner),
+      ).pipe(Effect.provide(connectedTargetLive, { local: true }));
+    };
+
+  const coordinateTargetOAuthConnectedRevocations: OAuthConnectedTarget["Service"]["coordinateTargetOAuthConnectedRevocations"] =
+    (database, mapping, configuration, owner) => {
+      const captured = captureOAuthMapping(mapping);
+
+      return Effect.flatMap(OAuthConnectedTarget, (service) =>
+        service.coordinateTargetOAuthConnectedRevocations(database, captured, configuration, owner),
+      ).pipe(Effect.provide(connectedTargetLive, { local: true }));
+    };
+
+  const sqlClientOAuthStandaloneGuard = (service: SqlClient["transactionService"] | undefined) =>
+    requireStandalone(unavailable, service);
+
+  return {
+    target: {
+      makeTargetOAuthSignInServices,
+      makeTargetOAuthRegistrationIntentServices,
+      makeTargetOAuthRegistrationServices,
+      makeTargetOAuthAccountsServices,
+      coordinateTargetOAuthRegistration,
+      coordinateTargetOAuthSignIn,
+      coordinateTargetOAuthRegistrationIntents,
+      coordinateTargetOAuthAccounts,
+      sqlClientOAuthStandaloneGuard,
+      oauthAccountsPersistenceLayer,
+      oauthSignInPersistenceLayer,
+      oauthRegistrationIntentsLayer,
+      oauthRegistrationAuthorityLayer,
+    },
+    connectedTarget: {
+      makeTargetOAuthConnectedServices,
+      makeTargetOAuthConnectedRevocationServices,
+      coordinateTargetOAuthConnected,
+      coordinateTargetOAuthConnectedRevocations,
+      oauthConnectedPersistenceLayer,
+      oauthConnectedRevocationsLayer,
+    },
+    connectedReference,
+  };
+};

package/src/internal/oauth-proxy.ts

@@ -0,0 +1,176 @@
+import { FlowContext, Persistence, Record, Unavailable } from "@yielded/auth/OAuthProxy";
+import { Effect, Layer, Schema } from "effect";
+import { SqlClient } from "effect/sql";
+
+import { identifier } from "./sql-table";
+import { requireStandalone } from "./standalone";
+
+export const oauthProxyColumns = {
+  namespace: "namespace",
+  flowId: "flow_id",
+  version: "version",
+  stage: "stage",
+  context: "context",
+  expiresAtMillis: "expires_at_millis",
+  handoffExpiresAtMillis: "handoff_expires_at_millis",
+  payload: "payload",
+} as const;
+
+/** Plain text and integer-millisecond storage; adapters supply physical names. */
+export interface OAuthProxySqlTable {
+  readonly name: string;
+  readonly schema?: string;
+  readonly columns: { readonly [K in keyof typeof oauthProxyColumns]: string };
+}
+
+const codec = Schema.fromJsonString(Record);
+const contextCodec = Schema.fromJsonString(FlowContext);
+
+const Row = Schema.Struct({
+  payload: Schema.String,
+  version: Schema.String,
+  stage: Schema.String,
+  context: Schema.String,
+  expiry: Schema.String,
+  deadline: Schema.NullOr(Schema.String),
+});
+
+/** SQLite/D1 and PostgreSQL; apply once through application migrations.
+ * Retain terminal records until expires_at_millis, then expired rows may be deleted.
+ * Context and stage columns guard each standalone transition without a prior read.
+ */
+const migration = `CREATE TABLE yielded_oauth_proxy (
+  namespace TEXT NOT NULL,
+  flow_id TEXT NOT NULL,
+  version TEXT NOT NULL,
+  stage TEXT NOT NULL CHECK (stage IN ('Pending', 'Exchanging', 'Ready', 'Consumed')),
+  context TEXT NOT NULL,
+  expires_at_millis BIGINT NOT NULL,
+  handoff_expires_at_millis BIGINT,
+  payload TEXT NOT NULL,
+  PRIMARY KEY (namespace, flow_id),
+  CHECK ((stage = 'Ready' AND handoff_expires_at_millis IS NOT NULL)
+    OR (stage <> 'Ready' AND handoff_expires_at_millis IS NULL))
+)`;
+
+export const makeOAuthProxyPersistence = Effect.fnUntraced(function* (table: OAuthProxySqlTable) {
+  const sql = (yield* SqlClient.SqlClient).withoutTransforms();
+
+  if (!sql.onDialectOrElse({ sqlite: () => true, pg: () => true, orElse: () => false }))
+    return yield* Unavailable.make({});
+
+  const names = Object.values(table.columns);
+
+  if (
+    [table.name, table.schema ?? "main", ...names].some((name) => !name || name.includes("\0")) ||
+    new Set(names).size !== names.length
+  )
+    return yield* Unavailable.make({});
+
+  const name = sql.literal(
+    (table.schema === undefined ? "" : `${identifier(table.schema)}.`) + identifier(table.name),
+  );
+
+  const column = (key: keyof typeof oauthProxyColumns) =>
+    sql.literal(identifier(table.columns[key]));
+
+  const standalone = requireStandalone(() => Unavailable.make({}), sql.transactionService);
+
+  const failure = <A, E, R>(effect: Effect.Effect<A, E, R>) =>
+    effect.pipe(Effect.mapError(() => Unavailable.make({})));
+
+  const clock = sql.onDialectOrElse({
+    sqlite: () => sql.literal("CAST((julianday('now') - 2440587.5) * 86400000 AS INTEGER)"),
+    orElse: () => sql.literal("CAST(EXTRACT(EPOCH FROM clock_timestamp()) * 1000 AS BIGINT)"),
+  });
+
+  return Persistence.of({
+    get: Effect.fnUntraced(function* (namespace, id) {
+      yield* standalone;
+
+      const rows = yield* sql`SELECT ${column("payload")} AS payload,
+          ${column("version")} AS version, ${column("stage")} AS stage, ${column("context")} AS context,
+          CAST(${column("expiresAtMillis")} AS TEXT) AS expiry,
+          CAST(${column("handoffExpiresAtMillis")} AS TEXT) AS deadline
+          FROM ${name} WHERE ${column("namespace")} = ${namespace} AND ${column("flowId")} = ${id}`;
+
+      if (rows.length === 0) return undefined;
+      if (rows.length !== 1) return yield* Unavailable.make({});
+      const row = yield* Schema.decodeUnknownEffect(Row)(rows[0]);
+      const record = yield* Schema.decodeEffect(codec)(row.payload);
+      const context = yield* Schema.encodeEffect(contextCodec)(record.context);
+
+      if (
+        record.context.id !== id ||
+        record.version !== row.version ||
+        record._tag !== row.stage ||
+        context !== row.context ||
+        String(record.context.expiresAtMillis) !== row.expiry ||
+        (record._tag === "Ready" ? String(record.handoffExpiresAtMillis) : null) !== row.deadline
+      )
+        return yield* Unavailable.make({});
+
+      return record;
+    }, failure),
+    insert: Effect.fnUntraced(function* (namespace, record) {
+      yield* standalone;
+      if (record._tag !== "Pending") return yield* Unavailable.make({});
+      const payload = yield* Schema.encodeEffect(codec)(record);
+      const context = yield* Schema.encodeEffect(contextCodec)(record.context);
+
+      const rows = yield* sql`INSERT INTO ${name}
+          (${column("namespace")}, ${column("flowId")}, ${column("version")}, ${column("stage")},
+            ${column("context")}, ${column("expiresAtMillis")}, ${column("payload")})
+          SELECT ${namespace}, ${record.context.id}, ${record.version}, ${record._tag},
+            ${context}, ${record.context.expiresAtMillis}, ${payload}
+          WHERE ${record.context.expiresAtMillis} > ${clock}
+          ON CONFLICT (${column("namespace")}, ${column("flowId")}) DO NOTHING
+          RETURNING ${column("version")}`;
+
+      return rows.length === 1;
+    }, failure),
+    compareAndSet: Effect.fnUntraced(function* (namespace, version, record) {
+      yield* standalone;
+      if (version === record.version || record._tag === "Pending")
+        return yield* Unavailable.make({});
+
+      // Explicitly omit private envelopes from both irreversible marker stages.
+      const payload = yield* Schema.encodeEffect(codec)(
+        record._tag === "Ready"
+          ? record
+          : { _tag: record._tag, version: record.version, context: record.context },
+      );
+
+      const context = yield* Schema.encodeEffect(contextCodec)(record.context);
+
+      const previous =
+        record._tag === "Exchanging" ? "Pending" : record._tag === "Ready" ? "Exchanging" : "Ready";
+
+      const deadline = record._tag === "Ready" ? record.handoffExpiresAtMillis : null;
+
+      const consume =
+        record._tag === "Consumed"
+          ? sql`AND ${column("handoffExpiresAtMillis")} > ${clock}`
+          : sql.literal("");
+
+      const rows = yield* sql`UPDATE ${name}
+          SET ${column("version")} = ${record.version}, ${column("stage")} = ${record._tag},
+            ${column("handoffExpiresAtMillis")} = ${deadline}, ${column("payload")} = ${payload}
+          WHERE ${column("namespace")} = ${namespace} AND ${column("flowId")} = ${record.context.id}
+            AND ${column("version")} = ${version} AND ${column("stage")} = ${previous}
+            AND ${column("context")} = ${context}
+            AND ${column("expiresAtMillis")} = ${record.context.expiresAtMillis}
+            AND ${column("expiresAtMillis")} > ${clock} ${consume}
+          RETURNING ${column("version")}`;
+
+      return rows.length === 1;
+    }, failure),
+  });
+});
+
+const layer = Layer.effect(
+  Persistence,
+  makeOAuthProxyPersistence({ name: "yielded_oauth_proxy", columns: oauthProxyColumns }),
+);
+
+export const OAuthProxyPersistence = { migration, layer };

package/src/internal/passkey/write-state.ts

@@ -427,10 +427,24 @@ export const makePasskeyWriteStateKernel = (
     mapping: any,
     supplied: SessionInvalidationWindow,
     policy: PasskeyManagementPolicy,
-  ) =>
-    jsonStorage(SessionInvalidationWindow).encode(supplied) ===
-      jsonStorage(SessionInvalidationWindow).encode(mapping.invalidation.window) &&
-    (!policy.requireImmediateInvalidation || supplied.existingSessions === "immediate");
+  ) => {
+    if (supplied.existingSessions === "cache-expiry" && supplied.maximumExposureMillis === 0)
+      return false;
+
+    // Cookie-cache exposure does not weaken the mapping's authoritative
+    // revision bump. Compare that immediate guarantee independently of the TTL.
+    const authoritative: SessionInvalidationWindow =
+      supplied.existingSessions === "cache-expiry" &&
+      mapping.invalidation.window.existingSessions === "immediate"
+        ? { ...supplied, existingSessions: "immediate", maximumExposureMillis: 0 }
+        : supplied;
+
+    return (
+      jsonStorage(SessionInvalidationWindow).encode(authoritative) ===
+        jsonStorage(SessionInvalidationWindow).encode(mapping.invalidation.window) &&
+      (!policy.requireImmediateInvalidation || supplied.existingSessions === "immediate")
+    );
+  };
 
   const invalidate = Effect.fn("passkey.invalidateCredentialChange")(function* (
     mapping: any,