@yielded/auth-persistence 0.1.0-beta.24 → 0.1.0-beta.26

package/src/internal/oauth/connected-management.ts

@@ -1,391 +0,0 @@
-import * as M from "@yielded/auth/OAuth";
-import { snapshotOAuthSync } from "@yielded/auth/OAuth";
-import { Effect, Context, Layer } from "effect";
-
-import { OAuthConnectedAccess } from "./connected-access";
-import { OAuthConnectedCustody } from "./connected-custody";
-import { OAuthConnectedFlow } from "./connected-flow";
-import type * as FTypes from "./connected-flow";
-import { OAuthConnectedState } from "./connected-state";
-import type * as STypes from "./connected-state";
-import { CurrentOAuthTransaction } from "./owner";
-import { OAuthQueryCompiler } from "./query-compiler";
-import { digest, invariant } from "./state";
-
-const make = Effect.gen(function* () {
-  const operations = yield* OAuthQueryCompiler;
-  const A = yield* OAuthConnectedAccess;
-  const C = yield* OAuthConnectedCustody;
-  const F = yield* OAuthConnectedFlow;
-  const S = yield* OAuthConnectedState;
-
-  const { asc, eq, gt, lte } = operations;
-  const { both, col, equal } = operations;
-
-  const list = Effect.fn("oauthConnected.list")(function* (
-    mapping: STypes.Mapping,
-    input: FTypes.Input<"list">,
-  ) {
-    const owner = yield* CurrentOAuthTransaction;
-    const found = yield* S.useAuthority(mapping, input.authorization, "metadata");
-
-    if (found === undefined) return { items: [] };
-    invariant(Number.isSafeInteger(input.limit) && input.limit >= 1 && input.limit <= 100);
-
-    const g = mapping.grant,
-      h = mapping.cohort,
-      j = S.jobTable(mapping);
-
-    const cursor = input.cursor === undefined ? undefined : M.OAuthGrantId.make(input.cursor);
-
-    const where = both(
-      equal(g.table, { [g.moduleId]: input.authorization.moduleId, [g.subjectId]: found.nativeId }),
-      cursor === undefined ? undefined : gt(col(g.table, g.grantId), cursor),
-      input.authorization.grantId === undefined
-        ? undefined
-        : eq(col(g.table, g.grantId), input.authorization.grantId),
-      input.authorization.profileKey === undefined
-        ? undefined
-        : eq(col(g.table, g.profileKey), input.authorization.profileKey),
-    );
-
-    const columns = [
-      g.moduleId,
-      g.grantId,
-      g.subjectId,
-      g.identityKey,
-      g.clientKey,
-      g.cohortKey,
-      g.cohortGeneration,
-      g.profileKey,
-      g.state,
-      g.summary,
-      g.revocationJobId,
-      g.version,
-    ];
-
-    const read = yield* owner.read(g.table, where, {
-      columns,
-      limit: input.limit + 1,
-      takeOnly: true,
-      observe: false,
-      lock: false,
-      orderBy: asc(col(g.table, g.grantId)),
-    });
-
-    const more = read.rows.length > input.limit,
-      rows = read.rows.slice(0, input.limit),
-      last = rows.at(-1)?.[g.grantId];
-
-    owner.observations.push({
-      table: g.table,
-      where: more ? both(where, lte(col(g.table, g.grantId), last)) : where,
-      rows,
-    });
-    const items: Array<typeof M.OAuthConnectedSummary.Type> = [];
-
-    for (const row of rows) {
-      const summary = S.summaryStorage.decode(row[g.summary]);
-
-      invariant(
-        summary.grantId === row[g.grantId] &&
-          summary.profileKey === row[g.profileKey] &&
-          mapping.subjectId.equals(found.nativeId, row[g.subjectId]),
-      );
-
-      const co = yield* owner.read(h.table, equal(h.table, { [h.cohortKey]: row[g.cohortKey] }), {
-        limit: 1,
-        lock: false,
-      });
-
-      const cr = co.rows[0];
-
-      invariant(
-        cr !== undefined &&
-          cr[h.clientKey] === row[g.clientKey] &&
-          cr[h.identityKey] === row[g.identityKey],
-      );
-      let status = row[g.state] as (typeof M.OAuthConnectedSummary.Type)["status"];
-
-      if (
-        status !== "Disconnected" &&
-        (cr[h.state] !== "Open" || cr[h.generation] !== row[g.cohortGeneration])
-      )
-        status = "ReauthorizationRequired";
-      let remote = summary.remoteRevocation;
-
-      if (row[g.revocationJobId] !== null) {
-        if (j === undefined) remote = "Unknown";
-        else {
-          const job = yield* owner.read(
-            j.table,
-            equal(j.table, { [j.jobId]: row[g.revocationJobId] }),
-            {
-              limit: 1,
-              lock: false,
-              columns: [j.jobId, j.moduleId, j.grantId, j.cohortKey, j.state],
-            },
-          );
-
-          const jr = job.rows[0];
-
-          invariant(
-            jr !== undefined &&
-              jr[j.moduleId] === row[g.moduleId] &&
-              jr[j.grantId] === row[g.grantId] &&
-              jr[j.cohortKey] === row[g.cohortKey],
-          );
-          remote =
-            jr[j.state] === "Confirmed"
-              ? "Confirmed"
-              : jr[j.state] === "Unknown"
-                ? "Unknown"
-                : "Pending";
-        }
-      }
-      items.push(
-        snapshotOAuthSync(M.OAuthConnectedSummary, {
-          ...summary,
-          status,
-          remoteRevocation: remote,
-        }),
-      );
-    }
-
-    return { items, ...(more ? { cursor: last as string } : {}) };
-  });
-
-  const command = Effect.fn("oauthConnected.disconnectCommand")(function* (
-    mapping: STypes.Mapping,
-    moduleId: string,
-    commandId: string,
-    lock = true,
-  ) {
-    const owner = yield* CurrentOAuthTransaction;
-
-    const d = mapping.command,
-      read = yield* owner.read(
-        d.table,
-        equal(d.table, { [d.moduleId]: moduleId, [d.commandId]: commandId }),
-        { limit: 1, lock, observe: lock },
-      );
-
-    const row = read.rows[0];
-
-    if (row === undefined) return { read };
-
-    const grant = S.commandStorage.decode(row[d.intent]),
-      result = S.disconnectedStorage.decode(row[d.decision]);
-
-    const native = yield* mapping.subjectId.toNative(grant.context.subjectId);
-
-    invariant(
-      grant.context.moduleId === moduleId &&
-        grant.context.grantId === row[d.grantId] &&
-        result.grantId === grant.context.grantId &&
-        mapping.subjectId.equals(native, row[d.subjectId]) &&
-        !result.replayed,
-    );
-
-    return { read, row, grant, result };
-  });
-
-  const inspectDisconnect = Effect.fn("oauthConnected.inspectDisconnect")(function* (
-    mapping: STypes.Mapping,
-    input: FTypes.Input<"inspectDisconnect">,
-  ) {
-    const found = yield* S.useAuthority(mapping, input.authorization, "metadata");
-
-    if (
-      found === undefined ||
-      input.subjectId !== found.revision.subjectId ||
-      input.moduleId !== input.authorization.moduleId
-    )
-      return { _tag: "Rejected" } as const;
-    const discovered = yield* command(mapping, input.moduleId, input.commandId, false);
-
-    if (discovered.row !== undefined) {
-      if (
-        discovered.grant.context.subjectId !== input.subjectId ||
-        discovered.grant.context.grantId !== input.grantId
-      )
-        return { _tag: "Conflict" } as const;
-      if (
-        (yield* S.useAuthority(
-          mapping,
-          input.authorization,
-          "metadata",
-          discovered.grant.context,
-        )) === undefined
-      )
-        return { _tag: "Rejected" } as const;
-      const prior = yield* command(mapping, input.moduleId, input.commandId);
-      const d = mapping.command;
-
-      if (
-        prior.row === undefined ||
-        prior.row[d.intent] !== discovered.row[d.intent] ||
-        prior.row[d.decision] !== discovered.row[d.decision] ||
-        prior.row[d.version] !== discovered.row[d.version]
-      )
-        return { _tag: "Rejected" } as const;
-
-      return { _tag: "Replay", result: { ...prior.result, replayed: true } } as const;
-    }
-    const read = yield* A.locked(mapping, input.authorization, input.grantId, "metadata");
-
-    if (read === undefined) return { _tag: "Rejected" } as const;
-    const finalCommand = yield* command(mapping, input.moduleId, input.commandId);
-
-    if (finalCommand.row !== undefined) return { _tag: "Rejected" } as const;
-
-    return {
-      _tag: "Target",
-      grant: {
-        context: read.grant.context,
-        ...(read.grant.sealed === undefined ? {} : { sealed: read.grant.sealed }),
-      },
-      revision: read.found.revision,
-    } as const;
-  });
-
-  const disconnect = Effect.fn("oauthConnected.disconnect")(function* (
-    mapping: STypes.Mapping,
-    input: FTypes.Input<"disconnect">,
-  ) {
-    const owner = yield* CurrentOAuthTransaction;
-
-    const token = input.grant.context,
-      found = yield* S.current(mapping, token.subjectId);
-
-    if (
-      found === undefined ||
-      input.moduleId !== token.moduleId ||
-      !(yield* S.action(mapping, found, input.authorization, "disconnect", {
-        moduleId: input.moduleId,
-        flowId: input.commandId,
-        commandId: input.commandId,
-        revision: input.authorization.challenge.revision,
-        intent: S.disconnectStorage.encode(input.grant),
-        maximumAgeMillis: 300000,
-        configuration: token.configuration,
-        grant: token,
-      }))
-    )
-      return { _tag: "Rejected" } as const;
-    const client = yield* S.client(mapping, token.configuration, false);
-
-    if (client === undefined) return { _tag: "Rejected" } as const;
-
-    const tuple = yield* F.inspectTuple(mapping, token.identity),
-      t = mapping.ownership.tuple;
-
-    if (
-      tuple.row?.[t.state] !== "Owned" ||
-      !mapping.subjectId.equals(tuple.row[t.subjectId], found.nativeId)
-    )
-      return { _tag: "Conflict" } as const;
-    const cohort = yield* S.cohort(mapping, client.id, tuple.key, false);
-
-    invariant(cohort.row !== undefined);
-
-    const read = yield* S.readGrant(mapping, input.moduleId, token.grantId),
-      g = mapping.grant;
-
-    if (
-      read === undefined ||
-      !C.sameContext(read.context, token) ||
-      S.disconnectStorage.encode({
-        context: read.context,
-        ...(read.sealed === undefined ? {} : { sealed: read.sealed }),
-      }) !== S.disconnectStorage.encode(input.grant)
-    )
-      return { _tag: "Conflict" } as const;
-    const prior = yield* command(mapping, input.moduleId, input.commandId);
-
-    // Only inspectDisconnect exposes replay. Mutation replay cannot repeat effects.
-    if (prior.row !== undefined) return { _tag: "Conflict" } as const;
-
-    const now = yield* owner.now(mapping.clock),
-      wasOpen = !cohort.blocked;
-
-    invariant(input.retentionUntilMillis >= now && input.retentionUntilMillis <= now + 2592000000);
-    const affected = yield* C.fence(mapping, client, cohort);
-    let remote: (typeof M.OAuthConnectedSummary.Type)["remoteRevocation"] = "Unsupported";
-
-    if (input.revocation !== undefined) {
-      yield* C.storeJob(mapping, input.revocation, token, found.nativeId, now);
-      remote = "Pending";
-    } else if (token.configuration.profile.revocation === "cohort") {
-      invariant(read.sealed === undefined);
-      remote = "Unknown";
-    }
-
-    const result = snapshotOAuthSync(M.OAuthConnectedDisconnected, {
-      _tag: "Disconnected",
-      grantId: token.grantId,
-      remoteRevocation: remote,
-      affectedGrantCount: affected,
-      replayed: false,
-    });
-
-    yield* owner.update(
-      g.table,
-      { [g.moduleId]: input.moduleId, [g.grantId]: token.grantId },
-      {
-        [g.state]: "Disconnected",
-        [g.activeIdentityKey]: null,
-        [g.sealed]: null,
-        [g.revocationJobId]: input.revocation?.context.jobId ?? read.row[g.revocationJobId],
-        [g.version]: owner.marker,
-      },
-    );
-
-    const d = mapping.command,
-      key = { [d.moduleId]: input.moduleId, [d.commandId]: input.commandId };
-
-    const inserted = yield* owner.insert(
-      d.table,
-      {
-        ...d.encodeInsert({
-          commandId: input.commandId,
-          grant: snapshotOAuthSync(M.OAuthConnectedDisconnectGrant, input.grant),
-          subjectId: S.nativeCopy(found.nativeId),
-        }),
-        ...key,
-        [d.subjectId]: found.nativeId,
-        [d.grantId]: token.grantId,
-        [d.intent]: S.commandStorage.encode({
-          context: token,
-          originalDigest: yield* digest(S.disconnectStorage.encode(input.grant)),
-          ...(input.revocation === undefined
-            ? {}
-            : { revocationJobId: input.revocation.context.jobId }),
-        }),
-        [d.decision]: S.disconnectedStorage.encode(result),
-        [d.retentionUntil]: mapping.clock.encodeInstant(input.retentionUntilMillis),
-        [d.version]: owner.marker,
-      },
-      key,
-    );
-
-    prior.read.rows = inserted.rows;
-    if (
-      wasOpen &&
-      input.revocation === undefined &&
-      token.configuration.profile.revocation === "unsupported"
-    )
-      yield* C.clear(mapping, client, cohort, undefined, true);
-
-    return result;
-  });
-
-  return { list, inspectDisconnect, disconnect };
-});
-
-export class OAuthConnectedManagement extends Context.Service<
-  OAuthConnectedManagement,
-  Effect.Success<typeof make>
->()("effect-auth/persistence/OAuthConnectedManagement") {
-  static readonly layer = Layer.effect(OAuthConnectedManagement, make);
-}

package/src/internal/oauth/connected-reference.ts

@@ -1,135 +0,0 @@
-import { Effect } from "effect";
-
-import type { OAuthConnectedMapping } from "../models/oauth-connected-model";
-import {
-  oauthReferenceGuardTable,
-  type OAuthReferenceGuardDescriptor,
-} from "../models/oauth-model";
-/* oxlint-disable no-explicit-any -- only adapter SQL expression handles are erased. */
-import type { SqlExpression as SQL } from "../query-operations";
-import type { QueryOperations } from "../query-operations";
-import type { TableModel } from "../query-operations";
-import { makeTransactionKernel } from "../transaction-kernel";
-import { scopeKey } from "./connected-keys";
-import type { Mapping } from "./connected-state";
-import { unavailable, captureOAuthMapping } from "./state";
-type Table = object;
-
-export const makeOAuthConnectedReferenceKernel = (
-  operations: QueryOperations,
-  dialect: (table: object) => "pg" | "sqlite" | "mysql",
-) => {
-  const { eq, sql } = operations;
-  const transactions = makeTransactionKernel(operations);
-  const { both } = transactions;
-  const { col, equal } = transactions.makeTransactionRows(unavailable);
-
-  const exactText = (table: Table, key: string, value: string) => {
-    const column = col(table, key),
-      bound = sql.param(value, column);
-
-    return dialect(table) === "mysql"
-      ? sql`binary ${column} = binary ${bound}`
-      : dialect(table) === "pg"
-        ? sql`convert_to(cast(${column} as text),'UTF8') = convert_to(cast(${bound} as text),'UTF8')`
-        : sql`cast(${column} as blob) = cast(${bound} as blob)`;
-  };
-
-  /** Compose Accounts.Unlink with this connected authority. The stable scope lock
-   * serializes unknown claims across every client registration for an issuer. */
-  const oauthConnectedOwnershipReferences = <
-    S extends TableModel,
-    AC extends TableModel,
-    T extends TableModel,
-    O extends TableModel,
-    F extends TableModel,
-    G extends TableModel,
-    C extends TableModel,
-    H extends TableModel,
-    A extends TableModel,
-    D extends TableModel,
-    N,
-    J extends TableModel,
-  >(
-    original: OAuthConnectedMapping<S, AC, T, O, F, G, C, H, A, D, N, J, any>,
-  ): {
-    readonly connectedReferenceGuards: ReadonlyArray<OAuthReferenceGuardDescriptor<N>>;
-    readonly connectedReference: (input: {
-      readonly identityKey: string;
-      readonly subjectId: N;
-    }) => SQL;
-  } => {
-    const mapping = captureOAuthMapping(original),
-      c = mapping.client;
-
-    return Object.freeze({
-      connectedReferenceGuards: [
-        oauthReferenceGuardTable<C, N>({
-          table: c.table,
-          orderBy: c.clientKey,
-          condition: (input) =>
-            Effect.gen(function* () {
-              const key = yield* scopeKey(input.identity.provider, input.identity.issuer);
-
-              return both(
-                equal(c.table, {
-                  [c.clientKey]: key,
-                  [c.counter]: mapping.order.encode(0),
-                }),
-                exactText(c.table, c.provider, input.identity.provider),
-                exactText(c.table, c.issuer, input.identity.issuer),
-                exactText(c.table, c.clientRegistrationId, ""),
-              );
-            }),
-        }),
-      ],
-      connectedReference: (input) => connectedReferenceCondition(mapping, input.identityKey),
-    });
-  };
-
-  const connectedReferenceCondition = (
-    mapping: Mapping,
-    identityKey: string | SQL,
-    knownIdentity?: { readonly provider: string | SQL; readonly issuer: string | SQL },
-  ) => {
-    const c = mapping.client,
-      t = mapping.ownership.tuple,
-      f = mapping.flow,
-      g = mapping.grant,
-      h = mapping.cohort,
-      a = mapping.admission,
-      j = mapping.revocation.mode === "cohort" ? mapping.revocation.job : undefined;
-
-    const tuple = equal(t.table, { [t.identityKey]: identityKey });
-    const knownFlow = sql`exists(select 1 from ${h.table} where ${col(h.table, h.cohortKey)} = ${col(f.table, f.cohortKey)} and ${col(h.table, h.identityKey)} = ${identityKey})`;
-
-    const unknownFlow =
-      knownIdentity === undefined
-        ? sql`${col(f.table, f.cohortKey)} is null and exists(select 1 from ${c.table} where ${col(c.table, c.clientKey)} = ${col(f.table, f.clientKey)} and exists(select 1 from ${t.table} where ${tuple} and ${col(c.table, c.provider)} = ${col(t.table, t.provider)} and ${col(c.table, c.issuer)} = ${col(t.table, t.issuer)}))`
-        : sql`${col(f.table, f.cohortKey)} is null and exists(select 1 from ${c.table} where ${col(c.table, c.clientKey)} = ${col(f.table, f.clientKey)} and ${col(c.table, c.provider)} = ${knownIdentity.provider} and ${col(c.table, c.issuer)} = ${knownIdentity.issuer})`;
-
-    const related = [f, g, h, ...(j === undefined ? [] : [j])];
-
-    return sql`(${sql.join(
-      [
-        sql`exists(select 1 from ${g.table} where ${eq(col(g.table, g.identityKey), identityKey)})`,
-        sql`exists(select 1 from ${a.table} where ${eq(col(a.table, a.identityKey), identityKey)})`,
-        sql`exists(select 1 from ${h.table} where ${both(eq(col(h.table, h.identityKey), identityKey), eq(col(h.table, h.state), "Blocked"))})`,
-        sql`exists(select 1 from ${f.table} where ${col(f.table, f.work)} = 'Unresolved' and (${knownFlow} or (${unknownFlow})))`,
-        ...(j === undefined
-          ? []
-          : [
-              sql`exists(select 1 from ${j.table} where ${eq(col(j.table, j.identityKey), identityKey)})`,
-            ]),
-        // A missing real client cannot turn erased unknown work into absence.
-        ...related.map(
-          (v) =>
-            sql`exists(select 1 from ${v.table} where not exists(select 1 from ${c.table} where ${col(c.table, c.clientKey)} = ${col(v.table, v.clientKey)}))`,
-        ),
-      ],
-      sql` or `,
-    )})`;
-  };
-
-  return { oauthConnectedOwnershipReferences, connectedReferenceCondition };
-};