@yielded/auth-persistence 0.1.0-beta.24 → 0.1.0-beta.26

package/src/internal/oauth/connected-settlement.ts

@@ -1,278 +0,0 @@
-import * as M from "@yielded/auth/OAuth";
-import { snapshotOAuthSync } from "@yielded/auth/OAuth";
-import { Effect, Context, Layer } from "effect";
-
-import { OAuthConnectedCustody } from "./connected-custody";
-import { OAuthConnectedFlow } from "./connected-flow";
-import type * as FTypes from "./connected-flow";
-import { OAuthConnectedState } from "./connected-state";
-import type * as STypes from "./connected-state";
-import { CurrentOAuthTransaction } from "./owner";
-import { OAuthQueryCompiler } from "./query-compiler";
-import { invariant, sameIdentity, oauthIdentityKey } from "./state";
-
-const make = Effect.gen(function* () {
-  const operations = yield* OAuthQueryCompiler;
-  const C = yield* OAuthConnectedCustody;
-  const F = yield* OAuthConnectedFlow;
-  const S = yield* OAuthConnectedState;
-
-  const { ne, sql } = operations;
-  const { both, col, equal } = operations;
-
-  const validMetadata = (context: M.OAuthConnectedTokenContext, now: number) => {
-    const m = context.metadata,
-      p = context.configuration.profile;
-
-    return (
-      p.provider === context.identity.provider &&
-      context.configuration.provider === context.identity.provider &&
-      context.configuration.issuer === context.identity.issuer &&
-      m.obtainedAtMillis <= now &&
-      m.useUntilMillis > m.obtainedAtMillis &&
-      m.useUntilMillis <= m.obtainedAtMillis + p.maximumAccessLifetimeMillis &&
-      (m.accessExpiresAtMillis === undefined || m.useUntilMillis <= m.accessExpiresAtMillis) &&
-      m.scopes.every((v) => p.scopes.includes(v)) &&
-      m.resources.every((v) => p.resources.includes(v)) &&
-      new Set(m.scopes).size === m.scopes.length &&
-      new Set(m.resources).size === m.resources.length &&
-      (m.refreshUseUntilMillis === undefined ||
-        (p.retention === "access-and-refresh" &&
-          p.maximumRefreshLifetimeMillis !== undefined &&
-          m.refreshUseUntilMillis > m.obtainedAtMillis &&
-          m.refreshUseUntilMillis <= m.obtainedAtMillis + p.maximumRefreshLifetimeMillis &&
-          (m.refreshExpiresAtMillis === undefined ||
-            m.refreshUseUntilMillis <= m.refreshExpiresAtMillis)))
-    );
-  };
-
-  /** The only writer that activates or replaces a confirmed connected grant. */
-  const activateGrant = Effect.fn("oauthConnected.activateGrant")(function* (
-    mapping: STypes.Mapping,
-    grant: M.OAuthConnectedStoredGrant,
-    native: unknown,
-    now: number,
-    replacing: boolean,
-  ) {
-    const owner = yield* CurrentOAuthTransaction;
-    const token = grant.context;
-    const g = mapping.grant;
-    const identityKey = yield* oauthIdentityKey(token.identity);
-    const clientKey = yield* S.clientKey(token.configuration);
-    const cohortKey = yield* S.cohortKey(clientKey, identityKey);
-
-    const values = {
-      ...g.encodeInsert({
-        grant: snapshotOAuthSync(M.OAuthConnectedStoredGrant, grant),
-        subjectId: S.nativeCopy(native),
-      }),
-      [g.moduleId]: token.moduleId,
-      [g.grantId]: token.grantId,
-      [g.subjectId]: native,
-      [g.identityKey]: identityKey,
-      [g.activeIdentityKey]: identityKey,
-      [g.clientKey]: clientKey,
-      [g.cohortKey]: cohortKey,
-      [g.profileKey]: token.configuration.profile.key,
-      [g.grantVersion]: token.grantVersion,
-      [g.tokenVersion]: token.tokenVersion,
-      [g.cohortGeneration]: token.cohortGeneration,
-      [g.state]: "Active",
-      [g.version]: owner.marker,
-      [g.context]: S.tokenContextStorage.encode(token),
-      [g.sealed]: S.sealedStorage.encode(grant.sealed),
-      [g.summary]: S.summaryStorage.encode(C.summary(token)),
-      [g.revocationJobId]: null,
-      [g.refreshWork]: "None",
-      [g.refreshClaim]: null,
-      [g.refreshClaimExpiresAt]: null,
-      [g.retentionUntil]: mapping.clock.encodeInstant(
-        S.retainedUntil(
-          mapping,
-          Math.max(now, token.metadata.useUntilMillis, token.metadata.refreshUseUntilMillis ?? 0),
-        ),
-      ),
-    };
-
-    if (!replacing) {
-      yield* owner.insert(g.table, values, {
-        [g.moduleId]: token.moduleId,
-        [g.grantId]: token.grantId,
-      });
-    } else
-      yield* owner.update(
-        g.table,
-        { [g.moduleId]: token.moduleId, [g.grantId]: token.grantId },
-        values,
-      );
-  });
-
-  const settle = Effect.fn("oauthConnected.settle")(function* (
-    mapping: STypes.Mapping,
-    input: FTypes.Input<"settle">,
-  ) {
-    const owner = yield* CurrentOAuthTransaction;
-
-    const c = input.claim.flow.context,
-      out = input.outcome;
-
-    const found = yield* S.current(mapping, c.revision.subjectId);
-
-    const authorized =
-      found !== undefined &&
-      (yield* S.action(
-        mapping,
-        found,
-        input.authorization,
-        "settle",
-        F.expected(input.claim.flow),
-      ));
-
-    const cl = yield* S.client(mapping, S.configuration(input.claim.flow), false);
-
-    if (cl === undefined) return { _tag: "Rejected" } as const;
-    if (out._tag !== "Verified" && out._tag !== "Quarantined") {
-      const claimed = yield* F.exact(mapping, input.claim);
-
-      if (claimed === undefined) return { _tag: "Rejected" } as const;
-      const state = out._tag === "Unissued" ? "Rejected" : out._tag;
-
-      yield* F.terminal(
-        mapping,
-        input.claim,
-        state,
-        out._tag === "Cancelled" || out._tag === "Unissued" ? "Resolved" : "Unresolved",
-      );
-
-      return { _tag: state } as
-        | { readonly _tag: "Cancelled" }
-        | { readonly _tag: "Rejected" }
-        | { readonly _tag: "Conflict" }
-        | { readonly _tag: "Ambiguous" };
-    }
-
-    const grant = snapshotOAuthSync(M.OAuthConnectedStoredGrant, out.grant),
-      token = grant.context;
-
-    invariant(
-      token.moduleId === c.moduleId &&
-        token.subjectId === c.revision.subjectId &&
-        token.grantId === c.grantId &&
-        token.identity.provider === c.provider &&
-        token.identity.issuer === c.issuer &&
-        (yield* S.clientKey(token.configuration)) === cl.id &&
-        S.tokenContextStorage.encode({
-          ...token,
-          configuration: S.configuration(input.claim.flow),
-        }) === S.tokenContextStorage.encode(token),
-    );
-    const native = yield* mapping.subjectId.toNative(c.revision.subjectId);
-
-    const tuple = yield* F.readTuple(mapping.ownership, token.identity),
-      t = mapping.ownership.tuple;
-
-    if (
-      tuple.row[t.state] === "Reserved" ||
-      (tuple.row[t.state] === "Owned" && !mapping.subjectId.equals(tuple.row[t.subjectId], native))
-    ) {
-      const claimed = yield* F.exact(mapping, input.claim);
-
-      if (claimed !== undefined) yield* F.terminal(mapping, input.claim, "Conflict", "Unresolved");
-
-      return { _tag: "Conflict" } as const;
-    }
-    const co = yield* S.cohort(mapping, cl.id, tuple.key, true);
-    const original = yield* S.readGrant(mapping, c.moduleId, c.grantId);
-    const g = mapping.grant;
-
-    const other = yield* owner.read(
-      g.table,
-      both(
-        equal(g.table, {
-          [g.moduleId]: c.moduleId,
-          [g.subjectId]: native,
-          [g.profileKey]: c.profile.key,
-          [g.activeIdentityKey]: tuple.key,
-        }),
-        ne(col(g.table, g.grantId), c.grantId),
-      ),
-      { limit: 1 },
-    );
-
-    const claimed = yield* F.exact(mapping, input.claim);
-
-    if (claimed === undefined) return { _tag: "Rejected" } as const;
-    invariant(
-      token.exchangeOrder === input.claim.order &&
-        validMetadata(token, claimed.now) &&
-        token.metadata.obtainedAtMillis >= input.claim.claimedAtMillis,
-    );
-    const reconnect = c.reconnect;
-
-    const targetOkay =
-      reconnect === undefined
-        ? original === undefined
-        : original !== undefined &&
-          F.sameTarget(reconnect, original.context) &&
-          sameIdentity(reconnect.identity, token.identity) &&
-          original.row[g.refreshWork] !== "Unresolved";
-
-    const previousSafe = yield* C.noFormerOwner(mapping, tuple.key, cl.id, native);
-
-    const active =
-      out._tag === "Verified" &&
-      authorized &&
-      claimed.active &&
-      c.profile.issuance === "active" &&
-      token.metadata.useUntilMillis > claimed.now &&
-      !co.blocked &&
-      co.generation === token.cohortGeneration &&
-      S.orderNumber(input.claim.order) > co.cutoff &&
-      targetOkay &&
-      other.rows.length === 0 &&
-      previousSafe;
-
-    if (!active) {
-      // Foreign historical custody never authorizes a new remote operation.
-      if (!previousSafe) {
-        yield* F.terminal(mapping, input.claim, "Conflict", "Unresolved");
-
-        return { _tag: "Conflict" } as const;
-      }
-      if (tuple.row[t.state] === "Unowned")
-        yield* F.acquireTuple(mapping.ownership, token.identity, tuple.key, S.nativeCopy(native));
-      yield* C.fence(mapping, cl, co);
-      if (out.cleanup !== undefined) {
-        yield* C.storeJob(mapping, out.cleanup, token, native, claimed.now);
-        yield* F.terminal(mapping, input.claim, "Quarantined", "Resolved", { cohort: co.id });
-      } else
-        yield* F.terminal(mapping, input.claim, "Quarantined", "Unresolved", {
-          cohort: co.id,
-          sealed: grant,
-        });
-
-      return { _tag: targetOkay && other.rows.length === 0 ? "Rejected" : "Conflict" } as
-        | { readonly _tag: "Rejected" }
-        | { readonly _tag: "Conflict" };
-    }
-    if (tuple.row[t.state] === "Unowned")
-      yield* F.acquireTuple(mapping.ownership, token.identity, tuple.key, S.nativeCopy(native));
-
-    yield* activateGrant(mapping, grant, native, claimed.now, original !== undefined);
-    yield* F.terminal(mapping, input.claim, "Connected", "Resolved", { cohort: co.id });
-    owner.postconditions.push(
-      sql`${mapping.clock.engineNowMillis} >= ${claimed.now} and ${mapping.clock.engineNowMillis} < ${Math.min(input.claim.claimExpiresAtMillis, token.metadata.useUntilMillis)}`,
-    );
-
-    return { _tag: "Connected", grant } as const;
-  });
-
-  return { validMetadata, activateGrant, settle };
-});
-
-export class OAuthConnectedSettlement extends Context.Service<
-  OAuthConnectedSettlement,
-  Effect.Success<typeof make>
->()("effect-auth/persistence/OAuthConnectedSettlement") {
-  static readonly layer = Layer.effect(OAuthConnectedSettlement, make);
-}