@yielded/auth-persistence 0.1.0-beta.24 → 0.1.0-beta.26

package/src/internal/oauth/registration.ts

@@ -1,676 +0,0 @@
-/* oxlint-disable no-explicit-any -- compiler table shapes are erased; domain codecs and error channels remain typed. */
-import {
-  OAuthRegistrationAccess,
-  OAuthRegistrationDecision,
-  OAuthRegistrationFingerprint,
-  OAuthRegistrationInspection,
-  OAuthRegistrationIntent,
-  OAuthCredentialSnapshot,
-  OAuthDisplayProfile,
-  OAuthSignInTransactionContext,
-  type OAuthExternalIdentity,
-  snapshotOAuthSync,
-} from "@yielded/auth/OAuth";
-import type { SecurityRevision } from "@yielded/auth/Sessions";
-import { Effect, Schema, Context, Layer } from "effect";
-
-import type { PersistenceMappingError, SubjectIdCodec } from "../models/common";
-import type { OAuthRegistrationBase } from "../models/oauth-model";
-import { OAuthFlow } from "./flow";
-import { CurrentOAuthTransaction } from "./owner";
-import { OAuthQueryCompiler } from "./query-compiler";
-import { invariant, oauthIdentityKey, sameIdentity, storage } from "./state";
-
-export interface RegistrationResources {
-  readonly provisioningIdentity: string;
-  readonly pendingReference?: string;
-  readonly subjectId?: unknown;
-  readonly credentialId?: string;
-  readonly revision?: string;
-}
-
-/** Public mapping callbacks are closed Effects; erasing native row shapes must
- * not erase their error or requirements channels. */
-export type RegistrationCallbacks<Registration> = Pick<
-  OAuthRegistrationBase<Registration, any, any, any, any, unknown>,
-  "snapshot" | "snapshotSync" | "inspect" | "inspectSync"
->;
-
-const make = Effect.gen(function* () {
-  const operations = yield* OAuthQueryCompiler;
-  const flow = yield* OAuthFlow;
-
-  const { eq, sql } = operations;
-  const { discoverOwned, exactClaim, resolveOwned, terminalFlow } = flow;
-  const { both, col, equal, matchesNativeRow } = operations;
-
-  const intentStorage = storage(OAuthRegistrationIntent);
-
-  const decisionStorage = storage(OAuthRegistrationDecision);
-
-  const contextStorage = storage(OAuthSignInTransactionContext);
-
-  const profileStorage = storage(Schema.NullOr(OAuthDisplayProfile));
-
-  const reservationStorage = storage(
-    Schema.Struct({
-      moduleId: Schema.String,
-      reference: Schema.String,
-      commandId: Schema.String,
-      fingerprint: Schema.String,
-      provisioningIdentity: Schema.String,
-    }),
-  );
-
-  const readTuple = (ownership: any, identity: typeof OAuthExternalIdentity.Type) =>
-    Effect.flatMap(CurrentOAuthTransaction, (owner) =>
-      Effect.gen(function* () {
-        const t = ownership.tuple,
-          key = yield* oauthIdentityKey(identity);
-
-        const where = { [t.identityKey]: key };
-        const observed = yield* owner.read(t.table, equal(t.table, where), { limit: 1 });
-
-        if (observed.rows.length === 0) {
-          const values = {
-            ...t.encodeInsert({ identityKey: key, identity }),
-            ...where,
-            [t.provider]: identity.provider,
-            [t.issuer]: identity.issuer,
-            [t.externalSubject]: identity.subject,
-            [t.state]: "Unowned",
-            [t.version]: owner.marker,
-            [t.subjectId]: null,
-            [t.reservation]: null,
-          };
-
-          const inserted = yield* owner.insert(t.table, values, where, true);
-
-          observed.rows = inserted.rows;
-        }
-        const row = observed.rows[0]!;
-
-        invariant(
-          row[t.provider] === identity.provider &&
-            row[t.issuer] === identity.issuer &&
-            row[t.externalSubject] === identity.subject &&
-            ["Unowned", "Reserved", "Owned"].includes(row[t.state]),
-        );
-        invariant(
-          row[t.state] === "Owned"
-            ? row[t.subjectId] !== null
-            : row[t.subjectId] === null &&
-                (row[t.state] === "Reserved"
-                  ? typeof row[t.reservation] === "string"
-                  : row[t.reservation] === null),
-        );
-        if (ownership.mode === "separate") {
-          const o = ownership.external;
-
-          const external = yield* owner.read(o.table, equal(o.table, { [o.identityKey]: key }), {
-            limit: 1,
-          });
-
-          if (row[t.state] === "Owned") {
-            const linked = external.rows[0];
-
-            invariant(
-              linked !== undefined &&
-                linked[o.provider] === identity.provider &&
-                linked[o.issuer] === identity.issuer &&
-                linked[o.externalSubject] === identity.subject &&
-                matchesNativeRow(o.table, linked, { [o.subjectId]: row[t.subjectId] }),
-            );
-            const owned = sql`exists(select 1 from ${o.table} where ${both(equal(o.table, { [o.identityKey]: key }), o.ownedCondition)})`;
-
-            invariant(yield* owner.check(owned));
-            owner.postconditions.push(owned);
-          } else invariant(external.rows.length === 0);
-        }
-
-        return { observed, row, key };
-      }),
-    );
-
-  const acquireTuple = (
-    ownership: any,
-    identity: typeof OAuthExternalIdentity.Type,
-    key: string,
-    subjectId: unknown,
-  ) =>
-    Effect.flatMap(CurrentOAuthTransaction, (owner) =>
-      Effect.gen(function* () {
-        const t = ownership.tuple;
-
-        yield* owner.update(
-          t.table,
-          { [t.identityKey]: key },
-          {
-            [t.state]: "Owned",
-            [t.subjectId]: subjectId,
-            [t.reservation]: null,
-            [t.version]: owner.marker,
-          },
-        );
-        if (ownership.mode === "separate") {
-          const o = ownership.external;
-
-          const values = {
-            ...o.encodeInsert({ identity, identityKey: key, subjectId }),
-            [o.identityKey]: key,
-            [o.provider]: identity.provider,
-            [o.issuer]: identity.issuer,
-            [o.externalSubject]: identity.subject,
-            [o.subjectId]: subjectId,
-          };
-
-          yield* owner.insert(o.table, values, { [o.identityKey]: key });
-        }
-      }),
-    );
-
-  const settleRegistrationIntent = (mapping: any, input: any) =>
-    Effect.flatMap(CurrentOAuthTransaction, (owner) =>
-      Effect.gen(function* () {
-        const identity = input.identity.identity,
-          context = input.claim.flow.context;
-
-        invariant(identity.provider === context.provider && identity.issuer === context.issuer);
-        const found = yield* discoverOwned(mapping.signIn, identity);
-        const tuple = found.owned ? undefined : yield* readTuple(mapping.ownership, identity);
-        const exact = yield* exactClaim(mapping.signIn, input.claim, "sign-in");
-
-        if (exact === undefined) return { _tag: "Rejected" } as const;
-        const credential = resolveOwned(mapping.signIn, context.moduleId, identity, found);
-
-        if (credential !== undefined) {
-          yield* terminalFlow(mapping.signIn, input.claim.flow, "Verified");
-
-          return { _tag: "Verified", credential } as const;
-        }
-        let decision: any = { _tag: "Rejected" };
-
-        if (
-          !found.owned &&
-          tuple?.row[mapping.ownership.tuple.state] === "Unowned" &&
-          input.intent !== undefined
-        ) {
-          const intent = snapshotOAuthSync(OAuthRegistrationIntent, input.intent);
-          const c = intent.context;
-
-          invariant(
-            sameIdentity(intent.identity, identity) &&
-              profileStorage.encode(intent.profile ?? null) ===
-                profileStorage.encode(input.identity.profile ?? null) &&
-              intent.claimId === input.claim.claimId &&
-              intent.claimedAtMillis === input.claim.claimedAtMillis &&
-              contextStorage.encode(c) === contextStorage.encode(context),
-          );
-
-          const allowed =
-            intent.issuedAtMillis >= intent.claimedAtMillis &&
-            intent.verifiedAtMillis <= intent.issuedAtMillis &&
-            intent.issuedAtMillis <= exact.now &&
-            exact.now < intent.expiresAtMillis &&
-            intent.expiresAtMillis <= c.requestBindingExpiresAtMillis &&
-            intent.retentionUntilMillis >= intent.expiresAtMillis &&
-            (yield* owner.check(mapping.eligibility.condition({ intent })));
-
-          if (allowed) {
-            const i = mapping.intent,
-              encode = mapping.signIn.clock.encodeInstant;
-
-            const key = { [i.moduleId]: c.moduleId, [i.reference]: intent.reference };
-
-            const values = {
-              ...i.encodeInsert(snapshotOAuthSync(OAuthRegistrationIntent, intent)),
-              ...key,
-              [i.flowId]: c.flowId,
-              [i.claimId]: intent.claimId,
-              [i.identityKey]: tuple.key,
-              [i.version]: owner.marker,
-              [i.state]: "Unbound",
-              [i.snapshot]: intentStorage.encode(intent),
-              [i.commandId]: null,
-              [i.fingerprint]: null,
-              [i.pendingReference]: null,
-              [i.expiresAt]: encode(intent.expiresAtMillis),
-              [i.retentionUntil]: encode(intent.retentionUntilMillis),
-            };
-
-            yield* owner.insert(i.table, values, key);
-            owner.postconditions.push(
-              mapping.eligibility.condition({ intent }),
-              sql`${mapping.signIn.clock.engineNowMillis} >= ${intent.issuedAtMillis} and
-            ${mapping.signIn.clock.engineNowMillis} < ${intent.expiresAtMillis}`,
-            );
-            decision = { _tag: "RegistrationIssued", intent };
-          }
-        }
-        yield* terminalFlow(mapping.signIn, input.claim.flow, decision._tag);
-
-        return decision;
-      }),
-    );
-
-  const inspectIntent = (
-    mapping: any,
-    original: typeof OAuthRegistrationAccess.Type,
-    discovery = false,
-  ) =>
-    Effect.flatMap(CurrentOAuthTransaction, (owner) =>
-      Effect.gen(function* () {
-        const access = snapshotOAuthSync(OAuthRegistrationAccess, original),
-          i = mapping.intent;
-
-        const observed = yield* owner.read(
-          i.table,
-          equal(i.table, {
-            [i.moduleId]: access.moduleId,
-            [i.reference]: access.reference,
-          }),
-          { limit: 1, ...(discovery ? { lock: false, observe: false } : {}) },
-        );
-
-        const row = observed.rows[0];
-
-        if (row === undefined) return undefined;
-
-        const intent = intentStorage.decode(row[i.snapshot]),
-          c = intent.context,
-          now = yield* owner.now(mapping.clock);
-
-        invariant(
-          row[i.moduleId] === c.moduleId &&
-            row[i.reference] === intent.reference &&
-            row[i.flowId] === c.flowId &&
-            row[i.claimId] === intent.claimId &&
-            row[i.identityKey] === (yield* oauthIdentityKey(intent.identity)) &&
-            mapping.clock.decodeInstant(row[i.expiresAt]) === intent.expiresAtMillis &&
-            mapping.clock.decodeInstant(row[i.retentionUntil]) === intent.retentionUntilMillis,
-        );
-        if (
-          access.moduleId !== c.moduleId ||
-          access.reference !== intent.reference ||
-          access.flowId !== c.flowId ||
-          access.requestBindingVerifier !== c.requestBindingVerifier ||
-          access.requestBindingExpiresAtMillis !== c.requestBindingExpiresAtMillis ||
-          access.credentialDigest !== intent.credentialDigest ||
-          now < intent.issuedAtMillis ||
-          now >= intent.expiresAtMillis
-        )
-          return undefined;
-        let application: any;
-
-        if (row[i.state] === "Unbound") {
-          invariant(
-            row[i.commandId] === null &&
-              row[i.fingerprint] === null &&
-              row[i.pendingReference] === null,
-          );
-          application = { _tag: "Unbound" };
-        } else {
-          application = {
-            _tag: row[i.state],
-            commandId: row[i.commandId],
-            fingerprint: row[i.fingerprint],
-            ...(row[i.state] === "ProvisioningPending"
-              ? { reference: row[i.pendingReference] }
-              : {}),
-          };
-        }
-        const inspection = snapshotOAuthSync(OAuthRegistrationInspection, { intent, application });
-
-        owner.postconditions
-          .push(sql`${mapping.clock.engineNowMillis} >= ${intent.issuedAtMillis} and
-      ${mapping.clock.engineNowMillis} < ${intent.expiresAtMillis}`);
-
-        return { observed, row, inspection };
-      }),
-    );
-
-  const registrationResources = (mapping: any) =>
-    Effect.gen(function* () {
-      const provisioningIdentity = yield* mapping.allocateProvisioningIdentity as Effect.Effect<
-        string,
-        PersistenceMappingError
-      >;
-
-      invariant(
-        typeof provisioningIdentity === "string" &&
-          provisioningIdentity.length > 0 &&
-          provisioningIdentity.length <= 256,
-      );
-      if (mapping.mode === "pending") {
-        const pendingReference = yield* mapping.allocatePendingReference as Effect.Effect<
-          string,
-          PersistenceMappingError
-        >;
-
-        invariant(
-          typeof pendingReference === "string" &&
-            pendingReference.length > 0 &&
-            pendingReference.length <= 256,
-        );
-
-        return { provisioningIdentity, pendingReference } as RegistrationResources;
-      }
-
-      const subjectId = yield* mapping.allocateSubjectId as Effect.Effect<
-        unknown,
-        PersistenceMappingError
-      >;
-
-      const publicId = yield* (mapping.subjectId as SubjectIdCodec<unknown>).toSubject(subjectId);
-
-      invariant(
-        mapping.subjectId.equals(
-          subjectId,
-          yield* (mapping.subjectId as SubjectIdCodec<unknown>).toNative(publicId),
-        ),
-      );
-
-      const credentialId = snapshotOAuthSync(
-        OAuthCredentialSnapshot.fields.credentialId,
-        yield* mapping.allocateCredentialId as Effect.Effect<string, PersistenceMappingError>,
-      );
-
-      const revision = snapshotOAuthSync(
-        OAuthCredentialSnapshot.fields.credentialRevision,
-        yield* mapping.allocateRevision as Effect.Effect<SecurityRevision, PersistenceMappingError>,
-      );
-
-      return { provisioningIdentity, subjectId, credentialId, revision } as RegistrationResources;
-    });
-
-  const registrationData = <Registration>(
-    mapping: any,
-    input: {
-      readonly intent: OAuthRegistrationIntent;
-      readonly registration: Registration;
-      readonly fingerprint: string;
-    },
-    bound: boolean,
-  ) =>
-    Effect.gen(function* () {
-      const snapshot = bound
-        ? (invariant(mapping.snapshotSync !== undefined), mapping.snapshotSync(input.registration))
-        : yield* (mapping as RegistrationCallbacks<Registration>).snapshot(input.registration);
-
-      const encoded = mapping.application.encode(snapshot);
-
-      invariant(typeof encoded === "string" && new TextEncoder().encode(encoded).length <= 1048576);
-      const detached = mapping.application.decode(encoded);
-
-      invariant(mapping.application.encode(detached) === encoded);
-
-      const checked = bound
-        ? (invariant(mapping.inspectSync !== undefined),
-          mapping.inspectSync({
-            intent: snapshotOAuthSync(OAuthRegistrationIntent, input.intent),
-            registration: mapping.application.decode(encoded),
-          }))
-        : yield* (mapping as RegistrationCallbacks<Registration>).inspect({
-            intent: snapshotOAuthSync(OAuthRegistrationIntent, input.intent),
-            registration: mapping.application.decode(encoded),
-          });
-
-      const fingerprint = snapshotOAuthSync(OAuthRegistrationFingerprint, checked.fingerprint);
-
-      invariant(typeof checked.eligible === "boolean");
-
-      return {
-        encoded,
-        registration: detached as Registration,
-        fingerprint,
-        eligible: checked.eligible && fingerprint === input.fingerprint,
-      };
-    });
-
-  const register = (
-    mapping: any,
-    input: any,
-    data: { readonly encoded: string; readonly fingerprint: string; readonly eligible: boolean },
-    resources: RegistrationResources,
-  ) =>
-    Effect.flatMap(CurrentOAuthTransaction, (owner) =>
-      Effect.gen(function* () {
-        const intent = snapshotOAuthSync(OAuthRegistrationIntent, input.intent),
-          c = intent.context;
-
-        const discovered = yield* inspectIntent(mapping, input.access, true);
-
-        if (
-          discovered === undefined ||
-          intentStorage.encode(discovered.inspection.intent) !== intentStorage.encode(intent)
-        )
-          return { _tag: "Rejected" } as const;
-        const nativeSubjectId = resources.subjectId;
-
-        const policyInput = () => ({
-          intent: snapshotOAuthSync(OAuthRegistrationIntent, intent),
-          registration: mapping.application.decode(data.encoded),
-          ...(mapping.mode === "atomic" ? { nativeSubjectId } : {}),
-        });
-
-        invariant((mapping.eligibility.guards?.length ?? 0) <= 32);
-        for (const guard of mapping.eligibility.guards ?? []) {
-          const locked = yield* owner.read(guard.table, guard.condition(policyInput()), {
-            orderBy: col(guard.table, guard.orderBy),
-            admissionOnly: true,
-          });
-
-          invariant(locked.rows.length > 0);
-        }
-        const tuple = yield* readTuple(mapping.ownership, intent.identity);
-        const inspected = yield* inspectIntent(mapping, input.access);
-
-        if (
-          inspected === undefined ||
-          intentStorage.encode(inspected.inspection.intent) !== intentStorage.encode(intent)
-        )
-          return { _tag: "Rejected" } as const;
-
-        const r = mapping.command,
-          i = mapping.intent,
-          t = mapping.ownership.tuple;
-
-        const commandKey = { [r.moduleId]: c.moduleId, [r.commandId]: input.commandId };
-        const command = yield* owner.read(r.table, equal(r.table, commandKey), { limit: 1 });
-        const previous = command.rows[0];
-
-        if (previous !== undefined) {
-          if (
-            previous[r.reference] !== intent.reference ||
-            previous[r.identityKey] !== tuple.key ||
-            previous[r.fingerprint] !== data.fingerprint ||
-            previous[r.intentSnapshot] !== intentStorage.encode(intent) ||
-            previous[r.applicationSnapshot] !== data.encoded
-          )
-            return { _tag: "Conflict" } as const;
-          invariant(
-            mapping.application.encode(
-              mapping.application.decode(previous[r.applicationSnapshot]),
-            ) === data.encoded,
-          );
-          const old = decisionStorage.decode(previous[r.decision]);
-
-          invariant(inspected.inspection.application._tag === old._tag);
-
-          return old._tag === "Registered" || old._tag === "ProvisioningPending"
-            ? { ...old, replayed: true }
-            : old;
-        }
-        if (inspected.inspection.application._tag !== "Unbound" || tuple.row[t.state] !== "Unowned")
-          return { _tag: "Conflict" } as const;
-        if (data.fingerprint !== input.fingerprint) return { _tag: "Rejected" } as const;
-
-        const admitted =
-          data.eligible && (yield* owner.check(mapping.eligibility.admission(policyInput())));
-
-        let decision: typeof OAuthRegistrationDecision.Type;
-
-        if (!admitted) decision = { _tag: "Rejected" };
-        else if (mapping.mode === "pending") {
-          invariant(resources.pendingReference !== undefined);
-
-          const reservation = reservationStorage.encode({
-            moduleId: c.moduleId,
-            reference: intent.reference,
-            commandId: input.commandId,
-            fingerprint: data.fingerprint,
-            provisioningIdentity: resources.provisioningIdentity,
-          });
-
-          yield* owner.update(
-            t.table,
-            { [t.identityKey]: tuple.key },
-            {
-              [t.state]: "Reserved",
-              [t.version]: owner.marker,
-              [t.reservation]: reservation,
-            },
-          );
-          decision = {
-            _tag: "ProvisioningPending",
-            reference: resources.pendingReference,
-            replayed: false,
-          };
-        } else {
-          invariant(resources.credentialId !== undefined && resources.revision !== undefined);
-
-          const s = mapping.subject,
-            cr = mapping.credential,
-            a = mapping.authority;
-
-          const subjectValues = {
-            ...mapping.encodeSubjectInsert(policyInput(), {
-              subjectId: nativeSubjectId,
-              securityRevision: resources.revision,
-            }),
-            [s.id]: nativeSubjectId,
-            [s.securityRevision]: resources.revision,
-          };
-
-          yield* owner.insert(s.table, subjectValues, { [s.id]: nativeSubjectId });
-
-          const credentialValues = {
-            ...cr.encodeInsert({
-              moduleId: c.moduleId,
-              subjectId: nativeSubjectId,
-              identityKey: tuple.key,
-              credentialId: resources.credentialId,
-              credentialRevision: resources.revision,
-            }),
-            [cr.moduleId]: c.moduleId,
-            [cr.subjectId]: nativeSubjectId,
-            [cr.identityKey]: tuple.key,
-            [cr.credentialId]: resources.credentialId,
-            [cr.credentialRevision]: resources.revision,
-          };
-
-          invariant(
-            cr.isActiveStatus(credentialValues[cr.status]) &&
-              s.isActiveStatus(subjectValues[s.status]),
-          );
-          yield* owner.insert(cr.table, credentialValues, {
-            [cr.credentialId]: resources.credentialId,
-          });
-
-          const authorityValues = {
-            ...a.encodeInsert({
-              subjectId: nativeSubjectId,
-              credentialId: resources.credentialId,
-              revision: resources.revision,
-            }),
-            [a.subjectId]: nativeSubjectId,
-            [a.credentialId]: resources.credentialId,
-            [a.revision]: resources.revision,
-          };
-
-          invariant(a.isActiveStatus(authorityValues[a.status]));
-          yield* owner.insert(a.table, authorityValues, {
-            [a.subjectId]: nativeSubjectId,
-            [a.credentialId]: resources.credentialId,
-          });
-          yield* acquireTuple(mapping.ownership, intent.identity, tuple.key, nativeSubjectId);
-          owner.postconditions.push(
-            sql`exists(select 1 from ${s.table} where ${both(
-              eq(col(s.table, s.id), nativeSubjectId),
-              s.activeCondition,
-            )})`,
-            sql`exists(select 1 from ${cr.table} where ${both(eq(col(cr.table, cr.credentialId), resources.credentialId), cr.activeCondition)})`,
-            sql`exists(select 1 from ${a.table} where ${both(
-              eq(col(a.table, a.credentialId), resources.credentialId),
-              eq(col(a.table, a.subjectId), nativeSubjectId),
-              a.activeCondition,
-            )})`,
-          );
-          decision = { _tag: "Registered", replayed: false };
-        }
-        const now = yield* owner.now(mapping.clock);
-
-        invariant(
-          Number.isSafeInteger(mapping.retentionMillis) && mapping.retentionMillis >= 120000,
-        );
-
-        const values = {
-          ...r.encodeInsert({
-            intent: snapshotOAuthSync(OAuthRegistrationIntent, intent),
-            commandId: input.commandId,
-            fingerprint: data.fingerprint,
-            registration: mapping.application.decode(data.encoded),
-            provisioningIdentity: resources.provisioningIdentity,
-          }),
-          ...commandKey,
-          [r.reference]: intent.reference,
-          [r.identityKey]: tuple.key,
-          [r.fingerprint]: data.fingerprint,
-          [r.intentSnapshot]: intentStorage.encode(intent),
-          [r.applicationSnapshot]: data.encoded,
-          [r.provisioningIdentity]: resources.provisioningIdentity,
-          [r.decision]: decisionStorage.encode(decision),
-          [r.retentionUntil]: mapping.clock.encodeInstant(
-            Math.max(intent.retentionUntilMillis, now + mapping.retentionMillis),
-          ),
-        };
-
-        const inserted = yield* owner.insert(r.table, values, commandKey);
-
-        command.rows = inserted.rows;
-        yield* owner.update(
-          i.table,
-          { [i.moduleId]: c.moduleId, [i.reference]: intent.reference },
-          {
-            [i.state]: decision._tag,
-            [i.commandId]: input.commandId,
-            [i.fingerprint]: data.fingerprint,
-            [i.version]: owner.marker,
-            [i.pendingReference]:
-              decision._tag === "ProvisioningPending" ? decision.reference : null,
-          },
-        );
-        if (admitted) owner.postconditions.push(mapping.eligibility.postcondition(policyInput()));
-
-        return decision;
-      }),
-    );
-
-  return {
-    intentStorage,
-    readTuple,
-    acquireTuple,
-    settleRegistrationIntent,
-    inspectIntent,
-    registrationResources,
-    registrationData,
-    register,
-  };
-});
-
-export class OAuthRegistration extends Context.Service<
-  OAuthRegistration,
-  Effect.Success<typeof make>
->()("effect-auth/persistence/OAuthRegistration") {
-  static readonly layer = Layer.effect(OAuthRegistration, make);
-}