@yielded/auth-persistence 0.1.0-beta.25 → 0.1.0-beta.26

package/src/internal/oauth/connected-access.ts

@@ -1,388 +0,0 @@
-import * as M from "@yielded/auth/OAuth";
-import { snapshotOAuthSync } from "@yielded/auth/OAuth";
-import { Effect, Context, Layer } from "effect";
-
-import { OAuthConnectedCustody } from "./connected-custody";
-import { OAuthConnectedFlow } from "./connected-flow";
-import type * as FTypes from "./connected-flow";
-import { OAuthConnectedSettlement } from "./connected-settlement";
-import { OAuthConnectedState } from "./connected-state";
-import type * as STypes from "./connected-state";
-import { CurrentOAuthTransaction } from "./owner";
-import { OAuthQueryCompiler } from "./query-compiler";
-import { invariant } from "./state";
-
-const make = Effect.gen(function* () {
-  const operations = yield* OAuthQueryCompiler;
-  const C = yield* OAuthConnectedCustody;
-  const F = yield* OAuthConnectedFlow;
-  const connectedSettlement = yield* OAuthConnectedSettlement;
-  const S = yield* OAuthConnectedState;
-
-  const { sql } = operations;
-  const { validMetadata } = connectedSettlement;
-  const { equal } = operations;
-
-  const locked = Effect.fn("oauthConnected.lockedGrant")(function* (
-    mapping: STypes.Mapping,
-    authorization: M.OAuthConnectedUseAuthorization,
-    grantId: M.OAuthConnectedTokenContext["grantId"],
-    purpose: "use" | "metadata",
-  ) {
-    const owner = yield* CurrentOAuthTransaction;
-    const initial = yield* S.readGrant(mapping, authorization.moduleId, grantId, false);
-
-    if (initial === undefined) return undefined;
-    const found = yield* S.useAuthority(mapping, authorization, purpose, initial.context);
-
-    if (found === undefined) return undefined;
-    const client = yield* S.client(mapping, initial.context.configuration, false);
-
-    if (client === undefined) return undefined;
-
-    const tuple = yield* F.inspectTuple(mapping, initial.context.identity),
-      t = mapping.ownership.tuple;
-
-    if (
-      tuple.row?.[t.state] !== "Owned" ||
-      !mapping.subjectId.equals(tuple.row[t.subjectId], found.nativeId)
-    )
-      return undefined;
-    const cohort = yield* S.cohort(mapping, client.id, tuple.key, false);
-
-    invariant(cohort.row !== undefined);
-    const grant = yield* S.readGrant(mapping, authorization.moduleId, grantId);
-
-    if (grant === undefined || !C.sameContext(grant.context, initial.context)) return undefined;
-
-    return { found, client, tuple, cohort, grant, now: yield* owner.now(mapping.clock) };
-  });
-
-  const state = (
-    mapping: STypes.Authority,
-    read: NonNullable<Effect.Success<ReturnType<typeof locked>>>,
-  ) => {
-    const g = mapping.grant;
-
-    if (
-      read.cohort.blocked ||
-      read.cohort.generation !== read.grant.context.cohortGeneration ||
-      read.grant.row[g.activeIdentityKey] !== read.tuple.key
-    )
-      return "ReauthorizationRequired" as const;
-
-    return read.grant.row[g.state] === "Refreshing"
-      ? ("Busy" as const)
-      : read.grant.row[g.state] === "Active"
-        ? ("Active" as const)
-        : ("ReauthorizationRequired" as const);
-  };
-
-  const inspectAccess = Effect.fn("oauthConnected.inspectAccess")(function* (
-    mapping: STypes.Mapping,
-    input: FTypes.Input<"inspectAccess">,
-  ) {
-    const read = yield* locked(mapping, input.authorization, input.grantId, "use");
-
-    if (read === undefined || read.grant.context.configuration.profile.key !== input.profileKey)
-      return { _tag: "Rejected" } as const;
-    const status = state(mapping, read);
-
-    if (status !== "Active") return { _tag: status };
-    if (read.grant.sealed === undefined) return { _tag: "ReauthorizationRequired" } as const;
-
-    return {
-      _tag: "Target",
-      grant: { context: read.grant.context, sealed: read.grant.sealed },
-    } as const;
-  });
-
-  const claimRefresh = Effect.fn("oauthConnected.claimRefresh")(function* (
-    mapping: STypes.Mapping,
-    input: FTypes.Input<"claimRefresh">,
-  ) {
-    const owner = yield* CurrentOAuthTransaction;
-    const read = yield* locked(mapping, input.authorization, input.grant.context.grantId, "use");
-
-    if (read === undefined) return { _tag: "Rejected" } as const;
-
-    const status = state(mapping, read),
-      g = mapping.grant;
-
-    if (status !== "Active") return { _tag: status };
-
-    const token = read.grant.context,
-      p = token.configuration.profile;
-
-    if (
-      read.grant.sealed === undefined ||
-      !C.sameGrant(input.grant, { context: token, sealed: read.grant.sealed })
-    )
-      return { _tag: "Rejected" } as const;
-    if (read.grant.row[g.refreshWork] === "Unresolved") return { _tag: "Busy" } as const;
-    if (
-      p.refresh === "unsupported" ||
-      token.metadata.refreshUseUntilMillis === undefined ||
-      read.now >= token.metadata.refreshUseUntilMillis
-    )
-      return { _tag: "ReauthorizationRequired" } as const;
-    if (read.now < token.metadata.useUntilMillis - p.refreshAheadMillis)
-      return { _tag: "Busy" } as const;
-    invariant(
-      Number.isSafeInteger(input.lifetimeMillis) &&
-        input.lifetimeMillis >= 1000 &&
-        input.lifetimeMillis <= 120000 &&
-        input.nextTokenVersion !== token.tokenVersion,
-    );
-
-    const expires = Math.min(
-      read.now + input.lifetimeMillis,
-      token.metadata.refreshUseUntilMillis,
-      input.authorization.expiresAtMillis,
-    );
-
-    if (expires <= read.now) return { _tag: "Rejected" } as const;
-
-    const claim = snapshotOAuthSync(M.OAuthConnectedRefreshClaim, {
-      grant: input.grant,
-      order: String(yield* S.nextOrder(mapping, read.client)),
-      claimId: input.claimId,
-      claimedAtMillis: read.now,
-      claimExpiresAtMillis: expires,
-      nextTokenVersion: input.nextTokenVersion,
-    });
-
-    yield* owner.update(
-      g.table,
-      { [g.moduleId]: token.moduleId, [g.grantId]: token.grantId },
-      {
-        [g.state]: "Refreshing",
-        [g.refreshWork]: "Unresolved",
-        [g.refreshClaim]: S.refreshStorage.encode(claim),
-        [g.refreshClaimExpiresAt]: mapping.clock.encodeInstant(expires),
-        [g.version]: owner.marker,
-      },
-    );
-    owner.postconditions.push(
-      sql`${mapping.clock.engineNowMillis} >= ${read.now} and ${mapping.clock.engineNowMillis} < ${expires}`,
-    );
-
-    return { _tag: "Claimed", claim } as const;
-  });
-
-  const settleRefresh = Effect.fn("oauthConnected.settleRefresh")(function* (
-    mapping: STypes.Mapping,
-    input: FTypes.Input<"settleRefresh">,
-  ) {
-    const owner = yield* CurrentOAuthTransaction;
-
-    const old = input.claim.grant.context,
-      g = mapping.grant;
-
-    // Capture policy before suffix locks. Loss of authorization still permits only
-    // cleanup of exact original work under its unchanged global owner.
-    const authorized =
-      (yield* S.useAuthority(mapping, input.authorization, "use", old)) !== undefined;
-
-    const native = yield* mapping.subjectId.toNative(old.subjectId);
-    const client = yield* S.client(mapping, old.configuration, false);
-
-    if (client === undefined) return { _tag: "Rejected" } as const;
-
-    const tuple = yield* F.inspectTuple(mapping, old.identity),
-      t = mapping.ownership.tuple;
-
-    if (
-      tuple.row?.[t.state] !== "Owned" ||
-      !mapping.subjectId.equals(tuple.row[t.subjectId], native)
-    )
-      return { _tag: "Rejected" } as const;
-    const cohort = yield* S.cohort(mapping, client.id, tuple.key, false);
-
-    invariant(cohort.row !== undefined);
-    const read = yield* S.readGrant(mapping, old.moduleId, old.grantId);
-
-    if (
-      read === undefined ||
-      read.row[g.refreshWork] !== "Unresolved" ||
-      read.row[g.refreshClaim] !== S.refreshStorage.encode(input.claim)
-    )
-      return { _tag: "Rejected" } as const;
-    invariant(
-      mapping.clock.decodeInstant(read.row[g.refreshClaimExpiresAt]) ===
-        input.claim.claimExpiresAtMillis,
-    );
-    const now = yield* owner.now(mapping.clock);
-
-    invariant(now >= input.claim.claimedAtMillis);
-    const outcome = input.outcome;
-    const incoming = outcome._tag === "Refreshed" ? outcome.grant : undefined;
-
-    if (incoming !== undefined)
-      invariant(
-        C.sameContext(
-          {
-            ...incoming.context,
-            tokenVersion: old.tokenVersion,
-            metadata: old.metadata,
-            exchangeOrder: old.exchangeOrder,
-          },
-          old,
-        ) &&
-          incoming.context.tokenVersion === input.claim.nextTokenVersion &&
-          incoming.context.exchangeOrder === input.claim.order &&
-          validMetadata(incoming.context, now) &&
-          incoming.context.metadata.obtainedAtMillis >= input.claim.claimedAtMillis &&
-          (incoming.context.metadata.refreshUseUntilMillis === undefined ||
-            (old.metadata.refreshUseUntilMillis !== undefined &&
-              incoming.context.metadata.refreshUseUntilMillis <=
-                old.metadata.refreshUseUntilMillis)),
-      );
-
-    const active =
-      incoming !== undefined &&
-      authorized &&
-      read.row[g.state] === "Refreshing" &&
-      C.sameContext(read.context, old) &&
-      !cohort.blocked &&
-      cohort.generation === old.cohortGeneration &&
-      now < input.claim.claimExpiresAtMillis &&
-      now < incoming.context.metadata.useUntilMillis;
-
-    if (active) {
-      yield* owner.update(
-        g.table,
-        { [g.moduleId]: old.moduleId, [g.grantId]: old.grantId },
-        {
-          [g.state]: "Active",
-          [g.context]: S.tokenContextStorage.encode(incoming.context),
-          [g.sealed]: S.sealedStorage.encode(incoming.sealed),
-          [g.summary]: S.summaryStorage.encode(C.summary(incoming.context)),
-          [g.tokenVersion]: incoming.context.tokenVersion,
-          [g.refreshWork]: "Resolved",
-          [g.version]: owner.marker,
-        },
-      );
-      owner.postconditions.push(
-        sql`${mapping.clock.engineNowMillis} >= ${now} and ${mapping.clock.engineNowMillis} < ${Math.min(input.claim.claimExpiresAtMillis, incoming.context.metadata.useUntilMillis)}`,
-      );
-
-      return { _tag: "Refreshed", grant: incoming } as const;
-    }
-    yield* C.fence(mapping, client, cohort);
-    if (incoming !== undefined && outcome._tag === "Refreshed" && outcome.cleanup !== undefined) {
-      yield* C.storeJob(mapping, outcome.cleanup, incoming.context, native, now);
-      yield* owner.update(
-        g.table,
-        { [g.moduleId]: old.moduleId, [g.grantId]: old.grantId },
-        {
-          [g.refreshWork]: "Resolved",
-          [g.revocationJobId]: outcome.cleanup.context.jobId,
-          [g.sealed]: null,
-          [g.version]: owner.marker,
-        },
-      );
-    } else if (incoming !== undefined)
-      yield* owner.update(
-        g.table,
-        { [g.moduleId]: old.moduleId, [g.grantId]: old.grantId },
-        {
-          [g.context]: S.tokenContextStorage.encode(incoming.context),
-          [g.sealed]: S.sealedStorage.encode(incoming.sealed),
-          [g.tokenVersion]: incoming.context.tokenVersion,
-          [g.summary]: S.summaryStorage.encode(C.summary(incoming.context)),
-          [g.version]: owner.marker,
-        },
-      );
-
-    return { _tag: "ReauthorizationRequired" } as const;
-  });
-
-  const admitUse = Effect.fn("oauthConnected.admitUse")(function* (
-    mapping: STypes.Mapping,
-    input: FTypes.Input<"admitUse">,
-  ) {
-    const owner = yield* CurrentOAuthTransaction;
-    const read = yield* locked(mapping, input.authorization, input.grant.context.grantId, "use");
-
-    if (read === undefined) return { _tag: "Rejected" } as const;
-    const status = state(mapping, read);
-
-    if (status !== "Active") return { _tag: status };
-    const token = read.grant.context;
-
-    if (
-      read.grant.sealed === undefined ||
-      !C.sameGrant(input.grant, { context: token, sealed: read.grant.sealed }) ||
-      read.now >= token.metadata.useUntilMillis
-    )
-      return { _tag: "ReauthorizationRequired" } as const;
-    invariant(
-      Number.isSafeInteger(input.lifetimeMillis) &&
-        input.lifetimeMillis >= 1 &&
-        input.lifetimeMillis <= 30000,
-    );
-
-    const expires = Math.min(
-        read.now + input.lifetimeMillis,
-        input.authorization.expiresAtMillis,
-        token.metadata.useUntilMillis,
-      ),
-      a = mapping.admission;
-
-    const key = { [a.admissionId]: input.admissionId },
-      prior = yield* owner.read(a.table, equal(a.table, key), { limit: 1 });
-
-    if (prior.rows.length) return { _tag: "Rejected" } as const;
-
-    const inserted = yield* owner.insert(
-      a.table,
-      {
-        ...a.encodeInsert({
-          admissionId: input.admissionId,
-          grant: snapshotOAuthSync(M.OAuthConnectedStoredGrant, input.grant),
-          authorization: snapshotOAuthSync(M.OAuthConnectedUseAuthorization, input.authorization),
-          subjectId: S.nativeCopy(read.found.nativeId),
-        }),
-        ...key,
-        [a.moduleId]: token.moduleId,
-        [a.grantId]: token.grantId,
-        [a.subjectId]: read.found.nativeId,
-        [a.identityKey]: read.tuple.key,
-        [a.clientKey]: read.client.id,
-        [a.cohortKey]: read.cohort.id,
-        [a.snapshot]: S.admissionStorage.encode({
-          grant: input.grant,
-          authorization: input.authorization,
-        }),
-        [a.admittedAt]: mapping.clock.encodeInstant(read.now),
-        [a.expiresAt]: mapping.clock.encodeInstant(expires),
-        [a.version]: owner.marker,
-      },
-      key,
-    );
-
-    prior.rows = inserted.rows;
-    owner.postconditions.push(
-      sql`${mapping.clock.engineNowMillis} >= ${read.now} and ${mapping.clock.engineNowMillis} < ${expires}`,
-    );
-
-    return {
-      _tag: "Admitted",
-      admissionId: input.admissionId,
-      grantId: token.grantId,
-      tokenVersion: token.tokenVersion,
-      admittedAtMillis: read.now,
-      expiresAtMillis: expires,
-    } as const;
-  });
-
-  return { locked, state, inspectAccess, claimRefresh, settleRefresh, admitUse };
-});
-
-export class OAuthConnectedAccess extends Context.Service<
-  OAuthConnectedAccess,
-  Effect.Success<typeof make>
->()("effect-auth/persistence/OAuthConnectedAccess") {
-  static readonly layer = Layer.effect(OAuthConnectedAccess, make);
-}