@yielded/auth-persistence 0.1.0-beta.25 → 0.1.0-beta.26

package/dist/internal/storage-mapping.mjs

@@ -1,16 +1,16 @@
 import { PersistenceMappingError } from "./mapping-error.mjs";
 import { randomId } from "./crypto.mjs";
-import { requiredProofConstraints } from "./models/proof-model.mjs";
 import { storageTables } from "./storage-tables.mjs";
 import { requiredEmailAddressConstraints } from "./models/email-model.mjs";
 import { requiredPasswordConstraints } from "./models/password-model.mjs";
-import { Crypto, DateTime, Effect, Redacted, Schema } from "effect";
-import { TokenDigest } from "@yielded/auth/Schema";
-import { SecurityRevision, SessionAuthenticationProvenance, SessionCredentialVersion, SessionId, SessionMetadata } from "@yielded/auth/Sessions";
-import { ProofBinding, ProofContinuationId, ProofDeliveryId, ProofId, ProofPurpose, ProofRequestId, ProofRequestReceipt, ProofVersion } from "@yielded/auth/Proofs";
+import { requiredProofConstraints } from "./models/proof-model.mjs";
+import { makeStorageClock } from "./storage-clock.mjs";
+import { Crypto, DateTime, Effect, Redacted, Schema, Struct } from "effect";
 import { EmailCredentialSnapshot } from "@yielded/auth/Email";
 import { EncodedPasswordHash, PasswordCredentialSnapshot } from "@yielded/auth/Password";
+import { AuthenticationEvidence, SecurityRevision, SessionAuthenticationProvenance, SessionCredentialVersion, SessionId, SessionMetadata } from "@yielded/auth/Sessions";
 import { LoginIdentifier } from "@yielded/auth/Identity";
+import { TokenDigest } from "@yielded/auth/Schema";
 //#region src/internal/storage-mapping.ts
 const failure = (cause) => PersistenceMappingError.make({
 	operation: "decode",
@@ -18,36 +18,6 @@ const failure = (cause) => PersistenceMappingError.make({
 });
 const decode = (schema, value) => Schema.decodeUnknownEffect(schema)(value).pipe(Effect.mapError(failure));
 const string = (value) => Schema.decodeUnknownSync(Schema.String)(value);
-const tuple = Schema.encodeSync(Schema.fromJsonString(Schema.Array(Schema.String)));
-const bindingJson = Schema.fromJsonString(ProofBinding);
-const receiptJson = Schema.fromJsonString(ProofRequestReceipt);
-const ProofRecord$1 = Schema.Struct({
-	moduleId: Schema.String,
-	purpose: ProofPurpose,
-	proofId: ProofId,
-	requestId: ProofRequestId,
-	fingerprint: TokenDigest,
-	deliveryId: ProofDeliveryId,
-	binding: ProofBinding,
-	verifier: Schema.Struct({
-		keyId: Schema.String,
-		digest: TokenDigest
-	}),
-	issuedAtMillis: Schema.Int,
-	expiresAtMillis: Schema.Int,
-	version: ProofVersion
-});
-const ProofContinuation = Schema.Struct({
-	moduleId: Schema.String,
-	purpose: ProofPurpose,
-	continuationId: ProofContinuationId,
-	digest: TokenDigest,
-	proofId: ProofId,
-	seriesKey: Schema.String,
-	binding: ProofBinding,
-	expiresAtMillis: Schema.Int,
-	version: ProofVersion
-});
 /** Derive shared row mappings from a managed or custom storage layout.
 * Acquire Effect Crypto once; the returned allocators retain that implementation.
 * Each factory requires its role tables to exist. Adapter authors supply typed
@@ -79,6 +49,7 @@ const makeMappings = Effect.fnUntraced(function* (input) {
 		securityRevision: s.securityRevision,
 		isActiveStatus: (value) => Object.is(value, s.activeValue),
 		d1ActiveStatusValue: s.activeValue,
+		activeStatusValue: s.activeValue,
 		decodeRequirement: s.requirements,
 		decodeActionRequirement: s.actionRequirements,
 		nextSecurityRevision: () => allocate.pipe(Effect.map(SecurityRevision.make))
@@ -89,6 +60,7 @@ const makeMappings = Effect.fnUntraced(function* (input) {
 		credentialId: "credentialId",
 		revision: "revision",
 		status: "active",
+		activeStatusValue: true,
 		isActiveStatus: (value) => value === true,
 		encodeInsert: (row) => ({
 			...row,
@@ -101,219 +73,28 @@ const makeMappings = Effect.fnUntraced(function* (input) {
 		subject,
 		credential: authorityCredential()
 	});
+	const clock = yield* makeStorageClock(input);
 	const proofs = () => ({
 		constraints: requiredProofConstraints,
-		encodeInstant: instant,
-		decodeInstant: readInstant,
-		allocateVersion: allocate.pipe(Effect.map(ProofVersion.make)),
-		isRequestConflict: () => false,
-		isSeriesConflict: () => false,
-		isCommandConflict: () => false,
-		scopeKeys: ({ binding }) => ({
-			series: tuple([
-				binding.identifier.namespace,
-				binding.identifier.value,
-				binding._tag === "Identifier" ? "anonymous" : binding.revision.subjectId
-			]),
-			identifier: tuple([binding.identifier.namespace, binding.identifier.value]),
-			subject: binding._tag === "Identifier" ? "anonymous" : binding.revision.subjectId
-		}),
-		authority: {
-			...authority(),
-			identifier: {
-				table: table("identifiers"),
-				namespace: "namespace",
-				value: "value",
-				isCurrent: (request, rows) => request.binding._tag === "Identifier" ? rows.length === 0 : request.binding._tag === "IdentifierChange" ? rows.length === 0 || rows.length === 1 && rows.every((row) => Object.is(row.subjectId, request.nativeSubjectId) && row.active === true && row.verifiedAt === null) : rows.length === 1 && rows.every((row) => Object.is(row.subjectId, request.nativeSubjectId) && row.active === true)
-			}
-		},
-		request: {
-			...mapped("proofRequests"),
-			moduleId: "moduleId",
-			requestId: "requestId",
-			fingerprint: "fingerprint",
-			proofId: "proofId",
-			purpose: "purpose",
-			keyId: "keyId",
-			createdAt: "createdAt",
-			retentionUntil: "retentionUntil",
-			encodeInsert: ({ record, retentionUntilMillis }) => ({
-				moduleId: record.moduleId,
-				requestId: record.requestId,
-				fingerprint: record.fingerprint,
-				proofId: record.proofId,
-				purpose: record.purpose,
-				keyId: record.verifier.keyId,
-				createdAt: instant(record.issuedAtMillis),
-				retentionUntil: instant(retentionUntilMillis),
-				receipt: Schema.encodeSync(receiptJson)({
-					requestId: record.requestId,
-					reference: {
-						proofId: record.proofId,
-						purpose: record.purpose,
-						keyId: record.verifier.keyId
-					}
-				})
-			}),
-			decodeReceipt: (row) => decode(receiptJson, row.receipt)
-		},
-		series: {
-			...mapped("proofSeries"),
-			moduleId: "moduleId",
-			purpose: "purpose",
-			scopeKey: "scopeKey",
-			activeProofId: "activeProofId",
-			lastIssueAt: "lastIssueAt",
-			version: "version",
-			encodeInsert: (row) => ({
-				...row,
-				activeProofId: null,
-				lastIssueAt: null
-			})
+		subjectId,
+		subject: {
+			table: s.table,
+			id: s.id
 		},
-		generation: {
-			...mapped("proofGenerations"),
+		clock,
+		proof: {
+			...mapped("proofs"),
 			moduleId: "moduleId",
 			purpose: "purpose",
-			proofId: "proofId",
-			requestId: "requestId",
 			seriesKey: "seriesKey",
-			deliveryId: "deliveryId",
+			proofId: "proofId",
 			binding: "binding",
 			verifierKeyId: "verifierKeyId",
 			verifierDigest: "verifierDigest",
 			issuedAt: "issuedAt",
 			expiresAt: "expiresAt",
-			version: "version",
-			state: "state",
-			sendCount: "sendCount",
-			deliveryState: "deliveryState",
-			claimVersion: "claimVersion",
-			claimDeadline: "claimDeadline",
-			retryAt: "retryAt",
-			deliveryRetryMillis: "deliveryRetryMillis",
-			retentionUntil: "retentionUntil",
-			encodeInsert: ({ record, seriesKey, retentionUntilMillis, state, deliveryState, policy }) => ({
-				moduleId: record.moduleId,
-				purpose: record.purpose,
-				proofId: record.proofId,
-				requestId: record.requestId,
-				seriesKey,
-				deliveryId: record.deliveryId,
-				binding: Schema.encodeSync(bindingJson)(record.binding),
-				verifierKeyId: record.verifier.keyId,
-				verifierDigest: record.verifier.digest,
-				issuedAt: instant(record.issuedAtMillis),
-				expiresAt: instant(record.expiresAtMillis),
-				version: record.version,
-				state,
-				sendCount: 0,
-				deliveryState,
-				claimVersion: null,
-				claimDeadline: null,
-				retryAt: null,
-				deliveryRetryMillis: policy.deliveryRetryMillis,
-				retentionUntil: instant(retentionUntilMillis),
-				fingerprint: record.fingerprint
-			}),
-			decodeBinding: (row) => decode(bindingJson, row.binding),
-			decodeRecord: (row) => Effect.gen(function* () {
-				return yield* decode(ProofRecord$1, {
-					moduleId: row.moduleId,
-					purpose: row.purpose,
-					proofId: row.proofId,
-					requestId: row.requestId,
-					fingerprint: row.fingerprint,
-					deliveryId: row.deliveryId,
-					binding: yield* decode(bindingJson, row.binding),
-					verifier: {
-						keyId: row.verifierKeyId,
-						digest: row.verifierDigest
-					},
-					issuedAtMillis: yield* readInstant(row.issuedAt),
-					expiresAtMillis: yield* readInstant(row.expiresAt),
-					version: row.version
-				});
-			})
-		},
-		continuation: {
-			...mapped("proofContinuations"),
-			moduleId: "moduleId",
-			purpose: "purpose",
-			continuationId: "continuationId",
-			digest: "digest",
-			proofId: "proofId",
-			seriesKey: "seriesKey",
-			binding: "binding",
-			expiresAt: "expiresAt",
-			consumed: "consumed",
-			version: "version",
-			retentionUntil: "retentionUntil",
-			encodeInsert: (record) => ({
-				...record,
-				binding: Schema.encodeSync(bindingJson)(record.binding),
-				expiresAt: instant(record.expiresAtMillis),
-				consumed: false,
-				retentionUntil: instant(record.retentionUntilMillis)
-			}),
-			decode: (row) => Effect.gen(function* () {
-				return yield* decode(ProofContinuation, {
-					...row,
-					binding: yield* decode(bindingJson, row.binding),
-					expiresAtMillis: yield* readInstant(row.expiresAt)
-				});
-			})
-		},
-		rateScope: {
-			...mapped("proofScopes"),
-			moduleId: "moduleId",
-			purpose: "purpose",
-			action: "action",
-			scopeKind: "scopeKind",
-			scopeKey: "scopeKey",
-			encodeInsert: (row) => ({ ...row })
-		},
-		abuseEvent: {
-			...mapped("proofAbuse"),
-			moduleId: "moduleId",
-			purpose: "purpose",
-			action: "action",
-			scopeKind: "scopeKind",
-			scopeKey: "scopeKey",
-			commandId: "commandId",
-			occurredAt: "occurredAt",
-			retentionUntil: "retentionUntil",
-			encodeInsert: (row) => ({
-				...row,
-				occurredAt: instant(row.occurredAtMillis),
-				retentionUntil: instant(row.retentionUntilMillis)
-			})
-		},
-		failureEvent: {
-			...mapped("proofFailures"),
-			moduleId: "moduleId",
-			purpose: "purpose",
-			seriesKey: "seriesKey",
-			commandId: "commandId",
-			occurredAt: "occurredAt",
-			retentionUntil: "retentionUntil",
-			encodeInsert: (row) => ({
-				...row,
-				occurredAt: instant(row.occurredAtMillis),
-				retentionUntil: instant(row.retentionUntilMillis)
-			})
-		},
-		command: {
-			...mapped("proofCommands"),
-			moduleId: "moduleId",
-			commandId: "commandId",
-			kind: "kind",
-			decision: "decision",
-			retentionUntil: "retentionUntil",
-			encodeInsert: (row) => ({
-				...row,
-				retentionUntil: instant(row.retentionUntilMillis)
-			})
+			failedAttempts: "failedAttempts",
+			encodeInsert: () => ({})
 		}
 	});
 	const passwords = () => {
@@ -326,12 +107,10 @@ const makeMappings = Effect.fnUntraced(function* (input) {
 			subject,
 			authorityCredential: authorityCredential(),
 			constraints: requiredPasswordConstraints,
-			isCommandConflict: () => false,
 			encodeInstant: instant,
 			decodeInstant: readInstant,
 			allocateCredentialId: allocate,
 			allocateRevision: allocate.pipe(Effect.map(SecurityRevision.make)),
-			commandRetentionMillis: 864e5,
 			sessionInvalidation: "same-authority-immediate",
 			identifier: {
 				table: table("identifiers"),
@@ -397,34 +176,24 @@ const makeMappings = Effect.fnUntraced(function* (input) {
 					});
 				})
 			},
-			command: {
-				...mapped("passwordCommands"),
-				moduleId: "moduleId",
-				commandId: "commandId",
-				action: "action",
-				bindingDigest: "bindingDigest",
-				decision: "decision",
-				retentionUntil: "retentionUntil",
-				encodeInsert: (row) => ({
-					...row,
-					retentionUntil: instant(row.retentionUntilMillis)
-				})
-			}
+			clock
 		};
 	};
 	const emails = () => ({
 		subjectId,
-		subject,
+		subject: {
+			...subject,
+			activeStatusValue: s.activeValue
+		},
 		constraints: requiredEmailAddressConstraints,
 		addressCardinality: "single",
 		changeDisposition: "retire-source",
+		clock,
 		encodeInstant: instant,
 		decodeInstant: readInstant,
 		allocateCredentialId: allocate,
 		allocateRevision: allocate.pipe(Effect.map(SecurityRevision.make)),
-		commandRetentionMillis: 864e5,
 		sessionInvalidation: "same-authority-immediate",
-		isCommandConflict: () => false,
 		isIdentifierConflict: () => false,
 		isCredentialConflict: () => false,
 		authorityCredential: {
@@ -465,6 +234,7 @@ const makeMappings = Effect.fnUntraced(function* (input) {
 			})
 		},
 		credential: {
+			activeStatusValue: true,
 			table: table("emailCredentials"),
 			moduleId: "moduleId",
 			subjectId: "subjectId",
@@ -491,7 +261,7 @@ const makeMappings = Effect.fnUntraced(function* (input) {
 				active: false
 			}),
 			decode: ({ moduleId, subject: row, identifier, credential }) => Effect.gen(function* () {
-				return yield* decode(EmailCredentialSnapshot, {
+				return yield* decode(Schema.Struct(Struct.omit(EmailCredentialSnapshot.fields, ["requirement"])), {
 					moduleId,
 					identifier: {
 						namespace: identifier.namespace,
@@ -511,32 +281,68 @@ const makeMappings = Effect.fnUntraced(function* (input) {
 					}
 				});
 			})
-		},
-		command: {
-			table: table("emailCommands"),
-			moduleId: "moduleId",
-			commandId: "commandId",
-			action: "action",
-			bindingDigest: "bindingDigest",
-			retentionUntil: "retentionUntil",
-			encodeInsert: ({ retentionUntilMillis, ...row }) => ({
-				...row,
-				retentionUntil: instant(retentionUntilMillis)
-			})
 		}
 	});
-	const sessions = (claims) => {
+	const pending = (claims, moduleId) => {
+		const record = Schema.fromJsonString(Schema.Struct({
+			digest: TokenDigest,
+			version: SecurityRevision,
+			evidence: AuthenticationEvidence,
+			expiresAt: Schema.DateTimeUtcFromMillis,
+			attemptLimit: Schema.Int.check(Schema.isGreaterThan(0)),
+			claims: Schema.Unknown
+		}));
+		return {
+			...authority(),
+			moduleId,
+			clock,
+			isConstraintConflict: () => false,
+			constraints: { pendingDigest: "unique(pending.digest)" },
+			pending: {
+				table: table("pending"),
+				moduleId: "moduleId",
+				kind: "kind",
+				digest: "digest",
+				version: "version",
+				flowId: "flowId",
+				subjectId: "subjectId",
+				bindingDigest: "bindingDigest",
+				snapshot: "snapshot",
+				expiresAt: "expiresAt",
+				attemptLimit: "attemptLimit",
+				failedAttempts: "failedAttempts",
+				consumed: "consumed",
+				encodeInstant: (date) => instant(DateTime.toEpochMillis(date)),
+				allocateVersion: allocate.pipe(Effect.map(SecurityRevision.make)),
+				encodeInsert: (value) => ({
+					...value,
+					expiresAt: instant(DateTime.toEpochMillis(value.expiresAt)),
+					failedAttempts: 0,
+					consumed: false
+				})
+			},
+			login: {
+				encode: (value) => Schema.encodeEffect(claims)(value.claims).pipe(Effect.flatMap((saved) => Schema.encodeEffect(record)({
+					...value,
+					claims: saved
+				})), Effect.mapError(failure)),
+				decode: (value) => decode(record, value).pipe(Effect.flatMap((saved) => decode(claims, saved.claims).pipe(Effect.map((decoded) => ({
+					...saved,
+					claims: decoded
+				})))))
+			}
+		};
+	};
+	const sessions = (claims, moduleId) => {
 		const record = Schema.fromJsonString(Schema.Struct({
 			...SessionMetadata.fields,
 			claims: Schema.Unknown,
 			digest: TokenDigest,
-			version: SecurityRevision,
 			provenance: SessionAuthenticationProvenance,
 			credentialVersion: SessionCredentialVersion
 		}));
 		const encodeRow = (value) => ({
 			digest: value.digest,
-			version: value.version,
 			securityRevision: value.securityRevision,
 			issuedAt: instant(DateTime.toEpochMillis(value.issuedAt)),
 			expiresAt: instant(DateTime.toEpochMillis(value.expiresAt)),
@@ -546,67 +352,46 @@ const makeMappings = Effect.fnUntraced(function* (input) {
 				claims: Schema.encodeSync(claims)(value.claims)
 			})
 		});
+		const login = pending(claims, moduleId);
 		return {
 			...authority(),
+			moduleId,
+			clock,
 			isConstraintConflict: () => false,
+			pending: {
+				pending: login.pending,
+				login: login.login
+			},
 			constraints: {
 				sessionDigest: "unique(session.digest)",
-				flowId: "unique(flow.flowId)"
+				pendingDigest: "unique(pending.digest)"
 			},
 			sessionId: {
 				toNative: (id) => Effect.succeed(id),
 				toSession: (id) => decode(SessionId, id),
 				equals: Object.is
 			},
-			flow: {
-				table: table("sessionFlows"),
-				flowId: "flowId",
-				subjectId: "subjectId",
-				state: "state",
-				pendingDigest: "pendingDigest",
-				dedupUntil: "dedupUntil",
-				pendingStateValue: "pending",
-				establishedStateValue: "established",
-				encodeInstant: (date) => instant(DateTime.toEpochMillis(date)),
-				decodeInstant: (value) => readInstant(value).pipe(Effect.map(DateTime.makeUnsafe)),
-				encodePendingInsert: (row) => ({
-					flowId: row.evidence.flowId,
-					subjectId: row.subjectId,
-					state: "pending",
-					pendingDigest: row.pendingDigest,
-					dedupUntil: instant(DateTime.toEpochMillis(row.dedupUntil))
-				}),
-				encodeEstablishedInsert: (row) => ({
-					flowId: row.evidence.flowId,
-					subjectId: row.subjectId,
-					state: "established",
-					pendingDigest: null,
-					dedupUntil: instant(DateTime.toEpochMillis(row.dedupUntil))
-				})
-			},
 			session: {
 				table: table("sessions"),
 				sessionId: "sessionId",
 				subjectId: "subjectId",
 				digest: "digest",
-				version: "version",
 				securityRevision: "securityRevision",
 				issuedAt: "issuedAt",
 				expiresAt: "expiresAt",
 				absoluteExpiresAt: "absoluteExpiresAt",
 				encodeInstant: (date) => instant(DateTime.toEpochMillis(date)),
 				allocateId: allocate,
-				allocateVersion: allocate.pipe(Effect.map(SecurityRevision.make)),
 				encodeInsert: (value, ids) => ({
 					...encodeRow(value),
 					...ids
 				}),
 				encodeRotation: encodeRow,
 				decode: (row) => Effect.gen(function* () {
-					const saved = yield* decode(record, row.record);
-					const decodedClaims = yield* decode(claims, saved.claims);
+					const saved = yield* decode(record, row.record), decodedClaims = yield* decode(claims, saved.claims);
 					return {
 						...saved,
+						issuedAt: DateTime.makeUnsafe(yield* readInstant(row.issuedAt)),
 						claims: decodedClaims
 					};
 				})
@@ -620,6 +405,7 @@ const makeMappings = Effect.fnUntraced(function* (input) {
 		passwords,
 		emails,
 		sessions,
+		pending,
 		string
 	};
 });