@yielded/auth-persistence 0.1.0-beta.25 → 0.1.0-beta.26

package/src/internal/browser-login.ts

@@ -2,7 +2,11 @@ import { Persistence, Record, Unavailable } from "@yielded/auth/BrowserLogin";
 import { Effect, Layer, Schema } from "effect";
 import { SqlClient } from "effect/sql";
 
-import { requireStandalone } from "./standalone";
+import { makeNativeSqlTables } from "./native-sql-table";
+import { exactSqlText } from "./sql-change";
+import { cleanupSqlRows } from "./sql-cleanup";
+import { makeSqlCommitExecutor } from "./sql-commit";
+import { Table } from "./sql-table";
 
 const codec = Schema.fromJsonString(Record);
 const Row = Schema.Struct({ payload: Schema.String, version: Schema.String });
@@ -26,10 +30,19 @@ const layer = Layer.effect(
 
     if (!sql.onDialectOrElse({ sqlite: () => true, pg: () => true, orElse: () => false }))
       return yield* Unavailable.make({});
-    const standalone = requireStandalone(() => Unavailable.make({}), sql.transactionService);
-
-    const failure = <A, E, R>(effect: Effect.Effect<A, E, R>) =>
-      effect.pipe(Effect.mapError(() => Unavailable.make({})));
+    const executor = yield* makeSqlCommitExecutor(() => Unavailable.make({}));
+
+    const table = makeNativeSqlTables(sql)(
+      new Table(
+        "yielded_browser_login",
+        {
+          namespace: { name: "namespace", type: "text" },
+          attemptId: { name: "attempt_id", type: "text" },
+          expiresAt: { name: "expires_at_millis", type: "integer" },
+        },
+        [["namespace", "attemptId"]],
+      ),
+    );
 
     const clock = sql.onDialectOrElse({
       sqlite: () => sql.literal("CAST((julianday('now') - 2440587.5) * 86400000 AS INTEGER)"),
@@ -37,9 +50,22 @@ const layer = Layer.effect(
     });
 
     return Persistence.of({
+      cleanup: ({ namespace, limit }) =>
+        executor.run(
+          cleanupSqlRows(
+            [
+              {
+                table,
+                keys: ["namespace", "attemptId"],
+                due: sql`${exactSqlText(sql, table.column("namespace"), table.value("namespace", namespace))} and ${table.column("expiresAt")} <= ${clock}`,
+                order: [table.column("expiresAt"), table.column("attemptId")],
+              },
+            ],
+            limit,
+          ),
+          "statement",
+        ),
       get: Effect.fnUntraced(function* (namespace, id) {
-        yield* standalone;
-
         const rows =
           yield* sql`SELECT payload, version FROM yielded_browser_login WHERE namespace = ${namespace} AND attempt_id = ${id}`;
 
@@ -51,32 +77,36 @@ const layer = Layer.effect(
         if (record.version !== row.version) return yield* Unavailable.make({});
 
         return record;
-      }, failure),
-      insert: Effect.fnUntraced(function* (namespace, id, record) {
-        yield* standalone;
-        const payload = yield* Schema.encodeEffect(codec)(record);
+      }, executor.read),
+      insert: Effect.fnUntraced(
+        function* (namespace, id, record) {
+          const payload = yield* Schema.encodeEffect(codec)(record);
 
-        const rows =
-          yield* sql`INSERT INTO yielded_browser_login (namespace, attempt_id, version, expires_at_millis, payload)
+          const rows =
+            yield* sql`INSERT INTO yielded_browser_login (namespace, attempt_id, version, expires_at_millis, payload)
         SELECT ${namespace}, ${id}, ${record.version}, ${record.expiresAtMillis}, ${payload}
         WHERE ${record.expiresAtMillis} > ${clock}
         ON CONFLICT (namespace, attempt_id) DO NOTHING RETURNING version`;
 
-        return rows.length === 1;
-      }, failure),
-      compareAndSet: Effect.fnUntraced(function* (namespace, id, version, record) {
-        yield* standalone;
-        if (version === record.version) return yield* Unavailable.make({});
-        const payload = yield* Schema.encodeEffect(codec)(record);
-
-        const rows =
-          yield* sql`UPDATE yielded_browser_login SET version = ${record.version}, payload = ${payload}
+          return rows.length === 1;
+        },
+        (effect) => executor.run(effect, "statement"),
+      ),
+      compareAndSet: Effect.fnUntraced(
+        function* (namespace, id, version, record) {
+          if (version === record.version) return yield* Unavailable.make({});
+          const payload = yield* Schema.encodeEffect(codec)(record);
+
+          const rows =
+            yield* sql`UPDATE yielded_browser_login SET version = ${record.version}, payload = ${payload}
         WHERE namespace = ${namespace} AND attempt_id = ${id} AND version = ${version}
         AND expires_at_millis = ${record.expiresAtMillis} AND expires_at_millis > ${clock}
         RETURNING version`;
 
-        return rows.length === 1;
-      }, failure),
+          return rows.length === 1;
+        },
+        (effect) => executor.run(effect, "statement"),
+      ),
     });
   }),
 );

package/src/internal/configuration.ts

@@ -4,7 +4,6 @@ import type {
   PasskeyActionChallenge,
   PasskeyConfig,
   PasskeyCredentials,
-  PasskeyEnrollmentContext,
   PasskeyManagementPersistence,
   PasskeyManagementPolicy,
   PasskeyMethodPolicy,
@@ -16,7 +15,7 @@ import type {
   PasswordPersistence,
   PasswordUnavailable,
 } from "@yielded/auth/Password";
-import type { PhoneAdmission, PhoneSignInTargets } from "@yielded/auth/PhoneOtp";
+import type { PhoneSignInTargets } from "@yielded/auth/PhoneOtp";
 import type { ProofPersistence } from "@yielded/auth/Proofs";
 import type { SubjectId } from "@yielded/auth/Schema";
 import type {
@@ -106,6 +105,7 @@ export type Provisioning<A extends { readonly strategies: Readonly<Record<string
       ? K
       : never
   ]: (input: {
+    readonly requestId: string;
     readonly identifier: LoginIdentifier;
     readonly registration: Registration<A["strategies"][K]>;
   }) => Effect.Effect<SubjectId, PasswordUnavailable>;
@@ -115,15 +115,7 @@ export type ProvisioningRequirement<
   A extends { readonly namespace: string; readonly strategies: Readonly<Record<string, Strategy>> },
 > = ManagedPassword<A> extends never ? never : ProvisioningId<A["namespace"]>;
 
-type ProofRoles =
-  | "proofRequests"
-  | "proofSeries"
-  | "proofGenerations"
-  | "proofContinuations"
-  | "proofScopes"
-  | "proofAbuse"
-  | "proofFailures"
-  | "proofCommands";
+type ProofRoles = "proofs";
 
 type UsesProofs<A extends { readonly strategies: Readonly<Record<string, Strategy>> }> =
   | Enabled<A, "phone">
@@ -134,36 +126,25 @@ export type Ports<C extends ClaimsCodec, Id extends string, A extends Definition
   | AuthenticationAuthority
   | KeyId<A["sessions"]["StatefulSessionPersistence"]>
   | KeyId<A["sessions"]["SessionRepository"]>
+  | KeyId<A["sessions"]["PendingAuthentication"]>
+  | KeyId<A["sessions"]["SessionStepUpPersistence"]>
+  | KeyId<A["sessions"]["SessionCleanup"]>
   | (Enabled<A, "password"> extends never ? never : PasswordPersistence)
   | KeyId<RegistrationKey<ManagedPassword<A>>>
   | (Enabled<A, "passkey"> extends never ? never : PasskeyPersistence | PasskeyCredentials)
-  | (ManagedPasskey<A> extends never
-      ? never
-      : PasskeyManagementPersistence | PasskeyEnrollmentContext)
+  | (ManagedPasskey<A> extends never ? never : PasskeyManagementPersistence)
   | (Enabled<A, "email"> extends never ? never : EmailAddressPersistence)
   | (UsesProofs<A> extends never ? never : ProofPersistence)
-  | (Enabled<A, "phone"> extends never ? never : PhoneAdmission | PhoneSignInTargets);
+  | (Enabled<A, "phone"> extends never ? never : PhoneSignInTargets);
 
 export type Roles<C extends ClaimsCodec, Id extends string, A extends Definition<C, Id>> =
   | "identifiers"
   | "credentials"
   | "sessions"
-  | "sessionFlows"
-  | (Enabled<A, "password"> extends never ? never : "passwords" | "passwordCommands")
-  | (ManagedPassword<A> extends never ? never : "passwordRegistrations")
-  | (Enabled<A, "phone"> extends never ? never : "phoneState")
-  | (Enabled<A, "email"> extends never ? never : "emailCredentials" | "emailCommands")
-  | (Enabled<A, "passkey"> extends never
-      ? never
-      :
-          | "passkeyCredentials"
-          | "passkeyOwnership"
-          | "passkeyHandles"
-          | "passkeyModules"
-          | "passkeyFlows"
-          | "passkeyAdmissions"
-          | "passkeyCharges")
-  | (ManagedPasskey<A> extends never ? never : "passkeyCommands")
+  | "pending"
+  | (Enabled<A, "password"> extends never ? never : "passwords")
+  | (Enabled<A, "email"> extends never ? never : "emailCredentials")
+  | (Enabled<A, "passkey"> extends never ? never : "passkeyCredentials" | "passkeyFlows")
   | (UsesProofs<A> extends never ? never : ProofRoles);
 
 export interface SubjectOptions<T extends object, NativeId> {
@@ -241,6 +222,10 @@ export interface BoundPersistence<
    * Do not perform external side effects or open an independent transaction here.
    */
   readonly Provisioning: Context.Service<ProvisioningRequirement<A>, Provisioning<A>>;
+  /** Capture dependencies at acquisition; validate SQL metadata and configure storage
+   * once on the first service operation. Initialization failures become that port's
+   * unavailable error. Failure or interruption remains cached until layer reacquisition.
+   */
   readonly layer: Layer.Layer<
     Ports<C, Id, A>,
     PersistenceConfigurationError,

package/src/internal/d1-planning.ts

@@ -0,0 +1,7 @@
+import type { SqlClient } from "effect/sql/SqlClient";
+import type { Fragment } from "effect/sql/Statement";
+
+/** A false predicate aborts the current D1 batch; checking its result after
+ * batch completion would be too late to roll the protected mutation back. */
+export const sqlBatchAssertion = (sql: SqlClient, condition: Fragment) =>
+  sql`select case when ${condition} then 1 else json_extract('[]', '$[auth-batch-precondition]') end as valid`;

package/src/internal/email-native-state.ts

@@ -0,0 +1,247 @@
+import { EmailCredentialSnapshot, EmailUnavailable } from "@yielded/auth/Email";
+import { LoginIdentifier } from "@yielded/auth/Identity";
+import type { SubjectId } from "@yielded/auth/Schema";
+import { AuthenticationRevision } from "@yielded/auth/Sessions";
+import { Effect, Option, Schema } from "effect";
+import { SqlClient } from "effect/sql/SqlClient";
+import type { Fragment } from "effect/sql/Statement";
+
+import type { AnyEmailSignInMapping } from "./models/email-model";
+import type { NativeSqlTables, SqlTable } from "./native-sql-table";
+import { exactSqlText } from "./sql-change";
+
+export const emailUnavailable = () => EmailUnavailable.make({});
+
+export const ensureEmail: (condition: unknown) => asserts condition = (condition) => {
+  if (!condition) throw emailUnavailable();
+};
+
+/** Every role binds the decoded native subject through its own physical column codec. */
+export const makeNativeEmailReader = Effect.fnUntraced(function* (
+  tables: NativeSqlTables,
+  mapping: AnyEmailSignInMapping,
+  engineNow?: Fragment,
+) {
+  const sql = (yield* SqlClient).withoutTransforms();
+
+  const s = mapping.subject,
+    i = mapping.identifier,
+    c = mapping.credential,
+    a = mapping.authorityCredential;
+
+  const subject = tables(s.table).as("email_subject"),
+    targetIdentifier = tables(i.table).as("email_target_identifier"),
+    sourceIdentifier = tables(i.table).as("email_source_identifier"),
+    targetCredential = tables(c.table).as("email_target_credential"),
+    sourceCredential = tables(c.table).as("email_source_credential"),
+    authority = tables(a.table).as("email_authority"),
+    sourceAuthority = tables(a.table).as("email_source_authority"),
+    cardinality = tables(c.table).as("email_cardinality");
+
+  const exact = (t: SqlTable, key: string, value: unknown) =>
+    exactSqlText(sql, t.column(key), t.value(key, value));
+
+  const id = (t: SqlTable, key: string, value: unknown) =>
+    sql`${t.column(key)} = ${t.value(key, value)}`;
+
+  const identifierKey = (t: SqlTable, value: LoginIdentifier) =>
+    sql.and([exact(t, i.namespace, value.namespace), exact(t, i.value, value.value)]);
+
+  const credentialKey = (t: SqlTable, moduleId: string, value: LoginIdentifier) =>
+    sql.and([
+      exact(t, c.moduleId, moduleId),
+      exact(t, c.identifierNamespace, value.namespace),
+      exact(t, c.identifierValue, value.value),
+    ]);
+
+  const selected = (t: SqlTable, row: Record<string, unknown>, prefix: string, key: string) => {
+    const decoded = t.decode(row, prefix);
+
+    return decoded[key] === null || decoded[key] === undefined ? undefined : decoded;
+  };
+
+  const owned = Effect.fnUntraced(function* (
+    row: Record<string, unknown> | undefined,
+    key: string,
+    subjectId: SubjectId,
+  ) {
+    return row !== undefined && (yield* mapping.subjectId.toSubject(row[key])) === subjectId;
+  });
+
+  const read = Effect.fnUntraced(function* (input: {
+    readonly moduleId: string;
+    readonly subjectId: SubjectId;
+    readonly identifier: LoginIdentifier;
+    readonly sourceCredentialId?: string;
+    readonly sourceIdentifier?: LoginIdentifier;
+    readonly single?: boolean;
+    readonly validity?: Fragment;
+  }) {
+    const native = yield* mapping.subjectId.toNative(input.subjectId);
+    let source = input.sourceIdentifier;
+
+    if (input.sourceCredentialId !== undefined && source === undefined) {
+      const table = tables(c.table);
+
+      const rows =
+        yield* sql`select ${table.fields("email_source_lookup_")} from ${table.name} where ${exact(table, c.moduleId, input.moduleId)} and ${exact(table, c.credentialId, input.sourceCredentialId)} and ${id(table, c.subjectId, native)} limit 2`;
+
+      if (rows.length !== 1) return undefined;
+      const row = table.decode(rows[0]!, "email_source_lookup_");
+
+      ensureEmail(row[c.credentialId] === input.sourceCredentialId);
+      source = yield* Schema.decodeUnknownEffect(LoginIdentifier)({
+        namespace: row[c.identifierNamespace],
+        value: row[c.identifierValue],
+      });
+    }
+
+    const rows =
+      yield* sql`select ${subject.fields("email_subject_")}, ${targetIdentifier.fields("email_target_identifier_")}, ${sourceIdentifier.fields("email_source_identifier_")}, ${targetCredential.fields("email_target_credential_")}, ${sourceCredential.fields("email_source_credential_")}, ${authority.fields("email_authority_")}, ${sourceAuthority.fields("email_source_authority_")}, ${engineNow ?? sql`0`} as engine_now, case when ${input.single === true && input.sourceCredentialId === undefined ? sql`exists(select 1 from ${cardinality.name} where ${id(cardinality, c.subjectId, native)} and ${exact(cardinality, c.moduleId, input.moduleId)} and ${id(cardinality, c.status, c.activeStatusValue)})` : sql`1 = 0`} then 1 else 0 end as cardinality_conflict
+      from ${subject.name}
+      left join ${targetIdentifier.name} on ${identifierKey(targetIdentifier, input.identifier)}
+      left join ${sourceIdentifier.name} on ${source === undefined ? sql`1 = 0` : identifierKey(sourceIdentifier, source)}
+      left join ${targetCredential.name} on ${credentialKey(targetCredential, input.moduleId, input.identifier)}
+      left join ${sourceCredential.name} on ${input.sourceCredentialId === undefined ? sql`1 = 0` : sql.and([exact(sourceCredential, c.moduleId, input.moduleId), exact(sourceCredential, c.credentialId, input.sourceCredentialId)])}
+      left join ${sourceAuthority.name} on ${input.sourceCredentialId === undefined ? sql`1 = 0` : sql.and([id(sourceAuthority, a.subjectId, native), exact(sourceAuthority, a.credentialId, input.sourceCredentialId)])}
+      left join ${authority.name} on ${id(authority, a.subjectId, native)} and ${id(authority, a.status, a.activeStatusValue)}
+      where ${id(subject, s.id, native)} and ${input.validity ?? sql`1 = 1`} limit 65`;
+
+    ensureEmail(rows.length <= 64);
+    const first = rows[0];
+
+    if (first === undefined) return undefined;
+    const subjectRow = subject.decode(first, "email_subject_");
+
+    ensureEmail((yield* mapping.subjectId.toSubject(subjectRow[s.id])) === input.subjectId);
+    if (!s.isActiveStatus(subjectRow[s.status])) return undefined;
+    const factors: { readonly credentialId: unknown; readonly revision: unknown }[] = [];
+
+    for (const row of rows) {
+      const factor = selected(authority, row, "email_authority_", a.credentialId);
+
+      if (factor === undefined) continue;
+      ensureEmail(
+        (yield* owned(factor, a.subjectId, input.subjectId)) && a.isActiveStatus(factor[a.status]),
+      );
+      ensureEmail(!factors.some((f) => f.credentialId === factor[a.credentialId]));
+      factors.push({ credentialId: factor[a.credentialId], revision: factor[a.revision] });
+    }
+
+    const revision = yield* Schema.decodeUnknownEffect(AuthenticationRevision)({
+      subjectId: input.subjectId,
+      securityRevision: subjectRow[s.securityRevision],
+      credentials: factors.sort((a, b) =>
+        String(a.credentialId).localeCompare(String(b.credentialId)),
+      ),
+    });
+
+    const targetRow = selected(targetIdentifier, first, "email_target_identifier_", i.namespace),
+      sourceRow = selected(sourceIdentifier, first, "email_source_identifier_", i.namespace),
+      targetFactor = selected(targetCredential, first, "email_target_credential_", c.credentialId),
+      sourceFactor = selected(sourceCredential, first, "email_source_credential_", c.credentialId);
+
+    const snapshot = Effect.fnUntraced(function* (
+      identifierRow: Record<string, unknown> | undefined,
+      credentialRow: Record<string, unknown> | undefined,
+      value: LoginIdentifier | undefined,
+    ) {
+      if (
+        identifierRow === undefined ||
+        credentialRow === undefined ||
+        value === undefined ||
+        !i.isCurrent(identifierRow) ||
+        identifierRow[i.verifiedAt] === null ||
+        identifierRow[i.verifiedAt] === undefined ||
+        !c.isActiveStatus(credentialRow[c.status]) ||
+        !(yield* owned(identifierRow, i.subjectId, input.subjectId)) ||
+        !(yield* owned(credentialRow, c.subjectId, input.subjectId))
+      )
+        return undefined;
+      ensureEmail(
+        identifierRow[i.namespace] === value.namespace &&
+          identifierRow[i.value] === value.value &&
+          credentialRow[c.moduleId] === input.moduleId &&
+          credentialRow[c.identifierNamespace] === value.namespace &&
+          credentialRow[c.identifierValue] === value.value,
+      );
+      if (
+        !revision.credentials.some(
+          (f) =>
+            f.credentialId === credentialRow[c.credentialId] &&
+            f.revision === credentialRow[c.credentialRevision],
+        )
+      )
+        return undefined;
+
+      const decoded = yield* c.decode({
+        moduleId: input.moduleId,
+        subject: subjectRow,
+        identifier: identifierRow,
+        credential: credentialRow,
+      });
+
+      return yield* Schema.decodeEffect(EmailCredentialSnapshot)({
+        ...decoded,
+        revision,
+        requirement: yield* s.decodeRequirement(subjectRow),
+      });
+    });
+
+    ensureEmail(
+      targetRow === undefined ||
+        (targetRow[i.namespace] === input.identifier.namespace &&
+          targetRow[i.value] === input.identifier.value),
+    );
+    ensureEmail(
+      targetFactor === undefined ||
+        (targetFactor[c.moduleId] === input.moduleId &&
+          targetFactor[c.identifierNamespace] === input.identifier.namespace &&
+          targetFactor[c.identifierValue] === input.identifier.value),
+    );
+    const now = Number(first.engine_now);
+
+    ensureEmail(Number.isSafeInteger(now));
+
+    return {
+      native,
+      subject: subjectRow,
+      revision,
+      targetIdentifier: targetRow,
+      sourceIdentifier: sourceRow,
+      targetCredential: targetFactor,
+      sourceCredential: sourceFactor,
+      sourceAuthority: selected(sourceAuthority, first, "email_source_authority_", a.credentialId),
+      targetSnapshot: yield* snapshot(targetRow, targetFactor, input.identifier),
+      sourceSnapshot: yield* snapshot(sourceRow, sourceFactor, source),
+      cardinalityConflict: Number(first.cardinality_conflict) === 1,
+      now,
+    };
+  });
+
+  const lookup = Effect.fnUntraced(function* (input: {
+    readonly moduleId: string;
+    readonly identifier: LoginIdentifier;
+  }) {
+    const table = tables(i.table);
+
+    const rows =
+      yield* sql`select ${table.fields("email_lookup_")} from ${table.name} where ${identifierKey(table, input.identifier)} limit 2`;
+
+    if (rows.length === 0) return Option.none();
+    ensureEmail(rows.length === 1);
+    const row = table.decode(rows[0]!, "email_lookup_");
+
+    ensureEmail(
+      row[i.namespace] === input.identifier.namespace && row[i.value] === input.identifier.value,
+    );
+    if (!i.isCurrent(row) || row[i.verifiedAt] === null || row[i.verifiedAt] === undefined)
+      return Option.none();
+    const subjectId = yield* mapping.subjectId.toSubject(row[i.subjectId]);
+    const result = yield* read({ ...input, subjectId });
+
+    return Option.fromUndefinedOr(result?.targetSnapshot);
+  });
+
+  return { read, lookup };
+});