@yielded/auth-persistence 0.1.0-beta.25 → 0.1.0-beta.26

package/src/internal/oauth/native-revocations.ts

@@ -0,0 +1,190 @@
+import type { LifecycleHooks } from "@yielded/auth/Hooks";
+import * as M from "@yielded/auth/OAuth";
+import { Effect, Option, Schema } from "effect";
+import { SqlClient } from "effect/sql";
+import type { Fragment } from "effect/sql/Statement";
+
+import { sqlBatchAssertion } from "../d1-planning";
+import type { OAuthConnectedRevocationMapping } from "../models/oauth-connected-model";
+import type { NativeSqlTables } from "../native-sql-table";
+import { exactSqlText, executeSqlChange } from "../sql-change";
+import {
+  appendSqlBatchStatement,
+  CurrentSqlCommit,
+  makeSqlCommitExecutor,
+  registerSqlBatchPostcondition,
+  registerSqlPostcondition,
+  SqlBatchCommit,
+} from "../sql-commit";
+import type { SqlExpression, TableModel } from "../table-model";
+import { prepareOAuthNative } from "./native-sign-in";
+import { invariant, storage, unavailable } from "./state";
+
+// The driver validates physical metadata; schema decoding owns durable values.
+export type OAuthNativeRevocationMapping = OAuthConnectedRevocationMapping<
+  TableModel,
+  TableModel,
+  TableModel,
+  unknown,
+  SqlExpression
+>;
+
+export const makeNativeOAuthRevocationServices = Effect.fnUntraced(function* (
+  tables: NativeSqlTables,
+  mapping: OAuthNativeRevocationMapping,
+  batch?: SqlBatchCommit["Service"],
+): Effect.fn.Return<
+  { readonly oauthConnectedRevocations: M.OAuthConnectedRevocations["Service"] },
+  M.OAuthUnavailable,
+  SqlClient.SqlClient | LifecycleHooks
+> {
+  const executor = yield* makeSqlCommitExecutor(unavailable);
+  const external = yield* Effect.serviceOption(CurrentSqlCommit);
+  const sql = (yield* SqlClient.SqlClient).withoutTransforms();
+  const job = tables(mapping.job.table);
+  const j = mapping.job;
+  const now = tables.expression(mapping.clock.engineNowMillis);
+  const stored = storage(M.OAuthConnectedRevocationJob);
+
+  const exact = (key: string, value: unknown) =>
+    exactSqlText(sql, job.column(key), job.value(key, value));
+
+  const lock =
+    batch === undefined
+      ? sql.onDialectOrElse({ sqlite: () => sql``, orElse: () => sql`for update` })
+      : sql``;
+
+  const run = <A, E, R>(
+    effect: Effect.Effect<A, E, R>,
+    mode: "transaction" | "statement" = "transaction",
+  ) =>
+    batch === undefined
+      ? executor.run(effect, mode)
+      : executor.batch(effect).pipe(Effect.provideService(SqlBatchCommit, batch));
+
+  const change = Effect.fnUntraced(function* (statement: Fragment) {
+    if (batch !== undefined) {
+      yield* appendSqlBatchStatement(sql`${statement}`);
+      yield* appendSqlBatchStatement(sqlBatchAssertion(sql, sql`changes() = 1`));
+    } else invariant((yield* executeSqlChange(sql, statement)) === 1);
+  });
+
+  const finish = (condition: Fragment) =>
+    batch === undefined
+      ? registerSqlPostcondition({
+          name: "oauth-revocation",
+          check: Effect.gen(function* () {
+            invariant((yield* sql`select 1 where ${condition}`).length === 1);
+          }),
+        })
+      : registerSqlBatchPostcondition({
+          name: "oauth-revocation",
+          statement: sqlBatchAssertion(sql, condition),
+        });
+
+  const service: M.OAuthConnectedRevocations["Service"] = {
+    claim: (input, prepare) =>
+      run(
+        Effect.gen(function* () {
+          const moduleId = M.snapshotOAuthSync(M.OAuthModuleId, input.moduleId);
+          const claimId = M.snapshotOAuthSync(M.OAuthClaimId, input.claimId);
+
+          invariant(
+            Number.isSafeInteger(input.lifetimeMillis) &&
+              input.lifetimeMillis >= 1000 &&
+              input.lifetimeMillis <= 300000,
+          );
+
+          const pending = sql.and([
+            exact(j.moduleId, moduleId),
+            exact(j.state, "Pending"),
+            sql`${tables.expression(mapping.clock.toMillis(job.column(j.retentionUntil)))} > ${now}`,
+          ]);
+
+          const rows =
+            yield* sql`select ${job.fields("job_")}, ${now} as engine_now from ${job.name} where ${pending} order by ${job.column(j.retentionUntil)}, ${job.column(j.jobId)} limit 1 ${lock}`;
+
+          if (rows[0] === undefined) return yield* prepareOAuthNative({ _tag: "Empty" }, prepare);
+          const row = job.decode(rows[0], "job_");
+          const encoded = row[j.snapshot];
+
+          invariant(typeof encoded === "string");
+          const value = stored.decode(encoded);
+
+          invariant(
+            row[j.jobId] === value.jobId &&
+              value.grant.context.moduleId === moduleId &&
+              mapping.subjectId.equals(
+                row[j.subjectId],
+                yield* mapping.subjectId.toNative(value.grant.context.subjectId),
+              ),
+          );
+          const engineNow = yield* Schema.decodeEffect(Schema.Int)(Number(rows[0].engine_now));
+
+          const deadline = engineNow + input.lifetimeMillis;
+
+          // A claim always gets its full lifetime; retention extends to cover it so
+          // cleanup cannot delete a job while its revocation attempt is live.
+          const retention = Math.max(mapping.clock.decodeInstant(row[j.retentionUntil]), deadline);
+
+          const claim = M.snapshotOAuthSync(M.OAuthConnectedRevocationClaim, {
+            job: value,
+            claimId,
+            claimedAtMillis: engineNow,
+            claimExpiresAtMillis: deadline,
+          });
+
+          yield* change(
+            sql`${job.update({ [j.state]: "Claimed", [j.claimId]: claimId, [j.claimedAt]: mapping.clock.encodeInstant(engineNow), [j.claimExpiresAt]: mapping.clock.encodeInstant(deadline), [j.retentionUntil]: mapping.clock.encodeInstant(retention) })} where ${pending} and ${exact(j.jobId, value.jobId)} and ${exact(j.snapshot, encoded)} and ${now} >= ${engineNow} and ${now} < ${deadline}`,
+          );
+          if (Option.isSome(external))
+            yield* finish(
+              sql`exists(select 1 from ${job.name} where ${exact(j.jobId, value.jobId)} and ${exact(j.snapshot, encoded)} and ${exact(j.claimId, claimId)} and ${exact(j.state, "Claimed")}) and ${now} < ${deadline}`,
+            );
+
+          return yield* prepareOAuthNative({ _tag: "Claimed", claim }, prepare);
+        }),
+      ),
+    settle: (original, prepare) =>
+      run(
+        Effect.gen(function* () {
+          const claim = M.snapshotOAuthSync(M.OAuthConnectedRevocationClaim, original.claim);
+
+          const outcome = yield* Schema.decodeEffect(Schema.Literals(["Confirmed", "Unknown"]))(
+            original.outcome,
+          );
+
+          const target = sql.and([
+            exact(j.jobId, claim.job.jobId),
+            exact(j.moduleId, claim.job.grant.context.moduleId),
+            exact(j.snapshot, stored.encode(claim.job)),
+            exact(j.state, "Claimed"),
+            exact(j.claimId, claim.claimId),
+            sql`${job.column(j.claimedAt)} = ${job.value(j.claimedAt, mapping.clock.encodeInstant(claim.claimedAtMillis))}`,
+            sql`${job.column(j.claimExpiresAt)} = ${job.value(j.claimExpiresAt, mapping.clock.encodeInstant(claim.claimExpiresAtMillis))}`,
+            sql`${now} >= ${claim.claimedAtMillis} and ${now} < ${claim.claimExpiresAtMillis}`,
+          ]);
+
+          const statement = sql`${job.update({ [j.state]: outcome })} where ${target}`;
+
+          if (batch !== undefined) {
+            const rows = yield* sql`select 1 from ${job.name} where ${target}`;
+
+            if (rows.length === 0) return yield* prepareOAuthNative({ settled: false }, prepare);
+            invariant(rows.length === 1);
+            yield* change(statement);
+          } else if ((yield* executeSqlChange(sql, statement)) !== 1)
+            return yield* prepareOAuthNative({ settled: false }, prepare);
+          if (Option.isSome(external))
+            yield* finish(
+              sql`exists(select 1 from ${job.name} where ${exact(j.jobId, claim.job.jobId)} and ${exact(j.snapshot, stored.encode(claim.job))} and ${exact(j.claimId, claim.claimId)} and ${exact(j.state, outcome)}) and ${now} < ${claim.claimExpiresAtMillis}`,
+            );
+
+          return yield* prepareOAuthNative({ settled: true }, prepare);
+        }),
+        "statement",
+      ),
+  };
+
+  return { oauthConnectedRevocations: service };
+});

package/src/internal/oauth/native-sign-in.ts

@@ -0,0 +1,111 @@
+import { CurrentCommitJournal, type LifecycleHooks } from "@yielded/auth/Hooks";
+import * as M from "@yielded/auth/OAuth";
+import { Crypto, Effect } from "effect";
+import type { SqlClient } from "effect/sql/SqlClient";
+
+import type { NativeSqlTables } from "../native-sql-table";
+import { makeSqlCommitExecutor, registerSqlCommitReceipt, SqlBatchCommit } from "../sql-commit";
+import { makeOAuthNativeFlow } from "./native-flow";
+import { makeOAuthNativeState, type OAuthNativeReadMapping } from "./native-state";
+import { invariant, unavailable } from "./state";
+
+export const prepareOAuthNative = <Value, A>(
+  value: Value,
+  prepare: M.PrepareOAuthCommit<Value, A>,
+) =>
+  Effect.gen(function* () {
+    const journal = yield* CurrentCommitJournal;
+
+    const receipt = prepare(value, journal);
+
+    invariant(receipt?._tag === "PreparedCommit" && Effect.isEffect(receipt.read));
+    yield* registerSqlCommitReceipt(receipt);
+
+    return receipt;
+  });
+
+/** Both physical adapters bind the same native SQL operations. */
+export const makeNativeOAuthSignInServices = Effect.fnUntraced(function* (
+  tables: NativeSqlTables,
+  mapping: OAuthNativeReadMapping,
+  batch?: SqlBatchCommit["Service"],
+): Effect.fn.Return<
+  { readonly oauthSignInPersistence: M.OAuthSignInPersistence["Service"] },
+  M.OAuthUnavailable,
+  SqlClient | LifecycleHooks | Crypto.Crypto
+> {
+  const executor = yield* makeSqlCommitExecutor(unavailable);
+  const crypto = yield* Crypto.Crypto;
+  const state = yield* makeOAuthNativeState(tables, mapping);
+
+  const flow = yield* makeOAuthNativeFlow(
+    tables,
+    mapping,
+    M.OAuthSignInFlow,
+    "sign-in",
+    () => undefined,
+    batch !== undefined,
+  );
+
+  const mode = flow.mysql ? "transaction" : "statement";
+
+  const run = <A, E, R>(
+    effect: Effect.Effect<A, E, R>,
+    selected: "transaction" | "statement" = mode,
+  ) =>
+    batch === undefined
+      ? executor.run(effect, selected)
+      : executor.batch(effect).pipe(Effect.provideService(SqlBatchCommit, batch));
+
+  const service: M.OAuthSignInPersistence["Service"] = {
+    issue: (original, prepare) =>
+      run(
+        Effect.gen(function* () {
+          const input = M.snapshotOAuthSync(M.OAuthSignInFlow, original);
+          const issued = yield* flow.issue(input);
+
+          return yield* prepareOAuthNative(
+            issued ? { _tag: "Issued", flow: input } : { _tag: "Rejected" },
+            prepare,
+          );
+        }),
+        mode,
+      ),
+    consume: (original, prepare) =>
+      run(
+        Effect.gen(function* () {
+          const input = M.snapshotOAuthSync(M.OAuthSignInAccess, original);
+          const consumed = yield* flow.consume(input);
+
+          return yield* prepareOAuthNative(
+            consumed === undefined ? { _tag: "Rejected" } : { _tag: "Consumed", flow: consumed },
+            prepare,
+          );
+        }),
+        mode,
+      ),
+    resolve: (input) =>
+      executor.read(
+        Effect.suspend(() =>
+          state.resolve(
+            input.moduleId,
+            M.snapshotOAuthSync(M.OAuthExternalIdentity, input.identity),
+          ),
+        ).pipe(Effect.provideService(Crypto.Crypto, crypto)),
+      ),
+    cleanup: (original, prepare) =>
+      run(
+        Effect.gen(function* () {
+          const input = M.snapshotOAuthSync(M.OAuthCleanupInput, original);
+
+          return yield* prepareOAuthNative(
+            yield* flow.cleanup(input.moduleId, input.limit),
+            prepare,
+          );
+        }),
+        "statement",
+      ),
+  };
+
+  return { oauthSignInPersistence: service };
+});

package/src/internal/oauth/native-state.ts

@@ -0,0 +1,346 @@
+import {
+  OAuthAccountRevision,
+  OAuthCredentialSnapshot,
+  OAuthExternalIdentity,
+  type OAuthCredentialKey,
+} from "@yielded/auth/OAuth";
+import type { SubjectId } from "@yielded/auth/Schema";
+import { Effect, Schema } from "effect";
+import { SqlClient } from "effect/sql";
+
+import type { OAuthSignInMapping } from "../models/oauth-model";
+import type { NativeSqlTables } from "../native-sql-table";
+import { exactSqlText } from "../sql-change";
+import type { SqlExpression, TableModel } from "../table-model";
+import { invariant, oauthIdentityKey } from "./state";
+
+// Expression handles are checked by the physical compiler, not domain codecs.
+export type OAuthNativeReadMapping = OAuthSignInMapping<
+  TableModel,
+  TableModel,
+  TableModel,
+  TableModel,
+  TableModel,
+  unknown,
+  SqlExpression
+>;
+
+type Row = Readonly<Record<string, unknown>>;
+
+/** Unlocked snapshots and explicit subject-first reads share decoding rules.
+ * No observation registry or discovered-identity placeholder is retained. */
+export const makeOAuthNativeAuthority = Effect.fnUntraced(function* (
+  tables: NativeSqlTables,
+  mapping: Pick<OAuthNativeReadMapping, "subject" | "authority" | "subjectId" | "clock">,
+) {
+  const sql = (yield* SqlClient.SqlClient).withoutTransforms();
+  const subject = tables(mapping.subject.table);
+  const authority = tables(mapping.authority.table);
+  const s = subject.as("oauth_subject");
+  const a = authority.as("oauth_authority");
+  const now = tables.expression(mapping.clock.engineNowMillis);
+
+  const lock = sql.onDialectOrElse({
+    pg: () => sql`for update`,
+    mysql: () => sql`for update`,
+    orElse: () => sql``,
+  });
+
+  const active = (kind: "subject" | "authority", alias: string) => {
+    const descriptor = mapping[kind];
+    const physical = tables(descriptor.table);
+
+    return sql`(select * from ${physical.name} where ${tables.expression(descriptor.activeCondition)}) as ${sql(alias)}`;
+  };
+
+  const revision = Effect.fnUntraced(function* (
+    subjectRow: Row,
+    factors: ReadonlyArray<Row>,
+    nativeId: unknown,
+  ) {
+    invariant(mapping.subject.isActiveStatus(subjectRow[mapping.subject.status]));
+    invariant(mapping.subjectId.equals(subjectRow[mapping.subject.id], nativeId));
+    invariant(factors.length > 0 && factors.length <= 64);
+    invariant(
+      factors.every(
+        (row) =>
+          mapping.subjectId.equals(row[mapping.authority.subjectId], nativeId) &&
+          mapping.authority.isActiveStatus(row[mapping.authority.status]),
+      ),
+    );
+
+    const credentials = factors.map((row) => ({
+      credentialId: row[mapping.authority.credentialId],
+      revision: row[mapping.authority.revision],
+    }));
+
+    invariant(new Set(credentials.map((item) => item.credentialId)).size === credentials.length);
+
+    const value = yield* Schema.decodeUnknownEffect(Schema.toType(OAuthAccountRevision))({
+      subjectId: yield* mapping.subjectId.toSubject(nativeId),
+      securityRevision: subjectRow[mapping.subject.securityRevision],
+      credentials,
+    });
+
+    return {
+      ...value,
+      credentials: [...value.credentials].sort((left, right) =>
+        left.credentialId.localeCompare(right.credentialId),
+      ),
+    };
+  });
+
+  const captureSubject = Effect.fnUntraced(function* (subjectId: SubjectId, locking: boolean) {
+    const nativeId = yield* mapping.subjectId.toNative(subjectId);
+
+    const rows =
+      yield* sql`select ${subject.fields("s_")}, ${now} as engine_now from ${subject.name} where ${subject.column(mapping.subject.id)} = ${subject.value(mapping.subject.id, nativeId)} and ${tables.expression(mapping.subject.activeCondition)} limit 2 ${locking ? lock : sql``}`;
+
+    invariant(rows.length <= 1);
+    if (rows[0] === undefined) return undefined;
+    const row = subject.decode(rows[0], "s_");
+
+    invariant(mapping.subjectId.equals(row[mapping.subject.id], nativeId));
+
+    return {
+      nativeId,
+      subject: row,
+      securityRevision: yield* Schema.decodeUnknownEffect(
+        OAuthAccountRevision.fields.securityRevision,
+      )(row[mapping.subject.securityRevision]),
+      now: yield* Schema.decodeEffect(Schema.Int)(Number(rows[0].engine_now)),
+    };
+  });
+
+  const capture = Effect.fnUntraced(function* (subjectId: SubjectId, locking: boolean) {
+    const nativeId = yield* mapping.subjectId.toNative(subjectId);
+
+    if (locking) {
+      // Never acquire a credential, identity, flow or policy lock before this.
+      const subjects =
+        yield* sql`select ${subject.fields("s_")}, ${now} as engine_now from ${subject.name}
+        where ${subject.column(mapping.subject.id)} = ${subject.value(mapping.subject.id, nativeId)}
+          and ${tables.expression(mapping.subject.activeCondition)} ${lock}`;
+
+      if (subjects.length === 0) return undefined;
+      invariant(subjects.length === 1);
+      const subjectRow = subject.decode(subjects[0]!, "s_");
+
+      const factors = yield* sql`select ${authority.fields("a_")} from ${authority.name}
+        where ${authority.column(mapping.authority.subjectId)} = ${authority.value(mapping.authority.subjectId, nativeId)}
+          and ${tables.expression(mapping.authority.activeCondition)}
+        order by ${authority.column(mapping.authority.credentialId)} limit 65 ${lock}`;
+
+      if (factors.length === 0) return undefined;
+
+      return {
+        nativeId,
+        subject: subjectRow,
+        revision: yield* revision(
+          subjectRow,
+          factors.map((row) => authority.decode(row, "a_")),
+          nativeId,
+        ),
+        now: yield* Schema.decodeEffect(Schema.Int)(Number(subjects[0]!.engine_now)),
+      };
+    }
+
+    // Bind each column's own native codec; the columns need not share an encoding.
+    const rows = yield* sql`select ${s.fields("s_")}, ${a.fields("a_")}, ${now} as engine_now
+      from ${active("subject", "oauth_subject")}
+      join ${active("authority", "oauth_authority")} on
+        ${a.column(mapping.authority.subjectId)} = ${a.value(mapping.authority.subjectId, nativeId)}
+      where ${s.column(mapping.subject.id)} = ${s.value(mapping.subject.id, nativeId)}
+      order by ${a.column(mapping.authority.credentialId)} limit 65`;
+
+    if (rows.length === 0) return undefined;
+    const subjectRow = s.decode(rows[0]!, "s_");
+
+    return {
+      nativeId,
+      subject: subjectRow,
+      revision: yield* revision(
+        subjectRow,
+        rows.map((row) => a.decode(row, "a_")),
+        nativeId,
+      ),
+      now: yield* Schema.decodeEffect(Schema.Int)(Number(rows[0]!.engine_now)),
+    };
+  });
+
+  return { sql, now, lock, subject, authority, capture, captureSubject, revision };
+});
+
+export const makeOAuthNativeState = Effect.fnUntraced(function* (
+  tables: NativeSqlTables,
+  mapping: OAuthNativeReadMapping,
+) {
+  const state = yield* makeOAuthNativeAuthority(tables, mapping);
+  const { sql, subject, authority, revision } = state;
+  const ownership = tables(mapping.ownership.table);
+  const credential = tables(mapping.credential.table);
+  const s = subject.as("oauth_subject");
+  const o = ownership.as("oauth_identity");
+  const c = credential.as("oauth_credential");
+  const a = authority.as("oauth_authority");
+
+  const exact = (
+    left: Parameters<typeof exactSqlText>[1],
+    right: Parameters<typeof exactSqlText>[2],
+  ) => exactSqlText(sql, left, right);
+
+  const active = (kind: "subject" | "credential" | "authority", alias: string) => {
+    const descriptor = mapping[kind];
+    const physical = tables(descriptor.table);
+
+    return sql`(select * from ${physical.name} where ${tables.expression(descriptor.activeCondition)}) as ${sql(alias)}`;
+  };
+
+  const joinedIds =
+    ownership.unencodedTextColumn?.(mapping.ownership.subjectId) !== undefined &&
+    subject.unencodedTextColumn?.(mapping.subject.id) !== undefined &&
+    credential.unencodedTextColumn?.(mapping.credential.subjectId) !== undefined &&
+    authority.unencodedTextColumn?.(mapping.authority.subjectId) !== undefined;
+
+  const decodeSnapshot = Effect.fnUntraced(function* (
+    rows: ReadonlyArray<Row>,
+    moduleId: string,
+    nativeId?: unknown,
+  ) {
+    if (rows.length === 0) return undefined;
+    const owned = o.decode(rows[0]!, "o_");
+
+    const identity = yield* Schema.decodeUnknownEffect(OAuthExternalIdentity)({
+      provider: owned[mapping.ownership.provider],
+      issuer: owned[mapping.ownership.issuer],
+      subject: owned[mapping.ownership.externalSubject],
+    });
+
+    const identityKey = yield* oauthIdentityKey(identity);
+
+    invariant(owned[mapping.ownership.identityKey] === identityKey);
+    const ownerId = mapping.ownership.decodeSubjectId(owned);
+
+    if (nativeId !== undefined) invariant(mapping.subjectId.equals(ownerId, nativeId));
+    const login = c.decode(rows[0]!, "c_");
+
+    invariant(mapping.subjectId.equals(login[mapping.credential.subjectId], ownerId));
+    invariant(login[mapping.credential.identityKey] === identityKey);
+    invariant(mapping.credential.isActiveStatus(login[mapping.credential.status]));
+
+    const current = yield* revision(
+      s.decode(rows[0]!, "s_"),
+      rows.map((row) => a.decode(row, "a_")),
+      ownerId,
+    );
+
+    const credentialId = login[mapping.credential.credentialId];
+    const credentialRevision = login[mapping.credential.credentialRevision];
+
+    if (
+      !current.credentials.some(
+        (item) => item.credentialId === credentialId && item.revision === credentialRevision,
+      )
+    )
+      return undefined;
+
+    return yield* Schema.decodeUnknownEffect(Schema.toType(OAuthCredentialSnapshot))({
+      moduleId,
+      identity,
+      credentialId,
+      credentialRevision,
+      revision: current,
+      requirement: mapping.subject.decodeAuthenticationRequirement(s.decode(rows[0]!, "s_")),
+    });
+  });
+
+  const resolve = Effect.fnUntraced(function* (
+    moduleId: string,
+    identity: typeof OAuthExternalIdentity.Type,
+  ) {
+    const identityKey = yield* oauthIdentityKey(identity);
+    let nativeId: unknown;
+
+    if (!joinedIds) {
+      const found = yield* sql`select ${ownership.fields("o_")} from ${ownership.name}
+        where ${exact(ownership.column(mapping.ownership.identityKey), ownership.value(mapping.ownership.identityKey, identityKey))}`;
+
+      if (found.length === 0) return undefined;
+      invariant(found.length === 1);
+      const row = ownership.decode(found[0]!, "o_");
+
+      invariant(
+        row[mapping.ownership.provider] === identity.provider &&
+          row[mapping.ownership.issuer] === identity.issuer &&
+          row[mapping.ownership.externalSubject] === identity.subject,
+      );
+      nativeId = mapping.ownership.decodeSubjectId(row);
+    }
+
+    const bindOwner = (table: typeof s, key: string) =>
+      joinedIds
+        ? exact(table.column(key), o.column(mapping.ownership.subjectId))
+        : sql`${table.column(key)} = ${table.value(key, nativeId)}`;
+
+    const rows =
+      yield* sql`select ${o.fields("o_")}, ${s.fields("s_")}, ${c.fields("c_")}, ${a.fields("a_")}
+      from ${o.name}
+      join ${active("subject", "oauth_subject")} on ${bindOwner(s, mapping.subject.id)}
+      join ${active("credential", "oauth_credential")} on ${bindOwner(c, mapping.credential.subjectId)}
+        and ${exact(c.column(mapping.credential.moduleId), c.value(mapping.credential.moduleId, moduleId))}
+        and ${exact(c.column(mapping.credential.identityKey), c.value(mapping.credential.identityKey, identityKey))}
+      join ${active("authority", "oauth_authority")} on ${bindOwner(a, mapping.authority.subjectId)}
+      where ${exact(o.column(mapping.ownership.identityKey), o.value(mapping.ownership.identityKey, identityKey))}
+      order by ${a.column(mapping.authority.credentialId)} limit 65`;
+
+    const result = yield* decodeSnapshot(rows, moduleId, joinedIds ? undefined : nativeId);
+
+    if (result !== undefined)
+      invariant(
+        result.identity.provider === identity.provider &&
+          result.identity.issuer === identity.issuer &&
+          result.identity.subject === identity.subject,
+      );
+
+    return result;
+  });
+
+  const readCredential = Effect.fnUntraced(function* (input: typeof OAuthCredentialKey.Type) {
+    const nativeId = yield* mapping.subjectId.toNative(input.subjectId);
+    let identityKey: unknown;
+
+    const direct =
+      credential.unencodedTextColumn?.(mapping.credential.identityKey) !== undefined &&
+      ownership.unencodedTextColumn?.(mapping.ownership.identityKey) !== undefined;
+
+    if (!direct) {
+      const selected = yield* sql`select ${credential.fields("c_")} from ${credential.name}
+        where ${exact(credential.column(mapping.credential.moduleId), credential.value(mapping.credential.moduleId, input.moduleId))}
+          and ${exact(credential.column(mapping.credential.credentialId), credential.value(mapping.credential.credentialId, input.credentialId))}
+          and ${credential.column(mapping.credential.subjectId)} = ${credential.value(mapping.credential.subjectId, nativeId)}`;
+
+      if (selected.length === 0) return undefined;
+      invariant(selected.length === 1);
+      identityKey = credential.decode(selected[0]!, "c_")[mapping.credential.identityKey];
+    }
+
+    const owner = (table: typeof s, key: string) =>
+      sql`${table.column(key)} = ${table.value(key, nativeId)}`;
+
+    const rows =
+      yield* sql`select ${o.fields("o_")}, ${s.fields("s_")}, ${c.fields("c_")}, ${a.fields("a_")}
+      from ${active("credential", "oauth_credential")}
+      join ${o.name} on ${direct ? exact(o.column(mapping.ownership.identityKey), c.column(mapping.credential.identityKey)) : exact(o.column(mapping.ownership.identityKey), o.value(mapping.ownership.identityKey, identityKey))}
+        and ${owner(o, mapping.ownership.subjectId)}
+      join ${active("subject", "oauth_subject")} on ${owner(s, mapping.subject.id)}
+      join ${active("authority", "oauth_authority")} on ${owner(a, mapping.authority.subjectId)}
+      where ${owner(c, mapping.credential.subjectId)}
+        and ${exact(c.column(mapping.credential.moduleId), c.value(mapping.credential.moduleId, input.moduleId))}
+        and ${exact(c.column(mapping.credential.credentialId), c.value(mapping.credential.credentialId, input.credentialId))}
+      order by ${a.column(mapping.authority.credentialId)} limit 65`;
+
+    return yield* decodeSnapshot(rows, input.moduleId, nativeId);
+  });
+
+  return { ...state, ownership, credential, resolve, readCredential };
+});