@yielded/auth-persistence 0.1.0-beta.25 → 0.1.0-beta.26

package/src/internal/registration.ts

@@ -1,45 +1,48 @@
-import { coordinateCommit, hasCommitScope, LifecycleHooks } from "@yielded/auth/Hooks";
+import type { LifecycleHooks } from "@yielded/auth/Hooks";
 import type { LoginIdentifier } from "@yielded/auth/Identity";
 import { PasswordUnavailable } from "@yielded/auth/Password";
-import { reportPersistenceFailure } from "@yielded/auth/Persistence";
 import type { SubjectId } from "@yielded/auth/Schema";
 import { SecurityRevision } from "@yielded/auth/Sessions";
-import { type Context, Crypto, Effect, Schema } from "effect";
+import { type Context, Crypto, Effect, Schema, Option, Cause } from "effect";
+import { SqlClient } from "effect/sql/SqlClient";
 
 import { PersistenceConfigurationError } from "./configuration";
 import { randomId } from "./crypto";
-import { CurrentPasswordSql } from "./password-kernel";
-import type { QueryOperations } from "./query-operations";
+import type { AnyPasswordPersistenceMapping } from "./models/password-model";
+import type { NativeSqlTables } from "./native-sql-table";
+import {
+  makeNativePasswordRegistrationStore,
+  PasswordIdentifierTaken,
+} from "./password-registration-native";
 import type { PasswordRegistrationAuthority } from "./registration-contract";
-import type { makeMappings } from "./storage-mapping";
-
-class IdentifierTaken extends Schema.TaggedError<IdentifierTaken>()("IdentifierTaken", {}) {}
+import { makeSqlCommitExecutor, CurrentSqlCommit } from "./sql-commit";
 
 type CreateSubject = (input: {
+  readonly requestId: string;
   readonly identifier: LoginIdentifier;
   readonly registration: unknown;
 }) => Effect.Effect<SubjectId, PasswordUnavailable>;
 
-/** Registration reserves the command, provisions the application's subject, and
- * creates the unverified identifier and password in one SQL transaction. Replays
- * always suppress; a public request ID never recovers a private password intent.
- */
-export const makeRegistrationAuthority = Effect.fn("makeRegistrationAuthority")(function* <R>(
-  mappings: Effect.Success<ReturnType<typeof makeMappings>>,
-  operations: QueryOperations,
-  standalone: Effect.Effect<void, PasswordUnavailable>,
+/** Application provisioning and the unverified identifier/password binding share
+ * one physical owner. Identifier uniqueness arbitrates registration; correlation
+ * request IDs never become a retained credential-issuance receipt. */
+export const makeRegistrationAuthority = Effect.fnUntraced(function* <R>(
+  tables: NativeSqlTables,
+  mapping: AnyPasswordPersistenceMapping,
   provisioning: Context.Key<R, object>,
   strategy: string,
 ): Effect.fn.Return<
   PasswordRegistrationAuthority<unknown>,
   PersistenceConfigurationError,
-  LifecycleHooks | CurrentPasswordSql | Crypto.Crypto | R
+  LifecycleHooks | SqlClient | Crypto.Crypto | R
 > {
-  const database = yield* CurrentPasswordSql;
-  const hooks = yield* LifecycleHooks;
+  const sql = (yield* SqlClient).withoutTransforms();
   const crypto = yield* Crypto.Crypto;
-  // Core has already decoded registration with the selected strategy's Schema;
-  // the dynamic strategy table erases only that heterogeneous callback signature.
+  const executor = yield* makeSqlCommitExecutor(() => PasswordUnavailable.make({}));
+  const parent = yield* Effect.serviceOption(CurrentSqlCommit);
+  const store = yield* makeNativePasswordRegistrationStore(tables, mapping);
+  // The strategy has already decoded its registration Schema. Only its callback
+  // signature is erased by the heterogeneous strategy service map.
   const creators = (yield* provisioning) as Readonly<Record<string, CreateSubject>>;
   const createSubject = creators[strategy];
 
@@ -47,132 +50,82 @@ export const makeRegistrationAuthority = Effect.fn("makeRegistrationAuthority")(
     return yield* PersistenceConfigurationError.make({
       reason: `Missing subject provisioning for ${strategy}`,
     });
-  const { and, eq, column } = operations;
-  const mapping = mappings.passwords();
-  const receipts = mappings.table("passwordRegistrations");
-
-  return {
-    register: (input, prepare) =>
-      Effect.gen(function* () {
-        if (yield* hasCommitScope) return yield* PasswordUnavailable.make({});
-        yield* standalone;
-
-        const receipt = { moduleId: input.moduleId, requestId: input.requestId };
-
-        const suppress = coordinateCommit(
-          (journal) =>
-            database.transaction((tx) =>
-              Effect.gen(function* () {
-                yield* tx.insert(receipts).values(receipt).onConflictDoNothing();
-
-                return prepare({ _tag: "Suppressed" }, journal);
-              }),
+  const s = mapping.subject;
+  const subject = tables(s.table);
+  const lock = sql.onDialectOrElse({ sqlite: () => sql``, orElse: () => sql`for update` });
+
+  const run = <A, E, R2>(work: Effect.Effect<A, E, R2>, suppressed: Effect.Effect<A, E, R2>) =>
+    Option.isSome(parent)
+      ? executor.run(work)
+      : executor
+          .operation(
+            work.pipe(
+              Effect.mapError((error) =>
+                error instanceof PasswordIdentifierTaken ? error : PasswordUnavailable.make({}),
+              ),
             ),
-          { mode: "interactive" },
-        );
-
-        const committed = yield* coordinateCommit(
-          (journal) =>
-            database.transaction((tx) =>
-              Effect.gen(function* () {
-                const reserved = yield* tx
-                  .insert(receipts)
-                  .values(receipt)
-                  .onConflictDoNothing()
-                  .returning();
-
-                if (reserved.length === 0) return prepare({ _tag: "Suppressed" }, journal);
-
-                const identifiers = yield* tx
-                  .select()
-                  .from(mapping.identifier.table)
-                  .where(
-                    and(
-                      eq(
-                        column(mapping.identifier.table, mapping.identifier.namespace),
-                        input.identifier.namespace,
-                      ),
-                      eq(
-                        column(mapping.identifier.table, mapping.identifier.value),
-                        input.identifier.value,
-                      ),
-                    ),
-                  )
-                  .limit(1);
-
-                if (identifiers.length !== 0) return prepare({ _tag: "Suppressed" }, journal);
-
-                const subjectId = yield* createSubject({
-                  identifier: input.identifier,
-                  registration: input.registration,
-                });
-
-                const nativeId = yield* mapping.subjectId.toNative(subjectId);
-
-                const subjects = yield* tx
-                  .select()
-                  .from(mapping.subject.table)
-                  .where(eq(column(mapping.subject.table, mapping.subject.id), nativeId))
-                  .limit(1);
-
-                if (
-                  subjects.length !== 1 ||
-                  !mapping.subject.isActiveStatus(subjects[0][mapping.subject.status])
-                )
-                  return yield* PasswordUnavailable.make({});
-                yield* Schema.decodeUnknownEffect(SecurityRevision)(
-                  subjects[0][mapping.subject.securityRevision],
-                );
-
-                const bound = yield* tx
-                  .insert(mapping.identifier.table)
-                  .values(
-                    mapping.identifier.encodeInitialInsert(
-                      input.identifier,
-                      nativeId,
-                      SecurityRevision.make(yield* randomId),
-                    ),
-                  )
-                  .onConflictDoNothing()
-                  .returning();
-
-                // A concurrent registration won the identifier. Roll back the application
-                // subject too, then persist a non-authorizing receipt in a new transaction.
-                if (bound.length !== 1) return yield* new IdentifierTaken({});
-
-                const credentialId = yield* randomId;
-                const credentialRevision = SecurityRevision.make(yield* randomId);
+          )
+          .pipe(
+            Effect.catchCause((cause) =>
+              cause.reasons.length > 0 &&
+              cause.reasons.every(
+                (reason) =>
+                  Cause.isFailReason(reason) && reason.error instanceof PasswordIdentifierTaken,
+              )
+                ? executor.run(suppressed, "statement")
+                : Effect.failCause(cause),
+            ),
+            Effect.mapError(() => PasswordUnavailable.make({})),
+          );
 
-                yield* tx.insert(mapping.credential.table).values(
-                  mapping.credential.encodeInsert({
-                    moduleId: input.moduleId,
-                    subjectId: nativeId,
+  return {
+    register: (input, project) =>
+      executor.read(store.available(input.identifier)).pipe(
+        Effect.flatMap((existing) =>
+          existing.length !== 0
+            ? executor.run(store.prepare({ _tag: "Suppressed" }, project), "statement")
+            : run(
+                Effect.gen(function* () {
+                  const subjectId = yield* createSubject({
+                    requestId: input.requestId,
+                    identifier: input.identifier,
+                    registration: input.registration,
+                  });
+
+                  const nativeId = yield* mapping.subjectId.toNative(subjectId);
+
+                  const rows =
+                    yield* sql`select ${subject.fields("registration_subject_")} from ${subject.name} where ${subject.column(s.id)} = ${subject.value(s.id, nativeId)} limit 2 ${lock}`;
+
+                  if (rows.length !== 1) return yield* PasswordUnavailable.make({});
+                  const row = subject.decode(rows[0]!, "registration_subject_");
+
+                  if (!s.isActiveStatus(row[s.status])) return yield* PasswordUnavailable.make({});
+
+                  const securityRevision = yield* Schema.decodeUnknownEffect(SecurityRevision)(
+                    row[s.securityRevision],
+                  );
+
+                  const identifierRevision = SecurityRevision.make(yield* randomId);
+                  const credentialId = yield* randomId;
+                  const credentialRevision = SecurityRevision.make(yield* randomId);
+                  const verifierVersion = SecurityRevision.make(yield* randomId);
+
+                  yield* store.bind({
+                    ...input,
+                    subjectId,
+                    securityRevision,
+                    identifierRevision,
                     credentialId,
                     credentialRevision,
-                    verifierVersion: SecurityRevision.make(yield* randomId),
-                    replacement: input.replacement,
-                  }),
-                );
-                yield* tx.insert(mapping.authorityCredential.table).values(
-                  mapping.authorityCredential.encodeInsert({
-                    subjectId: nativeId,
-                    credentialId,
-                    revision: credentialRevision,
-                  }),
-                );
-
-                return prepare({ _tag: "Created", subjectId }, journal);
-              }),
-            ),
-          { mode: "interactive" },
-        ).pipe(Effect.catchTag("IdentifierTaken", () => suppress));
-
-        return committed.value;
-      }).pipe(
-        Effect.provideService(LifecycleHooks, hooks),
-        Effect.provideService(Crypto.Crypto, crypto),
-        (work) => reportPersistenceFailure(work, Schema.is(PasswordUnavailable)),
-        Effect.mapError(() => PasswordUnavailable.make({})),
+                    verifierVersion,
+                  });
+
+                  return yield* store.prepare({ _tag: "Created", subjectId }, project);
+                }).pipe(Effect.provideService(Crypto.Crypto, crypto)),
+                store.prepare({ _tag: "Suppressed" }, project),
+              ),
+        ),
       ),
   };
 });

package/src/internal/session-native-authority.ts

@@ -0,0 +1,247 @@
+import { type LifecycleHooks } from "@yielded/auth/Hooks";
+import {
+  type AuthenticationAuthority,
+  StaleAuthentication,
+  PendingAuthenticationInvalid,
+  type AuthenticationEvidence,
+  type PendingConsumption,
+  type AuthenticationRequirement,
+} from "@yielded/auth/Sessions";
+import { DateTime, Effect, Option } from "effect";
+import type { SqlClient } from "effect/sql/SqlClient";
+
+import { sqlBatchAssertion } from "./d1-planning";
+import { PersistenceMappingError } from "./mapping-error";
+import type { AuthenticationAuthorityMapping } from "./models/session-model";
+import type { NativeSqlTables } from "./native-sql-table";
+import { makeNativeSessionPending, prepareNativeSession } from "./session-native-pending";
+import {
+  makeNativeSessionAuthorityState,
+  normalizeSessionOperation,
+  sessionUnavailable,
+  sameSessionRevision,
+  assessSessionAt,
+} from "./session-native-state";
+import { preservesRevision } from "./session-policy";
+import {
+  CurrentSqlCommit,
+  makeSqlCommitExecutor,
+  SqlBatchCommit,
+  registerSqlPostcondition,
+  registerSqlBatchPostcondition,
+  appendSqlBatchStatement,
+} from "./sql-commit";
+import type { AnyTableModel } from "./table-model";
+
+export type NativeAuthenticationAuthorityMapping<Claims> = AuthenticationAuthorityMapping<
+  Claims,
+  AnyTableModel,
+  AnyTableModel,
+  AnyTableModel,
+  unknown
+>;
+
+export const sessionEvidenceDeadline = Effect.fnUntraced(function* (
+  evidence: AuthenticationEvidence,
+  requirement: AuthenticationRequirement,
+  now: number,
+) {
+  const assessed = yield* assessSessionAt(evidence, requirement, now);
+
+  if (!assessed.satisfied) return yield* StaleAuthentication.make({});
+
+  const boundaries = [
+    ...new Set(
+      evidence.proofs.map(
+        (proof) => DateTime.toEpochMillis(proof.verifiedAt) + requirement.maximumAgeMillis,
+      ),
+    ),
+  ]
+    .filter((n) => n > now)
+    .sort((a, b) => a - b);
+
+  for (const boundary of boundaries) {
+    const after = yield* assessSessionAt(evidence, requirement, boundary).pipe(Effect.result);
+
+    if (after._tag === "Failure" || !after.success.satisfied)
+      return { assessed, validUntil: boundary };
+  }
+
+  return yield* StaleAuthentication.make({});
+});
+
+export const makeNativeAuthenticationAuthorityServices = Effect.fnUntraced(function* <Claims>(
+  tables: NativeSqlTables,
+  mapping: NativeAuthenticationAuthorityMapping<Claims>,
+): Effect.fn.Return<
+  { readonly authenticationAuthority: AuthenticationAuthority["Service"] },
+  never,
+  SqlClient | LifecycleHooks | SqlBatchCommit
+> {
+  const batch = yield* SqlBatchCommit;
+
+  const state = yield* makeNativeSessionAuthorityState(tables, mapping, batch !== undefined);
+  const executor = yield* makeSqlCommitExecutor(sessionUnavailable);
+  const external = yield* Effect.serviceOption(CurrentSqlCommit);
+
+  const pending =
+    mapping.pending === undefined
+      ? undefined
+      : yield* makeNativeSessionPending(
+          tables,
+          { ...mapping, ...mapping.pending },
+          batch !== undefined,
+        );
+
+  const { sql, now } = state;
+
+  const readEvidence = Effect.fnUntraced(function* (
+    evidence: AuthenticationEvidence,
+    locking: boolean,
+  ) {
+    const current = yield* state.read(evidence.revision.subjectId, locking);
+
+    return current !== undefined && sameSessionRevision(current.revision, evidence.revision)
+      ? current
+      : undefined;
+  });
+
+  const consume = Effect.fnUntraced(function* (
+    input: PendingConsumption,
+    evidence: AuthenticationEvidence,
+    native: unknown,
+  ) {
+    if (pending === undefined || mapping.pending === undefined)
+      return yield* PendingAuthenticationInvalid.make({});
+    const found = yield* pending.read("Login", input.digest);
+
+    if (
+      found === undefined ||
+      found.record.version !== input.version ||
+      found.record.flowId !== input.flowId ||
+      found.record.bindingDigest !== input.bindingDigest ||
+      found.record.subjectId !== evidence.revision.subjectId
+    )
+      return yield* PendingAuthenticationInvalid.make({});
+    const original = yield* mapping.pending.login.decode(found.record.snapshot);
+
+    if (
+      original.digest !== input.digest ||
+      original.version !== input.version ||
+      !preservesRevision(evidence, original.evidence) ||
+      DateTime.toEpochMillis(original.expiresAt) !== found.record.expiresAtMillis ||
+      original.attemptLimit !== found.record.attemptLimit
+    )
+      return yield* PendingAuthenticationInvalid.make({});
+    yield* pending.consume("Login", input, native);
+
+    return found.record.expiresAtMillis;
+  });
+
+  const native = <A, E, R>(work: Effect.Effect<A, E, R>) =>
+    batch === undefined
+      ? executor.operation(normalizeSessionOperation(work))
+      : executor
+          .operationBatch(normalizeSessionOperation(work))
+          .pipe(Effect.provideService(SqlBatchCommit, batch));
+
+  const authenticationAuthority: AuthenticationAuthority["Service"] = {
+    capture: (subjectId, credentialIds) =>
+      executor
+        .read(state.read(subjectId))
+        .pipe(
+          Effect.flatMap((current) =>
+            current === undefined ||
+            new Set(credentialIds).size !== credentialIds.length ||
+            credentialIds.some(
+              (id) => !current.revision.credentials.some((f) => f.credentialId === id),
+            )
+              ? Effect.fail(StaleAuthentication.make({}))
+              : Effect.succeed({ revision: current.revision, requirement: current.requirement }),
+          ),
+        ),
+    requirements: (evidence) =>
+      executor
+        .read(readEvidence(evidence, false))
+        .pipe(
+          Effect.flatMap((current) =>
+            current === undefined
+              ? Effect.fail(StaleAuthentication.make({}))
+              : Effect.succeed(current.requirement),
+          ),
+        ),
+    approve: (input, project) =>
+      native(
+        Effect.gen(function* () {
+          const current = yield* readEvidence(input.evidence, true);
+
+          if (current === undefined) return yield* StaleAuthentication.make({});
+
+          const assessment = yield* sessionEvidenceDeadline(
+            input.evidence,
+            current.requirement,
+            current.now,
+          );
+
+          const expires = DateTime.toEpochMillis(input.expiresAt),
+            absolute = DateTime.toEpochMillis(input.absoluteExpiresAt);
+
+          if (current.now >= expires || expires > absolute)
+            return yield* StaleAuthentication.make({});
+
+          const pendingExpiry =
+            input.pending === undefined
+              ? undefined
+              : yield* consume(input.pending, input.evidence, current.native);
+
+          const deadline = Math.min(assessment.validUntil, expires, pendingExpiry ?? Infinity);
+          const condition = sql`${state.authorityCondition(current.revision, current.native)} and ${state.policyCondition(current.row, current.native)} and ${now} >= ${current.now} and ${now} < ${deadline}`;
+
+          if (batch !== undefined) {
+            yield* appendSqlBatchStatement(sqlBatchAssertion(sql, condition));
+            yield* registerSqlBatchPostcondition({
+              name: "signed-session-issuance-authority",
+              statement: sqlBatchAssertion(
+                sql,
+                input.pending === undefined || pending === undefined
+                  ? condition
+                  : sql`${condition} and ${pending.consumedCondition("Login", input.pending, current.native)}`,
+              ),
+            });
+          } else if (Option.isSome(external)) {
+            yield* registerSqlPostcondition({
+              name: "signed-session-issuance-authority",
+              check: Effect.gen(function* () {
+                const final = yield* readEvidence(input.evidence, false);
+
+                if (final === undefined || final.now < current.now || final.now >= deadline)
+                  return yield* StaleAuthentication.make({});
+                yield* sessionEvidenceDeadline(input.evidence, final.requirement, final.now);
+                if (input.pending !== undefined && pending !== undefined) {
+                  const rows =
+                    yield* sql`select 1 where ${pending.consumedCondition("Login", input.pending, current.native)}`;
+
+                  if (rows.length !== 1) return yield* PendingAuthenticationInvalid.make({});
+                }
+              }).pipe(
+                Effect.mapError((cause) =>
+                  PersistenceMappingError.make({ operation: "decode", cause }),
+                ),
+              ),
+            });
+          } else {
+            // A signed credential has no session INSERT that can enforce the
+            // original evidence deadline. Check that deadline at this owner.
+            const rows =
+              yield* sql`select 1 where ${now} >= ${current.now} and ${now} < ${deadline}`;
+
+            if (rows.length !== 1) return yield* StaleAuthentication.make({});
+          }
+
+          return yield* prepareNativeSession(undefined, project);
+        }),
+      ),
+  };
+
+  return { authenticationAuthority };
+});

package/src/internal/session-native-cleanup.ts

@@ -0,0 +1,65 @@
+import type { LifecycleHooks } from "@yielded/auth/Hooks";
+import type { SessionCleanup } from "@yielded/auth/Sessions";
+import { Effect } from "effect";
+import { SqlClient } from "effect/sql/SqlClient";
+
+import type { SessionCleanupMapping } from "./models/session-model";
+import type { NativeSqlTables } from "./native-sql-table";
+import { sessionUnavailable } from "./session-native-state";
+import { exactSqlText } from "./sql-change";
+import { cleanupSqlRows, type SqlCleanupTable } from "./sql-cleanup";
+import { makeSqlCommitExecutor, SqlBatchCommit } from "./sql-commit";
+import type { AnyTableModel } from "./table-model";
+
+export const makeNativeSessionCleanupServices = Effect.fnUntraced(function* (
+  tables: NativeSqlTables,
+  mapping: SessionCleanupMapping<AnyTableModel, AnyTableModel, unknown, unknown>,
+): Effect.fn.Return<
+  { readonly sessionCleanup: SessionCleanup },
+  never,
+  SqlClient | LifecycleHooks | SqlBatchCommit
+> {
+  const batch = yield* SqlBatchCommit;
+
+  const sql = (yield* SqlClient).withoutTransforms();
+  const executor = yield* makeSqlCommitExecutor(sessionUnavailable);
+  const now = tables.expression(mapping.clock.engineNowMillis);
+  const candidates: SqlCleanupTable[] = [];
+
+  if (mapping.pending !== undefined) {
+    const p = mapping.pending,
+      table = tables(p.table);
+
+    candidates.push({
+      table,
+      keys: [p.digest],
+      due: sql`${exactSqlText(sql, table.column(p.moduleId), table.value(p.moduleId, mapping.moduleId))} and ${tables.expression(mapping.clock.toMillis(table.column(p.expiresAt)))} <= ${now}`,
+      order: [table.column(p.expiresAt), table.column(p.digest)],
+    });
+  }
+  if (mapping.tombstone !== undefined) {
+    const t = mapping.tombstone,
+      table = tables(t.table);
+
+    candidates.push({
+      table,
+      keys: [t.moduleId, t.subjectId, t.sessionId],
+      due: sql`${exactSqlText(sql, table.column(t.moduleId), table.value(t.moduleId, mapping.moduleId))} and ${tables.expression(mapping.clock.toMillis(table.column(t.absoluteExpiresAt)))} <= ${now}`,
+      order: [table.column(t.absoluteExpiresAt), table.column(t.sessionId)],
+    });
+  }
+
+  return {
+    sessionCleanup: {
+      cleanup: ({ limit }) => {
+        if (candidates.length === 0)
+          return executor.read(Effect.succeed({ removed: 0, hasMore: false }));
+        const work = cleanupSqlRows(candidates, limit, batch !== undefined);
+
+        return batch === undefined
+          ? executor.run(work, candidates.length > 1 ? "transaction" : "statement")
+          : executor.batch(work).pipe(Effect.provideService(SqlBatchCommit, batch));
+      },
+    },
+  };
+});