@yielded/auth-persistence 0.1.0-beta.25 → 0.1.0-beta.26

package/src/internal/session-native-step-up.ts

@@ -0,0 +1,450 @@
+import type { LifecycleHooks } from "@yielded/auth/Hooks";
+import { AuthenticationAssurance } from "@yielded/auth/Operations";
+import {
+  SessionConflict,
+  SessionStepUpInvalid,
+  StaleAuthentication,
+  SessionMetadata,
+  type SessionStepUpPersistence,
+  type SessionStepUpIntent,
+  type StatefulSessionRecord,
+} from "@yielded/auth/Sessions";
+import { DateTime, Effect, Option, Schema } from "effect";
+import type { SqlClient } from "effect/sql/SqlClient";
+import type { Fragment } from "effect/sql/Statement";
+
+import { sqlBatchAssertion } from "./d1-planning";
+import { PersistenceMappingError, isMappedConstraintConflict } from "./mapping-error";
+import type { SessionStepUpMapping } from "./models/step-up-model";
+import type { NativeSqlTables } from "./native-sql-table";
+import { sessionEvidenceDeadline } from "./session-native-authority";
+import { prepareNativeSession, type StoredSessionPending } from "./session-native-pending";
+import { makeNativeSessionPendingReader } from "./session-native-pending-read";
+import {
+  makeNativeSessionRecords,
+  sameSessionRecord,
+  makeConditionalSqlInsert,
+} from "./session-native-record";
+import {
+  sameSessionRevision,
+  normalizeSessionOperation,
+  sessionInvariant,
+  sessionUnavailable,
+} from "./session-native-state";
+import { allocateSessionValue } from "./session-policy";
+import {
+  CurrentSqlCommit,
+  makeSqlCommitExecutor,
+  SqlBatchCommit,
+  registerSqlPostcondition,
+  registerSqlBatchPostcondition,
+} from "./sql-commit";
+import {
+  encodeStepUpIntent,
+  decodeStepUpIntent,
+  stepUpIntentLive,
+  validateStepUpPlan,
+} from "./step-up-state";
+import type { AnyTableModel } from "./table-model";
+
+export type NativeSessionStepUpMapping<Claims> = SessionStepUpMapping<
+  Claims,
+  AnyTableModel,
+  AnyTableModel,
+  AnyTableModel,
+  AnyTableModel,
+  AnyTableModel,
+  unknown,
+  unknown
+>;
+
+const assuranceJson = Schema.encodeSync(Schema.fromJsonString(SessionMetadata.fields.assurance));
+
+export const makeNativeSessionStepUpServices = Effect.fnUntraced(function* <Claims>(
+  tables: NativeSqlTables,
+  mapping: NativeSessionStepUpMapping<Claims>,
+): Effect.fn.Return<
+  { readonly sessionStepUpPersistence: SessionStepUpPersistence<Claims> },
+  never,
+  SqlClient | LifecycleHooks | SqlBatchCommit
+> {
+  const batch = yield* SqlBatchCommit;
+
+  const {
+    state,
+    pending,
+    read: readPending,
+  } = yield* makeNativeSessionPendingReader(tables, mapping, batch !== undefined);
+
+  const conditionalInsert = yield* makeConditionalSqlInsert();
+
+  const records =
+    mapping.source.kind === "Stateful"
+      ? yield* makeNativeSessionRecords(tables, { ...mapping, ...mapping.source })
+      : undefined;
+
+  const executor = yield* makeSqlCommitExecutor(sessionUnavailable),
+    external = yield* Effect.serviceOption(CurrentSqlCommit);
+
+  const { sql, now } = state;
+
+  const native = <A, E, R>(
+    work: Effect.Effect<A, E, R>,
+    mode: "transaction" | "statement" = "transaction",
+  ) =>
+    batch === undefined
+      ? executor.operation(normalizeSessionOperation(work), mode)
+      : executor
+          .operationBatch(normalizeSessionOperation(work))
+          .pipe(Effect.provideService(SqlBatchCommit, batch));
+
+  const decode = Effect.fnUntraced(function* (stored: StoredSessionPending) {
+    const intent = yield* decodeStepUpIntent(stored.snapshot);
+
+    sessionInvariant(
+      intent.digest === stored.digest &&
+        intent.version === stored.version &&
+        intent.flowId === stored.flowId &&
+        intent.bindingDigest === stored.bindingDigest &&
+        intent.revision.subjectId === stored.subjectId &&
+        DateTime.toEpochMillis(intent.expiresAt) === stored.expiresAtMillis &&
+        intent.attemptLimit === stored.attemptLimit,
+    );
+
+    return intent;
+  });
+
+  const source = Effect.fnUntraced(function* (
+    intent: Omit<SessionStepUpIntent, "version">,
+    instant: number,
+  ) {
+    if (!stepUpIntentLive(intent, mapping.source.kind, DateTime.makeUnsafe(instant)))
+      return undefined;
+    const subject = yield* mapping.subjectId.toNative(intent.revision.subjectId);
+
+    if (mapping.source.kind === "Stateful") {
+      sessionInvariant(records !== undefined);
+
+      const nativeSession = yield* mapping.source.sessionId.toNative(intent.sourceSessionId),
+        { s, table } = records;
+
+      const rows =
+        yield* sql`select ${table.fields("source_")} from ${table.name} where ${state.id(table, s.subjectId, subject)} and ${state.id(table, s.sessionId, nativeSession)} and ${records.live(table)} limit 2`;
+
+      sessionInvariant(rows.length <= 1);
+      if (rows[0] === undefined) return undefined;
+      const record = yield* records.decode(table.decode(rows[0], "source_"));
+
+      if (
+        record.credentialVersion !== intent.sourceCredentialVersion ||
+        record.subjectId !== intent.revision.subjectId ||
+        record.sessionId !== intent.sourceSessionId ||
+        record.securityRevision !== intent.revision.securityRevision ||
+        DateTime.toEpochMillis(record.assurance.authenticatedAt) !==
+          DateTime.toEpochMillis(intent.sourceAuthenticatedAt) ||
+        DateTime.toEpochMillis(record.expiresAt) !==
+          DateTime.toEpochMillis(intent.sourceExpiresAt) ||
+        DateTime.toEpochMillis(record.absoluteExpiresAt) !==
+          DateTime.toEpochMillis(intent.sourceAbsoluteExpiresAt)
+      )
+        return undefined;
+
+      return {
+        record,
+        condition: sql`exists(select 1 from ${table.name} where ${yield* records.owner(record)} and ${records.live(table)})`,
+      };
+    }
+    if (mapping.source.kind === "StateAssistedSigned") {
+      const t = mapping.source.tombstone,
+        table = tables(t.table),
+        session = yield* mapping.source.sessionId.toNative(intent.sourceSessionId);
+
+      const condition = sql`not exists(select 1 from ${table.name} where ${state.exact(table, t.moduleId, mapping.moduleId)} and ${state.id(table, t.subjectId, subject)} and ${state.id(table, t.sessionId, session)})`;
+
+      if ((yield* sql`select 1 where ${condition}`).length !== 1) return undefined;
+
+      return { record: undefined, condition };
+    }
+
+    return { record: undefined, condition: sql`1 = 1` };
+  });
+
+  const final = Effect.fnUntraced(function* (name: string, condition: Fragment) {
+    if (batch !== undefined)
+      yield* registerSqlBatchPostcondition({ name, statement: sqlBatchAssertion(sql, condition) });
+    else if (Option.isSome(external))
+      yield* registerSqlPostcondition({
+        name,
+        check: Effect.gen(function* () {
+          sessionInvariant((yield* sql`select 1 where ${condition}`).length === 1);
+        }).pipe(
+          Effect.mapError((cause) => PersistenceMappingError.make({ operation: "decode", cause })),
+        ),
+      });
+  });
+
+  const snapshotCondition = (intent: SessionStepUpIntent, snapshot: string) =>
+    sql.and([
+      state.exact(pending.table, pending.p.snapshot, snapshot),
+      sql`${tables.expression(mapping.clock.toMillis(pending.table.column(pending.p.expiresAt)))} = ${DateTime.toEpochMillis(intent.expiresAt)}`,
+      sql`${pending.table.column(pending.p.attemptLimit)} = ${pending.table.value(pending.p.attemptLimit, intent.attemptLimit)}`,
+    ]);
+
+  const sessionStepUpPersistence: SessionStepUpPersistence<Claims> = {
+    create: (input, _now, project) =>
+      native(
+        Effect.gen(function* () {
+          const current = yield* state.read(input.revision.subjectId, true);
+
+          if (current === undefined || !sameSessionRevision(current.revision, input.revision))
+            return yield* StaleAuthentication.make({});
+          const original = yield* source(input, current.now);
+
+          if (original === undefined) return yield* StaleAuthentication.make({});
+
+          const version = yield* allocateSessionValue(
+            "interactive",
+            mapping.pending.allocateVersion,
+            mapping.pending.allocateVersionSync,
+          );
+
+          const intent = { ...input, version },
+            snapshot = yield* encodeStepUpIntent(intent);
+
+          const condition = sql`${state.authorityCondition(intent.revision, current.native)} and ${state.policyCondition(current.row, current.native)} and ${original.condition} and ${now} >= ${DateTime.toEpochMillis(intent.sourceAuthenticatedAt)} and ${now} < ${DateTime.toEpochMillis(intent.expiresAt)}`;
+
+          yield* pending
+            .insert(
+              {
+                moduleId: mapping.moduleId,
+                kind: "StepUp",
+                digest: intent.digest,
+                version,
+                flowId: intent.flowId,
+                subjectId: current.native,
+                bindingDigest: intent.bindingDigest,
+                snapshot,
+                expiresAt: intent.expiresAt,
+                attemptLimit: intent.attemptLimit,
+              },
+              condition,
+            )
+            .pipe(
+              Effect.mapError((error) =>
+                isMappedConstraintConflict(mapping.isConstraintConflict, error)
+                  ? SessionConflict.make({})
+                  : error,
+              ),
+            );
+          yield* final(
+            "session-step-up-issuance",
+            sql`${condition} and exists(select 1 from ${pending.table.name} where ${pending.predicate(pending.table, "StepUp", intent.digest)} and ${state.exact(pending.table, pending.p.version, version)} and ${snapshotCondition(intent, snapshot)})`,
+          );
+
+          return yield* prepareNativeSession(intent, project);
+        }),
+      ),
+    read: ({ digest }) =>
+      executor
+        .read(
+          Effect.gen(function* () {
+            const selected = yield* readPending("StepUp", digest);
+
+            if (selected === undefined) return undefined;
+
+            const intent = yield* decode(selected.record),
+              current = selected.authority;
+
+            if (
+              !sameSessionRevision(current.revision, intent.revision) ||
+              !stepUpIntentLive(intent, mapping.source.kind, DateTime.makeUnsafe(current.now))
+            )
+              return undefined;
+
+            // The detached source stays original. Its live digest and metadata
+            // are rechecked by complete before any replacement is committed.
+            return { intent, requirement: current.requirement };
+          }),
+        )
+        .pipe(
+          Effect.flatMap((value) =>
+            value === undefined
+              ? Effect.fail(SessionStepUpInvalid.make({}))
+              : Effect.succeed(value),
+          ),
+        ),
+    reject: ({ digest }, project) =>
+      native(
+        Effect.gen(function* () {
+          yield* pending.reject("StepUp", digest);
+
+          return yield* prepareNativeSession({ _tag: "Rejected" } as const, project);
+        }),
+        "statement",
+      ),
+    complete: (plan, project) =>
+      native(
+        Effect.gen(function* () {
+          yield* validateStepUpPlan(plan);
+          const { intent, evidence, replacement } = plan;
+          const current = yield* state.read(intent.revision.subjectId, true);
+
+          if (
+            current === undefined ||
+            !sameSessionRevision(current.revision, evidence.revision) ||
+            !sameSessionRevision(current.revision, intent.revision)
+          )
+            return yield* StaleAuthentication.make({});
+          const original = yield* source(intent, current.now);
+
+          if (original === undefined) return yield* SessionStepUpInvalid.make({});
+          if (plan.source.guard._tag === "Stateful") {
+            if (
+              original.record === undefined ||
+              original.record.digest !== plan.source.guard.digest ||
+              !sameSessionRecord(original.record, {
+                ...plan.source.inspection.session,
+                provenance: plan.source.inspection.provenance,
+                credentialVersion: plan.source.inspection.credentialVersion,
+                digest: plan.source.guard.digest,
+              })
+            )
+              return yield* SessionStepUpInvalid.make({});
+          }
+
+          const base = yield* sessionEvidenceDeadline(evidence, current.requirement, current.now),
+            profile = yield* sessionEvidenceDeadline(evidence, intent.requirement, current.now);
+
+          if (
+            assuranceJson(
+              AuthenticationAssurance.make({
+                ...base.assessed.assurance,
+                authenticatedAt: profile.assessed.assurance.authenticatedAt,
+              }),
+            ) !== assuranceJson(replacement.inspection.session.assurance)
+          )
+            return yield* SessionStepUpInvalid.make({});
+
+          const deadline = Math.min(
+            base.validUntil,
+            profile.validUntil,
+            DateTime.toEpochMillis(intent.expiresAt),
+            DateTime.toEpochMillis(replacement.inspection.session.expiresAt),
+          );
+
+          if (
+            current.now >= deadline ||
+            DateTime.toEpochMillis(replacement.inspection.session.issuedAt) > current.now ||
+            DateTime.toEpochMillis(replacement.inspection.session.expiresAt) >
+              DateTime.toEpochMillis(intent.sourceAbsoluteExpiresAt)
+          )
+            return yield* SessionStepUpInvalid.make({});
+          const snapshot = yield* encodeStepUpIntent(intent);
+          const authority = sql`${state.authorityCondition(evidence.revision, current.native)} and ${state.policyCondition(current.row, current.native)} and ${now} >= ${current.now} and ${now} < ${deadline}`;
+
+          yield* pending.consume(
+            "StepUp",
+            intent,
+            current.native,
+            sql`${snapshotCondition(intent, snapshot)} and ${authority} and ${original.condition}`,
+          );
+          let replacementCondition: Fragment = sql`1 = 1`;
+          let replacementRecord: StatefulSessionRecord<Claims> | undefined;
+
+          if (replacement._tag === "Stateful" && mapping.source.kind === "Stateful") {
+            sessionInvariant(records !== undefined && original.record !== undefined);
+
+            const next: StatefulSessionRecord<Claims> = {
+              ...replacement.inspection.session,
+              digest: replacement.nextDigest,
+              credentialVersion: replacement.inspection.credentialVersion,
+              provenance: replacement.inspection.provenance,
+            };
+
+            if (
+              next.digest === original.record.digest ||
+              next.credentialVersion === original.record.credentialVersion
+            )
+              return yield* SessionStepUpInvalid.make({});
+            const { s, table } = records;
+
+            const values = {
+              ...s.encodeRotation(next),
+              [s.digest]: next.digest,
+              [s.issuedAt]: s.encodeInstant(next.issuedAt),
+              [s.expiresAt]: s.encodeInstant(next.expiresAt),
+              [s.absoluteExpiresAt]: s.encodeInstant(next.absoluteExpiresAt),
+              [s.securityRevision]: next.securityRevision,
+            };
+
+            yield* pending.stage(
+              sql`${table.update(values)} where ${yield* records.owner(original.record)} and ${records.live(table)} and ${authority}`,
+              1,
+            );
+            replacementCondition = sql`exists(select 1 from ${table.name} where ${yield* records.owner(next)} and ${records.encodedCondition(values)} and ${records.live(table)})`;
+            replacementRecord = next;
+          } else if (
+            replacement._tag === "StateAssistedSigned" &&
+            mapping.source.kind === "StateAssistedSigned"
+          ) {
+            const t = mapping.source.tombstone,
+              table = tables(t.table),
+              session = yield* mapping.source.sessionId.toNative(intent.sourceSessionId);
+
+            const values = {
+              ...t.encodeInsert({
+                moduleId: mapping.moduleId,
+                subjectId: current.native,
+                sessionId: session,
+                absoluteExpiresAt: intent.sourceAbsoluteExpiresAt,
+              }),
+              [t.moduleId]: mapping.moduleId,
+              [t.subjectId]: current.native,
+              [t.sessionId]: session,
+              [t.absoluteExpiresAt]: t.encodeInstant(intent.sourceAbsoluteExpiresAt),
+            };
+
+            yield* pending.stage(
+              conditionalInsert(table, values, sql`${authority} and ${original.condition}`),
+              1,
+            );
+            replacementCondition = sql`exists(select 1 from ${table.name} where ${state.exact(table, t.moduleId, mapping.moduleId)} and ${state.id(table, t.subjectId, current.native)} and ${state.id(table, t.sessionId, session)} and ${tables.expression(mapping.clock.toMillis(table.column(t.absoluteExpiresAt)))} >= ${DateTime.toEpochMillis(intent.sourceAbsoluteExpiresAt)})`;
+          } else if (
+            replacement._tag !== "StatelessSigned" ||
+            mapping.source.kind !== "StatelessSigned"
+          )
+            return yield* SessionStepUpInvalid.make({});
+          yield* final(
+            "session-step-up-completion",
+            sql`${authority} and ${pending.consumedCondition("StepUp", intent, current.native)} and ${replacementCondition}`,
+          );
+          if (batch === undefined && Option.isSome(external))
+            yield* registerSqlPostcondition({
+              name: "session-step-up-current-policy",
+              check: Effect.gen(function* () {
+                const actual = yield* state.read(intent.revision.subjectId);
+
+                sessionInvariant(
+                  actual !== undefined && sameSessionRevision(actual.revision, evidence.revision),
+                );
+                yield* sessionEvidenceDeadline(evidence, actual.requirement, actual.now);
+                yield* sessionEvidenceDeadline(evidence, intent.requirement, actual.now);
+                if (replacementRecord !== undefined && records !== undefined) {
+                  const row = yield* records.read(replacementRecord.digest);
+
+                  sessionInvariant(row !== undefined && sameSessionRecord(row, replacementRecord));
+                }
+              }).pipe(
+                Effect.mapError((cause) =>
+                  PersistenceMappingError.make({ operation: "decode", cause }),
+                ),
+              ),
+            });
+
+          return yield* prepareNativeSession(replacement.inspection, project);
+        }),
+      ),
+  };
+
+  return { sessionStepUpPersistence };
+});

package/src/internal/session-native-validity.ts

@@ -0,0 +1,208 @@
+import type { LifecycleHooks } from "@yielded/auth/Hooks";
+import {
+  SessionInvalid,
+  StaleAuthentication,
+  type SignedSessionValidity,
+} from "@yielded/auth/Sessions";
+import { DateTime, Effect, Option } from "effect";
+import { SqlClient } from "effect/sql/SqlClient";
+import type { Fragment } from "effect/sql/Statement";
+
+import { sqlBatchAssertion } from "./d1-planning";
+import { PersistenceMappingError } from "./mapping-error";
+import type { SignedSessionValidityMapping } from "./models/session-model";
+import type { NativeSqlTables, SqlTable } from "./native-sql-table";
+import { prepareNativeSession } from "./session-native-pending";
+import {
+  normalizeSessionOperation,
+  sessionInvariant,
+  sessionUnavailable,
+} from "./session-native-state";
+import { allocateSessionValue } from "./session-policy";
+import { exactSqlText, executeSqlChange } from "./sql-change";
+import {
+  CurrentSqlCommit,
+  makeSqlCommitExecutor,
+  SqlBatchCommit,
+  appendSqlBatchStatement,
+  registerSqlBatchPostcondition,
+  registerSqlPostcondition,
+} from "./sql-commit";
+import type { AnyTableModel } from "./table-model";
+
+export type NativeSignedSessionValidityMapping = SignedSessionValidityMapping<
+  AnyTableModel,
+  AnyTableModel,
+  unknown,
+  unknown
+>;
+
+export const makeNativeSignedSessionValidityServices = Effect.fnUntraced(function* (
+  tables: NativeSqlTables,
+  mapping: NativeSignedSessionValidityMapping,
+): Effect.fn.Return<
+  { readonly signedSessionValidity: SignedSessionValidity },
+  never,
+  SqlClient | LifecycleHooks | SqlBatchCommit
+> {
+  const batch = yield* SqlBatchCommit;
+
+  const sql = (yield* SqlClient).withoutTransforms(),
+    executor = yield* makeSqlCommitExecutor(sessionUnavailable);
+
+  const external = yield* Effect.serviceOption(CurrentSqlCommit);
+
+  const s = mapping.subject,
+    t = mapping.tombstone,
+    subject = tables(s.table),
+    tombstone = tables(t.table),
+    now = tables.expression(mapping.clock.engineNowMillis);
+
+  const id = (table: SqlTable, key: string, value: unknown) =>
+    sql`${table.column(key)} = ${table.value(key, value)}`;
+
+  const exact = (table: SqlTable, key: string, value: unknown) =>
+    exactSqlText(sql, table.column(key), table.value(key, value));
+
+  const key = (nativeSubject: unknown, nativeSession: unknown) =>
+    sql.and([
+      exact(tombstone, t.moduleId, mapping.moduleId),
+      id(tombstone, t.subjectId, nativeSubject),
+      id(tombstone, t.sessionId, nativeSession),
+    ]);
+
+  const native = <A, E, R>(work: Effect.Effect<A, E, R>) =>
+    batch === undefined
+      ? executor.operation(normalizeSessionOperation(work), "statement")
+      : executor
+          .operationBatch(normalizeSessionOperation(work))
+          .pipe(Effect.provideService(SqlBatchCommit, batch));
+
+  const stage = Effect.fnUntraced(function* (statement: Fragment, expected?: number) {
+    if (batch !== undefined) {
+      yield* appendSqlBatchStatement(sql`${statement}`);
+      if (expected !== undefined)
+        yield* appendSqlBatchStatement(sqlBatchAssertion(sql, sql`changes() = ${expected}`));
+
+      return expected;
+    }
+
+    return yield* executeSqlChange(sql, statement);
+  });
+
+  const final = Effect.fnUntraced(function* (name: string, condition: Fragment) {
+    if (batch !== undefined)
+      yield* registerSqlBatchPostcondition({ name, statement: sqlBatchAssertion(sql, condition) });
+    else if (Option.isSome(external))
+      yield* registerSqlPostcondition({
+        name,
+        check: Effect.gen(function* () {
+          sessionInvariant((yield* sql`select 1 where ${condition}`).length === 1);
+        }).pipe(
+          Effect.mapError((cause) => PersistenceMappingError.make({ operation: "decode", cause })),
+        ),
+      });
+  });
+
+  const signedSessionValidity: SignedSessionValidity = {
+    verify: (record) =>
+      executor
+        .verify(
+          Effect.gen(function* () {
+            const nativeSubject = yield* mapping.subjectId.toNative(record.subjectId),
+              nativeSession = yield* mapping.sessionId.toNative(record.sessionId);
+
+            const rows =
+              yield* sql`select ${subject.fields("subject_")} from ${subject.name} where ${id(subject, s.id, nativeSubject)} and ${id(subject, s.status, s.activeStatusValue)} and ${exact(subject, s.securityRevision, record.securityRevision)} and ${now} >= ${DateTime.toEpochMillis(record.issuedAt)} and ${now} < ${DateTime.toEpochMillis(record.expiresAt)} and ${DateTime.toEpochMillis(record.expiresAt)} <= ${DateTime.toEpochMillis(record.absoluteExpiresAt)} and not exists(select 1 from ${tombstone.name} where ${key(nativeSubject, nativeSession)}) limit 2`;
+
+            sessionInvariant(rows.length <= 1);
+            if (rows[0] === undefined) return false;
+            const decoded = subject.decode(rows[0], "subject_");
+
+            sessionInvariant(
+              (yield* mapping.subjectId.toSubject(decoded[s.id])) === record.subjectId &&
+                s.isActiveStatus(decoded[s.status]),
+            );
+
+            return true;
+          }),
+        )
+        .pipe(
+          Effect.flatMap((valid) => (valid ? Effect.void : Effect.fail(SessionInvalid.make({})))),
+        ),
+    revoke: (input, project) =>
+      native(
+        Effect.gen(function* () {
+          const nativeSubject = yield* mapping.subjectId.toNative(input.subjectId),
+            nativeSession = yield* mapping.sessionId.toNative(input.sessionId);
+
+          const row = {
+            ...t.encodeInsert({
+              moduleId: mapping.moduleId,
+              subjectId: nativeSubject,
+              sessionId: nativeSession,
+              absoluteExpiresAt: input.absoluteExpiresAt,
+            }),
+            [t.moduleId]: mapping.moduleId,
+            [t.subjectId]: nativeSubject,
+            [t.sessionId]: nativeSession,
+            [t.absoluteExpiresAt]: t.encodeInstant(input.absoluteExpiresAt),
+          };
+
+          const expiry = tables.expression(
+            mapping.clock.toMillis(tombstone.column(t.absoluteExpiresAt)),
+          );
+
+          const next = DateTime.toEpochMillis(input.absoluteExpiresAt);
+          const longest = sql`case when ${expiry} >= ${next} then ${tombstone.column(t.absoluteExpiresAt)} else ${tombstone.value(t.absoluteExpiresAt, row[t.absoluteExpiresAt])} end`;
+          const insert = tombstone.insert(row);
+
+          const statement = sql.onDialectOrElse({
+            mysql: () =>
+              sql`${insert} on duplicate key update ${tombstone.columnName(t.absoluteExpiresAt)} = ${longest}`,
+            orElse: () =>
+              sql`${insert} on conflict (${tombstone.columnName(t.moduleId)}, ${tombstone.columnName(t.subjectId)}, ${tombstone.columnName(t.sessionId)}) do update set ${tombstone.columnName(t.absoluteExpiresAt)} = ${longest}`,
+          });
+
+          yield* stage(statement);
+          yield* final(
+            "assisted-session-revocation",
+            sql`exists(select 1 from ${tombstone.name} where ${key(nativeSubject, nativeSession)} and ${expiry} >= ${next})`,
+          );
+
+          return yield* prepareNativeSession(undefined, project);
+        }),
+      ),
+    revokeAll: (input, project) =>
+      native(
+        Effect.gen(function* () {
+          const nativeSubject = yield* mapping.subjectId.toNative(input.subjectId);
+
+          const next = yield* allocateSessionValue(
+            "interactive",
+            s.nextSecurityRevision?.(input.expectedSecurityRevision),
+            s.nextSecurityRevisionSync === undefined
+              ? undefined
+              : () => s.nextSecurityRevisionSync!(input.expectedSecurityRevision),
+          );
+
+          sessionInvariant(next !== input.expectedSecurityRevision);
+
+          const changed = yield* stage(
+            sql`${subject.update({ [s.securityRevision]: next })} where ${id(subject, s.id, nativeSubject)} and ${id(subject, s.status, s.activeStatusValue)} and ${exact(subject, s.securityRevision, input.expectedSecurityRevision)}`,
+            1,
+          );
+
+          if (changed !== 1) return yield* StaleAuthentication.make({});
+          yield* final(
+            "all-assisted-session-revocation",
+            sql`exists(select 1 from ${subject.name} where ${id(subject, s.id, nativeSubject)} and ${exact(subject, s.securityRevision, next)})`,
+          );
+
+          return yield* prepareNativeSession(undefined, project);
+        }),
+      ),
+  };
+
+  return { signedSessionValidity };
+});