@yielded/auth-persistence 0.1.0-beta.25 → 0.1.0-beta.27

package/src/internal/oauth/native-flow.ts

@@ -0,0 +1,253 @@
+import type {
+  OAuthSealedTransaction,
+  OAuthSignInAccess,
+  OAuthSignInTransactionContext,
+} from "@yielded/auth/OAuth";
+import type { SubjectId } from "@yielded/auth/Schema";
+import { Effect, Option, Schema } from "effect";
+import { SqlClient } from "effect/sql";
+import { SqlError } from "effect/sql/SqlError";
+
+import { sqlBatchAssertion } from "../d1-planning";
+import type { SubjectIdCodec } from "../models/common";
+import type { OAuthClock, OAuthFlowTable } from "../models/oauth-model";
+import type { NativeSqlTables } from "../native-sql-table";
+import { exactSqlText, executeSqlChange } from "../sql-change";
+import { cleanupSqlRows } from "../sql-cleanup";
+import {
+  appendSqlBatchStatement,
+  CurrentSqlCommit,
+  registerSqlBatchPostcondition,
+  registerSqlPostcondition,
+} from "../sql-commit";
+import type { SqlExpression, TableModel } from "../table-model";
+import { invariant, storage } from "./state";
+
+type FlowContext = Omit<OAuthSignInTransactionContext, "namespace" | "returnTarget" | "access">;
+
+export interface OAuthFlowValue {
+  readonly context: FlowContext;
+  readonly sealed: OAuthSealedTransaction;
+}
+
+export interface OAuthNativeFlowMapping {
+  readonly flow: OAuthFlowTable<TableModel>;
+  // The physical adapter validates and compiles its expression representation.
+  readonly clock: OAuthClock<SqlExpression>;
+  readonly subjectId: SubjectIdCodec<unknown>;
+}
+
+/** One immutable row survives only until conditional consumption or expiry. */
+export const makeOAuthNativeFlow = Effect.fnUntraced(function* <Flow extends OAuthFlowValue>(
+  tables: NativeSqlTables,
+  mapping: OAuthNativeFlowMapping,
+  codec: Schema.Codec<Flow, unknown, never, never>,
+  purpose: "sign-in" | "link" | "connect",
+  subjectId: (flow: Flow) => SubjectId | undefined,
+  batch = false,
+) {
+  const boundOwner = yield* Effect.serviceOption(CurrentSqlCommit);
+  const sql = (yield* SqlClient.SqlClient).withoutTransforms();
+  const flow = tables(mapping.flow.table);
+  const f = mapping.flow;
+  const persisted = storage(codec);
+  const now = tables.expression(mapping.clock.engineNowMillis);
+  const mysql = sql.onDialectOrElse({ mysql: () => true, orElse: () => false });
+  const millis = (key: string) => tables.expression(mapping.clock.toMillis(flow.column(key)));
+
+  const exact = (key: string, input: unknown) =>
+    exactSqlText(sql, flow.column(key), flow.value(key, input));
+
+  const access = Effect.fnUntraced(function* (
+    input: OAuthSignInAccess & { readonly subjectId?: SubjectId },
+  ) {
+    const nativeId =
+      input.subjectId === undefined
+        ? undefined
+        : yield* mapping.subjectId.toNative(input.subjectId);
+
+    return sql.and([
+      exact(f.moduleId, input.moduleId),
+      exact(f.purpose, purpose),
+      exact(f.flowId, input.flowId),
+      sql`${flow.column(f.generation)} = ${flow.value(f.generation, input.generation)}`,
+      exact(f.provider, input.provider),
+      exact(f.callbackId, input.callbackId),
+      exact(f.stateDigest, input.stateDigest),
+      exact(f.binderVerifier, input.requestBindingVerifier),
+      sql`${flow.column(f.binderExpiresAt)} = ${flow.value(f.binderExpiresAt, mapping.clock.encodeInstant(input.requestBindingExpiresAtMillis))}`,
+      sql`${millis(f.binderExpiresAt)} > ${now}`,
+      sql`${millis(f.expiresAt)} > ${now}`,
+      sql`${millis(f.issuedAt)} <= ${now}`,
+      nativeId === undefined
+        ? sql`${flow.column(f.subjectId)} is null`
+        : sql`${flow.column(f.subjectId)} = ${flow.value(f.subjectId, nativeId)}`,
+      input.responseIssuer === undefined
+        ? exact(f.responseIssuerMode, "unsupported")
+        : sql.and([exact(f.responseIssuerMode, "required"), exact(f.issuer, input.responseIssuer)]),
+    ]);
+  });
+
+  const issue = Effect.fnUntraced(function* (value: Flow) {
+    const context = value.context;
+    const owner = subjectId(value);
+    const nativeId = owner === undefined ? null : yield* mapping.subjectId.toNative(owner);
+
+    if (
+      context.issuedAtMillis >= context.expiresAtMillis ||
+      context.expiresAtMillis > context.requestBindingExpiresAtMillis
+    )
+      return false;
+
+    const statement = sql`${flow.insert({
+      ...f.encodeInsert({ moduleId: context.moduleId, flowId: context.flowId, purpose }),
+      [f.moduleId]: context.moduleId,
+      [f.flowId]: context.flowId,
+      [f.purpose]: purpose,
+      [f.generation]: context.generation,
+      [f.provider]: context.provider,
+      [f.callbackId]: context.callbackId,
+      [f.issuer]: context.issuer,
+      [f.responseIssuerMode]: context.responseIssuerMode,
+      [f.subjectId]: nativeId,
+      [f.stateDigest]: context.stateDigest,
+      [f.binderVerifier]: context.requestBindingVerifier,
+      [f.binderExpiresAt]: mapping.clock.encodeInstant(context.requestBindingExpiresAtMillis),
+      [f.issuedAt]: mapping.clock.encodeInstant(context.issuedAtMillis),
+      [f.expiresAt]: mapping.clock.encodeInstant(context.expiresAtMillis),
+      [f.snapshot]: persisted.encode(value),
+    })} ${mysql ? sql`` : sql`on conflict do nothing`}`;
+
+    return yield* Effect.gen(function* () {
+      if (batch) {
+        const clock = yield* sql`select ${now} as engine_now`;
+        const engineNow = yield* Schema.decodeEffect(Schema.Int)(Number(clock[0]?.engine_now));
+
+        if (context.issuedAtMillis > engineNow || context.expiresAtMillis <= engineNow)
+          return false;
+        yield* appendSqlBatchStatement(
+          sqlBatchAssertion(
+            sql,
+            sql`${now} >= ${context.issuedAtMillis} and ${now} < ${context.expiresAtMillis}`,
+          ),
+        );
+        yield* appendSqlBatchStatement(statement);
+        yield* appendSqlBatchStatement(sqlBatchAssertion(sql, sql`changes() = 1`));
+
+        return true;
+      }
+
+      const rows = mysql
+        ? (yield* executeSqlChange(sql, statement)) === 1
+          ? yield* sql`select ${now} as engine_now`
+          : []
+        : yield* sql`${statement} returning ${now} as engine_now`;
+
+      if (rows.length === 0) return false;
+      invariant(rows.length === 1);
+      const engineNow = yield* Schema.decodeEffect(Schema.Int)(Number(rows[0]!.engine_now));
+
+      return context.issuedAtMillis <= engineNow && context.expiresAtMillis > engineNow;
+    }).pipe(
+      Effect.catchIf(
+        (error) => Schema.is(SqlError)(error) && error.reason._tag === "UniqueViolation",
+        () => Effect.succeed(false),
+      ),
+    );
+  });
+
+  const consume = Effect.fnUntraced(function* (
+    input: OAuthSignInAccess & { readonly subjectId?: SubjectId },
+  ) {
+    const predicate = yield* access(input);
+    const deletion = sql`delete from ${flow.name} where ${predicate}`;
+
+    // MySQL has no DELETE RETURNING. Its caller owns one transaction and this
+    // locking read; PostgreSQL and SQLite consume in one statement.
+    const rows = batch
+      ? yield* sql`select ${flow.fields("oauth_flow_")} from ${flow.name} where ${predicate}`
+      : mysql
+        ? yield* sql`select ${flow.fields("oauth_flow_")} from ${flow.name} where ${predicate} for update`
+        : yield* sql`${deletion} returning ${flow.fields("oauth_flow_")}`;
+
+    if (rows.length === 0) return undefined;
+    invariant(rows.length === 1);
+    const row = flow.decode(rows[0]!, "oauth_flow_");
+    const encoded = row[f.snapshot];
+
+    invariant(typeof encoded === "string");
+    const value = persisted.decode(encoded);
+    const context = value.context;
+
+    invariant(
+      context.moduleId === input.moduleId &&
+        context.flowId === input.flowId &&
+        context.generation === input.generation &&
+        context.provider === input.provider &&
+        context.callbackId === input.callbackId &&
+        context.stateDigest === input.stateDigest &&
+        context.requestBindingVerifier === input.requestBindingVerifier &&
+        context.requestBindingExpiresAtMillis === input.requestBindingExpiresAtMillis &&
+        context.issuedAtMillis === mapping.clock.decodeInstant(row[f.issuedAt]) &&
+        context.expiresAtMillis === mapping.clock.decodeInstant(row[f.expiresAt]) &&
+        subjectId(value) === input.subjectId &&
+        (input.responseIssuer === undefined
+          ? context.responseIssuerMode === "unsupported"
+          : context.responseIssuerMode === "required" && context.issuer === input.responseIssuer),
+    );
+
+    if (mysql) invariant((yield* executeSqlChange(sql, deletion)) === 1);
+
+    if (batch) {
+      // Planning reads convey no authority. The same access and exact immutable
+      // snapshot must still match inside the atomic primary-engine batch.
+      yield* appendSqlBatchStatement(sql`${deletion} and ${exact(f.snapshot, encoded)}`);
+      yield* appendSqlBatchStatement(sqlBatchAssertion(sql, sql`changes() = 1`));
+    }
+
+    if (Option.isSome(boundOwner) && boundOwner.value.mode === "transaction") {
+      // Bound application work may follow consumption. Confirm the exact key
+      // stays absent at the physical commit; unrelated/new flows remain valid.
+      yield* registerSqlPostcondition({
+        name: "oauth-consumed-flow-absent",
+        check: Effect.gen(function* () {
+          const restored = yield* sql`select 1 from ${flow.name}
+            where ${exact(f.moduleId, input.moduleId)} and ${exact(f.flowId, input.flowId)} limit 1`;
+
+          invariant(restored.length === 0);
+        }),
+      });
+    }
+
+    if (Option.isSome(boundOwner) && boundOwner.value.mode === "batch")
+      yield* registerSqlBatchPostcondition({
+        name: "oauth-consumed-flow-absent",
+        statement: sqlBatchAssertion(
+          sql,
+          sql`not exists(select 1 from ${flow.name} where ${exact(f.moduleId, input.moduleId)} and ${exact(f.flowId, input.flowId)})`,
+        ),
+      });
+
+    return value;
+  });
+
+  const cleanup = (moduleId: string, limit: number) =>
+    cleanupSqlRows(
+      [
+        {
+          table: flow,
+          keys: [f.moduleId, f.flowId],
+          due: sql.and([
+            exact(f.moduleId, moduleId),
+            exact(f.purpose, purpose),
+            sql`${millis(f.expiresAt)} <= ${now}`,
+          ]),
+          order: [flow.column(f.expiresAt), flow.column(f.flowId)],
+        },
+      ],
+      limit,
+      batch,
+    );
+
+  return { issue, consume, cleanup, mysql };
+});

package/src/internal/oauth/native-layers.ts

@@ -0,0 +1,83 @@
+import {
+  OAuthAccountsPersistence,
+  OAuthSignInPersistence,
+  OAuthRegistrationIntents,
+  OAuthConnectedPersistence,
+  OAuthConnectedRevocations,
+} from "@yielded/auth/OAuth";
+import { type Context, Effect, Layer } from "effect";
+
+import type { OAuthRegistrationAuthority } from "../models/oauth-model";
+
+export const oauthAccountsPersistenceLayer = <E, R>(
+  services: Effect.Effect<
+    { readonly oauthAccountsPersistence: OAuthAccountsPersistence["Service"] },
+    E,
+    R
+  >,
+) =>
+  Layer.effect(
+    OAuthAccountsPersistence,
+    Effect.map(services, (value) => value.oauthAccountsPersistence),
+  );
+
+export const oauthSignInPersistenceLayer = <E, R>(
+  services: Effect.Effect<
+    { readonly oauthSignInPersistence: OAuthSignInPersistence["Service"] },
+    E,
+    R
+  >,
+) =>
+  Layer.effect(
+    OAuthSignInPersistence,
+    Effect.map(services, (value) => value.oauthSignInPersistence),
+  );
+
+export const oauthRegistrationIntentsLayer = <E, R>(
+  services: Effect.Effect<
+    { readonly oauthRegistrationIntents: OAuthRegistrationIntents["Service"] },
+    E,
+    R
+  >,
+) =>
+  Layer.effect(
+    OAuthRegistrationIntents,
+    Effect.map(services, (value) => value.oauthRegistrationIntents),
+  );
+
+export const oauthConnectedPersistenceLayer = <E, R>(
+  services: Effect.Effect<
+    { readonly oauthConnectedPersistence: OAuthConnectedPersistence["Service"] },
+    E,
+    R
+  >,
+) =>
+  Layer.effect(
+    OAuthConnectedPersistence,
+    Effect.map(services, (value) => value.oauthConnectedPersistence),
+  );
+
+export const oauthConnectedRevocationsLayer = <E, R>(
+  services: Effect.Effect<
+    { readonly oauthConnectedRevocations: OAuthConnectedRevocations["Service"] },
+    E,
+    R
+  >,
+) =>
+  Layer.effect(
+    OAuthConnectedRevocations,
+    Effect.map(services, (value) => value.oauthConnectedRevocations),
+  );
+
+export const oauthRegistrationAuthorityLayer = <Id, Registration, E, R>(
+  tag: Context.Key<Id, OAuthRegistrationAuthority<Registration>>,
+  services: Effect.Effect<
+    { readonly registrationAuthority: OAuthRegistrationAuthority<Registration> },
+    E,
+    R
+  >,
+) =>
+  Layer.effect(
+    tag,
+    Effect.map(services, (value) => value.registrationAuthority),
+  );

package/src/internal/oauth/native-mutation.ts

@@ -0,0 +1,222 @@
+import type { OAuthAccountRevision, OAuthExternalIdentity } from "@yielded/auth/OAuth";
+import { Cause, Effect, Schema } from "effect";
+import { SqlClient } from "effect/sql";
+import { SqlError } from "effect/sql/SqlError";
+import type { Fragment } from "effect/sql/Statement";
+
+import { sqlBatchAssertion } from "../d1-planning";
+import type { OAuthOwnershipTable } from "../models/oauth-model";
+import type { NativeSqlTables } from "../native-sql-table";
+import { exactSqlText, executeSqlChange } from "../sql-change";
+import {
+  appendSqlBatchStatement,
+  registerSqlBatchPostcondition,
+  registerSqlPostcondition,
+} from "../sql-commit";
+import type { TableModel } from "../table-model";
+import { makeOAuthNativeAuthority, type OAuthNativeReadMapping } from "./native-state";
+import { invariant, oauthIdentityKey } from "./state";
+
+export type OAuthNativeMutationMapping = Pick<
+  OAuthNativeReadMapping,
+  "subject" | "authority" | "subjectId" | "clock"
+> & {
+  readonly ownership: OAuthOwnershipTable<TableModel, unknown>;
+};
+
+/** Shared semantic predicates for native transactions and fixed D1 statements. */
+export const makeOAuthNativeMutation = Effect.fnUntraced(function* (
+  tables: NativeSqlTables,
+  mapping: OAuthNativeMutationMapping,
+  batch: boolean,
+) {
+  const authority = yield* makeOAuthNativeAuthority(tables, mapping);
+  const sql = (yield* SqlClient.SqlClient).withoutTransforms();
+  const ownership = tables(mapping.ownership.table);
+  const o = mapping.ownership;
+  const s = mapping.subject;
+  const a = mapping.authority;
+
+  const exact = (key: string, value: unknown) =>
+    exactSqlText(sql, ownership.column(key), ownership.value(key, value));
+
+  const assert = Effect.fnUntraced(function* (condition: Fragment) {
+    if (batch) yield* appendSqlBatchStatement(sqlBatchAssertion(sql, condition));
+    else {
+      const rows = yield* sql`select 1 where ${condition}`;
+
+      invariant(rows.length === 1);
+    }
+  });
+
+  const change = Effect.fnUntraced(function* (statement: Fragment, expected = 1) {
+    if (batch) {
+      yield* appendSqlBatchStatement(sql`${statement}`);
+      yield* appendSqlBatchStatement(sqlBatchAssertion(sql, sql`changes() = ${expected}`));
+
+      return expected;
+    }
+
+    return yield* executeSqlChange(sql, statement);
+  });
+
+  const finish = (name: string, condition: Fragment) =>
+    batch
+      ? registerSqlBatchPostcondition({ name, statement: sqlBatchAssertion(sql, condition) })
+      : registerSqlPostcondition({
+          name,
+          check: Effect.gen(function* () {
+            const rows = yield* sql`select 1 where ${condition}`;
+
+            invariant(rows.length === 1);
+          }),
+        });
+
+  const subjectCondition = (nativeId: unknown, revision: OAuthAccountRevision) => {
+    const subject = authority.subject;
+
+    return sql.and([
+      sql`${subject.column(s.id)} = ${subject.value(s.id, nativeId)}`,
+      exactSqlText(
+        sql,
+        subject.column(s.securityRevision),
+        subject.value(s.securityRevision, revision.securityRevision),
+      ),
+      tables.expression(s.activeCondition),
+    ]);
+  };
+
+  const factorCondition = (nativeId: unknown, revision: OAuthAccountRevision) => {
+    const factors = authority.authority;
+    const factorOwner = sql`${factors.column(a.subjectId)} = ${factors.value(a.subjectId, nativeId)}`;
+    const active = tables.expression(a.activeCondition);
+
+    return sql.and([
+      sql`(select count(*) from ${factors.name} where ${factorOwner} and ${active}) = ${revision.credentials.length}`,
+      ...revision.credentials.map(
+        (item) => sql`exists(select 1 from ${factors.name} where ${factorOwner} and ${active}
+        and ${exactSqlText(sql, factors.column(a.credentialId), factors.value(a.credentialId, item.credentialId))}
+        and ${exactSqlText(sql, factors.column(a.revision), factors.value(a.revision, item.revision))})`,
+      ),
+    ]);
+  };
+
+  const authorityCondition = (nativeId: unknown, revision: OAuthAccountRevision) =>
+    sql.and([
+      sql`exists(select 1 from ${authority.subject.name} where ${subjectCondition(nativeId, revision)})`,
+      factorCondition(nativeId, revision),
+    ]);
+
+  const ownerCondition = (identityKey: string, nativeId: unknown) =>
+    sql.and([
+      exact(o.identityKey, identityKey),
+      sql`${ownership.column(o.subjectId)} = ${ownership.value(o.subjectId, nativeId)}`,
+    ]);
+
+  const insertUnique = (statement: Fragment) =>
+    change(statement).pipe(
+      Effect.catchCause((cause) =>
+        cause.reasons.length > 0 &&
+        cause.reasons.every(
+          (reason) =>
+            Cause.isFailReason(reason) &&
+            Schema.is(SqlError)(reason.error) &&
+            reason.error.reason._tag === "UniqueViolation",
+        )
+          ? Effect.succeed(0)
+          : Effect.failCause(cause),
+      ),
+    );
+
+  const ensureOwnership = Effect.fnUntraced(function* (
+    identity: typeof OAuthExternalIdentity.Type,
+    nativeId: unknown,
+  ) {
+    const identityKey = yield* oauthIdentityKey(identity);
+
+    // An existing-owner mapping may deliberately reject creation in encodeInsert.
+    // Inspect ownership after the caller's subject lock before invoking that policy.
+    const rows =
+      yield* sql`select ${ownership.fields("identity_")} from ${ownership.name} where ${exact(o.identityKey, identityKey)}`;
+
+    invariant(rows.length <= 1);
+    const row = rows[0] === undefined ? undefined : ownership.decode(rows[0], "identity_");
+
+    if (row !== undefined) {
+      invariant(
+        row[o.provider] === identity.provider &&
+          row[o.issuer] === identity.issuer &&
+          row[o.externalSubject] === identity.subject,
+      );
+      if (!mapping.subjectId.equals(o.decodeSubjectId(row), nativeId)) return undefined;
+      if (batch)
+        yield* assert(
+          sql`exists(select 1 from ${ownership.name} where ${ownerCondition(identityKey, nativeId)})`,
+        );
+
+      return identityKey;
+    }
+
+    const statement = sql`${ownership.insert({
+      ...o.encodeInsert({ identity, identityKey, subjectId: nativeId }),
+      [o.identityKey]: identityKey,
+      [o.provider]: identity.provider,
+      [o.issuer]: identity.issuer,
+      [o.externalSubject]: identity.subject,
+      [o.subjectId]: nativeId,
+    })} ${sql.onDialectOrElse({ mysql: () => sql``, orElse: () => sql`on conflict do nothing` })}`;
+
+    if (batch) {
+      yield* change(statement);
+
+      return identityKey;
+    }
+
+    const inserted = yield* insertUnique(statement);
+
+    if (inserted === 1) return identityKey;
+
+    const raced =
+      yield* sql`select ${ownership.fields("identity_")} from ${ownership.name} where ${exact(o.identityKey, identityKey)}`;
+
+    invariant(raced.length === 1);
+    const committed = ownership.decode(raced[0]!, "identity_");
+
+    invariant(
+      committed[o.provider] === identity.provider &&
+        committed[o.issuer] === identity.issuer &&
+        committed[o.externalSubject] === identity.subject,
+    );
+
+    return mapping.subjectId.equals(o.decodeSubjectId(committed), nativeId)
+      ? identityKey
+      : undefined;
+  });
+
+  const execute = (statement: Fragment) =>
+    batch
+      ? appendSqlBatchStatement(sql`${statement}`)
+      : executeSqlChange(sql, statement).pipe(Effect.asVoid);
+
+  const releaseOwnership = (identityKey: string, nativeId: unknown, referenced: Fragment) =>
+    execute(
+      sql`delete from ${ownership.name} where ${ownerCondition(identityKey, nativeId)} and not (${referenced})`,
+    );
+
+  return {
+    ...authority,
+    sql,
+    ownership,
+    assert,
+    change,
+    finish,
+    authorityCondition,
+    subjectCondition,
+    factorCondition,
+    ownerCondition,
+    ensureOwnership,
+    insertUnique,
+    releaseOwnership,
+    execute,
+  };
+});