@yielded/auth-persistence 0.1.0-beta.25 → 0.1.0-beta.27

package/src/internal/sql-table.ts

@@ -18,76 +18,44 @@ const decodeInteger = Schema.decodeUnknownOption(SqlInteger);
 export type Dialect = "pg" | "sqlite";
 export type Row = Readonly<Record<string, unknown>>;
 
-export interface Compiler {
-  readonly dialect: Dialect;
-  readonly parameters: unknown[];
-}
-
 export const identifier = (name: string) => '"' + name.replaceAll('"', '""') + '"';
 
-export class Fragment {
-  constructor(
-    readonly render: (compiler: Compiler) => string,
-    readonly decode: (value: unknown) => unknown = (value) => value,
-  ) {}
-
-  mapWith(decode: (value: unknown) => unknown): Fragment {
-    return new Fragment(this.render, decode);
-  }
-
-  as(_name: string): Fragment {
-    return this;
-  }
-
-  getSQL(): Fragment {
-    return this;
-  }
-}
-
 export interface ColumnOptions {
   readonly name: string;
   readonly type: "text" | "integer" | "boolean";
   readonly nullable?: boolean;
 }
 
-export class Column extends Fragment {
+export class Column {
   constructor(
     readonly tableName: string,
     readonly options: ColumnOptions,
     readonly schema?: string,
-  ) {
-    super(
-      () =>
-        `${schema === undefined ? "" : identifier(schema) + "."}${identifier(tableName)}.${identifier(options.name)}`,
-      (value) => {
-        if (value === null) return value;
-        if (options.type === "boolean") {
-          if (value === true || value === 1) return true;
-          if (value === false || value === 0) return false;
-          throw PersistenceMappingError.make({ operation: "decode", cause: "Invalid SQL boolean" });
-        }
-        if (options.type === "integer") {
-          const number = decodeInteger(value);
-
-          if (Option.isSome(number)) return number.value;
-          throw PersistenceMappingError.make({
-            operation: "decode",
-            cause: "SQL integer is outside the safe range",
-          });
-        }
+  ) {}
 
-        return value;
-      },
-    );
-  }
+  decode(value: unknown): unknown {
+    if (value === null) return value;
+    if (this.options.type === "boolean") {
+      if (value === true || value === 1) return true;
+      if (value === false || value === 0) return false;
+      throw PersistenceMappingError.make({ operation: "decode", cause: "Invalid SQL boolean" });
+    }
+    if (this.options.type === "integer") {
+      const number = decodeInteger(value);
+
+      if (Option.isSome(number)) return number.value;
+      throw PersistenceMappingError.make({
+        operation: "decode",
+        cause: "SQL integer is outside the safe range",
+      });
+    }
 
-  mapToDriverValue(value: unknown): unknown {
     return value;
   }
 }
 
 /** Plain SQL identifiers and column representations, independent of an ORM. */
-export class Table extends Fragment {
+export class Table {
   readonly columns: Readonly<Record<string, Column>>;
 
   constructor(
@@ -96,7 +64,6 @@ export class Table extends Fragment {
     readonly unique: ReadonlyArray<ReadonlyArray<string>>,
     readonly schema?: string,
   ) {
-    super(() => (schema === undefined ? "" : identifier(schema) + ".") + identifier(name));
     this.columns = Object.fromEntries(
       Object.entries(columns).map(([key, options]) => [key, new Column(name, options, schema)]),
     );

package/src/internal/standalone.ts

@@ -10,19 +10,10 @@ export const requireStandalone = <Failure>(
   >,
 ): Effect.Effect<void, Failure> =>
   Effect.withFiber((fiber) => {
+    if (transactionService === undefined) return Effect.fail(unavailable());
     const services = fiber.context.mapUnsafe;
 
-    if (transactionService !== undefined && services.has(transactionService.key))
-      return Effect.fail(unavailable());
-
-    // rc.117 libSQL uses a private per-client marker that is not exposed through
-    // SqlClient.transactionService. Conservatively reject every ambient libSQL
-    // transaction, including another client's, before issuing standalone writes.
-    // Recheck this upstream detail whenever the Effect driver is upgraded.
-    for (const key of services.keys()) {
-      if (key.startsWith("@effect/sql-libsql/LibsqlClient/LibsqlTransaction/"))
-        return Effect.fail(unavailable());
-    }
+    if (services.has(transactionService.key)) return Effect.fail(unavailable());
 
     return Effect.void;
   });

package/src/internal/step-up-state.ts

@@ -2,7 +2,6 @@ import {
   SessionStepUpInvalid,
   SessionUnavailable,
   AuthenticationEvidence,
-  type AuthenticationRevision,
   SessionMetadata,
   SessionStepUpIntent,
   SessionStepUpRequirement,
@@ -11,6 +10,8 @@ import {
 } from "@yielded/auth/Sessions";
 import { DateTime, Effect, Schema } from "effect";
 
+import { sameSessionRevision } from "./session-native-state";
+
 export const stepUpIntentCodec = Schema.fromJsonString(SessionStepUpIntent);
 const BoundedSnapshot = Schema.String.check(Schema.isMaxLength(131072));
 
@@ -26,19 +27,8 @@ export const decodeStepUpIntent = (snapshot: string) =>
     Effect.mapError(() => SessionUnavailable.make({})),
   );
 
-export const sameStepUpRevision = (left: AuthenticationRevision, right: AuthenticationRevision) =>
-  left.subjectId === right.subjectId &&
-  left.securityRevision === right.securityRevision &&
-  left.credentials.length === right.credentials.length &&
-  new Set(left.credentials.map((c) => c.credentialId)).size === left.credentials.length &&
-  left.credentials.every((item) =>
-    right.credentials.some(
-      (other) => item.credentialId === other.credentialId && item.revision === other.revision,
-    ),
-  );
-
 export const stepUpIntentLive = (
-  intent: SessionStepUpIntent,
+  intent: Omit<SessionStepUpIntent, "version">,
   kind: SessionStepUpIntent["sourceKind"],
   now: DateTime.Utc,
 ) => {
@@ -86,7 +76,7 @@ export const validateStepUpPlan = Effect.fn("DrizzleStepUp.validatePlan")(functi
     intent.sourceKind !== replacement._tag ||
     intent.sourceSessionId !== original.session.sessionId ||
     intent.sourceCredentialVersion !== original.credentialVersion ||
-    !sameStepUpRevision(intent.revision, original.provenance.evidence.revision) ||
+    !sameSessionRevision(intent.revision, original.provenance.evidence.revision) ||
     intent.revision.subjectId !== evidence.revision.subjectId ||
     intent.revision.securityRevision !== evidence.revision.securityRevision ||
     intent.flowId !== evidence.flowId ||
@@ -97,8 +87,6 @@ export const validateStepUpPlan = Effect.fn("DrizzleStepUp.validatePlan")(functi
       DateTime.toEpochMillis(original.session.expiresAt) ||
     DateTime.toEpochMillis(intent.sourceAbsoluteExpiresAt) !==
       DateTime.toEpochMillis(original.session.absoluteExpiresAt) ||
-    DateTime.toEpochMillis(intent.sourceAuthenticatedAt) !==
-      DateTime.toEpochMillis(replacement.inspection.session.assurance.authenticatedAt) ||
     DateTime.toEpochMillis(intent.sourceAbsoluteExpiresAt) !==
       DateTime.toEpochMillis(replacement.inspection.session.absoluteExpiresAt) ||
     evidenceEncoding(replacement.inspection.provenance.evidence) !== evidenceEncoding(evidence)
@@ -108,7 +96,6 @@ export const validateStepUpPlan = Effect.fn("DrizzleStepUp.validatePlan")(functi
     replacement._tag === "Stateful" &&
     (source.guard._tag !== "Stateful" ||
       source.guard.digest !== replacement.expectedDigest ||
-      source.guard.rowVersion !== replacement.expectedRowVersion ||
       replacement.inspection.session.sessionId !== intent.sourceSessionId)
   )
     return yield* SessionStepUpInvalid.make({});

package/src/internal/storage-clock.ts

@@ -0,0 +1,58 @@
+import { Effect } from "effect";
+import { SqlClient } from "effect/sql/SqlClient";
+
+import type { MappingInput } from "./configuration";
+import { PersistenceMappingError } from "./mapping-error";
+import type { ProofClock } from "./models/proof-model";
+import { compileSqlExpression } from "./sql-expression";
+import type { SqlExpression } from "./table-model";
+
+/** Managed storage supports epoch milliseconds or canonical ISO text. */
+export const makeStorageClock = Effect.fnUntraced(function* (storage: MappingInput) {
+  const sql = (yield* SqlClient).withoutTransforms();
+  const encoded = storage.encodeInstant(0);
+  const numeric = typeof encoded === "number";
+
+  if (!numeric && encoded !== "1970-01-01T00:00:00.000Z")
+    return yield* PersistenceMappingError.make({
+      operation: "mapping",
+      cause: "Unsupported managed timestamp representation",
+    });
+
+  const clock: ProofClock<SqlExpression> = {
+    encodeInstant: storage.encodeInstant,
+    decodeInstant: storage.decodeInstantSync,
+    engineNowMillis: sql.onDialectOrElse({
+      pg: () => sql`cast(extract(epoch from clock_timestamp()) * 1000 as bigint)`,
+      mysql: () => sql`cast(unix_timestamp(current_timestamp(3)) * 1000 as signed)`,
+      orElse: () => sql`cast(round((julianday('now') - 2440587.5) * 86400000) as integer)`,
+    }),
+    toMillis: (expression) => {
+      const value = compileSqlExpression(sql, expression);
+
+      return numeric
+        ? value
+        : sql.onDialectOrElse({
+            pg: () => sql`cast(extract(epoch from cast(${value} as timestamptz)) * 1000 as bigint)`,
+            mysql: () =>
+              sql`cast(unix_timestamp(str_to_date(${value}, '%Y-%m-%dT%H:%i:%s.%fZ')) * 1000 as signed)`,
+            orElse: () => sql`cast(round((julianday(${value}) - 2440587.5) * 86400000) as integer)`,
+          });
+    },
+    fromMillis: (expression) => {
+      const value = compileSqlExpression(sql, expression);
+
+      return numeric
+        ? value
+        : sql.onDialectOrElse({
+            pg: () =>
+              sql`to_char(to_timestamp((${value}) / 1000.0) at time zone 'UTC', 'YYYY-MM-DD"T"HH24:MI:SS.MS"Z"')`,
+            mysql: () =>
+              sql`concat(date_format(from_unixtime((${value}) / 1000.0), '%Y-%m-%dT%H:%i:%s.'), lpad(mod(${value}, 1000), 3, '0'), 'Z')`,
+            orElse: () => sql`strftime('%Y-%m-%dT%H:%M:%fZ', (${value}) / 1000.0, 'unixepoch')`,
+          });
+    },
+  };
+
+  return clock;
+});