@yielded/auth-persistence 0.1.0-beta.25 → 0.1.0-beta.27

package/src/internal/storage-mapping.ts

@@ -5,26 +5,17 @@ import {
   EncodedPasswordHash,
   type PasswordReplacement,
 } from "@yielded/auth/Password";
-import {
-  ProofBinding,
-  ProofContinuationId,
-  ProofDeliveryId,
-  ProofId,
-  ProofPurpose,
-  ProofRequestId,
-  ProofRequestReceipt,
-  ProofVersion,
-} from "@yielded/auth/Proofs";
 import { TokenDigest } from "@yielded/auth/Schema";
 import {
   SecurityRevision,
+  AuthenticationEvidence,
   SessionId,
   SessionMetadata,
   SessionAuthenticationProvenance,
   SessionCredentialVersion,
   type StatefulSessionRecord,
 } from "@yielded/auth/Sessions";
-import { Crypto, DateTime, Effect, Redacted, Schema } from "effect";
+import { Crypto, DateTime, Effect, Redacted, Schema, Struct } from "effect";
 
 import type { MappingInput } from "./configuration";
 import { randomId } from "./crypto";
@@ -35,9 +26,10 @@ import {
   type AnyPasswordPersistenceMapping,
 } from "./models/password-model";
 import { requiredProofConstraints, type AnyProofPersistenceMapping } from "./models/proof-model";
-import type { StatefulSessionMapping } from "./models/session-model";
-import type { TableModel, SqlFragment } from "./query-operations";
+import type { StatefulSessionMapping, PendingAuthenticationMapping } from "./models/session-model";
+import { makeStorageClock } from "./storage-clock";
 import { storageTables, type StorageRole } from "./storage-tables";
+import type { TableModel, SqlExpression } from "./table-model";
 
 const failure = (cause: unknown) => PersistenceMappingError.make({ operation: "decode", cause });
 
@@ -45,35 +37,6 @@ const decode = <S extends Schema.Codec<unknown, unknown>>(schema: S, value: unkn
   Schema.decodeUnknownEffect(schema)(value).pipe(Effect.mapError(failure));
 
 const string = (value: unknown) => Schema.decodeUnknownSync(Schema.String)(value);
-const tuple = Schema.encodeSync(Schema.fromJsonString(Schema.Array(Schema.String)));
-const bindingJson = Schema.fromJsonString(ProofBinding);
-const receiptJson = Schema.fromJsonString(ProofRequestReceipt);
-
-const ProofRecord = Schema.Struct({
-  moduleId: Schema.String,
-  purpose: ProofPurpose,
-  proofId: ProofId,
-  requestId: ProofRequestId,
-  fingerprint: TokenDigest,
-  deliveryId: ProofDeliveryId,
-  binding: ProofBinding,
-  verifier: Schema.Struct({ keyId: Schema.String, digest: TokenDigest }),
-  issuedAtMillis: Schema.Int,
-  expiresAtMillis: Schema.Int,
-  version: ProofVersion,
-});
-
-const ProofContinuation = Schema.Struct({
-  moduleId: Schema.String,
-  purpose: ProofPurpose,
-  continuationId: ProofContinuationId,
-  digest: TokenDigest,
-  proofId: ProofId,
-  seriesKey: Schema.String,
-  binding: ProofBinding,
-  expiresAtMillis: Schema.Int,
-  version: ProofVersion,
-});
 
 /** Derive shared row mappings from a managed or custom storage layout.
  * Acquire Effect Crypto once; the returned allocators retain that implementation.
@@ -112,6 +75,7 @@ export const makeMappings = Effect.fnUntraced(function* (input: MappingInput) {
     securityRevision: s.securityRevision,
     isActiveStatus: (value: unknown) => Object.is(value, s.activeValue),
     d1ActiveStatusValue: s.activeValue,
+    activeStatusValue: s.activeValue,
     decodeRequirement: s.requirements,
     decodeActionRequirement: s.actionRequirements,
     nextSecurityRevision: () => allocate.pipe(Effect.map(SecurityRevision.make)),
@@ -123,6 +87,7 @@ export const makeMappings = Effect.fnUntraced(function* (input: MappingInput) {
     credentialId: "credentialId",
     revision: "revision",
     status: "active",
+    activeStatusValue: true,
     isActiveStatus: (value: unknown) => value === true,
     encodeInsert: (row: object) => ({ ...row, active: true }),
     encodeRevision: (revision: SecurityRevision) => ({ revision }),
@@ -130,237 +95,30 @@ export const makeMappings = Effect.fnUntraced(function* (input: MappingInput) {
 
   const authority = () => ({ subjectId, subject, credential: authorityCredential() });
 
-  const proofs = (): AnyProofPersistenceMapping<SqlFragment> => ({
+  const clock = yield* makeStorageClock(input);
+
+  const proofs = (): AnyProofPersistenceMapping<SqlExpression> => ({
     constraints: requiredProofConstraints,
-    encodeInstant: instant,
-    decodeInstant: readInstant,
-    allocateVersion: allocate.pipe(Effect.map(ProofVersion.make)),
-    isRequestConflict: () => false,
-    isSeriesConflict: () => false,
-    isCommandConflict: () => false,
-    scopeKeys: ({ binding }) => ({
-      series: tuple([
-        binding.identifier.namespace,
-        binding.identifier.value,
-        binding._tag === "Identifier" ? "anonymous" : binding.revision.subjectId,
-      ]),
-      identifier: tuple([binding.identifier.namespace, binding.identifier.value]),
-      subject: binding._tag === "Identifier" ? "anonymous" : binding.revision.subjectId,
-    }),
-    authority: {
-      ...authority(),
-      identifier: {
-        table: table("identifiers"),
-        namespace: "namespace",
-        value: "value",
-        isCurrent: (request, rows) =>
-          request.binding._tag === "Identifier"
-            ? rows.length === 0
-            : request.binding._tag === "IdentifierChange"
-              ? rows.length === 0 ||
-                (rows.length === 1 &&
-                  rows.every(
-                    (row) =>
-                      Object.is(row.subjectId, request.nativeSubjectId) &&
-                      row.active === true &&
-                      row.verifiedAt === null,
-                  ))
-              : rows.length === 1 &&
-                rows.every(
-                  (row) => Object.is(row.subjectId, request.nativeSubjectId) && row.active === true,
-                ),
-      },
-    },
-    request: {
-      ...mapped("proofRequests"),
-      moduleId: "moduleId",
-      requestId: "requestId",
-      fingerprint: "fingerprint",
-      proofId: "proofId",
-      purpose: "purpose",
-      keyId: "keyId",
-      createdAt: "createdAt",
-      retentionUntil: "retentionUntil",
-      encodeInsert: ({ record, retentionUntilMillis }) => ({
-        moduleId: record.moduleId,
-        requestId: record.requestId,
-        fingerprint: record.fingerprint,
-        proofId: record.proofId,
-        purpose: record.purpose,
-        keyId: record.verifier.keyId,
-        createdAt: instant(record.issuedAtMillis),
-        retentionUntil: instant(retentionUntilMillis),
-        receipt: Schema.encodeSync(receiptJson)({
-          requestId: record.requestId,
-          reference: {
-            proofId: record.proofId,
-            purpose: record.purpose,
-            keyId: record.verifier.keyId,
-          },
-        }),
-      }),
-      decodeReceipt: (row) => decode(receiptJson, row.receipt),
-    },
-    series: {
-      ...mapped("proofSeries"),
-      moduleId: "moduleId",
-      purpose: "purpose",
-      scopeKey: "scopeKey",
-      activeProofId: "activeProofId",
-      lastIssueAt: "lastIssueAt",
-      version: "version",
-      encodeInsert: (row) => ({ ...row, activeProofId: null, lastIssueAt: null }),
-    },
-    generation: {
-      ...mapped("proofGenerations"),
+    subjectId,
+    subject: { table: s.table, id: s.id },
+    clock,
+    proof: {
+      ...mapped("proofs"),
       moduleId: "moduleId",
       purpose: "purpose",
-      proofId: "proofId",
-      requestId: "requestId",
       seriesKey: "seriesKey",
-      deliveryId: "deliveryId",
+      proofId: "proofId",
       binding: "binding",
       verifierKeyId: "verifierKeyId",
       verifierDigest: "verifierDigest",
       issuedAt: "issuedAt",
       expiresAt: "expiresAt",
-      version: "version",
-      state: "state",
-      sendCount: "sendCount",
-      deliveryState: "deliveryState",
-      claimVersion: "claimVersion",
-      claimDeadline: "claimDeadline",
-      retryAt: "retryAt",
-      deliveryRetryMillis: "deliveryRetryMillis",
-      retentionUntil: "retentionUntil",
-      encodeInsert: ({
-        record,
-        seriesKey,
-        retentionUntilMillis,
-        state,
-        deliveryState,
-        policy,
-      }) => ({
-        moduleId: record.moduleId,
-        purpose: record.purpose,
-        proofId: record.proofId,
-        requestId: record.requestId,
-        seriesKey,
-        deliveryId: record.deliveryId,
-        binding: Schema.encodeSync(bindingJson)(record.binding),
-        verifierKeyId: record.verifier.keyId,
-        verifierDigest: record.verifier.digest,
-        issuedAt: instant(record.issuedAtMillis),
-        expiresAt: instant(record.expiresAtMillis),
-        version: record.version,
-        state,
-        sendCount: 0,
-        deliveryState,
-        claimVersion: null,
-        claimDeadline: null,
-        retryAt: null,
-        deliveryRetryMillis: policy.deliveryRetryMillis,
-        retentionUntil: instant(retentionUntilMillis),
-        fingerprint: record.fingerprint,
-      }),
-      decodeBinding: (row) => decode(bindingJson, row.binding),
-      decodeRecord: (row) =>
-        Effect.gen(function* () {
-          return yield* decode(ProofRecord, {
-            moduleId: row.moduleId,
-            purpose: row.purpose,
-            proofId: row.proofId,
-            requestId: row.requestId,
-            fingerprint: row.fingerprint,
-            deliveryId: row.deliveryId,
-            binding: yield* decode(bindingJson, row.binding),
-            verifier: { keyId: row.verifierKeyId, digest: row.verifierDigest },
-            issuedAtMillis: yield* readInstant(row.issuedAt),
-            expiresAtMillis: yield* readInstant(row.expiresAt),
-            version: row.version,
-          });
-        }),
-    },
-    continuation: {
-      ...mapped("proofContinuations"),
-      moduleId: "moduleId",
-      purpose: "purpose",
-      continuationId: "continuationId",
-      digest: "digest",
-      proofId: "proofId",
-      seriesKey: "seriesKey",
-      binding: "binding",
-      expiresAt: "expiresAt",
-      consumed: "consumed",
-      version: "version",
-      retentionUntil: "retentionUntil",
-      encodeInsert: (record) => ({
-        ...record,
-        binding: Schema.encodeSync(bindingJson)(record.binding),
-        expiresAt: instant(record.expiresAtMillis),
-        consumed: false,
-        retentionUntil: instant(record.retentionUntilMillis),
-      }),
-      decode: (row) =>
-        Effect.gen(function* () {
-          return yield* decode(ProofContinuation, {
-            ...row,
-            binding: yield* decode(bindingJson, row.binding),
-            expiresAtMillis: yield* readInstant(row.expiresAt),
-          });
-        }),
-    },
-    rateScope: {
-      ...mapped("proofScopes"),
-      moduleId: "moduleId",
-      purpose: "purpose",
-      action: "action",
-      scopeKind: "scopeKind",
-      scopeKey: "scopeKey",
-      encodeInsert: (row) => ({ ...row }),
-    },
-    abuseEvent: {
-      ...mapped("proofAbuse"),
-      moduleId: "moduleId",
-      purpose: "purpose",
-      action: "action",
-      scopeKind: "scopeKind",
-      scopeKey: "scopeKey",
-      commandId: "commandId",
-      occurredAt: "occurredAt",
-      retentionUntil: "retentionUntil",
-      encodeInsert: (row) => ({
-        ...row,
-        occurredAt: instant(row.occurredAtMillis),
-        retentionUntil: instant(row.retentionUntilMillis),
-      }),
-    },
-    failureEvent: {
-      ...mapped("proofFailures"),
-      moduleId: "moduleId",
-      purpose: "purpose",
-      seriesKey: "seriesKey",
-      commandId: "commandId",
-      occurredAt: "occurredAt",
-      retentionUntil: "retentionUntil",
-      encodeInsert: (row) => ({
-        ...row,
-        occurredAt: instant(row.occurredAtMillis),
-        retentionUntil: instant(row.retentionUntilMillis),
-      }),
-    },
-    command: {
-      ...mapped("proofCommands"),
-      moduleId: "moduleId",
-      commandId: "commandId",
-      kind: "kind",
-      decision: "decision",
-      retentionUntil: "retentionUntil",
-      encodeInsert: (row) => ({ ...row, retentionUntil: instant(row.retentionUntilMillis) }),
+      failedAttempts: "failedAttempts",
+      encodeInsert: () => ({}),
     },
   });
 
-  const passwords = (): AnyPasswordPersistenceMapping<SqlFragment> => {
+  const passwords = (): AnyPasswordPersistenceMapping<SqlExpression> => {
     const verifier = (replacement: PasswordReplacement) => ({
       verifier: Redacted.value(replacement.verifier),
       normalization: replacement.normalization,
@@ -371,12 +129,10 @@ export const makeMappings = Effect.fnUntraced(function* (input: MappingInput) {
       subject,
       authorityCredential: authorityCredential(),
       constraints: requiredPasswordConstraints,
-      isCommandConflict: () => false,
       encodeInstant: instant,
       decodeInstant: readInstant,
       allocateCredentialId: allocate,
       allocateRevision: allocate.pipe(Effect.map(SecurityRevision.make)),
-      commandRetentionMillis: 86_400_000,
       sessionInvalidation: "same-authority-immediate",
       identifier: {
         table: table("identifiers"),
@@ -442,32 +198,22 @@ export const makeMappings = Effect.fnUntraced(function* (input: MappingInput) {
             });
           }),
       },
-      command: {
-        ...mapped("passwordCommands"),
-        moduleId: "moduleId",
-        commandId: "commandId",
-        action: "action",
-        bindingDigest: "bindingDigest",
-        decision: "decision",
-        retentionUntil: "retentionUntil",
-        encodeInsert: (row) => ({ ...row, retentionUntil: instant(row.retentionUntilMillis) }),
-      },
+      clock,
     };
   };
 
-  const emails = (): AnyEmailAddressMapping<SqlFragment> => ({
+  const emails = (): AnyEmailAddressMapping<SqlExpression> => ({
     subjectId,
-    subject,
+    subject: { ...subject, activeStatusValue: s.activeValue },
     constraints: requiredEmailAddressConstraints,
     addressCardinality: "single",
     changeDisposition: "retire-source",
+    clock,
     encodeInstant: instant,
     decodeInstant: readInstant,
     allocateCredentialId: allocate,
     allocateRevision: allocate.pipe(Effect.map(SecurityRevision.make)),
-    commandRetentionMillis: 86_400_000,
     sessionInvalidation: "same-authority-immediate",
-    isCommandConflict: () => false,
     isIdentifierConflict: () => false,
     isCredentialConflict: () => false,
     authorityCredential: {
@@ -499,6 +245,7 @@ export const makeMappings = Effect.fnUntraced(function* (input: MappingInput) {
       encodeRetirement: ({ bindingRevision }) => ({ revision: bindingRevision, active: false }),
     },
     credential: {
+      activeStatusValue: true,
       table: table("emailCredentials"),
       moduleId: "moduleId",
       subjectId: "subjectId",
@@ -523,55 +270,110 @@ export const makeMappings = Effect.fnUntraced(function* (input: MappingInput) {
       encodeRetirement: ({ credentialRevision }) => ({ credentialRevision, active: false }),
       decode: ({ moduleId, subject: row, identifier, credential }) =>
         Effect.gen(function* () {
-          return yield* decode(EmailCredentialSnapshot, {
-            moduleId,
-            identifier: { namespace: identifier.namespace, value: identifier.value },
-            identifierRevision: identifier.revision,
-            verifiedAtMillis: yield* readInstant(identifier.verifiedAt),
-            credentialId: credential.credentialId,
-            credentialRevision: credential.credentialRevision,
-            revision: {
-              subjectId: yield* s.toSubject(row[s.id]),
-              securityRevision: row[s.securityRevision],
-              credentials: [
-                { credentialId: credential.credentialId, revision: credential.credentialRevision },
-              ],
+          return yield* decode(
+            Schema.Struct(Struct.omit(EmailCredentialSnapshot.fields, ["requirement"])),
+            {
+              moduleId,
+              identifier: { namespace: identifier.namespace, value: identifier.value },
+              identifierRevision: identifier.revision,
+              verifiedAtMillis: yield* readInstant(identifier.verifiedAt),
+              credentialId: credential.credentialId,
+              credentialRevision: credential.credentialRevision,
+              revision: {
+                subjectId: yield* s.toSubject(row[s.id]),
+                securityRevision: row[s.securityRevision],
+                credentials: [
+                  {
+                    credentialId: credential.credentialId,
+                    revision: credential.credentialRevision,
+                  },
+                ],
+              },
             },
-          });
+          );
         }),
     },
-    command: {
-      table: table("emailCommands"),
-      moduleId: "moduleId",
-      commandId: "commandId",
-      action: "action",
-      bindingDigest: "bindingDigest",
-      retentionUntil: "retentionUntil",
-      encodeInsert: ({ retentionUntilMillis, ...row }) => ({
-        ...row,
-        retentionUntil: instant(retentionUntilMillis),
-      }),
-    },
   });
 
+  const pending = <C extends Schema.Codec<unknown, unknown, never, never>>(
+    claims: C,
+    moduleId: string,
+  ): PendingAuthenticationMapping<C["Type"], TableModel, TableModel, TableModel, unknown> => {
+    const record = Schema.fromJsonString(
+      Schema.Struct({
+        digest: TokenDigest,
+        version: SecurityRevision,
+        evidence: AuthenticationEvidence,
+        expiresAt: Schema.DateTimeUtcFromMillis,
+        attemptLimit: Schema.Int.check(Schema.isGreaterThan(0)),
+        claims: Schema.Unknown,
+      }),
+    );
+
+    return {
+      ...authority(),
+      moduleId,
+      clock,
+      isConstraintConflict: () => false,
+      constraints: { pendingDigest: "unique(pending.digest)" },
+      pending: {
+        table: table("pending"),
+        moduleId: "moduleId",
+        kind: "kind",
+        digest: "digest",
+        version: "version",
+        flowId: "flowId",
+        subjectId: "subjectId",
+        bindingDigest: "bindingDigest",
+        snapshot: "snapshot",
+        expiresAt: "expiresAt",
+        attemptLimit: "attemptLimit",
+        failedAttempts: "failedAttempts",
+        consumed: "consumed",
+        encodeInstant: (date) => instant(DateTime.toEpochMillis(date)),
+        allocateVersion: allocate.pipe(Effect.map(SecurityRevision.make)),
+        encodeInsert: (value) => ({
+          ...value,
+          expiresAt: instant(DateTime.toEpochMillis(value.expiresAt)),
+          failedAttempts: 0,
+          consumed: false,
+        }),
+      },
+      login: {
+        encode: (value) =>
+          Schema.encodeEffect(claims)(value.claims).pipe(
+            Effect.flatMap((saved) => Schema.encodeEffect(record)({ ...value, claims: saved })),
+            Effect.mapError(failure),
+          ),
+        decode: (value) =>
+          decode(record, value).pipe(
+            Effect.flatMap((saved) =>
+              decode(claims, saved.claims).pipe(
+                Effect.map((decoded) => ({ ...saved, claims: decoded })),
+              ),
+            ),
+          ),
+      },
+    };
+  };
+
   const sessions = <C extends Schema.Codec<unknown, unknown, never, never>>(
     claims: C,
+    moduleId: string,
   ): StatefulSessionMapping<
     C["Type"],
     TableModel,
     TableModel,
     TableModel,
     TableModel,
-    TableModel,
     unknown,
-    string
+    unknown
   > => {
     const record = Schema.fromJsonString(
       Schema.Struct({
         ...SessionMetadata.fields,
         claims: Schema.Unknown,
         digest: TokenDigest,
-        version: SecurityRevision,
         provenance: SessionAuthenticationProvenance,
         credentialVersion: SessionCredentialVersion,
       }),
@@ -579,7 +381,6 @@ export const makeMappings = Effect.fnUntraced(function* (input: MappingInput) {
 
     const encodeRow = (value: StatefulSessionRecord<C["Type"]>) => ({
       digest: value.digest,
-      version: value.version,
       securityRevision: value.securityRevision,
       issuedAt: instant(DateTime.toEpochMillis(value.issuedAt)),
       expiresAt: instant(DateTime.toEpochMillis(value.expiresAt)),
@@ -590,66 +391,50 @@ export const makeMappings = Effect.fnUntraced(function* (input: MappingInput) {
       }),
     });
 
+    const login = pending(claims, moduleId);
+
     return {
       ...authority(),
+      moduleId,
+      clock,
       isConstraintConflict: () => false,
-      constraints: { sessionDigest: "unique(session.digest)", flowId: "unique(flow.flowId)" },
+      pending: { pending: login.pending, login: login.login },
+      constraints: {
+        sessionDigest: "unique(session.digest)",
+        pendingDigest: "unique(pending.digest)",
+      },
       sessionId: {
         toNative: (id) => Effect.succeed(id),
         toSession: (id) => decode(SessionId, id),
         equals: Object.is,
       },
-      flow: {
-        table: table("sessionFlows"),
-        flowId: "flowId",
-        subjectId: "subjectId",
-        state: "state",
-        pendingDigest: "pendingDigest",
-        dedupUntil: "dedupUntil",
-        pendingStateValue: "pending",
-        establishedStateValue: "established",
-        encodeInstant: (date) => instant(DateTime.toEpochMillis(date)),
-        decodeInstant: (value) => readInstant(value).pipe(Effect.map(DateTime.makeUnsafe)),
-        encodePendingInsert: (row) => ({
-          flowId: row.evidence.flowId,
-          subjectId: row.subjectId,
-          state: "pending",
-          pendingDigest: row.pendingDigest,
-          dedupUntil: instant(DateTime.toEpochMillis(row.dedupUntil)),
-        }),
-        encodeEstablishedInsert: (row) => ({
-          flowId: row.evidence.flowId,
-          subjectId: row.subjectId,
-          state: "established",
-          pendingDigest: null,
-          dedupUntil: instant(DateTime.toEpochMillis(row.dedupUntil)),
-        }),
-      },
       session: {
         table: table("sessions"),
         sessionId: "sessionId",
         subjectId: "subjectId",
         digest: "digest",
-        version: "version",
         securityRevision: "securityRevision",
         issuedAt: "issuedAt",
         expiresAt: "expiresAt",
         absoluteExpiresAt: "absoluteExpiresAt",
         encodeInstant: (date) => instant(DateTime.toEpochMillis(date)),
         allocateId: allocate,
-        allocateVersion: allocate.pipe(Effect.map(SecurityRevision.make)),
         encodeInsert: (value, ids) => ({ ...encodeRow(value), ...ids }),
         encodeRotation: encodeRow,
         decode: (row) =>
           Effect.gen(function* () {
-            const saved = yield* decode(record, row.record);
-            const decodedClaims = yield* decode(claims, saved.claims);
+            const saved = yield* decode(record, row.record),
+              decodedClaims = yield* decode(claims, saved.claims);
 
-            return { ...saved, claims: decodedClaims };
+            return {
+              ...saved,
+              issuedAt: DateTime.makeUnsafe(yield* readInstant(row.issuedAt)),
+              claims: decodedClaims,
+            };
           }),
       },
     };
   };
 
-  return { table, authority, proofs, passwords, emails, sessions, string };
+  return { table, authority, proofs, passwords, emails, sessions, pending, string };
 });