@yielded/auth-persistence 0.1.0-beta.29 → 0.1.0-beta.30

package/src/internal/oauth/native-accounts.ts

@@ -8,7 +8,7 @@ import type { Fragment } from "effect/sql/Statement";
 import { type OAuthAccountsMapping, OAuthEligibilityFact } from "../models/oauth-model";
 import type { NativeSqlTables } from "../native-sql-table";
 import { makeConditionalSqlInsert } from "../session-native-record";
-import { anySqlCondition, exactSqlText } from "../sql-change";
+import { anySqlCondition, exactSqlText, sqlTextBytes } from "../sql-change";
 import { makeSqlCommitExecutor, SqlBatchCommit, CurrentSqlCommit } from "../sql-commit";
 import type { SqlExpression, TableModel } from "../table-model";
 import { makeOAuthNativeFlow } from "./native-flow";
@@ -86,6 +86,77 @@ export const makeNativeOAuthAccountsServices = Effect.fnUntraced(function* (
     ]);
 
   const service: M.OAuthAccountsPersistence["Service"] = {
+    list: (original) =>
+      read(
+        Effect.gen(function* () {
+          const input = M.snapshotOAuthSync(M.OAuthLinkedAccountsRead, original);
+          const nativeId = yield* mapping.subjectId.toNative(input.invocation.subjectId);
+
+          const metadataAccess = tables.expression(
+            mapping.metadataAccess({
+              invocation: input.invocation,
+              moduleId: input.moduleId,
+              subjectId: nativeId,
+            }),
+          );
+
+          const s = mapping.subject;
+          const orderedId = yield* sqlTextBytes(credential.column(c.credentialId));
+
+          const cursorCondition =
+            input.cursor === undefined
+              ? sql``
+              : sql`and ${orderedId} > ${yield* sqlTextBytes(credential.value(c.credentialId, input.cursor))}`;
+
+          // Bound candidate work before resolving identities. Each final read uses
+          // its columns' own codecs and rechecks live ownership/authority/policy.
+          // A removed candidate can leave a short page; the cursor still advances.
+          // Match exact credential identity even when the column's collation does not.
+          const rows = yield* sql`select ${credential.fields("page_")} from ${credential.name}
+            where ${exactSqlText(sql, credential.column(c.moduleId), credential.value(c.moduleId, input.moduleId))}
+              and ${credential.column(c.subjectId)} = ${credential.value(c.subjectId, nativeId)}
+              and ${tables.expression(c.activeCondition)} and ${metadataAccess}
+              and exists(select 1 from ${state.subject.name}
+                where ${state.subject.column(s.id)} = ${state.subject.value(s.id, nativeId)}
+                  and ${tables.expression(s.activeCondition)})
+              ${cursorCondition}
+            order by ${orderedId} limit ${input.limit + 1}`;
+
+          const selected = rows.slice(0, input.limit);
+          const items: Array<M.OAuthLinkedAccount> = [];
+          let cursor: string | undefined;
+
+          for (const row of selected) {
+            const credentialId = yield* Schema.decodeUnknownEffect(
+              M.OAuthLinkedAccount.fields.credentialId,
+            )(credential.decode(row, "page_")[c.credentialId]);
+
+            cursor = credentialId;
+
+            const current = yield* state.readCredential(
+              {
+                moduleId: input.moduleId,
+                subjectId: input.invocation.subjectId,
+                credentialId,
+              },
+              metadataAccess,
+            );
+
+            if (current !== undefined)
+              items.push(
+                M.OAuthLinkedAccount.make({
+                  credentialId: current.credentialId,
+                  ...current.identity,
+                }),
+              );
+          }
+
+          return M.snapshotOAuthSync(M.OAuthLinkedAccountsListResult, {
+            items,
+            ...(rows.length > input.limit && cursor !== undefined ? { cursor } : {}),
+          });
+        }),
+      ),
     capture: (input) =>
       read(Effect.map(state.capture(input.subjectId, false), (current) => current?.revision)),
     issue: (original, prepare) =>

package/src/internal/oauth/native-state.ts

@@ -7,6 +7,7 @@ import {
 import type { SubjectId } from "@yielded/auth/Schema";
 import { Effect, Schema } from "effect";
 import { SqlClient } from "effect/sql";
+import type { Fragment } from "effect/sql/Statement";
 
 import type { OAuthSignInMapping } from "../models/oauth-model";
 import type { NativeSqlTables } from "../native-sql-table";
@@ -305,7 +306,10 @@ export const makeOAuthNativeState = Effect.fnUntraced(function* (
     return result;
   });
 
-  const readCredential = Effect.fnUntraced(function* (input: typeof OAuthCredentialKey.Type) {
+  const readCredential = Effect.fnUntraced(function* (
+    input: typeof OAuthCredentialKey.Type,
+    metadataAccess: Fragment = sql`true`,
+  ) {
     const nativeId = yield* mapping.subjectId.toNative(input.subjectId);
     let identityKey: unknown;
 
@@ -334,7 +338,7 @@ export const makeOAuthNativeState = Effect.fnUntraced(function* (
         and ${owner(o, mapping.ownership.subjectId)}
       join ${active("subject", "oauth_subject")} on ${owner(s, mapping.subject.id)}
       join ${active("authority", "oauth_authority")} on ${owner(a, mapping.authority.subjectId)}
-      where ${owner(c, mapping.credential.subjectId)}
+      where ${metadataAccess} and ${owner(c, mapping.credential.subjectId)}
         and ${exact(c.column(mapping.credential.moduleId), c.value(mapping.credential.moduleId, input.moduleId))}
         and ${exact(c.column(mapping.credential.credentialId), c.value(mapping.credential.credentialId, input.credentialId))}
       order by ${a.column(mapping.authority.credentialId)} limit 65`;

package/src/internal/sql-change.ts

@@ -1,5 +1,5 @@
 import { Effect, Schema } from "effect";
-import type { SqlClient } from "effect/sql/SqlClient";
+import { SqlClient } from "effect/sql/SqlClient";
 import type { SqlError } from "effect/sql/SqlError";
 import { join, type Fragment } from "effect/sql/Statement";
 
@@ -25,6 +25,19 @@ export const anySqlCondition: (conditions: ReadonlyArray<Fragment>) => Fragment
   "1 = 0",
 );
 
+/** Exact text comparison and ordering, independent of the column's collation. */
+export const sqlTextBytes = Effect.fnUntraced(function* (
+  value: Fragment,
+): Effect.fn.Return<Fragment, never, SqlClient> {
+  const sql = (yield* SqlClient).withoutTransforms();
+
+  return sql.onDialectOrElse({
+    mysql: () => sql`binary ${value}`,
+    pg: () => sql`convert_to(cast(${value} as text), 'UTF8')`,
+    orElse: () => sql`cast(${value} as blob)`,
+  });
+});
+
 /** Keep the indexed predicate and reject collation aliases of security tokens. */
 export const exactSqlText = (sql: SqlClient, left: Fragment, right: Fragment) =>
   sql.and([