@yielded/auth-persistence 0.1.0-beta.29 → 0.1.0-beta.31

package/src/internal/session-native-state.ts

@@ -14,12 +14,13 @@ import {
 } from "@yielded/auth/Sessions";
 import { Cause, Effect, Schema, DateTime } from "effect";
 import { SqlClient } from "effect/sql/SqlClient";
-import type { Fragment } from "effect/sql/Statement";
+import { fragment, parameter, type Fragment } from "effect/sql/Statement";
 
 import { PersistenceMappingError } from "./mapping-error";
 import type { SessionAuthorityTables, SessionExecution } from "./models/session-model";
-import type { NativeSqlTables, SqlTable } from "./native-sql-table";
+import { nativeSqlAlias, type NativeSqlTables, type SqlTable } from "./native-sql-table";
 import { anySqlCondition, exactSqlText } from "./sql-change";
+import { guardSqlitePolicy, type SqlitePolicyValue } from "./sqlite-policy-guard";
 import type { AnyTableModel } from "./table-model";
 
 export const sessionUnavailable = () => SessionUnavailable.make({});
@@ -72,6 +73,7 @@ export type NativeSessionAuthorityMapping = SessionAuthorityTables<
 export interface NativeSessionAuthority {
   readonly native: unknown;
   readonly row: Record<string, unknown>;
+  readonly policyValues: ReadonlyArray<SqlitePolicyValue>;
   readonly revision: AuthenticationRevision;
   readonly requirement: AuthenticationRequirement;
   readonly now: number;
@@ -133,13 +135,15 @@ export const makeNativeSessionAuthorityState = Effect.fnUntraced(function* (
   const decode = Effect.fnUntraced(function* (
     subjectId: SubjectId,
     native: unknown,
-    row: Record<string, unknown>,
+    projected: Record<string, unknown>,
     factors: ReadonlyArray<Record<string, unknown>>,
     instant: unknown,
   ): Effect.fn.Return<
     NativeSessionAuthority | undefined,
     PersistenceMappingError | Schema.SchemaError
   > {
+    const row = subject.decode(projected, "s_");
+
     sessionInvariant((yield* mapping.subjectId.toSubject(row[s.id])) === subjectId);
     if (!s.isActiveStatus(row[s.status])) return undefined;
     const credentials: { credentialId: string; revision: string }[] = [];
@@ -161,6 +165,16 @@ export const makeNativeSessionAuthorityState = Effect.fnUntraced(function* (
     return {
       native,
       row,
+      // Compare the selected SQL representation, without round-tripping through
+      // application codecs (for example, JSON whitespace or date precision).
+      policyValues: batch
+        ? (s.requirementColumns ?? []).map((key) => ({
+            column: subject.selectedColumn(key),
+            value: fragment([
+              parameter(projected[nativeSqlAlias("s_", subject.keys.indexOf(key))]),
+            ]),
+          }))
+        : [],
       revision: yield* Schema.decodeUnknownEffect(AuthenticationRevision)({
         subjectId,
         securityRevision: row[s.securityRevision],
@@ -188,7 +202,7 @@ export const makeNativeSessionAuthorityState = Effect.fnUntraced(function* (
       return yield* decode(
         subjectId,
         native,
-        subject.decode(owners[0], "s_"),
+        owners[0],
         factors.map((row) => credential.decode(row, "c_")),
         owners[0].engine_now,
       );
@@ -202,18 +216,23 @@ export const makeNativeSessionAuthorityState = Effect.fnUntraced(function* (
     return yield* decode(
       subjectId,
       native,
-      joinedSubject.decode(rows[0], "s_"),
+      rows[0],
       rows.map((row) => joinedCredential.decode(row, "c_")),
       rows[0].engine_now,
     );
   });
 
-  const policyCondition = (row: Record<string, unknown>, native: unknown): Fragment => {
-    if (!batch) return sql`1 = 1`;
+  const guardPolicy = Effect.fnUntraced(function* (current: NativeSessionAuthority) {
+    if (!batch) return;
     sessionInvariant(s.requirementColumns !== undefined);
 
-    return sql`exists(select 1 from ${subject.name} where ${id(subject, s.id, native)} and ${sql.and(s.requirementColumns.map((key) => (row[key] === null ? sql`${subject.column(key)} is null` : typeof row[key] === "string" ? exact(subject, key, row[key]) : id(subject, key, row[key]))))})`;
-  };
+    yield* guardSqlitePolicy({
+      name: "session-subject-policy",
+      table: subject.name,
+      owner: id(subject, s.id, current.native),
+      values: current.policyValues,
+    });
+  });
 
   const authorityCondition = (revision: AuthenticationRevision, native: unknown): Fragment =>
     sql.and([
@@ -242,7 +261,7 @@ export const makeNativeSessionAuthorityState = Effect.fnUntraced(function* (
     decode,
     read,
     authorityCondition,
-    policyCondition,
+    guardPolicy,
   };
 });
 

package/src/internal/session-native-stateful.ts

@@ -261,7 +261,9 @@ export const makeNativeStatefulSessionServices = Effect.fnUntraced(function* <Cl
             };
 
             const deadline = Math.min(expires, assessment.validUntil, pendingExpiry);
-            const condition = sql`${state.authorityCondition(current.revision, current.native)} and ${state.policyCondition(current.row, current.native)} and ${now} >= ${current.now} and ${now} < ${deadline}`;
+
+            yield* state.guardPolicy(current);
+            const condition = sql`${state.authorityCondition(current.revision, current.native)} and ${now} >= ${current.now} and ${now} < ${deadline}`;
 
             const values = {
               ...s.encodeInsert(record, { subjectId: current.native, sessionId: nativeSession }),

package/src/internal/session-native-step-up.ts

@@ -211,7 +211,8 @@ export const makeNativeSessionStepUpServices = Effect.fnUntraced(function* <Clai
           const intent = { ...input, version },
             snapshot = yield* encodeStepUpIntent(intent);
 
-          const condition = sql`${state.authorityCondition(intent.revision, current.native)} and ${state.policyCondition(current.row, current.native)} and ${original.condition} and ${now} >= ${DateTime.toEpochMillis(intent.sourceAuthenticatedAt)} and ${now} < ${DateTime.toEpochMillis(intent.expiresAt)}`;
+          yield* state.guardPolicy(current);
+          const condition = sql`${state.authorityCondition(intent.revision, current.native)} and ${original.condition} and ${now} >= ${DateTime.toEpochMillis(intent.sourceAuthenticatedAt)} and ${now} < ${DateTime.toEpochMillis(intent.expiresAt)}`;
 
           yield* pending
             .insert(
@@ -340,7 +341,9 @@ export const makeNativeSessionStepUpServices = Effect.fnUntraced(function* <Clai
           )
             return yield* SessionStepUpInvalid.make({});
           const snapshot = yield* encodeStepUpIntent(intent);
-          const authority = sql`${state.authorityCondition(evidence.revision, current.native)} and ${state.policyCondition(current.row, current.native)} and ${now} >= ${current.now} and ${now} < ${deadline}`;
+
+          yield* state.guardPolicy(current);
+          const authority = sql`${state.authorityCondition(evidence.revision, current.native)} and ${now} >= ${current.now} and ${now} < ${deadline}`;
 
           yield* pending.consume(
             "StepUp",

package/src/internal/sql-change.ts

@@ -1,5 +1,5 @@
 import { Effect, Schema } from "effect";
-import type { SqlClient } from "effect/sql/SqlClient";
+import { SqlClient } from "effect/sql/SqlClient";
 import type { SqlError } from "effect/sql/SqlError";
 import { join, type Fragment } from "effect/sql/Statement";
 
@@ -25,6 +25,19 @@ export const anySqlCondition: (conditions: ReadonlyArray<Fragment>) => Fragment
   "1 = 0",
 );
 
+/** Exact text comparison and ordering, independent of the column's collation. */
+export const sqlTextBytes = Effect.fnUntraced(function* (
+  value: Fragment,
+): Effect.fn.Return<Fragment, never, SqlClient> {
+  const sql = (yield* SqlClient).withoutTransforms();
+
+  return sql.onDialectOrElse({
+    mysql: () => sql`binary ${value}`,
+    pg: () => sql`convert_to(cast(${value} as text), 'UTF8')`,
+    orElse: () => sql`cast(${value} as blob)`,
+  });
+});
+
 /** Keep the indexed predicate and reject collation aliases of security tokens. */
 export const exactSqlText = (sql: SqlClient, left: Fragment, right: Fragment) =>
   sql.and([

package/src/internal/sqlite-policy-guard.ts

@@ -0,0 +1,34 @@
+import { Array, Effect } from "effect";
+import { SqlClient } from "effect/sql/SqlClient";
+import type { Fragment } from "effect/sql/Statement";
+
+import { appendSqlBatchStatement, registerSqlBatchPostcondition } from "./sql-commit";
+
+export interface SqlitePolicyValue {
+  readonly column: Fragment;
+  readonly value: Fragment;
+}
+
+/** Check original values before writes and at the end of the same atomic batch.
+ * Small groups bound parameters and expression depth without expanding retained
+ * values into hex/JSON. BINARY preserves text bytes; IS also compares NULLs. */
+export const guardSqlitePolicy = Effect.fnUntraced(function* (input: {
+  readonly name: string;
+  readonly table: Fragment;
+  readonly owner: Fragment;
+  readonly values: ReadonlyArray<SqlitePolicyValue>;
+}) {
+  const sql = (yield* SqlClient).withoutTransforms();
+
+  for (const values of Array.chunksOf(input.values, 32)) {
+    const matches = sql.and(
+      values.map(({ column, value }) => sql`${column} collate binary is ${value}`),
+    );
+
+    const condition = sql`exists(select 1 from ${input.table} where ${input.owner} and ${matches})`;
+    const statement = sql`select case when ${condition} then 1 else json_extract('[]', '$[auth-batch-precondition]') end as valid`;
+
+    yield* appendSqlBatchStatement(statement);
+    yield* registerSqlBatchPostcondition({ name: input.name, statement });
+  }
+});

package/src/internal/storage-mapping.ts

@@ -16,6 +16,7 @@ import {
   type StatefulSessionRecord,
 } from "@yielded/auth/Sessions";
 import { Crypto, DateTime, Effect, Redacted, Schema, Struct } from "effect";
+import { SqlClient } from "effect/sql";
 
 import type { MappingInput } from "./configuration";
 import { randomId } from "./crypto";
@@ -27,6 +28,8 @@ import {
 } from "./models/password-model";
 import { requiredProofConstraints, type AnyProofPersistenceMapping } from "./models/proof-model";
 import type { StatefulSessionMapping, PendingAuthenticationMapping } from "./models/session-model";
+import type { NativeSqlTables } from "./native-sql-table";
+import { exactSqlText } from "./sql-change";
 import { makeStorageClock } from "./storage-clock";
 import { storageTables, type StorageRole } from "./storage-tables";
 import type { TableModel, SqlExpression } from "./table-model";
@@ -40,12 +43,16 @@ const string = (value: unknown) => Schema.decodeUnknownSync(Schema.String)(value
 
 /** Derive shared row mappings from a managed or custom storage layout.
  * Acquire Effect Crypto once; the returned allocators retain that implementation.
- * Each factory requires its role tables to exist. Adapter authors supply typed
- * table handles and dialect-specific clocks/commit predicates, and may refine
- * authority policy for explicit services. This does not alter composed defaults.
+ * Each factory requires its role tables to exist. Supplying native tables derives
+ * batch commit predicates and subject policy columns. Adapter authors may refine
+ * clocks and authority policy for explicit services.
  */
-export const makeMappings = Effect.fnUntraced(function* (input: MappingInput) {
+export const makeMappings = Effect.fnUntraced(function* (
+  input: MappingInput,
+  tables?: NativeSqlTables,
+) {
   const crypto = yield* Crypto.Crypto;
+  const sql = (yield* SqlClient.SqlClient).withoutTransforms();
 
   const allocate = randomId.pipe(
     Effect.provideService(Crypto.Crypto, crypto),
@@ -67,12 +74,27 @@ export const makeMappings = Effect.fnUntraced(function* (input: MappingInput) {
 
   const { subjects: s, encodeInstant: instant, decodeInstant: readInstant } = input;
   const subjectId = { toNative: s.toNative, toSubject: s.toSubject, equals: Object.is };
+  const identifierTable = tables?.(table("identifiers"));
+
+  const activeIdentifier =
+    identifierTable === undefined
+      ? undefined
+      : sql`${identifierTable.column("active")} = ${identifierTable.value("active", true)}`;
 
   const subject = {
     table: s.table,
     id: s.id,
     status: s.status,
     securityRevision: s.securityRevision,
+    // Policy callbacks may read any application column. Identity, status and
+    // security revision have their own final checks and can be intentionally revised.
+    ...(tables === undefined
+      ? {}
+      : {
+          requirementColumns: tables(s.table).keys.filter(
+            (key) => key !== s.id && key !== s.status && key !== s.securityRevision,
+          ),
+        }),
     isActiveStatus: (value: unknown) => Object.is(value, s.activeValue),
     d1ActiveStatusValue: s.activeValue,
     activeStatusValue: s.activeValue,
@@ -88,6 +110,7 @@ export const makeMappings = Effect.fnUntraced(function* (input: MappingInput) {
     revision: "revision",
     status: "active",
     activeStatusValue: true,
+    d1ActiveStatusValue: true,
     isActiveStatus: (value: unknown) => value === true,
     encodeInsert: (row: object) => ({ ...row, active: true }),
     encodeRevision: (revision: SecurityRevision) => ({ revision }),
@@ -142,6 +165,11 @@ export const makeMappings = Effect.fnUntraced(function* (input: MappingInput) {
         verifiedAt: "verifiedAt",
         bindingRevision: "revision",
         isCurrent: (row) => row.active === true,
+        ...(activeIdentifier === undefined
+          ? {}
+          : {
+              d1CurrentCondition: () => activeIdentifier,
+            }),
         encodeInitialInsert: (identifier, subjectId, revision) => ({
           ...identifier,
           subjectId,
@@ -230,6 +258,14 @@ export const makeMappings = Effect.fnUntraced(function* (input: MappingInput) {
       bindingRevision: "revision",
       isCurrent: (row) => row.active === true && row.verifiedAt !== null,
       isMutableTarget: (row) => row.active === true && row.verifiedAt === null,
+      ...(identifierTable === undefined || activeIdentifier === undefined
+        ? {}
+        : {
+            d1CurrentCondition: ({ bindingRevision }) =>
+              sql`${activeIdentifier} and ${identifierTable.column("verifiedAt")} is not null and ${exactSqlText(sql, identifierTable.column("revision"), identifierTable.value("revision", bindingRevision))}`,
+            d1MutableTargetCondition: () =>
+              sql`${activeIdentifier} and ${identifierTable.column("verifiedAt")} is null`,
+          }),
       encodeVerifiedInsert: ({ identifier, subjectId, verifiedAtMillis, bindingRevision }) => ({
         ...identifier,
         subjectId,