@yielded/auth-persistence 0.1.0-beta.29 → 0.1.0-beta.31

package/src/internal/configuration.ts

@@ -97,6 +97,27 @@ export interface ProvisioningId<Id extends string> {
   readonly service: "PersistenceProvisioning";
 }
 
+export interface SubjectProvisioningInput<Registration> {
+  readonly requestId: string;
+  readonly identifier: LoginIdentifier;
+  readonly registration: Registration;
+}
+
+/** Return application subject values for insertion by the auth commit owner.
+ * Include the allocated native ID, active status, and initial security revision.
+ * Preparing values may allocate IDs, but must not write to the database or perform
+ * external side effects. Interactive drivers also accept an existing insert callback.
+ */
+export type SubjectProvisioning<Registration> =
+  | {
+      readonly values: (
+        input: SubjectProvisioningInput<Registration>,
+      ) => Effect.Effect<Readonly<Record<string, unknown>>, PasswordUnavailable>;
+    }
+  | ((
+      input: SubjectProvisioningInput<Registration>,
+    ) => Effect.Effect<SubjectId, PasswordUnavailable>);
+
 export type Provisioning<A extends { readonly strategies: Readonly<Record<string, Strategy>> }> = {
   readonly [
     K in keyof A["strategies"] as A["strategies"][K] extends {
@@ -104,11 +125,7 @@ export type Provisioning<A extends { readonly strategies: Readonly<Record<string
     }
       ? K
       : never
-  ]: (input: {
-    readonly requestId: string;
-    readonly identifier: LoginIdentifier;
-    readonly registration: Registration<A["strategies"][K]>;
-  }) => Effect.Effect<SubjectId, PasswordUnavailable>;
+  ]: SubjectProvisioning<Registration<A["strategies"][K]>>;
 };
 
 export type ProvisioningRequirement<
@@ -217,9 +234,10 @@ export interface BoundPersistence<
       value: StorageLayout<T, Roles<C, Id, A>>,
     ) => Layer.Layer<ConfigId<A["namespace"]>>;
   };
-  /** Create only the application subject. Runs inside the owning auth SQL transaction;
-   * use that SqlClient (including Drizzle over it), and return the new subject ID.
-   * Do not perform external side effects or open an independent transaction here.
+  /** Supply subject values through `{ values }` on every driver, including D1.
+   * Interactive drivers also accept callbacks that insert through the owning
+   * SqlClient and return the new subject ID. Never open an independent transaction
+   * or perform external side effects while preparing a subject.
    */
   readonly Provisioning: Context.Service<ProvisioningRequirement<A>, Provisioning<A>>;
   /** Capture dependencies at acquisition; validate SQL metadata and configure storage

package/src/internal/models/oauth-model.ts

@@ -2,6 +2,7 @@ import type { PreparedCommit } from "@yielded/auth/Hooks";
 import type {
   OAuthActionAuthorization,
   OAuthAccountRevision,
+  OAuthLinkedAccountsRead,
   OAuthRegistrationIntent,
   OAuthExternalIdentity,
   OAuthRegistrationAccess,
@@ -442,6 +443,15 @@ export interface OAuthAccountsMapping<
   readonly subjectId: SubjectIdCodec<N>;
   readonly clock: OAuthClock<Expression>;
   readonly constraints: typeof requiredOAuthSignInConstraints;
+  /** Self-contained SQL predicate rechecking this invocation's current permission
+   * to view login metadata. Evaluated in every releasing read, alongside active
+   * subject/credential authority and ownership. Do not trust public assurance as
+   * credential provenance; bind session policy to application-owned rows as needed. */
+  readonly metadataAccess: (input: {
+    readonly invocation: OAuthLinkedAccountsRead["invocation"];
+    readonly moduleId: string;
+    readonly subjectId: N;
+  }) => Expression;
   readonly eligibility: ReadonlyArray<OAuthEligibilityDescriptor<N, Expression, Descriptor>>;
   readonly cleanup: ReadonlyArray<OAuthCleanupDescriptor<N, Expression, Descriptor>>;
   readonly sessionInvalidation: "same-authority-immediate" | "original-absolute-expiry";

package/src/internal/models/password-model.ts

@@ -23,7 +23,8 @@ export interface PasswordSubjectTable<Subject extends Table, _NativeSubjectId> {
   readonly decodeRequirement: (
     row: Subject["select"],
   ) => Effect.Effect<AuthenticationRequirement, PersistenceMappingError>;
-  /** Current policy for this exact credential mutation, decoded under the subject lock. */
+  /** Current policy for this exact credential mutation. Interactive drivers hold
+   * the subject lock; D1 guards the physical application columns through commit. */
   readonly decodeActionRequirement: (
     row: Subject["select"],
     action: PasswordAction,

package/src/internal/oauth/native-accounts.ts

@@ -8,7 +8,7 @@ import type { Fragment } from "effect/sql/Statement";
 import { type OAuthAccountsMapping, OAuthEligibilityFact } from "../models/oauth-model";
 import type { NativeSqlTables } from "../native-sql-table";
 import { makeConditionalSqlInsert } from "../session-native-record";
-import { anySqlCondition, exactSqlText } from "../sql-change";
+import { anySqlCondition, exactSqlText, sqlTextBytes } from "../sql-change";
 import { makeSqlCommitExecutor, SqlBatchCommit, CurrentSqlCommit } from "../sql-commit";
 import type { SqlExpression, TableModel } from "../table-model";
 import { makeOAuthNativeFlow } from "./native-flow";
@@ -86,6 +86,77 @@ export const makeNativeOAuthAccountsServices = Effect.fnUntraced(function* (
     ]);
 
   const service: M.OAuthAccountsPersistence["Service"] = {
+    list: (original) =>
+      read(
+        Effect.gen(function* () {
+          const input = M.snapshotOAuthSync(M.OAuthLinkedAccountsRead, original);
+          const nativeId = yield* mapping.subjectId.toNative(input.invocation.subjectId);
+
+          const metadataAccess = tables.expression(
+            mapping.metadataAccess({
+              invocation: input.invocation,
+              moduleId: input.moduleId,
+              subjectId: nativeId,
+            }),
+          );
+
+          const s = mapping.subject;
+          const orderedId = yield* sqlTextBytes(credential.column(c.credentialId));
+
+          const cursorCondition =
+            input.cursor === undefined
+              ? sql``
+              : sql`and ${orderedId} > ${yield* sqlTextBytes(credential.value(c.credentialId, input.cursor))}`;
+
+          // Bound candidate work before resolving identities. Each final read uses
+          // its columns' own codecs and rechecks live ownership/authority/policy.
+          // A removed candidate can leave a short page; the cursor still advances.
+          // Match exact credential identity even when the column's collation does not.
+          const rows = yield* sql`select ${credential.fields("page_")} from ${credential.name}
+            where ${exactSqlText(sql, credential.column(c.moduleId), credential.value(c.moduleId, input.moduleId))}
+              and ${credential.column(c.subjectId)} = ${credential.value(c.subjectId, nativeId)}
+              and ${tables.expression(c.activeCondition)} and ${metadataAccess}
+              and exists(select 1 from ${state.subject.name}
+                where ${state.subject.column(s.id)} = ${state.subject.value(s.id, nativeId)}
+                  and ${tables.expression(s.activeCondition)})
+              ${cursorCondition}
+            order by ${orderedId} limit ${input.limit + 1}`;
+
+          const selected = rows.slice(0, input.limit);
+          const items: Array<M.OAuthLinkedAccount> = [];
+          let cursor: string | undefined;
+
+          for (const row of selected) {
+            const credentialId = yield* Schema.decodeUnknownEffect(
+              M.OAuthLinkedAccount.fields.credentialId,
+            )(credential.decode(row, "page_")[c.credentialId]);
+
+            cursor = credentialId;
+
+            const current = yield* state.readCredential(
+              {
+                moduleId: input.moduleId,
+                subjectId: input.invocation.subjectId,
+                credentialId,
+              },
+              metadataAccess,
+            );
+
+            if (current !== undefined)
+              items.push(
+                M.OAuthLinkedAccount.make({
+                  credentialId: current.credentialId,
+                  ...current.identity,
+                }),
+              );
+          }
+
+          return M.snapshotOAuthSync(M.OAuthLinkedAccountsListResult, {
+            items,
+            ...(rows.length > input.limit && cursor !== undefined ? { cursor } : {}),
+          });
+        }),
+      ),
     capture: (input) =>
       read(Effect.map(state.capture(input.subjectId, false), (current) => current?.revision)),
     issue: (original, prepare) =>

package/src/internal/oauth/native-state.ts

@@ -7,6 +7,7 @@ import {
 import type { SubjectId } from "@yielded/auth/Schema";
 import { Effect, Schema } from "effect";
 import { SqlClient } from "effect/sql";
+import type { Fragment } from "effect/sql/Statement";
 
 import type { OAuthSignInMapping } from "../models/oauth-model";
 import type { NativeSqlTables } from "../native-sql-table";
@@ -305,7 +306,10 @@ export const makeOAuthNativeState = Effect.fnUntraced(function* (
     return result;
   });
 
-  const readCredential = Effect.fnUntraced(function* (input: typeof OAuthCredentialKey.Type) {
+  const readCredential = Effect.fnUntraced(function* (
+    input: typeof OAuthCredentialKey.Type,
+    metadataAccess: Fragment = sql`true`,
+  ) {
     const nativeId = yield* mapping.subjectId.toNative(input.subjectId);
     let identityKey: unknown;
 
@@ -334,7 +338,7 @@ export const makeOAuthNativeState = Effect.fnUntraced(function* (
         and ${owner(o, mapping.ownership.subjectId)}
       join ${active("subject", "oauth_subject")} on ${owner(s, mapping.subject.id)}
       join ${active("authority", "oauth_authority")} on ${owner(a, mapping.authority.subjectId)}
-      where ${owner(c, mapping.credential.subjectId)}
+      where ${metadataAccess} and ${owner(c, mapping.credential.subjectId)}
         and ${exact(c.column(mapping.credential.moduleId), c.value(mapping.credential.moduleId, input.moduleId))}
         and ${exact(c.column(mapping.credential.credentialId), c.value(mapping.credential.credentialId, input.credentialId))}
       order by ${a.column(mapping.authority.credentialId)} limit 65`;

package/src/internal/passkey-managed.ts

@@ -14,13 +14,14 @@ import {
   requiredPasskeyPersistenceConstraints,
 } from "./models/passkey-model";
 import type { NativeSqlTables } from "./native-sql-table";
-import { makeNativePasskeyServices } from "./passkey-native";
+import { makeBatchPasskeyServices, makeNativePasskeyServices } from "./passkey-native";
 import type { PasskeyNativeMapping, PasskeyNativeRead } from "./passkey-native-state";
 import {
   makePasskeyNativeManagement,
   type NativePasskeyManagementMapping,
 } from "./passkey-native-write";
 import { anySqlCondition } from "./sql-change";
+import { SqlBatchCommit } from "./sql-commit";
 import { storageTables, type StorageRole } from "./storage-tables";
 
 export interface ComposedPasskeyInput {
@@ -255,6 +256,8 @@ const mappings = Effect.fnUntraced(function* (
 /** Managed and mapped tables feed the same native passkey statements. */
 export const makeManagedPasskeys = Effect.fnUntraced(
   function* (input: ComposedPasskeyInput, tables: NativeSqlTables) {
+    const batch = yield* SqlBatchCommit;
+
     const policies = yield* Effect.forEach(input.features, (feature) =>
       Effect.map(feature.policy, (policy) => ({ feature, policy })),
     );
@@ -275,7 +278,10 @@ export const makeManagedPasskeys = Effect.fnUntraced(
 
     for (const feature of input.features) {
       const selected = feature.management ? mapping.management(feature) : mapping.base(feature);
-      const base = yield* makeNativePasskeyServices(tables, selected);
+
+      const base = yield* batch === undefined
+        ? makeNativePasskeyServices(tables, selected)
+        : makeBatchPasskeyServices(tables, selected);
 
       services.set(feature.moduleId, base);
       if (feature.management)

package/src/internal/password-native.ts

@@ -6,13 +6,13 @@ import type { SubjectId } from "@yielded/auth/Schema";
 import { SecurityRevision, type AuthenticationRequirement } from "@yielded/auth/Sessions";
 import { DateTime, Effect, Option, Redacted, Schema, Crypto } from "effect";
 import { SqlClient } from "effect/sql/SqlClient";
-import type { Fragment } from "effect/sql/Statement";
+import { fragment, parameter, type Fragment } from "effect/sql/Statement";
 
 import { sqlBatchAssertion } from "./d1-planning";
 import { PersistenceMappingError } from "./mapping-error";
 import type { AnyPasswordPersistenceMapping } from "./models/password-model";
 import type { AnyProofPersistenceMapping } from "./models/proof-model";
-import type { NativeSqlTables, SqlTable } from "./native-sql-table";
+import { nativeSqlAlias, type NativeSqlTables, type SqlTable } from "./native-sql-table";
 import { makePasswordCredentials, samePasswordCredentialSnapshot } from "./password-credentials";
 import {
   allocatePasswordNextSecurityRevision,
@@ -33,6 +33,7 @@ import {
   registerSqlPostcondition,
   SqlBatchCommit,
 } from "./sql-commit";
+import { guardSqlitePolicy } from "./sqlite-policy-guard";
 import { requireStandalone } from "./standalone";
 
 const unavailable = () => P.PasswordUnavailable.make({});
@@ -70,6 +71,12 @@ export const makeNativePasswordServices = Effect.fnUntraced(function* (
     rawPassword = tables(c.table),
     rawAuthority = tables(a.table);
 
+  // Action policy may inspect any application column. Authority columns have
+  // separate checks and securityRevision intentionally changes in this mutation.
+  const policyColumns = rawSubject.keys.filter(
+    (key) => key !== s.id && key !== s.status && key !== s.securityRevision,
+  );
+
   const now = tables.expression(mapping.clock.engineNowMillis);
   const lock = sql.onDialectOrElse({ sqlite: () => sql``, orElse: () => sql`for update` });
 
@@ -193,6 +200,17 @@ export const makeNativePasswordServices = Effect.fnUntraced(function* (
     return {
       nativeId,
       subjectRow,
+      policyValues:
+        batch === undefined
+          ? []
+          : policyColumns.map((key) => ({
+              column: rawSubject.selectedColumn(key),
+              value: fragment([
+                parameter(
+                  rows[0][nativeSqlAlias("password_subject_", rawSubject.keys.indexOf(key))],
+                ),
+              ]),
+            })),
       identifierRow,
       passwordRow,
       revision,
@@ -344,6 +362,14 @@ export const makeNativePasswordServices = Effect.fnUntraced(function* (
           );
         };
 
+        if (batch !== undefined)
+          yield* guardSqlitePolicy({
+            name: "password-subject-policy",
+            table: rawSubject.name,
+            owner: subjectKey(rawSubject, s.id, nativeId),
+            values: state.policyValues,
+          });
+
         const requestedDeadline = freshUntil(input.authorization.requirement),
           currentDeadline = freshUntil(requirement);