@yielded/auth-persistence 0.1.0-beta.30 → 0.1.0-beta.31

package/src/internal/persistence.ts

@@ -65,6 +65,8 @@ export interface Backend<T extends object, R, Database extends object = object>
   readonly describe: (table: T) => StorageTable;
   readonly acquire: Effect.Effect<Database, PersistenceConfigurationError, R | SqlClient.SqlClient>;
   readonly nativeTables: (database: Database) => NativeSqlTables;
+  /** Fixed atomic batches replace interactive transactions on backends such as D1. */
+  readonly batch?: (database: Database) => NonNullable<SqlBatchCommit["Service"]>;
 }
 
 const configError = (reason: string) => PersistenceConfigurationError.make({ reason });
@@ -233,194 +235,202 @@ export const createPersistence = <T extends object, R, Database extends object =
     };
 
     const services = Layer.effectContext(
-      Effect.gen(function* () {
-        const storage = yield* ConfigKey;
-        const client = yield* SqlClient.SqlClient;
-        const database = yield* backend.acquire;
-
-        const dialect = client.onDialectOrElse({
-          pg: () => "pg" as const,
-          sqlite: () => "sqlite" as const,
-          orElse: () => undefined,
-        });
+      Effect.flatMap(backend.acquire, (database) =>
+        Effect.gen(function* () {
+          const storage = yield* ConfigKey;
+          const client = yield* SqlClient.SqlClient;
+
+          const dialect = client.onDialectOrElse({
+            pg: () => "pg" as const,
+            sqlite: () => "sqlite" as const,
+            orElse: () => undefined,
+          });
 
-        if (dialect === undefined)
-          return yield* configError("Use an explicit adapter for this SQL dialect");
-        if (auth.sessionMode !== "stateful")
-          return yield* configError("The composed layer currently requires stateful sessions");
-        if (
-          features.some(
-            (feature) =>
-              feature === undefined ||
-              ("lifecycle" in feature && feature.lifecycle) ||
-              (feature.kind === "email" && !feature.addresses),
+          if (dialect === undefined)
+            return yield* configError("Use an explicit adapter for this SQL dialect");
+          if (auth.sessionMode !== "stateful")
+            return yield* configError("The composed layer currently requires stateful sessions");
+          if (
+            features.some(
+              (feature) =>
+                feature === undefined ||
+                ("lifecycle" in feature && feature.lifecycle) ||
+                (feature.kind === "email" && !feature.addresses),
+            )
           )
-        )
-          return yield* configError(
-            "Use explicit services for strategies without composed persistence support",
-          );
-        if (storage.namespace !== auth.namespace)
-          return yield* configError(
-            "Persistence configuration belongs to a different Auth definition",
-          );
-        const validations: StorageValidation[] = [];
+            return yield* configError(
+              "Use explicit services for strategies without composed persistence support",
+            );
+          if (storage.namespace !== auth.namespace)
+            return yield* configError(
+              "Persistence configuration belongs to a different Auth definition",
+            );
+          const validations: StorageValidation[] = [];
 
-        for (const role of roles) {
-          const table = (storage.schema as Partial<Record<StorageRole, T>>)[role];
+          for (const role of roles) {
+            const table = (storage.schema as Partial<Record<StorageRole, T>>)[role];
 
-          if (table === undefined) return yield* configError(`Missing ${role} table`);
-          const description = backend.describe(table);
-          const columns = description.columns;
+            if (table === undefined) return yield* configError(`Missing ${role} table`);
+            const description = backend.describe(table);
+            const columns = description.columns;
 
-          for (const name of Object.keys(storageTables[role].columns)) {
-            if (columns[name] === undefined)
-              return yield* configError(`Missing ${role}.${name} column`);
+            for (const name of Object.keys(storageTables[role].columns)) {
+              if (columns[name] === undefined)
+                return yield* configError(`Missing ${role}.${name} column`);
+            }
+            validations.push({ table: description, required: storageTables[role].unique });
           }
-          validations.push({ table: description, required: storageTables[role].unique });
-        }
-        validations.push({
-          table: backend.describe(storage.subjects.table as T),
-          required: [[storage.subjects.id]],
-        });
-        yield* validateStorageBatch(dialect, validations);
-        const mappings = yield* makeMappings(storage);
-
-        const nativeTables = backend.nativeTables(database);
-        const sessionMapping = mappings.sessions(auth.claims, auth.sessions.moduleId);
-        const pendingMapping = mappings.pending(auth.claims, auth.sessions.moduleId);
-
-        const sessionServices = yield* makeNativeStatefulSessionServices(
-          nativeTables,
-          sessionMapping,
-        );
-
-        const { authenticationAuthority } = yield* makeNativeAuthenticationAuthorityServices(
-          nativeTables,
-          sessionMapping,
-        );
-
-        const { pendingAuthentication } = yield* makeNativePendingAuthenticationServices(
-          nativeTables,
-          pendingMapping,
-        );
-
-        const { sessionStepUpPersistence } = yield* makeNativeSessionStepUpServices(nativeTables, {
-          ...pendingMapping,
-          source: {
-            kind: "Stateful",
-            session: sessionMapping.session,
-            sessionId: sessionMapping.sessionId,
-            constraints: { sessionDigest: "unique(session.digest)" },
-          },
-        });
-
-        const { sessionCleanup } = yield* makeNativeSessionCleanupServices(
-          nativeTables,
-          pendingMapping,
-        );
-
-        let context: Context.Context<never> = Context.make(
-          AuthenticationAuthority,
-          authenticationAuthority,
-        ).pipe(
-          Context.add(
-            auth.sessions.StatefulSessionPersistence,
-            sessionServices.statefulSessionPersistence,
-          ),
-          Context.add(auth.sessions.SessionRepository, sessionServices.sessionRepository),
-          Context.add(auth.sessions.PendingAuthentication, pendingAuthentication),
-          Context.add(auth.sessions.SessionStepUpPersistence, sessionStepUpPersistence),
-          Context.add(auth.sessions.SessionCleanup, sessionCleanup),
-        );
+          validations.push({
+            table: backend.describe(storage.subjects.table as T),
+            required: [[storage.subjects.id]],
+          });
+          yield* validateStorageBatch(dialect, validations);
+          const nativeTables = backend.nativeTables(database);
+          const mappings = yield* makeMappings(storage, nativeTables);
+          const sessionMapping = mappings.sessions(auth.claims, auth.sessions.moduleId);
+          const pendingMapping = mappings.pending(auth.claims, auth.sessions.moduleId);
+
+          const sessionServices = yield* makeNativeStatefulSessionServices(
+            nativeTables,
+            sessionMapping,
+          );
 
-        const proofMapping = proofs ? mappings.proofs() : undefined;
+          const { authenticationAuthority } = yield* makeNativeAuthenticationAuthorityServices(
+            nativeTables,
+            sessionMapping,
+          );
 
-        if (proofMapping !== undefined) {
-          const services = yield* makeNativeProofServices(
-            backend.nativeTables(database),
-            proofMapping,
+          const { pendingAuthentication } = yield* makeNativePendingAuthenticationServices(
+            nativeTables,
+            pendingMapping,
           );
 
-          context = Context.add(context, ProofPersistence, services.proofPersistence);
-        }
+          const { sessionStepUpPersistence } = yield* makeNativeSessionStepUpServices(
+            nativeTables,
+            {
+              ...pendingMapping,
+              source: {
+                kind: "Stateful",
+                session: sessionMapping.session,
+                sessionId: sessionMapping.sessionId,
+                constraints: { sessionDigest: "unique(session.digest)" },
+              },
+            },
+          );
 
-        if (password) {
-          const mapping = mappings.passwords();
+          const { sessionCleanup } = yield* makeNativeSessionCleanupServices(
+            nativeTables,
+            pendingMapping,
+          );
 
-          const services = yield* makeNativePasswordServices(
-            backend.nativeTables(database),
-            mapping,
-            proofMapping,
+          let context: Context.Context<never> = Context.make(
+            AuthenticationAuthority,
+            authenticationAuthority,
+          ).pipe(
+            Context.add(
+              auth.sessions.StatefulSessionPersistence,
+              sessionServices.statefulSessionPersistence,
+            ),
+            Context.add(auth.sessions.SessionRepository, sessionServices.sessionRepository),
+            Context.add(auth.sessions.PendingAuthentication, pendingAuthentication),
+            Context.add(auth.sessions.SessionStepUpPersistence, sessionStepUpPersistence),
+            Context.add(auth.sessions.SessionCleanup, sessionCleanup),
           );
 
-          context = Context.add(context, PasswordPersistence, services.passwordPersistence);
-        }
-        for (const [name, strategy] of Object.entries(auth.strategies)) {
-          if (strategy.persistence?.kind !== "password" || !strategy.persistence.management)
-            continue;
-          const key = strategy.RegistrationAuthority;
+          const proofMapping = proofs ? mappings.proofs() : undefined;
 
-          if (key === undefined)
-            return yield* configError(`Missing subject provisioning for ${name}`);
+          if (proofMapping !== undefined) {
+            const services = yield* makeNativeProofServices(
+              backend.nativeTables(database),
+              proofMapping,
+            );
 
-          const registration = yield* makeRegistrationAuthority(
-            backend.nativeTables(database),
-            mappings.passwords(),
-            ProvisioningKey,
-            name,
-          );
+            context = Context.add(context, ProofPersistence, services.proofPersistence);
+          }
 
-          context = Context.add(context, key, registration);
-        }
-        if (email)
-          context = Context.add(
-            context,
-            EmailAddressPersistence,
-            (yield* makeNativeEmailAddressServices(
+          if (password) {
+            const mapping = mappings.passwords();
+
+            const services = yield* makeNativePasswordServices(
               backend.nativeTables(database),
-              mappings.emails(),
+              mapping,
               proofMapping,
-            )).emailAddressPersistence,
-          );
+            );
+
+            context = Context.add(context, PasswordPersistence, services.passwordPersistence);
+          }
+          for (const [name, strategy] of Object.entries(auth.strategies)) {
+            if (strategy.persistence?.kind !== "password" || !strategy.persistence.management)
+              continue;
+            const key = strategy.RegistrationAuthority;
 
-        if (phone)
-          context = Context.add(
-            context,
-            PhoneSignInTargets,
-            yield* makeComposedPhoneTargets(
+            if (key === undefined)
+              return yield* configError(`Missing subject provisioning for ${name}`);
+
+            const registration = yield* makeRegistrationAuthority(
               backend.nativeTables(database),
-              storage,
-              mappings.proofs(),
-              features.flatMap((feature) => (feature?.kind === "phone" ? [feature.moduleId] : [])),
-            ),
-          );
+              mappings.passwords(),
+              ProvisioningKey,
+              name,
+            );
 
-        if (passkeys.length > 0) {
-          // Auth capability metadata determines whether PasskeyConfig is required.
-          const services = makeManagedPasskeys(
-            {
-              storage,
-              namespace: auth.namespace,
-              dialect,
-              features: passkeys,
-              passwordModules: features.flatMap((feature) =>
-                feature?.kind === "password" ? [feature.moduleId] : [],
+            context = Context.add(context, key, registration);
+          }
+          if (email)
+            context = Context.add(
+              context,
+              EmailAddressPersistence,
+              (yield* makeNativeEmailAddressServices(
+                backend.nativeTables(database),
+                mappings.emails(),
+                proofMapping,
+              )).emailAddressPersistence,
+            );
+
+          if (phone)
+            context = Context.add(
+              context,
+              PhoneSignInTargets,
+              yield* makeComposedPhoneTargets(
+                backend.nativeTables(database),
+                storage,
+                mappings.proofs(),
+                features.flatMap((feature) =>
+                  feature?.kind === "phone" ? [feature.moduleId] : [],
+                ),
               ),
-            },
-            backend.nativeTables(database),
-          ) as Effect.Effect<
-            Context.Context<never>,
-            PersistenceConfigurationError,
-            PasskeyRequirement<A> | Crypto.Crypto | LifecycleHooks | SqlClient.SqlClient
-          >;
-
-          context = Context.merge(context, yield* services);
-        }
+            );
 
-        // The checked capability metadata above determines exactly these service keys.
-        return context as Context.Context<Ports<C, Id, A>>;
-      }).pipe(
-        Effect.provideService(SqlBatchCommit, undefined),
+          if (passkeys.length > 0) {
+            // Auth capability metadata determines whether PasskeyConfig is required.
+            const services = makeManagedPasskeys(
+              {
+                storage,
+                namespace: auth.namespace,
+                dialect,
+                features: passkeys,
+                passwordModules: features.flatMap((feature) =>
+                  feature?.kind === "password" ? [feature.moduleId] : [],
+                ),
+              },
+              backend.nativeTables(database),
+            ) as Effect.Effect<
+              Context.Context<never>,
+              PersistenceConfigurationError,
+              | PasskeyRequirement<A>
+              | Crypto.Crypto
+              | LifecycleHooks
+              | SqlClient.SqlClient
+              | SqlBatchCommit
+            >;
+
+            context = Context.merge(context, yield* services);
+          }
+
+          // The checked capability metadata above determines exactly these service keys.
+          return context as Context.Context<Ports<C, Id, A>>;
+        }).pipe(Effect.provideService(SqlBatchCommit, backend.batch?.(database))),
+      ).pipe(
         withStorageValidation,
         Effect.mapError((error) =>
           Schema.is(PersistenceConfigurationError)(error)

package/src/internal/registration.ts

@@ -1,12 +1,10 @@
 import type { LifecycleHooks } from "@yielded/auth/Hooks";
-import type { LoginIdentifier } from "@yielded/auth/Identity";
 import { PasswordUnavailable } from "@yielded/auth/Password";
-import type { SubjectId } from "@yielded/auth/Schema";
 import { SecurityRevision } from "@yielded/auth/Sessions";
 import { type Context, Crypto, Effect, Schema, Option, Cause } from "effect";
 import { SqlClient } from "effect/sql/SqlClient";
 
-import { PersistenceConfigurationError } from "./configuration";
+import { PersistenceConfigurationError, type SubjectProvisioning } from "./configuration";
 import { randomId } from "./crypto";
 import type { AnyPasswordPersistenceMapping } from "./models/password-model";
 import type { NativeSqlTables } from "./native-sql-table";
@@ -15,13 +13,9 @@ import {
   PasswordIdentifierTaken,
 } from "./password-registration-native";
 import type { PasswordRegistrationAuthority } from "./registration-contract";
-import { makeSqlCommitExecutor, CurrentSqlCommit } from "./sql-commit";
+import { makeSqlCommitExecutor, CurrentSqlCommit, SqlBatchCommit } from "./sql-commit";
 
-type CreateSubject = (input: {
-  readonly requestId: string;
-  readonly identifier: LoginIdentifier;
-  readonly registration: unknown;
-}) => Effect.Effect<SubjectId, PasswordUnavailable>;
+const SubjectValues = Schema.Record(Schema.String, Schema.Unknown);
 
 /** Application provisioning and the unverified identifier/password binding share
  * one physical owner. Identifier uniqueness arbitrates registration; correlation
@@ -34,49 +28,56 @@ export const makeRegistrationAuthority = Effect.fnUntraced(function* <R>(
 ): Effect.fn.Return<
   PasswordRegistrationAuthority<unknown>,
   PersistenceConfigurationError,
-  LifecycleHooks | SqlClient | Crypto.Crypto | R
+  LifecycleHooks | SqlClient | Crypto.Crypto | SqlBatchCommit | R
 > {
   const sql = (yield* SqlClient).withoutTransforms();
   const crypto = yield* Crypto.Crypto;
   const executor = yield* makeSqlCommitExecutor(() => PasswordUnavailable.make({}));
   const parent = yield* Effect.serviceOption(CurrentSqlCommit);
-  const store = yield* makeNativePasswordRegistrationStore(tables, mapping);
+  const batch = yield* SqlBatchCommit;
+  const store = yield* makeNativePasswordRegistrationStore(tables, mapping, batch !== undefined);
   // The strategy has already decoded its registration Schema. Only its callback
   // signature is erased by the heterogeneous strategy service map.
-  const creators = (yield* provisioning) as Readonly<Record<string, CreateSubject>>;
+  const creators = (yield* provisioning) as Readonly<Record<string, SubjectProvisioning<unknown>>>;
   const createSubject = creators[strategy];
 
   if (createSubject === undefined)
     return yield* PersistenceConfigurationError.make({
       reason: `Missing subject provisioning for ${strategy}`,
     });
+  if (batch !== undefined && typeof createSubject === "function")
+    return yield* PersistenceConfigurationError.make({
+      reason: `D1 subject provisioning for ${strategy} requires { values }; return the new subject row instead of inserting it`,
+    });
   const s = mapping.subject;
   const subject = tables(s.table);
   const lock = sql.onDialectOrElse({ sqlite: () => sql``, orElse: () => sql`for update` });
 
   const run = <A, E, R2>(work: Effect.Effect<A, E, R2>, suppressed: Effect.Effect<A, E, R2>) =>
-    Option.isSome(parent)
-      ? executor.run(work)
-      : executor
-          .operation(
-            work.pipe(
-              Effect.mapError((error) =>
-                error instanceof PasswordIdentifierTaken ? error : PasswordUnavailable.make({}),
+    batch !== undefined
+      ? executor.batch(work).pipe(Effect.provideService(SqlBatchCommit, batch))
+      : Option.isSome(parent)
+        ? executor.run(work)
+        : executor
+            .operation(
+              work.pipe(
+                Effect.mapError((error) =>
+                  error instanceof PasswordIdentifierTaken ? error : PasswordUnavailable.make({}),
+                ),
               ),
-            ),
-          )
-          .pipe(
-            Effect.catchCause((cause) =>
-              cause.reasons.length > 0 &&
-              cause.reasons.every(
-                (reason) =>
-                  Cause.isFailReason(reason) && reason.error instanceof PasswordIdentifierTaken,
-              )
-                ? executor.run(suppressed, "statement")
-                : Effect.failCause(cause),
-            ),
-            Effect.mapError(() => PasswordUnavailable.make({})),
-          );
+            )
+            .pipe(
+              Effect.catchCause((cause) =>
+                cause.reasons.length > 0 &&
+                cause.reasons.every(
+                  (reason) =>
+                    Cause.isFailReason(reason) && reason.error instanceof PasswordIdentifierTaken,
+                )
+                  ? executor.run(suppressed, "statement")
+                  : Effect.failCause(cause),
+              ),
+              Effect.mapError(() => PasswordUnavailable.make({})),
+            );
 
   return {
     register: (input, project) =>
@@ -86,26 +87,38 @@ export const makeRegistrationAuthority = Effect.fnUntraced(function* <R>(
             ? executor.run(store.prepare({ _tag: "Suppressed" }, project), "statement")
             : run(
                 Effect.gen(function* () {
-                  const subjectId = yield* createSubject({
+                  const provisioningInput = {
                     requestId: input.requestId,
                     identifier: input.identifier,
                     registration: input.registration,
-                  });
+                  };
 
-                  const nativeId = yield* mapping.subjectId.toNative(subjectId);
+                  const row = yield* Effect.gen(function* () {
+                    if (typeof createSubject !== "function")
+                      return yield* createSubject
+                        .values(provisioningInput)
+                        .pipe(Effect.flatMap(Schema.decodeEffect(SubjectValues)));
+                    const subjectId = yield* createSubject(provisioningInput);
+                    const nativeId = yield* mapping.subjectId.toNative(subjectId);
 
-                  const rows =
-                    yield* sql`select ${subject.fields("registration_subject_")} from ${subject.name} where ${subject.column(s.id)} = ${subject.value(s.id, nativeId)} limit 2 ${lock}`;
+                    const rows =
+                      yield* sql`select ${subject.fields("registration_subject_")} from ${subject.name} where ${subject.column(s.id)} = ${subject.value(s.id, nativeId)} limit 2 ${lock}`;
 
-                  if (rows.length !== 1) return yield* PasswordUnavailable.make({});
-                  const row = subject.decode(rows[0]!, "registration_subject_");
+                    if (rows.length !== 1) return yield* PasswordUnavailable.make({});
+
+                    return subject.decode(rows[0]!, "registration_subject_");
+                  });
 
                   if (!s.isActiveStatus(row[s.status])) return yield* PasswordUnavailable.make({});
+                  const subjectId = yield* mapping.subjectId.toSubject(row[s.id]);
 
                   const securityRevision = yield* Schema.decodeUnknownEffect(SecurityRevision)(
                     row[s.securityRevision],
                   );
 
+                  if (typeof createSubject !== "function")
+                    yield* store.stage(sql`${subject.insert(row)}`);
+
                   const identifierRevision = SecurityRevision.make(yield* randomId);
                   const credentialId = yield* randomId;
                   const credentialRevision = SecurityRevision.make(yield* randomId);

package/src/internal/session-native-authority.ts

@@ -195,7 +195,9 @@ export const makeNativeAuthenticationAuthorityServices = Effect.fnUntraced(funct
               : yield* consume(input.pending, input.evidence, current.native);
 
           const deadline = Math.min(assessment.validUntil, expires, pendingExpiry ?? Infinity);
-          const condition = sql`${state.authorityCondition(current.revision, current.native)} and ${state.policyCondition(current.row, current.native)} and ${now} >= ${current.now} and ${now} < ${deadline}`;
+
+          yield* state.guardPolicy(current);
+          const condition = sql`${state.authorityCondition(current.revision, current.native)} and ${now} >= ${current.now} and ${now} < ${deadline}`;
 
           if (batch !== undefined) {
             yield* appendSqlBatchStatement(sqlBatchAssertion(sql, condition));

package/src/internal/session-native-login.ts

@@ -129,7 +129,9 @@ export const makeNativePendingAuthenticationServices = Effect.fnUntraced(functio
 
           const record: PendingAuthenticationRecord<Claims> = { ...input, version };
           const snapshot = yield* mapping.login.encode(record);
-          const condition = sql`${state.authorityCondition(current.revision, current.native)} and ${state.policyCondition(current.row, current.native)} and ${now} >= ${current.now} and ${now} < ${expires}`;
+
+          yield* state.guardPolicy(current);
+          const condition = sql`${state.authorityCondition(current.revision, current.native)} and ${now} >= ${current.now} and ${now} < ${expires}`;
 
           if (batch !== undefined)
             yield* appendSqlBatchStatement(sqlBatchAssertion(sql, condition));

package/src/internal/session-native-pending-read.ts

@@ -47,7 +47,7 @@ export const makeNativeSessionPendingReader = Effect.fnUntraced(function* (
       const authority = yield* state.decode(
         record.subjectId,
         owner,
-        st.decode(rows[0], "s_"),
+        rows[0],
         rows.map((row) => ct.decode(row, "c_")),
         rows[0].engine_now,
       );