@yielded/auth-persistence 0.1.0-beta.30 → 0.1.0-beta.32

package/src/OAuthPersistence.ts

@@ -8,6 +8,7 @@ import {
   OAuthConnectedRevocations,
   OAuthUnavailable,
 } from "@yielded/auth/OAuth";
+import { reportAuthDiagnostic } from "@yielded/auth/Persistence";
 import { type Context, type Crypto, Effect, Predicate, Schema } from "effect";
 import { SqlClient } from "effect/sql";
 
@@ -49,6 +50,7 @@ import { validateSqlStorage } from "./internal/sql-storage-validation";
 import { Table } from "./internal/sql-table";
 import { requireStandalone } from "./internal/standalone";
 import type { StorageTable } from "./internal/storage-tables";
+import { withStorageValidation } from "./internal/storage-validation";
 export * from "./internal/sql-oauth-model";
 export * from "./internal/sql-oauth-connected-model";
 export * from "./internal/oauth/native-layers";
@@ -77,10 +79,13 @@ const acquire = Effect.gen(function* () {
   if (
     !client.onDialectOrElse({ pg: () => true, sqlite: () => true, orElse: () => false }) ||
     Predicate.hasProperty(client, "~@effect/sql-d1/D1Client")
-  )
+  ) {
+    yield* reportAuthDiagnostic("persistence-validation", "configuration");
+
     return yield* PersistenceConfigurationError.make({
       reason: "OAuth persistence requires PostgreSQL or SQLite with interactive transactions",
     });
+  }
 
   return { client, tables: makeNativeSqlTables(client) };
 });
@@ -96,7 +101,7 @@ const using = <M, A, E, R>(
     yield* validateSqlStorage(mapping).pipe(Effect.mapError(() => OAuthUnavailable.make({})));
 
     return yield* make(target.tables, mapping);
-  });
+  }).pipe(withStorageValidation);
 
 const coordinate = <S, A, E, R, ES, RS>(
   make: Effect.Effect<S, ES, RS>,

package/src/internal/configuration.ts

@@ -1,5 +1,11 @@
 import type { EmailAction, EmailAddressPersistence } from "@yielded/auth/Email";
 import type { LoginIdentifier } from "@yielded/auth/Identity";
+import type {
+  OAuthConnectedPersistence,
+  OAuthConnectedPolicy,
+  OAuthConnectedRevocations,
+  OAuthSignInPersistence,
+} from "@yielded/auth/OAuth";
 import type {
   PasskeyActionChallenge,
   PasskeyConfig,
@@ -44,10 +50,19 @@ export interface PasskeyFeature {
   readonly managementPolicy?: PasskeyManagementPolicy;
 }
 
+export interface OAuthFeature {
+  readonly kind: "oauth";
+  readonly moduleId: string;
+  readonly signIn: boolean;
+  readonly connected?: OAuthConnectedPolicy;
+}
+
 export interface Strategy {
   readonly strategy: object;
+  /** Absent metadata leaves the strategy's persistence services application-supplied. */
   readonly persistence?:
     | PasskeyFeature
+    | OAuthFeature
     | {
         readonly kind: "password" | "phone" | "email";
         readonly moduleId: string;
@@ -69,7 +84,7 @@ export interface Definition<C extends ClaimsCodec, Id extends string> {
 type KeyId<T> = T extends Context.Key<infer Id, infer _Service> ? Id : never;
 type Enabled<
   A extends { readonly strategies: Readonly<Record<string, Strategy>> },
-  Kind extends "password" | "phone" | "email" | "passkey",
+  Kind extends "password" | "phone" | "email" | "passkey" | "oauth",
 > = Extract<A["strategies"][keyof A["strategies"]], { persistence: { kind: Kind } }>;
 
 type ManagedPassword<A extends { readonly strategies: Readonly<Record<string, Strategy>> }> =
@@ -82,6 +97,14 @@ export type PasskeyRequirement<
   A extends { readonly strategies: Readonly<Record<string, Strategy>> },
 > = Enabled<A, "passkey"> extends never ? never : PasskeyConfig;
 
+type OAuthSignIn<A extends { readonly strategies: Readonly<Record<string, Strategy>> }> = Extract<
+  Enabled<A, "oauth">,
+  { persistence: { signIn: true } }
+>;
+
+type OAuthConnected<A extends { readonly strategies: Readonly<Record<string, Strategy>> }> =
+  Extract<Enabled<A, "oauth">, { persistence: { connected: OAuthConnectedPolicy } }>;
+
 type RegistrationKey<S> = S extends { readonly RegistrationAuthority: infer K } ? K : never;
 type Registration<S> =
   RegistrationKey<S> extends Context.Key<infer _Id, infer Service>
@@ -97,6 +120,27 @@ export interface ProvisioningId<Id extends string> {
   readonly service: "PersistenceProvisioning";
 }
 
+export interface SubjectProvisioningInput<Registration> {
+  readonly requestId: string;
+  readonly identifier: LoginIdentifier;
+  readonly registration: Registration;
+}
+
+/** Return application subject values for insertion by the auth commit owner.
+ * Include the allocated native ID, active status, and initial security revision.
+ * Preparing values may allocate IDs, but must not write to the database or perform
+ * external side effects. Interactive drivers also accept an existing insert callback.
+ */
+export type SubjectProvisioning<Registration> =
+  | {
+      readonly values: (
+        input: SubjectProvisioningInput<Registration>,
+      ) => Effect.Effect<Readonly<Record<string, unknown>>, PasswordUnavailable>;
+    }
+  | ((
+      input: SubjectProvisioningInput<Registration>,
+    ) => Effect.Effect<SubjectId, PasswordUnavailable>);
+
 export type Provisioning<A extends { readonly strategies: Readonly<Record<string, Strategy>> }> = {
   readonly [
     K in keyof A["strategies"] as A["strategies"][K] extends {
@@ -104,11 +148,7 @@ export type Provisioning<A extends { readonly strategies: Readonly<Record<string
     }
       ? K
       : never
-  ]: (input: {
-    readonly requestId: string;
-    readonly identifier: LoginIdentifier;
-    readonly registration: Registration<A["strategies"][K]>;
-  }) => Effect.Effect<SubjectId, PasswordUnavailable>;
+  ]: SubjectProvisioning<Registration<A["strategies"][K]>>;
 };
 
 export type ProvisioningRequirement<
@@ -124,8 +164,11 @@ type UsesProofs<A extends { readonly strategies: Readonly<Record<string, Strateg
 
 export type Ports<C extends ClaimsCodec, Id extends string, A extends Definition<C, Id>> =
   | AuthenticationAuthority
-  | KeyId<A["sessions"]["StatefulSessionPersistence"]>
-  | KeyId<A["sessions"]["SessionRepository"]>
+  | ("stateful" extends A["sessionMode"]
+      ?
+          | KeyId<A["sessions"]["StatefulSessionPersistence"]>
+          | KeyId<A["sessions"]["SessionRepository"]>
+      : never)
   | KeyId<A["sessions"]["PendingAuthentication"]>
   | KeyId<A["sessions"]["SessionStepUpPersistence"]>
   | KeyId<A["sessions"]["SessionCleanup"]>
@@ -135,17 +178,26 @@ export type Ports<C extends ClaimsCodec, Id extends string, A extends Definition
   | (ManagedPasskey<A> extends never ? never : PasskeyManagementPersistence)
   | (Enabled<A, "email"> extends never ? never : EmailAddressPersistence)
   | (UsesProofs<A> extends never ? never : ProofPersistence)
-  | (Enabled<A, "phone"> extends never ? never : PhoneSignInTargets);
+  | (Enabled<A, "phone"> extends never ? never : PhoneSignInTargets)
+  | (OAuthSignIn<A> extends never ? never : OAuthSignInPersistence)
+  | (OAuthConnected<A> extends never
+      ? never
+      : OAuthConnectedPersistence | OAuthConnectedRevocations);
 
 export type Roles<C extends ClaimsCodec, Id extends string, A extends Definition<C, Id>> =
   | "identifiers"
   | "credentials"
-  | "sessions"
+  | ("stateful" extends A["sessionMode"] ? "sessions" : never)
   | "pending"
   | (Enabled<A, "password"> extends never ? never : "passwords")
   | (Enabled<A, "email"> extends never ? never : "emailCredentials")
   | (Enabled<A, "passkey"> extends never ? never : "passkeyCredentials" | "passkeyFlows")
-  | (UsesProofs<A> extends never ? never : ProofRoles);
+  | (UsesProofs<A> extends never ? never : ProofRoles)
+  | (Enabled<A, "oauth"> extends never ? never : "oauthIdentities" | "oauthCredentials")
+  | (OAuthSignIn<A> extends never ? never : "oauthSignInFlows")
+  | (OAuthConnected<A> extends never
+      ? never
+      : "oauthConnectedFlows" | "oauthConnectedGrants" | "oauthConnectedRevocations");
 
 export interface SubjectOptions<T extends object, NativeId> {
   readonly table: T;
@@ -217,14 +269,19 @@ export interface BoundPersistence<
       value: StorageLayout<T, Roles<C, Id, A>>,
     ) => Layer.Layer<ConfigId<A["namespace"]>>;
   };
-  /** Create only the application subject. Runs inside the owning auth SQL transaction;
-   * use that SqlClient (including Drizzle over it), and return the new subject ID.
-   * Do not perform external side effects or open an independent transaction here.
+  /** Supply subject values through `{ values }` on every driver, including D1.
+   * Interactive drivers also accept callbacks that insert through the owning
+   * SqlClient and return the new subject ID. Never open an independent transaction
+   * or perform external side effects while preparing a subject.
    */
   readonly Provisioning: Context.Service<ProvisioningRequirement<A>, Provisioning<A>>;
-  /** Capture dependencies at acquisition; validate SQL metadata and configure storage
+  /** Stateful sessions and OAuth-only stateless sessions are supported. Other session
+   * configurations fail acquisition with PersistenceConfigurationError.
+   * Capture dependencies at acquisition; validate SQL metadata and configure storage
    * once on the first service operation. Initialization failures become that port's
    * unavailable error. Failure or interruption remains cached until layer reacquisition.
+   * Managed OAuth metadata/token-use authorizations bind policyRevision to the subject's
+   * securityRevision; changes to application authorization policy must advance it.
    */
   readonly layer: Layer.Layer<
     Ports<C, Id, A>,

package/src/internal/email-native.ts

@@ -250,11 +250,19 @@ export const makeNativeEmailAddressServices = Effect.fnUntraced(function* (
           .filter((time) => time > current.now)
           .sort((a, b) => a - b);
 
-        const deadline = boundaries.find((time) =>
-          requirements.some(
-            (r) => !passwordEvidenceSatisfiedAt(input.authorization.evidence, r, time),
-          ),
-        );
+        let deadline: number | undefined;
+
+        for (const time of boundaries) {
+          for (const requirement of requirements) {
+            if (
+              !(yield* passwordEvidenceSatisfiedAt(input.authorization.evidence, requirement, time))
+            ) {
+              deadline = time;
+              break;
+            }
+          }
+          if (deadline !== undefined) break;
+        }
 
         ensure(deadline !== undefined);
         const freshness = sql`${now} >= ${current.now} and ${now} < ${deadline}`;
@@ -470,7 +478,9 @@ export const makeNativeEmailAddressServices = Effect.fnUntraced(function* (
               );
               const policy = yield* s.decodeActionRequirement(final.subject, action);
 
-              ensure(passwordEvidenceSatisfiedAt(input.authorization.evidence, policy, final.now));
+              ensure(
+                yield* passwordEvidenceSatisfiedAt(input.authorization.evidence, policy, final.now),
+              );
               if (source !== undefined)
                 ensure(
                   final.sourceIdentifier !== undefined &&

package/src/internal/email-policy.ts

@@ -14,7 +14,7 @@ import {
   type AuthenticationRequirement,
   type SecurityRevision,
 } from "@yielded/auth/Sessions";
-import { Effect } from "effect";
+import { DateTime, Effect } from "effect";
 
 import { PersistenceMappingError } from "./mapping-error";
 import type { AnyEmailAddressMapping } from "./models/email-model";
@@ -171,12 +171,21 @@ export const validateEmailMutation = Effect.fn("EmailAddressPersistence.validate
 
     const currentRequirement = yield* current.requirement;
 
+    // Address custody retains strict future-proof rejection.
+    if (
+      input.authorization.evidence.proofs.some(
+        (proof) => DateTime.toEpochMillis(proof.verifiedAt) > now,
+      )
+    )
+      return false;
+
     return (
-      passwordEvidenceSatisfiedAt(
+      (yield* passwordEvidenceSatisfiedAt(
         input.authorization.evidence,
         input.authorization.requirement,
         now,
-      ) && passwordEvidenceSatisfiedAt(input.authorization.evidence, currentRequirement, now)
+      )) &&
+      (yield* passwordEvidenceSatisfiedAt(input.authorization.evidence, currentRequirement, now))
     );
   },
 );

package/src/internal/models/oauth-model.ts

@@ -47,7 +47,11 @@ export interface OAuthSubjectReadTable<
   readonly securityRevision: Column<S>;
   readonly isActiveStatus: (value: unknown) => boolean;
   readonly activeCondition: Expression;
-  readonly decodeAuthenticationRequirement: (row: S["select"]) => AuthenticationRequirement;
+  readonly decodeAuthenticationRequirement: (
+    row: S["select"],
+  ) =>
+    | AuthenticationRequirement
+    | Effect.Effect<AuthenticationRequirement, PersistenceMappingError>;
 }
 
 export interface OAuthSubjectTable<
@@ -465,6 +469,8 @@ export interface OAuthAccountsMapping<
 }
 
 export interface OAuthRegistrationAuthority<Registration> {
+  /** Only the first confirmed registration supplies its private authentication handoff. */
+  readonly authentication?: "first-confirmed-registration";
   readonly read: (
     access: OAuthRegistrationAccess,
   ) => Effect.Effect<OAuthRegistrationInspection | undefined, OAuthUnavailable>;

package/src/internal/models/password-model.ts

@@ -23,7 +23,8 @@ export interface PasswordSubjectTable<Subject extends Table, _NativeSubjectId> {
   readonly decodeRequirement: (
     row: Subject["select"],
   ) => Effect.Effect<AuthenticationRequirement, PersistenceMappingError>;
-  /** Current policy for this exact credential mutation, decoded under the subject lock. */
+  /** Current policy for this exact credential mutation. Interactive drivers hold
+   * the subject lock; D1 guards the physical application columns through commit. */
   readonly decodeActionRequirement: (
     row: Subject["select"],
     action: PasswordAction,

package/src/internal/oauth/native-accounts.ts

@@ -14,7 +14,7 @@ import type { SqlExpression, TableModel } from "../table-model";
 import { makeOAuthNativeFlow } from "./native-flow";
 import { makeOAuthNativeMutation } from "./native-mutation";
 import { prepareOAuthNative } from "./native-sign-in";
-import { makeOAuthNativeState } from "./native-state";
+import { decodeOAuthRequirement, makeOAuthNativeState } from "./native-state";
 import { invariant, oauthIdentityKey, sameRevision, satisfies, unavailable } from "./state";
 
 // Physical metadata is validated by the adapter; schema values remain typed.
@@ -341,7 +341,7 @@ export const makeNativeOAuthAccountsServices = Effect.fnUntraced(function* (
             credentialId,
             credentialRevision,
             revision,
-            requirement: mapping.subject.decodeAuthenticationRequirement(current.subject),
+            requirement: yield* decodeOAuthRequirement(mapping.subject, current.subject),
           });
 
           return yield* prepareOAuthNative(
@@ -495,7 +495,7 @@ export const makeNativeOAuthAccountsServices = Effect.fnUntraced(function* (
           }
           const methods = [...eligible.values()];
           const facts = methods.map((entry) => entry.fact);
-          const requirement = mapping.subject.decodeAuthenticationRequirement(current.subject);
+          const requirement = yield* decodeOAuthRequirement(mapping.subject, current.subject);
 
           if (!facts.some((fact) => fact.usablePrimary) || !satisfies(facts, requirement))
             return yield* prepareOAuthNative({ _tag: "LastSignInMethod" }, prepare);

package/src/internal/oauth/native-registration.ts

@@ -293,6 +293,7 @@ export const makeNativeOAuthRegistrationServices = Effect.fnUntraced(function* <
     executor.read(Effect.provideService(effect, Crypto.Crypto, crypto));
 
   const service: OAuthRegistrationAuthority<Registration> = {
+    authentication: "first-confirmed-registration",
     read: (access) =>
       read(
         Effect.map(
@@ -399,6 +400,7 @@ export const makeNativeOAuthRegistrationServices = Effect.fnUntraced(function* <
                 (batch === undefined || (yield* sql`select 1 where ${eligible}`).length === 1);
 
               let final: Fragment = horizon(expected);
+              let authentication: M.OAuthRegistrationAuthentication | undefined;
 
               if (admitted) {
                 const nativeId = yield* mapping.allocateSubjectId;
@@ -488,14 +490,20 @@ export const makeNativeOAuthRegistrationServices = Effect.fnUntraced(function* <
 
                   invariant(a.isActiveStatus(factor[a.status]));
                   yield* state.change(authority.insert(factor));
-                  final = sql.and([
-                    horizon(expected),
-                    tables.expression(mapping.eligibility.postcondition(policy)),
-                    mutation.authorityCondition(nativeId, {
+                  authentication = M.snapshotOAuthSync(M.OAuthRegistrationAuthentication, {
+                    intent: expected,
+                    credentialId,
+                    credentialRevision: revision,
+                    revision: {
                       subjectId,
                       securityRevision: revision,
                       credentials: [{ credentialId, revision }],
-                    }),
+                    },
+                  });
+                  final = sql.and([
+                    horizon(expected),
+                    tables.expression(mapping.eligibility.postcondition(policy)),
+                    mutation.authorityCondition(nativeId, authentication.revision),
                     sql`exists(select 1 from ${credential.name} where ${credential.column(c.subjectId)} = ${credential.value(c.subjectId, nativeId)} and ${exactSqlText(sql, credential.column(c.credentialId), credential.value(c.credentialId, credentialId))} and ${exactSqlText(sql, credential.column(c.credentialRevision), credential.value(c.credentialRevision, revision))} and ${exactSqlText(sql, credential.column(c.identityKey), credential.value(c.identityKey, found.identityKey))} and ${tables.expression(c.activeCondition)})`,
                     sql`exists(select 1 from ${mutation.ownership.name} where ${mutation.ownerCondition(found.identityKey, nativeId)})`,
                   ]);
@@ -520,8 +528,11 @@ export const makeNativeOAuthRegistrationServices = Effect.fnUntraced(function* <
                   ]),
                 );
 
+              if (!admitted) return yield* rejected();
+              invariant(authentication !== undefined);
+
               return yield* prepareOAuthNative(
-                admitted ? { _tag: "Registered", replayed: false } : { _tag: "Rejected" },
+                { _tag: "Registered", replayed: false, authentication },
                 prepare,
               );
             }),

package/src/internal/oauth/native-state.ts

@@ -5,15 +5,18 @@ import {
   type OAuthCredentialKey,
 } from "@yielded/auth/OAuth";
 import type { SubjectId } from "@yielded/auth/Schema";
+import type { AuthenticationRequirement } from "@yielded/auth/Sessions";
 import { Effect, Schema } from "effect";
 import { SqlClient } from "effect/sql";
 import type { Fragment } from "effect/sql/Statement";
 
-import type { OAuthSignInMapping } from "../models/oauth-model";
+import type { PersistenceMappingError } from "../mapping-error";
+import type { OAuthSignInMapping, OAuthSubjectReadTable } from "../models/oauth-model";
 import type { NativeSqlTables } from "../native-sql-table";
 import { exactSqlText } from "../sql-change";
+import { canJoinTextColumns, withStorageValidation } from "../storage-validation";
 import type { SqlExpression, TableModel } from "../table-model";
-import { invariant, oauthIdentityKey } from "./state";
+import { invariant, oauthIdentityKey, unavailable } from "./state";
 
 // Expression handles are checked by the physical compiler, not domain codecs.
 export type OAuthNativeReadMapping = OAuthSignInMapping<
@@ -28,6 +31,15 @@ export type OAuthNativeReadMapping = OAuthSignInMapping<
 
 type Row = Readonly<Record<string, unknown>>;
 
+export const decodeOAuthRequirement = Effect.fnUntraced(function* (
+  subject: OAuthSubjectReadTable<TableModel>,
+  row: Row,
+): Effect.fn.Return<AuthenticationRequirement, PersistenceMappingError> {
+  const requirement = subject.decodeAuthenticationRequirement(row);
+
+  return yield* Effect.isEffect(requirement) ? requirement : Effect.succeed(requirement);
+});
+
 /** Unlocked snapshots and explicit subject-first reads share decoding rules.
  * No observation registry or discovered-identity placeholder is retained. */
 export const makeOAuthNativeAuthority = Effect.fnUntraced(function* (
@@ -197,19 +209,31 @@ export const makeOAuthNativeState = Effect.fnUntraced(function* (
     return sql`(select * from ${physical.name} where ${tables.expression(descriptor.activeCondition)}) as ${sql(alias)}`;
   };
 
-  const joinedIds =
-    ownership.unencodedTextColumn?.(mapping.ownership.subjectId) !== undefined &&
-    subject.unencodedTextColumn?.(mapping.subject.id) !== undefined &&
-    credential.unencodedTextColumn?.(mapping.credential.subjectId) !== undefined &&
-    authority.unencodedTextColumn?.(mapping.authority.subjectId) !== undefined;
+  const [joinedIds, joinedIdentityKeys] = yield* Effect.forEach(
+    [
+      [
+        ownership.unencodedTextColumn?.(mapping.ownership.subjectId),
+        subject.unencodedTextColumn?.(mapping.subject.id),
+        credential.unencodedTextColumn?.(mapping.credential.subjectId),
+        authority.unencodedTextColumn?.(mapping.authority.subjectId),
+      ],
+      [
+        credential.unencodedTextColumn?.(mapping.credential.identityKey),
+        ownership.unencodedTextColumn?.(mapping.ownership.identityKey),
+      ],
+    ],
+    canJoinTextColumns,
+  ).pipe(withStorageValidation, Effect.mapError(unavailable));
 
   const decodeSnapshot = Effect.fnUntraced(function* (
     rows: ReadonlyArray<Row>,
     moduleId: string,
     nativeId?: unknown,
   ) {
-    if (rows.length === 0) return undefined;
-    const owned = o.decode(rows[0]!, "o_");
+    const first = rows[0];
+
+    if (first === undefined) return undefined;
+    const owned = o.decode(first, "o_");
 
     const identity = yield* Schema.decodeUnknownEffect(OAuthExternalIdentity)({
       provider: owned[mapping.ownership.provider],
@@ -223,14 +247,14 @@ export const makeOAuthNativeState = Effect.fnUntraced(function* (
     const ownerId = mapping.ownership.decodeSubjectId(owned);
 
     if (nativeId !== undefined) invariant(mapping.subjectId.equals(ownerId, nativeId));
-    const login = c.decode(rows[0]!, "c_");
+    const login = c.decode(first, "c_");
 
     invariant(mapping.subjectId.equals(login[mapping.credential.subjectId], ownerId));
     invariant(login[mapping.credential.identityKey] === identityKey);
     invariant(mapping.credential.isActiveStatus(login[mapping.credential.status]));
 
     const current = yield* revision(
-      s.decode(rows[0]!, "s_"),
+      s.decode(first, "s_"),
       rows.map((row) => a.decode(row, "a_")),
       ownerId,
     );
@@ -251,7 +275,7 @@ export const makeOAuthNativeState = Effect.fnUntraced(function* (
       credentialId,
       credentialRevision,
       revision: current,
-      requirement: mapping.subject.decodeAuthenticationRequirement(s.decode(rows[0]!, "s_")),
+      requirement: yield* decodeOAuthRequirement(mapping.subject, s.decode(first, "s_")),
     });
   });
 
@@ -313,11 +337,7 @@ export const makeOAuthNativeState = Effect.fnUntraced(function* (
     const nativeId = yield* mapping.subjectId.toNative(input.subjectId);
     let identityKey: unknown;
 
-    const direct =
-      credential.unencodedTextColumn?.(mapping.credential.identityKey) !== undefined &&
-      ownership.unencodedTextColumn?.(mapping.ownership.identityKey) !== undefined;
-
-    if (!direct) {
+    if (!joinedIdentityKeys) {
       const selected = yield* sql`select ${credential.fields("c_")} from ${credential.name}
         where ${exact(credential.column(mapping.credential.moduleId), credential.value(mapping.credential.moduleId, input.moduleId))}
           and ${exact(credential.column(mapping.credential.credentialId), credential.value(mapping.credential.credentialId, input.credentialId))}
@@ -334,7 +354,7 @@ export const makeOAuthNativeState = Effect.fnUntraced(function* (
     const rows =
       yield* sql`select ${o.fields("o_")}, ${s.fields("s_")}, ${c.fields("c_")}, ${a.fields("a_")}
       from ${active("credential", "oauth_credential")}
-      join ${o.name} on ${direct ? exact(o.column(mapping.ownership.identityKey), c.column(mapping.credential.identityKey)) : exact(o.column(mapping.ownership.identityKey), o.value(mapping.ownership.identityKey, identityKey))}
+      join ${o.name} on ${joinedIdentityKeys ? exact(o.column(mapping.ownership.identityKey), c.column(mapping.credential.identityKey)) : exact(o.column(mapping.ownership.identityKey), o.value(mapping.ownership.identityKey, identityKey))}
         and ${owner(o, mapping.ownership.subjectId)}
       join ${active("subject", "oauth_subject")} on ${owner(s, mapping.subject.id)}
       join ${active("authority", "oauth_authority")} on ${owner(a, mapping.authority.subjectId)}