@yielded/auth-persistence 0.1.0-beta.30 → 0.1.0-beta.32

package/src/internal/password-native.ts

@@ -1,18 +1,19 @@
 import { CurrentCommitJournal, type LifecycleHooks } from "@yielded/auth/Hooks";
 import type { LoginIdentifier } from "@yielded/auth/Identity";
+import { AuthenticationClock } from "@yielded/auth/Operations";
 import * as P from "@yielded/auth/Password";
 import { ProofRedemptionInput } from "@yielded/auth/Proofs";
 import type { SubjectId } from "@yielded/auth/Schema";
 import { SecurityRevision, type AuthenticationRequirement } from "@yielded/auth/Sessions";
 import { DateTime, Effect, Option, Redacted, Schema, Crypto } from "effect";
 import { SqlClient } from "effect/sql/SqlClient";
-import type { Fragment } from "effect/sql/Statement";
+import { fragment, parameter, type Fragment } from "effect/sql/Statement";
 
 import { sqlBatchAssertion } from "./d1-planning";
 import { PersistenceMappingError } from "./mapping-error";
 import type { AnyPasswordPersistenceMapping } from "./models/password-model";
 import type { AnyProofPersistenceMapping } from "./models/proof-model";
-import type { NativeSqlTables, SqlTable } from "./native-sql-table";
+import { nativeSqlAlias, type NativeSqlTables, type SqlTable } from "./native-sql-table";
 import { makePasswordCredentials, samePasswordCredentialSnapshot } from "./password-credentials";
 import {
   allocatePasswordNextSecurityRevision,
@@ -33,6 +34,7 @@ import {
   registerSqlPostcondition,
   SqlBatchCommit,
 } from "./sql-commit";
+import { guardSqlitePolicy } from "./sqlite-policy-guard";
 import { requireStandalone } from "./standalone";
 
 const unavailable = () => P.PasswordUnavailable.make({});
@@ -51,6 +53,7 @@ export const makeNativePasswordServices = Effect.fnUntraced(function* (
   SqlClient | LifecycleHooks | Crypto.Crypto | SqlBatchCommit
 > {
   const batch = yield* SqlBatchCommit;
+  const clockPolicy = yield* AuthenticationClock;
   const sql = (yield* SqlClient).withoutTransforms();
   const executor = yield* makeSqlCommitExecutor(unavailable);
   const crypto = yield* Crypto.Crypto;
@@ -70,6 +73,12 @@ export const makeNativePasswordServices = Effect.fnUntraced(function* (
     rawPassword = tables(c.table),
     rawAuthority = tables(a.table);
 
+  // Action policy may inspect any application column. Authority columns have
+  // separate checks and securityRevision intentionally changes in this mutation.
+  const policyColumns = rawSubject.keys.filter(
+    (key) => key !== s.id && key !== s.status && key !== s.securityRevision,
+  );
+
   const now = tables.expression(mapping.clock.engineNowMillis);
   const lock = sql.onDialectOrElse({ sqlite: () => sql``, orElse: () => sql`for update` });
 
@@ -80,11 +89,12 @@ export const makeNativePasswordServices = Effect.fnUntraced(function* (
     sql`${table.column(key)} = ${table.value(key, nativeId)}`;
 
   const run = <A, E, R>(work: Effect.Effect<A, E, R>) =>
-    batch === undefined
+    (batch === undefined
       ? executor.run(work.pipe(Effect.provideService(Crypto.Crypto, crypto)))
       : executor
           .batch(work.pipe(Effect.provideService(Crypto.Crypto, crypto)))
-          .pipe(Effect.provideService(SqlBatchCommit, batch));
+          .pipe(Effect.provideService(SqlBatchCommit, batch))
+    ).pipe(Effect.provideService(AuthenticationClock, clockPolicy));
 
   const read = Effect.fnUntraced(function* (
     moduleId: string,
@@ -193,6 +203,17 @@ export const makeNativePasswordServices = Effect.fnUntraced(function* (
     return {
       nativeId,
       subjectRow,
+      policyValues:
+        batch === undefined
+          ? []
+          : policyColumns.map((key) => ({
+              column: rawSubject.selectedColumn(key),
+              value: fragment([
+                parameter(
+                  rows[0][nativeSqlAlias("password_subject_", rawSubject.keys.indexOf(key))],
+                ),
+              ]),
+            })),
       identifierRow,
       passwordRow,
       revision,
@@ -328,7 +349,9 @@ export const makeNativePasswordServices = Effect.fnUntraced(function* (
             verifierVersion !== input.credential?.verifierVersion,
         );
 
-        const freshUntil = (requirement: AuthenticationRequirement) => {
+        const freshUntil = Effect.fnUntraced(function* (
+          requirement: AuthenticationRequirement,
+        ): Effect.fn.Return<number | undefined> {
           const deadlines = [
             ...new Set(
               input.authorization.evidence.proofs.map(
@@ -339,13 +362,24 @@ export const makeNativePasswordServices = Effect.fnUntraced(function* (
             .filter((time) => time > state.now)
             .sort((a, b) => a - b);
 
-          return deadlines.find(
-            (time) => !passwordEvidenceSatisfiedAt(input.authorization.evidence, requirement, time),
-          );
-        };
+          for (const time of deadlines) {
+            if (
+              !(yield* passwordEvidenceSatisfiedAt(input.authorization.evidence, requirement, time))
+            )
+              return time;
+          }
+        });
+
+        if (batch !== undefined)
+          yield* guardSqlitePolicy({
+            name: "password-subject-policy",
+            table: rawSubject.name,
+            owner: subjectKey(rawSubject, s.id, nativeId),
+            values: state.policyValues,
+          });
 
-        const requestedDeadline = freshUntil(input.authorization.requirement),
-          currentDeadline = freshUntil(requirement);
+        const requestedDeadline = yield* freshUntil(input.authorization.requirement),
+          currentDeadline = yield* freshUntil(requirement);
 
         ensure(requestedDeadline !== undefined && currentDeadline !== undefined);
         const deadline = Math.min(requestedDeadline, currentDeadline);

package/src/internal/password-policy.ts

@@ -1,4 +1,5 @@
 import type { LoginIdentifier } from "@yielded/auth/Identity";
+import { AuthenticationClock } from "@yielded/auth/Operations";
 import {
   PasswordUnavailable,
   snapshotPasswordCredential,
@@ -47,11 +48,13 @@ export const samePasswordCredential = (
   samePasswordIdentifier(left.identifier, right.identifier) &&
   Redacted.value(left.verifier) === Redacted.value(right.verifier);
 
-export const passwordEvidenceSatisfiedAt = (
+export const passwordEvidenceSatisfiedAt = Effect.fnUntraced(function* (
   evidence: AuthenticationEvidence,
   requirement: AuthenticationRequirement,
   now: number,
-): boolean => {
+): Effect.fn.Return<boolean> {
+  const { futureToleranceMillis } = yield* AuthenticationClock;
+
   if (evidence.proofs.length > 64 || evidence.revision.credentials.length > 64) return false;
   const revisions = new Map<string, string>();
 
@@ -60,12 +63,17 @@ export const passwordEvidenceSatisfiedAt = (
     revisions.set(item.credentialId, item.revision);
   }
   if (evidence.proofs.some((proof) => !revisions.has(proof.credentialId))) return false;
-  if (evidence.proofs.some((proof) => now < DateTime.toEpochMillis(proof.verifiedAt))) return false;
+  if (
+    evidence.proofs.some(
+      (proof) => DateTime.toEpochMillis(proof.verifiedAt) - now > futureToleranceMillis,
+    )
+  )
+    return false;
 
   const eligible = evidence.proofs.filter((proof) => {
-    const age = now - DateTime.toEpochMillis(proof.verifiedAt);
+    const age = Math.max(0, now - DateTime.toEpochMillis(proof.verifiedAt));
 
-    return age >= 0 && age < requirement.maximumAgeMillis;
+    return age < requirement.maximumAgeMillis;
   });
 
   const factors = new Set(eligible.flatMap((proof) => proof.factors));
@@ -81,7 +89,7 @@ export const passwordEvidenceSatisfiedAt = (
           (!alternative.phishingResistant || proof.phishingResistant),
       ),
   );
-};
+});
 
 export const snapshotPasswordMutation = Effect.fn("PasswordPersistence.snapshotMutation")(
   function* (input: PasswordMutationInput) {
@@ -272,8 +280,8 @@ export const validatePasswordMutation = Effect.fnUntraced(function* (
   const requirement = yield* current.requirement;
 
   if (
-    !passwordEvidenceSatisfiedAt(evidence, input.authorization.requirement, now) ||
-    !passwordEvidenceSatisfiedAt(evidence, requirement, now)
+    !(yield* passwordEvidenceSatisfiedAt(evidence, input.authorization.requirement, now)) ||
+    !(yield* passwordEvidenceSatisfiedAt(evidence, requirement, now))
   )
     return undefined;
   if (