@yielded/auth-persistence 0.1.0-beta.30 → 0.1.0-beta.32

package/src/internal/sqlite-policy-guard.ts

@@ -0,0 +1,34 @@
+import { Array, Effect } from "effect";
+import { SqlClient } from "effect/sql/SqlClient";
+import type { Fragment } from "effect/sql/Statement";
+
+import { appendSqlBatchStatement, registerSqlBatchPostcondition } from "./sql-commit";
+
+export interface SqlitePolicyValue {
+  readonly column: Fragment;
+  readonly value: Fragment;
+}
+
+/** Check original values before writes and at the end of the same atomic batch.
+ * Small groups bound parameters and expression depth without expanding retained
+ * values into hex/JSON. BINARY preserves text bytes; IS also compares NULLs. */
+export const guardSqlitePolicy = Effect.fnUntraced(function* (input: {
+  readonly name: string;
+  readonly table: Fragment;
+  readonly owner: Fragment;
+  readonly values: ReadonlyArray<SqlitePolicyValue>;
+}) {
+  const sql = (yield* SqlClient).withoutTransforms();
+
+  for (const values of Array.chunksOf(input.values, 32)) {
+    const matches = sql.and(
+      values.map(({ column, value }) => sql`${column} collate binary is ${value}`),
+    );
+
+    const condition = sql`exists(select 1 from ${input.table} where ${input.owner} and ${matches})`;
+    const statement = sql`select case when ${condition} then 1 else json_extract('[]', '$[auth-batch-precondition]') end as valid`;
+
+    yield* appendSqlBatchStatement(statement);
+    yield* registerSqlBatchPostcondition({ name: input.name, statement });
+  }
+});

package/src/internal/step-up-state.ts

@@ -1,7 +1,9 @@
+import { AuthenticationAssurance, AuthenticationClock } from "@yielded/auth/Operations";
 import {
   SessionStepUpInvalid,
   SessionUnavailable,
   AuthenticationEvidence,
+  AuthenticationProof,
   SessionMetadata,
   SessionStepUpIntent,
   SessionStepUpRequirement,
@@ -10,7 +12,7 @@ import {
 } from "@yielded/auth/Sessions";
 import { DateTime, Effect, Schema } from "effect";
 
-import { sameSessionRevision } from "./session-native-state";
+import { assessSessionAt, sameSessionRevision } from "./session-native-state";
 
 export const stepUpIntentCodec = Schema.fromJsonString(SessionStepUpIntent);
 const BoundedSnapshot = Schema.String.check(Schema.isMaxLength(131072));
@@ -27,11 +29,13 @@ export const decodeStepUpIntent = (snapshot: string) =>
     Effect.mapError(() => SessionUnavailable.make({})),
   );
 
-export const stepUpIntentLive = (
+export const stepUpIntentLive = Effect.fnUntraced(function* (
   intent: Omit<SessionStepUpIntent, "version">,
   kind: SessionStepUpIntent["sourceKind"],
   now: DateTime.Utc,
-) => {
+): Effect.fn.Return<boolean> {
+  const { futureToleranceMillis } = yield* AuthenticationClock;
+
   const n = DateTime.toEpochMillis(now),
     authenticated = DateTime.toEpochMillis(intent.sourceAuthenticatedAt),
     idle = DateTime.toEpochMillis(intent.sourceExpiresAt),
@@ -40,16 +44,22 @@ export const stepUpIntentLive = (
 
   return (
     intent.sourceKind === kind &&
-    authenticated <= n &&
+    authenticated - n <= futureToleranceMillis &&
+    authenticated < idle &&
     n < expires &&
     expires <= idle &&
     idle <= absolute
   );
-};
+});
 
 const evidenceEncoding = Schema.encodeSync(Schema.fromJsonString(AuthenticationEvidence));
 const requirementEncoding = Schema.encodeSync(Schema.fromJsonString(SessionStepUpRequirement));
 const metadataEncoding = Schema.encodeSync(Schema.fromJsonString(SessionMetadata));
+const proofEncoding = Schema.encodeSync(Schema.fromJsonString(Schema.Array(AuthenticationProof)));
+
+const assuranceEncoding = Schema.encodeSync(
+  Schema.fromJsonString(SessionMetadata.fields.assurance),
+);
 
 /** Validate core-owned plans before driver allocation/SQL expansion. No bearer or Claims decoding. */
 export const validateStepUpPlan = Effect.fn("DrizzleStepUp.validatePlan")(function* <Claims>(
@@ -57,7 +67,14 @@ export const validateStepUpPlan = Effect.fn("DrizzleStepUp.validatePlan")(functi
 ) {
   const { intent, source, replacement, evidence } = plan;
   const original = source.inspection;
+  const issuedAt = DateTime.toEpochMillis(replacement.inspection.session.issuedAt);
 
+  if (
+    issuedAt < DateTime.toEpochMillis(original.session.issuedAt) ||
+    evidence.proofs.some((proof) => DateTime.toEpochMillis(proof.verifiedAt) > issuedAt) ||
+    issuedAt >= DateTime.toEpochMillis(replacement.inspection.session.expiresAt)
+  )
+    return yield* SessionStepUpInvalid.make({});
   if (
     requirementEncoding(plan.profileRequirement) !== requirementEncoding(intent.requirement) ||
     replacement.inspection.session.subjectId !== evidence.revision.subjectId ||
@@ -89,7 +106,9 @@ export const validateStepUpPlan = Effect.fn("DrizzleStepUp.validatePlan")(functi
       DateTime.toEpochMillis(original.session.absoluteExpiresAt) ||
     DateTime.toEpochMillis(intent.sourceAbsoluteExpiresAt) !==
       DateTime.toEpochMillis(replacement.inspection.session.absoluteExpiresAt) ||
-    evidenceEncoding(replacement.inspection.provenance.evidence) !== evidenceEncoding(evidence)
+    evidenceEncoding(replacement.inspection.provenance.evidence) !== evidenceEncoding(evidence) ||
+    proofEncoding(evidence.proofs.slice(0, original.provenance.evidence.proofs.length)) !==
+      proofEncoding(original.provenance.evidence.proofs)
   )
     return yield* SessionStepUpInvalid.make({});
   if (
@@ -111,6 +130,24 @@ export const validateStepUpPlan = Effect.fn("DrizzleStepUp.validatePlan")(functi
     replacement.inspection.session.sessionId === intent.sourceSessionId
   )
     return yield* SessionStepUpInvalid.make({});
+
+  const at = DateTime.toEpochMillis(plan.now);
+  const base = yield* assessSessionAt(evidence, plan.baseRequirement, at);
+
+  const profile = yield* assessSessionAt(evidence, plan.profileRequirement, at);
+
+  // Freshness can change metadata at commit; validate the exact preparation snapshot here.
+  if (
+    !base.satisfied ||
+    !profile.satisfied ||
+    assuranceEncoding(
+      AuthenticationAssurance.make({
+        ...base.assurance,
+        authenticatedAt: profile.assurance.authenticatedAt,
+      }),
+    ) !== assuranceEncoding(replacement.inspection.session.assurance)
+  )
+    return yield* SessionStepUpInvalid.make({});
 });
 
 /** Compare a consumer-decoded encoded update/readback with the intended rotation.

package/src/internal/storage-mapping.ts

@@ -16,6 +16,7 @@ import {
   type StatefulSessionRecord,
 } from "@yielded/auth/Sessions";
 import { Crypto, DateTime, Effect, Redacted, Schema, Struct } from "effect";
+import { SqlClient } from "effect/sql";
 
 import type { MappingInput } from "./configuration";
 import { randomId } from "./crypto";
@@ -27,6 +28,8 @@ import {
 } from "./models/password-model";
 import { requiredProofConstraints, type AnyProofPersistenceMapping } from "./models/proof-model";
 import type { StatefulSessionMapping, PendingAuthenticationMapping } from "./models/session-model";
+import type { NativeSqlTables } from "./native-sql-table";
+import { exactSqlText } from "./sql-change";
 import { makeStorageClock } from "./storage-clock";
 import { storageTables, type StorageRole } from "./storage-tables";
 import type { TableModel, SqlExpression } from "./table-model";
@@ -40,12 +43,16 @@ const string = (value: unknown) => Schema.decodeUnknownSync(Schema.String)(value
 
 /** Derive shared row mappings from a managed or custom storage layout.
  * Acquire Effect Crypto once; the returned allocators retain that implementation.
- * Each factory requires its role tables to exist. Adapter authors supply typed
- * table handles and dialect-specific clocks/commit predicates, and may refine
- * authority policy for explicit services. This does not alter composed defaults.
+ * Each factory requires its role tables to exist. Supplying native tables derives
+ * batch commit predicates and subject policy columns. Adapter authors may refine
+ * clocks and authority policy for explicit services.
  */
-export const makeMappings = Effect.fnUntraced(function* (input: MappingInput) {
+export const makeMappings = Effect.fnUntraced(function* (
+  input: MappingInput,
+  tables?: NativeSqlTables,
+) {
   const crypto = yield* Crypto.Crypto;
+  const sql = (yield* SqlClient.SqlClient).withoutTransforms();
 
   const allocate = randomId.pipe(
     Effect.provideService(Crypto.Crypto, crypto),
@@ -67,12 +74,27 @@ export const makeMappings = Effect.fnUntraced(function* (input: MappingInput) {
 
   const { subjects: s, encodeInstant: instant, decodeInstant: readInstant } = input;
   const subjectId = { toNative: s.toNative, toSubject: s.toSubject, equals: Object.is };
+  const identifierTable = tables?.(table("identifiers"));
+
+  const activeIdentifier =
+    identifierTable === undefined
+      ? undefined
+      : sql`${identifierTable.column("active")} = ${identifierTable.value("active", true)}`;
 
   const subject = {
     table: s.table,
     id: s.id,
     status: s.status,
     securityRevision: s.securityRevision,
+    // Policy callbacks may read any application column. Identity, status and
+    // security revision have their own final checks and can be intentionally revised.
+    ...(tables === undefined
+      ? {}
+      : {
+          requirementColumns: tables(s.table).keys.filter(
+            (key) => key !== s.id && key !== s.status && key !== s.securityRevision,
+          ),
+        }),
     isActiveStatus: (value: unknown) => Object.is(value, s.activeValue),
     d1ActiveStatusValue: s.activeValue,
     activeStatusValue: s.activeValue,
@@ -88,6 +110,7 @@ export const makeMappings = Effect.fnUntraced(function* (input: MappingInput) {
     revision: "revision",
     status: "active",
     activeStatusValue: true,
+    d1ActiveStatusValue: true,
     isActiveStatus: (value: unknown) => value === true,
     encodeInsert: (row: object) => ({ ...row, active: true }),
     encodeRevision: (revision: SecurityRevision) => ({ revision }),
@@ -142,6 +165,11 @@ export const makeMappings = Effect.fnUntraced(function* (input: MappingInput) {
         verifiedAt: "verifiedAt",
         bindingRevision: "revision",
         isCurrent: (row) => row.active === true,
+        ...(activeIdentifier === undefined
+          ? {}
+          : {
+              d1CurrentCondition: () => activeIdentifier,
+            }),
         encodeInitialInsert: (identifier, subjectId, revision) => ({
           ...identifier,
           subjectId,
@@ -230,6 +258,14 @@ export const makeMappings = Effect.fnUntraced(function* (input: MappingInput) {
       bindingRevision: "revision",
       isCurrent: (row) => row.active === true && row.verifiedAt !== null,
       isMutableTarget: (row) => row.active === true && row.verifiedAt === null,
+      ...(identifierTable === undefined || activeIdentifier === undefined
+        ? {}
+        : {
+            d1CurrentCondition: ({ bindingRevision }) =>
+              sql`${activeIdentifier} and ${identifierTable.column("verifiedAt")} is not null and ${exactSqlText(sql, identifierTable.column("revision"), identifierTable.value("revision", bindingRevision))}`,
+            d1MutableTargetCondition: () =>
+              sql`${activeIdentifier} and ${identifierTable.column("verifiedAt")} is null`,
+          }),
       encodeVerifiedInsert: ({ identifier, subjectId, verifiedAtMillis, bindingRevision }) => ({
         ...identifier,
         subjectId,

package/src/internal/storage-tables.ts

@@ -27,6 +27,27 @@ const spec = <C extends Readonly<Record<string, Omit<StorageTable["columns"][str
   unique: ReadonlyArray<ReadonlyArray<Extract<keyof C, string>>>,
 ) => ({ columns, unique });
 
+const oauthFlow = spec(
+  {
+    moduleId: text,
+    flowId: text,
+    purpose: text,
+    generation: integer,
+    provider: text,
+    callbackId: text,
+    issuer: text,
+    responseIssuerMode: text,
+    subjectId: optionalText,
+    stateDigest: text,
+    binderVerifier: text,
+    binderExpiresAt: integer,
+    snapshot: text,
+    issuedAt: integer,
+    expiresAt: integer,
+  },
+  [["moduleId", "flowId"], ["stateDigest"]],
+);
+
 /** Logical roles are independent of table names and migration ownership. */
 export const storageTables = {
   subjects: spec({ id: text, active: boolean, securityRevision: text }, [["id"]]),
@@ -113,6 +134,61 @@ export const storageTables = {
     },
     [["moduleId", "flowId"]],
   ),
+  oauthIdentities: spec(
+    { identityKey: text, provider: text, issuer: text, externalSubject: text, subjectId: text },
+    [["identityKey"]],
+  ),
+  oauthCredentials: spec(
+    {
+      moduleId: text,
+      credentialId: text,
+      subjectId: text,
+      identityKey: text,
+      credentialRevision: text,
+      active: boolean,
+    },
+    [["credentialId"], ["identityKey"]],
+  ),
+  oauthSignInFlows: oauthFlow,
+  oauthConnectedFlows: oauthFlow,
+  oauthConnectedGrants: spec(
+    {
+      moduleId: text,
+      grantId: text,
+      subjectId: text,
+      identityKey: text,
+      profileKey: text,
+      grantVersion: text,
+      tokenVersion: text,
+      state: text,
+      snapshot: text,
+      summary: text,
+      refreshClaimId: optionalText,
+      refreshNextTokenVersion: optionalText,
+      refreshClaimedAt: optionalInteger,
+      refreshClaimExpiresAt: optionalInteger,
+      expiresAt: integer,
+    },
+    [
+      ["moduleId", "grantId"],
+      ["moduleId", "subjectId", "profileKey", "identityKey"],
+    ],
+  ),
+  oauthConnectedRevocations: spec(
+    {
+      jobId: text,
+      moduleId: text,
+      subjectId: text,
+      identityKey: text,
+      snapshot: text,
+      state: text,
+      claimId: optionalText,
+      claimedAt: optionalInteger,
+      claimExpiresAt: optionalInteger,
+      retentionUntil: integer,
+    },
+    [["jobId"]],
+  ),
   proofs: spec(
     {
       moduleId: text,

package/src/internal/storage-validation.ts

@@ -2,11 +2,23 @@ import { Context, Effect, Schema } from "effect";
 import { SqlClient } from "effect/sql/SqlClient";
 
 import { PersistenceConfigurationError } from "./configuration";
+import type { PhysicalTextColumn } from "./native-sql-table";
 import type { StorageTable } from "./storage-tables";
 
 const Columns = Schema.Array(Schema.String);
 const Keys = Schema.Array(Columns);
-const Metadata = Schema.Struct({ relation: Schema.String, columns: Columns, keys: Keys });
+
+const TextColumns = Schema.Array(
+  Schema.Struct({ name: Schema.String, type: Schema.String, collation: Schema.String }),
+);
+
+const Metadata = Schema.Struct({
+  relation: Schema.String,
+  columns: Columns,
+  keys: Keys,
+  textColumns: TextColumns,
+});
+
 const PgMetadata = Schema.Array(Metadata);
 
 const SqliteMetadata = Schema.Array(
@@ -14,10 +26,18 @@ const SqliteMetadata = Schema.Array(
     relation: Schema.String,
     columns: Schema.fromJsonString(Columns),
     keys: Schema.fromJsonString(Keys),
+    textColumns: Schema.fromJsonString(TextColumns),
   }),
 );
 
-const MysqlColumns = Schema.Array(Schema.Struct({ relation: Schema.String, name: Schema.String }));
+const MysqlColumns = Schema.Array(
+  Schema.Struct({
+    relation: Schema.String,
+    name: Schema.String,
+    type: Schema.String,
+    collation: Schema.NullOr(Schema.String),
+  }),
+);
 
 const MysqlIndexes = Schema.Array(
   Schema.Struct({
@@ -101,28 +121,32 @@ export interface StorageValidation {
   readonly required: ReadonlyArray<ReadonlyArray<string>>;
 }
 
-/** Batch physical metadata reads, reusing only the current acquisition snapshot.
- * Every requirement is still checked; later acquisitions read fresh metadata. */
-export const validateStorageBatch = Effect.fnUntraced(
-  function* (dialect: "pg" | "mysql" | "sqlite", requirements: ReadonlyArray<StorageValidation>) {
-    if (requirements.length === 0) return;
+type Dialect = "pg" | "mysql" | "sqlite";
+
+/** Share physical type, collation and key observations only during acquisition. */
+const readStorageMetadata = Effect.fnUntraced(
+  function* (
+    dialect: Dialect,
+    physical: ReadonlyArray<Pick<PhysicalStorageTable, "name" | "schema">>,
+  ) {
     if (
       dialect === "sqlite" &&
-      requirements.some(({ table }) => table.schema !== undefined && table.schema !== "main")
+      physical.some((table) => table.schema !== undefined && table.schema !== "main")
     )
       return yield* PersistenceConfigurationError.make({
         reason: "SQLite storage must belong to the main database",
       });
-    const client = yield* SqlClient;
+    const captured = yield* SqlClient;
+    const client = captured.withoutTransforms();
     const cache = yield* CurrentMetadata;
 
     const byRelation = cache?.active
-      ? (cache.clients.get(client) ?? new Map<string, typeof Metadata.Type>())
+      ? (cache.clients.get(captured) ?? new Map<string, typeof Metadata.Type>())
       : new Map<string, typeof Metadata.Type>();
 
-    if (cache?.active) cache.clients.set(client, byRelation);
+    if (cache?.active) cache.clients.set(captured, byRelation);
 
-    const tables = new Map(requirements.map(({ table }) => [qualifiedTableName(table), table]));
+    const tables = new Map(physical.map((table) => [qualifiedTableName(table), table]));
 
     const missing = [...tables.entries()].filter(
       ([relation]) => !byRelation.has(`${dialect}:${relation}`),
@@ -151,7 +175,11 @@ export const validateStorageBatch = Effect.fnUntraced(
               from pragma_index_list(requested.name) i
               where i."unique" = 1 and i.partial = 0
                 and not exists(select 1 from pragma_index_info(i.name) where name is null)
-            ) storage_key where json_array_length(storage_key.columns) > 0) as keys
+            ) storage_key where json_array_length(storage_key.columns) > 0) as keys,
+            (select json_group_array(json_object('name', c.name, 'type', 'TEXT', 'collation', 'BINARY'))
+              from pragma_table_info(requested.name) c
+              join sqlite_schema s on s.name = requested.name and s.type = 'table'
+              where upper(c.type) = 'TEXT' and instr(lower(s.sql), 'collate') = 0) as "textColumns"
           from requested
         `.pipe(Effect.flatMap(Schema.decodeUnknownEffect(SqliteMetadata)));
           })
@@ -168,7 +196,8 @@ export const validateStorageBatch = Effect.fnUntraced(
               );
 
               const columns = yield* client`
-          select requested.relation, c.column_name as name
+          select requested.relation, c.column_name as name,
+            c.data_type as type, c.collation_name as collation
           from (${requested}) requested join information_schema.columns c
             on c.table_schema = coalesce(requested.schemaName, database()) and c.table_name = requested.tableName
         `.pipe(Effect.flatMap(Schema.decodeUnknownEffect(MysqlColumns)));
@@ -196,6 +225,13 @@ export const validateStorageBatch = Effect.fnUntraced(
                   columns: columns
                     .filter((column) => column.relation === relation)
                     .map((column) => column.name),
+                  textColumns: columns.flatMap((column) =>
+                    column.relation === relation &&
+                    column.collation !== null &&
+                    ["varchar", "text", "tinytext", "mediumtext", "longtext"].includes(column.type)
+                      ? [{ name: column.name, type: column.type, collation: column.collation }]
+                      : [],
+                  ),
                   keys: [...grouped.values()]
                     .filter((entries) =>
                       entries.every((entry) => entry.columnName !== null && entry.prefix === null),
@@ -229,7 +265,12 @@ export const validateStorageBatch = Effect.fnUntraced(
             and i.indpred is null and i.indexprs is null
             and k.ordinality <= i.indnkeyatts
           group by i.indexrelid
-        ) storage_key), '[]'::jsonb) as keys
+        ) storage_key), '[]'::jsonb) as keys,
+        coalesce((select jsonb_agg(jsonb_build_object(
+          'name', a.attname::text, 'type', a.atttypid::text, 'collation', a.attcollation::text))
+          from pg_attribute a where a.attrelid = to_regclass(requested.relation)
+            and a.attnum > 0 and not a.attisdropped
+            and a.atttypid in ('text'::regtype, 'varchar'::regtype)), '[]'::jsonb) as "textColumns"
       from (values ${requested}) requested(relation)
     `.pipe(Effect.flatMap(Schema.decodeUnknownEffect(PgMetadata)));
             });
@@ -237,18 +278,7 @@ export const validateStorageBatch = Effect.fnUntraced(
       for (const row of metadata) byRelation.set(`${dialect}:${row.relation}`, row);
     }
 
-    for (const { table, required } of requirements) {
-      const relation = qualifiedTableName(table);
-      const actual = byRelation.get(`${dialect}:${relation}`);
-
-      for (const column of Object.values(table.columns)) {
-        if (actual === undefined || !actual.columns.includes(column.name))
-          return yield* PersistenceConfigurationError.make({
-            reason: `Missing SQL column ${relation}.${column.name}`,
-          });
-      }
-      yield* validateKeys(table, required, actual?.keys ?? []);
-    }
+    return byRelation;
   },
   Effect.mapError((error) =>
     Schema.is(PersistenceConfigurationError)(error)
@@ -257,6 +287,76 @@ export const validateStorageBatch = Effect.fnUntraced(
   ),
 );
 
+/** Batch physical metadata reads, reusing only the current acquisition snapshot.
+ * Every requirement is still checked; later acquisitions read fresh metadata. */
+export const validateStorageBatch = Effect.fnUntraced(function* (
+  dialect: Dialect,
+  requirements: ReadonlyArray<StorageValidation>,
+) {
+  if (requirements.length === 0) return;
+
+  const byRelation = yield* readStorageMetadata(
+    dialect,
+    requirements.map(({ table }) => table),
+  );
+
+  for (const { table, required } of requirements) {
+    const relation = qualifiedTableName(table);
+    const actual = byRelation.get(`${dialect}:${relation}`);
+
+    for (const column of Object.values(table.columns)) {
+      if (actual === undefined || !actual.columns.includes(column.name))
+        return yield* PersistenceConfigurationError.make({
+          reason: `Missing SQL column ${relation}.${column.name}`,
+        });
+    }
+    yield* validateKeys(table, required, actual?.keys ?? []);
+  }
+});
+
+/** Candidate declarations do not establish SQL equality compatibility. SQLite
+ * omits column collations, so only TEXT tables without COLLATE qualify. */
+export const canJoinTextColumns = Effect.fnUntraced(function* (
+  columns: ReadonlyArray<PhysicalTextColumn | undefined>,
+) {
+  const candidates = columns.filter((column) => column !== undefined);
+
+  if (candidates.length !== columns.length || candidates.length === 0) return false;
+  const client = yield* SqlClient;
+
+  const dialect = client.onDialectOrElse({
+    pg: () => "pg" as const,
+    mysql: () => "mysql" as const,
+    sqlite: () => "sqlite" as const,
+    orElse: () => undefined,
+  });
+
+  if (
+    dialect === undefined ||
+    (dialect === "sqlite" &&
+      candidates.some(({ table }) => table.schema !== undefined && table.schema !== "main"))
+  )
+    return false;
+
+  const metadata = yield* readStorageMetadata(
+    dialect,
+    candidates.map(({ table }) => table),
+  );
+
+  const physical = candidates.map(({ table, name }) =>
+    metadata
+      .get(`${dialect}:${qualifiedTableName(table)}`)
+      ?.textColumns.find((column) => column.name === name),
+  );
+
+  const first = physical[0];
+
+  return (
+    first !== undefined &&
+    physical.every((column) => column?.type === first.type && column.collation === first.collation)
+  );
+});
+
 /** Validate physical columns and unconditional uniqueness before operations run. */
 export const validateStorage = (
   dialect: "pg" | "mysql" | "sqlite",