@yielded/auth-persistence 0.1.0-beta.31 → 0.1.0-beta.32

package/src/internal/oauth-managed.ts

@@ -0,0 +1,277 @@
+import type { LifecycleHooks } from "@yielded/auth/Hooks";
+import * as M from "@yielded/auth/OAuth";
+import { AuthenticationFlowId } from "@yielded/auth/Sessions";
+import { Context, type Crypto, DateTime, Effect, Schema } from "effect";
+import { SqlClient } from "effect/sql";
+import type { Fragment } from "effect/sql/Statement";
+
+import {
+  PersistenceConfigurationError,
+  type MappingInput,
+  type OAuthFeature,
+} from "./configuration";
+import {
+  requiredOAuthConnectedConstraints,
+  requiredOAuthConnectedRevocationConstraints,
+  type OAuthConnectedPolicyInput,
+} from "./models/oauth-connected-model";
+import { requiredOAuthSignInConstraints } from "./models/oauth-model";
+import type { NativeSqlTables } from "./native-sql-table";
+import { makeNativeOAuthConnectedServices } from "./oauth/native-connected";
+import type { OAuthNativeConnectedMapping } from "./oauth/native-connected-state";
+import { makeNativeOAuthRevocationServices } from "./oauth/native-revocations";
+import { makeNativeOAuthSignInServices } from "./oauth/native-sign-in";
+import type { OAuthNativeReadMapping } from "./oauth/native-state";
+import { sameRevision, satisfies } from "./oauth/state";
+import { exactSqlText } from "./sql-change";
+import { SqlBatchCommit } from "./sql-commit";
+import { makeStorageClock } from "./storage-clock";
+import { storageTables, type StorageRole } from "./storage-tables";
+
+// Removed provider grants retain revocation custody for 30 days; claims may extend it.
+const revocationRetentionMillis = 30 * 24 * 60 * 60 * 1000;
+const encodeProfile = Schema.encodeSync(Schema.fromJsonString(M.OAuthConnectedProfile));
+const encodePolicy = Schema.encodeSync(Schema.fromJsonString(M.OAuthConnectedPolicy));
+
+const configurationError = (reason: string) => PersistenceConfigurationError.make({ reason });
+
+/** Managed tables use the same native OAuth operations as explicit mappings. */
+export const makeManagedOAuth = Effect.fnUntraced(function* (
+  storage: MappingInput,
+  tables: NativeSqlTables,
+  features: ReadonlyArray<OAuthFeature>,
+): Effect.fn.Return<
+  Context.Context<never>,
+  PersistenceConfigurationError,
+  Crypto.Crypto | LifecycleHooks | SqlClient.SqlClient | SqlBatchCommit
+> {
+  const sql = (yield* SqlClient.SqlClient).withoutTransforms();
+  const batch = yield* SqlBatchCommit;
+
+  const clock = yield* makeStorageClock(storage).pipe(
+    Effect.mapError(() => configurationError("Cannot configure the OAuth storage clock")),
+  );
+
+  function mapped<Role extends StorageRole>(role: Role) {
+    const table = storage.tables[role];
+
+    if (table === undefined) throw configurationError(`Missing ${role} mapping`);
+
+    return {
+      table,
+      // Storage validation owns these logical column keys.
+      ...(Object.fromEntries(Object.keys(storageTables[role].columns).map((key) => [key, key])) as {
+        readonly [Key in keyof (typeof storageTables)[Role]["columns"]]: Key;
+      }),
+    };
+  }
+
+  const s = storage.subjects;
+  const subject = tables(s.table);
+  const credential = mapped("oauthCredentials");
+  const credentials = tables(credential.table);
+  const authority = mapped("credentials");
+  const factors = tables(authority.table);
+  const now = tables.expression(clock.engineNowMillis);
+  const policies = new Map<string, M.OAuthConnectedPolicy>();
+
+  for (const feature of features) {
+    if (feature.connected === undefined) continue;
+
+    const policy = yield* M.snapshotOAuth(M.OAuthConnectedPolicy, feature.connected).pipe(
+      Effect.mapError(() => configurationError(`Invalid OAuth policy for ${feature.moduleId}`)),
+    );
+
+    const previous = policies.get(feature.moduleId);
+
+    if (previous !== undefined && encodePolicy(previous) !== encodePolicy(policy))
+      return yield* configurationError(`Conflicting OAuth policies for ${feature.moduleId}`);
+    policies.set(feature.moduleId, policy);
+  }
+
+  const shared = {
+    subject: {
+      table: s.table,
+      id: s.id,
+      status: s.status,
+      securityRevision: s.securityRevision,
+      isActiveStatus: (value: unknown) => Object.is(value, s.activeValue),
+      activeCondition: sql`${subject.column(s.status)} = ${subject.value(s.status, s.activeValue)}`,
+      decodeAuthenticationRequirement: s.requirements,
+    },
+    subjectId: { toSubject: s.toSubject, toNative: s.toNative, equals: Object.is },
+    ownership: {
+      ...mapped("oauthIdentities"),
+      decodeSubjectId: (row: Record<string, unknown>) => row.subjectId,
+      encodeInsert: () => ({}),
+    },
+    credential: {
+      ...credential,
+      status: "active",
+      isActiveStatus: (value: unknown) => value === true,
+      activeCondition: sql`${credentials.column("active")} = ${credentials.value("active", true)}`,
+    },
+    authority: {
+      ...authority,
+      status: "active",
+      isActiveStatus: (value: unknown) => value === true,
+      activeCondition: sql`${factors.column("active")} = ${factors.value("active", true)}`,
+    },
+    clock,
+  };
+
+  function policyCondition(input: OAuthConnectedPolicyInput<unknown>): Fragment {
+    let moduleId: string;
+
+    switch (input.kind) {
+      case "sign-in":
+        moduleId = input.credential.moduleId;
+        break;
+      case "action":
+        moduleId = input.authorization.challenge.moduleId;
+        break;
+      case "metadata":
+      case "use":
+        moduleId = input.authorization.moduleId;
+    }
+    const policy = policies.get(moduleId);
+
+    if (policy === undefined) return sql`false`;
+    const grant = input.grant;
+
+    if (grant !== undefined) {
+      if (grant.moduleId !== moduleId || grant.subjectId !== input.revision.subjectId)
+        return sql`false`;
+      // Disconnect must remain possible after a profile is retired or removed.
+      if (input.kind !== "action" || input.operation !== "disconnect") {
+        const profile = policy.profiles.find(
+          (value) => value.key === grant.configuration.profile.key && value.issuance === "active",
+        );
+
+        if (
+          profile === undefined ||
+          encodeProfile(profile) !==
+            encodeProfile({
+              ...grant.configuration.profile,
+              issuance: "active",
+            })
+        )
+          return sql`false`;
+      }
+    }
+
+    const current = sql`exists(select 1 from ${subject.name} where ${subject.column(s.id)} = ${subject.value(s.id, input.subjectId)} and ${shared.subject.activeCondition} and ${exactSqlText(sql, subject.column(s.securityRevision), subject.value(s.securityRevision, input.revision.securityRevision))})`;
+
+    if (input.kind === "sign-in")
+      return features.some((feature) => feature.moduleId === moduleId && feature.signIn)
+        ? current
+        : sql`false`;
+    if (input.kind !== "action") {
+      // Mutable application policy shares the subject's guarded security revision.
+      return input.authorization.policyRevision === input.revision.securityRevision
+        ? current
+        : sql`false`;
+    }
+
+    const { authorization } = input;
+    const { challenge, evidence, requirement } = authorization;
+    const action = input.operation === "settle" ? "connected-complete" : "connected-disconnect";
+
+    if (
+      challenge.action !== action ||
+      !sameRevision(challenge.revision, input.revision) ||
+      !sameRevision(evidence.revision, input.revision) ||
+      evidence.flowId !== AuthenticationFlowId.make(challenge.flowId) ||
+      evidence.bindingDigest !== challenge.bindingDigest ||
+      !satisfies(evidence.proofs, requirement) ||
+      evidence.proofs.some(
+        (proof) =>
+          !input.revision.credentials.some((entry) => entry.credentialId === proof.credentialId),
+      )
+    )
+      return sql`false`;
+
+    const maximumAge = Math.min(requirement.maximumAgeMillis, policy.maximumEvidenceAgeMillis);
+    const verified = evidence.proofs.map((proof) => DateTime.toEpochMillis(proof.verifiedAt));
+
+    if (authorization.source._tag === "Session")
+      verified.push(DateTime.toEpochMillis(authorization.source.authenticatedAt));
+
+    return sql.and([
+      current,
+      sql`${now} < ${authorization.validUntilMillis}`,
+      ...verified.map((instant) => sql`${now} >= ${instant} and ${now} < ${instant + maximumAge}`),
+    ]);
+  }
+
+  let context: Context.Context<never> = Context.empty();
+
+  if (features.some((feature) => feature.signIn)) {
+    const mapping: OAuthNativeReadMapping = {
+      ...shared,
+      flow: { ...mapped("oauthSignInFlows"), encodeInsert: () => ({}) },
+      constraints: requiredOAuthSignInConstraints,
+    };
+
+    const services = yield* makeNativeOAuthSignInServices(tables, mapping, batch).pipe(
+      Effect.mapError(() => configurationError("Cannot configure OAuth sign-in persistence")),
+    );
+
+    context = Context.add(context, M.OAuthSignInPersistence, services.oauthSignInPersistence);
+  }
+  if (policies.size > 0) {
+    const job = { ...mapped("oauthConnectedRevocations"), encodeInsert: () => ({}) };
+    const grant = { ...mapped("oauthConnectedGrants"), encodeInsert: () => ({}) };
+
+    const mapping: OAuthNativeConnectedMapping = {
+      ...shared,
+      flow: { ...mapped("oauthConnectedFlows"), encodeInsert: () => ({}) },
+      grant,
+      policy: { condition: policyCondition },
+      constraints: requiredOAuthConnectedConstraints,
+      revocation: {
+        mode: "provider",
+        job,
+        retentionMillis: revocationRetentionMillis,
+        constraints: requiredOAuthConnectedRevocationConstraints,
+      },
+      otherReferences: ({ identityKey, subjectId }) =>
+        sql`exists(select 1 from ${credentials.name} where ${credentials.column("subjectId")} = ${credentials.value("subjectId", subjectId)} and ${exactSqlText(sql, credentials.column("identityKey"), credentials.value("identityKey", identityKey))})`,
+    };
+
+    const connected = yield* makeNativeOAuthConnectedServices(tables, mapping, batch).pipe(
+      Effect.mapError(() => configurationError("Cannot configure OAuth connected persistence")),
+    );
+
+    const revocations = yield* makeNativeOAuthRevocationServices(
+      tables,
+      {
+        ...mapping,
+        job,
+        constraints: requiredOAuthConnectedRevocationConstraints,
+      },
+      batch,
+    ).pipe(
+      Effect.mapError(() => configurationError("Cannot configure OAuth revocation persistence")),
+    );
+
+    context = context.pipe(
+      Context.add(M.OAuthConnectedPersistence, {
+        ...connected.oauthConnectedPersistence,
+        read: (input) =>
+          connected.oauthConnectedPersistence
+            .read(input)
+            .pipe(
+              Effect.map((snapshot) =>
+                snapshot === undefined
+                  ? undefined
+                  : { ...snapshot, policyRevision: snapshot.revision.securityRevision },
+              ),
+            ),
+      }),
+      Context.add(M.OAuthConnectedRevocations, revocations.oauthConnectedRevocations),
+    );
+  }
+
+  return context;
+});

package/src/internal/passkey-native-state.ts

@@ -1,4 +1,5 @@
 /* oxlint-disable no-explicit-any -- physical mapping generics are erased only at this shared adapter boundary. */
+import { AuthenticationClock } from "@yielded/auth/Operations";
 import * as M from "@yielded/auth/Passkey";
 import { Effect, Schema } from "effect";
 import { SqlClient } from "effect/sql";
@@ -9,6 +10,7 @@ import { sqlMapping, type NativeSqlTables } from "./native-sql-table";
 import { makePasskeyNativeFlow } from "./passkey-native-flow";
 import { passkeyCredentialKey } from "./passkey-policy";
 import { exactSqlText } from "./sql-change";
+import { canJoinTextColumns } from "./storage-validation";
 import type { TableModel } from "./table-model";
 
 // Physical expression types are validated by NativeSqlTables at this boundary.
@@ -226,75 +228,79 @@ export const makePasskeyNativeReadState = Effect.fnUntraced(function* (
     return sql`(select * from ${table.name} where ${active(kind)}) as ${sql(alias)}`;
   };
 
+  const joinedIds = yield* canJoinTextColumns([
+    subject.unencodedTextColumn?.(read.subject.id),
+    credential.unencodedTextColumn?.(read.credential.subjectId),
+    factor.unencodedTextColumn?.(read.authority.subjectId),
+  ]).pipe(Effect.mapError(() => M.PasskeyUnavailable.make({})));
+
   const lookup = Effect.fnUntraced(function* (rpId: string, protocolCredentialId: string) {
     const key = yield* passkeyCredentialKey(rpId, protocolCredentialId);
+    let nativeId: unknown;
 
-    if (
-      subject.unencodedTextColumn?.(read.subject.id) !== undefined &&
-      credential.unencodedTextColumn?.(read.credential.subjectId) !== undefined &&
-      factor.unencodedTextColumn?.(read.authority.subjectId) !== undefined
-    ) {
-      const s = joinedSubject,
-        c = joinedCredential,
-        f = joinedFactor;
-
-      const rows =
-        yield* sql<PasskeyNativeRow>`select ${s.fields("s_")}, ${c.fields("c_")}, ${f.fields("f_")}
-        from ${selected("credential", "passkey_credential")}
-        join ${selected("subject", "passkey_subject")} on ${exactSqlText(sql, s.column(read.subject.id), c.column(read.credential.subjectId))}
-        left join ${selected("authority", "passkey_factor")} on ${exactSqlText(sql, f.column(read.authority.subjectId), c.column(read.credential.subjectId))}
-        where ${exactSqlText(sql, c.column(read.credential.credentialKey), c.value(read.credential.credentialKey, key))} limit 65`;
+    if (!joinedIds) {
+      const found =
+        yield* sql<PasskeyNativeRow>`select ${credential.fields("c_")} from ${credential.name} where ${exactSqlText(sql, credential.column(read.credential.credentialKey), credential.value(read.credential.credentialKey, key))} and ${active("credential")}`;
 
-      if (rows.length === 0 || rows.length > 64) return undefined;
-      const row = c.decode(rows[0]!, "c_");
-      const subjectRow = s.decode(rows[0]!, "s_");
-      const owner = read.credential.decodeSubjectId(row);
+      if (found.length !== 1) return undefined;
+      const row = credential.decode(found[0]!, "c_");
 
       invariant(
         row[read.credential.rpId] === rpId &&
           row[read.credential.protocolCredentialId] === protocolCredentialId,
       );
-      invariant(
-        rows.every((selected) => {
-          const other = c.decode(selected, "c_");
-          const subjectValue = s.decode(selected, "s_");
-
-          return (
-            sameId(owner, read.credential.decodeSubjectId(other)) &&
-            sameId(owner, read.subject.decodeId(subjectValue)) &&
-            other[read.credential.credentialId] === row[read.credential.credentialId] &&
-            other[read.credential.credentialRevision] === row[read.credential.credentialRevision] &&
-            subjectValue[read.subject.securityRevision] ===
-              subjectRow[read.subject.securityRevision]
-          );
-        }),
-      );
-
-      return yield* decodeCredential(
-        row,
-        revision(
-          subjectRow,
-          rows.map((row) => f.decode(row, "f_")),
-        ),
-        subjectRow,
-      );
+      nativeId = read.credential.decodeSubjectId(row);
     }
 
+    const s = joinedSubject,
+      c = joinedCredential,
+      f = joinedFactor;
+
+    const bindOwner = (table: typeof subject, key: string) =>
+      joinedIds
+        ? exactSqlText(sql, table.column(key), c.column(read.credential.subjectId))
+        : sql`${table.column(key)} = ${table.value(key, nativeId)}`;
+
     const rows =
-      yield* sql<PasskeyNativeRow>`select ${credential.fields("c_")} from ${credential.name} where ${credential.column(read.credential.credentialKey)} = ${credential.value(read.credential.credentialKey, key)} and ${active("credential")}`;
+      yield* sql<PasskeyNativeRow>`select ${s.fields("s_")}, ${c.fields("c_")}, ${f.fields("f_")}
+      from ${selected("credential", "passkey_credential")}
+      join ${selected("subject", "passkey_subject")} on ${bindOwner(s, read.subject.id)}
+      left join ${selected("authority", "passkey_factor")} on ${bindOwner(f, read.authority.subjectId)}
+      where ${exactSqlText(sql, c.column(read.credential.credentialKey), c.value(read.credential.credentialKey, key))}${joinedIds ? sql`` : sql` and ${bindOwner(c, read.credential.subjectId)}`} limit 65`;
 
-    if (rows.length !== 1) return undefined;
-    const row = credential.decode(rows[0]!, "c_");
+    if (rows.length === 0 || rows.length > 64) return undefined;
+    const row = c.decode(rows[0]!, "c_");
+    const subjectRow = s.decode(rows[0]!, "s_");
+    const owner = read.credential.decodeSubjectId(row);
 
     invariant(
-      row[read.credential.rpId] === rpId &&
+      (joinedIds || sameId(owner, nativeId)) &&
+        row[read.credential.rpId] === rpId &&
         row[read.credential.protocolCredentialId] === protocolCredentialId,
     );
-    const current = yield* readAuthority(read.credential.decodeSubjectId(row), false);
+    invariant(
+      rows.every((selected) => {
+        const other = c.decode(selected, "c_");
+        const subjectValue = s.decode(selected, "s_");
 
-    return current === undefined
-      ? undefined
-      : yield* decodeCredential(row, current.revision, current.row);
+        return (
+          sameId(owner, read.credential.decodeSubjectId(other)) &&
+          sameId(owner, read.subject.decodeId(subjectValue)) &&
+          other[read.credential.credentialId] === row[read.credential.credentialId] &&
+          other[read.credential.credentialRevision] === row[read.credential.credentialRevision] &&
+          subjectValue[read.subject.securityRevision] === subjectRow[read.subject.securityRevision]
+        );
+      }),
+    );
+
+    return yield* decodeCredential(
+      row,
+      revision(
+        subjectRow,
+        rows.map((row) => f.decode(row, "f_")),
+      ),
+      subjectRow,
+    );
   });
 
   return {
@@ -326,9 +332,10 @@ export const makePasskeyNativeState = Effect.fnUntraced(function* (
   mapping: PasskeyNativeMapping,
 ) {
   const state = yield* makePasskeyNativeReadState(tables, mapping.read, mapping.clock);
+  const clockPolicy = yield* AuthenticationClock;
   const ceremony = yield* makePasskeyNativeFlow(tables, mapping);
 
-  return { ...state, mapping, ceremony, flow: ceremony.flow, access: ceremony.access };
+  return { ...state, clockPolicy, mapping, ceremony, flow: ceremony.flow, access: ceremony.access };
 });
 
 export type PasskeyNativeReadState = Effect.Success<ReturnType<typeof makePasskeyNativeReadState>>;

package/src/internal/passkey-native-write.ts

@@ -334,7 +334,7 @@ export const makePasskeyNativeManagement = (
 
           const requirement = yield* mapping.write.policy.requirement(current.row, "enroll-begin");
 
-          const authority = assessPasskeyAction(
+          const authority = yield* assessPasskeyAction(
             {
               moduleId: mapping.moduleId,
               revision: current.revision,
@@ -487,7 +487,7 @@ export const makePasskeyNativeManagement = (
             return yield* preparePasskeyNative({ _tag: "Rejected" }, prepare);
           const requirement = yield* mapping.write.policy.requirement(current.row, "remove");
 
-          const authority = assessPasskeyAction(
+          const authority = yield* assessPasskeyAction(
             {
               moduleId: mapping.moduleId,
               revision: current.revision,

package/src/internal/passkey-native.ts

@@ -1,4 +1,5 @@
 import { CurrentCommitJournal } from "@yielded/auth/Hooks";
+import { AuthenticationClock } from "@yielded/auth/Operations";
 import * as M from "@yielded/auth/Passkey";
 import { Crypto, Effect, Option, Schema } from "effect";
 import { SqlError } from "effect/sql/SqlError";
@@ -66,9 +67,10 @@ const services = Effect.fnUntraced(function* (
     effect: Effect.Effect<A, E, R>,
     mode: "transaction" | "statement" = "transaction",
   ) =>
-    batch === undefined
+    (batch === undefined
       ? executor.run(provide(effect), mode)
-      : executor.batch(provide(effect)).pipe(Effect.provideService(SqlBatchCommit, batch));
+      : executor.batch(provide(effect)).pipe(Effect.provideService(SqlBatchCommit, batch))
+    ).pipe(Effect.provideService(AuthenticationClock, state.clockPolicy));
 
   const advisory = <A, E, R>(effect: Effect.Effect<A, E, R>) => executor.read(provide(effect));
 

package/src/internal/passkey-policy.ts

@@ -1,3 +1,4 @@
+import { AuthenticationClock } from "@yielded/auth/Operations";
 import {
   PasskeyUnavailable,
   type PasskeyCeremony,
@@ -154,10 +155,11 @@ export interface PasskeyActionFacts {
 }
 
 /** Reject stale bindings before evaluating application requirements. */
-export const validPasskeyActionEvidence = (
+export const validPasskeyActionEvidence = Effect.fnUntraced(function* (
   facts: Pick<PasskeyActionFacts, "moduleId" | "revision" | "expected" | "nowMillis">,
   authorization: PasskeyActionAuthorization,
-) => {
+): Effect.fn.Return<boolean> {
+  const { futureToleranceMillis } = yield* AuthenticationClock;
   const { challenge, evidence } = authorization;
   const { expected, revision, nowMillis: now } = facts;
 
@@ -190,23 +192,25 @@ export const validPasskeyActionEvidence = (
   if (
     evidence.proofs.some(
       (proof) =>
-        DateTime.toEpochMillis(proof.verifiedAt) > now ||
+        DateTime.toEpochMillis(proof.verifiedAt) - now > futureToleranceMillis ||
         !evidence.revision.credentials.some((item) => item.credentialId === proof.credentialId),
     )
   )
     return false;
 
   return true;
-};
+});
 
 /** SQL policy predicates remain native. This authorizes the exact evidence and
  * returns the deadline every backend must retain through its final commit. */
-export const assessPasskeyAction = (
+export const assessPasskeyAction = Effect.fnUntraced(function* (
   facts: PasskeyActionFacts,
   authorization: PasskeyActionAuthorization,
   policy: PasskeyManagementPolicy,
-) => {
-  if (!validPasskeyActionEvidence(facts, authorization)) return undefined;
+): Effect.fn.Return<
+  { readonly notBeforeMillis: number; readonly expiresBeforeMillis: number } | undefined
+> {
+  if (!(yield* validPasskeyActionEvidence(facts, authorization))) return undefined;
   const { evidence } = authorization;
   const now = facts.nowMillis;
   let expiresBefore = Infinity;
@@ -219,7 +223,7 @@ export const assessPasskeyAction = (
     const age = Math.min(policy.maximumEvidenceAgeMillis, requirement.maximumAgeMillis);
 
     const fresh = evidence.proofs.filter(
-      (proof) => now - DateTime.toEpochMillis(proof.verifiedAt) < age,
+      (proof) => Math.max(0, now - DateTime.toEpochMillis(proof.verifiedAt)) < age,
     );
 
     const factors = new Set(fresh.flatMap((proof) => proof.factors));
@@ -243,4 +247,4 @@ export const assessPasskeyAction = (
   }
 
   return { notBeforeMillis: now, expiresBeforeMillis: expiresBefore };
-};
+});

package/src/internal/password-native.ts

@@ -1,5 +1,6 @@
 import { CurrentCommitJournal, type LifecycleHooks } from "@yielded/auth/Hooks";
 import type { LoginIdentifier } from "@yielded/auth/Identity";
+import { AuthenticationClock } from "@yielded/auth/Operations";
 import * as P from "@yielded/auth/Password";
 import { ProofRedemptionInput } from "@yielded/auth/Proofs";
 import type { SubjectId } from "@yielded/auth/Schema";
@@ -52,6 +53,7 @@ export const makeNativePasswordServices = Effect.fnUntraced(function* (
   SqlClient | LifecycleHooks | Crypto.Crypto | SqlBatchCommit
 > {
   const batch = yield* SqlBatchCommit;
+  const clockPolicy = yield* AuthenticationClock;
   const sql = (yield* SqlClient).withoutTransforms();
   const executor = yield* makeSqlCommitExecutor(unavailable);
   const crypto = yield* Crypto.Crypto;
@@ -87,11 +89,12 @@ export const makeNativePasswordServices = Effect.fnUntraced(function* (
     sql`${table.column(key)} = ${table.value(key, nativeId)}`;
 
   const run = <A, E, R>(work: Effect.Effect<A, E, R>) =>
-    batch === undefined
+    (batch === undefined
       ? executor.run(work.pipe(Effect.provideService(Crypto.Crypto, crypto)))
       : executor
           .batch(work.pipe(Effect.provideService(Crypto.Crypto, crypto)))
-          .pipe(Effect.provideService(SqlBatchCommit, batch));
+          .pipe(Effect.provideService(SqlBatchCommit, batch))
+    ).pipe(Effect.provideService(AuthenticationClock, clockPolicy));
 
   const read = Effect.fnUntraced(function* (
     moduleId: string,
@@ -346,7 +349,9 @@ export const makeNativePasswordServices = Effect.fnUntraced(function* (
             verifierVersion !== input.credential?.verifierVersion,
         );
 
-        const freshUntil = (requirement: AuthenticationRequirement) => {
+        const freshUntil = Effect.fnUntraced(function* (
+          requirement: AuthenticationRequirement,
+        ): Effect.fn.Return<number | undefined> {
           const deadlines = [
             ...new Set(
               input.authorization.evidence.proofs.map(
@@ -357,10 +362,13 @@ export const makeNativePasswordServices = Effect.fnUntraced(function* (
             .filter((time) => time > state.now)
             .sort((a, b) => a - b);
 
-          return deadlines.find(
-            (time) => !passwordEvidenceSatisfiedAt(input.authorization.evidence, requirement, time),
-          );
-        };
+          for (const time of deadlines) {
+            if (
+              !(yield* passwordEvidenceSatisfiedAt(input.authorization.evidence, requirement, time))
+            )
+              return time;
+          }
+        });
 
         if (batch !== undefined)
           yield* guardSqlitePolicy({
@@ -370,8 +378,8 @@ export const makeNativePasswordServices = Effect.fnUntraced(function* (
             values: state.policyValues,
           });
 
-        const requestedDeadline = freshUntil(input.authorization.requirement),
-          currentDeadline = freshUntil(requirement);
+        const requestedDeadline = yield* freshUntil(input.authorization.requirement),
+          currentDeadline = yield* freshUntil(requirement);
 
         ensure(requestedDeadline !== undefined && currentDeadline !== undefined);
         const deadline = Math.min(requestedDeadline, currentDeadline);

package/src/internal/password-policy.ts

@@ -1,4 +1,5 @@
 import type { LoginIdentifier } from "@yielded/auth/Identity";
+import { AuthenticationClock } from "@yielded/auth/Operations";
 import {
   PasswordUnavailable,
   snapshotPasswordCredential,
@@ -47,11 +48,13 @@ export const samePasswordCredential = (
   samePasswordIdentifier(left.identifier, right.identifier) &&
   Redacted.value(left.verifier) === Redacted.value(right.verifier);
 
-export const passwordEvidenceSatisfiedAt = (
+export const passwordEvidenceSatisfiedAt = Effect.fnUntraced(function* (
   evidence: AuthenticationEvidence,
   requirement: AuthenticationRequirement,
   now: number,
-): boolean => {
+): Effect.fn.Return<boolean> {
+  const { futureToleranceMillis } = yield* AuthenticationClock;
+
   if (evidence.proofs.length > 64 || evidence.revision.credentials.length > 64) return false;
   const revisions = new Map<string, string>();
 
@@ -60,12 +63,17 @@ export const passwordEvidenceSatisfiedAt = (
     revisions.set(item.credentialId, item.revision);
   }
   if (evidence.proofs.some((proof) => !revisions.has(proof.credentialId))) return false;
-  if (evidence.proofs.some((proof) => now < DateTime.toEpochMillis(proof.verifiedAt))) return false;
+  if (
+    evidence.proofs.some(
+      (proof) => DateTime.toEpochMillis(proof.verifiedAt) - now > futureToleranceMillis,
+    )
+  )
+    return false;
 
   const eligible = evidence.proofs.filter((proof) => {
-    const age = now - DateTime.toEpochMillis(proof.verifiedAt);
+    const age = Math.max(0, now - DateTime.toEpochMillis(proof.verifiedAt));
 
-    return age >= 0 && age < requirement.maximumAgeMillis;
+    return age < requirement.maximumAgeMillis;
   });
 
   const factors = new Set(eligible.flatMap((proof) => proof.factors));
@@ -81,7 +89,7 @@ export const passwordEvidenceSatisfiedAt = (
           (!alternative.phishingResistant || proof.phishingResistant),
       ),
   );
-};
+});
 
 export const snapshotPasswordMutation = Effect.fn("PasswordPersistence.snapshotMutation")(
   function* (input: PasswordMutationInput) {
@@ -272,8 +280,8 @@ export const validatePasswordMutation = Effect.fnUntraced(function* (
   const requirement = yield* current.requirement;
 
   if (
-    !passwordEvidenceSatisfiedAt(evidence, input.authorization.requirement, now) ||
-    !passwordEvidenceSatisfiedAt(evidence, requirement, now)
+    !(yield* passwordEvidenceSatisfiedAt(evidence, input.authorization.requirement, now)) ||
+    !(yield* passwordEvidenceSatisfiedAt(evidence, requirement, now))
   )
     return undefined;
   if (