@yielded/auth-persistence 0.1.0-beta.31 → 0.1.0-beta.32

package/src/internal/sql-storage-validation.ts

@@ -1,3 +1,4 @@
+import { reportAuthDiagnostic } from "@yielded/auth/Persistence";
 import { Effect } from "effect";
 import { SqlClient } from "effect/sql";
 
@@ -7,57 +8,63 @@ import { storageKeyPlans } from "./storage-plans";
 import { validateStorageBatch, type StorageValidation } from "./storage-validation";
 
 /** Check declared mappings against physical keys before acquiring OAuth services. */
-export const validateSqlStorage = Effect.fnUntraced(function* (mapping: unknown) {
-  const plans = yield* Effect.try({
-    try: () =>
-      storageKeyPlans(mapping, (table) => {
-        if (!(table instanceof Table)) throw new Error("Expected a SQL table");
+export const validateSqlStorage = Effect.fnUntraced(
+  function* (mapping: unknown) {
+    const plans = yield* Effect.try({
+      try: () =>
+        storageKeyPlans(mapping, (table) => {
+          if (!(table instanceof Table)) throw new Error("Expected a SQL table");
 
-        return table.columns;
-      }),
-    catch: () =>
-      PersistenceMappingError.make({ operation: "mapping", cause: "Invalid storage key mapping" }),
-  });
-
-  const client = yield* SqlClient.SqlClient;
+          return table.columns;
+        }),
+      catch: () =>
+        PersistenceMappingError.make({
+          operation: "mapping",
+          cause: "Invalid storage key mapping",
+        }),
+    });
 
-  const dialect = client.onDialectOrElse({
-    pg: () => "pg" as const,
-    sqlite: () => "sqlite" as const,
-    orElse: () => undefined,
-  });
+    const client = yield* SqlClient.SqlClient;
 
-  if (dialect === undefined)
-    return yield* PersistenceMappingError.make({
-      operation: "mapping",
-      cause: "OAuth persistence requires PostgreSQL or SQLite",
+    const dialect = client.onDialectOrElse({
+      pg: () => "pg" as const,
+      sqlite: () => "sqlite" as const,
+      orElse: () => undefined,
     });
-  const validations: StorageValidation[] = [];
 
-  for (const plan of plans) {
-    if (!(plan.table instanceof Table))
+    if (dialect === undefined)
       return yield* PersistenceMappingError.make({
         operation: "mapping",
-        cause: "Expected a SQL table",
+        cause: "OAuth persistence requires PostgreSQL or SQLite",
       });
-    validations.push({
-      table: {
-        name: plan.table.name,
-        ...(plan.table.schema === undefined ? {} : { schema: plan.table.schema }),
-        columns: Object.fromEntries(
-          Object.entries(plan.table.columns).map(([key, column]) => [key, column.options]),
-        ),
-      },
-      required: [plan.keys],
-    });
-  }
-  yield* validateStorageBatch(dialect, validations).pipe(
-    Effect.provideService(SqlClient.SqlClient, client),
-    Effect.mapError(() =>
-      PersistenceMappingError.make({
-        operation: "mapping",
-        cause: "Required SQL storage key is unavailable",
-      }),
-    ),
-  );
-});
+    const validations: StorageValidation[] = [];
+
+    for (const plan of plans) {
+      if (!(plan.table instanceof Table))
+        return yield* PersistenceMappingError.make({
+          operation: "mapping",
+          cause: "Expected a SQL table",
+        });
+      validations.push({
+        table: {
+          name: plan.table.name,
+          ...(plan.table.schema === undefined ? {} : { schema: plan.table.schema }),
+          columns: Object.fromEntries(
+            Object.entries(plan.table.columns).map(([key, column]) => [key, column.options]),
+          ),
+        },
+        required: [plan.keys],
+      });
+    }
+    yield* validateStorageBatch(dialect, validations).pipe(
+      Effect.provideService(SqlClient.SqlClient, client),
+      Effect.mapError(() =>
+        PersistenceMappingError.make({
+          operation: "mapping",
+          cause: "Required SQL storage key is unavailable",
+        }),
+      ),
+    );
+  },
+  Effect.tapError(() => reportAuthDiagnostic("persistence-validation", "mapping")),
+);

package/src/internal/sql-table.ts

@@ -22,6 +22,7 @@ export const identifier = (name: string) => '"' + name.replaceAll('"', '""') + '
 
 export interface ColumnOptions {
   readonly name: string;
+  /** Driver value representation, not the database column's physical SQL type. */
   readonly type: "text" | "integer" | "boolean";
   readonly nullable?: boolean;
 }

package/src/internal/step-up-state.ts

@@ -1,7 +1,9 @@
+import { AuthenticationAssurance, AuthenticationClock } from "@yielded/auth/Operations";
 import {
   SessionStepUpInvalid,
   SessionUnavailable,
   AuthenticationEvidence,
+  AuthenticationProof,
   SessionMetadata,
   SessionStepUpIntent,
   SessionStepUpRequirement,
@@ -10,7 +12,7 @@ import {
 } from "@yielded/auth/Sessions";
 import { DateTime, Effect, Schema } from "effect";
 
-import { sameSessionRevision } from "./session-native-state";
+import { assessSessionAt, sameSessionRevision } from "./session-native-state";
 
 export const stepUpIntentCodec = Schema.fromJsonString(SessionStepUpIntent);
 const BoundedSnapshot = Schema.String.check(Schema.isMaxLength(131072));
@@ -27,11 +29,13 @@ export const decodeStepUpIntent = (snapshot: string) =>
     Effect.mapError(() => SessionUnavailable.make({})),
   );
 
-export const stepUpIntentLive = (
+export const stepUpIntentLive = Effect.fnUntraced(function* (
   intent: Omit<SessionStepUpIntent, "version">,
   kind: SessionStepUpIntent["sourceKind"],
   now: DateTime.Utc,
-) => {
+): Effect.fn.Return<boolean> {
+  const { futureToleranceMillis } = yield* AuthenticationClock;
+
   const n = DateTime.toEpochMillis(now),
     authenticated = DateTime.toEpochMillis(intent.sourceAuthenticatedAt),
     idle = DateTime.toEpochMillis(intent.sourceExpiresAt),
@@ -40,16 +44,22 @@ export const stepUpIntentLive = (
 
   return (
     intent.sourceKind === kind &&
-    authenticated <= n &&
+    authenticated - n <= futureToleranceMillis &&
+    authenticated < idle &&
     n < expires &&
     expires <= idle &&
     idle <= absolute
   );
-};
+});
 
 const evidenceEncoding = Schema.encodeSync(Schema.fromJsonString(AuthenticationEvidence));
 const requirementEncoding = Schema.encodeSync(Schema.fromJsonString(SessionStepUpRequirement));
 const metadataEncoding = Schema.encodeSync(Schema.fromJsonString(SessionMetadata));
+const proofEncoding = Schema.encodeSync(Schema.fromJsonString(Schema.Array(AuthenticationProof)));
+
+const assuranceEncoding = Schema.encodeSync(
+  Schema.fromJsonString(SessionMetadata.fields.assurance),
+);
 
 /** Validate core-owned plans before driver allocation/SQL expansion. No bearer or Claims decoding. */
 export const validateStepUpPlan = Effect.fn("DrizzleStepUp.validatePlan")(function* <Claims>(
@@ -57,7 +67,14 @@ export const validateStepUpPlan = Effect.fn("DrizzleStepUp.validatePlan")(functi
 ) {
   const { intent, source, replacement, evidence } = plan;
   const original = source.inspection;
+  const issuedAt = DateTime.toEpochMillis(replacement.inspection.session.issuedAt);
 
+  if (
+    issuedAt < DateTime.toEpochMillis(original.session.issuedAt) ||
+    evidence.proofs.some((proof) => DateTime.toEpochMillis(proof.verifiedAt) > issuedAt) ||
+    issuedAt >= DateTime.toEpochMillis(replacement.inspection.session.expiresAt)
+  )
+    return yield* SessionStepUpInvalid.make({});
   if (
     requirementEncoding(plan.profileRequirement) !== requirementEncoding(intent.requirement) ||
     replacement.inspection.session.subjectId !== evidence.revision.subjectId ||
@@ -89,7 +106,9 @@ export const validateStepUpPlan = Effect.fn("DrizzleStepUp.validatePlan")(functi
       DateTime.toEpochMillis(original.session.absoluteExpiresAt) ||
     DateTime.toEpochMillis(intent.sourceAbsoluteExpiresAt) !==
       DateTime.toEpochMillis(replacement.inspection.session.absoluteExpiresAt) ||
-    evidenceEncoding(replacement.inspection.provenance.evidence) !== evidenceEncoding(evidence)
+    evidenceEncoding(replacement.inspection.provenance.evidence) !== evidenceEncoding(evidence) ||
+    proofEncoding(evidence.proofs.slice(0, original.provenance.evidence.proofs.length)) !==
+      proofEncoding(original.provenance.evidence.proofs)
   )
     return yield* SessionStepUpInvalid.make({});
   if (
@@ -111,6 +130,24 @@ export const validateStepUpPlan = Effect.fn("DrizzleStepUp.validatePlan")(functi
     replacement.inspection.session.sessionId === intent.sourceSessionId
   )
     return yield* SessionStepUpInvalid.make({});
+
+  const at = DateTime.toEpochMillis(plan.now);
+  const base = yield* assessSessionAt(evidence, plan.baseRequirement, at);
+
+  const profile = yield* assessSessionAt(evidence, plan.profileRequirement, at);
+
+  // Freshness can change metadata at commit; validate the exact preparation snapshot here.
+  if (
+    !base.satisfied ||
+    !profile.satisfied ||
+    assuranceEncoding(
+      AuthenticationAssurance.make({
+        ...base.assurance,
+        authenticatedAt: profile.assurance.authenticatedAt,
+      }),
+    ) !== assuranceEncoding(replacement.inspection.session.assurance)
+  )
+    return yield* SessionStepUpInvalid.make({});
 });
 
 /** Compare a consumer-decoded encoded update/readback with the intended rotation.

package/src/internal/storage-tables.ts

@@ -27,6 +27,27 @@ const spec = <C extends Readonly<Record<string, Omit<StorageTable["columns"][str
   unique: ReadonlyArray<ReadonlyArray<Extract<keyof C, string>>>,
 ) => ({ columns, unique });
 
+const oauthFlow = spec(
+  {
+    moduleId: text,
+    flowId: text,
+    purpose: text,
+    generation: integer,
+    provider: text,
+    callbackId: text,
+    issuer: text,
+    responseIssuerMode: text,
+    subjectId: optionalText,
+    stateDigest: text,
+    binderVerifier: text,
+    binderExpiresAt: integer,
+    snapshot: text,
+    issuedAt: integer,
+    expiresAt: integer,
+  },
+  [["moduleId", "flowId"], ["stateDigest"]],
+);
+
 /** Logical roles are independent of table names and migration ownership. */
 export const storageTables = {
   subjects: spec({ id: text, active: boolean, securityRevision: text }, [["id"]]),
@@ -113,6 +134,61 @@ export const storageTables = {
     },
     [["moduleId", "flowId"]],
   ),
+  oauthIdentities: spec(
+    { identityKey: text, provider: text, issuer: text, externalSubject: text, subjectId: text },
+    [["identityKey"]],
+  ),
+  oauthCredentials: spec(
+    {
+      moduleId: text,
+      credentialId: text,
+      subjectId: text,
+      identityKey: text,
+      credentialRevision: text,
+      active: boolean,
+    },
+    [["credentialId"], ["identityKey"]],
+  ),
+  oauthSignInFlows: oauthFlow,
+  oauthConnectedFlows: oauthFlow,
+  oauthConnectedGrants: spec(
+    {
+      moduleId: text,
+      grantId: text,
+      subjectId: text,
+      identityKey: text,
+      profileKey: text,
+      grantVersion: text,
+      tokenVersion: text,
+      state: text,
+      snapshot: text,
+      summary: text,
+      refreshClaimId: optionalText,
+      refreshNextTokenVersion: optionalText,
+      refreshClaimedAt: optionalInteger,
+      refreshClaimExpiresAt: optionalInteger,
+      expiresAt: integer,
+    },
+    [
+      ["moduleId", "grantId"],
+      ["moduleId", "subjectId", "profileKey", "identityKey"],
+    ],
+  ),
+  oauthConnectedRevocations: spec(
+    {
+      jobId: text,
+      moduleId: text,
+      subjectId: text,
+      identityKey: text,
+      snapshot: text,
+      state: text,
+      claimId: optionalText,
+      claimedAt: optionalInteger,
+      claimExpiresAt: optionalInteger,
+      retentionUntil: integer,
+    },
+    [["jobId"]],
+  ),
   proofs: spec(
     {
       moduleId: text,

package/src/internal/storage-validation.ts

@@ -2,11 +2,23 @@ import { Context, Effect, Schema } from "effect";
 import { SqlClient } from "effect/sql/SqlClient";
 
 import { PersistenceConfigurationError } from "./configuration";
+import type { PhysicalTextColumn } from "./native-sql-table";
 import type { StorageTable } from "./storage-tables";
 
 const Columns = Schema.Array(Schema.String);
 const Keys = Schema.Array(Columns);
-const Metadata = Schema.Struct({ relation: Schema.String, columns: Columns, keys: Keys });
+
+const TextColumns = Schema.Array(
+  Schema.Struct({ name: Schema.String, type: Schema.String, collation: Schema.String }),
+);
+
+const Metadata = Schema.Struct({
+  relation: Schema.String,
+  columns: Columns,
+  keys: Keys,
+  textColumns: TextColumns,
+});
+
 const PgMetadata = Schema.Array(Metadata);
 
 const SqliteMetadata = Schema.Array(
@@ -14,10 +26,18 @@ const SqliteMetadata = Schema.Array(
     relation: Schema.String,
     columns: Schema.fromJsonString(Columns),
     keys: Schema.fromJsonString(Keys),
+    textColumns: Schema.fromJsonString(TextColumns),
   }),
 );
 
-const MysqlColumns = Schema.Array(Schema.Struct({ relation: Schema.String, name: Schema.String }));
+const MysqlColumns = Schema.Array(
+  Schema.Struct({
+    relation: Schema.String,
+    name: Schema.String,
+    type: Schema.String,
+    collation: Schema.NullOr(Schema.String),
+  }),
+);
 
 const MysqlIndexes = Schema.Array(
   Schema.Struct({
@@ -101,28 +121,32 @@ export interface StorageValidation {
   readonly required: ReadonlyArray<ReadonlyArray<string>>;
 }
 
-/** Batch physical metadata reads, reusing only the current acquisition snapshot.
- * Every requirement is still checked; later acquisitions read fresh metadata. */
-export const validateStorageBatch = Effect.fnUntraced(
-  function* (dialect: "pg" | "mysql" | "sqlite", requirements: ReadonlyArray<StorageValidation>) {
-    if (requirements.length === 0) return;
+type Dialect = "pg" | "mysql" | "sqlite";
+
+/** Share physical type, collation and key observations only during acquisition. */
+const readStorageMetadata = Effect.fnUntraced(
+  function* (
+    dialect: Dialect,
+    physical: ReadonlyArray<Pick<PhysicalStorageTable, "name" | "schema">>,
+  ) {
     if (
       dialect === "sqlite" &&
-      requirements.some(({ table }) => table.schema !== undefined && table.schema !== "main")
+      physical.some((table) => table.schema !== undefined && table.schema !== "main")
     )
       return yield* PersistenceConfigurationError.make({
         reason: "SQLite storage must belong to the main database",
       });
-    const client = yield* SqlClient;
+    const captured = yield* SqlClient;
+    const client = captured.withoutTransforms();
     const cache = yield* CurrentMetadata;
 
     const byRelation = cache?.active
-      ? (cache.clients.get(client) ?? new Map<string, typeof Metadata.Type>())
+      ? (cache.clients.get(captured) ?? new Map<string, typeof Metadata.Type>())
       : new Map<string, typeof Metadata.Type>();
 
-    if (cache?.active) cache.clients.set(client, byRelation);
+    if (cache?.active) cache.clients.set(captured, byRelation);
 
-    const tables = new Map(requirements.map(({ table }) => [qualifiedTableName(table), table]));
+    const tables = new Map(physical.map((table) => [qualifiedTableName(table), table]));
 
     const missing = [...tables.entries()].filter(
       ([relation]) => !byRelation.has(`${dialect}:${relation}`),
@@ -151,7 +175,11 @@ export const validateStorageBatch = Effect.fnUntraced(
               from pragma_index_list(requested.name) i
               where i."unique" = 1 and i.partial = 0
                 and not exists(select 1 from pragma_index_info(i.name) where name is null)
-            ) storage_key where json_array_length(storage_key.columns) > 0) as keys
+            ) storage_key where json_array_length(storage_key.columns) > 0) as keys,
+            (select json_group_array(json_object('name', c.name, 'type', 'TEXT', 'collation', 'BINARY'))
+              from pragma_table_info(requested.name) c
+              join sqlite_schema s on s.name = requested.name and s.type = 'table'
+              where upper(c.type) = 'TEXT' and instr(lower(s.sql), 'collate') = 0) as "textColumns"
           from requested
         `.pipe(Effect.flatMap(Schema.decodeUnknownEffect(SqliteMetadata)));
           })
@@ -168,7 +196,8 @@ export const validateStorageBatch = Effect.fnUntraced(
               );
 
               const columns = yield* client`
-          select requested.relation, c.column_name as name
+          select requested.relation, c.column_name as name,
+            c.data_type as type, c.collation_name as collation
           from (${requested}) requested join information_schema.columns c
             on c.table_schema = coalesce(requested.schemaName, database()) and c.table_name = requested.tableName
         `.pipe(Effect.flatMap(Schema.decodeUnknownEffect(MysqlColumns)));
@@ -196,6 +225,13 @@ export const validateStorageBatch = Effect.fnUntraced(
                   columns: columns
                     .filter((column) => column.relation === relation)
                     .map((column) => column.name),
+                  textColumns: columns.flatMap((column) =>
+                    column.relation === relation &&
+                    column.collation !== null &&
+                    ["varchar", "text", "tinytext", "mediumtext", "longtext"].includes(column.type)
+                      ? [{ name: column.name, type: column.type, collation: column.collation }]
+                      : [],
+                  ),
                   keys: [...grouped.values()]
                     .filter((entries) =>
                       entries.every((entry) => entry.columnName !== null && entry.prefix === null),
@@ -229,7 +265,12 @@ export const validateStorageBatch = Effect.fnUntraced(
             and i.indpred is null and i.indexprs is null
             and k.ordinality <= i.indnkeyatts
           group by i.indexrelid
-        ) storage_key), '[]'::jsonb) as keys
+        ) storage_key), '[]'::jsonb) as keys,
+        coalesce((select jsonb_agg(jsonb_build_object(
+          'name', a.attname::text, 'type', a.atttypid::text, 'collation', a.attcollation::text))
+          from pg_attribute a where a.attrelid = to_regclass(requested.relation)
+            and a.attnum > 0 and not a.attisdropped
+            and a.atttypid in ('text'::regtype, 'varchar'::regtype)), '[]'::jsonb) as "textColumns"
       from (values ${requested}) requested(relation)
     `.pipe(Effect.flatMap(Schema.decodeUnknownEffect(PgMetadata)));
             });
@@ -237,18 +278,7 @@ export const validateStorageBatch = Effect.fnUntraced(
       for (const row of metadata) byRelation.set(`${dialect}:${row.relation}`, row);
     }
 
-    for (const { table, required } of requirements) {
-      const relation = qualifiedTableName(table);
-      const actual = byRelation.get(`${dialect}:${relation}`);
-
-      for (const column of Object.values(table.columns)) {
-        if (actual === undefined || !actual.columns.includes(column.name))
-          return yield* PersistenceConfigurationError.make({
-            reason: `Missing SQL column ${relation}.${column.name}`,
-          });
-      }
-      yield* validateKeys(table, required, actual?.keys ?? []);
-    }
+    return byRelation;
   },
   Effect.mapError((error) =>
     Schema.is(PersistenceConfigurationError)(error)
@@ -257,6 +287,76 @@ export const validateStorageBatch = Effect.fnUntraced(
   ),
 );
 
+/** Batch physical metadata reads, reusing only the current acquisition snapshot.
+ * Every requirement is still checked; later acquisitions read fresh metadata. */
+export const validateStorageBatch = Effect.fnUntraced(function* (
+  dialect: Dialect,
+  requirements: ReadonlyArray<StorageValidation>,
+) {
+  if (requirements.length === 0) return;
+
+  const byRelation = yield* readStorageMetadata(
+    dialect,
+    requirements.map(({ table }) => table),
+  );
+
+  for (const { table, required } of requirements) {
+    const relation = qualifiedTableName(table);
+    const actual = byRelation.get(`${dialect}:${relation}`);
+
+    for (const column of Object.values(table.columns)) {
+      if (actual === undefined || !actual.columns.includes(column.name))
+        return yield* PersistenceConfigurationError.make({
+          reason: `Missing SQL column ${relation}.${column.name}`,
+        });
+    }
+    yield* validateKeys(table, required, actual?.keys ?? []);
+  }
+});
+
+/** Candidate declarations do not establish SQL equality compatibility. SQLite
+ * omits column collations, so only TEXT tables without COLLATE qualify. */
+export const canJoinTextColumns = Effect.fnUntraced(function* (
+  columns: ReadonlyArray<PhysicalTextColumn | undefined>,
+) {
+  const candidates = columns.filter((column) => column !== undefined);
+
+  if (candidates.length !== columns.length || candidates.length === 0) return false;
+  const client = yield* SqlClient;
+
+  const dialect = client.onDialectOrElse({
+    pg: () => "pg" as const,
+    mysql: () => "mysql" as const,
+    sqlite: () => "sqlite" as const,
+    orElse: () => undefined,
+  });
+
+  if (
+    dialect === undefined ||
+    (dialect === "sqlite" &&
+      candidates.some(({ table }) => table.schema !== undefined && table.schema !== "main"))
+  )
+    return false;
+
+  const metadata = yield* readStorageMetadata(
+    dialect,
+    candidates.map(({ table }) => table),
+  );
+
+  const physical = candidates.map(({ table, name }) =>
+    metadata
+      .get(`${dialect}:${qualifiedTableName(table)}`)
+      ?.textColumns.find((column) => column.name === name),
+  );
+
+  const first = physical[0];
+
+  return (
+    first !== undefined &&
+    physical.every((column) => column?.type === first.type && column.collation === first.collation)
+  );
+});
+
 /** Validate physical columns and unconditional uniqueness before operations run. */
 export const validateStorage = (
   dialect: "pg" | "mysql" | "sqlite",