@yielded/auth-persistence 0.1.0-beta.7 → 0.1.0-beta.9

package/src/drizzle/model.ts

@@ -22,9 +22,11 @@ import {
   type InferSelectModel,
   type Table,
 } from "drizzle-orm";
-import { Context, DateTime, Effect, Layer, Option } from "effect";
+import { Context, DateTime, Effect, Layer } from "effect";
 import type * as SqlClient from "effect/unstable/sql/SqlClient";
 
+import { requireStandalone } from "../internal/standalone";
+
 export type CommitMode = "interactive" | "synchronous" | "batch";
 
 /**
@@ -39,16 +41,12 @@ export interface SqlClientTransactionDatabase {
 export const requireStandaloneConsume = (
   database: SqlClientTransactionDatabase,
 ): Effect.Effect<void, AuthStoreError> =>
-  Effect.serviceOption(database.$client.transactionService).pipe(
-    Effect.flatMap(
-      Option.match({
-        onNone: () => Effect.void,
-        onSome: () =>
-          AuthStoreError.make({
-            message: "Use the decision consume API inside an outer database transaction",
-          }),
+  requireStandalone(
+    () =>
+      AuthStoreError.make({
+        message: "Use the decision consume API inside an outer database transaction",
       }),
-    ),
+    database.$client,
   );
 
 export type { ChallengeConsumeDecision } from "@yielded/auth/Persistence";

package/src/drizzle/standalone-guard.ts

@@ -1,6 +1,8 @@
-import { Context, Effect, Option, Predicate } from "effect";
+import { Context, Effect, Predicate } from "effect";
 import type * as SqlClient from "effect/unstable/sql/SqlClient";
 
+import { requireStandalone } from "../internal/standalone";
+
 type TransactionService = Context.Key<
   SqlClient.TransactionConnection,
   SqlClient.TransactionConnection.Service
@@ -27,12 +29,5 @@ export const sqlClientStandaloneGuard = <Failure>(
 
   if (service === undefined) return Effect.suspend(() => Effect.fail(unavailable()));
 
-  return Effect.serviceOption(service).pipe(
-    Effect.flatMap(
-      Option.match({
-        onNone: () => Effect.void,
-        onSome: () => Effect.fail(unavailable()),
-      }),
-    ),
-  );
+  return requireStandalone(unavailable, { transactionService: service });
 };

package/src/drizzle/transaction-mysql.ts

@@ -65,6 +65,8 @@ export const mysqlTransaction = <A, E, R, Failure>(
         commit: () => statement("COMMIT"),
         rollback: () => statement("ROLLBACK"),
         savepoint: (_connection, id) => statement(`SAVEPOINT effect_auth_oauth_${id}`),
+        releaseSavepoint: (_connection, id) =>
+          statement(`RELEASE SAVEPOINT effect_auth_oauth_${id}`),
         rollbackSavepoint: (_connection, id) =>
           statement(`ROLLBACK TO SAVEPOINT effect_auth_oauth_${id}`),
       });

package/src/index.ts

@@ -1,4 +1,6 @@
 export { AuthPersistence } from "./internal/sql-persistence";
+export { OAuthAppPersistence } from "./internal/oauth-app";
+export { OAuthServerPersistence } from "./internal/oauth-server";
 export { PersistenceConfigurationError } from "./internal/configuration";
 export { PersistenceMappingError } from "./internal/mapping-error";
 export { StorageColumn, StorageTable } from "./internal/storage-tables";

package/src/internal/oauth-app.ts

@@ -0,0 +1,82 @@
+import { OAuthUnavailable } from "@yielded/auth/OAuth";
+import { Persistence, Record } from "@yielded/auth/OAuthApp";
+import { Effect, Layer, Schema } from "effect";
+import { SqlClient } from "effect/unstable/sql";
+
+import { requireStandalone } from "./standalone";
+
+const codec = Schema.fromJsonString(Record);
+const Row = Schema.Struct({ payload: Schema.String, version: Schema.String });
+
+/** Apply with the application's migrations. SQLite (including D1) and PostgreSQL.
+ * Each transition is one conditional statement, so D1 needs no interactive
+ * transaction and parallel workers share the same refresh/code claim.
+ */
+const migration = `CREATE TABLE yielded_oauth_app (
+  namespace TEXT NOT NULL,
+  record_key TEXT NOT NULL,
+  version TEXT NOT NULL,
+  payload TEXT NOT NULL,
+  PRIMARY KEY (namespace, record_key)
+)`;
+
+const layer = Layer.effect(
+  Persistence,
+  Effect.gen(function* () {
+    const sql = yield* SqlClient.SqlClient;
+
+    if (!sql.onDialectOrElse({ sqlite: () => true, pg: () => true, orElse: () => false }))
+      return yield* OAuthUnavailable.make({});
+
+    const noTransaction = requireStandalone(() => OAuthUnavailable.make({}), sql);
+
+    const failure = <A, E, R>(effect: Effect.Effect<A, E, R>) =>
+      effect.pipe(Effect.mapError(() => OAuthUnavailable.make({})));
+
+    return Persistence.of({
+      get: Effect.fn("OAuthAppPersistence.get")(function* (namespace, key) {
+        yield* noTransaction;
+
+        const rows = yield* sql<{
+          payload: string;
+          version: string;
+        }>`SELECT payload, version FROM yielded_oauth_app WHERE namespace = ${namespace} AND record_key = ${key}`;
+
+        if (rows.length === 0) return undefined;
+        if (rows.length !== 1) return yield* OAuthUnavailable.make({});
+        const row = yield* Schema.decodeEffect(Row)(rows[0]);
+        const value = yield* Schema.decodeEffect(codec)(row.payload);
+
+        if (value.version !== row.version) return yield* OAuthUnavailable.make({});
+
+        return value;
+      }, failure),
+      insert: Effect.fn("OAuthAppPersistence.insert")(function* (namespace, key, value) {
+        yield* noTransaction;
+        const payload = yield* Schema.encodeEffect(codec)(value);
+
+        const rows =
+          yield* sql`INSERT INTO yielded_oauth_app (namespace, record_key, version, payload) VALUES (${namespace}, ${key}, ${value.version}, ${payload}) ON CONFLICT (namespace, record_key) DO NOTHING RETURNING version`;
+
+        return rows.length === 1;
+      }, failure),
+      compareAndSet: Effect.fn("OAuthAppPersistence.compareAndSet")(function* (
+        namespace,
+        key,
+        version,
+        value,
+      ) {
+        yield* noTransaction;
+        if (value.version === version) return yield* OAuthUnavailable.make({});
+        const payload = yield* Schema.encodeEffect(codec)(value);
+
+        const rows =
+          yield* sql`UPDATE yielded_oauth_app SET version = ${value.version}, payload = ${payload} WHERE namespace = ${namespace} AND record_key = ${key} AND version = ${version} RETURNING version`;
+
+        return rows.length === 1;
+      }, failure),
+    });
+  }),
+);
+
+export const OAuthAppPersistence = { layer, migration };

package/src/internal/oauth-server.ts

@@ -0,0 +1,89 @@
+import { Persistence, Record, Unavailable } from "@yielded/auth/OAuthServer";
+import { Effect, Layer, Schema } from "effect";
+import { SqlClient } from "effect/unstable/sql";
+
+import { requireStandalone } from "./standalone";
+
+const codec = Schema.fromJsonString(Record);
+
+const Row = Schema.Struct({
+  payload: Schema.String,
+  version: Schema.String,
+  revoked: Schema.Literals([0, 1]),
+});
+
+/** SQLite (including D1) and PostgreSQL. Apply once through application migrations.
+ * Expired records may be deleted when expires_at_millis <= the current time.
+ * Revocation has its own monotonic column so it cannot lose a race with rotation.
+ */
+const migration = `CREATE TABLE yielded_oauth_server (
+  namespace TEXT NOT NULL,
+  grant_id TEXT NOT NULL,
+  version TEXT NOT NULL,
+  revoked INTEGER NOT NULL DEFAULT 0,
+  expires_at_millis BIGINT NOT NULL,
+  payload TEXT NOT NULL,
+  PRIMARY KEY (namespace, grant_id)
+)`;
+
+const layer = Layer.effect(
+  Persistence,
+  Effect.gen(function* () {
+    const sql = yield* SqlClient.SqlClient;
+
+    if (!sql.onDialectOrElse({ sqlite: () => true, pg: () => true, orElse: () => false }))
+      return yield* Unavailable.make({});
+    const standalone = requireStandalone(() => Unavailable.make({}), sql);
+
+    const failure = <A, E, R>(effect: Effect.Effect<A, E, R>) =>
+      effect.pipe(Effect.mapError(() => Unavailable.make({})));
+
+    return Persistence.of({
+      get: Effect.fn("OAuthServerPersistence.get")(function* (namespace, id) {
+        yield* standalone;
+
+        const rows =
+          yield* sql`SELECT payload, version, revoked FROM yielded_oauth_server WHERE namespace = ${namespace} AND grant_id = ${id}`;
+
+        if (rows.length === 0) return undefined;
+        if (rows.length !== 1) return yield* Unavailable.make({});
+        const row = yield* Schema.decodeUnknownEffect(Row)(rows[0]);
+        const record = yield* Schema.decodeEffect(codec)(row.payload);
+
+        if (record.version !== row.version) return yield* Unavailable.make({});
+
+        return row.revoked === 1 ? { ...record, status: "Revoked" as const } : record;
+      }, failure),
+      insert: Effect.fn("OAuthServerPersistence.insert")(function* (namespace, id, record) {
+        yield* standalone;
+        const payload = yield* Schema.encodeEffect(codec)(record);
+
+        const rows =
+          yield* sql`INSERT INTO yielded_oauth_server (namespace, grant_id, version, revoked, expires_at_millis, payload) VALUES (${namespace}, ${id}, ${record.version}, ${record.status === "Revoked" ? 1 : 0}, ${record.expiresAtMillis}, ${payload}) ON CONFLICT (namespace, grant_id) DO NOTHING RETURNING version`;
+
+        return rows.length === 1;
+      }, failure),
+      compareAndSet: Effect.fn("OAuthServerPersistence.compareAndSet")(function* (
+        namespace,
+        id,
+        version,
+        record,
+      ) {
+        yield* standalone;
+        if (version === record.version) return yield* Unavailable.make({});
+        const payload = yield* Schema.encodeEffect(codec)(record);
+
+        const rows =
+          yield* sql`UPDATE yielded_oauth_server SET version = ${record.version}, revoked = ${record.status === "Revoked" ? 1 : 0}, expires_at_millis = ${record.expiresAtMillis}, payload = ${payload} WHERE namespace = ${namespace} AND grant_id = ${id} AND version = ${version} AND revoked = 0 RETURNING version`;
+
+        return rows.length === 1;
+      }, failure),
+      revoke: Effect.fn("OAuthServerPersistence.revoke")(function* (namespace, id) {
+        yield* standalone;
+        yield* sql`UPDATE yielded_oauth_server SET revoked = 1 WHERE namespace = ${namespace} AND grant_id = ${id}`;
+      }, failure),
+    });
+  }),
+);
+
+export const OAuthServerPersistence = { migration, layer };

package/src/internal/passkeys.ts

@@ -36,6 +36,7 @@ import type { PasskeyTargetConfiguration } from "./passkey/target";
 import type { Backend } from "./persistence";
 import type { ProofSqlDatabase } from "./proof-kernel";
 import type { QueryOperations } from "./query-operations";
+import { requireStandalone } from "./standalone";
 import { storageTables, type StorageRole } from "./storage-tables";
 
 const profileJson = Schema.fromJsonString(PasskeyProfile);
@@ -395,12 +396,7 @@ export const makeComposedPasskeys = (
         mode: "interactive",
         dialect,
         locking: dialect === "pg",
-        standaloneGuard: () =>
-          Effect.serviceOption(client.transactionService).pipe(
-            Effect.flatMap((value) =>
-              value._tag === "None" ? Effect.void : Effect.fail(unavailable()),
-            ),
-          ),
+        standaloneGuard: () => requireStandalone(unavailable, client),
       };
 
       // The backend has already checked the native query builder; schemas check stored values.

package/src/internal/persistence.ts

@@ -7,7 +7,7 @@ import { PhoneAdmission, PhoneSignInTargets, PhoneOtpUnavailable } from "@yielde
 import { ProofPersistence, ProofUnavailable } from "@yielded/auth/Proofs";
 import { AuthenticationAuthority, SessionUnavailable } from "@yielded/auth/Sessions";
 import type { Table } from "drizzle-orm";
-import { Context, Effect, Layer, Option, Schema } from "effect";
+import { Context, Effect, Layer, Schema } from "effect";
 import { SqlClient } from "effect/unstable/sql";
 
 import {
@@ -35,6 +35,7 @@ import { makeProofKernel, type ProofSqlDatabase, type ProofSqlQuery } from "./pr
 import type { QueryOperations } from "./query-operations";
 import { makeRegistrationAuthority, type CreateSubject } from "./registration";
 import { makeSessionKernel, type SessionSqlDatabase } from "./session-kernel";
+import { requireStandalone } from "./standalone";
 import { makeMappings } from "./storage-mapping";
 import {
   tableDefinition,
@@ -323,10 +324,7 @@ export const createPersistence = <T extends object, R>(
         ]);
         const mappings = makeMappings(storage);
 
-        const standalone = <E>(error: () => E) =>
-          Effect.serviceOption(client.transactionService).pipe(
-            Effect.flatMap((value) => (Option.isNone(value) ? Effect.void : Effect.fail(error()))),
-          );
+        const standalone = <E>(error: () => E) => requireStandalone(error, client);
 
         // Backend validation owns the foreign query-builder shape, never the decoded rows.
         const native = database as ProofSqlDatabase &

package/src/internal/sql-table.ts

@@ -1,5 +1,20 @@
+import { Option, Schema, SchemaGetter } from "effect";
+
 import { PersistenceMappingError } from "./mapping-error";
 
+const SqlInteger = Schema.Union([
+  Schema.Int,
+  Schema.BigInt,
+  Schema.String.check(Schema.isPattern(/^-?\d+$/)),
+]).pipe(
+  Schema.decodeTo(Schema.Int, {
+    decode: SchemaGetter.transform(Number),
+    encode: SchemaGetter.passthrough(),
+  }),
+);
+
+const decodeInteger = Schema.decodeUnknownOption(SqlInteger);
+
 export type Dialect = "pg" | "sqlite";
 export type Row = Readonly<Record<string, unknown>>;
 
@@ -52,9 +67,9 @@ export class Column extends Fragment {
           throw PersistenceMappingError.make({ operation: "decode", cause: "Invalid SQL boolean" });
         }
         if (options.type === "integer") {
-          const number = typeof value === "string" && /^-?\d+$/.test(value) ? Number(value) : value;
+          const number = decodeInteger(value);
 
-          if (typeof number === "number" && Number.isSafeInteger(number)) return number;
+          if (Option.isSome(number)) return number.value;
           throw PersistenceMappingError.make({
             operation: "decode",
             cause: "SQL integer is outside the safe range",

package/src/internal/standalone.ts

@@ -0,0 +1,30 @@
+import { type Context, Effect } from "effect";
+import type * as SqlClient from "effect/unstable/sql/SqlClient";
+
+/** Standalone operations must observe their own durable commit. */
+export const requireStandalone = <Failure>(
+  unavailable: () => Failure,
+  client?: {
+    readonly transactionService: Context.Key<
+      SqlClient.TransactionConnection,
+      SqlClient.TransactionConnection.Service
+    >;
+  },
+): Effect.Effect<void, Failure> =>
+  Effect.withFiber((fiber) => {
+    const services = fiber.context.mapUnsafe;
+
+    if (client !== undefined && services.has(client.transactionService.key))
+      return Effect.fail(unavailable());
+
+    // rc.117 libSQL uses a private per-client marker that is not exposed through
+    // SqlClient.transactionService. Conservatively reject every ambient libSQL
+    // transaction, including another client's, before issuing standalone writes.
+    // Recheck this upstream detail whenever the Effect driver is upgraded.
+    for (const key of services.keys()) {
+      if (key.startsWith("@effect/sql-libsql/LibsqlClient/LibsqlTransaction/"))
+        return Effect.fail(unavailable());
+    }
+
+    return Effect.void;
+  });

package/src/internal/transaction-execution-kernel.ts

@@ -7,11 +7,12 @@ import {
 } from "@yielded/auth/Hooks";
 /* oxlint-disable no-explicit-any -- existing storage kernels erase foreign table shapes; domain errors remain typed. */
 /* oxlint-disable no-explicit-any -- private execution bridge retains exact public driver wrappers. */
-import { Context, Effect, Option } from "effect";
+import { Context, Effect } from "effect";
 import type * as SqlClient from "effect/unstable/sql/SqlClient";
 import type * as SqlError from "effect/unstable/sql/SqlError";
 import type { Statement } from "effect/unstable/sql/Statement";
 
+import { requireStandalone } from "./standalone";
 import {
   type TransactionNativeDatabase,
   type TransactionOwner,
@@ -67,12 +68,7 @@ export const makeTransactionExecutionKernel = (
     database: {
       readonly $client: Pick<SqlClient.SqlClient, "transactionService">;
     },
-  ) =>
-    Effect.serviceOption(database.$client.transactionService).pipe(
-      Effect.flatMap(
-        Option.match({ onNone: () => Effect.void, onSome: () => Effect.fail(unavailable()) }),
-      ),
-    );
+  ) => requireStandalone(unavailable, database.$client);
 
   const makeTransactionExecution = <Failure, OwnerId>(
     ownerTag: Context.Key<OwnerId, TransactionOwner<Failure>>,