@yielded/auth-persistence 0.1.0-beta.7

package/src/drizzle/passkey-write-drivers.ts

@@ -0,0 +1,395 @@
+import type { LifecycleHooks } from "@yielded/auth/Hooks";
+import { PasskeyManagementPersistence, PasskeyPersistence } from "@yielded/auth/Passkey";
+import type { Table } from "drizzle-orm";
+import { Context, Effect } from "effect";
+
+import type { PasskeyMappingSource } from "./passkey-model";
+import type { PasskeyCoordinatorError, PasskeyTargetConfiguration } from "./passkey-target";
+import type {
+  PasskeyManagementMapping,
+  PasskeyRegistrationMapping,
+  PasskeyRegistrationWriter,
+} from "./passkey-write-model";
+import {
+  coordinateTargetPasskeyManagement,
+  coordinateTargetPasskeyRegistrationWriter,
+  makeTargetPasskeyManagement,
+  makeTargetPasskeyRegistrationWriter,
+} from "./passkey-write-target";
+import type { SuppliedService } from "./SuppliedService";
+// oxlint-disable-next-line no-explicit-any -- inspect the installed concrete transaction callback.
+type TransactionOf<D> = D extends { readonly transaction: (...args: any[]) => any }
+  ? Parameters<Parameters<D["transaction"]>[0]>[0]
+  : never;
+
+export const makePasskeyWriteTarget = <
+  D,
+  T extends Table,
+  Extra = unknown,
+  Synchronous extends boolean = false,
+>(
+  configuration: PasskeyTargetConfiguration,
+) => {
+  function coordinatePasskeyManagement<
+    Database extends D,
+    S extends T,
+    C extends T,
+    F extends T,
+    O extends T,
+    H extends T,
+    M extends T,
+    Flow extends T,
+    Admission extends T,
+    Charge extends T,
+    Command extends T,
+    N,
+    A,
+    E,
+    R,
+    RSetup = never,
+    DatabaseError = never,
+    DatabaseRequirements = never,
+  >(
+    acquire: Effect.Effect<Database, DatabaseError, DatabaseRequirements>,
+    options: {
+      readonly mapping: PasskeyMappingSource<
+        PasskeyManagementMapping<S, C, F, O, H, M, Flow, Admission, Charge, Command, N> & Extra,
+        RSetup
+      >;
+      readonly transaction?: never;
+    },
+    body: Effect.Effect<
+      A,
+      E,
+      Synchronous extends true ? NoInfer<PasskeyPersistence | PasskeyManagementPersistence> : R
+    >,
+  ): Effect.Effect<
+    A,
+    PasskeyCoordinatorError<E> | DatabaseError,
+    | (Synchronous extends true
+        ? never
+        : Exclude<R, PasskeyPersistence | PasskeyManagementPersistence>)
+    | LifecycleHooks
+    | RSetup
+    | DatabaseRequirements
+  >;
+  function coordinatePasskeyManagement<
+    Database extends D,
+    S extends T,
+    C extends T,
+    F extends T,
+    O extends T,
+    H extends T,
+    M extends T,
+    Flow extends T,
+    Admission extends T,
+    Charge extends T,
+    Command extends T,
+    N,
+    A,
+    E,
+    R,
+    TxId,
+    TxShape,
+    RSetup = never,
+    DatabaseError = never,
+    DatabaseRequirements = never,
+  >(
+    acquire: Effect.Effect<Database, DatabaseError, DatabaseRequirements>,
+    options: {
+      readonly mapping: PasskeyMappingSource<
+        PasskeyManagementMapping<S, C, F, O, H, M, Flow, Admission, Charge, Command, N> & Extra,
+        RSetup
+      >;
+      readonly transaction: SuppliedService<TxId, NoInfer<TransactionOf<Database>>, TxShape>;
+    },
+    body: Effect.Effect<
+      A,
+      E,
+      Synchronous extends true
+        ? NoInfer<PasskeyPersistence | PasskeyManagementPersistence | TxId>
+        : R
+    >,
+  ): Effect.Effect<
+    A,
+    PasskeyCoordinatorError<E> | DatabaseError,
+    | (Synchronous extends true
+        ? never
+        : Exclude<R, PasskeyPersistence | PasskeyManagementPersistence | TxId>)
+    | LifecycleHooks
+    | RSetup
+    | DatabaseRequirements
+  >;
+  function coordinatePasskeyManagement<
+    Database extends D,
+    S extends T,
+    C extends T,
+    F extends T,
+    O extends T,
+    H extends T,
+    M extends T,
+    Flow extends T,
+    Admission extends T,
+    Charge extends T,
+    Command extends T,
+    N,
+    A,
+    E,
+    R,
+    TxId,
+    TxShape,
+    RSetup = never,
+    DatabaseError = never,
+    DatabaseRequirements = never,
+  >(
+    acquire: Effect.Effect<Database, DatabaseError, DatabaseRequirements>,
+    options: {
+      readonly mapping: PasskeyMappingSource<
+        PasskeyManagementMapping<S, C, F, O, H, M, Flow, Admission, Charge, Command, N> & Extra,
+        RSetup
+      >;
+      readonly transaction?: SuppliedService<TxId, NoInfer<TransactionOf<Database>>, TxShape>;
+    },
+    body: Effect.Effect<A, E, R>,
+  ): Effect.Effect<
+    A,
+    PasskeyCoordinatorError<E> | DatabaseError,
+    | Exclude<R, PasskeyPersistence | PasskeyManagementPersistence>
+    | LifecycleHooks
+    | RSetup
+    | DatabaseRequirements
+  > {
+    return Effect.flatMap(acquire, (database) =>
+      coordinateTargetPasskeyManagement(
+        database,
+        options.mapping,
+        configuration,
+        (transaction: TransactionOf<Database>, services) => {
+          const context = Context.make(PasskeyPersistence, services.passkeyPersistence).pipe(
+            Context.add(PasskeyManagementPersistence, services.passkeyManagementPersistence),
+          );
+
+          const work = Effect.provideContext(body, context);
+
+          return options.transaction === undefined
+            ? work
+            : Effect.provideService(work, options.transaction, options.transaction.of(transaction));
+        },
+      ),
+    );
+  }
+
+  const makePasskeyManagementServices = <
+    Database extends D,
+    S extends T,
+    C extends T,
+    F extends T,
+    O extends T,
+    H extends T,
+    M extends T,
+    Flow extends T,
+    Admission extends T,
+    Charge extends T,
+    Command extends T,
+    N,
+    RSetup = never,
+  >(
+    database: Database,
+    mapping: PasskeyMappingSource<
+      PasskeyManagementMapping<S, C, F, O, H, M, Flow, Admission, Charge, Command, N> & Extra,
+      RSetup
+    >,
+  ) => makeTargetPasskeyManagement(database, mapping, configuration);
+
+  function coordinatePasskeyRegistration<
+    Database extends D,
+    S extends T,
+    C extends T,
+    F extends T,
+    O extends T,
+    H extends T,
+    M extends T,
+    Flow extends T,
+    Admission extends T,
+    Charge extends T,
+    Intent extends T,
+    N,
+    Value,
+    A,
+    E,
+    R,
+    AuthorityId,
+    RSetup = never,
+    DatabaseError = never,
+    DatabaseRequirements = never,
+  >(
+    acquire: Effect.Effect<Database, DatabaseError, DatabaseRequirements>,
+    options: {
+      readonly mapping: PasskeyMappingSource<
+        PasskeyRegistrationMapping<S, C, F, O, H, M, Flow, Admission, Charge, Intent, N, Value> &
+          Extra,
+        RSetup
+      >;
+      readonly authority: Context.Key<AuthorityId, PasskeyRegistrationWriter<Value>>;
+      readonly transaction?: never;
+    },
+    body: Effect.Effect<
+      A,
+      E,
+      Synchronous extends true ? NoInfer<PasskeyPersistence | AuthorityId> : R
+    >,
+  ): Effect.Effect<
+    A,
+    PasskeyCoordinatorError<E> | DatabaseError,
+    | (Synchronous extends true ? never : Exclude<R, PasskeyPersistence | AuthorityId>)
+    | LifecycleHooks
+    | RSetup
+    | DatabaseRequirements
+  >;
+  function coordinatePasskeyRegistration<
+    Database extends D,
+    S extends T,
+    C extends T,
+    F extends T,
+    O extends T,
+    H extends T,
+    M extends T,
+    Flow extends T,
+    Admission extends T,
+    Charge extends T,
+    Intent extends T,
+    N,
+    Value,
+    A,
+    E,
+    R,
+    AuthorityId,
+    TxId,
+    TxShape,
+    RSetup = never,
+    DatabaseError = never,
+    DatabaseRequirements = never,
+  >(
+    acquire: Effect.Effect<Database, DatabaseError, DatabaseRequirements>,
+    options: {
+      readonly mapping: PasskeyMappingSource<
+        PasskeyRegistrationMapping<S, C, F, O, H, M, Flow, Admission, Charge, Intent, N, Value> &
+          Extra,
+        RSetup
+      >;
+      readonly authority: Context.Key<AuthorityId, PasskeyRegistrationWriter<Value>>;
+      readonly transaction: SuppliedService<TxId, NoInfer<TransactionOf<Database>>, TxShape>;
+    },
+    body: Effect.Effect<
+      A,
+      E,
+      Synchronous extends true ? NoInfer<PasskeyPersistence | AuthorityId | TxId> : R
+    >,
+  ): Effect.Effect<
+    A,
+    PasskeyCoordinatorError<E> | DatabaseError,
+    | (Synchronous extends true ? never : Exclude<R, PasskeyPersistence | AuthorityId | TxId>)
+    | LifecycleHooks
+    | RSetup
+    | DatabaseRequirements
+  >;
+  function coordinatePasskeyRegistration<
+    Database extends D,
+    S extends T,
+    C extends T,
+    F extends T,
+    O extends T,
+    H extends T,
+    M extends T,
+    Flow extends T,
+    Admission extends T,
+    Charge extends T,
+    Intent extends T,
+    N,
+    Value,
+    A,
+    E,
+    R,
+    AuthorityId,
+    TxId,
+    TxShape,
+    RSetup = never,
+    DatabaseError = never,
+    DatabaseRequirements = never,
+  >(
+    acquire: Effect.Effect<Database, DatabaseError, DatabaseRequirements>,
+    options: {
+      readonly mapping: PasskeyMappingSource<
+        PasskeyRegistrationMapping<S, C, F, O, H, M, Flow, Admission, Charge, Intent, N, Value> &
+          Extra,
+        RSetup
+      >;
+      readonly authority: Context.Key<AuthorityId, PasskeyRegistrationWriter<Value>>;
+      readonly transaction?: SuppliedService<TxId, NoInfer<TransactionOf<Database>>, TxShape>;
+    },
+    body: Effect.Effect<A, E, R>,
+  ): Effect.Effect<
+    A,
+    PasskeyCoordinatorError<E> | DatabaseError,
+    Exclude<R, PasskeyPersistence | AuthorityId> | LifecycleHooks | RSetup | DatabaseRequirements
+  > {
+    return Effect.flatMap(acquire, (database) =>
+      coordinateTargetPasskeyRegistrationWriter(
+        database,
+        options.mapping,
+        configuration,
+        (
+          transaction: TransactionOf<Database>,
+          services: import("./passkey-write-model").PasskeyRegistrationServices<Value>,
+        ) => {
+          const context = Context.make(PasskeyPersistence, services.passkeyPersistence).pipe(
+            Context.add(options.authority, services.passkeyRegistrationAuthority),
+          );
+
+          const work = Effect.provideContext(body, context);
+
+          return options.transaction === undefined
+            ? work
+            : Effect.provideService(work, options.transaction, options.transaction.of(transaction));
+        },
+      ),
+    );
+  }
+
+  const makePasskeyRegistrationServices = <
+    Database extends D,
+    S extends T,
+    C extends T,
+    F extends T,
+    O extends T,
+    H extends T,
+    M extends T,
+    Flow extends T,
+    Admission extends T,
+    Charge extends T,
+    Intent extends T,
+    N,
+    Value,
+    RSetup = never,
+  >(
+    database: Database,
+    mapping: PasskeyMappingSource<
+      PasskeyRegistrationMapping<S, C, F, O, H, M, Flow, Admission, Charge, Intent, N, Value> &
+        Extra,
+      RSetup
+    >,
+  ) =>
+    makeTargetPasskeyRegistrationWriter<
+      PasskeyRegistrationMapping<S, C, F, O, H, M, Flow, Admission, Charge, Intent, N, Value> &
+        Extra,
+      Value,
+      RSetup
+    >(database, mapping, configuration);
+
+  return {
+    makePasskeyManagementServices,
+    makePasskeyRegistrationServices,
+    coordinatePasskeyManagement,
+    coordinatePasskeyRegistration,
+  };
+};

package/src/drizzle/passkey-write-model.ts

@@ -0,0 +1,271 @@
+import type { PreparedCommit } from "@yielded/auth/Hooks";
+import type {
+  PasskeyUnavailable,
+  PasskeyActionAuthorization,
+  PasskeyCeremony,
+  PasskeyClaim,
+  PasskeyCredential,
+  PasskeyCredentialSummary,
+  PasskeyIssueDecision,
+  PasskeyRegistrationResult,
+  PasskeyRegistrationVerified,
+  PasskeyRequirement,
+  PasskeyRevision,
+  PasskeyManagementPersistence,
+  PreparePasskeyCommit,
+  PasskeyManagementPolicy,
+  PasskeyMethodPolicy,
+} from "@yielded/auth/Passkey";
+import type { TokenDigest } from "@yielded/auth/Schema";
+import type { SessionInvalidationWindow } from "@yielded/auth/Sessions";
+import type { InferInsertModel, InferSelectModel, SQL, Table } from "drizzle-orm";
+import type { Effect, Schema } from "effect";
+
+import type { PersistenceMappingError } from "./model";
+import type {
+  PasskeyColumn,
+  PasskeyCredentialMapping,
+  PasskeyFlowTable,
+  PasskeyHandleReservationTable,
+  PasskeyPersistenceMapping,
+  PasskeyPersistenceServices,
+} from "./passkey-model";
+import type { PasskeyRegistrationIntentReadTable } from "./passkey-registration-ceremony-model";
+
+export interface PasskeyCredentialInsert<N> {
+  readonly subjectId: N;
+  readonly credential: PasskeyCredential;
+  readonly summary: PasskeyCredentialSummary;
+  readonly marker: string;
+}
+
+export interface PasskeyWriteTables<
+  S extends Table,
+  C extends Table,
+  F extends Table,
+  O extends Table,
+  H extends Table,
+  N,
+> {
+  readonly credential: {
+    readonly name: PasskeyColumn<C>;
+    readonly createdAt: PasskeyColumn<C>;
+    readonly encodeInsert: (input: PasskeyCredentialInsert<N>) => InferInsertModel<C>;
+    readonly encodePrimarySignIn: (value: boolean) => unknown;
+    readonly encodeEnrollmentUserVerified: (value: boolean) => unknown;
+    readonly encodeBackupEligible: (value: boolean) => unknown;
+    readonly activeStatus: unknown;
+    readonly removedStatus: unknown;
+  };
+  readonly authority: {
+    readonly encodeInsert: (input: PasskeyCredentialInsert<N>) => InferInsertModel<F>;
+    readonly activeStatus: unknown;
+    readonly removedStatus: unknown;
+  };
+  readonly credentialOwnership: {
+    readonly encodeInsert: (input: PasskeyCredentialInsert<N>) => InferInsertModel<O>;
+    readonly ownedState: unknown;
+    readonly removedState: unknown;
+  };
+  readonly handleOwnership: {
+    readonly encodeInsert: (input: {
+      readonly subjectId: N;
+      readonly rpId: string;
+      readonly userHandle: string;
+      readonly marker: string;
+    }) => InferInsertModel<H>;
+    readonly ownedState: unknown;
+  };
+  /** All mutable policy dependencies must be subject columns or declared module guards. */
+  readonly policy: {
+    readonly subjectColumns: ReadonlyArray<PasskeyColumn<S>>;
+    readonly management: (row: Readonly<Partial<InferSelectModel<S>>>) => PasskeyManagementPolicy;
+    readonly requirement: (
+      row: Readonly<Partial<InferSelectModel<S>>>,
+      action: PasskeyActionAuthorization["challenge"]["action"],
+    ) => Effect.Effect<typeof PasskeyRequirement.Type, PersistenceMappingError>;
+    readonly metadata: (subjectId: N) => SQL;
+    readonly action: (subjectId: N, authorization: PasskeyActionAuthorization) => SQL;
+    /** Usable primary/recovery path AND required remaining factors. Evaluated with the target excluded, before and after removal. Connected grants/factor-only credentials are not primary paths. */
+    readonly remainingSignIn: (
+      subjectId: N,
+      removedCredentialId: string,
+      row: Readonly<Partial<InferSelectModel<S>>>,
+    ) => Effect.Effect<SQL, PersistenceMappingError>;
+  };
+}
+
+export interface PasskeyInvalidationInput<N> {
+  readonly subjectId: N;
+  readonly previousRevision: typeof PasskeyRevision.Type.securityRevision;
+  readonly securityRevision: typeof PasskeyRevision.Type.securityRevision;
+  readonly invalidation: SessionInvalidationWindow;
+}
+
+export interface PasskeyInvalidationMutation<N> {
+  readonly table: Table;
+  readonly where: (input: PasskeyInvalidationInput<N>) => SQL;
+  readonly values: (input: PasskeyInvalidationInput<N>) => Readonly<Record<string, unknown>>;
+  readonly postcondition: (input: PasskeyInvalidationInput<N>) => SQL;
+}
+
+/** Same-owner updates for consumer session/pending tables. No external effects or callbacks after commit. */
+export const passkeyInvalidationMutation = <T extends Table, N>(input: {
+  readonly table: T;
+  readonly where: (input: PasskeyInvalidationInput<N>) => SQL;
+  readonly values: (input: PasskeyInvalidationInput<N>) => Partial<InferInsertModel<T>>;
+  readonly postcondition: (input: PasskeyInvalidationInput<N>) => SQL;
+}): PasskeyInvalidationMutation<N> => input;
+
+export interface PasskeyCommandTable<T extends Table, N> {
+  readonly table: T;
+  readonly moduleId: PasskeyColumn<T>;
+  readonly commandId: PasskeyColumn<T>;
+  readonly subjectId: PasskeyColumn<T>;
+  readonly credentialId: PasskeyColumn<T>;
+  readonly intent: PasskeyColumn<T>;
+  readonly decision: PasskeyColumn<T>;
+  readonly retentionUntil: PasskeyColumn<T>;
+  readonly version: PasskeyColumn<T>;
+  readonly encodeInsert: (input: {
+    readonly moduleId: string;
+    readonly commandId: string;
+    readonly subjectId: N;
+    readonly credentialId: string;
+  }) => InferInsertModel<T>;
+}
+
+export interface PasskeyManagementMapping<
+  S extends Table,
+  C extends Table,
+  F extends Table,
+  O extends Table,
+  H extends Table,
+  M extends Table,
+  Flow extends Table,
+  A extends Table,
+  Charge extends Table,
+  Command extends Table,
+  N,
+> extends PasskeyPersistenceMapping<
+  PasskeyCredentialMapping<S, C, F, O, H, N>,
+  M,
+  Flow,
+  A,
+  Charge,
+  N
+> {
+  readonly write: PasskeyWriteTables<S, C, F, O, H, N>;
+  readonly command: PasskeyCommandTable<Command, N>;
+  readonly managementConstraints: typeof requiredPasskeyManagementConstraints;
+  /** Removal must match the installed session strategy and change the subject revision; immediate sessions must consult that authority or be updated here. Enrollment preserves existing authentication. */
+  readonly invalidation: {
+    readonly window: SessionInvalidationWindow;
+    readonly mutations: ReadonlyArray<PasskeyInvalidationMutation<N>>;
+    readonly postcondition: (input: PasskeyInvalidationInput<N>) => SQL;
+  };
+}
+
+export const requiredPasskeyManagementConstraints = { command: ["moduleId", "commandId"] } as const;
+
+export interface PasskeyManagementServices extends PasskeyPersistenceServices {
+  readonly passkeyManagementPersistence: PasskeyManagementPersistence["Service"];
+}
+
+export interface PasskeyRegistrationWriter<R> {
+  readonly inspect: (registration: R) => Effect.Effect<
+    {
+      readonly fingerprint: TokenDigest;
+      readonly eligible: boolean;
+      readonly name: string;
+      readonly displayName: string;
+    },
+    PasskeyUnavailable
+  >;
+  readonly issueRegistration: <A>(
+    input: {
+      readonly ceremony: PasskeyCeremony;
+      readonly policy: PasskeyMethodPolicy;
+      readonly registration: R;
+    },
+    prepare: PreparePasskeyCommit<PasskeyIssueDecision, A>,
+  ) => Effect.Effect<PreparedCommit<A>, PasskeyUnavailable>;
+  readonly completeRegistration: <A>(
+    input: {
+      readonly claim: PasskeyClaim;
+      readonly verified: PasskeyRegistrationVerified;
+      readonly nowMillis: number;
+    },
+    prepare: PreparePasskeyCommit<PasskeyRegistrationResult | { readonly _tag: "Rejected" }, A>,
+  ) => Effect.Effect<PreparedCommit<A>, PasskeyUnavailable>;
+}
+
+export interface PasskeyRegistrationServices<R> extends PasskeyPersistenceServices {
+  readonly passkeyRegistrationAuthority: PasskeyRegistrationWriter<R>;
+}
+
+export interface PasskeyRegistrationMapping<
+  S extends Table,
+  C extends Table,
+  F extends Table,
+  O extends Table,
+  H extends Table,
+  M extends Table,
+  Flow extends Table,
+  A extends Table,
+  Charge extends Table,
+  Intent extends Table,
+  N,
+  R,
+> extends PasskeyPersistenceMapping<
+  PasskeyCredentialMapping<S, C, F, O, H, N>,
+  M,
+  Flow,
+  A,
+  Charge,
+  N
+> {
+  readonly write: PasskeyWriteTables<S, C, F, O, H, N>;
+  readonly flow: PasskeyFlowTable<Flow>;
+  readonly handle: PasskeyHandleReservationTable<H> & {
+    readonly reservedState: unknown;
+    readonly encodeInsert: (input: {
+      readonly ceremony: PasskeyCeremony;
+      readonly reservationId: string;
+    }) => InferInsertModel<H>;
+  };
+  readonly intent: PasskeyRegistrationIntentReadTable<Intent> & {
+    readonly pendingState: unknown;
+    readonly acceptedState: unknown;
+    readonly rejectedState: unknown;
+    readonly encodeInsert: (input: {
+      readonly ceremony: PasskeyCeremony;
+      readonly registration: R;
+      readonly reservationId: string;
+    }) => InferInsertModel<Intent>;
+  };
+  /** Consumer-owned data and identity, synchronously encoded inside the owner. A SQL-local registration creates no session and needs no email address. */
+  readonly registration: {
+    readonly schema: Schema.Codec<R, unknown, never, never>;
+    readonly describe: (registration: R) => { readonly name: string; readonly displayName: string };
+    readonly eligible: (registration: R) => SQL;
+    /** Commit-time application policy after provisioning. Unlike `eligible`, this
+     * must permit the newly created subject and retain every mutable prerequisite.
+     * Declare mutable external policy rows in module.guards so native locking
+     * owners serialize revocation through commit; this predicate alone is not a lock. */
+    readonly finalEligibility: (input: { readonly registration: R; readonly subjectId: N }) => SQL;
+    readonly subject: (input: {
+      readonly registration: R;
+      readonly ceremony: PasskeyCeremony;
+      readonly marker: string;
+    }) => { readonly subjectId: N; readonly values: InferInsertModel<S> };
+    readonly activeStatus: unknown;
+  };
+  readonly registrationConstraints: typeof requiredPasskeyRegistrationWriteConstraints;
+}
+
+export const requiredPasskeyRegistrationWriteConstraints = {
+  intentFlow: ["moduleId", "flowId"],
+  intentCommand: ["moduleId", "commandId"],
+  handle: ["handleKey"],
+} as const;

package/src/drizzle/passkey-write-target.ts

@@ -0,0 +1,9 @@
+import { passkeyKernel } from "./passkey-kernel";
+
+export const {
+  passkeyManagementPersistenceLayer,
+  makeTargetPasskeyManagement,
+  makeTargetPasskeyRegistrationWriter,
+  coordinateTargetPasskeyManagement,
+  coordinateTargetPasskeyRegistrationWriter,
+} = passkeyKernel.writeTarget;