@yielded/auth-persistence 0.1.0-beta.7

package/src/drizzle/password-prepared-state.ts

@@ -0,0 +1,231 @@
+import {
+  PasswordUnavailable,
+  PasswordAction,
+  PasswordCommandId,
+  PasswordCredentialSnapshot,
+  PasswordPreparedConfiguration,
+  PasswordPreparedIntentId,
+  PasswordPreparedReservation,
+  PasswordPreparedReset,
+  PasswordPreparedRequirement,
+  snapshotPasswordPreparedReservation,
+  snapshotPasswordPreparedReady,
+  encodePasswordPreparedReady,
+  type PasswordPreparedReady,
+  type PasswordPreparedMutation,
+  type PasswordPreparedPersistence,
+} from "@yielded/auth/Password";
+import { ProofBinding, ProofContinuationId, ProofPurpose } from "@yielded/auth/Proofs";
+import { SubjectId, TokenDigest } from "@yielded/auth/Schema";
+import {
+  SessionInvalidationWindow,
+  AuthenticationProof,
+  AuthenticationRequirement,
+  type AuthenticationRevision,
+} from "@yielded/auth/Sessions";
+import { DateTime, Effect, Redacted, Schema } from "effect";
+
+import { passwordSqlKernel } from "./password-sql";
+
+export const unavailable = () => PasswordUnavailable.make({});
+const Instant = Schema.Int.check(Schema.isBetween({ minimum: 0, maximum: 8640000000000000 }));
+const Label = Schema.NonEmptyString.check(Schema.isMaxLength(256));
+
+export const CompletionInput = Schema.Struct({
+  moduleId: Label,
+  purpose: ProofPurpose,
+  continuationId: ProofContinuationId,
+  continuationDigest: TokenDigest.check(Schema.isMaxLength(256)),
+  binding: ProofBinding,
+  nowMillis: Instant,
+});
+
+export const ContextInput = Schema.Struct({
+  moduleId: Label,
+  generation: PasswordPreparedConfiguration.fields.generation,
+  digest: TokenDigest.check(Schema.isMaxLength(256)),
+  nowMillis: Instant,
+});
+
+const ReserveInput = Schema.Struct({
+  moduleId: Label,
+  generation: PasswordPreparedConfiguration.fields.generation,
+  intentId: PasswordPreparedIntentId,
+  commandId: PasswordCommandId,
+  action: PasswordAction,
+  subjectId: SubjectId.check(Schema.isMaxLength(256)),
+  nowMillis: Instant,
+  policy: PasswordPreparedConfiguration,
+  invalidation: SessionInvalidationWindow,
+  reset: Schema.optionalKey(PasswordPreparedReset),
+  completion: Schema.optionalKey(CompletionInput),
+});
+
+const reserveCodec = Schema.fromJsonString(ReserveInput);
+
+export const snapshotReserve = (input: Parameters<PasswordPreparedPersistence["reserve"]>[0]) =>
+  Schema.encodeEffect(reserveCodec)(input).pipe(
+    Effect.flatMap(Schema.decodeEffect(Schema.String.check(Schema.isMaxLength(131072)))),
+    Effect.flatMap(Schema.decodeEffect(reserveCodec)),
+    Effect.mapError(unavailable),
+  );
+
+const reservationCodec = Schema.fromJsonString(PasswordPreparedReservation);
+
+export const encodeReservation = (input: PasswordPreparedReservation) =>
+  snapshotPasswordPreparedReservation(input).pipe(
+    Effect.flatMap(Schema.encodeEffect(reservationCodec)),
+    Effect.mapError(unavailable),
+  );
+
+export const decodeReservation = (input: string) =>
+  Schema.decodeEffect(Schema.String.check(Schema.isMaxLength(131072)))(input).pipe(
+    Effect.flatMap(Schema.decodeEffect(reservationCodec)),
+    Effect.flatMap(snapshotPasswordPreparedReservation),
+    Effect.mapError(unavailable),
+  );
+
+export const reservationOf = (ready: PasswordPreparedReady): PasswordPreparedReservation => {
+  const {
+    replacement: _replacement,
+    challenge: _challenge,
+    baseEvidence: _evidence,
+    digest: _digest,
+    issuedAtMillis: _issued,
+    expiresAtMillis: _expires,
+    ...reservation
+  } = ready;
+
+  return { ...reservation, _tag: "Preparing" };
+};
+
+export const sameRevision = (a: AuthenticationRevision, b: AuthenticationRevision) =>
+  a.subjectId === b.subjectId &&
+  a.securityRevision === b.securityRevision &&
+  a.credentials.length === b.credentials.length &&
+  a.credentials.every((c) =>
+    b.credentials.some((d) => c.credentialId === d.credentialId && c.revision === d.revision),
+  );
+
+const scopeJson = Schema.encodeSync(Schema.fromJsonString(Schema.Array(Schema.String)));
+const invalidationJson = Schema.encodeSync(Schema.fromJsonString(SessionInvalidationWindow));
+const proofJson = Schema.encodeSync(Schema.fromJsonString(AuthenticationProof));
+
+export const identifierScope = (
+  record: Pick<PasswordPreparedReservation, "credential" | "revision">,
+) =>
+  record.credential === undefined
+    ? scopeJson(["prepared-subject", record.revision.subjectId])
+    : scopeJson([
+        "prepared-identifier",
+        record.credential.identifier.namespace,
+        record.credential.identifier.value,
+      ]);
+
+const credentialCodec = Schema.fromJsonString(PasswordCredentialSnapshot);
+
+const sameCredential = Effect.fn("DrizzlePasswordPrepared.sameCredential")(function* (
+  a: PasswordPreparedReservation["credential"],
+  b: PasswordPreparedReservation["credential"],
+) {
+  if (a === undefined || b === undefined) return a === b;
+
+  return (
+    (yield* Schema.encodeEffect(credentialCodec)(a).pipe(Effect.mapError(unavailable))) ===
+    (yield* Schema.encodeEffect(credentialCodec)(b).pipe(Effect.mapError(unavailable)))
+  );
+});
+
+const requirementJson = Schema.encodeSync(
+  Schema.fromJsonString(AuthenticationRequirement.fields.alternatives),
+);
+
+const requirementShape = (value: AuthenticationRequirement) => requirementJson(value.alternatives);
+
+export const snapshotMutation = Effect.fn("DrizzlePasswordPrepared.snapshotMutation")(function* (
+  input: PasswordPreparedMutation,
+) {
+  const intent = yield* snapshotPasswordPreparedReady(input.intent);
+  const mutation = yield* passwordSqlKernel.snapshotMutationInput(input.mutation);
+
+  const capturedRequirement = yield* Schema.decodeEffect(PasswordPreparedRequirement)(
+    input.capturedRequirement,
+  ).pipe(Effect.mapError(unavailable));
+
+  const currentRequirement = yield* Schema.decodeEffect(PasswordPreparedRequirement)(
+    input.currentRequirement,
+  ).pipe(Effect.mapError(unavailable));
+
+  const original = intent.challenge,
+    actual = mutation.authorization.challenge;
+
+  if (
+    mutation.moduleId !== intent.moduleId ||
+    mutation.commandId !== intent.commandId ||
+    !sameRevision(mutation.expectedRevision, intent.revision) ||
+    !(yield* sameCredential(mutation.credential, intent.credential)) ||
+    Redacted.value(mutation.replacement.verifier) !== Redacted.value(intent.replacement.verifier) ||
+    mutation.replacement.normalization !== intent.replacement.normalization ||
+    actual.moduleId !== original.moduleId ||
+    actual.action !== original.action ||
+    actual.commandId !== original.commandId ||
+    actual.bindingDigest !== original.bindingDigest ||
+    actual.targetCredentialId !== original.targetCredentialId ||
+    !sameRevision(actual.revision, original.revision) ||
+    invalidationJson(mutation.invalidation) !== invalidationJson(intent.invalidation) ||
+    requirementShape(capturedRequirement) !== requirementShape(intent.capturedRequirement) ||
+    capturedRequirement.maximumAgeMillis > intent.capturedRequirement.maximumAgeMillis
+  )
+    return yield* unavailable();
+
+  return { intent, mutation, capturedRequirement, currentRequirement, nowMillis: input.nowMillis };
+});
+
+export const evidenceCurrent = (
+  input: PasswordPreparedMutation,
+  current: AuthenticationRequirement,
+  now: number,
+) => {
+  const requirements = [
+    input.mutation.authorization.requirement,
+    input.intent.capturedRequirement,
+    input.capturedRequirement,
+    current,
+    input.currentRequirement,
+  ];
+
+  if (
+    requirementShape(input.currentRequirement) !== requirementShape(current) ||
+    input.currentRequirement.maximumAgeMillis > current.maximumAgeMillis ||
+    now < input.intent.issuedAtMillis ||
+    now >= input.intent.expiresAtMillis ||
+    !requirements.every((requirement) =>
+      passwordSqlKernel.evidenceSatisfiedAt(
+        input.mutation.authorization.evidence,
+        requirement,
+        now,
+      ),
+    )
+  )
+    return false;
+  const age = Math.min(...requirements.map((requirement) => requirement.maximumAgeMillis));
+
+  return (input.intent.baseEvidence?.proofs ?? []).every((proof) => {
+    const verified = DateTime.toEpochMillis(proof.verifiedAt);
+
+    return (
+      verified <= now &&
+      now - verified < age &&
+      input.mutation.authorization.evidence.proofs.some(
+        (actual) => proofJson(actual) === proofJson(proof),
+      )
+    );
+  });
+};
+
+export const sameReady = Effect.fn("DrizzlePasswordPrepared.sameReady")(function* (
+  a: PasswordPreparedReady,
+  b: PasswordPreparedReady,
+) {
+  return (yield* encodePasswordPreparedReady(a)) === (yield* encodePasswordPreparedReady(b));
+});

package/src/drizzle/password-prepared-target.ts

@@ -0,0 +1,160 @@
+import {
+  coordinateCommit,
+  hasCommitScope,
+  type PreparedCommit,
+  LifecycleHooks,
+} from "@yielded/auth/Hooks";
+import { PasswordUnavailable, type PasswordPreparedPersistence } from "@yielded/auth/Password";
+/* oxlint-disable no-explicit-any -- concrete driver modules restore native table/database types. */
+import { type Context, Cause, Effect, Layer } from "effect";
+import type * as SqlError from "effect/unstable/sql/SqlError";
+
+import { makeSqlPasswordPreparedPersistence } from "./password-prepared-sql";
+import type { PasswordSqlDatabase } from "./password-sql";
+import {
+  passwordOptions,
+  type PasswordTargetConfiguration,
+  type PasswordCoordinatorError,
+} from "./password-target";
+import {
+  CurrentPasswordPreparedTransaction,
+  PasswordPreparedPostconditions,
+  PasswordPreparedJournalGuards,
+  type PasswordPreparedPostcondition,
+} from "./PasswordPreparedPostconditions";
+
+export const makeTargetPasswordPreparedPersistenceServices = (
+  database: any,
+  mapping: any,
+  configuration: PasswordTargetConfiguration,
+  proofMapping?: any,
+) =>
+  Effect.gen(function* () {
+    return {
+      passwordPreparedPersistence: yield* makeSqlPasswordPreparedPersistence(
+        database,
+        mapping,
+        passwordOptions(configuration, proofMapping),
+      ),
+    };
+  });
+
+export const coordinateTargetPasswordPreparedPersistence = <Transaction, A, E, R>(
+  database: {
+    readonly transaction: <Out, Err, Env>(
+      body: (transaction: Transaction) => Effect.Effect<Out, Err, Env>,
+    ) => Effect.Effect<Out, Err | SqlError.SqlError, Env>;
+  },
+  mapping: any,
+  configuration: PasswordTargetConfiguration,
+  proofMapping: any | undefined,
+  owner: (
+    transaction: Transaction,
+    services: { readonly passwordPreparedPersistence: PasswordPreparedPersistence },
+  ) => Effect.Effect<A, E, R>,
+): Effect.Effect<A, PasswordCoordinatorError<E>, R | LifecycleHooks> =>
+  Effect.gen(function* () {
+    const hooks = yield* LifecycleHooks;
+
+    if (yield* hasCommitScope) return yield* PasswordUnavailable.make({});
+    yield* configuration.coordinatorGuard ?? configuration.standaloneGuard;
+
+    const result = yield* coordinateCommit(
+      () =>
+        database.transaction((transaction) =>
+          Effect.gen(function* () {
+            const guards: Array<PreparedCommit<void>> = [];
+            const postconditions: Array<PasswordPreparedPostcondition> = [];
+            let poisoned = false;
+            let acceptingPostconditions = true;
+
+            const services = yield* makeSqlPasswordPreparedPersistence(
+              transaction as unknown as PasswordSqlDatabase,
+              mapping,
+              passwordOptions(configuration, proofMapping, true),
+            );
+
+            const protect = <Out, Err, Env>(effect: Effect.Effect<Out, Err, Env>) =>
+              effect.pipe(
+                Effect.onError(() =>
+                  Effect.sync(() => {
+                    poisoned = true;
+                  }),
+                ),
+              );
+
+            const value = yield* owner(transaction, {
+              passwordPreparedPersistence: {
+                reserve: (input, prepare) => protect(services.reserve(input, prepare)),
+                publishReady: (input, prepare) => protect(services.publishReady(input, prepare)),
+                context: (input) => protect(services.context(input)),
+                complete: (input, prepare) => protect(services.complete(input, prepare)),
+                resetWithProof: (input, prepare) =>
+                  protect(services.resetWithProof(input, prepare)),
+                cancel: (input, prepare) => protect(services.cancel(input, prepare)),
+                cleanup: (input, prepare) => protect(services.cleanup(input, prepare)),
+              },
+            }).pipe(
+              Effect.provideService(PasswordPreparedJournalGuards, {
+                register: (guard) => {
+                  if (!acceptingPostconditions) return false;
+                  guards.push(guard);
+
+                  return true;
+                },
+              }),
+              Effect.provideService(PasswordPreparedPostconditions, {
+                register: (check) => {
+                  if (!acceptingPostconditions) return false;
+                  postconditions.push(check);
+
+                  return true;
+                },
+              }),
+              Effect.ensuring(
+                Effect.sync(() => {
+                  acceptingPostconditions = false;
+                }),
+              ),
+            );
+
+            if (poisoned) return yield* PasswordUnavailable.make({});
+            for (const guard of guards) {
+              const status = yield* Effect.result(guard.read);
+
+              if (status._tag === "Success" || status.failure._tag !== "CommitPending")
+                return yield* PasswordUnavailable.make({});
+            }
+
+            for (const check of postconditions)
+              yield* check.pipe(
+                Effect.provideService(
+                  CurrentPasswordPreparedTransaction,
+                  transaction as unknown as PasswordSqlDatabase,
+                ),
+                Effect.catchCause((cause) =>
+                  Effect.failCause(Cause.map(cause, () => PasswordUnavailable.make({}))),
+                ),
+              );
+
+            return value;
+          }),
+        ),
+      { mode: configuration.mode },
+    ).pipe(Effect.provideService(LifecycleHooks, hooks));
+
+    return result.value;
+  });
+
+export const passwordPreparedPersistenceLayer = <Id>(
+  tag: Context.Key<Id, PasswordPreparedPersistence>,
+  services: Effect.Effect<
+    { readonly passwordPreparedPersistence: PasswordPreparedPersistence },
+    never,
+    LifecycleHooks
+  >,
+) =>
+  Layer.effect(
+    tag,
+    Effect.map(services, (value) => value.passwordPreparedPersistence),
+  );