@yielded/auth-persistence 0.1.0-beta.7

package/src/drizzle/d1-generated-statement.ts

@@ -0,0 +1,129 @@
+import { sql, type SQL } from "drizzle-orm";
+import { Schema } from "effect";
+import type { Statement } from "effect/unstable/sql/Statement";
+
+// oxlint-disable-next-line no-restricted-properties -- Statement.compile exposes untyped native SQL parameters.
+const valuesJson = Schema.encodeUnknownSync(
+  Schema.fromJsonString(
+    Schema.Array(Schema.Union([Schema.String, Schema.Finite, Schema.Boolean, Schema.Null])),
+  ),
+);
+
+const hex = Schema.encodeSync(Schema.Uint8ArrayFromHex);
+// oxlint-disable-next-line no-restricted-properties -- D1 binding parameters are untyped native views.
+const viewElements = Schema.decodeUnknownSync(Schema.Array(Schema.Finite));
+
+// oxlint-disable-next-line no-restricted-properties -- D1 also accepts untyped byte-array parameters.
+const byteElements = Schema.decodeUnknownSync(
+  Schema.Array(Schema.Finite.check(Schema.isGreaterThanOrEqualTo(0), Schema.isLessThan(256))),
+);
+
+/** Private compiler boundary for generated statements only. SQLite numbered
+ * parameters let every JSON lookup share one binding without a CTE name. */
+export const compactD1GeneratedStatement = <A extends object>(
+  client: {
+    readonly unsafe: <Row extends object>(
+      sql: string,
+      params?: ReadonlyArray<unknown>,
+    ) => Statement<Row>;
+  },
+  statement: Statement<A>,
+  invalid: () => unknown,
+): Statement<A> => {
+  const [source, parameters] = statement.compile();
+
+  if (parameters.length <= 100 && new TextEncoder().encode(source).length <= 100_000)
+    return statement;
+  const blobs = new Set<number>();
+  const numbers = new Set<number>();
+
+  const values = parameters.map((value, index) => {
+    if (typeof value === "number" || typeof value === "boolean") numbers.add(index);
+
+    const bytes =
+      value instanceof ArrayBuffer
+        ? new Uint8Array(value)
+        : ArrayBuffer.isView(value)
+          ? // Match D1's Array.from(view) conversion, including empty DataView.
+            Uint8Array.from(viewElements(Array.from(value as unknown as ArrayLike<unknown>)))
+          : Array.isArray(value)
+            ? Uint8Array.from(byteElements(value))
+            : undefined;
+
+    if (bytes === undefined) return value;
+    blobs.add(index);
+
+    return hex(bytes);
+  });
+
+  const encoded = valuesJson(values);
+
+  let index = 0,
+    result = "";
+
+  let quote: "'" | '"' | "`" | "]" | undefined;
+  let comment: "line" | "block" | undefined;
+
+  for (let offset = 0; offset < source.length; offset++) {
+    const char = source[offset]!,
+      next = source[offset + 1];
+
+    if (comment !== undefined) {
+      result += char;
+      if (comment === "line" && char === "\n") comment = undefined;
+      else if (comment === "block" && char === "*" && next === "/") {
+        result += next;
+        offset++;
+        comment = undefined;
+      }
+    } else if (quote !== undefined) {
+      result += char;
+      if (char === quote) {
+        if (next === quote && quote !== "]") {
+          result += next;
+          offset++;
+        } else quote = undefined;
+      }
+    } else if (char === "'" || char === '"' || char === "`" || char === "[") {
+      quote = char === "[" ? "]" : char;
+      result += char;
+    } else if ((char === "-" && next === "-") || (char === "/" && next === "*")) {
+      comment = char === "-" ? "line" : "block";
+      result += char + next;
+      offset++;
+    } else if (char === "?") {
+      if (next !== undefined && next >= "0" && next <= "9") throw invalid();
+      const lookup = `json_extract(?1, '$[${index}]')`;
+
+      result += blobs.has(index)
+        ? `unhex(${lookup})`
+        : numbers.has(index)
+          ? `cast(${lookup} as real)`
+          : lookup;
+      index++;
+    } else result += char;
+  }
+  if (
+    index !== parameters.length ||
+    quote !== undefined ||
+    comment === "block" ||
+    new TextEncoder().encode(result).length > 100_000
+  )
+    throw invalid();
+
+  return client.unsafe<A>(result, [encoded]);
+};
+
+/** Keep bounded credential vectors below D1's expression-tree depth ceiling. */
+export const balancedD1And = (...conditions: ReadonlyArray<SQL | undefined>): SQL | undefined => {
+  const parts = conditions.filter((condition) => condition !== undefined);
+
+  const join = (start: number, end: number): SQL => {
+    if (end - start === 1) return sql`(${parts[start]!})`;
+    const middle = start + Math.floor((end - start) / 2);
+
+    return sql`(${join(start, middle)} and ${join(middle, end)})`;
+  };
+
+  return parts.length === 0 ? undefined : join(0, parts.length);
+};

package/src/drizzle/d1-identity.ts

@@ -0,0 +1,375 @@
+import type { D1Client } from "@effect/sql-d1/D1Client";
+import {
+  ExternalIdentityMutation,
+  type ExternalIdentity,
+  IdentityConflict,
+  IdentityUnavailable,
+  SubjectProvisioned,
+  SubjectProvisioner,
+  type SubjectProvisioningInput,
+} from "@yielded/auth/Identity";
+import { reportPersistenceFailure } from "@yielded/auth/Persistence";
+import type { SubjectId } from "@yielded/auth/Schema";
+/* oxlint-disable no-explicit-any -- D1 batch bridges Drizzle SQL objects to Effect SQL Statements at this adapter boundary. */
+import {
+  and,
+  eq,
+  getTableColumns,
+  is,
+  sql,
+  SQL,
+  type AnyRelations,
+  type InferInsertModel,
+  type Table,
+} from "drizzle-orm";
+import type { EffectSQLiteD1Database } from "drizzle-orm/effect-d1";
+import type { AnySQLiteTable, SQLiteColumn } from "drizzle-orm/sqlite-core";
+import { Cause, Effect, Schema } from "effect";
+
+import {
+  column,
+  isMappedConstraintConflict,
+  provisioningFingerprint,
+  type D1ExternalIdentityMapping,
+  type D1GeneratedIdentityMapping,
+  type D1SubjectProvisioningMapping,
+} from "./model";
+
+type RuntimeDatabase = EffectSQLiteD1Database<any> & { readonly $client: D1Client };
+const unavailable = () => IdentityUnavailable.make();
+const isIdentityFailure = Schema.is(Schema.Union([IdentityConflict, IdentityUnavailable]));
+
+const mapUnavailable = <A, E, R>(effect: Effect.Effect<A, E, R>) =>
+  reportPersistenceFailure(effect, isIdentityFailure).pipe(
+    Effect.catchCause((cause) =>
+      Effect.failCause(
+        Cause.map(cause, (error) => (isIdentityFailure(error) ? error : unavailable())),
+      ),
+    ),
+  );
+
+const selectFields = <T extends Table>(
+  table: T,
+  values: InferInsertModel<T>,
+): Record<string, unknown> => {
+  const columns = getTableColumns(table) as Record<string, SQLiteColumn>;
+
+  const fields = Object.fromEntries(
+    Object.entries(values)
+      .filter(([, value]) => value !== undefined)
+      .map(([key, value]) => [
+        key,
+        is(value, SQL) ? value : sql`${sql.param(value, columns[key] as SQLiteColumn)}`,
+      ]),
+  );
+
+  for (const [key, mapped] of Object.entries(columns)) {
+    if (
+      fields[key] !== undefined ||
+      (
+        mapped as SQLiteColumn & { readonly shouldDisableInsert: () => boolean }
+      ).shouldDisableInsert()
+    )
+      continue;
+    if (mapped.default !== null && mapped.default !== undefined) continue;
+
+    const value =
+      mapped.defaultFn !== undefined
+        ? mapped.defaultFn()
+        : !mapped.default && mapped.onUpdateFn !== undefined
+          ? mapped.onUpdateFn()
+          : undefined;
+
+    if (value !== undefined || mapped.defaultFn !== undefined || mapped.onUpdateFn !== undefined)
+      fields[key] = is(value, SQL) ? value : sql`${sql.param(value, mapped)}`;
+  }
+
+  return fields;
+};
+
+/**
+ * D1 provisioning is an ordered atomic batch. The receipt captures the
+ * database-generated subject id from the first insert via last_insert_rowid;
+ * the optional identifier then reads that stable id from the receipt.
+ */
+export const makeD1SubjectProvisioningServices = <
+  Subject extends AnySQLiteTable,
+  Identifier extends AnySQLiteTable,
+  Request extends AnySQLiteTable,
+  NativeId,
+>(
+  database: EffectSQLiteD1Database<AnyRelations> & { readonly $client: D1Client },
+  mapping: D1SubjectProvisioningMapping<Subject, Identifier, Request, NativeId>,
+) => {
+  const db = database as RuntimeDatabase;
+  const requestTable = mapping.provisioningRequest.table;
+
+  const requestIdColumn = column(
+    requestTable,
+    mapping.provisioningRequest.requestId,
+  ) as SQLiteColumn;
+
+  const requestFingerprintColumn = column(
+    requestTable,
+    mapping.provisioningRequest.fingerprint,
+  ) as SQLiteColumn;
+
+  const requestSubjectColumn = column(
+    requestTable,
+    mapping.provisioningRequest.subjectId,
+  ) as SQLiteColumn;
+
+  const findReceipt = Effect.fn("DrizzleD1Identity.findReceipt")(function* (requestId: string) {
+    const rows = yield* db
+      .select({ fingerprint: requestFingerprintColumn, subjectId: requestSubjectColumn })
+      .from(requestTable as any)
+      .where(eq(requestIdColumn, requestId))
+      .limit(1);
+
+    return rows[0];
+  });
+
+  const provision = Effect.fn("DrizzleD1Identity.provision")(function* (
+    input: SubjectProvisioningInput,
+  ) {
+    const fingerprint = provisioningFingerprint(input);
+    const existing = yield* findReceipt(input.requestId);
+
+    if (existing !== undefined) {
+      if (existing.fingerprint !== fingerprint) return yield* IdentityConflict.make();
+      const subjectId = yield* mapping.subjectId.toSubject(existing.subjectId as NativeId);
+
+      return SubjectProvisioned.make({ subjectId });
+    }
+
+    const allocated =
+      mapping.subject.allocateId === undefined
+        ? mapping.subject.allocateIdSync?.()
+        : yield* mapping.subject.allocateId;
+
+    const subjectQuery = db
+      .insert(mapping.subject.table as any)
+      .values(mapping.subject.encodeInsert(input, allocated) as any)
+      .toSQL();
+
+    const statements = [db.$client.unsafe(subjectQuery.sql, subjectQuery.params)];
+
+    if (allocated !== undefined) {
+      const requestQuery = db
+        .insert(requestTable as any)
+        .values(
+          mapping.provisioningRequest.encodeInsert(input.requestId, fingerprint, allocated) as any,
+        )
+        .toSQL();
+
+      statements.push(db.$client.unsafe(requestQuery.sql, requestQuery.params));
+
+      if (input.identifier !== undefined) {
+        const identifierQuery = db
+          .insert(mapping.identifier.table as any)
+          .values(
+            mapping.identifier.encodeInsert(input.identifier, allocated, input.verifiedAt) as any,
+          )
+          .toSQL();
+
+        statements.push(db.$client.unsafe(identifierQuery.sql, identifierQuery.params));
+      }
+    } else {
+      if (mapping.d1.generatedRowIdAlias === undefined) return yield* unavailable();
+
+      const mappedColumnNames = Object.values(getTableColumns(mapping.subject.table)).map((value) =>
+        value.name.toLowerCase(),
+      );
+
+      if (mappedColumnNames.includes(mapping.d1.generatedRowIdAlias.toLowerCase()))
+        return yield* unavailable();
+      const subjectIdColumn = column(mapping.subject.table, mapping.subject.id);
+      const rowId = sql.identifier(mapping.d1.generatedRowIdAlias);
+
+      const requestQuery = db
+        .insert(requestTable as any)
+        .values({
+          ...mapping.d1.requestInsertWithoutSubject(input.requestId, fingerprint),
+          [mapping.provisioningRequest.subjectId]:
+            sql`(select ${subjectIdColumn} from ${mapping.subject.table} where ${rowId} = last_insert_rowid())`,
+        } as any)
+        .toSQL();
+
+      statements.push(db.$client.unsafe(requestQuery.sql, requestQuery.params));
+    }
+
+    if (allocated === undefined && input.identifier !== undefined) {
+      const requestIdParam = sql.param(input.requestId, requestIdColumn);
+
+      const identifierQuery = db
+        .insert(mapping.identifier.table as any)
+        .values({
+          ...mapping.d1.identifierInsertWithoutSubject(input.identifier, input.verifiedAt),
+          [mapping.identifier.subjectId]:
+            sql`(select ${requestSubjectColumn} from ${requestTable} where ${requestIdColumn} = ${requestIdParam})`,
+        } as any)
+        .toSQL();
+
+      statements.push(db.$client.unsafe(identifierQuery.sql, identifierQuery.params));
+    }
+    const attempt = db.$client.batch(statements);
+
+    yield* attempt.pipe(
+      Effect.catchCause(
+        (
+          cause,
+        ): Effect.Effect<
+          void,
+          | Effect.Error<typeof attempt>
+          | Effect.Error<ReturnType<typeof findReceipt>>
+          | IdentityConflict
+        > => {
+          if (
+            cause.reasons.length === 0 ||
+            !cause.reasons.every(
+              (reason) =>
+                Cause.isFailReason(reason) &&
+                isMappedConstraintConflict(mapping.isConstraintConflict, reason.error),
+            )
+          )
+            return Effect.failCause(cause);
+
+          return findReceipt(input.requestId).pipe(
+            Effect.flatMap((receipt) =>
+              receipt !== undefined && receipt.fingerprint === fingerprint
+                ? Effect.void
+                : IdentityConflict.make(),
+            ),
+          );
+        },
+      ),
+    );
+    const receipt = yield* findReceipt(input.requestId);
+
+    if (receipt === undefined || receipt.fingerprint !== fingerprint)
+      return yield* IdentityConflict.make();
+    const subjectId = yield* mapping.subjectId.toSubject(receipt.subjectId as NativeId);
+
+    return SubjectProvisioned.make({ subjectId });
+  }, mapUnavailable);
+
+  return { subjectProvisioner: SubjectProvisioner.of({ provision }) } as const;
+};
+
+export const makeD1ExternalIdentityServices = <
+  Subject extends AnySQLiteTable,
+  External extends AnySQLiteTable,
+  NativeId,
+>(
+  database: EffectSQLiteD1Database<AnyRelations> & { readonly $client: D1Client },
+  mapping: D1ExternalIdentityMapping<Subject, External, NativeId>,
+) => {
+  const db = database as RuntimeDatabase;
+  const externalTable = mapping.externalIdentity.table;
+
+  const externalSubjectIdColumn = column(
+    externalTable,
+    mapping.externalIdentity.subjectId,
+  ) as SQLiteColumn;
+
+  const externalProviderColumn = column(
+    externalTable,
+    mapping.externalIdentity.provider,
+  ) as SQLiteColumn;
+
+  const externalIssuerColumn = column(
+    externalTable,
+    mapping.externalIdentity.issuer,
+  ) as SQLiteColumn;
+
+  const externalSubjectColumn = column(
+    externalTable,
+    mapping.externalIdentity.subject,
+  ) as SQLiteColumn;
+
+  const bind = Effect.fn("DrizzleD1Identity.bindExternalIdentity")(function* (
+    subjectId: SubjectId,
+    identity: ExternalIdentity,
+  ) {
+    const nativeId = yield* mapping.subjectId.toNative(subjectId);
+    const subjectIdColumn = column(mapping.subject.table, mapping.subject.id);
+    const subjectStatusColumn = column(mapping.subject.table, mapping.subject.status);
+    const nativeIdParam = sql.param(nativeId, subjectIdColumn);
+    const activeStatusParam = sql.param(mapping.d1.activeStatusValue, subjectStatusColumn);
+
+    const selection = selectFields(
+      externalTable,
+      mapping.externalIdentity.encodeInsert(identity, nativeId),
+    );
+
+    selection[mapping.externalIdentity.subjectId] = subjectIdColumn;
+
+    const inserted = yield* db
+      .insert(externalTable as any)
+      .select(
+        db
+          .select(selection as any)
+          .from(mapping.subject.table as any)
+          .where(
+            and(eq(subjectIdColumn, nativeIdParam), eq(subjectStatusColumn, activeStatusParam)),
+          ) as any,
+      )
+      .returning({ subjectId: externalSubjectIdColumn })
+      .pipe(
+        Effect.catchCause((cause) => {
+          if (
+            cause.reasons.length === 0 ||
+            !cause.reasons.every(
+              (reason) =>
+                Cause.isFailReason(reason) &&
+                isMappedConstraintConflict(mapping.isConstraintConflict, reason.error),
+            )
+          )
+            return Effect.failCause(cause);
+
+          return db
+            .select({ subjectId: externalSubjectIdColumn })
+            .from(externalTable as any)
+            .innerJoin(
+              mapping.subject.table as any,
+              and(
+                eq(externalSubjectIdColumn, subjectIdColumn),
+                eq(subjectStatusColumn, mapping.d1.activeStatusValue),
+              ),
+            )
+            .where(
+              and(
+                eq(externalProviderColumn, identity.provider),
+                eq(externalIssuerColumn, identity.issuer),
+                eq(externalSubjectColumn, identity.subject),
+                eq(externalSubjectIdColumn, nativeId),
+              ),
+            )
+            .limit(1);
+        }),
+      );
+
+    const row = inserted[0];
+
+    if (row === undefined) return yield* IdentityConflict.make();
+    const linked = row.subjectId as NativeId;
+
+    if (!mapping.subjectId.equals(linked, nativeId)) return yield* IdentityConflict.make();
+  }, mapUnavailable);
+
+  return { externalIdentityMutation: ExternalIdentityMutation.of({ bind }) } as const;
+};
+
+export const makeD1IdentityServices = <
+  Subject extends AnySQLiteTable,
+  Identifier extends AnySQLiteTable,
+  External extends AnySQLiteTable,
+  Request extends AnySQLiteTable,
+  NativeId,
+>(
+  database: EffectSQLiteD1Database<AnyRelations> & { readonly $client: D1Client },
+  mapping: D1GeneratedIdentityMapping<Subject, Identifier, External, Request, NativeId>,
+) => ({
+  ...makeD1SubjectProvisioningServices(database, mapping),
+  ...makeD1ExternalIdentityServices(database, mapping),
+});