@yielded/auth-persistence 0.1.0-beta.7

package/src/drizzle/mysql-emails.ts

@@ -0,0 +1,321 @@
+import { EmailAddressPersistence, type EmailUnavailable } from "@yielded/auth/Email";
+import type { LifecycleHooks, HookConfigurationError } from "@yielded/auth/Hooks";
+/* oxlint-disable no-explicit-any -- proof mapping tables are independently typed by the proof owner; this driver forwards them unchanged to the shared target. */
+import type { AnyRelations } from "drizzle-orm";
+import type { EffectMysql2Database } from "drizzle-orm/effect-mysql2";
+import type { AnyMySqlTable } from "drizzle-orm/mysql-core";
+import { Effect, Context } from "effect";
+import type { SqlError } from "effect/unstable/sql/SqlError";
+
+import type {
+  EmailAddressMapping,
+  EmailRegistrationMapping,
+  EmailSignInMapping,
+} from "./email-model";
+import type { EmailRegistrationAuthority } from "./email-registration";
+import type { EmailSqlQuery } from "./email-sql";
+import {
+  coordinateTargetEmailAddress,
+  coordinateTargetEmailRegistration,
+  makeTargetEmailAddressServices,
+  makeTargetEmailRegistrationServices,
+  makeTargetEmailSignInServices,
+  sqlClientEmailStandaloneGuard,
+} from "./email-target";
+import type { ProofPersistenceMapping } from "./proof-model";
+import type { ProofSqlQuery } from "./proof-sql";
+import { sqlClientProofStandaloneGuard } from "./proof-target";
+import type { SuppliedService } from "./SuppliedService";
+
+type Database = EffectMysql2Database<AnyRelations>;
+type TransactionOf<D extends Database> = Parameters<Parameters<D["transaction"]>[0]>[0];
+type ProofMapping = ProofPersistenceMapping<
+  any,
+  any,
+  any,
+  any,
+  any,
+  any,
+  any,
+  any,
+  any,
+  any,
+  any,
+  any
+>;
+
+const configuration = (database: Database) => ({
+  mode: "interactive" as const,
+  locking: true,
+  standaloneGuard: sqlClientEmailStandaloneGuard(database),
+  generatedSubjectRows: (query: EmailSqlQuery) => query.$returningId(),
+  proof: {
+    mode: "interactive" as const,
+    locking: true,
+    standaloneGuard: sqlClientProofStandaloneGuard(database),
+    insertIfAbsent: (query: ProofSqlQuery, selfKey: string, selfValue: unknown) =>
+      query.onDuplicateKeyUpdate({ set: { [selfKey]: selfValue } }),
+  },
+});
+
+export const makeMysqlEmailSignInServices = <
+  S extends AnyMySqlTable,
+  I extends AnyMySqlTable,
+  C extends AnyMySqlTable,
+  NativeId,
+>(
+  database: Database,
+  mapping: EmailSignInMapping<S, I, C, NativeId>,
+) => makeTargetEmailSignInServices(database, mapping, configuration(database));
+
+export const makeMysqlEmailAddressServices = <
+  S extends AnyMySqlTable,
+  I extends AnyMySqlTable,
+  C extends AnyMySqlTable,
+  AC extends AnyMySqlTable,
+  M extends AnyMySqlTable,
+  NativeId,
+>(
+  database: Database,
+  mapping: EmailAddressMapping<S, I, C, AC, M, NativeId>,
+  proofMapping: ProofMapping,
+) => makeTargetEmailAddressServices(database, mapping, proofMapping, configuration(database));
+
+export function coordinateMysqlEmailAddress<
+  D extends Database,
+  S extends AnyMySqlTable,
+  I extends AnyMySqlTable,
+  C extends AnyMySqlTable,
+  AC extends AnyMySqlTable,
+  M extends AnyMySqlTable,
+  NativeId,
+  Out,
+  E,
+  R,
+  DatabaseError,
+  DatabaseRequirements,
+>(
+  acquire: Effect.Effect<D, DatabaseError, DatabaseRequirements>,
+  options: {
+    readonly mapping: EmailAddressMapping<S, I, C, AC, M, NativeId>;
+    readonly proofMapping: ProofMapping;
+    readonly transaction?: never;
+  },
+  body: Effect.Effect<Out, E, R>,
+): Effect.Effect<
+  Out,
+  E | EmailUnavailable | HookConfigurationError | SqlError | DatabaseError,
+  Exclude<R, EmailAddressPersistence> | LifecycleHooks | DatabaseRequirements
+>;
+
+export function coordinateMysqlEmailAddress<
+  D extends Database,
+  S extends AnyMySqlTable,
+  I extends AnyMySqlTable,
+  C extends AnyMySqlTable,
+  AC extends AnyMySqlTable,
+  M extends AnyMySqlTable,
+  NativeId,
+  Out,
+  E,
+  R,
+  DatabaseError,
+  DatabaseRequirements,
+  TxId,
+  TxShape,
+>(
+  acquire: Effect.Effect<D, DatabaseError, DatabaseRequirements>,
+  options: {
+    readonly mapping: EmailAddressMapping<S, I, C, AC, M, NativeId>;
+    readonly proofMapping: ProofMapping;
+    readonly transaction: SuppliedService<TxId, NoInfer<TransactionOf<D>>, TxShape>;
+  },
+  body: Effect.Effect<Out, E, R>,
+): Effect.Effect<
+  Out,
+  E | EmailUnavailable | HookConfigurationError | SqlError | DatabaseError,
+  Exclude<R, EmailAddressPersistence | TxId> | LifecycleHooks | DatabaseRequirements
+>;
+
+export function coordinateMysqlEmailAddress<
+  D extends Database,
+  S extends AnyMySqlTable,
+  I extends AnyMySqlTable,
+  C extends AnyMySqlTable,
+  AC extends AnyMySqlTable,
+  M extends AnyMySqlTable,
+  NativeId,
+  Out,
+  E,
+  R,
+  DatabaseError,
+  DatabaseRequirements,
+  TxId,
+  TxShape,
+>(
+  acquire: Effect.Effect<D, DatabaseError, DatabaseRequirements>,
+  options: {
+    readonly mapping: EmailAddressMapping<S, I, C, AC, M, NativeId>;
+    readonly proofMapping: ProofMapping;
+    readonly transaction?: SuppliedService<TxId, NoInfer<TransactionOf<D>>, TxShape>;
+  },
+  body: Effect.Effect<Out, E, R>,
+): Effect.Effect<
+  Out,
+  E | EmailUnavailable | HookConfigurationError | SqlError | DatabaseError,
+  Exclude<R, EmailAddressPersistence> | LifecycleHooks | DatabaseRequirements
+> {
+  return Effect.flatMap(acquire, (database) =>
+    coordinateTargetEmailAddress<TransactionOf<D>, Out, E, Exclude<R, EmailAddressPersistence>>(
+      database,
+      options.mapping,
+      options.proofMapping,
+      configuration(database),
+      (
+        transaction: TransactionOf<D>,
+        services: { readonly emailAddressPersistence: EmailAddressPersistence["Service"] },
+      ) => {
+        const provided = Context.make(EmailAddressPersistence, services.emailAddressPersistence);
+        const work = Effect.provideContext(body, provided);
+
+        return options.transaction === undefined
+          ? work
+          : Effect.provideService(work, options.transaction, options.transaction.of(transaction));
+      },
+    ),
+  );
+}
+
+export const makeMysqlEmailRegistrationServices = <
+  Registration,
+  S extends AnyMySqlTable,
+  I extends AnyMySqlTable,
+  C extends AnyMySqlTable,
+  AC extends AnyMySqlTable,
+  Rq extends AnyMySqlTable,
+  NativeId,
+>(
+  database: Database,
+  mapping: EmailRegistrationMapping<Registration, S, I, C, AC, Rq, NativeId>,
+  proofMapping: ProofMapping,
+) =>
+  makeTargetEmailRegistrationServices<Registration>(
+    database,
+    mapping,
+    proofMapping,
+    configuration(database),
+  );
+
+export function coordinateMysqlEmailRegistration<
+  TargetId,
+  Registration,
+  D extends Database,
+  S extends AnyMySqlTable,
+  I extends AnyMySqlTable,
+  C extends AnyMySqlTable,
+  AC extends AnyMySqlTable,
+  Rq extends AnyMySqlTable,
+  NativeId,
+  Out,
+  E,
+  R,
+  DatabaseError,
+  DatabaseRequirements,
+>(
+  acquire: Effect.Effect<D, DatabaseError, DatabaseRequirements>,
+  options: {
+    readonly mapping: EmailRegistrationMapping<NoInfer<Registration>, S, I, C, AC, Rq, NativeId>;
+    readonly proofMapping: ProofMapping;
+    readonly target: SuppliedService<TargetId, EmailRegistrationAuthority<Registration>>;
+    readonly transaction?: never;
+  },
+  body: Effect.Effect<Out, E, R>,
+): Effect.Effect<
+  Out,
+  E | EmailUnavailable | HookConfigurationError | SqlError | DatabaseError,
+  Exclude<R, TargetId> | LifecycleHooks | DatabaseRequirements
+>;
+
+export function coordinateMysqlEmailRegistration<
+  TargetId,
+  Registration,
+  D extends Database,
+  S extends AnyMySqlTable,
+  I extends AnyMySqlTable,
+  C extends AnyMySqlTable,
+  AC extends AnyMySqlTable,
+  Rq extends AnyMySqlTable,
+  NativeId,
+  Out,
+  E,
+  R,
+  DatabaseError,
+  DatabaseRequirements,
+  TxId,
+  TxShape,
+>(
+  acquire: Effect.Effect<D, DatabaseError, DatabaseRequirements>,
+  options: {
+    readonly mapping: EmailRegistrationMapping<NoInfer<Registration>, S, I, C, AC, Rq, NativeId>;
+    readonly proofMapping: ProofMapping;
+    readonly target: SuppliedService<TargetId, EmailRegistrationAuthority<Registration>>;
+    readonly transaction: SuppliedService<TxId, NoInfer<TransactionOf<D>>, TxShape>;
+  },
+  body: Effect.Effect<Out, E, R>,
+): Effect.Effect<
+  Out,
+  E | EmailUnavailable | HookConfigurationError | SqlError | DatabaseError,
+  Exclude<R, TargetId | TxId> | LifecycleHooks | DatabaseRequirements
+>;
+
+export function coordinateMysqlEmailRegistration<
+  TargetId,
+  Registration,
+  D extends Database,
+  S extends AnyMySqlTable,
+  I extends AnyMySqlTable,
+  C extends AnyMySqlTable,
+  AC extends AnyMySqlTable,
+  Rq extends AnyMySqlTable,
+  NativeId,
+  Out,
+  E,
+  R,
+  DatabaseError,
+  DatabaseRequirements,
+  TxId,
+  TxShape,
+>(
+  acquire: Effect.Effect<D, DatabaseError, DatabaseRequirements>,
+  options: {
+    readonly mapping: EmailRegistrationMapping<NoInfer<Registration>, S, I, C, AC, Rq, NativeId>;
+    readonly proofMapping: ProofMapping;
+    readonly target: SuppliedService<TargetId, EmailRegistrationAuthority<Registration>>;
+    readonly transaction?: SuppliedService<TxId, NoInfer<TransactionOf<D>>, TxShape>;
+  },
+  body: Effect.Effect<Out, E, R>,
+): Effect.Effect<
+  Out,
+  E | EmailUnavailable | HookConfigurationError | SqlError | DatabaseError,
+  Exclude<R, TargetId> | LifecycleHooks | DatabaseRequirements
+> {
+  return Effect.flatMap(acquire, (database) =>
+    coordinateTargetEmailRegistration<Registration, TransactionOf<D>, Out, E, Exclude<R, TargetId>>(
+      database,
+      options.mapping,
+      options.proofMapping,
+      configuration(database),
+      (
+        transaction: TransactionOf<D>,
+        services: { readonly registrationAuthority: EmailRegistrationAuthority<Registration> },
+      ) => {
+        const provided = Context.make(options.target, services.registrationAuthority);
+        const work = Effect.provideContext(body, provided);
+
+        return options.transaction === undefined
+          ? work
+          : Effect.provideService(work, options.transaction, options.transaction.of(transaction));
+      },
+    ),
+  );
+}

package/src/drizzle/mysql-identity.ts

@@ -0,0 +1,324 @@
+import {
+  ExternalIdentityMutation,
+  type ExternalIdentity,
+  IdentityConflict,
+  IdentityUnavailable,
+  SubjectProvisioned,
+  SubjectProvisioner,
+  type SubjectProvisioningInput,
+} from "@yielded/auth/Identity";
+import { reportPersistenceFailure } from "@yielded/auth/Persistence";
+import type { SubjectId } from "@yielded/auth/Schema";
+/* oxlint-disable no-explicit-any -- Drizzle generic query types are narrowed at this technology boundary. */
+import { and, eq, type AnyRelations } from "drizzle-orm";
+import type { EffectMysql2Database } from "drizzle-orm/effect-mysql2";
+import type { AnyMySqlTable, MySqlColumn } from "drizzle-orm/mysql-core";
+import { Cause, Effect, Schema } from "effect";
+
+import {
+  column,
+  isMappedConstraintConflict,
+  PersistenceMappingError,
+  provisioningFingerprint,
+  type ExternalIdentityTables,
+  type IdentityTables,
+  type SubjectProvisioningTables,
+} from "./model";
+
+type Database = EffectMysql2Database<AnyRelations>;
+type RuntimeDatabase = EffectMysql2Database<any>;
+const unavailable = () => IdentityUnavailable.make();
+const isIdentityFailure = Schema.is(Schema.Union([IdentityConflict, IdentityUnavailable]));
+
+const mapUnavailable = <A, E, R>(effect: Effect.Effect<A, E, R>) =>
+  reportPersistenceFailure(effect, isIdentityFailure).pipe(
+    Effect.catchCause((cause) =>
+      Effect.failCause(
+        Cause.map(cause, (error) => (isIdentityFailure(error) ? error : unavailable())),
+      ),
+    ),
+  );
+
+export const makeMysqlSubjectProvisioningServices = <
+  Subject extends AnyMySqlTable,
+  Identifier extends AnyMySqlTable,
+  Request extends AnyMySqlTable,
+  NativeId,
+>(
+  database: Database,
+  mapping: SubjectProvisioningTables<Subject, Identifier, Request, NativeId>,
+) => {
+  const db = database as RuntimeDatabase;
+  const requestTable = mapping.provisioningRequest.table;
+
+  const requestIdColumn = column(
+    requestTable,
+    mapping.provisioningRequest.requestId,
+  ) as MySqlColumn;
+
+  const requestFingerprintColumn = column(
+    requestTable,
+    mapping.provisioningRequest.fingerprint,
+  ) as MySqlColumn;
+
+  const requestSubjectColumn = column(
+    requestTable,
+    mapping.provisioningRequest.subjectId,
+  ) as MySqlColumn;
+
+  const identifierTable = mapping.identifier.table;
+
+  const identifierNamespaceColumn = column(
+    identifierTable,
+    mapping.identifier.namespace,
+  ) as MySqlColumn;
+
+  const identifierValueColumn = column(identifierTable, mapping.identifier.value) as MySqlColumn;
+
+  const findReceipt = Effect.fn("DrizzleMysqlIdentity.findReceipt")(function* (requestId: string) {
+    const rows = yield* db
+      .select({ fingerprint: requestFingerprintColumn, subjectId: requestSubjectColumn })
+      .from(requestTable as any)
+      .where(eq(requestIdColumn, requestId))
+      .limit(1);
+
+    return rows[0];
+  });
+
+  const provision = Effect.fn("DrizzleMysqlIdentity.provision")(function* (
+    input: SubjectProvisioningInput,
+  ) {
+    const fingerprint = provisioningFingerprint(input);
+    const existing = yield* findReceipt(input.requestId);
+
+    if (existing !== undefined) {
+      if (existing.fingerprint !== fingerprint) return yield* IdentityConflict.make();
+      const subjectId = yield* mapping.subjectId.toSubject(existing.subjectId as NativeId);
+
+      return SubjectProvisioned.make({ subjectId });
+    }
+
+    const attempt = db.transaction((tx) =>
+      Effect.gen(function* () {
+        const allocated =
+          mapping.subject.allocateId === undefined
+            ? mapping.subject.allocateIdSync?.()
+            : yield* mapping.subject.allocateId;
+
+        const insert = tx
+          .insert(mapping.subject.table as any)
+          .values(mapping.subject.encodeInsert(input, allocated) as any);
+
+        let nativeId = allocated;
+
+        if (nativeId === undefined) {
+          if (mapping.subject.decodeGeneratedId === undefined)
+            return yield* PersistenceMappingError.make({
+              operation: "provisionSubject.generatedId",
+              cause: new Error("MySQL generated IDs require decodeGeneratedId"),
+            });
+          const ids = yield* insert.$returningId();
+
+          nativeId = yield* mapping.subject.decodeGeneratedId(ids as ReadonlyArray<unknown>);
+        } else {
+          yield* insert;
+        }
+        if (input.identifier !== undefined)
+          yield* tx
+            .insert(identifierTable as any)
+            .values(
+              mapping.identifier.encodeInsert(input.identifier, nativeId, input.verifiedAt) as any,
+            );
+        yield* tx
+          .insert(requestTable as any)
+          .values(
+            mapping.provisioningRequest.encodeInsert(input.requestId, fingerprint, nativeId) as any,
+          );
+
+        return nativeId;
+      }),
+    );
+
+    const nativeId = yield* attempt.pipe(
+      Effect.catchCause(
+        (
+          cause,
+        ): Effect.Effect<
+          NativeId,
+          | Effect.Error<typeof attempt>
+          | Effect.Error<ReturnType<typeof findReceipt>>
+          | IdentityConflict
+        > => {
+          if (
+            cause.reasons.length === 0 ||
+            !cause.reasons.every(
+              (reason) =>
+                Cause.isFailReason(reason) &&
+                isMappedConstraintConflict(mapping.isConstraintConflict, reason.error),
+            )
+          )
+            return Effect.failCause(cause);
+
+          return findReceipt(input.requestId).pipe(
+            Effect.flatMap((receipt) => {
+              if (receipt !== undefined && receipt.fingerprint === fingerprint)
+                return Effect.succeed(receipt.subjectId as NativeId);
+              if (input.identifier === undefined) return IdentityConflict.make();
+
+              return db
+                .select({
+                  subjectId: column(identifierTable, mapping.identifier.subjectId) as MySqlColumn,
+                })
+                .from(identifierTable as any)
+                .where(
+                  and(
+                    eq(identifierNamespaceColumn, input.identifier.namespace),
+                    eq(identifierValueColumn, input.identifier.value),
+                  ),
+                )
+                .limit(1)
+                .pipe(Effect.flatMap(() => IdentityConflict.make()));
+            }),
+          );
+        },
+      ),
+    );
+
+    const subjectId = yield* mapping.subjectId.toSubject(nativeId);
+
+    return SubjectProvisioned.make({ subjectId });
+  }, mapUnavailable);
+
+  return { subjectProvisioner: SubjectProvisioner.of({ provision }) } as const;
+};
+
+export const makeMysqlExternalIdentityServices = <
+  Subject extends AnyMySqlTable,
+  External extends AnyMySqlTable,
+  NativeId,
+>(
+  database: Database,
+  mapping: ExternalIdentityTables<Subject, External, NativeId>,
+) => {
+  const db = database as RuntimeDatabase;
+  const externalTable = mapping.externalIdentity.table;
+
+  const externalProviderColumn = column(
+    externalTable,
+    mapping.externalIdentity.provider,
+  ) as MySqlColumn;
+
+  const externalIssuerColumn = column(
+    externalTable,
+    mapping.externalIdentity.issuer,
+  ) as MySqlColumn;
+
+  const externalSubjectColumn = column(
+    externalTable,
+    mapping.externalIdentity.subject,
+  ) as MySqlColumn;
+
+  const externalSubjectIdColumn = column(
+    externalTable,
+    mapping.externalIdentity.subjectId,
+  ) as MySqlColumn;
+
+  const subjectIdColumn = column(mapping.subject.table, mapping.subject.id) as MySqlColumn;
+  const subjectStatusColumn = column(mapping.subject.table, mapping.subject.status) as MySqlColumn;
+
+  const bind = Effect.fn("DrizzleMysqlIdentity.bindExternalIdentity")(function* (
+    subjectId: SubjectId,
+    identity: ExternalIdentity,
+  ) {
+    const nativeId = yield* mapping.subjectId.toNative(subjectId);
+
+    const decision = yield* db
+      .transaction((tx) =>
+        Effect.gen(function* () {
+          const subjects = yield* tx
+            .select({ status: subjectStatusColumn })
+            .from(mapping.subject.table as any)
+            .where(eq(subjectIdColumn, nativeId))
+            .for("update")
+            .limit(1);
+
+          if (subjects[0] === undefined || !mapping.subject.isActiveStatus(subjects[0].status))
+            return { _tag: "conflict" } as const;
+
+          const links = yield* tx
+            .select({ subjectId: externalSubjectIdColumn })
+            .from(externalTable as any)
+            .where(
+              and(
+                eq(externalProviderColumn, identity.provider),
+                eq(externalIssuerColumn, identity.issuer),
+                eq(externalSubjectColumn, identity.subject),
+              ),
+            )
+            .for("update")
+            .limit(1);
+
+          if (links[0] !== undefined)
+            return mapping.subjectId.equals(links[0].subjectId as NativeId, nativeId)
+              ? ({ _tag: "bound" } as const)
+              : ({ _tag: "conflict" } as const);
+          yield* tx
+            .insert(externalTable as any)
+            .values(mapping.externalIdentity.encodeInsert(identity, nativeId) as any);
+
+          return { _tag: "bound" } as const;
+        }),
+      )
+      .pipe(
+        Effect.catchCause((cause) => {
+          if (
+            cause.reasons.length === 0 ||
+            !cause.reasons.every(
+              (reason) =>
+                Cause.isFailReason(reason) &&
+                isMappedConstraintConflict(mapping.isConstraintConflict, reason.error),
+            )
+          )
+            return Effect.failCause(cause);
+
+          return db
+            .select({ subjectId: externalSubjectIdColumn })
+            .from(externalTable as any)
+            .where(
+              and(
+                eq(externalProviderColumn, identity.provider),
+                eq(externalIssuerColumn, identity.issuer),
+                eq(externalSubjectColumn, identity.subject),
+              ),
+            )
+            .limit(1)
+            .pipe(
+              Effect.map((rows) =>
+                rows[0] !== undefined &&
+                mapping.subjectId.equals(rows[0].subjectId as NativeId, nativeId)
+                  ? ({ _tag: "bound" } as const)
+                  : ({ _tag: "conflict" } as const),
+              ),
+            );
+        }),
+      );
+
+    if (decision._tag === "conflict") return yield* IdentityConflict.make();
+  }, mapUnavailable);
+
+  return { externalIdentityMutation: ExternalIdentityMutation.of({ bind }) } as const;
+};
+
+export const makeMysqlIdentityServices = <
+  Subject extends AnyMySqlTable,
+  Identifier extends AnyMySqlTable,
+  External extends AnyMySqlTable,
+  Request extends AnyMySqlTable,
+  NativeId,
+>(
+  database: Database,
+  mapping: IdentityTables<Subject, Identifier, External, Request, NativeId>,
+) => ({
+  ...makeMysqlSubjectProvisioningServices(database, mapping),
+  ...makeMysqlExternalIdentityServices(database, mapping),
+});