@yielded/auth 0.1.0-beta.1

package/src/auth/actions.ts

@@ -0,0 +1,220 @@
+import { Effect, Predicate, Redacted, Schema } from "effect";
+
+import type {
+  ActionError,
+  ActionInput,
+  ActionSuccess,
+  AnyAuthAction,
+  AuthActions,
+} from "../operations/actions";
+import { guest } from "../operations/context";
+import {
+  type AuthCredentialCommand,
+  AuthCredentialCommandCollector,
+  AuthRevealCommandCollectorService,
+} from "../operations/credentials";
+import { InvalidOperationInput } from "../operations/errors";
+import type { makeOperation } from "../operations/operation";
+import type { AuthRevealCommand } from "../operations/reveals";
+import { AuthConfigurationError } from "./AuthConfigurationError";
+import { AuthRequest } from "./AuthRequest";
+
+type Method = (...input: never[]) => Effect.Effect<unknown, unknown, unknown>;
+type Methods = Readonly<Record<string, Method>>;
+type Implementations = Readonly<Record<string, Methods>>;
+type Lookup<Table, Key> = Table extends unknown
+  ? string extends Key
+    ? Table[keyof Table]
+    : Key extends keyof Table
+      ? Table[Key]
+      : never
+  : never;
+type Selection<Action extends AnyAuthAction, Default> =
+  | Exclude<Action["strategy"], undefined>
+  | (undefined extends Action["strategy"] ? Default : never);
+type Implementation<
+  Action extends AnyAuthAction,
+  Sessions extends Methods,
+  Strategies extends Implementations,
+  Default,
+> =
+  | Lookup<Sessions, Action["method"]>
+  | Lookup<Lookup<Strategies, Selection<Action, Default>>, Action["method"]>;
+type Requirements<Method> = Method extends (
+  ...args: never[]
+) => Effect.Effect<unknown, unknown, infer R>
+  ? R
+  : never;
+type Codecs<Action extends AnyAuthAction> = Action["route"]["operation"]["rpc"][
+  | "payloadSchema"
+  | "successSchema"
+  | "errorSchema"];
+type SchemaServices<Action extends AnyAuthAction> = Codecs<Action>[
+  | "DecodingServices"
+  | "EncodingServices"];
+
+export type LocalActionApi<
+  Actions extends AuthActions,
+  Sessions extends Methods,
+  Strategies extends Implementations,
+  Default,
+> = {
+  readonly [Name in keyof Actions]: (
+    ...args: [ActionInput<Actions[Name]>] extends [void]
+      ? [input?: ActionInput<Actions[Name]>]
+      : [input: ActionInput<Actions[Name]>]
+  ) => Effect.Effect<
+    ActionSuccess<Actions[Name]>,
+    ActionError<Actions[Name]>,
+    | AuthRequest
+    | SchemaServices<Actions[Name]>
+    | Requirements<Implementation<Actions[Name], Sessions, Strategies, Default>>
+  >;
+};
+
+/** Bind shared schemas to local capabilities. The chosen implementation is fixed
+ * at construction; credentials and all execution services are resolved per call. */
+export const makeActionApi = Effect.fn("Auth.makeActionApi")(function* <
+  Sessions extends Methods,
+  Strategies extends Implementations,
+  Default extends keyof Strategies | undefined,
+  Actions extends AuthActions,
+>(
+  sessions: Sessions,
+  strategies: Strategies,
+  defaultStrategy: Default | undefined,
+  actions: Actions,
+) {
+  type RawMethod = Sessions[keyof Sessions] | Strategies[keyof Strategies][string];
+  type R = Requirements<RawMethod>;
+
+  const entries: Array<
+    readonly [string, (input: unknown) => Effect.Effect<unknown, unknown, R | AuthRequest>]
+  > = [];
+
+  for (const [name, action] of Object.entries(actions)) {
+    const selected = action.strategy ?? defaultStrategy;
+
+    const methods = Object.hasOwn(sessions, action.method)
+      ? sessions
+      : typeof selected === "string" && Object.hasOwn(strategies, selected)
+        ? strategies[selected]
+        : undefined;
+
+    if (methods === undefined || !Object.hasOwn(methods, action.method))
+      return yield* AuthConfigurationError.make({ reason: "method" });
+
+    // Indexed iteration hides the paired input/result types, but keeps the union
+    // of implementation requirements. The shared operation validates both sides.
+    const method = methods[action.method] as (input: unknown) => Effect.Effect<unknown, unknown, R>;
+
+    if (!Predicate.isFunction(method))
+      return yield* AuthConfigurationError.make({ reason: "method" });
+
+    const run = Effect.fn(`Auth.action.${name}`)(function* (input: unknown) {
+      const request = yield* AuthRequest;
+
+      // The action has decoded and validated the complete public codec. Existing
+      // strategy methods accept encoded inputs at their own operation boundary.
+      const encoded = yield* Schema.encodeEffect(action.route.operation.rpc.payloadSchema)(
+        input,
+      ).pipe(Effect.mapError(() => InvalidOperationInput.make({})));
+
+      const fields = Object.entries(action.requestFields);
+
+      if (fields.length > 0 && !Predicate.isObject(encoded))
+        return yield* InvalidOperationInput.make({});
+
+      const payload = fields.length === 0 ? encoded : { ...(encoded as Record<string, unknown>) };
+
+      for (const [field, slot] of fields) {
+        const credential = request.credentials[slot];
+
+        if (credential === undefined) return yield* InvalidOperationInput.make({});
+        (payload as Record<string, unknown>)[field] = Redacted.value(credential);
+      }
+
+      const credentialCommands: AuthCredentialCommand[] = [];
+      const revealCommands: AuthRevealCommand[] = [];
+
+      const sink = (commands: ReadonlyArray<AuthCredentialCommand>) =>
+        Effect.sync(() => {
+          credentialCommands.push(...commands);
+        });
+
+      const collector = {
+        supportedKinds: action.route.reveals,
+        accept: (commands: ReadonlyArray<AuthRevealCommand>) =>
+          Effect.sync(() => {
+            revealCommands.push(...commands);
+          }),
+      };
+
+      const value = yield* method(payload).pipe(
+        Effect.provideService(AuthRequest, {
+          ...request,
+          actionMode: action.mode,
+          credentialCommandSink: sink,
+          revealCommandCollector: collector,
+        }),
+        Effect.provideService(AuthCredentialCommandCollector, sink),
+        Effect.provideService(AuthRevealCommandCollectorService, collector),
+      );
+
+      if (
+        (!action.route.operation.credentials && credentialCommands.length > 0) ||
+        (action.route.reveals.length === 0 && revealCommands.length > 0)
+      )
+        return yield* Effect.die(AuthConfigurationError.make({ reason: "method" }));
+
+      return { value, credentialCommands, revealCommands };
+    });
+
+    // Restore the handler constructors hidden by the heterogeneous descriptor.
+    const operation = action.route.operation as unknown as ReturnType<
+      typeof makeOperation<string, Schema.Top, Schema.Top, Schema.Top>
+    >;
+
+    const layer =
+      operation.credentials || operation.reveals.length > 0
+        ? operation.privateHandlerLayer(run)
+        : operation.handlerLayer((input) => run(input).pipe(Effect.map((result) => result.value)));
+
+    entries.push([
+      name,
+      Effect.fn(`Auth.${name}`)(function* (input: unknown) {
+        const request = yield* AuthRequest;
+
+        if (action.mode === "mutation" && request.beforeMutation !== undefined)
+          yield* request.beforeMutation;
+
+        // Reject private input before schema projection can remove unknown fields.
+        if (
+          Predicate.isObject(input) &&
+          Object.keys(action.requestFields).some((field) => Object.hasOwn(input, field))
+        )
+          return yield* InvalidOperationInput.make({});
+
+        return yield* operation.invokeUnknown(guest, input).pipe(
+          Effect.provide(layer, { local: true }),
+          Effect.provideService(AuthCredentialCommandCollector, request.credentialCommandSink),
+          Effect.provideService(
+            AuthRevealCommandCollectorService,
+            request.revealCommandCollector ?? {
+              supportedKinds: [],
+              accept: () => Effect.void,
+            },
+          ),
+        );
+      }) as (input: unknown) => Effect.Effect<unknown, unknown, R | AuthRequest>,
+    ]);
+  }
+
+  // Every entry invokes the exact operation and implementation selected above.
+  return Object.freeze(Object.fromEntries(entries)) as LocalActionApi<
+    Actions,
+    Sessions,
+    Strategies,
+    Default
+  >;
+});

package/src/auth/defaults.ts

@@ -0,0 +1,23 @@
+import type { Context } from "effect";
+import { Crypto, Effect, Layer, Option } from "effect";
+
+import { LifecycleHooks } from "../hooks/LifecycleHooks";
+import { layerCryptoWeb, SubtleCrypto } from "../WebCrypto";
+
+/** Keep explicitly supplied services. Shared Layer values also share their resources. */
+export const defaultLayer = <I, S, E, R>(
+  service: Context.Key<I, S>,
+  fallback: Layer.Layer<I, E, R>,
+): Layer.Layer<I, E, R> =>
+  Layer.unwrap(
+    Effect.map(Effect.serviceOption(service), (current) =>
+      Option.isSome(current) ? Layer.succeed(service, current.value) : fallback,
+    ),
+  );
+
+export const cryptoLayer = Layer.mergeAll(
+  defaultLayer(Crypto.Crypto, layerCryptoWeb),
+  defaultLayer(SubtleCrypto, SubtleCrypto.layerWeb),
+);
+
+export const hooksLayer = defaultLayer(LifecycleHooks, LifecycleHooks.empty);

package/src/auth/definition.ts

@@ -0,0 +1,88 @@
+import type { Effect, HKT, Schema } from "effect";
+
+import type { makeSessionModule } from "../sessions/module";
+
+export type ClaimsCodec = Schema.Codec<unknown, unknown, unknown, unknown>;
+export type AuthMethod = (...args: never[]) => Effect.Effect<unknown, unknown, unknown>;
+
+export interface BuiltStrategy {
+  /** This method bundle completes authentication through the shared session authority. */
+  readonly completion?: boolean;
+  readonly make: Effect.Effect<Readonly<Record<string, AuthMethod>>, unknown, unknown>;
+}
+
+/** Static contracts and service keys shared by one auth definition. Implementations come from Layers. */
+export interface StrategyBinding<
+  Claims extends ClaimsCodec,
+  Id extends string,
+  SessionId extends string,
+> {
+  readonly claims: Claims;
+  readonly namespace: Id;
+  readonly sessions: ReturnType<typeof makeSessionModule<SessionId, Claims>>;
+  readonly sessionNamespace: SessionId;
+}
+
+export interface StrategyTypeLambda extends HKT.TypeLambda {
+  readonly type: { readonly strategy: BuiltStrategy };
+}
+
+export type BindingOf<F extends HKT.TypeLambda> = Extract<
+  F["Target"],
+  {
+    readonly claims: ClaimsCodec;
+    readonly namespace: string;
+    readonly sessionNamespace: string;
+  }
+>;
+
+export interface StrategyDefinition<
+  F extends StrategyTypeLambda,
+  Namespace extends string | undefined = undefined,
+> {
+  readonly _TypeLambda?: F;
+  /** Override only when an existing credential or operation namespace must be retained. */
+  readonly namespace: Namespace;
+  readonly bind: <
+    Claims extends ClaimsCodec,
+    const Id extends string,
+    const SessionId extends string,
+  >(
+    binding: StrategyBinding<Claims, Id, SessionId>,
+  ) => HKT.Kind<F, never, never, never, StrategyBinding<Claims, Id, SessionId>>;
+}
+
+export type StrategySelection = Readonly<
+  Record<string, StrategyDefinition<StrategyTypeLambda, string | undefined> | BuiltStrategy>
+>;
+
+type NamespaceOf<S, Root extends string, Key extends string> = S extends {
+  readonly namespace: infer Id extends string | undefined;
+}
+  ? undefined extends Id
+    ? Exclude<Id, undefined> | `${Root}/${Key}`
+    : Id
+  : `${Root}/${Key}`;
+
+export type BoundStrategies<
+  S extends StrategySelection,
+  Claims extends ClaimsCodec,
+  Id extends string,
+  SessionId extends string,
+> = {
+  readonly [K in keyof S]: S[K] extends StrategyDefinition<infer F, string | undefined>
+    ? HKT.Kind<
+        F,
+        never,
+        never,
+        never,
+        StrategyBinding<Claims, NamespaceOf<S[K], Id, Extract<K, string>>, SessionId>
+      >
+    : { readonly strategy: S[K] };
+};
+
+export type BoundSelection<S> = {
+  readonly [K in keyof S]: S[K] extends { readonly strategy: infer Strategy extends BuiltStrategy }
+    ? Strategy
+    : never;
+};

package/src/auth/session.ts

@@ -0,0 +1,146 @@
+import { Context, Effect, Layer, Redacted, type Schema, Scope } from "effect";
+
+import type { HookDenied } from "../hooks/models";
+import { guest } from "../operations/context";
+import {
+  AuthCredentialCommandCollector,
+  AuthRevealCommandCollectorService,
+} from "../operations/credentials";
+import { AuthenticationRequired, type OperationBoundaryError } from "../operations/errors";
+import {
+  SessionInvalid,
+  type SessionError,
+  type SessionSignOutUnavailable,
+} from "../sessions/errors";
+import type { SessionSignOut } from "../sessions/models";
+import type { makeSessionModule } from "../sessions/module";
+import { AuthRequest } from "./AuthRequest";
+
+export type SessionApiError = SessionError | HookDenied | OperationBoundaryError;
+
+/** Session actions share implementations across HTTP, native and local callers. */
+export interface SessionApi<Session, R = never> {
+  /** Explicit credential verification; does not read a request or renew credentials. */
+  readonly verifySession: (
+    credential: Redacted.Redacted<string>,
+  ) => Effect.Effect<Session, SessionApiError>;
+  /** Missing or invalid credentials are anonymous; availability failures remain failures. */
+  readonly getSession: () => Effect.Effect<Session | null, SessionApiError, AuthRequest | R>;
+  readonly requireSession: () => Effect.Effect<Session, SessionApiError, AuthRequest | R>;
+  /** Does not preverify. Local clearing and server invalidation have distinct outcomes. */
+  readonly signOut: () => Effect.Effect<
+    SessionSignOut | SessionSignOutUnavailable,
+    SessionApiError,
+    AuthRequest | R
+  >;
+  /** Explicit renewal; ordinary session reads never rotate credentials. */
+  readonly renewSession: () => Effect.Effect<Session, SessionApiError, AuthRequest | R>;
+}
+
+export const makeSessionApi = <
+  const Id extends string,
+  Claims extends Schema.Codec<unknown, unknown, unknown, unknown>,
+>(
+  sessions: ReturnType<typeof makeSessionModule<Id, Claims>>,
+) =>
+  Effect.gen(function* () {
+    const strategy = yield* sessions.SessionStrategy;
+
+    // Handler installation captures its input context. Supply only its shared
+    // dependency, so constructing auth inside a request cannot retain that request.
+    const handlers = yield* Layer.buildWithScope(
+      sessions.sessionHandlersLayer,
+      yield* Effect.scope,
+    ).pipe(
+      Effect.updateContext((_: Context.Context<never>) =>
+        Context.make(sessions.SessionStrategy, strategy),
+      ),
+    );
+
+    // Keep application codec dependencies, but never capture a request or its collectors.
+    const services = (yield* Effect.context<
+      Claims["DecodingServices"] | Claims["EncodingServices"]
+    >()).pipe(
+      Context.merge(handlers),
+      Context.omit(
+        AuthRequest,
+        Scope.Scope,
+        AuthCredentialCommandCollector,
+        AuthRevealCommandCollectorService,
+      ),
+    );
+
+    const verifySession = Effect.fn("Auth.verifySession")(function* (
+      credential: Redacted.Redacted<string>,
+    ) {
+      return yield* sessions.operations.Verify.invoke(guest, {
+        credential: Redacted.value(credential),
+      }).pipe(
+        Effect.provide(services),
+        Effect.catchTag("InvalidOperationInput", () => SessionInvalid.make({})),
+      );
+    });
+
+    const getSession = Effect.fn("Auth.getSession")(function* () {
+      const request = yield* AuthRequest;
+      const credential = request.credentials.session;
+
+      if (credential === undefined) return null;
+
+      return yield* verifySession(credential).pipe(
+        Effect.catchTag("SessionInvalid", () => Effect.succeed(null)),
+      );
+    });
+
+    const requireSession = Effect.fn("Auth.requireSession")(function* () {
+      const session = yield* getSession();
+
+      if (session === null) return yield* AuthenticationRequired.make({});
+
+      return session;
+    });
+
+    const signOut = Effect.fn("Auth.signOut")(function* () {
+      const request = yield* AuthRequest;
+
+      if (request.beforeMutation !== undefined) yield* request.beforeMutation;
+      const credential = request.credentials.session;
+
+      if (credential === undefined || Redacted.value(credential) === "") {
+        yield* request.credentialCommandSink([{ _tag: "Clear", slot: "session" }]);
+
+        return { clearCredential: true as const, invalidation: "already-invalid" as const };
+      }
+
+      return yield* sessions.operations.SignOut.invoke(guest, {
+        credential: Redacted.value(credential),
+      }).pipe(
+        Effect.provide(services),
+        Effect.provideService(AuthCredentialCommandCollector, request.credentialCommandSink),
+      );
+    });
+
+    const renewSession = Effect.fn("Auth.renewSession")(function* () {
+      const request = yield* AuthRequest;
+
+      if (request.beforeMutation !== undefined) yield* request.beforeMutation;
+      const credential = request.credentials.session;
+
+      if (credential === undefined) return yield* AuthenticationRequired.make({});
+
+      return yield* sessions.operations.Renew.invoke(guest, {
+        credential: Redacted.value(credential),
+      }).pipe(
+        Effect.provide(services),
+        Effect.provideService(AuthCredentialCommandCollector, request.credentialCommandSink),
+      );
+    });
+
+    return {
+      verifySession,
+      getSession,
+      requireSession,
+      signOut,
+      renewSession,
+    } satisfies SessionApi<typeof sessions.Session.Type>;
+  });

package/src/drizzle/D1BatchStatements.ts

@@ -0,0 +1,10 @@
+import { Context, type Effect } from "effect";
+import type { Statement } from "effect/unstable/sql/Statement";
+
+/** Appends application statements to the current coordinator's single atomic batch. */
+export class D1BatchStatements extends Context.Service<
+  D1BatchStatements,
+  {
+    readonly append: (statement: Statement<unknown>) => Effect.Effect<void>;
+  }
+>()("effect-auth/D1BatchStatements") {}

package/src/drizzle/PasswordPreparedPostconditions.ts

@@ -0,0 +1,30 @@
+import { Context, type Effect } from "effect";
+
+import type { PreparedCommit } from "../hooks/commit";
+import type { PasswordUnavailable } from "../password/methods/errors";
+import type { ProofUnavailable } from "../proofs/errors";
+import type { PasswordSqlDatabase } from "./password-sql";
+
+/** Final reads resolve the current physical owner, never a released savepoint. */
+export class CurrentPasswordPreparedTransaction extends Context.Service<
+  CurrentPasswordPreparedTransaction,
+  PasswordSqlDatabase
+>()("effect-auth/drizzle/CurrentPasswordPreparedTransaction") {}
+
+export type PasswordPreparedPostcondition = Effect.Effect<
+  void,
+  PasswordUnavailable | ProofUnavailable,
+  CurrentPasswordPreparedTransaction
+>;
+
+/** Registration ends when the application owner returns, before final validation. */
+export class PasswordPreparedPostconditions extends Context.Service<
+  PasswordPreparedPostconditions,
+  { readonly register: (check: PasswordPreparedPostcondition) => boolean }
+>()("effect-auth/drizzle/PasswordPreparedPostconditions") {}
+
+/** Journal registration closes with the prepared-password owner callback. */
+export class PasswordPreparedJournalGuards extends Context.Service<
+  PasswordPreparedJournalGuards,
+  { readonly register: (guard: PreparedCommit<void>) => boolean }
+>()("effect-auth/drizzle/PasswordPreparedJournalGuards") {}

package/src/drizzle/SuppliedService.ts

@@ -0,0 +1,10 @@
+import type { Context } from "effect";
+
+/** The strict function property also checks class-style keys: the adapter's
+ * constructed value must satisfy the selected service, including native relations. */
+export type SuppliedService<Id, Constructed, Selected = Constructed> = Context.Service<
+  Id,
+  Selected
+> & {
+  readonly of: (value: Constructed) => Selected;
+};