@yielded/auth 0.1.0-beta.1

package/src/drizzle/passkey-credentials.ts

@@ -0,0 +1,465 @@
+/* oxlint-disable no-explicit-any -- private row bridge; concrete makers retain every table/native-ID type. */
+import { asc, inArray, sql } from "drizzle-orm";
+import { Effect, Schema } from "effect";
+
+import {
+  PasskeyCredential,
+  PasskeyDescriptor,
+  PasskeyRevision,
+  PasskeyUserHandle,
+} from "../passkey/models";
+import { validatePasskeyPolicy } from "../passkey/policy";
+import { snapshotPasskeySync } from "../passkey/snapshot";
+import type { SubjectId } from "../Schema";
+import {
+  assertNow,
+  col,
+  copiedRow,
+  credentialKey,
+  equal,
+  handleKey,
+  invariant,
+  mappedColumns,
+  observeSemantic,
+  matchesNativeRow,
+  semanticCredentialColumns,
+  CurrentPasskeyTransaction,
+  unavailable,
+} from "./passkey-state";
+import { both } from "./transaction-owner";
+
+export interface SubjectRead {
+  readonly nativeId: unknown;
+  readonly subjectId: SubjectId;
+  readonly securityRevision: typeof PasskeyRevision.Type.securityRevision;
+}
+
+export const readSubject = Effect.fn("passkey.readSubject")(function* (
+  mapping: any,
+  subjectId: SubjectId,
+) {
+  const owner = yield* CurrentPasskeyTransaction;
+  const descriptor = mapping.subject;
+  const nativeId = mapping.subjectIds.toNative(subjectId);
+
+  invariant(mapping.subjectIds.toSubject(nativeId) === subjectId);
+
+  const found = yield* owner.read(
+    descriptor.table,
+    equal(descriptor.table, { [descriptor.id]: nativeId }),
+    {
+      limit: 1,
+      columns: [descriptor.id, descriptor.status, descriptor.securityRevision],
+    },
+  );
+
+  const row = found.rows[0];
+
+  if (row === undefined || !descriptor.isActiveStatus(row[descriptor.status])) return undefined;
+  invariant(mapping.subjectIds.equals(descriptor.decodeId(copiedRow(row)), nativeId));
+
+  const active = sql`exists(select 1 from ${descriptor.table} where ${both(
+    owner.exact(descriptor.table, row),
+    descriptor.activeCondition,
+  )})`;
+
+  if (!(yield* owner.check(active))) return undefined;
+  owner.postconditions.push(active);
+
+  // oxlint-disable-next-line no-restricted-properties -- native SQL column values enter through this untyped driver boundary.
+  const securityRevision = Schema.decodeUnknownSync(PasskeyRevision.fields.securityRevision)(
+    row[descriptor.securityRevision],
+  );
+
+  return { nativeId, subjectId, securityRevision };
+});
+
+export const readModule = Effect.fn("passkey.readModule")(function* (mapping: any) {
+  const owner = yield* CurrentPasskeyTransaction;
+  const descriptor = mapping.module;
+
+  const columns = [
+    ...new Set<string>([
+      descriptor.moduleId,
+      descriptor.status,
+      descriptor.policyRevision,
+      ...descriptor.policyColumns,
+    ]),
+  ];
+
+  const found = yield* owner.read(
+    descriptor.table,
+    equal(descriptor.table, { [descriptor.moduleId]: mapping.moduleId }),
+    {
+      limit: 1,
+      columns,
+    },
+  );
+
+  const row = found.rows[0];
+
+  if (row === undefined || !descriptor.isActiveStatus(row[descriptor.status])) return undefined;
+  invariant(row[descriptor.moduleId] === mapping.moduleId);
+  yield* assertNow(
+    sql`exists(select 1 from ${descriptor.table} where ${both(
+      owner.exact(descriptor.table, row),
+      descriptor.activeCondition,
+    )})`,
+  );
+
+  return yield* validatePasskeyPolicy(descriptor.decodeMethodPolicy(copiedRow(row))).pipe(
+    Effect.mapError(unavailable),
+  );
+});
+
+export const readPolicyGuards = Effect.fn("passkey.readPolicyGuards")(function* (mapping: any) {
+  const owner = yield* CurrentPasskeyTransaction;
+
+  for (const guard of [...(mapping.module.guards ?? [])].sort((a, b) =>
+    a.scope < b.scope ? -1 : a.scope > b.scope ? 1 : 0,
+  )) {
+    const locked = yield* owner.read(guard.table, guard.where(mapping.moduleId), {
+      limit: 1,
+      columns: guard.columns,
+    });
+
+    invariant(locked.rows.length === 1);
+    yield* assertNow(guard.condition(mapping.moduleId));
+  }
+});
+
+/** Advisory discovery never locks a tuple before its subject. All fields are
+ * reread under the common subject/tuple lock order by readCredential. */
+export const discoverSubject = Effect.fn("passkey.discoverSubject")(function* (
+  mapping: any,
+  rpId: string,
+  protocolCredentialId: string,
+) {
+  const owner = yield* CurrentPasskeyTransaction;
+  const descriptor = mapping.credentialOwnership;
+
+  const found = yield* owner.read(
+    descriptor.table,
+    equal(descriptor.table, {
+      [descriptor.credentialKey]: credentialKey(rpId, protocolCredentialId),
+    }),
+    { lock: false, observe: false, limit: 1, columns: mappedColumns(descriptor) },
+  );
+
+  const row = found.rows[0];
+
+  if (row === undefined) return undefined;
+  invariant(
+    row[descriptor.rpId] === rpId && row[descriptor.protocolCredentialId] === protocolCredentialId,
+  );
+  if (!descriptor.isOwnedState(row[descriptor.state])) return undefined;
+  const native = descriptor.decodeSubjectId(copiedRow(row));
+  const subjectId = mapping.subjectIds.toSubject(native);
+
+  invariant(mapping.subjectIds.equals(mapping.subjectIds.toNative(subjectId), native));
+
+  return subjectId as SubjectId;
+});
+
+export const readRevision = Effect.fn("passkey.readRevision")(function* (
+  mapping: any,
+  subject: SubjectRead,
+  ids?: ReadonlyArray<string>,
+) {
+  const owner = yield* CurrentPasskeyTransaction;
+
+  if (ids !== undefined) invariant(ids.length <= 64 && new Set(ids).size === ids.length);
+  const descriptor = mapping.authority;
+
+  const where = both(
+    equal(descriptor.table, { [descriptor.subjectId]: subject.nativeId }),
+    descriptor.activeCondition,
+    ids === undefined
+      ? undefined
+      : ids.length === 0
+        ? sql`1 = 0`
+        : inArray(col(descriptor.table, descriptor.credentialId), [...ids]),
+  );
+
+  const found = yield* owner.read(descriptor.table, where, {
+    limit: 64,
+    columns: mappedColumns(descriptor),
+    orderBy: asc(col(descriptor.table, descriptor.credentialId)),
+  });
+
+  const credentials = found.rows.map((row) => {
+    invariant(descriptor.isActiveStatus(row[descriptor.status]));
+
+    return {
+      credentialId: row[descriptor.credentialId],
+      revision: row[descriptor.revision],
+    };
+  });
+
+  const revision = snapshotPasskeySync(PasskeyRevision, {
+    subjectId: subject.subjectId,
+    securityRevision: subject.securityRevision,
+    credentials,
+  });
+
+  invariant(
+    new Set(revision.credentials.map((item) => item.credentialId)).size ===
+      revision.credentials.length,
+  );
+  if (
+    ids !== undefined &&
+    (revision.credentials.length !== ids.length ||
+      !ids.every((id) => revision.credentials.some((item) => item.credentialId === id)))
+  )
+    return undefined;
+
+  return revision;
+});
+
+export interface CredentialRead {
+  readonly credential: PasskeyCredential;
+  readonly row: Record<string, unknown>;
+}
+
+export const readCredential = Effect.fn("passkey.readCredential")(function* (
+  mapping: any,
+  subject: SubjectRead,
+  rpId: string,
+  protocolCredentialId: string,
+  ids?: ReadonlyArray<string>,
+) {
+  const owner = yield* CurrentPasskeyTransaction;
+  const ownership = mapping.credentialOwnership;
+  const tupleKey = credentialKey(rpId, protocolCredentialId);
+
+  const tuple = (yield* owner.read(
+    ownership.table,
+    equal(ownership.table, { [ownership.credentialKey]: tupleKey }),
+    {
+      limit: 1,
+      columns: mappedColumns(ownership),
+    },
+  )).rows[0];
+
+  if (tuple === undefined) return undefined;
+  invariant(
+    tuple[ownership.rpId] === rpId &&
+      tuple[ownership.protocolCredentialId] === protocolCredentialId,
+  );
+  if (!ownership.isOwnedState(tuple[ownership.state])) return undefined;
+  if (!mapping.subjectIds.equals(ownership.decodeSubjectId(copiedRow(tuple)), subject.nativeId))
+    return undefined;
+  yield* assertNow(
+    sql`exists(select 1 from ${ownership.table} where ${both(owner.exact(ownership.table, tuple), ownership.ownedCondition)})`,
+  );
+  const descriptor = mapping.credential;
+
+  const where = equal(descriptor.table, {
+    [descriptor.credentialId]: tuple[ownership.credentialId],
+  });
+
+  let row = (yield* owner.read(descriptor.table, where, {
+    limit: 1,
+    lock: false,
+    observe: false,
+    columns: mappedColumns(descriptor),
+  })).rows[0];
+
+  if (row === undefined) return undefined;
+  if (!descriptor.isActiveStatus(row[descriptor.status])) return undefined;
+  if (!mapping.subjectIds.equals(descriptor.decodeSubjectId(copiedRow(row)), subject.nativeId))
+    return undefined;
+  let decoded = descriptor.decode(copiedRow(row));
+  const handle = mapping.handleOwnership;
+  const expectedHandleKey = handleKey(rpId, decoded.userHandle);
+
+  const handleRow = (yield* owner.read(
+    handle.table,
+    equal(handle.table, { [handle.handleKey]: expectedHandleKey }),
+    {
+      limit: 1,
+      columns: mappedColumns(handle),
+    },
+  )).rows[0];
+
+  invariant(
+    row[descriptor.credentialKey] === tupleKey && row[descriptor.handleKey] === expectedHandleKey,
+  );
+  if (handleRow === undefined || !handle.isOwnedState(handleRow[handle.state])) return undefined;
+  invariant(handleRow[handle.rpId] === rpId && handleRow[handle.userHandle] === decoded.userHandle);
+  if (!mapping.subjectIds.equals(handle.decodeSubjectId(copiedRow(handleRow)), subject.nativeId))
+    return undefined;
+  yield* assertNow(
+    sql`exists(select 1 from ${handle.table} where ${both(owner.exact(handle.table, handleRow), handle.ownedCondition)})`,
+  );
+
+  const locked = (yield* owner.read(descriptor.table, where, {
+    limit: 1,
+    observe: false,
+    columns: mappedColumns(descriptor),
+  })).rows[0];
+
+  if (locked === undefined) return undefined;
+  invariant(
+    matchesNativeRow(
+      descriptor.table,
+      locked,
+      Object.fromEntries(
+        semanticCredentialColumns(descriptor).map((column) => [column, row![column]]),
+      ),
+    ),
+  );
+  row = locked;
+  decoded = descriptor.decode(copiedRow(row));
+  yield* observeSemantic(descriptor, where, row);
+  yield* assertNow(
+    sql`exists(select 1 from ${descriptor.table} where ${both(
+      owner.exact(descriptor.table, {
+        [descriptor.credentialId]: row[descriptor.credentialId],
+        [descriptor.credentialRevision]: row[descriptor.credentialRevision],
+      }),
+      descriptor.activeCondition,
+    )})`,
+  );
+
+  const requested =
+    ids === undefined ? undefined : [...new Set([...ids, decoded.credentialId])].sort();
+
+  const revision = yield* readRevision(mapping, subject, requested);
+
+  if (revision === undefined) return undefined;
+  const credential = snapshotPasskeySync(PasskeyCredential, { ...decoded, revision, active: true });
+
+  invariant(credential.rpId === rpId && credential.protocolCredentialId === protocolCredentialId);
+  invariant(
+    credential.credentialId === row[descriptor.credentialId] &&
+      credential.credentialId === tuple[ownership.credentialId],
+  );
+  invariant(
+    credential.profile.rpId === rpId &&
+      credential.profile.algorithms.includes(credential.algorithm),
+  );
+  invariant(
+    credential.counter === Number(row[descriptor.counter]) &&
+      credential.maximumCounter === Number(row[descriptor.maximumCounter]),
+  );
+  invariant(
+    credential.maximumCounter >= credential.counter &&
+      (!credential.backupState || credential.backupEligible),
+  );
+  if (
+    !revision.credentials.some(
+      (item) =>
+        item.credentialId === credential.credentialId &&
+        item.revision === row[descriptor.credentialRevision],
+    )
+  )
+    return undefined;
+
+  return { credential, row };
+});
+
+export const lookupCredential = Effect.fn("passkey.lookupCredential")(function* (
+  mapping: any,
+  rpId: string,
+  protocolCredentialId: string,
+) {
+  const subjectId = yield* discoverSubject(mapping, rpId, protocolCredentialId);
+
+  if (subjectId === undefined) return undefined;
+  const subject = yield* readSubject(mapping, subjectId);
+
+  if (subject === undefined) return undefined;
+
+  return (yield* readCredential(mapping, subject, rpId, protocolCredentialId))?.credential;
+});
+
+export const captureEnrollmentContext = Effect.fn("passkey.captureEnrollmentContext")(function* (
+  mapping: any,
+  input: { readonly moduleId: string; readonly rpId: string; readonly subjectId: SubjectId },
+) {
+  const owner = yield* CurrentPasskeyTransaction;
+
+  if (input.moduleId !== mapping.moduleId) return undefined;
+  const policy = yield* readModule(mapping);
+
+  if (policy === undefined || !policy.profiles.some((profile) => profile.rpId === input.rpId))
+    return undefined;
+  const subject = yield* readSubject(mapping.read, input.subjectId);
+
+  if (subject === undefined) return undefined;
+  yield* readPolicyGuards(mapping);
+  const handle = mapping.read.handleOwnership;
+
+  const handles = yield* owner.read(
+    handle.table,
+    both(
+      equal(handle.table, {
+        [handle.rpId]: input.rpId,
+        [handle.subjectId]: subject.nativeId,
+      }),
+      handle.ownedCondition,
+    ),
+    { limit: 1, columns: mappedColumns(handle) },
+  );
+
+  const handleRow = handles.rows[0];
+  let userHandle: PasskeyUserHandle | undefined;
+
+  if (handleRow !== undefined) {
+    invariant(
+      handle.isOwnedState(handleRow[handle.state]) && handleRow[handle.rpId] === input.rpId,
+    );
+    invariant(
+      mapping.read.subjectIds.equals(
+        handle.decodeSubjectId(copiedRow(handleRow)),
+        subject.nativeId,
+      ),
+    );
+    // oxlint-disable-next-line no-restricted-properties -- native SQL column values enter through this untyped driver boundary.
+    userHandle = Schema.decodeUnknownSync(PasskeyUserHandle)(handleRow[handle.userHandle]);
+    invariant(handleRow[handle.handleKey] === handleKey(input.rpId, userHandle));
+  }
+  const credential = mapping.read.credential;
+
+  const found = yield* owner.read(
+    credential.table,
+    both(
+      equal(credential.table, {
+        [credential.rpId]: input.rpId,
+        [credential.subjectId]: subject.nativeId,
+      }),
+      credential.activeCondition,
+    ),
+    {
+      limit: 64,
+      columns: [
+        credential.credentialId,
+        credential.rpId,
+        credential.protocolCredentialId,
+        credential.subjectId,
+        credential.credentialRevision,
+        credential.status,
+      ],
+      orderBy: asc(col(credential.table, credential.protocolCredentialId)),
+    },
+  );
+
+  const credentials = found.rows.map((row) => {
+    invariant(
+      credential.isActiveStatus(row[credential.status]) && row[credential.rpId] === input.rpId,
+    );
+
+    return snapshotPasskeySync(PasskeyDescriptor, {
+      type: "public-key",
+      id: row[credential.protocolCredentialId],
+    });
+  });
+
+  invariant(new Set(credentials.map((item) => item.id)).size === credentials.length);
+  const revision = yield* readRevision(mapping.read, subject);
+
+  invariant(revision !== undefined);
+
+  return { revision, ...(userHandle === undefined ? {} : { userHandle }), credentials };
+});