{"version":3,"file":"oauth-connected-model.mjs","names":[],"sources":["../../../src/internal/models/oauth-connected-model.ts"],"sourcesContent":["import type * as M from \"@yielded/auth/OAuth\";\n\nimport type { TableModel as Table, SqlExpression } from \"../table-model\";\nimport type { SubjectIdCodec } from \"./common\";\nimport type {\n  OAuthAuthorityReadTable,\n  OAuthClock,\n  OAuthCredentialReadTable,\n  OAuthFlowTable,\n  OAuthOwnershipTable,\n  OAuthOwnershipReadTable,\n  OAuthSubjectReadTable,\n} from \"./oauth-model\";\n\ntype Column<T extends Table> = T[\"column\"];\nexport type OAuthConnectedAction = M.OAuthConnectedActionChallenge[\"action\"];\n\n/** Immutable sealed data plus the exact refresh compare-and-set fields. */\nexport interface OAuthConnectedGrantTable<G extends Table, N> {\n  readonly table: G[\"table\"];\n  readonly moduleId: Column<G>;\n  readonly grantId: Column<G>;\n  readonly subjectId: Column<G>;\n  readonly identityKey: Column<G>;\n  readonly profileKey: Column<G>;\n  readonly grantVersion: Column<G>;\n  readonly tokenVersion: Column<G>;\n  readonly state: Column<G>;\n  readonly snapshot: Column<G>;\n  /** Listing selects this bounded projection, never encrypted token material. */\n  readonly summary: Column<G>;\n  readonly refreshClaimId: Column<G>;\n  readonly refreshNextTokenVersion: Column<G>;\n  readonly refreshClaimedAt: Column<G>;\n  readonly refreshClaimExpiresAt: Column<G>;\n  readonly expiresAt: Column<G>;\n  readonly encodeInsert: (input: {\n    readonly grant: M.OAuthConnectedStoredGrant;\n    readonly subjectId: N;\n  }) => G[\"insert\"];\n}\n\n/** Optional provider revocation retains the exact removed grant ciphertext. A\n * possibly spent claim is never reset to Pending or reclaimed after timeout. */\nexport interface OAuthConnectedRevocationJobTable<J extends Table, N> {\n  readonly table: J[\"table\"];\n  readonly jobId: Column<J>;\n  readonly moduleId: Column<J>;\n  readonly subjectId: Column<J>;\n  readonly identityKey: Column<J>;\n  readonly snapshot: Column<J>;\n  readonly state: Column<J>;\n  readonly claimId: Column<J>;\n  readonly claimedAt: Column<J>;\n  readonly claimExpiresAt: Column<J>;\n  readonly retentionUntil: Column<J>;\n  readonly encodeInsert: (input: {\n    readonly job: M.OAuthConnectedRevocationJob;\n    readonly subjectId: N;\n  }) => J[\"insert\"];\n}\n\nexport type OAuthConnectedPolicyInput<N> = {\n  readonly subjectId: N;\n  readonly revision: M.OAuthAccountRevision;\n} & (\n  | {\n      readonly kind: \"action\";\n      readonly operation: \"settle\" | \"disconnect\";\n      readonly authorization: M.OAuthConnectedActionAuthorization;\n      readonly grant?: M.OAuthConnectedTokenContext;\n    }\n  | {\n      readonly kind: \"sign-in\";\n      readonly credential: M.OAuthCredentialSnapshot;\n      readonly grant: M.OAuthConnectedTokenContext;\n    }\n  | {\n      readonly kind: \"metadata\" | \"use\";\n      readonly authorization: M.OAuthConnectedUseAuthorization;\n      readonly grant?: M.OAuthConnectedTokenContext;\n    }\n);\n\n/** Changes to mutable policy advance the same subject security revision. This\n * predicate participates in the guarded write and final application postcondition. */\nexport interface OAuthConnectedSqlPolicy<N, Expression extends SqlExpression = SqlExpression> {\n  readonly condition: (input: OAuthConnectedPolicyInput<N>) => Expression;\n}\n\nexport const requiredOAuthConnectedConstraints = {\n  flow: \"unique(flow.moduleId,flow.flowId)\",\n  stateDigest: \"unique(flow.stateDigest)\",\n  ownership: \"unique(ownership.identityKey)\",\n  grant: \"unique(connectedGrant.moduleId,connectedGrant.grantId)\",\n  activeIdentity:\n    \"unique(connectedGrant.moduleId,connectedGrant.subjectId,connectedGrant.profileKey,connectedGrant.identityKey)\",\n  authorityCredential: \"unique(authority.subjectId,authority.credentialId)\",\n} as const;\n\nexport const requiredOAuthConnectedRevocationConstraints = {\n  job: \"unique(connectedRevocation.jobId)\",\n} as const;\n\nexport interface OAuthConnectedMapping<\n  S extends Table,\n  AC extends Table,\n  O extends Table,\n  F extends Table,\n  G extends Table,\n  N,\n  J extends Table = Table,\n  Expression extends SqlExpression = SqlExpression,\n  SignIn extends Table = Table,\n> {\n  readonly ownership: OAuthOwnershipTable<O, N>;\n  readonly subject: OAuthSubjectReadTable<S, Expression>;\n  readonly authority: OAuthAuthorityReadTable<AC, Expression>;\n  readonly subjectId: SubjectIdCodec<N>;\n  readonly flow: OAuthFlowTable<F>;\n  readonly grant: OAuthConnectedGrantTable<G, N>;\n  readonly credential?: OAuthCredentialReadTable<SignIn, Expression>;\n  readonly clock: OAuthClock<Expression>;\n  readonly policy: OAuthConnectedSqlPolicy<N, Expression>;\n  readonly constraints: typeof requiredOAuthConnectedConstraints;\n  readonly revocation:\n    | { readonly mode: \"unsupported\" }\n    | {\n        readonly mode: \"provider\";\n        readonly job: OAuthConnectedRevocationJobTable<J, N>;\n        readonly retentionMillis: number;\n        readonly constraints: typeof requiredOAuthConnectedRevocationConstraints;\n      };\n  /** Indexed same-owner predicate for installed references beyond these grants/jobs. */\n  readonly otherReferences: (input: {\n    readonly identityKey: string;\n    readonly subjectId: N;\n  }) => Expression;\n}\n\nexport interface OAuthConnectedRevocationMapping<\n  O extends Table,\n  G extends Table,\n  J extends Table,\n  N,\n  Expression extends SqlExpression = SqlExpression,\n> {\n  readonly ownership: OAuthOwnershipReadTable<O, N>;\n  readonly subjectId: SubjectIdCodec<N>;\n  readonly grant: Omit<OAuthConnectedGrantTable<G, N>, \"encodeInsert\">;\n  readonly job: Omit<OAuthConnectedRevocationJobTable<J, N>, \"encodeInsert\">;\n  readonly clock: OAuthClock<Expression>;\n  readonly otherReferences: (input: {\n    readonly identityKey: string;\n    readonly subjectId: N;\n  }) => Expression;\n  readonly constraints: typeof requiredOAuthConnectedRevocationConstraints;\n}\n"],"mappings":";AA0FA,MAAa,oCAAoC;CAC/C,MAAM;CACN,aAAa;CACb,WAAW;CACX,OAAO;CACP,gBACE;CACF,qBAAqB;AACvB;AAEA,MAAa,8CAA8C,EACzD,KAAK,oCACP"}