1import * as Effect from "effect/Effect";
2import * as SqlClient from "effect/sql/SqlClient";
3
4/**
5 * This is an intentional alpha cutover: role-bearing credentials and sessions
6 * cannot safely be assigned new capabilities implicitly.
7 */
8export default Effect.gen(function* () {
9 const sql = yield* SqlClient.SqlClient;
10
11 yield* sql`DROP TABLE IF EXISTS auth_pairing_links`;
12 yield* sql`DROP TABLE IF EXISTS auth_sessions`;
13
14 yield* sql`
15 CREATE TABLE auth_pairing_links (
16 id TEXT PRIMARY KEY,
17 credential TEXT NOT NULL UNIQUE,
18 method TEXT NOT NULL,
19 scopes TEXT NOT NULL,
20 subject TEXT NOT NULL,
21 label TEXT,
22 created_at TEXT NOT NULL,
23 expires_at TEXT NOT NULL,
24 consumed_at TEXT,
25 revoked_at TEXT
26 )
27 `;
28
29 yield* sql`
30 CREATE INDEX idx_auth_pairing_links_active
31 ON auth_pairing_links(revoked_at, consumed_at, expires_at)
32 `;
33
34 yield* sql`
35 CREATE TABLE auth_sessions (
36 session_id TEXT PRIMARY KEY,
37 subject TEXT NOT NULL,
38 scopes TEXT NOT NULL,
39 method TEXT NOT NULL,
40 client_label TEXT,
41 client_ip_address TEXT,
42 client_user_agent TEXT,
43 client_device_type TEXT NOT NULL DEFAULT 'unknown',
44 client_os TEXT,
45 client_browser TEXT,
46 issued_at TEXT NOT NULL,
47 expires_at TEXT NOT NULL,
48 last_connected_at TEXT,
49 revoked_at TEXT
50 )
51 `;
52
53 yield* sql`
54 CREATE INDEX idx_auth_sessions_active
55 ON auth_sessions(revoked_at, expires_at, issued_at)
56 `;
57});