import * as Context from "effect/Context";import * as DateTime from "effect/DateTime";import * as Effect from "effect/Effect";import * as Layer from "effect/Layer";import * as Schema from "effect/Schema";import * as HttpApiError from "effect/unstable/httpapi/HttpApiError";import { lt } from "drizzle-orm"; import { verifyDpopProof } from "@t3tools/shared/dpop";import * as RelayDb from "../db.ts";import { relayDpopProofs } from "../persistence/schema.ts"; export class DpopProofReplayPersistenceError extends Schema.TaggedErrorClass<DpopProofReplayPersistenceError>()(  "DpopProofReplayPersistenceError",  {    operation: Schema.Literals(["consume", "prune-expired"]),    thumbprint: Schema.optionalKey(Schema.String),    jti: Schema.optionalKey(Schema.String),    iat: Schema.optionalKey(Schema.Number),    expiresBefore: Schema.optionalKey(Schema.String),    cause: Schema.Defect(),  },) {  override get message(): string {    return `Failed to persist DPoP proof replay state during '${this.operation}'`;  }} export class DpopProofReplay extends Context.Service<  DpopProofReplay,  {    readonly verifyAndConsume: (input: {      readonly proof: string | undefined;      readonly method: string;      readonly url: string;      readonly expectedThumbprint?: string;      readonly expectedAccessToken?: string;      readonly now: DateTime.DateTime;    }) => Effect.Effect<string, HttpApiError.Unauthorized | DpopProofReplayPersistenceError>;    readonly consume: (input: {      readonly thumbprint: string;      readonly jti: string;      readonly iat: number;      readonly expiresAt: DateTime.DateTime;    }) => Effect.Effect<boolean, DpopProofReplayPersistenceError>;    readonly pruneExpired: Effect.Effect<void, DpopProofReplayPersistenceError>;  }>()("t3code-relay/auth/DpopProofs/DpopProofReplay") {} const make = Effect.gen(function* () {  const db = yield* RelayDb.RelayDb;   const consume: DpopProofReplay["Service"]["consume"] = Effect.fn("relay.dpop_proofs.consume")(    function* (input) {      const createdAt = DateTime.formatIso(yield* DateTime.now);      const inserted = yield* db        .insert(relayDpopProofs)        .values({          thumbprint: input.thumbprint,          jti: input.jti,          iat: input.iat,          expiresAt: DateTime.formatIso(input.expiresAt),          createdAt,        })        .onConflictDoNothing()        .returning({ jti: relayDpopProofs.jti })        .pipe(          Effect.mapError(            (cause) =>              new DpopProofReplayPersistenceError({                operation: "consume",                thumbprint: input.thumbprint,                jti: input.jti,                iat: input.iat,                cause,              }),          ),        );      return inserted.length > 0;    },  );   const verifyAndConsume: DpopProofReplay["Service"]["verifyAndConsume"] = Effect.fn(    "relay.dpop_proofs.verify_and_consume",  )(function* (input) {    yield* Effect.annotateCurrentSpan({      "relay.dpop.method": input.method,      "relay.dpop.expected_thumbprint_present": input.expectedThumbprint !== undefined,      "relay.dpop.expected_access_token_present": input.expectedAccessToken !== undefined,    });    const result = verifyDpopProof({      proof: input.proof,      method: input.method,      url: input.url,      nowEpochSeconds: Math.floor(input.now.epochMilliseconds / 1_000),      ...(input.expectedThumbprint ? { expectedThumbprint: input.expectedThumbprint } : {}),      ...(input.expectedAccessToken ? { expectedAccessToken: input.expectedAccessToken } : {}),    });    if (!result.ok) {      yield* Effect.logWarning("relay dpop proof rejected", {        reason: result.reason,        method: input.method,        url: input.url,        expectedThumbprintPresent: input.expectedThumbprint !== undefined,        expectedAccessTokenPresent: input.expectedAccessToken !== undefined,      });      return yield* new HttpApiError.Unauthorized({});    }    const consumed = yield* consume({      thumbprint: result.thumbprint,      jti: result.jti,      iat: result.iat,      expiresAt: DateTime.add(input.now, { minutes: 5 }),    });    if (!consumed) {      yield* Effect.logWarning("relay dpop proof replay rejected", {        thumbprint: result.thumbprint,        jti: result.jti,        iat: result.iat,      });      return yield* new HttpApiError.Unauthorized({});    }    yield* Effect.annotateCurrentSpan({      "relay.dpop.thumbprint": result.thumbprint,      "relay.dpop.iat": result.iat,    });    return result.thumbprint;  });   const pruneExpired: DpopProofReplay["Service"]["pruneExpired"] = Effect.gen(function* () {    const now = DateTime.formatIso(yield* DateTime.now);    yield* Effect.annotateCurrentSpan({ "relay.dpop_prune.before": now });    yield* db      .delete(relayDpopProofs)      .where(lt(relayDpopProofs.expiresAt, now))      .pipe(        Effect.mapError(          (cause) =>            new DpopProofReplayPersistenceError({              operation: "prune-expired",              expiresBefore: now,              cause,            }),        ),      );  }).pipe(Effect.withSpan("relay.dpop_proofs.prune_expired"));   return DpopProofReplay.of({    verifyAndConsume,    consume,    pruneExpired,  });}); export const layer = Layer.effect(DpopProofReplay, make);