import * as Context from "effect/Context";import * as Effect from "effect/Effect";import * as Layer from "effect/Layer";import * as Option from "effect/Option";import * as Schema from "effect/Schema";import * as SqlClient from "effect/unstable/sql/SqlClient";import * as SqlSchema from "effect/unstable/sql/SqlSchema"; import { AuthClientMetadataDeviceType, AuthConnectClientStatus } from "@t3tools/contracts"; import {  type AuthConnectClientRepositoryError,  PersistenceDecodeError,  type PersistenceErrorCorrelation,  PersistenceSqlError,} from "./Errors.ts"; export const AuthConnectClientMetadataRecord = Schema.Struct({  label: Schema.NullOr(Schema.String),  ipAddress: Schema.NullOr(Schema.String),  userAgent: Schema.NullOr(Schema.String),  deviceType: AuthClientMetadataDeviceType,  os: Schema.NullOr(Schema.String),  browser: Schema.NullOr(Schema.String),});export type AuthConnectClientMetadataRecord = typeof AuthConnectClientMetadataRecord.Type; export const AuthConnectClientRecord = Schema.Struct({  clientProofKeyThumbprint: Schema.String,  cloudUserId: Schema.String,  deviceId: Schema.NullOr(Schema.String),  status: AuthConnectClientStatus,  client: AuthConnectClientMetadataRecord,  requestedAt: Schema.DateTimeUtcFromString,  updatedAt: Schema.DateTimeUtcFromString,  approvedAt: Schema.NullOr(Schema.DateTimeUtcFromString),  rejectedAt: Schema.NullOr(Schema.DateTimeUtcFromString),  revokedAt: Schema.NullOr(Schema.DateTimeUtcFromString),  lastSeenAt: Schema.NullOr(Schema.DateTimeUtcFromString),});export type AuthConnectClientRecord = typeof AuthConnectClientRecord.Type; export const UpsertAuthConnectClientRequestInput = Schema.Struct({  clientProofKeyThumbprint: Schema.String,  cloudUserId: Schema.String,  deviceId: Schema.NullOr(Schema.String),  client: AuthConnectClientMetadataRecord,  requestedAt: Schema.DateTimeUtcFromString,});export type UpsertAuthConnectClientRequestInput = typeof UpsertAuthConnectClientRequestInput.Type; export const UpdateAuthConnectClientStatusInput = Schema.Struct({  clientProofKeyThumbprint: Schema.String,  status: Schema.Literals(["approved", "rejected"]),  decidedAt: Schema.DateTimeUtcFromString,});export type UpdateAuthConnectClientStatusInput = typeof UpdateAuthConnectClientStatusInput.Type; export const RevokeAuthConnectClientInput = Schema.Struct({  clientProofKeyThumbprint: Schema.String,  revokedAt: Schema.DateTimeUtcFromString,});export type RevokeAuthConnectClientInput = typeof RevokeAuthConnectClientInput.Type; export const MarkAuthConnectClientSeenInput = Schema.Struct({  clientProofKeyThumbprint: Schema.String,  seenAt: Schema.DateTimeUtcFromString,});export type MarkAuthConnectClientSeenInput = typeof MarkAuthConnectClientSeenInput.Type; export class AuthConnectClientRepository extends Context.Service<  AuthConnectClientRepository,  {    readonly upsertRequest: (      input: UpsertAuthConnectClientRequestInput,    ) => Effect.Effect<AuthConnectClientRecord, AuthConnectClientRepositoryError>;    readonly updateStatus: (      input: UpdateAuthConnectClientStatusInput,    ) => Effect.Effect<Option.Option<AuthConnectClientRecord>, AuthConnectClientRepositoryError>;    readonly revoke: (      input: RevokeAuthConnectClientInput,    ) => Effect.Effect<boolean, AuthConnectClientRepositoryError>;    readonly markSeen: (      input: MarkAuthConnectClientSeenInput,    ) => Effect.Effect<Option.Option<AuthConnectClientRecord>, AuthConnectClientRepositoryError>;    readonly listActive: () => Effect.Effect<      ReadonlyArray<AuthConnectClientRecord>,      AuthConnectClientRepositoryError    >;  }>()("t3/persistence/AuthConnectClients/AuthConnectClientRepository") {} const AuthConnectClientDbRow = Schema.Struct({  clientProofKeyThumbprint: Schema.String,  cloudUserId: Schema.String,  deviceId: Schema.NullOr(Schema.String),  status: AuthConnectClientStatus,  clientLabel: Schema.NullOr(Schema.String),  clientIpAddress: Schema.NullOr(Schema.String),  clientUserAgent: Schema.NullOr(Schema.String),  clientDeviceType: Schema.Literals(["desktop", "mobile", "tablet", "bot", "unknown"]),  clientOs: Schema.NullOr(Schema.String),  clientBrowser: Schema.NullOr(Schema.String),  requestedAt: Schema.DateTimeUtcFromString,  updatedAt: Schema.DateTimeUtcFromString,  approvedAt: Schema.NullOr(Schema.DateTimeUtcFromString),  rejectedAt: Schema.NullOr(Schema.DateTimeUtcFromString),  revokedAt: Schema.NullOr(Schema.DateTimeUtcFromString),  lastSeenAt: Schema.NullOr(Schema.DateTimeUtcFromString),}); const AuthConnectClientRawDbRow = Schema.Struct({  clientProofKeyThumbprint: Schema.String,  cloudUserId: Schema.Unknown,  deviceId: Schema.Unknown,  status: Schema.Unknown,  clientLabel: Schema.Unknown,  clientIpAddress: Schema.Unknown,  clientUserAgent: Schema.Unknown,  clientDeviceType: Schema.Unknown,  clientOs: Schema.Unknown,  clientBrowser: Schema.Unknown,  requestedAt: Schema.Unknown,  updatedAt: Schema.Unknown,  approvedAt: Schema.Unknown,  rejectedAt: Schema.Unknown,  revokedAt: Schema.Unknown,  lastSeenAt: Schema.Unknown,}); const decodeAuthConnectClientDbRow = Schema.decodeUnknownEffect(AuthConnectClientDbRow); function toAuthConnectClientRecord(  row: typeof AuthConnectClientDbRow.Type,): AuthConnectClientRecord {  return {    clientProofKeyThumbprint: row.clientProofKeyThumbprint,    cloudUserId: row.cloudUserId,    deviceId: row.deviceId,    status: row.status,    client: {      label: row.clientLabel,      ipAddress: row.clientIpAddress,      userAgent: row.clientUserAgent,      deviceType: row.clientDeviceType,      os: row.clientOs,      browser: row.clientBrowser,    },    requestedAt: row.requestedAt,    updatedAt: row.updatedAt,    approvedAt: row.approvedAt,    rejectedAt: row.rejectedAt,    revokedAt: row.revokedAt,    lastSeenAt: row.lastSeenAt,  };} function toPersistenceSqlOrDecodeError(  sqlOperation: string,  decodeOperation: string,  correlation?: PersistenceErrorCorrelation,) {  return (cause: unknown): AuthConnectClientRepositoryError =>    Schema.isSchemaError(cause)      ? PersistenceDecodeError.fromSchemaError(decodeOperation, cause, correlation)      : new PersistenceSqlError({          operation: sqlOperation,          ...(correlation === undefined ? {} : { correlation }),          cause,        });} const rowSelection = `  client_proof_key_thumbprint AS "clientProofKeyThumbprint",  cloud_user_id AS "cloudUserId",  device_id AS "deviceId",  status AS "status",  client_label AS "clientLabel",  client_ip_address AS "clientIpAddress",  client_user_agent AS "clientUserAgent",  client_device_type AS "clientDeviceType",  client_os AS "clientOs",  client_browser AS "clientBrowser",  requested_at AS "requestedAt",  updated_at AS "updatedAt",  approved_at AS "approvedAt",  rejected_at AS "rejectedAt",  revoked_at AS "revokedAt",  last_seen_at AS "lastSeenAt"`; export const make = Effect.gen(function* () {  const sql = yield* SqlClient.SqlClient;   const upsertRequestRow = SqlSchema.findOne({    Request: UpsertAuthConnectClientRequestInput,    Result: AuthConnectClientRawDbRow,    execute: (input) =>      sql`        INSERT INTO auth_connect_clients (          client_proof_key_thumbprint,          cloud_user_id,          device_id,          status,          client_label,          client_ip_address,          client_user_agent,          client_device_type,          client_os,          client_browser,          requested_at,          updated_at,          approved_at,          rejected_at,          revoked_at,          last_seen_at        )        VALUES (          ${input.clientProofKeyThumbprint},          ${input.cloudUserId},          ${input.deviceId},          'pending',          ${input.client.label},          ${input.client.ipAddress},          ${input.client.userAgent},          ${input.client.deviceType},          ${input.client.os},          ${input.client.browser},          ${input.requestedAt},          ${input.requestedAt},          NULL,          NULL,          NULL,          NULL        )        ON CONFLICT(client_proof_key_thumbprint) DO UPDATE SET          cloud_user_id = excluded.cloud_user_id,          device_id = excluded.device_id,          status = CASE            WHEN auth_connect_clients.revoked_at IS NULL              AND auth_connect_clients.cloud_user_id = excluded.cloud_user_id              THEN auth_connect_clients.status            ELSE 'pending'          END,          client_label = excluded.client_label,          client_ip_address = excluded.client_ip_address,          client_user_agent = excluded.client_user_agent,          client_device_type = excluded.client_device_type,          client_os = excluded.client_os,          client_browser = excluded.client_browser,          requested_at = excluded.requested_at,          updated_at = excluded.updated_at,          approved_at = CASE            WHEN auth_connect_clients.revoked_at IS NULL              AND auth_connect_clients.cloud_user_id = excluded.cloud_user_id              THEN auth_connect_clients.approved_at            ELSE NULL          END,          rejected_at = CASE            WHEN auth_connect_clients.revoked_at IS NULL              AND auth_connect_clients.cloud_user_id = excluded.cloud_user_id              THEN auth_connect_clients.rejected_at            ELSE NULL          END,          last_seen_at = CASE            WHEN auth_connect_clients.revoked_at IS NULL              AND auth_connect_clients.cloud_user_id = excluded.cloud_user_id              THEN auth_connect_clients.last_seen_at            ELSE NULL          END,          revoked_at = NULL        RETURNING ${sql.unsafe(rowSelection)}      `,  });   const updateStatusRow = SqlSchema.findOneOption({    Request: UpdateAuthConnectClientStatusInput,    Result: AuthConnectClientRawDbRow,    execute: ({ clientProofKeyThumbprint, status, decidedAt }) =>      sql`        UPDATE auth_connect_clients        SET          status = ${status},          updated_at = ${decidedAt},          approved_at = CASE WHEN ${status} = 'approved' THEN ${decidedAt} ELSE NULL END,          rejected_at = CASE WHEN ${status} = 'rejected' THEN ${decidedAt} ELSE NULL END,          last_seen_at = CASE            WHEN ${status} = 'approved' AND status = 'approved' THEN last_seen_at            ELSE NULL          END,          revoked_at = NULL        WHERE client_proof_key_thumbprint = ${clientProofKeyThumbprint}          AND revoked_at IS NULL        RETURNING ${sql.unsafe(rowSelection)}      `,  });   const revokeRow = SqlSchema.findAll({    Request: RevokeAuthConnectClientInput,    Result: Schema.Struct({ clientProofKeyThumbprint: Schema.String }),    execute: ({ clientProofKeyThumbprint, revokedAt }) =>      sql`        UPDATE auth_connect_clients        SET          revoked_at = ${revokedAt},          updated_at = ${revokedAt}        WHERE client_proof_key_thumbprint = ${clientProofKeyThumbprint}          AND revoked_at IS NULL        RETURNING client_proof_key_thumbprint AS "clientProofKeyThumbprint"      `,  });   const markSeenRow = SqlSchema.findOneOption({    Request: MarkAuthConnectClientSeenInput,    Result: AuthConnectClientRawDbRow,    execute: ({ clientProofKeyThumbprint, seenAt }) =>      sql`        UPDATE auth_connect_clients        SET          last_seen_at = CASE WHEN status = 'approved' THEN ${seenAt} ELSE last_seen_at END,          updated_at = CASE WHEN status = 'approved' THEN ${seenAt} ELSE updated_at END        WHERE client_proof_key_thumbprint = ${clientProofKeyThumbprint}          AND revoked_at IS NULL        RETURNING ${sql.unsafe(rowSelection)}      `,  });   const listRows = SqlSchema.findAll({    Request: Schema.Void,    Result: AuthConnectClientRawDbRow,    execute: () =>      sql`        SELECT ${sql.unsafe(rowSelection)}        FROM auth_connect_clients        WHERE revoked_at IS NULL        ORDER BY          CASE status            WHEN 'pending' THEN 0            WHEN 'approved' THEN 1            ELSE 2          END,          updated_at DESC,          client_proof_key_thumbprint DESC      `,  });   const decodeRow = (    row: typeof AuthConnectClientRawDbRow.Type,    operation: string,  ): Effect.Effect<AuthConnectClientRecord, PersistenceDecodeError> =>    decodeAuthConnectClientDbRow(row).pipe(      Effect.mapError((cause) =>        PersistenceDecodeError.fromSchemaError(operation, cause, {          clientProofKeyThumbprint: row.clientProofKeyThumbprint,        }),      ),      Effect.map(toAuthConnectClientRecord),    );   const upsertRequest: AuthConnectClientRepository["Service"]["upsertRequest"] = (input) =>    upsertRequestRow(input).pipe(      Effect.mapError(        toPersistenceSqlOrDecodeError(          "AuthConnectClientRepository.upsertRequest:query",          "AuthConnectClientRepository.upsertRequest:decodeRow",          { clientProofKeyThumbprint: input.clientProofKeyThumbprint },        ),      ),      Effect.flatMap((row) =>        decodeRow(row, "AuthConnectClientRepository.upsertRequest:decodeRow"),      ),    );   const updateStatus: AuthConnectClientRepository["Service"]["updateStatus"] = (input) =>    updateStatusRow(input).pipe(      Effect.mapError(        toPersistenceSqlOrDecodeError(          "AuthConnectClientRepository.updateStatus:query",          "AuthConnectClientRepository.updateStatus:decodeRow",          { clientProofKeyThumbprint: input.clientProofKeyThumbprint },        ),      ),      Effect.flatMap((rowOption) =>        Option.match(rowOption, {          onNone: () => Effect.succeed(Option.none()),          onSome: (row) =>            decodeRow(row, "AuthConnectClientRepository.updateStatus:decodeRow").pipe(              Effect.map(Option.some),            ),        }),      ),    );   const revoke: AuthConnectClientRepository["Service"]["revoke"] = (input) =>    revokeRow(input).pipe(      Effect.mapError(        toPersistenceSqlOrDecodeError(          "AuthConnectClientRepository.revoke:query",          "AuthConnectClientRepository.revoke:decodeRows",          { clientProofKeyThumbprint: input.clientProofKeyThumbprint },        ),      ),      Effect.map((rows) => rows.length > 0),    );   const markSeen: AuthConnectClientRepository["Service"]["markSeen"] = (input) =>    markSeenRow(input).pipe(      Effect.mapError(        toPersistenceSqlOrDecodeError(          "AuthConnectClientRepository.markSeen:query",          "AuthConnectClientRepository.markSeen:decodeRow",          { clientProofKeyThumbprint: input.clientProofKeyThumbprint },        ),      ),      Effect.flatMap((rowOption) =>        Option.match(rowOption, {          onNone: () => Effect.succeed(Option.none()),          onSome: (row) =>            decodeRow(row, "AuthConnectClientRepository.markSeen:decodeRow").pipe(              Effect.map(Option.some),            ),        }),      ),    );   const listActive: AuthConnectClientRepository["Service"]["listActive"] = () =>    listRows().pipe(      Effect.mapError(        toPersistenceSqlOrDecodeError(          "AuthConnectClientRepository.listActive:query",          "AuthConnectClientRepository.listActive:decodeRows",        ),      ),      Effect.flatMap((rows) =>        Effect.forEach(rows, (row) =>          decodeRow(row, "AuthConnectClientRepository.listActive:decodeRows"),        ),      ),    );   return {    upsertRequest,    updateStatus,    revoke,    markSeen,    listActive,  } satisfies AuthConnectClientRepository["Service"];}); export const layer = Layer.effect(AuthConnectClientRepository, make);