Commit 57d25c934b74986423896a7dc433595ed09b9c8d | the-knife

apps/server/src/persistence/AuthPairingLinks.ts+78-6

...	@@ -11,6 +11,7 @@ import { AuthEnvironmentScopes } from "@t3tools/contracts";	...	@@ -11,6 +11,7 @@ import { AuthEnvironmentScopes } from "@t3tools/contracts";
11	import {	11	import {
12	type AuthPairingLinkRepositoryError,	12	type AuthPairingLinkRepositoryError,
13	PersistenceDecodeError,	13	PersistenceDecodeError,
		14	type PersistenceErrorCorrelation,
14	PersistenceSqlError,	15	PersistenceSqlError,
15	} from "./Errors.ts";	16	} from "./Errors.ts";
16		17
...	@@ -66,6 +67,22 @@ export const GetAuthPairingLinkByCredentialInput = Schema.Struct({	...	@@ -66,6 +67,22 @@ export const GetAuthPairingLinkByCredentialInput = Schema.Struct({
66	});	67	});
67	export type GetAuthPairingLinkByCredentialInput = typeof GetAuthPairingLinkByCredentialInput.Type;	68	export type GetAuthPairingLinkByCredentialInput = typeof GetAuthPairingLinkByCredentialInput.Type;
68		69
		70	const AuthPairingLinkRawDbRow = Schema.Struct({
		71	id: Schema.String,
		72	credential: Schema.Unknown,
		73	method: Schema.Unknown,
		74	scopes: Schema.Unknown,
		75	subject: Schema.Unknown,
		76	label: Schema.Unknown,
		77	proofKeyThumbprint: Schema.Unknown,
		78	createdAt: Schema.Unknown,
		79	expiresAt: Schema.Unknown,
		80	consumedAt: Schema.Unknown,
		81	revokedAt: Schema.Unknown,
		82	});
		83
		84	const decodeAuthPairingLinkDbRow = Schema.decodeUnknownEffect(AuthPairingLinkRecord);
		85
69	export class AuthPairingLinkRepository extends Context.Service<	86	export class AuthPairingLinkRepository extends Context.Service<
70	AuthPairingLinkRepository,	87	AuthPairingLinkRepository,
71	{	88	{
...	@@ -87,11 +104,19 @@ export class AuthPairingLinkRepository extends Context.Service<	...	@@ -87,11 +104,19 @@ export class AuthPairingLinkRepository extends Context.Service<
87	}	104	}
88	>()("t3/persistence/AuthPairingLinks/AuthPairingLinkRepository") {}	105	>()("t3/persistence/AuthPairingLinks/AuthPairingLinkRepository") {}
89		106
90	function toPersistenceSqlOrDecodeError(sqlOperation: string, decodeOperation: string) {	107	function toPersistenceSqlOrDecodeError(
		108	sqlOperation: string,
		109	decodeOperation: string,
		110	correlation?: PersistenceErrorCorrelation,
		111	) {
91	return (cause: unknown): AuthPairingLinkRepositoryError =>	112	return (cause: unknown): AuthPairingLinkRepositoryError =>
92	Schema.isSchemaError(cause)	113	Schema.isSchemaError(cause)
93	? PersistenceDecodeError.fromSchemaError(decodeOperation, cause)	114	? PersistenceDecodeError.fromSchemaError(decodeOperation, cause, correlation)
94	: new PersistenceSqlError({ operation: sqlOperation, cause });	115	: new PersistenceSqlError({
		116	operation: sqlOperation,
		117	...(correlation === undefined ? {} : { correlation }),
		118	cause,
		119	});
95	}	120	}
96		121
97	export const make = Effect.gen(function* () {	122	export const make = Effect.gen(function* () {
...	@@ -132,7 +157,7 @@ export const make = Effect.gen(function* () {	...	@@ -132,7 +157,7 @@ export const make = Effect.gen(function* () {
132		157
133	const consumeAvailablePairingLinkRow = SqlSchema.findOneOption({	158	const consumeAvailablePairingLinkRow = SqlSchema.findOneOption({
134	Request: ConsumeAuthPairingLinkInput,	159	Request: ConsumeAuthPairingLinkInput,
135	Result: AuthPairingLinkRecord,	160	Result: AuthPairingLinkRawDbRow,
136	execute: ({ credential, proofKeyThumbprint, consumedAt, now }) =>	161	execute: ({ credential, proofKeyThumbprint, consumedAt, now }) =>
137	sql`	162	sql`
138	UPDATE auth_pairing_links	163	UPDATE auth_pairing_links
...	@@ -162,7 +187,7 @@ export const make = Effect.gen(function* () {	...	@@ -162,7 +187,7 @@ export const make = Effect.gen(function* () {
162		187
163	const listActivePairingLinkRows = SqlSchema.findAll({	188	const listActivePairingLinkRows = SqlSchema.findAll({
164	Request: ListActiveAuthPairingLinksInput,	189	Request: ListActiveAuthPairingLinksInput,
165	Result: AuthPairingLinkRecord,	190	Result: AuthPairingLinkRawDbRow,
166	execute: ({ now }) =>	191	execute: ({ now }) =>
167	sql`	192	sql`
168	SELECT	193	SELECT
...	@@ -201,7 +226,7 @@ export const make = Effect.gen(function* () {	...	@@ -201,7 +226,7 @@ export const make = Effect.gen(function* () {
201		226
202	const getPairingLinkRowByCredential = SqlSchema.findOneOption({	227	const getPairingLinkRowByCredential = SqlSchema.findOneOption({
203	Request: GetAuthPairingLinkByCredentialInput,	228	Request: GetAuthPairingLinkByCredentialInput,
204	Result: AuthPairingLinkRecord,	229	Result: AuthPairingLinkRawDbRow,
205	execute: ({ credential }) =>	230	execute: ({ credential }) =>
206	sql`	231	sql`
207	SELECT	232	SELECT
...	@@ -227,6 +252,7 @@ export const make = Effect.gen(function* () {	...	@@ -227,6 +252,7 @@ export const make = Effect.gen(function* () {
227	toPersistenceSqlOrDecodeError(	252	toPersistenceSqlOrDecodeError(
228	"AuthPairingLinkRepository.create:query",	253	"AuthPairingLinkRepository.create:query",
229	"AuthPairingLinkRepository.create:encodeRequest",	254	"AuthPairingLinkRepository.create:encodeRequest",
		255	{ pairingLinkId: input.id },
230	),	256	),
231	),	257	),
232	);	258	);
...	@@ -239,6 +265,22 @@ export const make = Effect.gen(function* () {	...	@@ -239,6 +265,22 @@ export const make = Effect.gen(function* () {
239	"AuthPairingLinkRepository.consumeAvailable:decodeRow",	265	"AuthPairingLinkRepository.consumeAvailable:decodeRow",
240	),	266	),
241	),	267	),
		268	Effect.flatMap((rowOption) =>
		269	Option.match(rowOption, {
		270	onNone: () => Effect.succeed(Option.none()),
		271	onSome: (row) =>
		272	decodeAuthPairingLinkDbRow(row).pipe(
		273	Effect.mapError((cause) =>
		274	PersistenceDecodeError.fromSchemaError(
		275	"AuthPairingLinkRepository.consumeAvailable:decodeRow",
		276	cause,
		277	{ pairingLinkId: row.id },
		278	),
		279	),
		280	Effect.map(Option.some),
		281	),
		282	}),
		283	),
242	);	284	);
243		285
244	const listActive: AuthPairingLinkRepository["Service"]["listActive"] = (input) =>	286	const listActive: AuthPairingLinkRepository["Service"]["listActive"] = (input) =>
...	@@ -249,6 +291,19 @@ export const make = Effect.gen(function* () {	...	@@ -249,6 +291,19 @@ export const make = Effect.gen(function* () {
249	"AuthPairingLinkRepository.listActive:decodeRows",	291	"AuthPairingLinkRepository.listActive:decodeRows",
250	),	292	),
251	),	293	),
		294	Effect.flatMap((rows) =>
		295	Effect.forEach(rows, (row) =>
		296	decodeAuthPairingLinkDbRow(row).pipe(
		297	Effect.mapError((cause) =>
		298	PersistenceDecodeError.fromSchemaError(
		299	"AuthPairingLinkRepository.listActive:decodeRows",
		300	cause,
		301	{ pairingLinkId: row.id },
		302	),
		303	),
		304	),
		305	),
		306	),
252	);	307	);
253		308
254	const revoke: AuthPairingLinkRepository["Service"]["revoke"] = (input) =>	309	const revoke: AuthPairingLinkRepository["Service"]["revoke"] = (input) =>
...	@@ -257,6 +312,7 @@ export const make = Effect.gen(function* () {	...	@@ -257,6 +312,7 @@ export const make = Effect.gen(function* () {
257	toPersistenceSqlOrDecodeError(	312	toPersistenceSqlOrDecodeError(
258	"AuthPairingLinkRepository.revoke:query",	313	"AuthPairingLinkRepository.revoke:query",
259	"AuthPairingLinkRepository.revoke:decodeRows",	314	"AuthPairingLinkRepository.revoke:decodeRows",
		315	{ pairingLinkId: input.id },
260	),	316	),
261	),	317	),
262	Effect.map((rows) => rows.length > 0),	318	Effect.map((rows) => rows.length > 0),
...	@@ -270,6 +326,22 @@ export const make = Effect.gen(function* () {	...	@@ -270,6 +326,22 @@ export const make = Effect.gen(function* () {
270	"AuthPairingLinkRepository.getByCredential:decodeRow",	326	"AuthPairingLinkRepository.getByCredential:decodeRow",
271	),	327	),
272	),	328	),
		329	Effect.flatMap((rowOption) =>
		330	Option.match(rowOption, {
		331	onNone: () => Effect.succeed(Option.none()),
		332	onSome: (row) =>
		333	decodeAuthPairingLinkDbRow(row).pipe(
		334	Effect.mapError((cause) =>
		335	PersistenceDecodeError.fromSchemaError(
		336	"AuthPairingLinkRepository.getByCredential:decodeRow",
		337	cause,
		338	{ pairingLinkId: row.id },
		339	),
		340	),
		341	Effect.map(Option.some),
		342	),
		343	}),
		344	),
273	);	345	);
274		346
275	return {	347	return {

apps/server/src/persistence/AuthSessions.ts+63-7

 @@ -16,6 +16,7 @@ import {
 import {
   type AuthSessionRepositoryError,
   PersistenceDecodeError,
+  type PersistenceErrorCorrelation,
   PersistenceSqlError,
 } from "./Errors.ts";
 @@ -122,6 +123,25 @@ const AuthSessionDbRow = Schema.Struct({
   revokedAt: Schema.NullOr(Schema.DateTimeUtcFromString),
 });
+const AuthSessionRawDbRow = Schema.Struct({
+  sessionId: Schema.String,
+  subject: Schema.Unknown,
+  scopes: Schema.Unknown,
+  method: Schema.Unknown,
+  clientLabel: Schema.Unknown,
+  clientIpAddress: Schema.Unknown,
+  clientUserAgent: Schema.Unknown,
+  clientDeviceType: Schema.Unknown,
+  clientOs: Schema.Unknown,
+  clientBrowser: Schema.Unknown,
+  issuedAt: Schema.Unknown,
+  expiresAt: Schema.Unknown,
+  lastConnectedAt: Schema.Unknown,
+  revokedAt: Schema.Unknown,
+});
+const decodeAuthSessionDbRow = Schema.decodeUnknownEffect(AuthSessionDbRow);
 function toAuthSessionRecord(row: typeof AuthSessionDbRow.Type): AuthSessionRecord {
   return {
     sessionId: row.sessionId,
 @@ -143,11 +163,19 @@ function toAuthSessionRecord(row: typeof AuthSessionDbRow.Type): AuthSessionReco
   };
 }
-function toPersistenceSqlOrDecodeError(sqlOperation: string, decodeOperation: string) {
+function toPersistenceSqlOrDecodeError(
+  sqlOperation: string,
+  decodeOperation: string,
+  correlation?: PersistenceErrorCorrelation,
+) {
   return (cause: unknown): AuthSessionRepositoryError =>
     Schema.isSchemaError(cause)
-      ? PersistenceDecodeError.fromSchemaError(decodeOperation, cause)
+      ? PersistenceDecodeError.fromSchemaError(decodeOperation, cause, correlation)
-      : new PersistenceSqlError({ operation: sqlOperation, cause });
+      : new PersistenceSqlError({
+          operation: sqlOperation,
+          ...(correlation === undefined ? {} : { correlation }),
+          cause,
+        });
 }
 export const make = Effect.gen(function* () {
 @@ -192,7 +220,7 @@ export const make = Effect.gen(function* () {
   const getSessionRowById = SqlSchema.findOneOption({
     Request: GetAuthSessionByIdInput,
-    Result: AuthSessionDbRow,
+    Result: AuthSessionRawDbRow,
     execute: ({ sessionId }) =>
       sql`
         SELECT
 @@ -217,7 +245,7 @@ export const make = Effect.gen(function* () {
   const listActiveSessionRows = SqlSchema.findAll({
     Request: ListActiveAuthSessionsInput,
-    Result: AuthSessionDbRow,
+    Result: AuthSessionRawDbRow,
     execute: ({ now }) =>
       sql`
         SELECT
 @@ -285,6 +313,7 @@ export const make = Effect.gen(function* () {
         toPersistenceSqlOrDecodeError(
           "AuthSessionRepository.create:query",
           "AuthSessionRepository.create:encodeRequest",
+          { sessionId: input.sessionId },
         ),
       ),
     );
 @@ -295,12 +324,23 @@ export const make = Effect.gen(function* () {
         toPersistenceSqlOrDecodeError(
           "AuthSessionRepository.getById:query",
           "AuthSessionRepository.getById:decodeRow",
+          { sessionId: input.sessionId },
         ),
       ),
       Effect.flatMap((rowOption) =>
         Option.match(rowOption, {
           onNone: () => Effect.succeed(Option.none()),
-          onSome: (row) => Effect.succeed(Option.some(toAuthSessionRecord(row))),
+          onSome: (row) =>
+            decodeAuthSessionDbRow(row).pipe(
+              Effect.mapError((cause) =>
+                PersistenceDecodeError.fromSchemaError(
+                  "AuthSessionRepository.getById:decodeRow",
+                  cause,
+                  { sessionId: input.sessionId },
+                ),
+              ),
+              Effect.map((decodedRow) => Option.some(toAuthSessionRecord(decodedRow))),
+            ),
         }),
       ),
     );
 @@ -313,7 +353,20 @@ export const make = Effect.gen(function* () {
           "AuthSessionRepository.listActive:decodeRows",
         ),
       ),
-      Effect.flatMap((rows) => Effect.succeed(rows.map((row) => toAuthSessionRecord(row)))),
+      Effect.flatMap((rows) =>
+        Effect.forEach(rows, (row) =>
+          decodeAuthSessionDbRow(row).pipe(
+            Effect.mapError((cause) =>
+              PersistenceDecodeError.fromSchemaError(
+                "AuthSessionRepository.listActive:decodeRows",
+                cause,
+                { sessionId: row.sessionId },
+              ),
+            ),
+            Effect.map(toAuthSessionRecord),
+          ),
+        ),
+      ),
     );
   const revoke: AuthSessionRepository["Service"]["revoke"] = (input) =>
 @@ -322,6 +375,7 @@ export const make = Effect.gen(function* () {
         toPersistenceSqlOrDecodeError(
           "AuthSessionRepository.revoke:query",
           "AuthSessionRepository.revoke:decodeRows",
+          { sessionId: input.sessionId },
         ),
       ),
       Effect.map((rows) => rows.length > 0),
 @@ -333,6 +387,7 @@ export const make = Effect.gen(function* () {
         toPersistenceSqlOrDecodeError(
           "AuthSessionRepository.revokeAllExcept:query",
           "AuthSessionRepository.revokeAllExcept:decodeRows",
+          { currentSessionId: input.currentSessionId },
         ),
       ),
       Effect.map((rows) => rows.map((row) => row.sessionId)),
 @@ -344,6 +399,7 @@ export const make = Effect.gen(function* () {
         toPersistenceSqlOrDecodeError(
           "AuthSessionRepository.setLastConnectedAt:query",
           "AuthSessionRepository.setLastConnectedAt:encodeRequest",
+          { sessionId: input.sessionId },
         ),
       ),
     );

apps/server/src/persistence/Errors.ts+16-1

 @@ -19,11 +19,20 @@ function summarizeSchemaIssue(issue: SchemaIssue.Issue): string {
 // Core Persistence Errors
 // ===============================
+export const PersistenceErrorCorrelation = Schema.Union([
+  Schema.Struct({ sessionId: Schema.String }),
+  Schema.Struct({ currentSessionId: Schema.String }),
+  Schema.Struct({ pairingLinkId: Schema.String }),
+  Schema.Struct({ threadId: Schema.String }),
+]);
+export type PersistenceErrorCorrelation = typeof PersistenceErrorCorrelation.Type;
 export class PersistenceSqlError extends Schema.TaggedErrorClass<PersistenceSqlError>()(
   "PersistenceSqlError",
   {
     operation: Schema.String,
     detail: Schema.optional(Schema.String),
+    correlation: Schema.optional(PersistenceErrorCorrelation),
     cause: Schema.optional(Schema.Defect()),
   },
 ) {
 @@ -39,13 +48,19 @@ export class PersistenceDecodeError extends Schema.TaggedErrorClass<PersistenceD
   {
     operation: Schema.String,
     issue: Schema.String,
+    correlation: Schema.optional(PersistenceErrorCorrelation),
     cause: Schema.optional(Schema.Defect()),
   },
 ) {
-  static fromSchemaError(operation: string, cause: Schema.SchemaError): PersistenceDecodeError {
+  static fromSchemaError(
+    operation: string,
+    cause: Schema.SchemaError,
+    correlation?: PersistenceErrorCorrelation,
+  ): PersistenceDecodeError {
     return new PersistenceDecodeError({
       operation,
       issue: summarizeSchemaIssue(cause.issue),
+      ...(correlation === undefined ? {} : { correlation }),
       cause,
     });
   }

apps/server/src/persistence/ProviderSessionRuntime.ts+41-18

 @@ -17,6 +17,7 @@ import {
 import {
   PersistenceDecodeError,
+  type PersistenceErrorCorrelation,
   PersistenceSqlError,
   type ProviderSessionRuntimeRepositoryError,
 } from "./Errors.ts";
 @@ -106,7 +107,19 @@ const ProviderSessionRuntimeDbRowSchema = ProviderSessionRuntime.mapFields(
   }),
 );
-const decodeRuntime = Schema.decodeUnknownEffect(ProviderSessionRuntime);
+const ProviderSessionRuntimeRawDbRowSchema = Schema.Struct({
+  threadId: Schema.String,
+  providerName: Schema.Unknown,
+  providerInstanceId: Schema.Unknown,
+  adapterKey: Schema.Unknown,
+  runtimeMode: Schema.Unknown,
+  status: Schema.Unknown,
+  lastSeenAt: Schema.Unknown,
+  resumeCursor: Schema.Unknown,
+  runtimePayload: Schema.Unknown,
+});
+const decodeRuntimeRow = Schema.decodeUnknownEffect(ProviderSessionRuntimeDbRowSchema);
 const GetRuntimeRequestSchema = Schema.Struct({
   threadId: ThreadId,
 @@ -114,11 +127,19 @@ const GetRuntimeRequestSchema = Schema.Struct({
 const DeleteRuntimeRequestSchema = GetRuntimeRequestSchema;
-function toPersistenceSqlOrDecodeError(sqlOperation: string, decodeOperation: string) {
+function toPersistenceSqlOrDecodeError(
+  sqlOperation: string,
+  decodeOperation: string,
+  correlation?: PersistenceErrorCorrelation,
+) {
   return (cause: unknown): ProviderSessionRuntimeRepositoryError =>
     Schema.isSchemaError(cause)
-      ? PersistenceDecodeError.fromSchemaError(decodeOperation, cause)
+      ? PersistenceDecodeError.fromSchemaError(decodeOperation, cause, correlation)
-      : new PersistenceSqlError({ operation: sqlOperation, cause });
+      : new PersistenceSqlError({
+          operation: sqlOperation,
+          ...(correlation === undefined ? {} : { correlation }),
+          cause,
+        });
 }
 export const make = Effect.gen(function* () {
 @@ -165,7 +186,7 @@ export const make = Effect.gen(function* () {
   const getRuntimeRowByThreadId = SqlSchema.findOneOption({
     Request: GetRuntimeRequestSchema,
-    Result: ProviderSessionRuntimeDbRowSchema,
+    Result: ProviderSessionRuntimeRawDbRowSchema,
     execute: ({ threadId }) =>
       sql`
         SELECT
 @@ -185,7 +206,7 @@ export const make = Effect.gen(function* () {
   const listRuntimeRows = SqlSchema.findAll({
     Request: Schema.Void,
-    Result: ProviderSessionRuntimeDbRowSchema,
+    Result: ProviderSessionRuntimeRawDbRowSchema,
     execute: () =>
       sql`
         SELECT
 @@ -218,6 +239,7 @@ export const make = Effect.gen(function* () {
         toPersistenceSqlOrDecodeError(
           "ProviderSessionRuntimeRepository.upsert:query",
           "ProviderSessionRuntimeRepository.upsert:encodeRequest",
+          { threadId: runtime.threadId },
         ),
       ),
     );
 @@ -228,17 +250,19 @@ export const make = Effect.gen(function* () {
         toPersistenceSqlOrDecodeError(
           "ProviderSessionRuntimeRepository.getByThreadId:query",
           "ProviderSessionRuntimeRepository.getByThreadId:decodeRow",
+          { threadId: input.threadId },
         ),
       ),
       Effect.flatMap((runtimeRowOption) =>
         Option.match(runtimeRowOption, {
           onNone: () => Effect.succeed(Option.none()),
           onSome: (row) =>
-            decodeRuntime(row).pipe(
+            decodeRuntimeRow(row).pipe(
               Effect.mapError((cause) =>
                 PersistenceDecodeError.fromSchemaError(
-                  "ProviderSessionRuntimeRepository.getByThreadId:rowToRuntime",
+                  "ProviderSessionRuntimeRepository.getByThreadId:decodeRow",
                   cause,
+                  { threadId: input.threadId },
                 ),
               ),
               Effect.map((runtime) => Option.some(runtime)),
 @@ -256,18 +280,16 @@ export const make = Effect.gen(function* () {
         ),
       ),
       Effect.flatMap((rows) =>
-        Effect.forEach(
+        Effect.forEach(rows, (row) =>
-          rows,
+          decodeRuntimeRow(row).pipe(
-          (row) =>
+            Effect.mapError((cause) =>
-            decodeRuntime(row).pipe(
+              PersistenceDecodeError.fromSchemaError(
-              Effect.mapError((cause) =>
+                "ProviderSessionRuntimeRepository.list:decodeRows",
-                PersistenceDecodeError.fromSchemaError(
+                cause,
-                  "ProviderSessionRuntimeRepository.list:rowToRuntime",
+                { threadId: row.threadId },
-                  cause,
-                ),
               ),
             ),
-          { concurrency: "unbounded" },
+          ),
         ),
       ),
     );
 @@ -280,6 +302,7 @@ export const make = Effect.gen(function* () {
         (cause) =>
           new PersistenceSqlError({
             operation: "ProviderSessionRuntimeRepository.deleteByThreadId:query",
+            correlation: { threadId: input.threadId },
             cause,
           }),
       ),

apps/server/src/persistence/RepositoryErrorCorrelation.test.ts created+253

...	@@ -0,0 +1,253 @@
1	import { AuthSessionId, ThreadId, type AuthEnvironmentScope } from "@t3tools/contracts";
2	import { assert, describe, it } from "@effect/vitest";
3	import * as DateTime from "effect/DateTime";
4	import * as Effect from "effect/Effect";
5	import * as Layer from "effect/Layer";
6	import * as SqlClient from "effect/unstable/sql/SqlClient";
7
8	import * as AuthPairingLinks from "./AuthPairingLinks.ts";
9	import * as AuthSessions from "./AuthSessions.ts";
10	import * as PersistenceErrors from "./Errors.ts";
11	import { SqlitePersistenceMemory } from "./Layers/Sqlite.ts";
12	import * as ProviderSessionRuntime from "./ProviderSessionRuntime.ts";
13
14	const issuedAt = DateTime.makeUnsafe("2026-06-20T00:00:00.000Z");
15	const expiresAt = DateTime.makeUnsafe("2027-06-20T00:00:00.000Z");
16	const now = DateTime.makeUnsafe("2026-06-21T00:00:00.000Z");
17	const scopes: ReadonlyArray<AuthEnvironmentScope> = ["access:read"];
18
19	const authSessionLayer = AuthSessions.layer.pipe(Layer.provideMerge(SqlitePersistenceMemory));
20	const authPairingLinkLayer = AuthPairingLinks.layer.pipe(
21	Layer.provideMerge(SqlitePersistenceMemory),
22	);
23	const providerSessionRuntimeLayer = ProviderSessionRuntime.layer.pipe(
24	Layer.provideMerge(SqlitePersistenceMemory),
25	);
26
27	describe("persistence error correlation", () => {
28	it.effect("correlates auth session SQL and row-decode failures without sensitive fields", () =>
29	Effect.gen(function* () {
30	const sessions = yield* AuthSessions.AuthSessionRepository;
31	const sql = yield* SqlClient.SqlClient;
32	const sessionId = AuthSessionId.make("session-correlation");
33	const currentSessionId = AuthSessionId.make("current-session-correlation");
34	const subject = "session-subject-secret-sentinel";
35
36	yield* sessions.create({
37	sessionId,
38	subject,
39	scopes,
40	method: "browser-session-cookie",
41	client: {
42	label: null,
43	ipAddress: null,
44	userAgent: null,
45	deviceType: "desktop",
46	os: null,
47	browser: null,
48	},
49	issuedAt,
50	expiresAt,
51	});
52	yield* sql`
53	UPDATE auth_sessions
54	SET scopes = ${"session-scopes-secret-sentinel"}
55	WHERE session_id = ${sessionId}
56	`;
57
58	const decodeError = yield* Effect.flip(sessions.listActive({ now }));
59	assert.instanceOf(decodeError, PersistenceErrors.PersistenceDecodeError);
60	assert.deepStrictEqual(decodeError.correlation, { sessionId });
61	assert.equal(
62	decodeError.message,
63	`Decode error in AuthSessionRepository.listActive:decodeRows: ${decodeError.issue}`,
64	);
65	assert.notInclude(decodeError.issue, subject);
66	assert.notInclude(decodeError.issue, "session-scopes-secret-sentinel");
67	assert.notInclude(decodeError.message, subject);
68
69	yield* sql`DROP TABLE auth_sessions`;
70	const createError = yield* Effect.flip(
71	sessions.create({
72	sessionId,
73	subject,
74	scopes,
75	method: "browser-session-cookie",
76	client: {
77	label: null,
78	ipAddress: null,
79	userAgent: null,
80	deviceType: "desktop",
81	os: null,
82	browser: null,
83	},
84	issuedAt,
85	expiresAt,
86	}),
87	);
88	assert.instanceOf(createError, PersistenceErrors.PersistenceSqlError);
89	assert.deepStrictEqual(createError.correlation, { sessionId });
90	assert.equal(createError.message, "SQL error in AuthSessionRepository.create:query");
91	assert.notInclude(createError.message, subject);
92	assert.notInclude(createError.message, DateTime.formatIso(issuedAt));
93
94	const revokeOtherError = yield* Effect.flip(
95	sessions.revokeAllExcept({ currentSessionId, revokedAt: now }),
96	);
97	assert.instanceOf(revokeOtherError, PersistenceErrors.PersistenceSqlError);
98	assert.deepStrictEqual(revokeOtherError.correlation, { currentSessionId });
99	assert.equal(
100	revokeOtherError.message,
101	"SQL error in AuthSessionRepository.revokeAllExcept:query",
102	);
103	assert.notInclude(revokeOtherError.message, DateTime.formatIso(now));
104	}).pipe(Effect.provide(authSessionLayer)),
105	);
106
107	it.effect("correlates pairing-link create and revoke failures by id only", () =>
108	Effect.gen(function* () {
109	const pairingLinks = yield* AuthPairingLinks.AuthPairingLinkRepository;
110	const sql = yield* SqlClient.SqlClient;
111	const id = "pairing-link-correlation";
112	const credential = "pairing-credential-secret-sentinel";
113	const subject = "pairing-subject-secret-sentinel";
114	const scopesPayload = "pairing-scopes-secret-sentinel";
115
116	yield* sql`
117	INSERT INTO auth_pairing_links (
118	id,
119	credential,
120	method,
121	scopes,
122	subject,
123	label,
124	proof_key_thumbprint,
125	created_at,
126	expires_at,
127	consumed_at,
128	revoked_at
129	)
130	VALUES (
131	${id},
132	${credential},
133	${"one-time-token"},
134	${scopesPayload},
135	${subject},
136	NULL,
137	NULL,
138	${DateTime.formatIso(issuedAt)},
139	${DateTime.formatIso(expiresAt)},
140	NULL,
141	NULL
142	)
143	`;
144
145	const decodeError = yield* Effect.flip(pairingLinks.getByCredential({ credential }));
146	assert.instanceOf(decodeError, PersistenceErrors.PersistenceDecodeError);
147	assert.deepStrictEqual(decodeError.correlation, { pairingLinkId: id });
148	assert.equal(
149	decodeError.message,
150	`Decode error in AuthPairingLinkRepository.getByCredential:decodeRow: ${decodeError.issue}`,
151	);
152	assert.notInclude(decodeError.issue, credential);
153	assert.notInclude(decodeError.issue, subject);
154	assert.notInclude(decodeError.issue, scopesPayload);
155	assert.notInclude(decodeError.message, DateTime.formatIso(issuedAt));
156
157	yield* sql`DROP TABLE auth_pairing_links`;
158	const createError = yield* Effect.flip(
159	pairingLinks.create({
160	id,
161	credential,
162	method: "one-time-token",
163	scopes,
164	subject,
165	label: null,
166	proofKeyThumbprint: null,
167	createdAt: issuedAt,
168	expiresAt,
169	}),
170	);
171	assert.instanceOf(createError, PersistenceErrors.PersistenceSqlError);
172	assert.deepStrictEqual(createError.correlation, { pairingLinkId: id });
173	assert.notInclude(createError.message, credential);
174	assert.notInclude(createError.message, subject);
175	assert.notInclude(createError.message, DateTime.formatIso(issuedAt));
176
177	const revokeError = yield* Effect.flip(pairingLinks.revoke({ id, revokedAt: now }));
178	assert.instanceOf(revokeError, PersistenceErrors.PersistenceSqlError);
179	assert.deepStrictEqual(revokeError.correlation, { pairingLinkId: id });
180	assert.notInclude(revokeError.message, credential);
181	assert.notInclude(revokeError.message, DateTime.formatIso(now));
182	}).pipe(Effect.provide(authPairingLinkLayer)),
183	);
184
185	it.effect("correlates provider runtime SQL and per-row decode failures by thread", () =>
186	Effect.gen(function* () {
187	const runtimes = yield* ProviderSessionRuntime.ProviderSessionRuntimeRepository;
188	const sql = yield* SqlClient.SqlClient;
189	const threadId = ThreadId.make("thread-correlation");
190	const runtimePayload = "runtime-payload-secret-sentinel";
191	const lastSeenAt = "2026-06-20T00:00:00.000Z";
192
193	yield* sql`
194	INSERT INTO provider_session_runtime (
195	thread_id,
196	provider_name,
197	provider_instance_id,
198	adapter_key,
199	runtime_mode,
200	status,
201	last_seen_at,
202	resume_cursor_json,
203	runtime_payload_json
204	)
205	VALUES (
206	${threadId},
207	${"codex"},
208	NULL,
209	${"codex"},
210	${"invalid-runtime-mode"},
211	${"running"},
212	${lastSeenAt},
213	NULL,
214	${`{"secret":"${runtimePayload}"}`}
215	)
216	`;
217
218	const decodeError = yield* Effect.flip(runtimes.list());
219	assert.instanceOf(decodeError, PersistenceErrors.PersistenceDecodeError);
220	assert.deepStrictEqual(decodeError.correlation, { threadId });
221	assert.equal(
222	decodeError.message,
223	`Decode error in ProviderSessionRuntimeRepository.list:decodeRows: ${decodeError.issue}`,
224	);
225	assert.notInclude(decodeError.issue, runtimePayload);
226	assert.notInclude(decodeError.message, runtimePayload);
227	assert.notInclude(decodeError.message, lastSeenAt);
228
229	yield* sql`DROP TABLE provider_session_runtime`;
230	const sqlFailure = yield* Effect.flip(
231	runtimes.upsert({
232	threadId,
233	providerName: "codex",
234	providerInstanceId: null,
235	adapterKey: "codex",
236	runtimeMode: "full-access",
237	status: "running",
238	lastSeenAt,
239	resumeCursor: null,
240	runtimePayload: { secret: runtimePayload },
241	}),
242	);
243	assert.instanceOf(sqlFailure, PersistenceErrors.PersistenceSqlError);
244	assert.deepStrictEqual(sqlFailure.correlation, { threadId });
245	assert.equal(
246	sqlFailure.message,
247	"SQL error in ProviderSessionRuntimeRepository.upsert:query",
248	);
249	assert.notInclude(sqlFailure.message, runtimePayload);
250	assert.notInclude(sqlFailure.message, lastSeenAt);
251	}).pipe(Effect.provide(providerSessionRuntimeLayer)),
252	);
253	});

author	Julius Marminge <julius0216@outlook.com> 2026-06-20 16:15:16-07:00
committer	GitHub <noreply@github.com> 2026-06-20 16:15:16-07:00
log	57d25c934b74986423896a7dc433595ed09b9c8d
tree	f44703de106959cfe7d190f811cce0fdbcd92fb1
parent	a26f0dc89fd46f88529823511cdd068c9cd2c151
signature	Signed by PGP key B5690EEEBB952194

[codex] Structure persistence error correlation (#3439)