Email OTP

import { AuthKernelLive } from "@effect-auth/core/AuthKernel";
import { AuthRateLimitStandardLive } from "@effect-auth/core/AuthRateLimit";
import { EmailOtpDefaultLive } from "@effect-auth/core/EmailOtp";
import {
  AuthHttpApiConfigLive,
  CoreAuthHttpApiLive,
} from "@effect-auth/core/HttpApi";
import { Layer } from "effect";
import { HttpServer } from "effect/unstable/http";

const AppAuthServicesLive = EmailOtpDefaultLive().pipe(
  Layer.provideMerge(AuthKernelLive),
  Layer.provideMerge(AppAuthRuntimeLive)
);

export const AuthLive = CoreAuthHttpApiLive.pipe(
  Layer.provide(AuthRateLimitStandardLive()),
  Layer.provide(Layer.mergeAll(AppAuthServicesLive, AppRateLimitLive)),
  Layer.provide(
    AuthHttpApiConfigLive({
      originCheck: { allowedOrigins: ["https://app.example.com"] },
    })
  ),
  Layer.provide(HttpServer.layerServices)
);

import { Duration } from "effect";

const EmailOtpLive = EmailOtpDefaultLive({
  length: 8,
  ttl: Duration.minutes(5),
});

import { createAuthClient } from "@effect-auth/core/Client";

export const auth = createAuthClient({
  requestInit: { credentials: "include" },
});

const started = await auth.emailOtp.start({ email });

const result = await auth.emailOtp.verify({
  challengeId: started.challengeId,
  secret: code,
});

import {
  AuthOriginCheckMiddleware,
  AuthSchemaErrorMiddleware,
  emailOtpStartEndpoint,
  emailOtpVerifyEndpoint,
} from "@effect-auth/core/HttpApi";
import { HttpApi, HttpApiGroup } from "effect/unstable/httpapi";

class AppEmailOtpHttpApiGroup extends HttpApiGroup.make("emailOtp")
  .add(emailOtpStartEndpoint, emailOtpVerifyEndpoint)
  .prefix("/auth/email-otp")
  .middleware(AuthSchemaErrorMiddleware)
  .middleware(AuthOriginCheckMiddleware) {}

export class AppAuthApi extends HttpApi.make("AppAuthApi")
  .add(AppEmailOtpHttpApiGroup) {}

import {
  EmailOtpHttpOperations,
  EmailOtpHttpOperationsLive,
} from "@effect-auth/core/HttpApi";
import { Effect, Layer } from "effect";
import { HttpApiBuilder } from "effect/unstable/httpapi";

export const AppEmailOtpHttpApiGroupLive = HttpApiBuilder.group(
  AppAuthApi,
  "emailOtp",
  Effect.fn("app.auth.email_otp")(function* (handlers) {
    const emailOtp = yield* EmailOtpHttpOperations;

    return handlers
      .handle("start", emailOtp.start)
      .handle("verify", emailOtp.verify);
  })
).pipe(Layer.provide(EmailOtpHttpOperationsLive));

import { EmailOtpLogin } from "@effect-auth/core/EmailOtp";
import { ChallengeId, Email } from "@effect-auth/core/Identifiers";
import type { IssuedSession } from "@effect-auth/core/Sessions";
import { Effect, Redacted } from "effect";

// Application services: normalize/validate public input, check tenant or
// invite policy, and serialize an issued session into a secure cookie.
declare const requireEmailOtpEligible: (email: Email) => Effect.Effect<void>;
declare const rememberPendingEmail: (
  challengeId: ChallengeId,
  email: Email
) => Effect.Effect<void>;
declare const requirePendingEmailEligible: (
  challengeId: ChallengeId
) => Effect.Effect<void>;
declare const commitSession: (session: IssuedSession) => Effect.Effect<void>;

export const startEmailOtp = (input: {
  readonly email: string;
  readonly locale?: string;
}) =>
  Effect.gen(function* () {
    const emailOtp = yield* EmailOtpLogin;
    const email = Email(input.email.trim().toLowerCase());

    yield* requireEmailOtpEligible(email);
    const started = yield* emailOtp.start({
      email,
      locale: input.locale,
      metadata: { tenantId: "acme" }, // Derive this server-side.
    });
    yield* rememberPendingEmail(started.challengeId, email);

    // Return this opaque ID to the code-entry page, never the mailed code.
    return { challengeId: started.challengeId, expiresAt: started.expiresAt };
  });

export const verifyEmailOtp = (input: {
  readonly challengeId: string;
  readonly code: string;
  readonly ip?: string;
  readonly userAgent?: string;
}) =>
  Effect.gen(function* () {
    const emailOtp = yield* EmailOtpLogin;
    const challengeId = ChallengeId(input.challengeId);

    // Re-check eligibility using challenge-bound application state when
    // policy can change between start and verify.
    yield* requirePendingEmailEligible(challengeId);
    const result = yield* emailOtp.verify({
      challengeId,
      secret: Redacted.make(input.code),
      request: { ip: input.ip, userAgent: input.userAgent },
    });

    if (result._tag === "Authenticated") {
      yield* commitSession(result.session);
      return { _tag: "Authenticated" as const };
    }

    // Return continuations to the next server-owned flow. Map credential,
    // disabled-account, and policy results to non-enumerating responses.
    return result;
  });