Magic Links

import { AuthKernelLive } from "@effect-auth/core/AuthKernel";
import { AuthRateLimitStandardLive } from "@effect-auth/core/AuthRateLimit";
import {
  AuthHttpApiConfigLive,
  CoreAuthHttpApiLive,
} from "@effect-auth/core/HttpApi";
import {
  MagicLinkLoginLive,
  type MagicLinkUrlInput,
} from "@effect-auth/core/MagicLink";
import { Layer, Redacted } from "effect";
import { HttpServer } from "effect/unstable/http";

const makeMagicLinkUrl = ({
  challengeId,
  secret,
}: MagicLinkUrlInput) => {
  const url = new URL("/magic-link", env.AUTH_PUBLIC_URL);
  url.searchParams.set("challengeId", challengeId);
  url.searchParams.set("secret", Redacted.value(secret));
  return url.toString();
};

const AppAuthServicesLive = MagicLinkLoginLive({
  makeUrl: makeMagicLinkUrl,
}).pipe(
  Layer.provideMerge(AuthKernelLive),
  Layer.provideMerge(AppAuthRuntimeLive)
);

export const AuthLive = CoreAuthHttpApiLive.pipe(
  Layer.provide(AuthRateLimitStandardLive()),
  Layer.provide(Layer.mergeAll(AppAuthServicesLive, AppRateLimitLive)),
  Layer.provide(
    AuthHttpApiConfigLive({
      originCheck: { allowedOrigins: ["https://app.example.com"] },
    })
  ),
  Layer.provide(HttpServer.layerServices)
);

import { createAuthClient } from "@effect-auth/core/Client";

export const auth = createAuthClient({
  requestInit: { credentials: "include" },
});

await auth.magicLink.start({ email });

const result = await auth.magicLink.verify({
  challengeId: searchParams.get("challengeId")!,
  secret: searchParams.get("secret")!,
});

import {
  AuthOriginCheckMiddleware,
  AuthSchemaErrorMiddleware,
  magicLinkStartEndpoint,
  magicLinkVerifyEndpoint,
} from "@effect-auth/core/HttpApi";
import { HttpApi, HttpApiGroup } from "effect/unstable/httpapi";

class AppMagicLinkHttpApiGroup extends HttpApiGroup.make("magicLink")
  .add(magicLinkStartEndpoint, magicLinkVerifyEndpoint)
  .prefix("/auth/magic-link")
  .middleware(AuthSchemaErrorMiddleware)
  .middleware(AuthOriginCheckMiddleware) {}

export class AppAuthApi extends HttpApi.make("AppAuthApi")
  .add(AppMagicLinkHttpApiGroup) {}

import {
  MagicLinkHttpOperations,
  MagicLinkHttpOperationsLive,
} from "@effect-auth/core/HttpApi";
import { Effect, Layer } from "effect";
import { HttpApiBuilder } from "effect/unstable/httpapi";

export const AppMagicLinkHttpApiGroupLive = HttpApiBuilder.group(
  AppAuthApi,
  "magicLink",
  Effect.fn("app.auth.magic_link")(function* (handlers) {
    const magicLink = yield* MagicLinkHttpOperations;

    return handlers
      .handle("start", magicLink.start)
      .handle("verify", magicLink.verify);
  })
).pipe(Layer.provide(MagicLinkHttpOperationsLive));

import { ChallengeId, Email } from "@effect-auth/core/Identifiers";
import {
  MagicLinkLoginLive,
  MagicLinkLogin,
} from "@effect-auth/core/MagicLink";
import type { IssuedSession } from "@effect-auth/core/Sessions";
import { Effect, Redacted } from "effect";

declare const requireMagicLinkEligible: (email: Email) => Effect.Effect<void>;
declare const rememberPendingEmail: (
  challengeId: ChallengeId,
  email: Email
) => Effect.Effect<void>;
declare const requirePendingEmailEligible: (
  challengeId: ChallengeId
) => Effect.Effect<void>;
declare const commitSession: (session: IssuedSession) => Effect.Effect<void>;

export const startMagicLink = (input: {
  readonly email: string;
  readonly locale?: string;
}) =>
  Effect.gen(function* () {
    const magicLinks = yield* MagicLinkLogin;
    const email = Email(input.email.trim().toLowerCase());

    yield* requireMagicLinkEligible(email);
    const started = yield* magicLinks.start({
      email,
      locale: input.locale,
      metadata: { tenantId: "acme", redirectTo: "/projects" },
    });
    yield* rememberPendingEmail(started.challengeId, email);

    // Keep this server-side. The recipient gets both credentials in mail.
    return { email: started.email, expiresAt: started.expiresAt };
  });

export const verifyMagicLink = (input: {
  readonly challengeId: string;
  readonly secret: string;
  readonly ip?: string;
  readonly userAgent?: string;
}) =>
  Effect.gen(function* () {
    const magicLinks = yield* MagicLinkLogin;
    const challengeId = ChallengeId(input.challengeId);

    // Resolve eligibility from challenge-bound application state here;
    // never trust tenant or redirect values copied from the callback URL.
    yield* requirePendingEmailEligible(challengeId);
    const result = yield* magicLinks.verify({
      challengeId,
      secret: Redacted.make(input.secret),
      request: { ip: input.ip, userAgent: input.userAgent },
    });

    if (result._tag === "Authenticated") {
      yield* commitSession(result.session);
      return { _tag: "Authenticated" as const };
    }

    // Preserve RequiresMfa and other continuations. Map invalid,
    // disabled-account, and policy results to non-enumerating responses.
    return result;
  });

export const MagicLinkLive = MagicLinkLoginLive({
  makeUrl: ({ challengeId, secret }) => {
    const url = new URL("/magic-link", "https://app.example.com");
    url.searchParams.set("challengeId", challengeId);
    url.searchParams.set("secret", Redacted.value(secret));
    return url.toString();
  },
});