@convex-dev/workos-authkit 0.2.8 → 0.2.10

package/src/component/_generated/component.ts

@@ -79,7 +79,6 @@ export type ComponentApi<Name extends string | undefined = string | undefined> =
         "mutation",
         "internal",
         {
-          apiKey: string;
           event: {
             context?: Record<string, any>;
             createdAt: string;
@@ -87,7 +86,6 @@ export type ComponentApi<Name extends string | undefined = string | undefined> =
             event: string;
             id: string;
           };
-          eventTypes?: Array<string>;
           logLevel?: "DEBUG";
           onEventHandle?: string;
         },

package/src/component/_generated/server.ts

@@ -30,6 +30,17 @@ import {
 } from "convex/server";
 import type { DataModel } from "./dataModel.js";
 
+/**
+ * Typesafe environment variables.
+ *
+ * This includes platform-provided env vars and any variables declared in
+ * `convex.config.ts`.
+ */
+type Env = {
+  readonly CONVEX_CLOUD_URL: string;
+  readonly CONVEX_SITE_URL: string;
+};
+
 /**
  * Define a query in this Convex app's public API.
  *
@@ -106,6 +117,8 @@ export const internalAction: ActionBuilder<DataModel, "internal"> =
  * @returns The wrapped function. Import this function from `convex/http.js` and route it to hook it up.
  */
 export const httpAction: HttpActionBuilder = httpActionGeneric;
+export const env: Env = (globalThis as unknown as { process: { env: Env } })
+  .process.env;
 
 /**
  * A set of services for use within Convex query functions.

package/src/component/backfill.test.ts

@@ -3,7 +3,6 @@ import { convexTest } from "convex-test";
 import { vi, describe, test, expect, beforeEach, afterEach } from "vitest";
 import { modules } from "./setup.test.js";
 import schema from "./schema.js";
-import workpool from "@convex-dev/workpool/test";
 import workflow from "@convex-dev/workflow/test";
 import { api, internal } from "./_generated/api.js";
 
@@ -44,7 +43,6 @@ function makeUser(overrides: Partial<typeof defaultUser> = {}) {
 /** Initialize a convex-test instance with sub-component registrations. */
 function initConvexTest() {
   const t = convexTest(schema, modules);
-  workpool.register(t, "eventWorkpool");
   workflow.register(t, "backfillWorkflow");
   return t;
 }
@@ -152,6 +150,22 @@ describe("backfill", () => {
     expect(dbUsers).toHaveLength(1);
   });
 
+  test("upsertUsersPage skips users with a tombstone", async () => {
+    const t = initConvexTest();
+    const user = makeUser({ id: "user_deleted", email: "gone@example.com" });
+
+    await t.run(async (ctx) => {
+      await ctx.db.insert("deletedUsers", { id: user.id });
+    });
+
+    await t.mutation(internal.backfill.upsertUsersPage, { users: [user] });
+
+    const dbUsers = await t.run(async (ctx) => {
+      return ctx.db.query("users").collect();
+    });
+    expect(dbUsers).toHaveLength(0);
+  });
+
   test("full workflow processes single page", async () => {
     const users = [
       makeUser({ id: "user_w1", email: "w1@example.com" }),
@@ -224,12 +238,8 @@ describe("backfill", () => {
   });
 
   test("pagination data flows through processUsersPage", async () => {
-    const page1Users = [
-      makeUser({ id: "user_p1", email: "p1@example.com" }),
-    ];
-    const page2Users = [
-      makeUser({ id: "user_p2", email: "p2@example.com" }),
-    ];
+    const page1Users = [makeUser({ id: "user_p1", email: "p1@example.com" })];
+    const page2Users = [makeUser({ id: "user_p2", email: "p2@example.com" })];
 
     const { WorkOS } = await import("@workos-inc/node");
     const listUsersMock = vi
@@ -300,9 +310,7 @@ describe("backfill", () => {
   });
 
   test("upsert is idempotent after processUsersPage inserts", async () => {
-    const users = [
-      makeUser({ id: "user_idem", email: "idem@example.com" }),
-    ];
+    const users = [makeUser({ id: "user_idem", email: "idem@example.com" })];
 
     const { WorkOS } = await import("@workos-inc/node");
     (WorkOS as unknown as ReturnType<typeof vi.fn>).mockImplementation(

package/src/component/backfill.ts

@@ -8,16 +8,13 @@ import {
 import { components, internal } from "./_generated/api.js";
 import { WorkOS } from "@workos-inc/node";
 import type { FunctionHandle } from "convex/server";
-import { WorkflowManager } from "@convex-dev/workflow";
-import { vResultValidator } from "@convex-dev/workpool";
-import schema from "./schema.js";
+import { vResultValidator, WorkflowManager } from "@convex-dev/workflow";
+import { vUser } from "../validators.js";
 
 const workflow = new WorkflowManager(components.backfillWorkflow, {
   workpoolOptions: { maxParallelism: 1 },
 });
 
-const vUser = schema.tables.users.validator;
-
 export const getBackfillApiKey = internalQuery({
   args: {},
   returns: v.union(v.string(), v.null()),
@@ -37,10 +34,7 @@ export const processUsersPage = internalAction({
   returns: v.object({
     nextCursor: v.optional(v.string()),
   }),
-  handler: async (
-    ctx,
-    args
-  ): Promise<{ nextCursor: string | undefined }> => {
+  handler: async (ctx, args): Promise<{ nextCursor: string | undefined }> => {
     const apiKey: string | null = await ctx.runQuery(
       internal.backfill.getBackfillApiKey,
       {}
@@ -85,7 +79,23 @@ export const upsertUsersPage = internalMutation({
       )
     );
 
-    const newUsers = args.users.filter((_, i) => !existingUsers[i]);
+    // A user.deleted webhook can arrive between the page fetch and this
+    // mutation, so skip anyone recorded in deletedUsers or the backfill
+    // would insert them again.
+    const deletedUsers = await Promise.all(
+      args.users.map((user, i) =>
+        existingUsers[i]
+          ? null
+          : ctx.db
+              .query("deletedUsers")
+              .withIndex("id", (q) => q.eq("id", user.id))
+              .unique()
+      )
+    );
+
+    const newUsers = args.users.filter(
+      (_, i) => !existingUsers[i] && !deletedUsers[i]
+    );
 
     if (args.logLevel === "DEBUG") {
       console.log(
@@ -124,14 +134,11 @@ export const backfillBatch = workflow.define({
     let pagesProcessed = 0;
 
     while (pagesProcessed < MAX_PAGES_PER_BATCH) {
-      const result = await step.runAction(
-        internal.backfill.processUsersPage,
-        {
-          after: cursor,
-          onEventHandle: args.onEventHandle,
-          logLevel: args.logLevel,
-        }
-      );
+      const result = await step.runAction(internal.backfill.processUsersPage, {
+        after: cursor,
+        onEventHandle: args.onEventHandle,
+        logLevel: args.logLevel,
+      });
 
       cursor = result.nextCursor;
       pagesProcessed++;

package/src/component/convex.config.ts

@@ -1,10 +1,8 @@
 import { defineComponent } from "convex/server";
-import workpool from "@convex-dev/workpool/convex.config";
 import workflow from "@convex-dev/workflow/convex.config";
 
 const component = defineComponent("workOSAuthKit");
 
-component.use(workpool, { name: "eventWorkpool" });
 component.use(workflow, { name: "backfillWorkflow" });
 
 export default component;

package/src/component/lib.test.ts

@@ -0,0 +1,370 @@
+/// <reference types="vite/client" />
+import { convexTest } from "convex-test";
+import { describe, test, expect } from "vitest";
+import { modules } from "./setup.test.js";
+import schema from "./schema.js";
+import workflow from "@convex-dev/workflow/test";
+import { api } from "./_generated/api.js";
+
+/** Default test user values. */
+const defaultUser = {
+  id: "user_01ABC",
+  email: "alice@example.com",
+  name: "Alice Smith" as string | null,
+  firstName: "Alice" as string | null,
+  lastName: "Smith" as string | null,
+  emailVerified: true,
+  profilePictureUrl: null as string | null,
+  lastSignInAt: null as string | null,
+  externalId: null as string | null,
+  metadata: {} as Record<string, string>,
+  locale: null as string | null,
+  createdAt: "2024-01-01T00:00:00.000Z",
+  updatedAt: "2024-01-01T00:00:00.000Z",
+};
+
+/** Create a test user fixture. */
+function makeUser(overrides: Partial<typeof defaultUser> = {}) {
+  return { ...defaultUser, ...overrides };
+}
+
+/** Create a webhook event payload fixture. */
+function makeEvent(
+  event: string,
+  user: ReturnType<typeof makeUser>,
+  overrides: Partial<{ id: string; createdAt: string }> = {}
+) {
+  return {
+    id: overrides.id ?? `event_${event}`,
+    createdAt: overrides.createdAt ?? user.updatedAt,
+    event,
+    data: { object: "user", ...user },
+  };
+}
+
+/** Create a webhook event payload for any event type. */
+function makeRawEvent(event: string, data: Record<string, unknown>) {
+  return {
+    id: `event_${event}`,
+    createdAt: "2024-01-01T00:00:00.000Z",
+    event,
+    data,
+  };
+}
+
+/** Initialize a convex-test instance with sub-component registrations. */
+function initConvexTest() {
+  const t = convexTest(schema, modules);
+  workflow.register(t, "backfillWorkflow");
+  return t;
+}
+
+describe("onWebhookEvent", () => {
+  test("user.created inserts the user", async () => {
+    const t = initConvexTest();
+    const user = makeUser();
+
+    await t.mutation(api.lib.onWebhookEvent, {
+      event: makeEvent("user.created", user),
+    });
+
+    const dbUsers = await t.run(async (ctx) => {
+      return ctx.db.query("users").collect();
+    });
+    expect(dbUsers).toHaveLength(1);
+    expect(dbUsers[0].id).toBe(user.id);
+    expect(dbUsers[0].email).toBe(user.email);
+  });
+
+  test("user.updated patches the user from the delivered payload", async () => {
+    const t = initConvexTest();
+    const user = makeUser();
+    await t.run(async (ctx) => {
+      await ctx.db.insert("users", user);
+    });
+
+    const updated = makeUser({
+      name: "Alice Jones",
+      lastName: "Jones",
+      updatedAt: "2024-01-02T00:00:00.000Z",
+    });
+    await t.mutation(api.lib.onWebhookEvent, {
+      event: makeEvent("user.updated", updated),
+    });
+
+    const dbUser = await t.run(async (ctx) => {
+      return ctx.db.query("users").unique();
+    });
+    expect(dbUser?.name).toBe("Alice Jones");
+    expect(dbUser?.updatedAt).toBe("2024-01-02T00:00:00.000Z");
+  });
+
+  test("user.deleted removes the user from the delivered payload", async () => {
+    const t = initConvexTest();
+    const user = makeUser();
+    await t.run(async (ctx) => {
+      await ctx.db.insert("users", user);
+    });
+
+    await t.mutation(api.lib.onWebhookEvent, {
+      event: makeEvent("user.deleted", user),
+    });
+
+    const dbUsers = await t.run(async (ctx) => {
+      return ctx.db.query("users").collect();
+    });
+    expect(dbUsers).toHaveLength(0);
+  });
+
+  test("retried deliveries dedupe on eventId", async () => {
+    const t = initConvexTest();
+    const user = makeUser();
+    const event = makeEvent("user.created", user);
+
+    await t.mutation(api.lib.onWebhookEvent, {
+      event,
+    });
+    await t.mutation(api.lib.onWebhookEvent, {
+      event,
+    });
+
+    const { dbUsers, dbEvents } = await t.run(async (ctx) => {
+      return {
+        dbUsers: await ctx.db.query("users").collect(),
+        dbEvents: await ctx.db.query("events").collect(),
+      };
+    });
+    expect(dbUsers).toHaveLength(1);
+    expect(dbEvents).toHaveLength(1);
+  });
+
+  test("user.updated delivered before user.created upserts the user", async () => {
+    const t = initConvexTest();
+    const created = makeUser();
+    const updated = makeUser({
+      name: "Alice Jones",
+      lastName: "Jones",
+      updatedAt: "2024-01-02T00:00:00.000Z",
+    });
+
+    await t.mutation(api.lib.onWebhookEvent, {
+      event: makeEvent("user.updated", updated),
+    });
+    await t.mutation(api.lib.onWebhookEvent, {
+      event: makeEvent("user.created", created),
+    });
+
+    const dbUsers = await t.run(async (ctx) => {
+      return ctx.db.query("users").collect();
+    });
+    expect(dbUsers).toHaveLength(1);
+    expect(dbUsers[0].name).toBe("Alice Jones");
+    expect(dbUsers[0].updatedAt).toBe("2024-01-02T00:00:00.000Z");
+  });
+
+  test("stale user.updated deliveries are skipped", async () => {
+    const t = initConvexTest();
+    const user = makeUser({
+      name: "Alice Jones",
+      updatedAt: "2024-01-02T00:00:00.000Z",
+    });
+    await t.run(async (ctx) => {
+      await ctx.db.insert("users", user);
+    });
+
+    const stale = makeUser({
+      name: "Alice Smith",
+      updatedAt: "2024-01-01T00:00:00.000Z",
+    });
+    await t.mutation(api.lib.onWebhookEvent, {
+      event: makeEvent("user.updated", stale),
+    });
+
+    const dbUser = await t.run(async (ctx) => {
+      return ctx.db.query("users").unique();
+    });
+    expect(dbUser?.name).toBe("Alice Jones");
+    expect(dbUser?.updatedAt).toBe("2024-01-02T00:00:00.000Z");
+  });
+
+  test("user events record the user id", async () => {
+    const t = initConvexTest();
+    const user = makeUser();
+
+    await t.mutation(api.lib.onWebhookEvent, {
+      event: makeEvent("user.created", user),
+    });
+
+    const dbEvent = await t.run(async (ctx) => {
+      return ctx.db.query("events").unique();
+    });
+    expect(dbEvent?.userId).toBe(user.id);
+  });
+
+  test("events referencing a user prefer userId over the object id", async () => {
+    const t = initConvexTest();
+
+    await t.mutation(api.lib.onWebhookEvent, {
+      event: {
+        id: "event_session_created",
+        createdAt: "2024-01-01T00:00:00.000Z",
+        event: "session.created",
+        data: {
+          object: "session",
+          id: "session_01XYZ",
+          userId: "user_01ABC",
+        },
+      },
+    });
+
+    const dbEvent = await t.run(async (ctx) => {
+      return ctx.db.query("events").unique();
+    });
+    expect(dbEvent?.userId).toBe("user_01ABC");
+  });
+
+  test("events without a usable id record no userId", async () => {
+    const t = initConvexTest();
+
+    await t.mutation(api.lib.onWebhookEvent, {
+      event: {
+        id: "event_connection_activated",
+        createdAt: "2024-01-01T00:00:00.000Z",
+        event: "connection.activated",
+        data: { object: "connection", id: null },
+      },
+    });
+
+    const dbEvent = await t.run(async (ctx) => {
+      return ctx.db.query("events").unique();
+    });
+    expect(dbEvent?.userId).toBeUndefined();
+  });
+
+  test("user.deleted records a tombstone", async () => {
+    const t = initConvexTest();
+    const user = makeUser();
+    await t.run(async (ctx) => {
+      await ctx.db.insert("users", user);
+    });
+
+    await t.mutation(api.lib.onWebhookEvent, {
+      event: makeEvent("user.deleted", user),
+    });
+
+    const { dbUsers, dbDeletedUsers } = await t.run(async (ctx) => {
+      return {
+        dbUsers: await ctx.db.query("users").collect(),
+        dbDeletedUsers: await ctx.db.query("deletedUsers").collect(),
+      };
+    });
+    expect(dbUsers).toHaveLength(0);
+    expect(dbDeletedUsers).toHaveLength(1);
+    expect(dbDeletedUsers[0].id).toBe(user.id);
+  });
+
+  test("user.deleted works with only an id in the payload", async () => {
+    const t = initConvexTest();
+    const user = makeUser();
+    await t.run(async (ctx) => {
+      await ctx.db.insert("users", user);
+    });
+
+    await t.mutation(api.lib.onWebhookEvent, {
+      event: makeRawEvent("user.deleted", { object: "user", id: user.id }),
+    });
+
+    const { dbUsers, dbDeletedUsers } = await t.run(async (ctx) => {
+      return {
+        dbUsers: await ctx.db.query("users").collect(),
+        dbDeletedUsers: await ctx.db.query("deletedUsers").collect(),
+      };
+    });
+    expect(dbUsers).toHaveLength(0);
+    expect(dbDeletedUsers).toHaveLength(1);
+    expect(dbDeletedUsers[0].id).toBe(user.id);
+  });
+
+  test("user.created after user.deleted is skipped", async () => {
+    const t = initConvexTest();
+    const user = makeUser();
+
+    await t.mutation(api.lib.onWebhookEvent, {
+      event: makeEvent("user.deleted", user),
+    });
+    await t.mutation(api.lib.onWebhookEvent, {
+      event: makeEvent("user.created", user),
+    });
+
+    const { dbUsers, dbDeletedUsers } = await t.run(async (ctx) => {
+      return {
+        dbUsers: await ctx.db.query("users").collect(),
+        dbDeletedUsers: await ctx.db.query("deletedUsers").collect(),
+      };
+    });
+    expect(dbUsers).toHaveLength(0);
+    expect(dbDeletedUsers).toHaveLength(1);
+    expect(dbDeletedUsers[0].id).toBe(user.id);
+  });
+
+  test("user.updated after user.deleted is skipped", async () => {
+    const t = initConvexTest();
+    const user = makeUser();
+
+    await t.mutation(api.lib.onWebhookEvent, {
+      event: makeEvent("user.deleted", user),
+    });
+    await t.mutation(api.lib.onWebhookEvent, {
+      event: makeEvent("user.updated", user),
+    });
+
+    const { dbUsers, dbDeletedUsers } = await t.run(async (ctx) => {
+      return {
+        dbUsers: await ctx.db.query("users").collect(),
+        dbDeletedUsers: await ctx.db.query("deletedUsers").collect(),
+      };
+    });
+    expect(dbUsers).toHaveLength(0);
+    expect(dbDeletedUsers).toHaveLength(1);
+    expect(dbDeletedUsers[0].id).toBe(user.id);
+  });
+
+  test("organization.created leaves userId unset", async () => {
+    const t = initConvexTest();
+
+    await t.mutation(api.lib.onWebhookEvent, {
+      event: makeRawEvent("organization.created", {
+        object: "organization",
+        id: "org_01ABC",
+        name: "Acme",
+      }),
+    });
+
+    const dbEvents = await t.run(async (ctx) => {
+      return ctx.db.query("events").collect();
+    });
+    expect(dbEvents).toHaveLength(1);
+    expect(dbEvents[0].userId).toBeUndefined();
+  });
+
+  test("authentication events with a null userId are recorded", async () => {
+    const t = initConvexTest();
+
+    await t.mutation(api.lib.onWebhookEvent, {
+      event: makeRawEvent("authentication.password_failed", {
+        userId: null,
+        email: "alice@example.com",
+        status: "failed",
+        type: "password",
+        ipAddress: null,
+        userAgent: null,
+      }),
+    });
+
+    const dbEvents = await t.run(async (ctx) => {
+      return ctx.db.query("events").collect();
+    });
+    expect(dbEvents).toHaveLength(1);
+    expect(dbEvents[0].userId).toBeUndefined();
+  });
+});