@convex-dev/workos-authkit 0.2.9 → 0.3.0

package/src/component/backfill.test.ts

@@ -3,7 +3,6 @@ import { convexTest } from "convex-test";
 import { vi, describe, test, expect, beforeEach, afterEach } from "vitest";
 import { modules } from "./setup.test.js";
 import schema from "./schema.js";
-import workpool from "@convex-dev/workpool/test";
 import workflow from "@convex-dev/workflow/test";
 import { api, internal } from "./_generated/api.js";
 
@@ -44,7 +43,6 @@ function makeUser(overrides: Partial<typeof defaultUser> = {}) {
 /** Initialize a convex-test instance with sub-component registrations. */
 function initConvexTest() {
   const t = convexTest(schema, modules);
-  workpool.register(t, "eventWorkpool");
   workflow.register(t, "backfillWorkflow");
   return t;
 }
@@ -152,6 +150,22 @@ describe("backfill", () => {
     expect(dbUsers).toHaveLength(1);
   });
 
+  test("upsertUsersPage skips users with a tombstone", async () => {
+    const t = initConvexTest();
+    const user = makeUser({ id: "user_deleted", email: "gone@example.com" });
+
+    await t.run(async (ctx) => {
+      await ctx.db.insert("deletedUsers", { id: user.id });
+    });
+
+    await t.mutation(internal.backfill.upsertUsersPage, { users: [user] });
+
+    const dbUsers = await t.run(async (ctx) => {
+      return ctx.db.query("users").collect();
+    });
+    expect(dbUsers).toHaveLength(0);
+  });
+
   test("full workflow processes single page", async () => {
     const users = [
       makeUser({ id: "user_w1", email: "w1@example.com" }),
@@ -224,12 +238,8 @@ describe("backfill", () => {
   });
 
   test("pagination data flows through processUsersPage", async () => {
-    const page1Users = [
-      makeUser({ id: "user_p1", email: "p1@example.com" }),
-    ];
-    const page2Users = [
-      makeUser({ id: "user_p2", email: "p2@example.com" }),
-    ];
+    const page1Users = [makeUser({ id: "user_p1", email: "p1@example.com" })];
+    const page2Users = [makeUser({ id: "user_p2", email: "p2@example.com" })];
 
     const { WorkOS } = await import("@workos-inc/node");
     const listUsersMock = vi
@@ -300,9 +310,7 @@ describe("backfill", () => {
   });
 
   test("upsert is idempotent after processUsersPage inserts", async () => {
-    const users = [
-      makeUser({ id: "user_idem", email: "idem@example.com" }),
-    ];
+    const users = [makeUser({ id: "user_idem", email: "idem@example.com" })];
 
     const { WorkOS } = await import("@workos-inc/node");
     (WorkOS as unknown as ReturnType<typeof vi.fn>).mockImplementation(

package/src/component/backfill.ts

@@ -8,16 +8,13 @@ import {
 import { components, internal } from "./_generated/api.js";
 import { WorkOS } from "@workos-inc/node";
 import type { FunctionHandle } from "convex/server";
-import { WorkflowManager } from "@convex-dev/workflow";
-import { vResultValidator } from "@convex-dev/workpool";
-import schema from "./schema.js";
+import { vResultValidator, WorkflowManager } from "@convex-dev/workflow";
+import { vUser } from "../validators.js";
 
 const workflow = new WorkflowManager(components.backfillWorkflow, {
   workpoolOptions: { maxParallelism: 1 },
 });
 
-const vUser = schema.tables.users.validator;
-
 export const getBackfillApiKey = internalQuery({
   args: {},
   returns: v.union(v.string(), v.null()),
@@ -37,10 +34,7 @@ export const processUsersPage = internalAction({
   returns: v.object({
     nextCursor: v.optional(v.string()),
   }),
-  handler: async (
-    ctx,
-    args
-  ): Promise<{ nextCursor: string | undefined }> => {
+  handler: async (ctx, args): Promise<{ nextCursor: string | undefined }> => {
     const apiKey: string | null = await ctx.runQuery(
       internal.backfill.getBackfillApiKey,
       {}
@@ -85,7 +79,23 @@ export const upsertUsersPage = internalMutation({
       )
     );
 
-    const newUsers = args.users.filter((_, i) => !existingUsers[i]);
+    // A user.deleted webhook can arrive between the page fetch and this
+    // mutation, so skip anyone recorded in deletedUsers or the backfill
+    // would insert them again.
+    const deletedUsers = await Promise.all(
+      args.users.map((user, i) =>
+        existingUsers[i]
+          ? null
+          : ctx.db
+              .query("deletedUsers")
+              .withIndex("id", (q) => q.eq("id", user.id))
+              .unique()
+      )
+    );
+
+    const newUsers = args.users.filter(
+      (_, i) => !existingUsers[i] && !deletedUsers[i]
+    );
 
     if (args.logLevel === "DEBUG") {
       console.log(
@@ -124,14 +134,11 @@ export const backfillBatch = workflow.define({
     let pagesProcessed = 0;
 
     while (pagesProcessed < MAX_PAGES_PER_BATCH) {
-      const result = await step.runAction(
-        internal.backfill.processUsersPage,
-        {
-          after: cursor,
-          onEventHandle: args.onEventHandle,
-          logLevel: args.logLevel,
-        }
-      );
+      const result = await step.runAction(internal.backfill.processUsersPage, {
+        after: cursor,
+        onEventHandle: args.onEventHandle,
+        logLevel: args.logLevel,
+      });
 
       cursor = result.nextCursor;
       pagesProcessed++;

package/src/component/convex.config.ts

@@ -1,10 +1,8 @@
 import { defineComponent } from "convex/server";
-import workpool from "@convex-dev/workpool/convex.config";
 import workflow from "@convex-dev/workflow/convex.config";
 
 const component = defineComponent("workOSAuthKit");
 
-component.use(workpool, { name: "eventWorkpool" });
 component.use(workflow, { name: "backfillWorkflow" });
 
 export default component;

package/src/component/lib.test.ts

@@ -1,11 +1,14 @@
 /// <reference types="vite/client" />
 import { convexTest } from "convex-test";
-import { describe, test, expect } from "vitest";
+import { createFunctionHandle, makeFunctionReference } from "convex/server";
+import { describe, test, expect, vi } from "vitest";
 import { modules } from "./setup.test.js";
 import schema from "./schema.js";
-import workpool from "@convex-dev/workpool/test";
 import workflow from "@convex-dev/workflow/test";
 import { api } from "./_generated/api.js";
+import { mutation } from "./_generated/server.js";
+import { vEvent } from "./lib.js";
+import { v } from "convex/values";
 
 /** Default test user values. */
 const defaultUser = {
@@ -43,10 +46,19 @@ function makeEvent(
   };
 }
 
+/** Create a webhook event payload for any event type. */
+function makeRawEvent(event: string, data: Record<string, unknown>) {
+  return {
+    id: `event_${event}`,
+    createdAt: "2024-01-01T00:00:00.000Z",
+    event,
+    data,
+  };
+}
+
 /** Initialize a convex-test instance with sub-component registrations. */
 function initConvexTest() {
   const t = convexTest(schema, modules);
-  workpool.register(t, "eventWorkpool");
   workflow.register(t, "backfillWorkflow");
   return t;
 }
@@ -57,7 +69,6 @@ describe("onWebhookEvent", () => {
     const user = makeUser();
 
     await t.mutation(api.lib.onWebhookEvent, {
-      apiKey: "sk_test_123",
       event: makeEvent("user.created", user),
     });
 
@@ -82,7 +93,6 @@ describe("onWebhookEvent", () => {
       updatedAt: "2024-01-02T00:00:00.000Z",
     });
     await t.mutation(api.lib.onWebhookEvent, {
-      apiKey: "sk_test_123",
       event: makeEvent("user.updated", updated),
     });
 
@@ -101,7 +111,6 @@ describe("onWebhookEvent", () => {
     });
 
     await t.mutation(api.lib.onWebhookEvent, {
-      apiKey: "sk_test_123",
       event: makeEvent("user.deleted", user),
     });
 
@@ -117,11 +126,9 @@ describe("onWebhookEvent", () => {
     const event = makeEvent("user.created", user);
 
     await t.mutation(api.lib.onWebhookEvent, {
-      apiKey: "sk_test_123",
       event,
     });
     await t.mutation(api.lib.onWebhookEvent, {
-      apiKey: "sk_test_123",
       event,
     });
 
@@ -145,11 +152,9 @@ describe("onWebhookEvent", () => {
     });
 
     await t.mutation(api.lib.onWebhookEvent, {
-      apiKey: "sk_test_123",
       event: makeEvent("user.updated", updated),
     });
     await t.mutation(api.lib.onWebhookEvent, {
-      apiKey: "sk_test_123",
       event: makeEvent("user.created", created),
     });
 
@@ -176,7 +181,6 @@ describe("onWebhookEvent", () => {
       updatedAt: "2024-01-01T00:00:00.000Z",
     });
     await t.mutation(api.lib.onWebhookEvent, {
-      apiKey: "sk_test_123",
       event: makeEvent("user.updated", stale),
     });
 
@@ -186,4 +190,237 @@ describe("onWebhookEvent", () => {
     expect(dbUser?.name).toBe("Alice Jones");
     expect(dbUser?.updatedAt).toBe("2024-01-02T00:00:00.000Z");
   });
+
+  test("user events record the user id", async () => {
+    const t = initConvexTest();
+    const user = makeUser();
+
+    await t.mutation(api.lib.onWebhookEvent, {
+      event: makeEvent("user.created", user),
+    });
+
+    const dbEvent = await t.run(async (ctx) => {
+      return ctx.db.query("events").unique();
+    });
+    expect(dbEvent?.userId).toBe(user.id);
+  });
+
+  test("events referencing a user prefer userId over the object id", async () => {
+    const t = initConvexTest();
+
+    await t.mutation(api.lib.onWebhookEvent, {
+      event: {
+        id: "event_session_created",
+        createdAt: "2024-01-01T00:00:00.000Z",
+        event: "session.created",
+        data: {
+          object: "session",
+          id: "session_01XYZ",
+          userId: "user_01ABC",
+        },
+      },
+    });
+
+    const dbEvent = await t.run(async (ctx) => {
+      return ctx.db.query("events").unique();
+    });
+    expect(dbEvent?.userId).toBe("user_01ABC");
+  });
+
+  test("events without a usable id record no userId", async () => {
+    const t = initConvexTest();
+
+    await t.mutation(api.lib.onWebhookEvent, {
+      event: {
+        id: "event_connection_activated",
+        createdAt: "2024-01-01T00:00:00.000Z",
+        event: "connection.activated",
+        data: { object: "connection", id: null },
+      },
+    });
+
+    const dbEvent = await t.run(async (ctx) => {
+      return ctx.db.query("events").unique();
+    });
+    expect(dbEvent?.userId).toBeUndefined();
+  });
+
+  test("user.deleted records a tombstone", async () => {
+    const t = initConvexTest();
+    const user = makeUser();
+    await t.run(async (ctx) => {
+      await ctx.db.insert("users", user);
+    });
+
+    await t.mutation(api.lib.onWebhookEvent, {
+      event: makeEvent("user.deleted", user),
+    });
+
+    const { dbUsers, dbDeletedUsers } = await t.run(async (ctx) => {
+      return {
+        dbUsers: await ctx.db.query("users").collect(),
+        dbDeletedUsers: await ctx.db.query("deletedUsers").collect(),
+      };
+    });
+    expect(dbUsers).toHaveLength(0);
+    expect(dbDeletedUsers).toHaveLength(1);
+    expect(dbDeletedUsers[0].id).toBe(user.id);
+  });
+
+  test("user.deleted works with only an id in the payload", async () => {
+    const t = initConvexTest();
+    const user = makeUser();
+    await t.run(async (ctx) => {
+      await ctx.db.insert("users", user);
+    });
+
+    await t.mutation(api.lib.onWebhookEvent, {
+      event: makeRawEvent("user.deleted", { object: "user", id: user.id }),
+    });
+
+    const { dbUsers, dbDeletedUsers } = await t.run(async (ctx) => {
+      return {
+        dbUsers: await ctx.db.query("users").collect(),
+        dbDeletedUsers: await ctx.db.query("deletedUsers").collect(),
+      };
+    });
+    expect(dbUsers).toHaveLength(0);
+    expect(dbDeletedUsers).toHaveLength(1);
+    expect(dbDeletedUsers[0].id).toBe(user.id);
+  });
+
+  test.each([
+    { payload: "a full user", data: { object: "user", ...makeUser() } },
+    { payload: "only an id", data: { id: defaultUser.id } },
+  ])(
+    "user.deleted forwards $payload without a stored user",
+    async ({ data }) => {
+      const onEvent = vi.fn();
+      const t = convexTest(schema, {
+        ...modules,
+        "./callbacks.ts": async () => ({
+          onEvent: mutation({
+            args: { event: vEvent.fields.event, data: vEvent.fields.data },
+            returns: v.null(),
+            handler: async (_ctx, args) => {
+              onEvent(args);
+              return null;
+            },
+          }),
+        }),
+      });
+      const onEventHandle = await t.run(async () =>
+        createFunctionHandle(
+          makeFunctionReference<"mutation">("callbacks:onEvent")
+        )
+      );
+      const event = makeRawEvent("user.deleted", data);
+
+      await t.mutation(api.lib.onWebhookEvent, { event, onEventHandle });
+
+      expect(onEvent).toHaveBeenCalledExactlyOnceWith({
+        event: "user.deleted",
+        data,
+      });
+
+      await t.mutation(api.lib.onWebhookEvent, { event, onEventHandle });
+      for (const eventType of ["user.created", "user.updated"]) {
+        await t.mutation(api.lib.onWebhookEvent, {
+          event: makeEvent(eventType, makeUser()),
+          onEventHandle,
+        });
+      }
+
+      expect(onEvent).toHaveBeenCalledTimes(1);
+      const { dbUsers, dbDeletedUsers } = await t.run(async (ctx) => ({
+        dbUsers: await ctx.db.query("users").collect(),
+        dbDeletedUsers: await ctx.db.query("deletedUsers").collect(),
+      }));
+      expect(dbUsers).toHaveLength(0);
+      expect(dbDeletedUsers).toMatchObject([{ id: data.id }]);
+    }
+  );
+
+  test("user.created after user.deleted is skipped", async () => {
+    const t = initConvexTest();
+    const user = makeUser();
+
+    await t.mutation(api.lib.onWebhookEvent, {
+      event: makeEvent("user.deleted", user),
+    });
+    await t.mutation(api.lib.onWebhookEvent, {
+      event: makeEvent("user.created", user),
+    });
+
+    const { dbUsers, dbDeletedUsers } = await t.run(async (ctx) => {
+      return {
+        dbUsers: await ctx.db.query("users").collect(),
+        dbDeletedUsers: await ctx.db.query("deletedUsers").collect(),
+      };
+    });
+    expect(dbUsers).toHaveLength(0);
+    expect(dbDeletedUsers).toHaveLength(1);
+    expect(dbDeletedUsers[0].id).toBe(user.id);
+  });
+
+  test("user.updated after user.deleted is skipped", async () => {
+    const t = initConvexTest();
+    const user = makeUser();
+
+    await t.mutation(api.lib.onWebhookEvent, {
+      event: makeEvent("user.deleted", user),
+    });
+    await t.mutation(api.lib.onWebhookEvent, {
+      event: makeEvent("user.updated", user),
+    });
+
+    const { dbUsers, dbDeletedUsers } = await t.run(async (ctx) => {
+      return {
+        dbUsers: await ctx.db.query("users").collect(),
+        dbDeletedUsers: await ctx.db.query("deletedUsers").collect(),
+      };
+    });
+    expect(dbUsers).toHaveLength(0);
+    expect(dbDeletedUsers).toHaveLength(1);
+    expect(dbDeletedUsers[0].id).toBe(user.id);
+  });
+
+  test("organization.created leaves userId unset", async () => {
+    const t = initConvexTest();
+
+    await t.mutation(api.lib.onWebhookEvent, {
+      event: makeRawEvent("organization.created", {
+        object: "organization",
+        id: "org_01ABC",
+        name: "Acme",
+      }),
+    });
+
+    const dbEvents = await t.run(async (ctx) => {
+      return ctx.db.query("events").collect();
+    });
+    expect(dbEvents).toHaveLength(1);
+    expect(dbEvents[0].userId).toBeUndefined();
+  });
+
+  test("authentication events with a null userId are recorded", async () => {
+    const t = initConvexTest();
+
+    await t.mutation(api.lib.onWebhookEvent, {
+      event: makeRawEvent("authentication.password_failed", {
+        userId: null,
+        email: "alice@example.com",
+        status: "failed",
+        type: "password",
+        ipAddress: null,
+        userAgent: null,
+      }),
+    });
+
+    const dbEvents = await t.run(async (ctx) => {
+      return ctx.db.query("events").collect();
+    });
+    expect(dbEvents).toHaveLength(1);
+    expect(dbEvents[0].userId).toBeUndefined();
+  });
 });