@estifanos-sh/convex-auth 0.0.1-preview.0

package/dist/component/schema.js

@@ -0,0 +1,401 @@
+import { vApiKeyRateLimit, vApiKeyRateLimitState, vApiKeyScope, vAuthEventActorType, vAuthEventCategory, vAuthEventData, vAuthEventKind, vAuthEventOutcome, vAuthEventSubjectType, vAuthEventTargetKind, vDeviceStatus, vGroupConnectionPolicy, vGroupConnectionProtocol, vGroupConnectionSecretKind, vGroupConnectionStatus, vInviteStatus, vScimResourceType, vScimStatus, vTokenEndpointAuthMethod, vWebhookDeliveryStatus, vWebhookEndpointStatus } from "./model.js";
+import { v } from "convex/values";
+import { defineSchema, defineTable } from "convex/server";
+
+//#region src/component/schema.ts
+/**
+* Schema for the auth component.
+*
+* Contains tables for core authentication (users, sessions, accounts, tokens,
+* verification codes, PKCE verifiers, rate limits) and hierarchical group
+* management (groups, members, invites).
+*/
+var schema_default = defineSchema({
+	User: defineTable({
+		name: v.optional(v.string()),
+		firstName: v.optional(v.string()),
+		lastName: v.optional(v.string()),
+		image: v.optional(v.string()),
+		email: v.optional(v.string()),
+		emailVerificationTime: v.optional(v.number()),
+		phone: v.optional(v.string()),
+		phoneVerificationTime: v.optional(v.number()),
+		isAnonymous: v.optional(v.boolean()),
+		lastActiveGroup: v.optional(v.id("Group")),
+		hasTotp: v.optional(v.boolean()),
+		extend: v.optional(v.any())
+	}).index("email", ["email"]).index("email_verified", ["email", "emailVerificationTime"]).index("phone", ["phone"]).index("phone_verified", ["phone", "phoneVerificationTime"]),
+	UserEmail: defineTable({
+		userId: v.id("User"),
+		email: v.string(),
+		verificationTime: v.optional(v.number()),
+		isPrimary: v.boolean(),
+		source: v.union(v.literal("password"), v.literal("oauth"), v.literal("oidc"), v.literal("saml"), v.literal("scim")),
+		accountId: v.optional(v.id("Account")),
+		provider: v.optional(v.string()),
+		connectionId: v.optional(v.id("GroupConnection"))
+	}).index("user_id", ["userId"]).index("user_id_email", ["userId", "email"]).index("connection_id_email", ["connectionId", "email"]),
+	Session: defineTable({
+		userId: v.id("User"),
+		expirationTime: v.number()
+	}).index("user_id", ["userId"]).index("expiration_time", ["expirationTime"]),
+	Account: defineTable({
+		userId: v.id("User"),
+		provider: v.string(),
+		providerAccountId: v.string(),
+		secret: v.optional(v.string()),
+		emailVerified: v.optional(v.string()),
+		phoneVerified: v.optional(v.string()),
+		extend: v.optional(v.any())
+	}).index("user_id_provider", ["userId", "provider"]).index("provider_account_id", ["provider", "providerAccountId"]),
+	RefreshToken: defineTable({
+		sessionId: v.id("Session"),
+		expirationTime: v.number(),
+		firstUsedTime: v.optional(v.number()),
+		parentRefreshTokenId: v.optional(v.id("RefreshToken"))
+	}).index("session_id", ["sessionId"]).index("session_id_first_used", ["sessionId", "firstUsedTime"]).index("session_id_parent_refresh_token_id", ["sessionId", "parentRefreshTokenId"]).index("expiration_time", ["expirationTime"]),
+	VerificationCode: defineTable({
+		accountId: v.id("Account"),
+		provider: v.string(),
+		code: v.string(),
+		expirationTime: v.number(),
+		verifier: v.optional(v.string()),
+		emailVerified: v.optional(v.string()),
+		phoneVerified: v.optional(v.string())
+	}).index("account_id", ["accountId"]).index("code", ["code"]).index("expiration_time", ["expirationTime"]),
+	AuthVerifier: defineTable({
+		sessionId: v.optional(v.id("Session")),
+		signature: v.optional(v.string()),
+		expirationTime: v.optional(v.number())
+	}).index("signature", ["signature"]).index("expiration_time", ["expirationTime"]),
+	SignInLimit: defineTable({
+		identifier: v.string(),
+		tokens: v.number(),
+		updatedAt: v.number()
+	}).index("identifier", ["identifier"]).index("updated_at", ["updatedAt"]),
+	Passkey: defineTable({
+		userId: v.id("User"),
+		credentialId: v.string(),
+		publicKey: v.bytes(),
+		algorithm: v.number(),
+		counter: v.number(),
+		transports: v.optional(v.array(v.string())),
+		deviceType: v.string(),
+		backedUp: v.boolean(),
+		name: v.optional(v.string()),
+		attestation: v.optional(v.object({
+			verifier: v.string(),
+			aaguid: v.string(),
+			format: v.string(),
+			metadataDescription: v.optional(v.string()),
+			verifiedAt: v.number(),
+			status: v.literal("trusted")
+		})),
+		createdAt: v.number(),
+		lastUsedAt: v.optional(v.number())
+	}).index("user_id", ["userId"]).index("credential_id", ["credentialId"]),
+	TotpFactor: defineTable({
+		userId: v.id("User"),
+		secret: v.bytes(),
+		digits: v.number(),
+		period: v.number(),
+		verified: v.boolean(),
+		name: v.optional(v.string()),
+		createdAt: v.number(),
+		lastUsedAt: v.optional(v.number())
+	}).index("user_id", ["userId"]).index("user_id_verified", ["userId", "verified"]),
+	DeviceCode: defineTable({
+		deviceCodeHash: v.string(),
+		userCode: v.string(),
+		expiresAt: v.number(),
+		interval: v.number(),
+		status: vDeviceStatus,
+		userId: v.optional(v.id("User")),
+		sessionId: v.optional(v.id("Session")),
+		lastPolledAt: v.optional(v.number())
+	}).index("device_code_hash", ["deviceCodeHash"]).index("user_code_status", ["userCode", "status"]).index("expires_at", ["expiresAt"]),
+	Group: defineTable({
+		name: v.string(),
+		slug: v.optional(v.string()),
+		type: v.optional(v.string()),
+		parentGroupId: v.optional(v.id("Group")),
+		rootGroupId: v.optional(v.id("Group")),
+		isRoot: v.optional(v.boolean()),
+		policy: v.optional(vGroupConnectionPolicy),
+		extend: v.optional(v.any()),
+		tags: v.optional(v.any())
+	}).index("name", ["name"]).index("slug", ["slug"]).index("parent_group_id", ["parentGroupId"]).index("parent_group_id_name", ["parentGroupId", "name"]).index("parent_group_id_slug", ["parentGroupId", "slug"]).index("parent_group_id_type", ["parentGroupId", "type"]).index("root_group_id", ["rootGroupId"]).index("is_root", ["isRoot"]).index("type", ["type"]).index("type_parent_group_id", ["type", "parentGroupId"]),
+	GroupHierarchyOperation: defineTable({
+		groupId: v.id("Group"),
+		kind: v.union(v.literal("remove"), v.literal("restamp")),
+		phase: v.union(v.literal("planning"), v.literal("applying"), v.literal("cleaning")),
+		newRootGroupId: v.optional(v.id("Group")),
+		expectedParentGroupId: v.optional(v.id("Group"))
+	}).index("group_id_kind", ["groupId", "kind"]).index("group_id_kind_parent_root", [
+		"groupId",
+		"kind",
+		"expectedParentGroupId",
+		"newRootGroupId"
+	]),
+	GroupHierarchyWork: defineTable({
+		operationId: v.id("GroupHierarchyOperation"),
+		kind: v.union(v.literal("remove"), v.literal("restamp")),
+		groupId: v.id("Group"),
+		parentWorkId: v.optional(v.id("GroupHierarchyWork")),
+		expectedParentGroupId: v.optional(v.id("Group")),
+		depth: v.number(),
+		planned: v.boolean(),
+		applied: v.boolean(),
+		eligible: v.optional(v.boolean()),
+		scanCursor: v.optional(v.string())
+	}).index("operation_id_group_id", ["operationId", "groupId"]).index("operation_id_planned", ["operationId", "planned"]).index("operation_id_applied_depth", [
+		"operationId",
+		"applied",
+		"depth"
+	]).index("group_id", ["groupId"]).index("group_id_kind", ["groupId", "kind"]),
+	GroupMember: defineTable({
+		groupId: v.id("Group"),
+		userId: v.id("User"),
+		role: v.optional(v.string()),
+		roleIds: v.optional(v.array(v.string())),
+		status: v.optional(v.string()),
+		extend: v.optional(v.any())
+	}).index("group_id", ["groupId"]).index("group_id_user_id", ["groupId", "userId"]).index("group_id_status", ["groupId", "status"]).index("user_id", ["userId"]).index("user_id_status", ["userId", "status"]).index("status", ["status"]),
+	GroupInvite: defineTable({
+		groupId: v.optional(v.id("Group")),
+		invitedByUserId: v.optional(v.id("User")),
+		email: v.optional(v.string()),
+		tokenHash: v.string(),
+		role: v.optional(v.string()),
+		roleIds: v.optional(v.array(v.string())),
+		status: vInviteStatus,
+		expiresTime: v.optional(v.number()),
+		acceptedByUserId: v.optional(v.id("User")),
+		acceptedTime: v.optional(v.number()),
+		extend: v.optional(v.any())
+	}).index("token_hash", ["tokenHash"]).index("status", ["status"]).index("email_status", ["email", "status"]).index("email_group_id_status", [
+		"email",
+		"groupId",
+		"status"
+	]).index("invited_by_user_id_status", ["invitedByUserId", "status"]).index("group_id", ["groupId"]).index("group_id_status", ["groupId", "status"]).index("group_id_email_status", [
+		"groupId",
+		"email",
+		"status"
+	]).index("expires_time", ["expiresTime"]),
+	GroupConnection: defineTable({
+		groupId: v.id("Group"),
+		slug: v.optional(v.string()),
+		name: v.optional(v.string()),
+		protocol: vGroupConnectionProtocol,
+		status: vGroupConnectionStatus,
+		config: v.optional(v.any()),
+		extend: v.optional(v.any())
+	}).index("group_id", ["groupId"]).index("name", ["name"]).index("slug", ["slug"]).index("status", ["status"]).index("group_id_name", ["groupId", "name"]).index("group_id_status", ["groupId", "status"]).index("group_id_slug", ["groupId", "slug"]),
+	GroupConnectionDomain: defineTable({
+		connectionId: v.id("GroupConnection"),
+		groupId: v.id("Group"),
+		domain: v.string(),
+		isPrimary: v.boolean(),
+		verifiedAt: v.optional(v.number())
+	}).index("connection_id", ["connectionId"]).index("group_id", ["groupId"]).index("domain", ["domain"]),
+	SamlLoginRequest: defineTable({
+		connectionId: v.id("GroupConnection"),
+		requestId: v.string(),
+		createdAt: v.number(),
+		expiresAt: v.number(),
+		acceptedAt: v.optional(v.number())
+	}).index("request_id", ["requestId"]).index("expires_at", ["expiresAt"]),
+	SamlSeenAssertion: defineTable({
+		connectionId: v.id("GroupConnection"),
+		assertionId: v.string(),
+		expiresAt: v.number()
+	}).index("connection_id_assertion_id", ["connectionId", "assertionId"]).index("expires_at", ["expiresAt"]),
+	GroupConnectionDomainVerification: defineTable({
+		connectionId: v.id("GroupConnection"),
+		groupId: v.id("Group"),
+		domainId: v.id("GroupConnectionDomain"),
+		domain: v.string(),
+		recordName: v.string(),
+		token: v.string(),
+		tokenHash: v.string(),
+		requestedAt: v.number(),
+		expiresAt: v.number()
+	}).index("connection_id", ["connectionId"]).index("domain_id", ["domainId"]).index("token_hash", ["tokenHash"]).index("expires_at", ["expiresAt"]),
+	GroupConnectionSecret: defineTable({
+		connectionId: v.id("GroupConnection"),
+		groupId: v.id("Group"),
+		kind: vGroupConnectionSecretKind,
+		ciphertext: v.string(),
+		updatedAt: v.number()
+	}).index("connection_id", ["connectionId"]).index("connection_id_kind", ["connectionId", "kind"]).index("group_id", ["groupId"]),
+	GroupConnectionScimConfig: defineTable({
+		connectionId: v.id("GroupConnection"),
+		groupId: v.id("Group"),
+		status: vScimStatus,
+		basePath: v.string(),
+		tokenHash: v.string(),
+		lastRotatedAt: v.optional(v.number()),
+		extend: v.optional(v.any())
+	}).index("group_connection_id", ["connectionId"]).index("group_id", ["groupId"]).index("token_hash", ["tokenHash"]).index("status", ["status"]),
+	GroupConnectionScimIdentity: defineTable({
+		connectionId: v.id("GroupConnection"),
+		groupId: v.id("Group"),
+		resourceType: vScimResourceType,
+		externalId: v.string(),
+		userId: v.optional(v.id("User")),
+		mappedGroupId: v.optional(v.id("Group")),
+		lastProvisionedAt: v.optional(v.number()),
+		active: v.optional(v.boolean()),
+		raw: v.optional(v.any())
+	}).index("group_connection_id", ["connectionId"]).index("group_id", ["groupId"]).index("group_connection_id_resource_type_external_id", [
+		"connectionId",
+		"resourceType",
+		"externalId"
+	]).index("group_connection_id_user_id", ["connectionId", "userId"]).index("user_id", ["userId"]).index("mapped_group_id", ["mappedGroupId"]),
+	AuthEventProjection: defineTable({
+		eventId: v.string(),
+		targetKind: vAuthEventTargetKind,
+		targetId: v.string(),
+		kind: vAuthEventKind,
+		category: vAuthEventCategory,
+		occurredAt: v.number(),
+		actorType: vAuthEventActorType,
+		actorId: v.optional(v.string()),
+		subjectType: vAuthEventSubjectType,
+		subjectId: v.optional(v.string()),
+		outcome: vAuthEventOutcome,
+		errorCode: v.optional(v.string()),
+		requestId: v.optional(v.string()),
+		ip: v.optional(v.string()),
+		userAgent: v.optional(v.string()),
+		data: v.optional(vAuthEventData),
+		streamId: v.optional(v.string()),
+		streamIndex: v.optional(v.number())
+	}).index("target_time", [
+		"targetKind",
+		"targetId",
+		"occurredAt"
+	]).index("target_kind_time", [
+		"targetKind",
+		"targetId",
+		"kind",
+		"occurredAt"
+	]).index("target_outcome_time", [
+		"targetKind",
+		"targetId",
+		"outcome",
+		"occurredAt"
+	]).index("target_kind_outcome_time", [
+		"targetKind",
+		"targetId",
+		"kind",
+		"outcome",
+		"occurredAt"
+	]).index("event_id_target", [
+		"eventId",
+		"targetKind",
+		"targetId"
+	]).index("kind_time", ["kind", "occurredAt"]).index("category_time", ["category", "occurredAt"]).index("outcome_time", ["outcome", "occurredAt"]).index("actor_time", [
+		"actorType",
+		"actorId",
+		"occurredAt"
+	]).index("subject_time", [
+		"subjectType",
+		"subjectId",
+		"occurredAt"
+	]).index("request_id_time", ["requestId", "occurredAt"]).index("occurred_at", ["occurredAt"]),
+	GroupWebhookEndpoint: defineTable({
+		connectionId: v.id("GroupConnection"),
+		groupId: v.id("Group"),
+		url: v.string(),
+		status: vWebhookEndpointStatus,
+		secretCiphertext: v.optional(v.string()),
+		secretHash: v.optional(v.string()),
+		subscriptions: v.array(v.string()),
+		createdByUserId: v.optional(v.id("User")),
+		lastSuccessAt: v.optional(v.number()),
+		lastFailureAt: v.optional(v.number()),
+		failureCount: v.number(),
+		extend: v.optional(v.any())
+	}).index("group_connection_id", ["connectionId"]).index("group_id", ["groupId"]).index("status", ["status"]),
+	GroupWebhookDelivery: defineTable({
+		connectionId: v.id("GroupConnection"),
+		endpointId: v.id("GroupWebhookEndpoint"),
+		eventId: v.optional(v.string()),
+		kind: v.optional(vAuthEventKind),
+		status: vWebhookDeliveryStatus,
+		attemptCount: v.number(),
+		nextAttemptAt: v.number(),
+		lastAttemptAt: v.optional(v.number()),
+		lastResponseStatus: v.optional(v.number()),
+		lastError: v.optional(v.string()),
+		payload: v.any(),
+		signature: v.optional(v.string()),
+		signedAt: v.optional(v.number()),
+		eventType: v.optional(v.string()),
+		auditEventId: v.optional(v.string())
+	}).index("group_connection_id", ["connectionId"]).index("status_next_attempt_at", ["status", "nextAttemptAt"]).index("status_signed_at", ["status", "signedAt"]).index("endpoint_id_status", ["endpointId", "status"]).index("event_id", ["eventId"]).index("event_id_endpoint_id", ["eventId", "endpointId"]),
+	ApiKey: defineTable({
+		userId: v.id("User"),
+		prefix: v.string(),
+		hashedKey: v.string(),
+		name: v.string(),
+		scopes: v.array(vApiKeyScope),
+		rateLimit: v.optional(vApiKeyRateLimit),
+		rateLimitState: v.optional(vApiKeyRateLimitState),
+		expiresAt: v.optional(v.number()),
+		lastUsedAt: v.optional(v.number()),
+		createdAt: v.number(),
+		revoked: v.boolean(),
+		extend: v.optional(v.any()),
+		metadata: v.optional(v.any())
+	}).index("user_id", ["userId"]).index("hashed_key", ["hashedKey"]),
+	OAuthClient: defineTable({
+		clientId: v.string(),
+		clientSecretHash: v.optional(v.string()),
+		name: v.string(),
+		redirectUris: v.array(v.string()),
+		scopes: v.array(v.string()),
+		grantTypes: v.array(v.string()),
+		tokenEndpointAuthMethod: v.optional(vTokenEndpointAuthMethod),
+		registrationAccessTokenHash: v.optional(v.string()),
+		createdBy: v.optional(v.id("User")),
+		revoked: v.boolean(),
+		revokedAt: v.optional(v.number()),
+		extend: v.optional(v.any())
+	}).index("client_id", ["clientId"]).index("created_by", ["createdBy"]).index("created_by_revoked", ["createdBy", "revoked"]).index("revoked", ["revoked"]).index("revoked_at", ["revoked", "revokedAt"]),
+	OAuthCode: defineTable({
+		codeHash: v.string(),
+		userId: v.id("User"),
+		clientId: v.string(),
+		redirectUri: v.string(),
+		scopes: v.array(v.string()),
+		codeChallenge: v.string(),
+		resource: v.optional(v.string()),
+		expiresAt: v.number(),
+		usedAt: v.optional(v.number())
+	}).index("code_hash", ["codeHash"]).index("user_id", ["userId"]).index("expires_at", ["expiresAt"]),
+	OAuthRefreshGrant: defineTable({
+		clientId: v.string(),
+		userId: v.id("User"),
+		scopes: v.array(v.string()),
+		resource: v.optional(v.string()),
+		expiresAt: v.number(),
+		revokedAt: v.optional(v.number())
+	}).index("expires_at", ["expiresAt"]).index("revoked_at", ["revokedAt"]),
+	OAuthRefreshToken: defineTable({
+		tokenHash: v.string(),
+		grantId: v.optional(v.id("OAuthRefreshGrant")),
+		expiresAt: v.number(),
+		firstUsedTime: v.optional(v.number()),
+		parentTokenId: v.optional(v.id("OAuthRefreshToken"))
+	}).index("token_hash", ["tokenHash"]).index("grant_id", ["grantId"]).index("grant_id_first_used", ["grantId", "firstUsedTime"]).index("grant_id_parent_token_id_first_used", [
+		"grantId",
+		"parentTokenId",
+		"firstUsedTime"
+	]).index("expires_at", ["expiresAt"])
+});
+
+//#endregion
+export { schema_default as default };
+//# sourceMappingURL=schema.js.map

package/dist/component/session.js

@@ -0,0 +1,134 @@
+import { vSessionDoc, vUserDoc } from "./model.js";
+import { mutation, query } from "./_generated/server.js";
+import { v } from "convex/values";
+
+//#region src/component/session.ts
+/**
+* `component.session.*` — auth sessions.
+*
+* `issue` is a kept domain verb (token issuance).
+*
+* @module
+*/
+const SESSION_TOKEN_DELETE_BATCH = 1024;
+/**
+* Create or rotate session rows inside an existing component mutation.
+*
+* Keeping the database work in a plain helper lets factor-specific completion
+* mutations commit their anti-replay state and the new session atomically,
+* without nesting another `ctx.runMutation` transaction.
+*
+* @internal
+*/
+async function createSessionRows(ctx, args) {
+	const user = await ctx.db.get("User", args.userId);
+	if (user === null) return null;
+	let sessionId = args.sessionId;
+	let replacedSessionId = args.replaceSessionId;
+	if (sessionId === void 0) {
+		if (replacedSessionId !== void 0) {
+			if (await ctx.db.get("Session", replacedSessionId) !== null) await ctx.db.delete("Session", replacedSessionId);
+			else replacedSessionId = void 0;
+			const existingTokens = await ctx.db.query("RefreshToken").withIndex("session_id", (q) => q.eq("sessionId", args.replaceSessionId)).take(SESSION_TOKEN_DELETE_BATCH);
+			await Promise.all(existingTokens.map((token) => ctx.db.delete("RefreshToken", token._id)));
+		}
+		sessionId = await ctx.db.insert("Session", {
+			userId: user._id,
+			expirationTime: args.sessionExpirationTime
+		});
+	}
+	const refreshTokenId = args.refreshTokenExpirationTime === void 0 ? void 0 : await ctx.db.insert("RefreshToken", {
+		sessionId,
+		expirationTime: args.refreshTokenExpirationTime
+	});
+	return {
+		user,
+		sessionId,
+		...refreshTokenId === void 0 ? {} : { refreshTokenId },
+		...replacedSessionId === void 0 ? {} : { replacedSessionId }
+	};
+}
+/** Read a session by id. */
+const get = query({
+	args: { id: v.id("Session") },
+	returns: v.union(vSessionDoc, v.null()),
+	handler: async (ctx, { id: sessionId }) => {
+		return await ctx.db.get("Session", sessionId);
+	}
+});
+/** List the sessions owned by a user. */
+const list = query({
+	args: { userId: v.id("User") },
+	returns: v.array(vSessionDoc),
+	handler: async (ctx, { userId }) => {
+		return await ctx.db.query("Session").withIndex("user_id", (q) => q.eq("userId", userId)).take(REVOKE_FOR_USER_MAX);
+	}
+});
+/**
+* Create (or rotate) a session together with its first refresh token.
+* Returns the resolved `{ userId, sessionId, refreshTokenId }` — a command
+* summary rather than `v.null()` — because callers need the freshly minted
+* ids to mint tokens and set cookies. When a `replaceSessionId` session was
+* present and deleted, its id is echoed back as `replacedSessionId` so the
+* caller can emit a `session.invalidated` audit event for the terminated
+* session.
+*/
+const create = mutation({
+	args: {
+		userId: v.id("User"),
+		sessionId: v.optional(v.id("Session")),
+		replaceSessionId: v.optional(v.id("Session")),
+		sessionExpirationTime: v.number(),
+		refreshTokenExpirationTime: v.optional(v.number())
+	},
+	returns: v.object({
+		userId: v.id("User"),
+		sessionId: v.id("Session"),
+		refreshTokenId: v.optional(v.id("RefreshToken")),
+		replacedSessionId: v.optional(v.id("Session")),
+		user: vUserDoc
+	}),
+	handler: async (ctx, args) => {
+		const created = await createSessionRows(ctx, args);
+		if (created === null) throw new Error(`Cannot create a session for missing user ${args.userId}`);
+		return {
+			userId: args.userId,
+			...created
+		};
+	}
+});
+/** Delete a session (no-op if it no longer exists). */
+const remove = mutation({
+	args: { id: v.id("Session") },
+	returns: v.null(),
+	handler: async (ctx, { id: sessionId }) => {
+		if (await ctx.db.get("Session", sessionId) !== null) await ctx.db.delete("Session", sessionId);
+		return null;
+	}
+});
+/** Upper bound on sessions revoked in one de-provisioning transaction. */
+const REVOKE_FOR_USER_MAX = 1e3;
+/**
+* Revoke every session a user owns, deleting each session and all of its
+* refresh tokens in one atomic transaction. Used on SSO de-provisioning so an
+* offboarded user's live session cookie and long-lived refresh token stop
+* working immediately rather than at natural expiry. Bounded at
+* {@link REVOKE_FOR_USER_MAX} sessions per call; returns the number revoked.
+*/
+const revokeForUser = mutation({
+	args: { userId: v.id("User") },
+	returns: v.object({ revoked: v.number() }),
+	handler: async (ctx, { userId }) => {
+		const sessions = await ctx.db.query("Session").withIndex("user_id", (q) => q.eq("userId", userId)).take(REVOKE_FOR_USER_MAX);
+		for (const session of sessions) {
+			const tokens = await ctx.db.query("RefreshToken").withIndex("session_id", (q) => q.eq("sessionId", session._id)).take(SESSION_TOKEN_DELETE_BATCH);
+			for (const token of tokens) await ctx.db.delete("RefreshToken", token._id);
+			await ctx.db.delete("Session", session._id);
+		}
+		return { revoked: sessions.length };
+	}
+});
+
+//#endregion
+export { create, createSessionRows, get, list, remove, revokeForUser };
+//# sourceMappingURL=session.js.map

package/dist/component/token/pkce.js

@@ -0,0 +1,121 @@
+import { vAuthVerifierDoc } from "../model.js";
+import { mutation, query } from "../_generated/server.js";
+import { v } from "convex/values";
+import { getOneFrom } from "convex-helpers/server/relationships";
+
+//#region src/component/token/pkce.ts
+/**
+* `component.token.pkce.*` — PKCE verifiers.
+*
+* Reads collapse into one overloaded `get`.
+*
+* @module
+*/
+const DEFAULT_VERIFIER_TTL_MS = 1e3 * 60 * 15;
+async function getUnexpiredVerifier(ctx, verifierId) {
+	const verifier = await ctx.db.get("AuthVerifier", verifierId);
+	if (verifier?.expirationTime !== void 0 && verifier.expirationTime < Date.now()) return null;
+	return verifier;
+}
+/**
+* Read a verifier by `id` or `signature`, returning `null` once expired.
+* Accepts exactly one selector.
+*/
+const get = query({
+	args: {
+		id: v.optional(v.id("AuthVerifier")),
+		signature: v.optional(v.string())
+	},
+	returns: v.union(vAuthVerifierDoc, v.null()),
+	handler: async (ctx, args) => {
+		if (args.signature !== void 0) {
+			const verifier = await getOneFrom(ctx.db, "AuthVerifier", "signature", args.signature);
+			if (verifier?.expirationTime !== void 0 && verifier.expirationTime < Date.now()) return null;
+			return verifier;
+		}
+		if (args.id === void 0) return null;
+		return await getUnexpiredVerifier(ctx, args.id);
+	}
+});
+/**
+* Atomically consume a verifier: read → validate → delete in ONE transaction,
+* returning the consumed doc to the single winner and `null` to everyone else
+* (unknown / expired / signature mismatch / already consumed).
+*
+* The passkey and TOTP ceremonies run in actions, where reading the verifier
+* (`get`) and deleting it (`remove`) are two separate transactions: two
+* concurrent requests carrying the same verifier could both pass the read +
+* signature check before either delete landed, each then minting its own
+* session (duplicate sign-in). Folding read + optional signature match + delete
+* into this single mutation makes the row's transaction the serialization
+* point — the first caller deletes and returns the doc; a racing caller retries
+* under OCC, re-reads the now-absent row, and gets `null`.
+*
+* A signature mismatch does NOT delete the row (a wrong guess must not burn a
+* legitimate pending verifier); an expired row IS deleted but reported as not
+* consumed.
+*/
+const consume = mutation({
+	args: {
+		id: v.optional(v.id("AuthVerifier")),
+		signature: v.optional(v.string()),
+		expectedSignature: v.optional(v.string())
+	},
+	returns: v.union(vAuthVerifierDoc, v.null()),
+	handler: async (ctx, { id, signature, expectedSignature }) => {
+		const verifier = signature !== void 0 ? await getOneFrom(ctx.db, "AuthVerifier", "signature", signature) : id !== void 0 ? await ctx.db.get("AuthVerifier", id) : null;
+		if (verifier === null) return null;
+		if (verifier.expirationTime !== void 0 && verifier.expirationTime < Date.now()) {
+			await ctx.db.delete("AuthVerifier", verifier._id);
+			return null;
+		}
+		if (expectedSignature !== void 0 && verifier.signature !== expectedSignature) return null;
+		await ctx.db.delete("AuthVerifier", verifier._id);
+		return verifier;
+	}
+});
+/** Create a PKCE verifier, defaulting `expirationTime` to 15 minutes out. */
+const create = mutation({
+	args: {
+		sessionId: v.optional(v.id("Session")),
+		signature: v.optional(v.string()),
+		expirationTime: v.optional(v.number())
+	},
+	returns: v.id("AuthVerifier"),
+	handler: async (ctx, { sessionId, signature, expirationTime }) => {
+		return await ctx.db.insert("AuthVerifier", {
+			sessionId,
+			signature,
+			expirationTime: expirationTime ?? Date.now() + DEFAULT_VERIFIER_TTL_MS
+		});
+	}
+});
+/** Patch a verifier in place. */
+const update = mutation({
+	args: {
+		id: v.id("AuthVerifier"),
+		patch: v.object({
+			sessionId: v.optional(v.id("Session")),
+			signature: v.optional(v.string()),
+			expirationTime: v.optional(v.number())
+		})
+	},
+	returns: v.null(),
+	handler: async (ctx, { id: verifierId, patch }) => {
+		await ctx.db.patch("AuthVerifier", verifierId, patch);
+		return null;
+	}
+});
+/** Delete a verifier by id. */
+const remove = mutation({
+	args: { id: v.id("AuthVerifier") },
+	returns: v.null(),
+	handler: async (ctx, { id: verifierId }) => {
+		await ctx.db.delete("AuthVerifier", verifierId);
+		return null;
+	}
+});
+
+//#endregion
+export { consume, create, get, remove, update };
+//# sourceMappingURL=pkce.js.map