@estifanos-sh/convex-auth 0.0.1-preview.0

package/dist/server/cache/context.js

@@ -0,0 +1,94 @@
+//#region src/server/cache/context.ts
+/**
+* Per-execution cache for Convex auth component reads.
+*
+* Convex components are invoked across a function boundary — every
+* `auth.user.get`, `auth.member.get`, `getGroupConnection`, etc. is
+* `ctx.runQuery(components.auth.…)`. Each crossing costs ~10–30ms.
+* Inside a single handler we often fetch the same entity several times
+* (outer `auth.ctx()` resolver + inner `auth.member.assert` calls +
+* Connection admin authorizer target resolution + the handler body itself).
+*
+* This module attaches a `Map<string, Promise<unknown>>` to the ctx via
+* a Symbol so that concurrent and repeated reads of the same key within
+* a single function invocation share one component round-trip. The cache
+* lives for the lifetime of the ctx object and dies with it.
+*
+* Semantics:
+* - Keys are namespaced strings (`user:abc`, `group:xyz`, etc.).
+* - Promises are stored — two concurrent callers dedup correctly.
+* - Rejected promises are evicted so a retry can succeed.
+* - Writes do **not** automatically invalidate reads; this matches the
+*   Convex transactional model where a mutation sees its own writes only
+*   on subsequent calls. If a handler writes and then re-reads an entity
+*   expecting fresh data, it must call {@link invalidateCtxCache} with the
+*   appropriate key (or key prefix).
+*
+* @module
+* @internal
+*/
+const CACHE_SYMBOL = Symbol.for("@estifanos-sh/convex-auth/ctxCache");
+/**
+* Get (or lazily create) the cache store attached to a Convex ctx.
+* @internal
+*/
+function getCtxCache(ctx) {
+	const c = ctx;
+	let store = c[CACHE_SYMBOL];
+	if (store === void 0) {
+		store = /* @__PURE__ */ new Map();
+		c[CACHE_SYMBOL] = store;
+	}
+	return store;
+}
+/**
+* Check whether the ctx cache already holds an entry under `key`.
+*
+* Useful before a batched fetch: callers can short-circuit the RPC if every
+* needed ID is already cached, or compute the exact subset to request.
+*
+* @internal
+*/
+function ctxCacheHas(ctx, key) {
+	return getCtxCache(ctx).has(key);
+}
+/**
+* Memoize an async read against the ctx cache.
+*
+* The returned promise is cached under `key`; concurrent callers get the
+* same in-flight promise. If the promise rejects, the entry is removed so a
+* later retry can succeed.
+*
+* @internal
+*/
+function cached(ctx, key, fn) {
+	const store = getCtxCache(ctx);
+	const hit = store.get(key);
+	if (hit !== void 0) return hit;
+	const promise = fn().catch((err) => {
+		if (store.get(key) === promise) store.delete(key);
+		throw err;
+	});
+	store.set(key, promise);
+	return promise;
+}
+/**
+* Drop a single cache entry (or all entries matching a prefix).
+*
+* Use this from mutations that write to an entity the cache already holds.
+* Passing no prefix clears the entire cache.
+*
+* @internal
+*/
+function invalidateCtxCache(ctx, keyPrefix) {
+	const store = getCtxCache(ctx);
+	if (keyPrefix === void 0 || keyPrefix === "") {
+		store.clear();
+		return;
+	}
+	for (const key of store.keys()) if (key === keyPrefix || key.startsWith(`${keyPrefix}:`)) store.delete(key);
+}
+
+//#endregion
+export { cached, ctxCacheHas, invalidateCtxCache };
+//# sourceMappingURL=context.js.map

package/dist/server/component/api.d.ts

@@ -0,0 +1,14 @@
+import { ComponentApi } from "../../component/_generated/component.js";
+
+//#region src/server/component/api.d.ts
+/**
+ * The auth component's API surface — the full generated `ComponentApi<"auth">`,
+ * with argument and return validators intact. Nesting and function kinds come
+ * from codegen, so it never drifts from the component. The loose
+ * `runQuery`/`runMutation` casts in the generic server layer are a local
+ * convenience at those call sites, not an erasure baked into this type.
+ */
+type AuthComponentApi = ComponentApi<"auth">;
+//#endregion
+export { AuthComponentApi };
+//# sourceMappingURL=api.d.ts.map

package/dist/server/component/api.js

@@ -0,0 +1,13 @@
+//#region src/server/component/api.ts
+/**
+* Narrow an overloaded `get` result — `Doc | (Doc | null)[] | null` — to a
+* single `Doc | null`. Use at call sites that pass a single selector to a
+* `get` whose return validator unions the single and batch shapes.
+*/
+function single(result) {
+	return Array.isArray(result) ? result[0] ?? null : result;
+}
+
+//#endregion
+export { single };
+//# sourceMappingURL=api.js.map

package/dist/server/component/context.d.ts

@@ -0,0 +1,16 @@
+import { GenericActionCtx, GenericDataModel } from "convex/server";
+
+//#region src/server/component/context.d.ts
+type RunCtx = GenericActionCtx<GenericDataModel>;
+type ComponentReadCtx = {
+  runQuery: RunCtx["runQuery"];
+};
+type ComponentCtx = ComponentReadCtx & {
+  runMutation: RunCtx["runMutation"];
+};
+type ComponentActionCtx = ComponentCtx & {
+  runAction: RunCtx["runAction"];
+};
+//#endregion
+export { ComponentActionCtx, ComponentCtx, ComponentReadCtx };
+//# sourceMappingURL=context.d.ts.map

package/dist/server/component/context.js

@@ -0,0 +1 @@
+export {  };

package/dist/server/component/factor/db.js

@@ -0,0 +1,71 @@
+//#region src/server/component/factor/db.ts
+/**
+* Atomically consume a PKCE verifier by ID across the component boundary,
+* returning the consumed doc to the single winner and `null` otherwise (unknown
+* / expired / signature mismatch / already consumed). Replaces the racy
+* read-then-remove so concurrent passkey/TOTP ceremonies cannot each consume the
+* same verifier and mint duplicate sessions. When `expectedSignature` is given,
+* the row is consumed only if its signature matches (a mismatch leaves it
+* intact).
+*/
+async function consumeVerifierById(ctx, verifierId, expectedSignature) {
+	return await ctx.runMutation(ctx.auth.config.component.token.pkce.consume, {
+		id: verifierId,
+		...expectedSignature === void 0 ? {} : { expectedSignature }
+	});
+}
+/** Fetch a user's verified TOTP factor across the component boundary. */
+async function queryTotpVerifiedByUserId(ctx, userId) {
+	return await ctx.runQuery(ctx.auth.config.component.factor.totp.get, { verifiedForUserId: userId });
+}
+/** Create a registration challenge and load registration context in one component transaction. */
+async function mutatePasskeyBeginRegistration(ctx, args) {
+	return await ctx.runMutation(ctx.auth.config.component.factor.passkey.beginRegistration, args);
+}
+/** Create a sign-in challenge and resolve its optional email allow-list atomically. */
+async function mutatePasskeyBeginSignIn(ctx, args) {
+	return await ctx.runMutation(ctx.auth.config.component.factor.passkey.beginSignIn, args);
+}
+/** Consume a WebAuthn challenge and load its credential in one component transaction. */
+async function mutatePasskeyBeginAssertion(ctx, args) {
+	return await ctx.runMutation(ctx.auth.config.component.factor.passkey.beginAssertion, {
+		verifierId: args.verifierId,
+		expectedChallenge: args.expectedChallenge,
+		credentialId: args.credentialId
+	});
+}
+/** Store a verified registration and create its session in one component transaction. */
+async function mutatePasskeyCompleteRegistration(ctx, args) {
+	return await ctx.runMutation(ctx.auth.config.component.factor.passkey.completeRegistration, args);
+}
+/** Atomically accept a verified assertion and create its session. */
+async function mutatePasskeyCompleteAssertion(ctx, args) {
+	return await ctx.runMutation(ctx.auth.config.component.factor.passkey.completeAssertion, args);
+}
+/** Insert a device-authorization record across the component boundary; returns its ID. */
+async function mutateDeviceInsert(ctx, args) {
+	return await ctx.runMutation(ctx.auth.config.component.factor.device.create, args);
+}
+/** Fetch a device-authorization record by code hash across the component boundary. */
+async function queryDeviceByCodeHash(ctx, deviceCodeHash) {
+	return await ctx.runQuery(ctx.auth.config.component.factor.device.get, { deviceCodeHash });
+}
+/** Fetch a device-authorization record by user code across the component boundary. */
+async function queryDeviceByUserCode(ctx, userCode) {
+	return await ctx.runQuery(ctx.auth.config.component.factor.device.get, { userCode });
+}
+/** Update a device-authorization record's `lastPolledAt` across the component boundary. */
+async function mutateDeviceUpdateLastPolled(ctx, deviceId, lastPolledAt) {
+	await ctx.runMutation(ctx.auth.config.component.factor.device.update, {
+		id: deviceId,
+		patch: { lastPolledAt }
+	});
+}
+/** Remove a device-authorization record by ID across the component boundary. */
+async function mutateDeviceRemove(ctx, deviceId) {
+	await ctx.runMutation(ctx.auth.config.component.factor.device.remove, { id: deviceId });
+}
+
+//#endregion
+export { consumeVerifierById, mutateDeviceInsert, mutateDeviceRemove, mutateDeviceUpdateLastPolled, mutatePasskeyBeginAssertion, mutatePasskeyBeginRegistration, mutatePasskeyBeginSignIn, mutatePasskeyCompleteAssertion, mutatePasskeyCompleteRegistration, queryDeviceByCodeHash, queryDeviceByUserCode, queryTotpVerifiedByUserId };
+//# sourceMappingURL=db.js.map

package/dist/server/config.d.ts

@@ -0,0 +1,3 @@
+import "./events.js";
+import "./types.js";
+import "./index.js";

package/dist/server/config.js

@@ -0,0 +1,78 @@
+import { envOptionalString } from "./env.js";
+import { normalizeAuthPath } from "./url.js";
+
+//#region src/server/config.ts
+/**
+* Resolve raw provider configs into materialized form and apply defaults.
+*/
+function configDefaults(config_) {
+	const config = materializeAndDefaultProviders(config_);
+	const extraProviders = config.providers.filter((p) => p.type === "credentials").map((p) => p.extraProviders).flat().filter((p) => p !== void 0);
+	return {
+		...config,
+		path: normalizeAuthPath(config.path),
+		permissions: normalizePermissionsConfig(config.permissions),
+		telemetry: normalizeTelemetryConfig(config.telemetry),
+		extraProviders: materializeProviders(extraProviders)
+	};
+}
+/**
+* List available provider IDs for error messages.
+*/
+function listAvailableProviders(config, allowExtraProviders) {
+	const availableProviders = config.providers.concat(allowExtraProviders ? config.extraProviders : []).map((provider) => `\`${provider.id}\``);
+	return availableProviders.length > 0 ? availableProviders.join(", ") : "no providers have been configured";
+}
+function materializeProviders(providers) {
+	const config = {
+		providers,
+		component: {}
+	};
+	materializeAndDefaultProviders(config);
+	return config.providers;
+}
+function materializeProviderConfig(raw) {
+	const resolved = typeof raw === "function" ? raw() : raw;
+	return "options" in resolved && typeof resolved.options === "object" && resolved.options !== null ? {
+		...resolved,
+		...resolved.options
+	} : resolved;
+}
+function materializeAndDefaultProviders(config_) {
+	const allProviders = [];
+	for (const raw of config_.providers) allProviders.push(materializeProviderConfig(raw));
+	const config = {
+		...config_,
+		providers: allProviders
+	};
+	config.providers.forEach((provider) => {
+		if (provider.type === "phone") {
+			const ID = provider.id.toUpperCase().replace(/-/g, "_");
+			provider.apiKey ??= envOptionalString(`AUTH_${ID}_KEY`);
+		}
+	});
+	return config;
+}
+function normalizePermissionsConfig(permissions) {
+	const declaredGrants = permissions?.grants;
+	return {
+		grants: Array.from(new Set(declaredGrants ?? [])).sort(),
+		roles: Object.fromEntries(Object.entries(permissions?.roles ?? {}).map(([roleId, role]) => [roleId, {
+			...role.label ? { label: role.label } : {},
+			grants: Array.from(new Set(role.grants)).sort()
+		}]))
+	};
+}
+function normalizeTelemetryConfig(telemetry) {
+	const normalized = {
+		includeIdentity: telemetry?.includeIdentity ?? "none",
+		identityFields: telemetry?.identityFields ?? {},
+		...telemetry?.hashIdentity ? { hashIdentity: telemetry.hashIdentity } : {}
+	};
+	if (normalized.includeIdentity === "hashed" && normalized.hashIdentity === void 0) throw new Error("Convex Auth telemetry with `includeIdentity: \"hashed\"` requires a `hashIdentity` function.");
+	return normalized;
+}
+
+//#endregion
+export { configDefaults, listAvailableProviders };
+//# sourceMappingURL=config.js.map

package/dist/server/connection/config.js

@@ -0,0 +1,101 @@
+import { asRecord } from "./shared.js";
+
+//#region src/server/connection/config.ts
+const getProtocolConfig = (config, protocol) => {
+	const base = asRecord(config);
+	const direct = base?.[protocol];
+	const viaProtocols = asRecord(base?.protocols)?.[protocol];
+	return asRecord(direct) ?? asRecord(viaProtocols) ?? {};
+};
+/** @internal */
+function getOidcConfig(config) {
+	return getProtocolConfig(config, "oidc");
+}
+/** @internal */
+function getPublicOidcConfig(config) {
+	const oidc = getOidcConfig(config);
+	if (!oidc.client) return oidc;
+	return {
+		...oidc,
+		client: {
+			...oidc.client,
+			secret: void 0
+		}
+	};
+}
+/** @internal */
+function withOidcSecretState(config, hasClientSecret) {
+	return {
+		...config,
+		hasClientSecret
+	};
+}
+/** @internal */
+function getSamlConfig(config) {
+	return getProtocolConfig(config, "saml");
+}
+/**
+* SAML config with the service-provider private-key material stripped, parallel
+* to `getPublicOidcConfig` stripping the OIDC client secret. The SP signing/
+* decryption keys are stored in config but must never leave the server.
+* @internal
+*/
+function getPublicSamlConfig(config) {
+	const saml = getSamlConfig(config);
+	if (Array.isArray(saml)) return {};
+	const sp = saml.serviceProvider;
+	if (sp === void 0 || sp === null) return saml;
+	if (Array.isArray(sp) || typeof sp !== "object") return {
+		...saml,
+		serviceProvider: void 0
+	};
+	return {
+		...saml,
+		serviceProvider: {
+			...sp,
+			privateKey: void 0,
+			privateKeyPass: void 0,
+			encPrivateKey: void 0,
+			encPrivateKeyPass: void 0
+		}
+	};
+}
+/**
+* Redact every protocol secret from a whole connection config before it is
+* returned to a client: the OIDC client secret and the SAML SP private-key
+* material. Used by the connection read facade (`get`/`list`) which would
+* otherwise hand back the raw stored config.
+* @internal
+*/
+function getPublicConnectionConfig(config) {
+	const base = asRecord(config);
+	if (base === null || Array.isArray(base)) return {};
+	const next = { ...base };
+	const protocols = asRecord(base.protocols);
+	if (protocols === null || Array.isArray(protocols)) delete next.protocols;
+	else next.protocols = {
+		...protocols,
+		...protocols.oidc !== void 0 ? { oidc: getPublicOidcConfig(config) } : {},
+		...protocols.saml !== void 0 ? { saml: getPublicSamlConfig(config) } : {}
+	};
+	if (base.oidc !== void 0) next.oidc = getPublicOidcConfig(config);
+	if (base.saml !== void 0) next.saml = getPublicSamlConfig(config);
+	return next;
+}
+/** @internal */
+function upsertProtocolConfig(config, protocol, protocolConfig) {
+	const base = asRecord(config) ?? {};
+	const protocols = asRecord(base.protocols) ?? {};
+	protocols[protocol] = {
+		...asRecord(protocols[protocol]),
+		...protocolConfig
+	};
+	return {
+		...base,
+		protocols
+	};
+}
+
+//#endregion
+export { getOidcConfig, getPublicConnectionConfig, getPublicOidcConfig, getPublicSamlConfig, getSamlConfig, upsertProtocolConfig, withOidcSecretState };
+//# sourceMappingURL=config.js.map