@estifanos-sh/convex-auth 0.0.1-preview.0

package/dist/server/connection/group/service.d.ts

@@ -0,0 +1,25 @@
+import { AuthEventKind } from "../../../shared/event/kinds.js";
+import "../../component/context.js";
+import { AuthEventActor, AuthEventDataByKind, AuthEventObject, AuthEventOutcome, AuthEventRequest, AuthEventSubject } from "../../events.js";
+import "../../types.js";
+import "../../config.js";
+import "../policy.js";
+
+//#region src/server/connection/group/service.d.ts
+/** Input for emitting a group-scoped auth event (with optional webhook fan-out). */
+type EmitGroupAuthEventInput<K extends AuthEventKind = AuthEventKind> = {
+  connectionId?: string;
+  groupId: string;
+  kind: K;
+  actor: AuthEventActor;
+  subject: AuthEventSubject;
+  outcome?: AuthEventOutcome;
+  request?: AuthEventRequest;
+  data?: AuthEventDataByKind[K];
+  webhook?: false | {
+    payload?: AuthEventObject;
+  };
+};
+//#endregion
+export { EmitGroupAuthEventInput };
+//# sourceMappingURL=service.d.ts.map

package/dist/server/connection/group/service.js

@@ -0,0 +1,250 @@
+import { ErrorCode } from "../../../shared/codes.js";
+import { constantTimeEqualHex } from "../../../shared/compare.js";
+import { emitAuthEvent } from "../../events.js";
+import { convexError } from "../../errors.js";
+import { getGroup, getGroupConnection, getGroupConnectionSecret, getScimConfigByConnection, listWebhookEndpoints } from "../../contract.js";
+import { isGroupSamlSourceActive } from "../shared.js";
+import { normalizeGroupConnectionPolicy } from "../policy.js";
+import { extractBearerToken } from "../../utils/bearer.js";
+import { decryptSecret } from "../../secret.js";
+import { getOidcConfig, getSamlConfig } from "../config.js";
+import { parseScimPath } from "../scim.js";
+import { SHA256 } from "@oslojs/crypto/sha2";
+import { encodeHexLowerCase } from "@oslojs/encoding";
+import { hmac } from "@oslojs/crypto/hmac";
+
+//#region src/server/connection/group/service.ts
+/**
+* Build the runtime group/connection service.
+*
+* Bundles connection and policy loaders, OIDC/SAML config resolution (with
+* secret decryption), policy validation, group-scoped event emission with
+* webhook delivery, and SCIM bearer-token authentication.
+*
+* @returns An object of group-connection service methods.
+*/
+function createGroupService(deps) {
+	const { config, sha256: sha256$1 } = deps;
+	const connectionNotFoundError = "Connection not found.";
+	const getPolicyFromGroup = (group) => normalizeGroupConnectionPolicy(group.policy);
+	const getGroupConnectionSecret$1 = async (ctx, connectionId, kind) => {
+		return await getGroupConnectionSecret(ctx, config.component.connection, {
+			connectionId,
+			kind
+		});
+	};
+	/**
+	* Core OIDC config resolver. Fires the connection fetch (when only the ID
+	* is known) in parallel with the secret fetch, and decrypts lazily once the
+	* secret is available. All three operations are independent until the final
+	* merge, so doing them sequentially was costing 30–60ms per OIDC lookup.
+	*/
+	const resolveOidcConfigWithSecret = async (ctx, connectionId, preloadedConnection) => {
+		const [connection, secret] = await Promise.all([preloadedConnection !== void 0 ? Promise.resolve(preloadedConnection) : getGroupConnection(ctx, config.component.connection, connectionId), getGroupConnectionSecret$1(ctx, connectionId, "oidc_client_secret")]);
+		if (!connection) throw convexError(ErrorCode.INVALID_PARAMETERS, connectionNotFoundError);
+		const oidc = getOidcConfig(connection.config);
+		if (!secret) return oidc;
+		const decrypted = await decryptSecret(secret.ciphertext);
+		const existingClient = typeof oidc.client === "object" && oidc.client !== null ? oidc.client : {};
+		return {
+			...oidc,
+			client: {
+				...existingClient,
+				secret: decrypted
+			}
+		};
+	};
+	const loadGroupPolicyOrThrow = async (ctx, groupId) => {
+		const group = await getGroup(ctx, config.component.group, groupId);
+		if (!group) throw convexError(ErrorCode.INVALID_PARAMETERS, "Group not found.");
+		return getPolicyFromGroup(group);
+	};
+	const loadConnectionOrThrow = async (ctx, connectionId) => {
+		const connection = await getGroupConnection(ctx, config.component.connection, connectionId);
+		if (!connection) throw convexError(ErrorCode.INVALID_PARAMETERS, connectionNotFoundError);
+		return connection;
+	};
+	const loadActiveGroupConnectionOrThrow = async (ctx, connectionId) => {
+		const connection = await loadConnectionOrThrow(ctx, connectionId);
+		if (connection.status !== "active") throw convexError(ErrorCode.INVALID_PARAMETERS, "Group connection is not active.");
+		return connection;
+	};
+	const loadActiveConnectionSamlOrThrow = async (ctx, connectionId) => {
+		const connection = await loadConnectionOrThrow(ctx, connectionId);
+		const loaded = {
+			source: {
+				kind: "connection",
+				id: connectionId
+			},
+			config: connection.config ?? {},
+			status: connection.status,
+			connection
+		};
+		if (!isGroupSamlSourceActive(loaded)) throw convexError(ErrorCode.INVALID_PARAMETERS, "Group connection is not active.");
+		const saml = getSamlConfig(loaded.config);
+		if (!saml.idp?.metadataXml) throw convexError(ErrorCode.PROVIDER_NOT_CONFIGURED, "SAML is not configured for this connection.");
+		return {
+			loaded,
+			connection,
+			saml
+		};
+	};
+	const loadConnectionOidcOrThrow = async (ctx, connectionId) => {
+		const [connection, oidc] = await Promise.all([loadActiveGroupConnectionOrThrow(ctx, connectionId), resolveOidcConfigWithSecret(ctx, connectionId)]);
+		if (oidc.enabled !== true) throw convexError(ErrorCode.PROVIDER_NOT_CONFIGURED, "OIDC is not configured for this connection.");
+		return {
+			connection,
+			oidc
+		};
+	};
+	const resolveGroupConnectionConnectionProtocolOrThrow = async (ctx, connectionId) => {
+		const connection = await loadActiveGroupConnectionOrThrow(ctx, connectionId);
+		if (connection.protocol === "oidc") return "oidc";
+		if (connection.protocol === "saml") return "saml";
+		throw convexError(ErrorCode.PROVIDER_NOT_CONFIGURED, "Group connection protocol is not configured.");
+	};
+	const validateGroupConnectionPolicy = (policy) => {
+		const hasConfiguredRoles = Object.keys(config.permissions.roles).length > 0;
+		const checks = [];
+		checks.push({
+			name: "policy_version",
+			ok: policy.version === 1
+		});
+		if (hasConfiguredRoles) {
+			checks.push({
+				name: "jit_default_role_ids_known",
+				ok: policy.provisioning.jit.defaultRoleIds.every((roleId) => config.permissions.roles[roleId] !== void 0),
+				message: policy.provisioning.jit.defaultRoleIds.every((roleId) => config.permissions.roles[roleId] !== void 0) ? void 0 : "JIT defaultRoleIds contains unknown roleIds."
+			});
+			checks.push({
+				name: "provisioning_role_mapping_targets_known",
+				ok: Object.values(policy.provisioning.roles.mapping ?? {}).every((roleIds) => roleIds.every((roleId) => config.permissions.roles[roleId] !== void 0)),
+				message: Object.values(policy.provisioning.roles.mapping ?? {}).every((roleIds) => roleIds.every((roleId) => config.permissions.roles[roleId] !== void 0)) ? void 0 : "Provisioning role mappings contain unknown roleIds."
+			});
+			checks.push({
+				name: "provisioning_group_mapping_targets_known",
+				ok: Object.values(policy.provisioning.groups.mapping ?? {}).every((roleIds) => roleIds.every((roleId) => config.permissions.roles[roleId] !== void 0)),
+				message: Object.values(policy.provisioning.groups.mapping ?? {}).every((roleIds) => roleIds.every((roleId) => config.permissions.roles[roleId] !== void 0)) ? void 0 : "Provisioning group mappings contain unknown roleIds."
+			});
+		}
+		checks.push({
+			name: "scim_reuse_supported",
+			ok: policy.provisioning.scimReuse.user === "externalId" || policy.provisioning.scimReuse.user === "none"
+		});
+		return checks;
+	};
+	const enqueueWebhookDeliveriesForEvent = async (ctx, data) => {
+		if (data.kind.startsWith("webhook.")) return;
+		const endpoints = await listWebhookEndpoints(ctx, config.component.connection, data.connectionId);
+		for (const endpoint of endpoints) {
+			if (endpoint.status !== "active" || !endpoint.subscriptions.includes(data.kind)) continue;
+			if (!endpoint.secretCiphertext) {
+				console.error("[auth] webhook endpoint has no encrypted secret; skipping", { endpointId: endpoint._id });
+				continue;
+			}
+			const signedAt = Date.now();
+			let secret;
+			try {
+				secret = await decryptSecret(endpoint.secretCiphertext);
+			} catch (err) {
+				console.error("[auth] webhook endpoint has unreadable secret; skipping", {
+					endpointId: endpoint._id,
+					err: err instanceof Error ? err.message : err
+				});
+				continue;
+			}
+			const body = JSON.stringify({
+				kind: data.kind,
+				payload: data.payload
+			});
+			const signature = encodeHexLowerCase(hmac(SHA256, new TextEncoder().encode(secret), new TextEncoder().encode(`${signedAt}.${body}`)));
+			await ctx.runMutation(config.component.connection.webhook.delivery.create, {
+				connectionId: data.connectionId,
+				endpointId: endpoint._id,
+				eventId: data.eventId,
+				kind: data.kind,
+				payload: data.payload,
+				nextAttemptAt: signedAt,
+				signature,
+				signedAt
+			});
+		}
+	};
+	const emitGroupAuthEvent = async (ctx, data) => {
+		const result = await emitAuthEvent(ctx, config, {
+			kind: data.kind,
+			actor: data.actor,
+			subject: data.subject,
+			targets: [
+				{
+					kind: "group",
+					id: data.groupId
+				},
+				...data.connectionId ? [{
+					kind: "connection",
+					id: data.connectionId
+				}] : [],
+				...data.subject.type === "user" && data.subject.id ? [{
+					kind: "user",
+					id: data.subject.id
+				}] : []
+			],
+			request: data.request,
+			outcome: data.outcome ?? "success",
+			data: data.data
+		});
+		const eventId = result.eventId;
+		const connectionEventCreated = data.connectionId !== void 0 && Array.isArray(result.createdTargets) && result.createdTargets.some((target) => target.kind === "connection" && target.id === data.connectionId);
+		if (data.connectionId && connectionEventCreated && data.webhook !== false) await enqueueWebhookDeliveriesForEvent(ctx, {
+			connectionId: data.connectionId,
+			kind: data.kind,
+			eventId,
+			payload: data.webhook?.payload ?? {
+				connectionId: data.connectionId,
+				groupId: data.groupId,
+				subject: data.subject,
+				data: data.data
+			}
+		});
+		return eventId;
+	};
+	/**
+	* Authenticate a SCIM request and resolve its connection context.
+	*
+	* Looks up the SCIM config by the path's `connectionId`, then compares the
+	* request's bearer token hash against the stored hash in constant time to
+	* prevent timing attacks on the token.
+	*/
+	const getGroupConnectionScimContext = async (ctx, request) => {
+		const token = extractBearerToken(request);
+		if (token === null) throw convexError(ErrorCode.MISSING_BEARER_TOKEN, "Missing or malformed Authorization: Bearer header.");
+		const parsedPath = parseScimPath(new URL(request.url).pathname);
+		const scimConfig = await getScimConfigByConnection(ctx, config.component.connection, parsedPath.connectionId);
+		const tokenHash = await sha256$1(token);
+		if (!scimConfig || scimConfig.status !== "active" || !scimConfig.tokenHash || !constantTimeEqualHex(tokenHash, scimConfig.tokenHash)) throw convexError(ErrorCode.INVALID_API_KEY, "Invalid SCIM token.");
+		const connection = await getGroupConnection(ctx, config.component.connection, scimConfig.connectionId);
+		if (connection === null) throw convexError(ErrorCode.INVALID_PARAMETERS, connectionNotFoundError);
+		if (connection.status !== "active") throw convexError(ErrorCode.INVALID_PARAMETERS, "Connection is not active.");
+		return {
+			scimConfig,
+			connection,
+			parsedPath
+		};
+	};
+	return {
+		getGroupConnectionSecret: getGroupConnectionSecret$1,
+		loadGroupPolicyOrThrow,
+		loadConnectionOrThrow,
+		loadActiveGroupConnectionOrThrow,
+		loadActiveConnectionSamlOrThrow,
+		loadConnectionOidcOrThrow,
+		resolveGroupConnectionConnectionProtocolOrThrow,
+		validateGroupConnectionPolicy,
+		emitGroupAuthEvent,
+		getGroupConnectionScimContext
+	};
+}
+
+//#endregion
+export { createGroupService };
+//# sourceMappingURL=service.js.map