@estifanos-sh/convex-auth 0.0.1-preview.0

package/dist/server/connection/scim.js

@@ -0,0 +1,115 @@
+import { SCIM_GROUP_SCHEMA_ID, SCIM_USER_SCHEMA_ID } from "./shared.js";
+
+//#region src/server/connection/scim.ts
+/** @internal */
+function parseScimPath(pathname) {
+	const parts = pathname.split("/").filter(Boolean);
+	const connectionsIndex = parts.lastIndexOf("connections");
+	const [connectionId, protocol, version, ...rest] = connectionsIndex >= 0 ? parts.slice(connectionsIndex + 1) : [];
+	if (connectionsIndex < 0 || !connectionId || connectionId === "setup" || protocol !== "scim" || version !== "v2" || rest.length > 2) return {
+		connectionId: "",
+		resource: "",
+		resourceId: void 0
+	};
+	return {
+		connectionId,
+		resource: rest[0] ?? "",
+		resourceId: rest[1]
+	};
+}
+/** @internal */
+function parseScimListRequest(url) {
+	const rawStartIndex = url.searchParams.get("startIndex") ?? "1";
+	const rawCount = url.searchParams.get("count") ?? "100";
+	const parsedStartIndex = Number(rawStartIndex);
+	const parsedCount = Number(rawCount);
+	if (!Number.isInteger(parsedStartIndex) || parsedStartIndex < 1) throw new Error("Invalid SCIM pagination.");
+	if (!Number.isInteger(parsedCount) || parsedCount < 0) throw new Error("Invalid SCIM pagination.");
+	const startIndex = parsedStartIndex;
+	const count = Math.min(100, parsedCount);
+	const filterParam = url.searchParams.get("filter");
+	return {
+		startIndex,
+		count,
+		filter: filterParam ? (() => {
+			const presentMatch = filterParam.match(/^([A-Za-z0-9_.]+)\s+pr$/);
+			if (presentMatch) return {
+				attribute: presentMatch[1],
+				operator: "pr"
+			};
+			const match = filterParam.match(/^([A-Za-z0-9_.]+(?:\[value eq "[^"]+"\])?)\s+(eq|co|sw|ew)\s+"([^"]+)"$/);
+			if (!match) throw new Error("Unsupported SCIM filter.");
+			return {
+				attribute: match[1],
+				operator: match[2],
+				value: match[3]
+			};
+		})() : void 0
+	};
+}
+/** @internal */
+function scimJson(data, status = 200, headers) {
+	const responseHeaders = new Headers({ "Content-Type": "application/scim+json" });
+	if (headers) new Headers(headers).forEach((value, key) => {
+		responseHeaders.set(key, value);
+	});
+	return new Response(JSON.stringify(data), {
+		status,
+		headers: responseHeaders
+	});
+}
+/** @internal */
+function scimError(status, scimType, detail) {
+	return scimJson({
+		schemas: ["urn:ietf:params:scim:api:messages:2.0:Error"],
+		status: String(status),
+		scimType,
+		detail
+	}, status);
+}
+/** @internal */
+function serializeScimUser(args) {
+	return {
+		schemas: [SCIM_USER_SCHEMA_ID],
+		id: args.id,
+		externalId: args.externalId,
+		meta: {
+			resourceType: "User",
+			location: args.location
+		},
+		userName: args.user.email ?? args.user.phone ?? args.user.name ?? args.id,
+		active: args.active ?? true,
+		name: args.user.name !== void 0 || args.user.firstName !== void 0 || args.user.lastName !== void 0 ? {
+			formatted: args.user.name,
+			givenName: args.user.firstName,
+			familyName: args.user.lastName
+		} : void 0,
+		emails: typeof args.user.email === "string" ? [{
+			value: args.user.email,
+			primary: true
+		}] : void 0,
+		phoneNumbers: typeof args.user.phone === "string" ? [{
+			value: args.user.phone,
+			primary: true
+		}] : void 0,
+		displayName: args.user.name
+	};
+}
+/** @internal */
+function serializeScimGroup(args) {
+	return {
+		schemas: [SCIM_GROUP_SCHEMA_ID],
+		id: args.id,
+		externalId: args.externalId,
+		meta: {
+			resourceType: "Group",
+			location: args.location
+		},
+		displayName: args.group.name ?? args.id,
+		members: args.members ?? []
+	};
+}
+
+//#endregion
+export { parseScimListRequest, parseScimPath, scimError, scimJson, serializeScimGroup, serializeScimUser };
+//# sourceMappingURL=scim.js.map

package/dist/server/connection/shared.js

@@ -0,0 +1,74 @@
+//#region src/server/connection/shared.ts
+/** @internal */
+const SCIM_USER_SCHEMA_ID = "urn:ietf:params:scim:schemas:core:2.0:User";
+/** @internal */
+const SCIM_GROUP_SCHEMA_ID = "urn:ietf:params:scim:schemas:core:2.0:Group";
+/** @internal */
+const GROUP_OIDC_PROVIDER_PREFIX = "group:oidc:";
+/** @internal */
+const GROUP_SAML_PROVIDER_PREFIX = "group:saml:";
+/** @internal */
+function normalizeDomain(domain) {
+	return domain.trim().toLowerCase().replace(/^@+/, "");
+}
+/** @internal */
+function groupOidcProviderId(connectionId) {
+	return `${GROUP_OIDC_PROVIDER_PREFIX}${connectionId}`;
+}
+/** @internal */
+function groupSamlProviderId(connectionId) {
+	return `${GROUP_SAML_PROVIDER_PREFIX}${connectionId}`;
+}
+/** @internal */
+function getGroupSamlUrls(opts) {
+	const root = opts.rootUrl.replace(/\/$/, "");
+	return {
+		metadataUrl: `${root}/connections/${opts.source.id}/saml/metadata`,
+		acsUrl: `${root}/connections/${opts.source.id}/saml/acs`,
+		sloUrl: `${root}/connections/${opts.source.id}/saml/slo`
+	};
+}
+/** @internal */
+function getGroupOidcUrls(opts) {
+	const root = opts.rootUrl.replace(/\/$/, "");
+	const callbackUrl = (() => {
+		if (typeof opts.sharedRedirectURI !== "string") return `${root}/connections/${opts.connectionId}/oidc/callback`;
+		if (/^https?:\/\//.test(opts.sharedRedirectURI)) return opts.sharedRedirectURI;
+		return `${root}${opts.sharedRedirectURI.startsWith("/") ? "" : "/"}${opts.sharedRedirectURI}`;
+	})();
+	return {
+		signInUrl: `${root}/connections/${opts.connectionId}/oidc/signin`,
+		callbackUrl
+	};
+}
+/** @internal */
+function encodeGroupOidcState(opts) {
+	const json = JSON.stringify(opts);
+	return (typeof btoa === "function" ? btoa(json) : Buffer.from(json, "utf8").toString("base64")).replace(/\+/g, "-").replace(/\//g, "_").replace(/=+$/g, "");
+}
+/** @internal */
+function decodeGroupOidcState(value) {
+	if (!value) throw new Error("Missing OIDC state.");
+	const normalized = value.replace(/-/g, "+").replace(/_/g, "/");
+	const padded = normalized + "=".repeat((4 - normalized.length % 4) % 4);
+	const decoded = typeof atob === "function" ? atob(padded) : Buffer.from(padded, "base64").toString("utf8");
+	const parsed = JSON.parse(decoded);
+	if (typeof parsed.connectionId !== "string" || typeof parsed.state !== "string") throw new Error("Invalid OIDC state.");
+	return {
+		connectionId: parsed.connectionId,
+		state: parsed.state
+	};
+}
+/** @internal */
+function isGroupSamlSourceActive(source) {
+	return source.status === "active";
+}
+/** @internal */
+function isGroupProviderId(providerId) {
+	return providerId.startsWith(GROUP_OIDC_PROVIDER_PREFIX) || providerId.startsWith(GROUP_SAML_PROVIDER_PREFIX);
+}
+const asRecord = (value) => typeof value === "object" && value !== null ? value : null;
+
+//#endregion
+export { GROUP_OIDC_PROVIDER_PREFIX, GROUP_SAML_PROVIDER_PREFIX, SCIM_GROUP_SCHEMA_ID, SCIM_USER_SCHEMA_ID, asRecord, decodeGroupOidcState, encodeGroupOidcState, getGroupOidcUrls, getGroupSamlUrls, groupOidcProviderId, groupSamlProviderId, isGroupProviderId, isGroupSamlSourceActive, normalizeDomain };
+//# sourceMappingURL=shared.js.map

package/dist/server/connection/webhook.js

@@ -0,0 +1,163 @@
+import { ErrorCode } from "../../shared/codes.js";
+import { EVENT_KINDS } from "../../shared/event/kinds.js";
+import { convexError } from "../errors.js";
+import { createWebhookEndpoint, getWebhookEndpoint, listReadyWebhookDeliveries, listWebhookDeliveries, listWebhookEndpoints, updateWebhookDelivery, updateWebhookEndpoint } from "../contract.js";
+import { unsafeFetchUrlReason } from "../../shared/fetch/guard.js";
+
+//#region src/server/connection/webhook.ts
+/**
+* Validate an operator-supplied webhook target URL before it is persisted and
+* later `fetch`ed server-side, rejecting requests that could be turned into SSRF
+* probes of internal infrastructure. Webhook targets are customer endpoints that
+* must always be publicly reachable, so — unlike the IdP discovery/metadata
+* fetch guard — this is not subject to the self-hosted private-host opt-out.
+*
+* See {@link unsafeFetchUrlReason} for the scheme/hostname rules. This is
+* scheme/hostname-level validation only — it does not defend against DNS
+* rebinding, where a public hostname resolves to a private address at delivery
+* time.
+*
+* @internal
+*/
+function assertSafeWebhookUrl(url) {
+	const reason = unsafeFetchUrlReason(url);
+	if (reason !== null) throw convexError(ErrorCode.INVALID_PARAMETERS, `Webhook ${reason}`);
+}
+/**
+* Webhook endpoint doc with all stored credential material stripped for the
+* public/admin read facade (`endpoint.get`/`endpoint.list`). The raw ciphertext
+* stays internal to delivery signing, which reads the component doc directly.
+* Hash-only legacy rows are reported as disabled until a new secret is stored.
+*
+* @internal
+*/
+function getPublicWebhookEndpoint(endpoint) {
+	if (!endpoint) return null;
+	const { secretCiphertext, secretHash: _secretHash, status, subscriptions, ...rest } = endpoint;
+	const hasSecret = typeof secretCiphertext === "string" && secretCiphertext.length > 0;
+	return {
+		...rest,
+		status: hasSecret ? status : "disabled",
+		subscriptions: subscriptions.filter((kind) => Object.prototype.hasOwnProperty.call(EVENT_KINDS, kind)),
+		hasSecret
+	};
+}
+function createGroupWebhookDomain(deps) {
+	const { config, encryptSecret, loadConnectionOrThrow, emitGroupAuthEvent } = deps;
+	return {
+		endpoint: {
+			get: async (ctx, args) => {
+				return getPublicWebhookEndpoint(await getWebhookEndpoint(ctx, config.component.connection, args.id));
+			},
+			create: async (ctx, data) => {
+				assertSafeWebhookUrl(data.url);
+				if (data.secret.length === 0) throw convexError(ErrorCode.INVALID_PARAMETERS, "Webhook secret must not be empty.");
+				const connection = await loadConnectionOrThrow(ctx, data.connectionId);
+				if (connection === null) throw convexError(ErrorCode.INVALID_PARAMETERS, "Connection not found.");
+				const secretCiphertext = await encryptSecret(data.secret);
+				const endpointId = await createWebhookEndpoint(ctx, config.component.connection, {
+					connectionId: connection._id,
+					groupId: connection.groupId,
+					url: data.url,
+					secretCiphertext,
+					subscriptions: data.subscriptions,
+					createdByUserId: data.createdByUserId
+				});
+				await emitGroupAuthEvent(ctx, {
+					connectionId: connection._id,
+					groupId: connection.groupId,
+					kind: "webhook.endpoint.created",
+					actor: data.createdByUserId ? {
+						type: "user",
+						id: data.createdByUserId
+					} : { type: "system" },
+					subject: {
+						type: "webhook_endpoint",
+						id: endpointId
+					},
+					webhook: false
+				});
+				return { endpointId };
+			},
+			list: async (ctx, args) => {
+				return (await listWebhookEndpoints(ctx, config.component.connection, args.connectionId)).map((endpoint) => getPublicWebhookEndpoint(endpoint));
+			},
+			update: async (ctx, args) => {
+				const endpoint = await getWebhookEndpoint(ctx, config.component.connection, args.id);
+				if (!endpoint) throw convexError(ErrorCode.INVALID_PARAMETERS, "Webhook endpoint not found.");
+				if (args.patch.url !== void 0) assertSafeWebhookUrl(args.patch.url);
+				if (args.patch.secret !== void 0 && args.patch.secret.length === 0) throw convexError(ErrorCode.INVALID_PARAMETERS, "Webhook secret must not be empty.");
+				if (args.patch.status === "active" && args.patch.secret === void 0 && !endpoint.secretCiphertext) throw convexError(ErrorCode.INVALID_PARAMETERS, "A new webhook secret is required before this endpoint can be enabled.");
+				const secretCiphertext = args.patch.secret === void 0 ? void 0 : await encryptSecret(args.patch.secret);
+				await updateWebhookEndpoint(ctx, config.component.connection, {
+					endpointId: args.id,
+					patch: {
+						...args.patch.url === void 0 ? {} : { url: args.patch.url },
+						...args.patch.status === void 0 ? {} : { status: args.patch.status },
+						...args.patch.subscriptions === void 0 ? {} : { subscriptions: args.patch.subscriptions },
+						...secretCiphertext === void 0 ? {} : { secretCiphertext }
+					}
+				});
+				return { endpointId: args.id };
+			},
+			revoke: async (ctx, args) => {
+				const endpoint = await getWebhookEndpoint(ctx, config.component.connection, args.id);
+				await updateWebhookEndpoint(ctx, config.component.connection, {
+					endpointId: args.id,
+					patch: { status: "disabled" }
+				});
+				if (endpoint) await emitGroupAuthEvent(ctx, {
+					connectionId: endpoint.connectionId,
+					groupId: endpoint.groupId,
+					kind: "webhook.endpoint.disabled",
+					actor: { type: "system" },
+					subject: {
+						type: "webhook_endpoint",
+						id: args.id
+					},
+					webhook: false
+				});
+				return { endpointId: args.id };
+			}
+		},
+		delivery: {
+			list: async (ctx, data) => {
+				return await listWebhookDeliveries(ctx, config.component.connection, data);
+			},
+			listReady: async (ctx, args = {}) => {
+				return await listReadyWebhookDeliveries(ctx, config.component.connection, {
+					now: Date.now(),
+					limit: args.limit
+				});
+			},
+			markDelivered: async (ctx, args) => {
+				await updateWebhookDelivery(ctx, config.component.connection, {
+					deliveryId: args.id,
+					patch: {
+						status: "delivered",
+						attemptCount: 1,
+						lastAttemptAt: Date.now(),
+						lastResponseStatus: args.responseStatus
+					}
+				});
+			},
+			markFailed: async (ctx, args) => {
+				await updateWebhookDelivery(ctx, config.component.connection, {
+					deliveryId: args.id,
+					patch: {
+						status: args.data.retryAt ? "pending" : "failed",
+						attemptCount: args.data.attemptCount,
+						lastAttemptAt: Date.now(),
+						lastResponseStatus: args.data.responseStatus,
+						lastError: args.data.error,
+						nextAttemptAt: args.data.retryAt ?? Date.now()
+					}
+				});
+			}
+		}
+	};
+}
+
+//#endregion
+export { createGroupWebhookDomain };
+//# sourceMappingURL=webhook.js.map

package/dist/server/context.d.ts

@@ -0,0 +1,137 @@
+import { Doc } from "./types.js";
+import { GenericId } from "convex/values";
+import { UserIdentity } from "convex/server";
+
+//#region src/server/context.d.ts
+/** Canonical user document type exposed by Convex Auth. */
+type UserDoc = Doc<"User">;
+type AuthIdentityCtx = {
+  auth: {
+    getUserIdentity: () => Promise<UserIdentity | null>;
+  };
+};
+/**
+ * Current request auth context injected into `ctx.auth` by `auth.ctx()`. This
+ * is the authenticated auth shape returned by {@link defineAuth().context}.
+ * Optional context builders may still surface nullable fields when
+ * `optional: true` is used.
+ *
+ * - `groupId` is `null` when the user has no active group set.
+ * - `role` is `null` when no active group or no membership is resolved.
+ * - `grants` is `[]` when no active group or no membership is resolved.
+ *
+ * @example
+ * ```ts
+ * import type { AuthContext } from "@estifanos-sh/convex-auth/server";
+ *
+ * const mockAuth: AuthContext = {
+ *   userId: "user123" as Id<"User">,
+ *   user: { _id: "user123", email: "test@example.com" },
+ *   groupId: "group456",
+ *   role: "admin",
+ *   grants: ["read", "write"],
+ * };
+ * ```
+ */
+type AuthContext = {
+  /** The authenticated user's document ID. */userId: GenericId<"User">; /** The authenticated user's full document. */
+  user: UserDoc; /** The user's active group ID, or `null` if none set. */
+  groupId: string | null; /** The user's primary role in the active group, or `null`. */
+  role: string | null; /** Resolved grant strings from the user's role definitions. */
+  grants: string[];
+  /**
+   * Assert the current user holds the given grant(s); throws
+   * `ConvexError({ code: ErrorCode.MISSING_GRANTS })` otherwise. Pass a
+   * group-owned document as the second argument to also assert the
+   * record belongs to the active group (`code: ErrorCode.FORBIDDEN` if not).
+   *
+   * For a boolean check, read `grants` directly:
+   * `ctx.auth.grants.includes("issues.read")`.
+   *
+   * @example
+   * ```ts
+   * ctx.auth.assert("members.manage");
+   * ctx.auth.assert(["issues.edit", "issues.move"]);
+   * ctx.auth.assert("issues.edit", issueDoc); // group-scoped
+   * ```
+   */
+  assert: (grant: string | readonly string[], doc?: {
+    groupId?: unknown;
+  }) => void;
+};
+/**
+ * Nullable auth context returned by `auth.context.optional(ctx)` and injected
+ * by `auth.ctx.optional()`.
+ *
+ * Use this when callers may be unauthenticated but you still want a stable
+ * auth-shaped object.
+ *
+ * - `userId` and `user` are `null` when unauthenticated.
+ * - `groupId` and `role` are `null` when no active group is resolved.
+ * - `grants` is `[]` when no membership is resolved.
+ *
+ * @example
+ * ```ts
+ * const authContext = await auth.context.optional(ctx);
+ * if (authContext.userId === null) {
+ *   return null;
+ * }
+ * ```
+ */
+type OptionalAuthContext = {
+  /** The authenticated user's document ID, or `null` when unauthenticated. */userId: GenericId<"User"> | null; /** The authenticated user's full document, or `null` when unauthenticated. */
+  user: UserDoc | null; /** The user's active group ID, or `null` if none is set. */
+  groupId: string | null; /** The user's primary role in the active group, or `null`. */
+  role: string | null; /** Resolved grant strings for the active membership, or `[]`. */
+  grants: string[];
+  /**
+   * Assert the current user holds the given grant(s); throws when
+   * missing (or, with a group-owned `doc`, when it is not in the active
+   * group). When unauthenticated this always throws. For a boolean
+   * check read `grants` directly.
+   */
+  assert: (grant: string | readonly string[], doc?: {
+    groupId?: unknown;
+  }) => void;
+};
+/**
+ * Configuration for {@link defineAuth().ctx} context enrichment.
+ *
+ * The same config shape is also used by {@link defineAuth().context}.
+ *
+ * @typeParam TResolve - Extra fields returned from `resolve()` and merged into
+ *   the resulting `ctx.auth` object.
+ *
+ * @example
+ * ```ts
+ * const authContext = await auth.context(ctx, {
+ *   resolve: async (_ctx, user, authState) => ({
+ *     email: user.email,
+ *     canWrite: authState.grants.includes("posts.write"),
+ *   }),
+ * });
+ * ```
+ */
+type AuthContextConfig<TResolve extends Record<string, unknown> = Record<string, never>, TCtx extends AuthIdentityCtx = AuthIdentityCtx> = {
+  /**
+   * Enforce grant(s) inline — equivalent to calling `ctx.auth.assert(...)`
+   * at the top of every handler built with this customization. Throws
+   * `ConvexError({ code: ErrorCode.MISSING_GRANTS })` when missing.
+   */
+  assert?: string | readonly string[];
+  /**
+   * Require an active group; throws `ConvexError({ code: ErrorCode.NO_ACTIVE_GROUP })`
+   * when the resolved context has no `groupId`. Reuses the `active` concept.
+   */
+  active?: true;
+  /**
+   * Attach additional derived fields to the auth context after the base auth
+   * context is resolved.
+   *
+   * This callback runs only when an authenticated user context is available.
+   */
+  resolve?: (ctx: TCtx, user: UserDoc, auth: AuthContext) => Promise<TResolve> | TResolve;
+};
+//#endregion
+export { AuthContext, AuthContextConfig, OptionalAuthContext, UserDoc };
+//# sourceMappingURL=context.d.ts.map

package/dist/server/context.js

@@ -0,0 +1,108 @@
+import { ErrorCode } from "../shared/codes.js";
+import { getAuthenticatedUserIdOrNull, getUserIdentityOrNull, oauthScopesFromIdentity, userIdFromIdentity } from "./identity/claims.js";
+import { ConvexError } from "convex/values";
+
+//#region src/server/context.ts
+/**
+* Narrow the loose {@link AuthLike} compat surface to the precise
+* {@link AuthContextResolverLike} the resolver body needs.
+*
+* `AuthLike`'s methods use `(...args: never[])` parameters so any concrete
+* domain object is assignable to it; those bottom-typed parameters do not
+* statically unify with the resolver's precise `(ctx, args)` signatures, so
+* this is the single sanctioned assertion at that irreducible boundary. The
+* concrete domains object (the only real value ever passed) satisfies both.
+*/
+function asResolver(auth) {
+	return auth;
+}
+/** @internal */
+async function getSessionUserId(ctx) {
+	return await getAuthenticatedUserIdOrNull(ctx);
+}
+/**
+* Build the `ctx.auth.assert` grant guard from the resolved grants and
+* active group. `assert(grant)` throws when a grant is missing;
+* `assert(grant, doc)` additionally asserts the group-owned `doc` belongs
+* to the active group. Reuses `member.assert`'s `MISSING_GRANTS` code.
+*
+* @internal
+*/
+function makeAssert(groupId, grants) {
+	return (grant, doc) => {
+		if ((Array.isArray(grant) ? grant : [grant]).filter((g) => !grants.includes(g)).length > 0) throw new ConvexError({
+			code: ErrorCode.MISSING_GRANTS,
+			message: "User is missing required grants."
+		});
+		if (doc !== void 0) {
+			const docGroupId = doc.groupId;
+			if (groupId === null || String(docGroupId) !== groupId) throw new ConvexError({
+				code: ErrorCode.FORBIDDEN,
+				message: "Record is not in the active group."
+			});
+		}
+	};
+}
+/**
+* Resolve the caller's *effective* active group and its grants on the hot path.
+*
+* The active-group domain resolves the stored preference, membership fallback,
+* and grants through one component transaction.
+*
+* @internal
+*/
+async function resolveActiveMembership(auth, ctx, userId) {
+	return await auth.active.get(ctx, { userId }) ?? {
+		groupId: null,
+		roleIds: [],
+		grants: []
+	};
+}
+/**
+* @internal
+*
+* Resolve the caller's auth context. When `oauthScopes` is supplied (the request
+* is authenticated by a scoped OAuth access token rather than a full session),
+* the user's role grants are intersected with the token's scopes so the caller's
+* effective grants — and therefore `assert` — can never exceed the granted
+* scope. Scopes and grants share one vocabulary, so this is a set intersection.
+* A session caller passes no scopes and keeps their full role grants.
+*/
+async function getAuthContextForUser(auth, ctx, userId, oauthScopes) {
+	const [user, resolved] = await Promise.all([auth.user.get(ctx, { id: userId }), resolveActiveMembership(auth, ctx, userId)]);
+	const groupId = resolved.groupId;
+	const role = groupId === null ? null : resolved.roleIds[0] ?? null;
+	const grants = groupId === null ? [] : resolved.grants;
+	const effectiveGrants = oauthScopes === void 0 ? grants : grants.filter((grant) => oauthScopes.includes(grant));
+	return {
+		userId,
+		user,
+		groupId,
+		role,
+		grants: effectiveGrants,
+		assert: makeAssert(groupId, effectiveGrants)
+	};
+}
+/** @internal */
+async function getAuthContext(auth, ctx) {
+	const identity = await getUserIdentityOrNull(ctx);
+	if (identity === null) return null;
+	const userId = userIdFromIdentity(identity);
+	const oauthScopes = oauthScopesFromIdentity(identity);
+	return await getAuthContextForUser(asResolver(auth), ctx, userId, oauthScopes ?? void 0);
+}
+/** @internal */
+function createUnauthenticatedAuthContext() {
+	return {
+		userId: null,
+		user: null,
+		groupId: null,
+		role: null,
+		grants: [],
+		assert: makeAssert(null, [])
+	};
+}
+
+//#endregion
+export { createUnauthenticatedAuthContext, getAuthContext, getAuthContextForUser, getSessionUserId };
+//# sourceMappingURL=context.js.map

package/dist/server/contract.d.ts

@@ -0,0 +1,48 @@
+import { ComponentReadCtx } from "./component/context.js";
+import "./events.js";
+import { ConvexAuthMaterializedConfig } from "./types.js";
+
+//#region src/server/contract.d.ts
+type ComponentConnection = ConvexAuthMaterializedConfig["component"]["connection"];
+type GroupConnectionRecord = {
+  _id: string;
+  _creationTime: number;
+  groupId: string;
+  slug?: string;
+  name?: string;
+  protocol: "oidc" | "saml";
+  status: "draft" | "active" | "disabled";
+  config?: unknown;
+  extend?: unknown;
+};
+type GroupConnectionDomainLookupRecord = {
+  connection: GroupConnectionRecord | null;
+  domain: ConnectionDomainRecord | null;
+};
+type ConnectionDomainRecord = {
+  _id: string;
+  _creationTime: number;
+  connectionId: string;
+  groupId: string;
+  domain: string;
+  isPrimary: boolean;
+  verifiedAt?: number;
+};
+type ScimIdentityRecord = {
+  _id: string;
+  _creationTime: number;
+  connectionId: string;
+  groupId: string;
+  resourceType: string;
+  externalId: string;
+  userId?: string;
+  mappedGroupId?: string;
+  active?: boolean;
+  raw?: Record<string, unknown>;
+  lastProvisionedAt?: number;
+};
+declare const getGroupConnection: (ctx: ComponentReadCtx, componentConnection: ComponentConnection, connectionId: string) => Promise<GroupConnectionRecord | null>;
+declare const getGroupConnectionByDomain: (ctx: ComponentReadCtx, componentConnection: ComponentConnection, domain: string) => Promise<GroupConnectionDomainLookupRecord | null>;
+//#endregion
+export { ScimIdentityRecord, getGroupConnection, getGroupConnectionByDomain };
+//# sourceMappingURL=contract.d.ts.map