@estifanos-sh/convex-auth 0.0.1-preview.0

package/dist/server/mutations/credentials/signin.js

@@ -0,0 +1,210 @@
+import { LOG_LEVELS } from "../../../shared/log.js";
+import { queueAuthEvent } from "../../events.js";
+import { log, maybeRedact } from "../../log.js";
+import { encodeRefreshToken, refreshTokenExpirationTime } from "../../token/refresh.js";
+import { setActiveSpanAttributes, withSpan } from "../../utils/span.js";
+import { buildSessionIdentity, getAuthSessionId, sessionExpirationTime } from "../../session/lifecycle.js";
+import { verify } from "../../crypto.js";
+import { AUTH_STORE_REF } from "../store/refs.js";
+import { maxSignInAttempts } from "../../limits.js";
+import { buildKnownSignInIdentityAttributes } from "../../telemetry.js";
+import { v } from "convex/values";
+
+//#region src/server/mutations/credentials/signin.ts
+/**
+* A well-formed but intentionally unmatchable password hash. Verifying any
+* secret against it runs the provider's full (scrypt) work and always fails.
+* Used on the missing-account branch so sign-in spends comparable time whether
+* or not the account exists — closing the user-enumeration timing oracle.
+*
+* The prefix and params mirror the default password provider's scrypt format so
+* that provider performs a real scrypt hash; the salt and digest are all zero,
+* a digest scrypt can never actually produce, so verification never succeeds.
+*/
+const DUMMY_PASSWORD_HASH = `scrypt:N=16384,r=16,p=1,dkLen=64$${"0".repeat(64)}$${"0".repeat(128)}`;
+/**
+* Run a throwaway secret verification purely to equalize timing on branches
+* that reject before the real verify would run. Never authenticates: it
+* verifies against {@link DUMMY_PASSWORD_HASH} (which cannot match) and swallows
+* any error, so a misconfigured or non-credentials provider still yields the
+* unified rejection rather than a distinguishable error or timing.
+*/
+async function burnVerifyForTiming(getProviderOrThrow, providerId, secret) {
+	try {
+		await verify(getProviderOrThrow(providerId), secret, DUMMY_PASSWORD_HASH);
+	} catch {}
+}
+/** Argument validator for the combined credentials-verify + session-issue mutation. */
+const vCredentialsSignInArgs = v.object({
+	provider: v.string(),
+	account: v.object({
+		id: v.string(),
+		secret: v.string()
+	}),
+	generateTokens: v.boolean(),
+	requireVerifiedEmail: v.boolean(),
+	enforceTotp: v.boolean()
+});
+/**
+* Verify credentials and issue a session through one app mutation.
+*
+* Enforces sign-in rate limiting, optional verified-email and TOTP gates, and
+* returns a discriminated result (`invalidAccount`, `tooManyAttempts`,
+* `invalidSecret`, `emailVerificationRequired`, `totpRequired`, or `signedIn`).
+*
+* @internal
+*/
+async function credentialsSignInImpl(ctx, args, getProviderOrThrow, config) {
+	return withSpan("convex-auth.mutations.credentialsSignIn", {
+		provider: args.provider,
+		generateTokens: args.generateTokens
+	}, () => credentialsSignInInner(ctx, args, getProviderOrThrow, config));
+}
+async function credentialsSignInInner(ctx, args, getProviderOrThrow, config) {
+	const { provider: providerId, account, generateTokens, requireVerifiedEmail, enforceTotp } = args;
+	log(LOG_LEVELS.DEBUG, "credentialsSignInImpl args:", {
+		provider: providerId,
+		account: {
+			id: account.id,
+			secret: maybeRedact(account.secret)
+		},
+		generateTokens,
+		requireVerifiedEmail,
+		enforceTotp
+	});
+	const begun = await ctx.runMutation(config.component.account.beginCredentialsSignIn, {
+		provider: providerId,
+		providerAccountId: account.id,
+		maxAttemptsPerHour: maxSignInAttempts(config),
+		reserveAttempt: true,
+		includeTotp: enforceTotp
+	});
+	if (begun.status === "invalid") {
+		await burnVerifyForTiming(getProviderOrThrow, providerId, account.secret);
+		return { kind: "invalidAccount" };
+	}
+	if (begun.status === "limited") return { kind: "tooManyAttempts" };
+	const existingAccount = begun.account;
+	const user = begun.user;
+	if (!await withSpan("convex-auth.credentials.verify", { providerId }, () => verify(getProviderOrThrow(providerId), account.secret, existingAccount.secret ?? ""))) return { kind: "invalidSecret" };
+	const complete = async (issueSession) => await ctx.runMutation(config.component.account.completeCredentialsSignIn, {
+		accountId: existingAccount._id,
+		issueSession,
+		generateTokens,
+		replaceSessionId: issueSession ? await getAuthSessionId(ctx) ?? void 0 : void 0,
+		sessionExpirationTime: sessionExpirationTime(config),
+		refreshTokenExpirationTime: refreshTokenExpirationTime(config)
+	});
+	if (requireVerifiedEmail && !existingAccount.emailVerified) {
+		await complete(false);
+		return {
+			kind: "emailVerificationRequired",
+			account: {
+				_id: existingAccount._id,
+				emailVerified: existingAccount.emailVerified
+			},
+			user: {
+				_id: user._id,
+				email: user.email
+			}
+		};
+	}
+	if (enforceTotp && begun.hasTotp) {
+		await complete(false);
+		return {
+			kind: "totpRequired",
+			account: {
+				_id: existingAccount._id,
+				emailVerified: existingAccount.emailVerified
+			},
+			user: {
+				_id: user._id,
+				email: user.email
+			}
+		};
+	}
+	const completed = await complete(true);
+	if (completed.status !== "accepted") return { kind: "invalidAccount" };
+	const userId = completed.user._id;
+	const sessionId = completed.sessionId;
+	setActiveSpanAttributes({
+		"auth.signin.result": "success",
+		...buildKnownSignInIdentityAttributes(config, {
+			userId,
+			sessionId
+		}, completed.user.email)
+	});
+	if (completed.replacedSessionId !== void 0) {
+		const replacedSessionId = completed.replacedSessionId;
+		await queueAuthEvent(ctx, config, {
+			kind: "session.invalidated",
+			actor: { type: "system" },
+			subject: {
+				type: "session",
+				id: replacedSessionId
+			},
+			targets: [{
+				kind: "user",
+				id: userId
+			}, {
+				kind: "session",
+				id: replacedSessionId
+			}],
+			outcome: "success",
+			data: {
+				userId,
+				reason: "replaced"
+			}
+		});
+	}
+	await queueAuthEvent(ctx, config, {
+		kind: "session.signed_in",
+		actor: {
+			type: "user",
+			id: userId
+		},
+		subject: {
+			type: "session",
+			id: sessionId
+		},
+		targets: [{
+			kind: "user",
+			id: userId
+		}, {
+			kind: "session",
+			id: sessionId
+		}],
+		outcome: "success",
+		data: { provider: providerId }
+	});
+	const refreshTokenId = completed.refreshTokenId;
+	return {
+		kind: "signedIn",
+		issuance: {
+			userId,
+			sessionId,
+			identity: buildSessionIdentity(userId, sessionId, completed.user),
+			refreshToken: generateTokens && refreshTokenId !== void 0 ? encodeRefreshToken(refreshTokenId, sessionId) : null
+		},
+		account: {
+			_id: existingAccount._id,
+			emailVerified: existingAccount.emailVerified
+		},
+		user: {
+			_id: user._id,
+			email: user.email,
+			hasTotp: begun.hasTotp
+		}
+	};
+}
+/** @internal */
+const callCredentialsSignIn = async (ctx, args) => {
+	return await ctx.runMutation(AUTH_STORE_REF, { args: {
+		type: "credentialsSignIn",
+		...args
+	} });
+};
+
+//#endregion
+export { callCredentialsSignIn, credentialsSignInImpl, vCredentialsSignInArgs };
+//# sourceMappingURL=signin.js.map

package/dist/server/mutations/invalidate.js

@@ -0,0 +1,60 @@
+import { LOG_LEVELS } from "../../shared/log.js";
+import { emitAuthEvent } from "../events.js";
+import { authDb } from "../db.js";
+import { log } from "../log.js";
+import { deleteSession } from "../session/lifecycle.js";
+import { AUTH_STORE_REF } from "./store/refs.js";
+import { v } from "convex/values";
+
+//#region src/server/mutations/invalidate.ts
+const vInvalidateSessionsArgs = v.object({
+	userId: v.string(),
+	except: v.optional(v.array(v.string()))
+});
+const callInvalidateSessions = async (ctx, args) => {
+	return ctx.runMutation(AUTH_STORE_REF, { args: {
+		type: "invalidateSessions",
+		...args
+	} });
+};
+async function invalidateSessionsImpl(ctx, args, config) {
+	log(LOG_LEVELS.DEBUG, "invalidateSessionsImpl args:", args);
+	const { userId, except } = args;
+	const exceptSet = new Set(except ?? []);
+	const typedUserId = userId;
+	const sessions = await authDb(ctx, config).sessions.listByUser(typedUserId);
+	const deleted = [];
+	await Promise.all(sessions.map(async (session) => {
+		if (exceptSet.has(session._id)) return;
+		await deleteSession(ctx, session, config);
+		deleted.push(session._id);
+	}));
+	for (const sessionId of deleted) await emitAuthEvent(ctx, config, {
+		kind: "session.invalidated",
+		actor: { type: "system" },
+		subject: {
+			type: "session",
+			id: sessionId
+		},
+		targets: [
+			{
+				kind: "user",
+				id: typedUserId
+			},
+			{
+				kind: "session",
+				id: sessionId
+			},
+			{
+				kind: "global",
+				id: "security"
+			}
+		],
+		outcome: "success",
+		data: { userId: typedUserId }
+	});
+}
+
+//#endregion
+export { callInvalidateSessions, invalidateSessionsImpl, vInvalidateSessionsArgs };
+//# sourceMappingURL=invalidate.js.map

package/dist/server/mutations/oauth.js

@@ -0,0 +1,251 @@
+import { ErrorCode } from "../../shared/codes.js";
+import { generateRandomString, sha256 } from "../random.js";
+import { authDb } from "../db.js";
+import { log, maybeRedact } from "../log.js";
+import { AUTH_STORE_REF } from "./store/refs.js";
+import { upsertUserAndAccount } from "../user/account.js";
+import { getGroup, getGroupConnection } from "../contract.js";
+import { vAccountExtend, vPayloadRecord } from "../payloads.js";
+import { vProfileEmail } from "../../component/model.js";
+import { single } from "../component/api.js";
+import { GROUP_OIDC_PROVIDER_PREFIX, GROUP_SAML_PROVIDER_PREFIX, isGroupProviderId } from "../connection/shared.js";
+import { createSyntheticOAuthMaterializedConfig } from "../connection/oidc.js";
+import { normalizeGroupConnectionPolicy, resolveProvisionedRoleIds } from "../connection/policy.js";
+import { ConvexError, v } from "convex/values";
+
+//#region src/server/mutations/oauth.ts
+const OAUTH_SIGN_IN_EXPIRATION_MS = 1e3 * 60 * 2;
+/**
+* Length and alphabet of the short-lived OAuth sign-in handoff code minted
+* below. Matches the 32-char alphanumeric convention used for OAuth
+* authorization codes elsewhere (`server/oauth/code.ts`): ~190 bits of entropy,
+* versus ~26.6 bits for the previous 8-digit numeric code — which was
+* brute-forceable within this handoff's 2-minute TTL.
+* @internal
+*/
+const OAUTH_SIGN_IN_CODE_LENGTH = 32;
+/** @internal */
+const OAUTH_SIGN_IN_CODE_ALPHABET = "abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789";
+/** Argument validator for the OAuth/Connection user provisioning mutation. */
+const vUserOAuthArgs = v.object({
+	provider: v.string(),
+	providerAccountId: v.string(),
+	profile: vPayloadRecord,
+	emails: v.optional(v.array(vProfileEmail)),
+	signature: v.string(),
+	accountExtend: v.optional(vAccountExtend)
+});
+function normalizeAccountExtend(provider, providerAccountId, accountExtend) {
+	const baseIdentity = {
+		type: "oauth",
+		provider,
+		providerAccountId
+	};
+	if (provider.startsWith(GROUP_OIDC_PROVIDER_PREFIX)) {
+		baseIdentity.type = "group-connection-oidc";
+		baseIdentity.connectionId = provider.slice(GROUP_OIDC_PROVIDER_PREFIX.length);
+	}
+	if (provider.startsWith(GROUP_SAML_PROVIDER_PREFIX)) {
+		baseIdentity.type = "group-connection-saml";
+		baseIdentity.connectionId = provider.slice(GROUP_SAML_PROVIDER_PREFIX.length);
+	}
+	const provided = accountExtend;
+	const providedIdentity = provided?.identity;
+	return {
+		...provided,
+		identity: {
+			...baseIdentity,
+			...providedIdentity
+		}
+	};
+}
+/**
+* Read a free-form string-array claim (e.g. `groups`, `roles`) from an IdP
+* profile. The value arrives as untyped wire data; the array branch is
+* re-narrowed to `string[]` at this single boundary.
+*/
+function readStringArrayClaim(profile, key) {
+	const value = profile[key];
+	return Array.isArray(value) ? value : void 0;
+}
+/** Lowercased registrable domain of an email address, or `null` when unparseable. */
+function emailDomain(email) {
+	if (typeof email !== "string") return null;
+	const at = email.lastIndexOf("@");
+	if (at === -1 || at === email.length - 1) return null;
+	return email.slice(at + 1).toLowerCase();
+}
+/**
+* Whether a SAML-asserted email may be treated as verified: true only when its
+* domain matches a verified (`verifiedAt` set) domain attached to the
+* connection. SAML carries no `email_verified` claim, so a domain-ownership
+* proof is the only signal that lets a SAML email drive `verifiedEmail`
+* account-linking — without it a malicious IdP could assert `victim@other.com`.
+*/
+async function isSamlEmailDomainVerified(ctx, config, connectionId, email) {
+	const domain = emailDomain(email);
+	if (domain === null) return false;
+	return (await ctx.runQuery(config.component.connection.domain.list, { connectionId })).some((row) => row.verifiedAt !== void 0 && row.domain.toLowerCase() === domain);
+}
+/**
+* Just-in-time membership provisioning for a connection-owned group on SSO
+* login, reconcile-to-set on roles.
+*
+* @remarks
+* The IdP assertion is authoritative for a connection-owned membership's roles:
+* an existing membership's `roleIds` are overwritten with exactly the mapped
+* set even when that shrinks (or empties) it, so a demotion at the IdP drops the
+* local roles rather than leaving them (the previous additive-only behavior).
+* The membership itself is never removed here — the user just authenticated
+* through this connection's IdP, so JIT keeps them a member; full
+* de-provisioning (and session revocation) is SCIM's responsibility.
+*/
+async function jitProvisionMembership(ctx, config, connectionPolicy, connection, userId, profile) {
+	if (connectionPolicy?.provisioning.jit.mode !== "createUserAndMembership") return;
+	const groupId = connection?.groupId;
+	if (!groupId) return;
+	const definedRoleIds = new Set(Object.keys(config.permissions?.roles ?? {}));
+	const provisionedRoleIds = resolveProvisionedRoleIds({
+		policy: connectionPolicy,
+		groups: readStringArrayClaim(profile, "groups"),
+		roles: readStringArrayClaim(profile, "roles")
+	}).filter((roleId) => definedRoleIds.has(roleId));
+	const existingMembership = single(await ctx.runQuery(config.component.group.member.get, {
+		userId,
+		groupId
+	}));
+	if (existingMembership === null) {
+		await ctx.runMutation(config.component.group.member.create, {
+			groupId,
+			userId,
+			roleIds: provisionedRoleIds,
+			status: "active"
+		});
+		return;
+	}
+	const currentRoleIds = existingMembership.roleIds ?? [];
+	const nextRoleSet = new Set(provisionedRoleIds);
+	if (!(currentRoleIds.length === nextRoleSet.size && currentRoleIds.every((roleId) => nextRoleSet.has(roleId)))) await ctx.runMutation(config.component.group.member.update, {
+		id: existingMembership._id,
+		patch: { roleIds: provisionedRoleIds }
+	});
+}
+/**
+* Redact secret-bearing fields (the OAuth state `signature`) from the
+* provisioning args before they reach a DEBUG log line, so enabling DEBUG never
+* writes the verifier signature to logs.
+* @internal
+*/
+function redactUserOAuthArgsForLog(args) {
+	return {
+		...args,
+		signature: maybeRedact(args.signature)
+	};
+}
+/**
+* Provision a user and account from a verified OAuth/Connection profile.
+*
+* Resolves any group connection (OIDC/SAML) and its policy, runs the
+* profile/provision hooks, upserts the user and account, performs JIT
+* membership provisioning, and mints a short-lived single-use sign-in code.
+*
+* @returns The numeric sign-in code the action side exchanges for tokens.
+*/
+async function userOAuthImpl(ctx, args, getProviderOrThrow, config) {
+	log("DEBUG", "userOAuthImpl args:", redactUserOAuthArgsForLog(args));
+	const { profile, provider, providerAccountId, signature, accountExtend } = args;
+	const typedProfile = profile;
+	const db = authDb(ctx, config);
+	const connectionId = provider.startsWith(GROUP_OIDC_PROVIDER_PREFIX) ? provider.slice(GROUP_OIDC_PROVIDER_PREFIX.length) : provider.startsWith(GROUP_SAML_PROVIDER_PREFIX) ? provider.slice(GROUP_SAML_PROVIDER_PREFIX.length) : null;
+	const connectionProtocol = provider.startsWith(GROUP_OIDC_PROVIDER_PREFIX) ? "oidc" : provider.startsWith(GROUP_SAML_PROVIDER_PREFIX) ? "saml" : null;
+	const existingAccount = await db.accounts.get({
+		provider,
+		providerAccountId
+	});
+	const connection = connectionId !== null ? await getGroupConnection(ctx, config.component.connection, connectionId) : null;
+	const group = connection !== null ? await getGroup(ctx, config.component.group, connection.groupId) : null;
+	const connectionPolicy = connection ? normalizeGroupConnectionPolicy(group?.policy) : null;
+	/**
+	* SCIM identity `userId` crosses the component boundary as `string`; re-brand
+	* to the server's `Id<"User">` here — the one legitimate cast at the boundary.
+	*/
+	const existingScimUserId = (connectionId !== null && existingAccount === null && connectionPolicy?.provisioning.scimReuse.user === "externalId" ? single(await ctx.runQuery(config.component.connection.scim.identity.get, {
+		connectionId,
+		resourceType: "user",
+		externalId: providerAccountId
+	})) : null)?.userId;
+	let verifier;
+	try {
+		verifier = await db.verifiers.get({ signature });
+	} catch (err) {
+		console.error("[auth] OAuth verifier lookup failed", { err });
+		throw new ConvexError({
+			code: ErrorCode.OAUTH_INVALID_STATE,
+			message: "Invalid OAuth state. Please try signing in again."
+		});
+	}
+	if (verifier === null) throw new ConvexError({
+		code: ErrorCode.OAUTH_INVALID_STATE,
+		message: "Invalid OAuth state. Please try signing in again."
+	});
+	const profileResolved = (config.connection?.hooks?.profileResolved ? await config.connection.hooks.profileResolved({
+		protocol: connectionProtocol ?? "oidc",
+		connectionId: connectionId ?? void 0,
+		profile: typedProfile
+	}) : void 0) ?? typedProfile;
+	const profileForProvisioning = (config.connection?.hooks?.beforeProvision ? await config.connection.hooks.beforeProvision({
+		protocol: connectionProtocol ?? "oidc",
+		connectionId: connectionId ?? void 0,
+		profile: profileResolved
+	}) : void 0) ?? profileResolved;
+	const provisioningProfile = connectionProtocol === "saml" && connectionId !== null ? {
+		...profileForProvisioning,
+		emailVerified: await isSamlEmailDomainVerified(ctx, config, connectionId, profileForProvisioning.email)
+	} : profileForProvisioning;
+	const { accountId } = await upsertUserAndAccount(ctx, verifier.sessionId ?? null, existingAccount !== null ? { existingAccount } : { providerAccountId }, {
+		type: "oauth",
+		provider: isGroupProviderId(provider) ? createSyntheticOAuthMaterializedConfig(provider, { accountLinking: connectionProtocol === "oidc" ? connectionPolicy?.identity.accountLinking.oidc : connectionProtocol === "saml" ? connectionPolicy?.identity.accountLinking.saml : void 0 }) : getProviderOrThrow(provider),
+		profile: provisioningProfile,
+		emails: args.emails,
+		accountExtend: normalizeAccountExtend(provider, providerAccountId, accountExtend)
+	}, config, connectionPolicy?.provisioning.user ? {
+		existingUserId: existingScimUserId,
+		provisioningUser: connectionPolicy.provisioning.user,
+		source: "login"
+	} : existingScimUserId ? { existingUserId: existingScimUserId } : void 0);
+	if (connectionId !== null) {
+		const userId = (await db.accounts.get({ id: accountId }))?.userId;
+		if (userId) {
+			await jitProvisionMembership(ctx, config, connectionPolicy, connection, userId, typedProfile);
+			if (config.connection?.hooks?.afterProvision) await config.connection.hooks.afterProvision({
+				protocol: connectionProtocol ?? "oidc",
+				connectionId,
+				profile: profileForProvisioning,
+				userId
+			});
+		}
+	}
+	const code = generateRandomString(OAUTH_SIGN_IN_CODE_LENGTH, OAUTH_SIGN_IN_CODE_ALPHABET);
+	await db.verifiers.delete(verifier._id);
+	const existingVerificationCode = await db.verificationCodes.get({ accountId });
+	if (existingVerificationCode !== null) await db.verificationCodes.delete(existingVerificationCode._id);
+	await db.verificationCodes.create({
+		code: await sha256(code),
+		accountId,
+		provider,
+		expirationTime: Date.now() + OAUTH_SIGN_IN_EXPIRATION_MS,
+		verifier: verifier._id
+	});
+	return code;
+}
+/** Action-side wrapper that runs {@link userOAuthImpl} through the auth store. */
+const callUserOAuth = async (ctx, args) => {
+	return ctx.runMutation(AUTH_STORE_REF, { args: {
+		type: "userOAuth",
+		...args
+	} });
+};
+
+//#endregion
+export { callUserOAuth, userOAuthImpl, vUserOAuthArgs };
+//# sourceMappingURL=oauth.js.map

package/dist/server/mutations/refresh.js

@@ -0,0 +1,152 @@
+import { emitAuthEvent, queueAuthEvent } from "../events.js";
+import { authDb } from "../db.js";
+import { log, maybeRedact } from "../log.js";
+import { REFRESH_TOKEN_REUSE_WINDOW_MS, encodeRefreshToken, parseRefreshToken, refreshTokenExpirationTime } from "../token/refresh.js";
+import { setActiveSpanAttributes, withSpan } from "../utils/span.js";
+import { buildSessionIdentity, finalizeSessionIssuance } from "../session/lifecycle.js";
+import { AUTH_STORE_REF } from "./store/refs.js";
+import { buildKnownRefreshIdentityAttributes } from "../telemetry.js";
+import { v } from "convex/values";
+
+//#region src/server/mutations/refresh.ts
+const vRefreshSessionArgs = v.object({ refreshToken: v.string() });
+/**
+* Exchange a refresh token and mint the next pair of session IDs + refresh
+* token string. The RSA-2048 JWT signing used to live here; it has been
+* moved to the action wrapper ({@link callRefreshSession}) so the mutation
+* can commit without paying 5–30ms of CPU per refresh.
+*
+* @internal
+*/
+async function refreshSessionImpl(ctx, args, config) {
+	const db = authDb(ctx, config);
+	return withSpan("convex-auth.refresh.session", {
+		hasRefreshToken: true,
+		"auth.flow": "refresh"
+	}, async () => {
+		try {
+			let refreshTokenId;
+			let sessionId;
+			try {
+				({refreshTokenId, sessionId} = parseRefreshToken(args.refreshToken));
+			} catch {
+				throw new RefreshFailure("parse_failure", "Failed to parse refresh token");
+			}
+			log("DEBUG", `refreshSessionImpl args: Token ID: ${maybeRedact(refreshTokenId)} Session ID: ${maybeRedact(sessionId)}`);
+			let exchanged;
+			try {
+				exchanged = await db.refreshTokens.exchange({
+					refreshTokenId,
+					sessionId,
+					now: Date.now(),
+					refreshTokenExpirationTime: refreshTokenExpirationTime(config),
+					reuseWindowMs: REFRESH_TOKEN_REUSE_WINDOW_MS
+				});
+			} catch {
+				throw new RefreshFailure("exchange_failure", "Failed to exchange refresh token");
+			}
+			if (exchanged.status === "reuse_detected") {
+				setActiveSpanAttributes({ "auth.refresh.result": "reuse_detected" });
+				await emitAuthEvent(ctx, config, {
+					kind: "session.refresh_reuse_detected",
+					actor: { type: "system" },
+					subject: {
+						type: "session",
+						id: sessionId
+					},
+					targets: [
+						{
+							kind: "user",
+							id: exchanged.userId
+						},
+						{
+							kind: "session",
+							id: sessionId
+						},
+						{
+							kind: "global",
+							id: "security"
+						}
+					],
+					outcome: "failure",
+					data: {
+						userId: exchanged.userId,
+						refreshTokenId: exchanged.refreshTokenId
+					}
+				});
+				return null;
+			}
+			if (exchanged.status === "invalid") {
+				setActiveSpanAttributes({ "auth.refresh.result": "null" });
+				return null;
+			}
+			setActiveSpanAttributes({
+				"auth.refresh.result": "success",
+				...buildKnownRefreshIdentityAttributes(config, {
+					userId: exchanged.userId,
+					sessionId: exchanged.sessionId,
+					refreshTokenId: exchanged.refreshTokenId
+				}, exchanged.user.email)
+			});
+			await queueAuthEvent(ctx, config, {
+				kind: "session.refresh_exchanged",
+				actor: { type: "system" },
+				subject: {
+					type: "session",
+					id: exchanged.sessionId
+				},
+				targets: [{
+					kind: "user",
+					id: exchanged.userId
+				}, {
+					kind: "session",
+					id: exchanged.sessionId
+				}],
+				outcome: "success",
+				data: { sessionId: exchanged.sessionId }
+			});
+			return {
+				userId: exchanged.userId,
+				sessionId: exchanged.sessionId,
+				identity: buildSessionIdentity(exchanged.userId, exchanged.sessionId, exchanged.user),
+				refreshToken: encodeRefreshToken(exchanged.refreshTokenId, exchanged.sessionId)
+			};
+		} catch (e) {
+			if (e instanceof RefreshFailure) {
+				setActiveSpanAttributes({
+					"auth.refresh.result": e.code,
+					"auth.refresh.failure_reason": e.reason
+				});
+				log("DEBUG", e.reason);
+				return null;
+			}
+			throw e;
+		}
+	});
+}
+var RefreshFailure = class extends Error {
+	constructor(code, reason) {
+		super(reason);
+		this.code = code;
+		this.reason = reason;
+	}
+};
+/**
+* Action-side wrapper: exchange the refresh token via the mutation, then
+* sign the next JWT outside the mutation transaction. See
+* {@link refreshSessionImpl} for the rationale.
+*
+* @internal
+*/
+const callRefreshSession = async (ctx, args) => {
+	const issuance = await ctx.runMutation(AUTH_STORE_REF, { args: {
+		type: "refreshSession",
+		...args
+	} });
+	if (issuance === null || issuance.refreshToken === null) return null;
+	return await finalizeSessionIssuance(ctx.auth.config, issuance);
+};
+
+//#endregion
+export { callRefreshSession, refreshSessionImpl, vRefreshSessionArgs };
+//# sourceMappingURL=refresh.js.map