@estifanos-sh/convex-auth 0.0.1-preview.0

package/dist/client/factors/device.js

@@ -0,0 +1,100 @@
+import { ErrorCode } from "../../shared/codes.js";
+import { ConvexError } from "convex/values";
+
+//#region src/client/factors/device.ts
+function isSignedInResult(result) {
+	return result.kind === "signedIn";
+}
+/** @internal */
+function createDeviceClient(deps) {
+	const { proxy, convex, requireApiRefs, proxyFetch, setTokenAndMaybeWait } = deps;
+	const requestDeviceSignIn = async (params) => {
+		return proxy ? await proxyFetch({
+			action: "auth:signIn",
+			args: {
+				provider: "device",
+				params
+			}
+		}) : await convex.action(requireApiRefs().signIn, {
+			provider: "device",
+			params
+		});
+	};
+	return {
+		poll: async (opts) => {
+			const { code, signal } = opts;
+			const MAX_POLL_DURATION_MS = 1800 * 1e3;
+			const SLOW_DOWN_INCREMENT_MS = 5 * 1e3;
+			let currentIntervalMs = code.interval * 1e3;
+			const startedAt = Date.now();
+			const expiresAt = Math.min(startedAt + code.expiresIn * 1e3, startedAt + MAX_POLL_DURATION_MS);
+			while (Date.now() < expiresAt) {
+				if (signal?.aborted) return;
+				await new Promise((resolve) => setTimeout(resolve, currentIntervalMs));
+				if (signal?.aborted) return;
+				const params = {
+					flow: "poll",
+					deviceCode: code.deviceCode
+				};
+				let pollResult;
+				try {
+					pollResult = await requestDeviceSignIn(params);
+				} catch (error) {
+					if (error instanceof ConvexError) {
+						const errorCode = error.data?.code;
+						if (errorCode === "DEVICE_AUTHORIZATION_PENDING") continue;
+						if (errorCode === "DEVICE_SLOW_DOWN") {
+							currentIntervalMs += SLOW_DOWN_INCREMENT_MS;
+							continue;
+						}
+					}
+					throw error;
+				}
+				if (pollResult === null) continue;
+				if (isSignedInResult(pollResult) && pollResult.session) {
+					if (proxy) await setTokenAndMaybeWait({
+						shouldStore: false,
+						tokens: pollResult.session === null ? null : { token: pollResult.session.token },
+						waitForHandshake: true,
+						context: {
+							provider: "device",
+							flow: "poll"
+						}
+					});
+					else await setTokenAndMaybeWait({
+						shouldStore: true,
+						tokens: pollResult.session ?? null,
+						waitForHandshake: true,
+						context: {
+							provider: "device",
+							flow: "poll"
+						}
+					});
+					return;
+				}
+			}
+			throw new ConvexError({
+				code: ErrorCode.DEVICE_CODE_EXPIRED,
+				message: "Device code expired before authorization was completed."
+			});
+		},
+		verify: async (opts) => {
+			const params = {
+				flow: "verify",
+				userCode: opts.code
+			};
+			try {
+				await requestDeviceSignIn(params);
+			} catch (error) {
+				throw new ConvexError({
+					code: ErrorCode.DEVICE_AUTHORIZATION_FAILED,
+					message: error instanceof Error ? error.message : "Invalid or expired code."
+				});
+			}
+		}
+	};
+}
+
+//#endregion
+export { createDeviceClient };
+//# sourceMappingURL=device.js.map

package/dist/client/factors/totp.js

@@ -0,0 +1,111 @@
+import { ErrorCode } from "../../shared/codes.js";
+
+//#region src/client/factors/totp.ts
+function isSignedInResult(result) {
+	return result.kind === "signedIn";
+}
+function isTotpSetupResult(result) {
+	return result.kind === "totpSetup";
+}
+/** @internal */
+function createTotpClient(deps) {
+	const { proxy, convex, requireApiRefs, proxyFetch, setTokenAndMaybeWait } = deps;
+	const completeSignIn = async (result, flow) => {
+		if (!isSignedInResult(result) || !result.session) return {
+			kind: "failed",
+			code: ErrorCode.TOTP_INVALID_CODE
+		};
+		return await setTokenAndMaybeWait(proxy ? {
+			shouldStore: false,
+			tokens: { token: result.session.token },
+			waitForHandshake: true,
+			context: {
+				provider: "totp",
+				flow
+			}
+		} : {
+			shouldStore: true,
+			tokens: result.session,
+			waitForHandshake: true,
+			context: {
+				provider: "totp",
+				flow
+			}
+		}) ? { kind: "signedIn" } : { kind: "started" };
+	};
+	return {
+		setup: async (opts) => {
+			const params = { flow: "setup" };
+			if (opts?.name) params.name = opts.name;
+			if (opts?.accountName) params.accountName = opts.accountName;
+			if (proxy) {
+				const result$1 = await proxyFetch({
+					action: "auth:signIn",
+					args: {
+						provider: "totp",
+						params
+					}
+				});
+				if (!isTotpSetupResult(result$1)) throw new Error("Server did not return TOTP setup data.");
+				return {
+					uri: result$1.totpSetup.uri,
+					secret: result$1.totpSetup.secret,
+					verifier: result$1.verifier,
+					totpId: result$1.totpSetup.totpId
+				};
+			}
+			const result = await convex.action(requireApiRefs().signIn, {
+				provider: "totp",
+				params
+			});
+			if (!isTotpSetupResult(result)) throw new Error("Server did not return TOTP setup data.");
+			return {
+				uri: result.totpSetup.uri,
+				secret: result.totpSetup.secret,
+				verifier: result.verifier,
+				totpId: result.totpSetup.totpId
+			};
+		},
+		confirm: async (opts) => {
+			const params = {
+				flow: "verify",
+				code: opts.code,
+				totpId: opts.totpId
+			};
+			return completeSignIn(proxy ? await proxyFetch({
+				action: "auth:signIn",
+				args: {
+					provider: "totp",
+					params,
+					verifier: opts.verifier
+				}
+			}) : await convex.action(requireApiRefs().signIn, {
+				provider: "totp",
+				params,
+				verifier: opts.verifier
+			}), "confirm");
+		},
+		verify: async (opts) => {
+			const params = {
+				flow: "verify",
+				code: opts.code
+			};
+			return completeSignIn(proxy ? await proxyFetch({
+				action: "auth:signIn",
+				args: {
+					provider: "totp",
+					params,
+					verifier: opts.verifier
+				}
+			}) : await convex.action(requireApiRefs().signIn, {
+				provider: "totp",
+				params,
+				verifier: opts.verifier
+			}), "verify");
+		}
+	};
+}
+
+//#endregion
+export { createTotpClient };
+//# sourceMappingURL=totp.js.map

package/dist/client/factors/webauthn.js

@@ -0,0 +1,69 @@
+//#region src/client/factors/webauthn.ts
+/**
+* Build the platform-neutral passkey client around a platform ceremony.
+*
+* @internal
+*/
+function createWebAuthnClientCore(deps, ceremony) {
+	const { proxy, convex, requireApiRefs, proxyFetch, setTokenAndMaybeWait } = deps;
+	const requestSignIn = async (params, verifier) => {
+		if (proxy) return await proxyFetch({
+			action: "auth:signIn",
+			args: {
+				provider: "webauthn",
+				params,
+				...verifier ? { verifier } : {}
+			}
+		});
+		return await convex.action(requireApiRefs().signIn, {
+			provider: "webauthn",
+			params,
+			...verifier ? { verifier } : {}
+		});
+	};
+	const handleSignedInResult = async (result, flow) => {
+		if (result.kind !== "signedIn") return { kind: "started" };
+		return await setTokenAndMaybeWait(proxy ? {
+			shouldStore: false,
+			tokens: result.session === null ? null : { token: result.session.token },
+			waitForHandshake: true,
+			context: {
+				provider: "webauthn",
+				flow
+			}
+		} : {
+			shouldStore: true,
+			tokens: result.session,
+			waitForHandshake: true,
+			context: {
+				provider: "webauthn",
+				flow
+			}
+		}) ? { kind: "signedIn" } : { kind: "started" };
+	};
+	return {
+		isSupported: () => ceremony.isSupported(),
+		isAutofillSupported: () => ceremony.isAutofillSupported(),
+		register: async (opts) => {
+			const phase1 = await requestSignIn({
+				flow: "register",
+				userName: opts?.userName,
+				userDisplayName: opts?.userDisplayName
+			});
+			if (phase1.kind !== "webauthnOptions") throw new Error("Server did not return WebAuthn registration options");
+			return handleSignedInResult(await requestSignIn(await ceremony.register(phase1.options, opts), phase1.verifier), "verify");
+		},
+		signIn: async (opts) => {
+			const phase1 = await requestSignIn({
+				flow: "signIn",
+				email: opts?.email
+			});
+			if (phase1.kind !== "webauthnOptions") throw new Error("Server did not return WebAuthn authentication options");
+			return handleSignedInResult(await requestSignIn(await ceremony.signIn(phase1.options, opts), phase1.verifier), "verify");
+		}
+	};
+}
+
+//#endregion
+export { createWebAuthnClientCore };
+//# sourceMappingURL=webauthn.js.map

package/dist/client/index.d.ts

@@ -0,0 +1,60 @@
+import { AnonymousParams, AuthApiRefs, AuthClient, AuthState, BrowserAuthClient, ClientOptions, ClientRuntime, CodeCompletionParams, ConnectionParams, DeviceClient, DeviceCodeResult, DevicePollParams, DeviceVerifyParams, EmailInitiateParams, OAuthCompletionResult, OAuthSignInParams, ParamsForProvider, PasswordParams, PendingInvite, PlatformAuthClient, SignInOverloads, SignInResult, Storage, TotpClient, TotpConfirmParams, TotpSetupOptions, TotpSetupResult, TotpVerifyParams, WebAuthnClient, WebAuthnRegisterOptions, WebAuthnSignInOptions } from "./core/types.js";
+
+//#region src/client/index.d.ts
+/**
+ * Create a framework-agnostic auth client.
+ *
+ * Returns an object with `signIn`, `signOut`, `subscribe`, `getSnapshot`, and any
+ * factor helpers enabled by your configured providers. Platform-specific
+ * WebAuthn support is added by higher-level entrypoints such as
+ * `@estifanos-sh/convex-auth/browser`.
+ *
+ * ### SPA mode (default)
+ *
+ * ```ts
+ * import { ConvexClient } from 'convex/browser';
+ * import { client } from '@estifanos-sh/convex-auth/client';
+ * import { api } from '../convex/_generated/api';
+ *
+ * const convex = new ConvexClient(CONVEX_URL);
+ * const auth = client({ convex, api: api.auth });
+ * ```
+ *
+ * ### Proxy mode
+ *
+ * ```ts
+ * const auth = client({
+ *   convex,
+ *   proxyPath: '/api/auth',
+ *   runtime: myRuntime,
+ * });
+ * ```
+ *
+ * In proxy mode all auth operations go through the injected proxy runtime.
+ * Tokens are stored in httpOnly cookies server-side — the client
+ * holds the JWT in memory only.
+ *
+ * The client resolves auth through a Convex confirmation handshake. For SSR,
+ * pass the server-known token via `token` so hydration starts from the same
+ * resolved state. The returned client also auto-wires its tokens into the
+ * passed Convex client via `setAuth`, so queries and mutations are
+ * authenticated without further configuration.
+ *
+ * While a sign-in handshake is pending, a transient `false` from the Convex
+ * client does not reject the session: Convex can emit `false` mid-reauth and a
+ * subsequent `true` confirms the same session. Rejection happens only on
+ * timeout or when the token actually changes or clears.
+ *
+ * @param options - Client configuration. See {@link ClientOptions}.
+ * @typeParam Api - An AuthApiRefs type determining which factor helpers are available.
+ * @returns Auth client with conditional `totp` and `device` helpers.
+ * @throws {Error} When the Convex deployment URL cannot be determined and `url` is not passed explicitly.
+ * @throws {Error} When `proxyPath` is not set and the `api` option is missing.
+ * @throws {Error} When `proxyPath` is set and `runtime.proxy` is missing.
+ * @throws {Error} When `token` has leading or trailing whitespace. An empty or
+ *   whitespace-only string is treated as an explicit signed-out seed, not an error.
+ */
+declare function client<Api extends AuthApiRefs<boolean, boolean, boolean> = AuthApiRefs>(options: ClientOptions<Api>): AuthClient<Api>;
+//#endregion
+export { type AnonymousParams, type AuthApiRefs, type AuthClient, type AuthState, type BrowserAuthClient, type ClientOptions, type ClientRuntime, type CodeCompletionParams, type ConnectionParams, type DeviceClient, type DeviceCodeResult, type DevicePollParams, type DeviceVerifyParams, type EmailInitiateParams, type OAuthCompletionResult, type OAuthSignInParams, type ParamsForProvider, type PasswordParams, type PendingInvite, type PlatformAuthClient, type SignInOverloads, type SignInResult, type Storage, type TotpClient, type TotpConfirmParams, type TotpSetupOptions, type TotpSetupResult, type TotpVerifyParams, type WebAuthnClient, type WebAuthnRegisterOptions, type WebAuthnSignInOptions, client };
+//# sourceMappingURL=index.d.ts.map