@estifanos-sh/convex-auth 0.0.1-preview.0

package/dist/server/runtime.js

@@ -0,0 +1,387 @@
+import { requireEnv } from "./env.js";
+import { appUrlFromEnv, authUrlFromEnv } from "./url.js";
+import { INVITE_TOKEN_ALPHABET, generateRandomString, sha256 } from "./random.js";
+import { createAuthEventDomain, emitAuthEvent } from "./events.js";
+import { log } from "./log.js";
+import { verifyOAuthToken } from "./tokens.js";
+import { createCoreDomains } from "./core.js";
+import { callModifyAccount } from "./mutations/account.js";
+import { callInvalidateSessions } from "./mutations/invalidate.js";
+import { vPayloadRecord } from "./payloads.js";
+import { normalizeGroupConnectionPolicy } from "./connection/policy.js";
+import { callUserOAuth } from "./mutations/oauth.js";
+import { callCreateAccountFromCredentials } from "./mutations/register.js";
+import { callRetrieveAccountWithCredentials } from "./mutations/retrieve.js";
+import { callVerifierSignature } from "./mutations/signature.js";
+import { callSignOut } from "./mutations/signout.js";
+import { storeImpl, vStoreArgs } from "./mutations/store.js";
+import { extractBearerToken } from "./utils/bearer.js";
+import { addAuthRoutes, addOAuthProviderRoutes, addOpenIdRoutes, addWellKnownRoutes, createHttpAction, createHttpContext, createHttpRoute } from "./http.js";
+import { addMcpRoutes } from "./mcp.js";
+import { createAuthorizeHandler } from "./oauth/authorize.js";
+import { createOAuthHttpHandlers } from "./oauth/handlers.js";
+import { createRegisterHandler } from "./oauth/register.js";
+import { createClientManagementHandler } from "./oauth/manage.js";
+import { createTokenHandler } from "./oauth/token.js";
+import { wellKnown } from "./wellknown.js";
+import { encryptSecret } from "./secret.js";
+import { createGroupService } from "./connection/group/service.js";
+import { createFactorUnlinkHelpers } from "./services/factors.js";
+import { resolveServerServices } from "./services/resolve.js";
+import { signInImpl } from "./signin/flow.js";
+import { createGroupConnectionDomain } from "./connection/domain.js";
+import { addGroupHttpRuntime } from "./connection/http.js";
+import { v } from "convex/values";
+import { actionGeneric, httpRouter, internalMutationGeneric } from "convex/server";
+
+//#region src/server/runtime.ts
+const GROUP_CONNECTION_OIDC_CLIENT_SECRET_KIND = "oidc_client_secret";
+/**
+* Single sanctioned bridge across an irreducible cross-package ctx/domain
+* family boundary. Several runtime values are structurally equivalent at
+* runtime to a consumer's nominal type but cannot be positively unified by
+* TypeScript — e.g. the {@link enrichCtx}-enriched action ctx versus the
+* sign-in service's `GenericActionCtxWithAuthConfig`, or the assembled
+* `authBase` versus the HTTP context's `HttpContextAuthLike`. This is the one
+* narrow, typed assertion those boundaries route through; callers name the
+* exact target via the `T` type argument so the result stays precisely typed.
+*/
+function bridgeRuntimeType(value) {
+	return value;
+}
+/**
+* Preserve Convex action context behavior while replacing `ctx.auth`.
+*
+* Convex context methods can be non-enumerable or prototype-backed. A plain
+* `{ ...ctx, auth }` drops those methods in packaged builds, so calls such as
+* `ctx.runQuery(...)` disappear inside provider flows. Forward the call methods
+* bound to the original ctx and preserve the rest of the context descriptors.
+*
+* @internal
+*/
+function enrichActionCtx(ctx, auth) {
+	const { auth: _authDescriptor, runAction: _runActionDescriptor, runMutation: _runMutationDescriptor, runQuery: _runQueryDescriptor, ...descriptors } = Object.getOwnPropertyDescriptors(ctx);
+	const enriched = Object.create(Object.getPrototypeOf(ctx), descriptors);
+	Object.defineProperties(enriched, {
+		auth: {
+			configurable: true,
+			enumerable: true,
+			value: auth,
+			writable: true
+		},
+		runAction: {
+			configurable: true,
+			value: ctx.runAction.bind(ctx),
+			writable: true
+		},
+		runMutation: {
+			configurable: true,
+			value: ctx.runMutation.bind(ctx),
+			writable: true
+		},
+		runQuery: {
+			configurable: true,
+			value: ctx.runQuery.bind(ctx),
+			writable: true
+		}
+	});
+	return enriched;
+}
+/**
+* Configure the Convex Auth library. Returns an object with
+* functions and `auth` helper. You must export the functions
+* from `convex/auth.ts` to make them callable:
+*
+* ```ts filename="convex/auth.ts"
+* import { defineAuth } from "@estifanos-sh/convex-auth/component";
+* import { components } from "./_generated/api";
+*
+* export const auth = defineAuth(components.auth, {
+*   providers: [],
+* });
+* export const { signIn, signOut, store } = auth;
+* ```
+*
+* Mount the auth HTTP routes from `convex/http.ts`:
+*
+* ```ts filename="convex/http.ts"
+* import { auth } from "./auth";
+*
+* export default auth.http();
+* ```
+*
+* @returns An object with fields you should reexport from your
+*          `convex/auth.ts` file, plus the `http` router factory.
+*/
+function Auth(config_) {
+	const services = resolveServerServices(config_);
+	const config = services.config;
+	const delegatableGrants = [...config.permissions?.grants ?? []];
+	const hasOAuth = config.providers.some((provider) => provider.type === "oauth");
+	const hasConnection = config.providers.some((provider) => provider.type === "connection");
+	const ssoProvider = config.providers.find((provider) => provider.type === "connection");
+	const getProviderOrThrow = services.providerRegistry.getProviderOrThrow;
+	const INVITE_TOKEN_LENGTH = 48;
+	const GROUP_CONNECTION_ROUTE_BASE = "/connections";
+	const routePrefix = config.path ?? "/auth";
+	const authSiteUrl = () => authUrlFromEnv(routePrefix);
+	const authCallbackUrl = (providerId) => `${authSiteUrl()}/callback/${providerId}`;
+	const group = createGroupService({
+		config,
+		sha256
+	});
+	const authRequireEnv = (name) => name === "CONVEX_SITE_URL" ? authSiteUrl() : requireEnv(name);
+	const authBase = {
+		...createCoreDomains({
+			config,
+			callInvalidateSessions,
+			callCreateAccountFromCredentials,
+			callRetrieveAccountWithCredentials,
+			callModifyAccount,
+			getEnrichCtx: () => enrichCtx,
+			inviteTokenAlphabet: INVITE_TOKEN_ALPHABET,
+			inviteTokenLength: INVITE_TOKEN_LENGTH,
+			signInForProvider: async (ctx, providerConfig, args) => {
+				const materialized = typeof providerConfig === "function" ? providerConfig() : providerConfig;
+				const result = await signInImpl(bridgeRuntimeType(enrichCtx(ctx)), materialized, args, {
+					generateTokens: false,
+					allowExtraProviders: true
+				});
+				if (result.kind === "signedIn") {
+					const session = result.session;
+					if (session === null || session === void 0) return null;
+					const userId = session.userId;
+					const sessionId = session.sessionId ?? session._id;
+					if (userId === void 0 || sessionId === void 0) return null;
+					return {
+						userId,
+						sessionId
+					};
+				}
+				return result;
+			}
+		}),
+		event: createAuthEventDomain(config),
+		connection: createGroupConnectionDomain({
+			config,
+			getGroupConnectionSecret: group.getGroupConnectionSecret,
+			loadConnectionOrThrow: group.loadConnectionOrThrow,
+			validateGroupConnectionPolicy: group.validateGroupConnectionPolicy,
+			emitGroupAuthEvent: group.emitGroupAuthEvent,
+			connectionNotFoundError: "Connection not found.",
+			GROUP_CONNECTION_OIDC_CLIENT_SECRET_KIND,
+			requireEnv: authRequireEnv,
+			generateRandomString,
+			INVITE_TOKEN_ALPHABET,
+			sha256,
+			encryptSecret,
+			loadGroupPolicyOrThrow: group.loadGroupPolicyOrThrow
+		})
+	};
+	const getDefaultCorsOrigins = () => [new URL(appUrlFromEnv()).origin];
+	const getAuthSiteUrl = (_ctx) => authSiteUrl();
+	const oauthHttpHandlers = createOAuthHttpHandlers({
+		config,
+		getProviderOrThrow,
+		authCallbackUrl
+	});
+	const request = {
+		mount: (http$1) => {
+			const protocolRequireEnv = (name) => name === "CONVEX_SITE_URL" ? authSiteUrl() : requireEnv(name);
+			addOpenIdRoutes(http$1, {
+				routeBase: routePrefix,
+				getIssuer: authSiteUrl,
+				getJwks: () => requireEnv("JWKS"),
+				oauth: config.oauth ? { scopes: delegatableGrants } : void 0
+			});
+			addWellKnownRoutes(http$1, { getResponse: (endpoint) => wellKnown(endpoint) });
+			addGroupHttpRuntime({
+				http: http$1,
+				hasConnection,
+				auth: authBase,
+				config,
+				routeBase: `${routePrefix}${GROUP_CONNECTION_ROUTE_BASE}`,
+				requireEnv: protocolRequireEnv,
+				loadActiveConnectionSamlOrThrow: group.loadActiveConnectionSamlOrThrow,
+				loadConnectionOidcOrThrow: group.loadConnectionOidcOrThrow,
+				getGroupConnectionScimContext: group.getGroupConnectionScimContext,
+				loadGroupPolicyOrThrow: group.loadGroupPolicyOrThrow,
+				normalizeGroupConnectionPolicy,
+				emitGroupAuthEvent: group.emitGroupAuthEvent,
+				generateRandomString,
+				inviteTokenAlphabet: INVITE_TOKEN_ALPHABET,
+				callUserOAuth,
+				callVerifierSignature,
+				sharedOidcRedirectURI: ssoProvider?.redirectURI
+			});
+			if (config.oauth) addOAuthProviderRoutes(http$1, {
+				routeBase: routePrefix,
+				handleAuthorize: createAuthorizeHandler({
+					getClient: (ctx, clientId) => authBase.oauth.client.get(ctx, { clientId }),
+					consentPage: config.oauth.pages.consent,
+					authSiteUrl
+				}),
+				handleToken: createTokenHandler({
+					issuer: authSiteUrl,
+					getClient: (ctx, clientId) => authBase.oauth.client.get(ctx, { clientId }),
+					getCode: async (ctx, codeHash) => await ctx.runQuery(config.component.oauth.code.get, { codeHash }),
+					verifyClientSecret: (ctx, clientId, clientSecret) => authBase.oauth.client.verify(ctx, {
+						clientId,
+						clientSecret
+					}),
+					acceptCode: (ctx, codeHash, clientId, redirectUri, codeChallenge, refresh) => authBase.oauth.code.accept(ctx, {
+						codeHash,
+						clientId,
+						redirectUri,
+						codeChallenge,
+						refresh
+					}),
+					mintRefresh: () => authBase.oauth.refresh.mint(),
+					exchangeRefresh: (ctx, args) => authBase.oauth.refresh.exchange(ctx, args),
+					emitEvent: async (ctx, event) => await emitAuthEvent(ctx, config, event)
+				}),
+				handleRegister: createRegisterHandler({
+					createClient: (ctx, opts) => authBase.oauth.client.create(ctx, { data: {
+						...opts,
+						extend: { kind: "dcr" }
+					} }),
+					allowedScopes: delegatableGrants,
+					registrationClientUri: (clientId) => `${authSiteUrl()}/oauth2/register/${clientId}`
+				}),
+				handleManage: createClientManagementHandler({
+					verifyRegistrationToken: (ctx, args) => authBase.oauth.client.verifyRegistrationToken(ctx, args),
+					update: (ctx, args) => authBase.oauth.client.update(ctx, args),
+					revoke: (ctx, args) => authBase.oauth.client.revoke(ctx, args),
+					allowedScopes: delegatableGrants,
+					registrationClientUri: (clientId) => `${authSiteUrl()}/oauth2/register/${clientId}`
+				})
+			});
+			if (hasOAuth) addAuthRoutes(http$1, {
+				routeBase: routePrefix,
+				...oauthHttpHandlers
+			});
+		},
+		routes: () => {
+			const http$1 = httpRouter();
+			request.mount(http$1);
+			return http$1.getRoutes().map(([path, method, handler]) => path.endsWith("*") ? {
+				pathPrefix: path.slice(0, -1),
+				method,
+				handler
+			} : {
+				path,
+				method,
+				handler
+			});
+		},
+		context: createHttpContext(bridgeRuntimeType(authBase), { issuer: authSiteUrl }),
+		action: createHttpAction(authBase, getDefaultCorsOrigins),
+		route: createHttpRoute(createHttpAction(authBase, getDefaultCorsOrigins), getDefaultCorsOrigins),
+		mcp: (http$1, tools, opts) => {
+			if (config.oauth === void 0) throw new Error("`auth.request.mcp(...)` requires `oauth` to be configured in `defineAuth` — the MCP server is protected by the OAuth authorization server.");
+			if (delegatableGrants.length === 0) throw new Error("`auth.request.mcp(...)` requires `permissions` with at least one grant — MCP tools delegate your app's grants, and none are defined.");
+			const mcpPath = opts?.mcpPath ?? "/mcp";
+			const canonicalResource = () => requireEnv("CONVEX_SITE_URL").replace(/\/+$/, "") + mcpPath;
+			addMcpRoutes(http$1, {
+				tools,
+				name: opts?.name,
+				version: opts?.version,
+				scopes: delegatableGrants,
+				mcpPath,
+				resource: canonicalResource,
+				authorizationServers: () => [authSiteUrl()],
+				resolveScopes: async (_ctx, request$1) => {
+					const token = extractBearerToken(request$1);
+					if (token === null) return null;
+					const verified = await verifyOAuthToken(token, {
+						issuer: authSiteUrl(),
+						resource: canonicalResource()
+					});
+					return verified ? verified.scopes : null;
+				}
+			});
+		}
+	};
+	const auth = Object.assign(authBase, { request });
+	/**
+	* App-owned HTTP router factory. `auth.http()` returns a Convex `httpRouter()`
+	* with every auth protocol route mounted via {@link request.mount}, so there is
+	* exactly one route table.
+	*/
+	const http = () => {
+		const router = httpRouter();
+		request.mount(router);
+		return router;
+	};
+	const { accountUnlink, passkeyDelete, totpDelete } = createFactorUnlinkHelpers(config);
+	const enrichedAccount = Object.assign({}, auth.account, { unlink: accountUnlink });
+	const passkeyHelpers = { remove: passkeyDelete };
+	const totpHelpers = { remove: totpDelete };
+	const enrichCtx = (ctx) => enrichActionCtx(ctx, {
+		...ctx.auth,
+		getUserIdentity: ctx.auth.getUserIdentity.bind(ctx.auth),
+		config,
+		account: enrichedAccount,
+		passkey: passkeyHelpers,
+		totp: totpHelpers,
+		session: auth.session,
+		member: auth.member,
+		provider: auth.provider,
+		event: auth.event
+	});
+	return {
+		auth,
+		signIn: actionGeneric({
+			args: {
+				provider: v.optional(v.string()),
+				params: v.optional(vPayloadRecord),
+				verifier: v.optional(v.string()),
+				refreshToken: v.optional(v.string()),
+				calledBy: v.optional(v.string())
+			},
+			handler: async (ctx, args) => {
+				if (args.calledBy !== void 0) log("INFO", `\`auth:signIn\` called by ${args.calledBy}`);
+				const provider = args.provider !== void 0 ? getProviderOrThrow(args.provider) : null;
+				const authSiteUrl$1 = provider?.type === "oauth" || provider?.type === "connection" ? getAuthSiteUrl(ctx) : void 0;
+				const result = await signInImpl(bridgeRuntimeType(enrichCtx(ctx)), provider, args, {
+					generateTokens: true,
+					allowExtraProviders: false,
+					authSiteUrl: authSiteUrl$1,
+					resolveConnectionProtocol: group.resolveGroupConnectionConnectionProtocolOrThrow
+				});
+				const resultKind = result.kind;
+				/** Exhaustive narrowing dispatch: only `signedIn` reshapes its session into tokens; every other variant passes through unchanged. */
+				switch (result.kind) {
+					case "signedIn": return {
+						kind: "signedIn",
+						session: result.session?.tokens ?? null
+					};
+					case "redirect":
+					case "started":
+					case "webauthnOptions":
+					case "totpRequired":
+					case "totpSetup":
+					case "deviceCode": return result;
+					default: throw new Error(`Unexpected sign-in result kind: ${resultKind}`);
+				}
+			}
+		}),
+		signOut: actionGeneric({
+			args: {},
+			handler: async (ctx) => {
+				await callSignOut(ctx);
+			}
+		}),
+		store: internalMutationGeneric({
+			args: vStoreArgs,
+			handler: async (ctx, args) => {
+				return storeImpl(ctx, args, services);
+			}
+		}),
+		http
+	};
+}
+
+//#endregion
+export { Auth };
+//# sourceMappingURL=runtime.js.map

package/dist/server/secret.js

@@ -0,0 +1,46 @@
+import { ErrorCode } from "../shared/codes.js";
+import { requireEnv } from "./env.js";
+import { ConvexError } from "convex/values";
+import { sha256 } from "@oslojs/crypto/sha2";
+import { decodeBase64urlIgnorePadding, encodeBase64urlNoPadding } from "@oslojs/encoding";
+
+//#region src/server/secret.ts
+const SECRET_KEY_ENV = "AUTH_SECRET_ENCRYPTION_KEY";
+const SECRET_IV_LENGTH = 12;
+function toArrayBuffer(bytes) {
+	return bytes.buffer.slice(bytes.byteOffset, bytes.byteOffset + bytes.byteLength);
+}
+async function getSecretCryptoKey() {
+	const material = requireEnv(SECRET_KEY_ENV);
+	const rawKey = sha256(new TextEncoder().encode(material));
+	return await crypto.subtle.importKey("raw", toArrayBuffer(rawKey), { name: "AES-GCM" }, false, ["encrypt", "decrypt"]);
+}
+/** @internal */
+async function encryptSecret(value) {
+	const key = await getSecretCryptoKey();
+	const iv = crypto.getRandomValues(new Uint8Array(SECRET_IV_LENGTH));
+	const encrypted = await crypto.subtle.encrypt({
+		name: "AES-GCM",
+		iv: toArrayBuffer(iv)
+	}, key, toArrayBuffer(new TextEncoder().encode(value)));
+	return `${encodeBase64urlNoPadding(iv)}.${encodeBase64urlNoPadding(new Uint8Array(encrypted))}`;
+}
+/** @internal */
+async function decryptSecret(ciphertext) {
+	const parts = ciphertext.split(".");
+	if (parts.length !== 2 || !parts[0] || !parts[1]) throw new ConvexError({
+		code: ErrorCode.INVALID_PARAMETERS,
+		message: "Stored group connection secret is malformed."
+	});
+	const [ivEncoded, payloadEncoded] = parts;
+	const key = await getSecretCryptoKey();
+	const decrypted = await crypto.subtle.decrypt({
+		name: "AES-GCM",
+		iv: toArrayBuffer(decodeBase64urlIgnorePadding(ivEncoded))
+	}, key, toArrayBuffer(decodeBase64urlIgnorePadding(payloadEncoded)));
+	return new TextDecoder().decode(decrypted);
+}
+
+//#endregion
+export { decryptSecret, encryptSecret };
+//# sourceMappingURL=secret.js.map

package/dist/server/services/factors.js

@@ -0,0 +1,117 @@
+import { ErrorCode } from "../../shared/codes.js";
+import { emitAuthEvent } from "../events.js";
+import { ConvexError } from "convex/values";
+
+//#region src/server/services/factors.ts
+const convexError = (data) => new ConvexError(data);
+/**
+* Build the factor-unlink helpers bound to a resolved auth `config`.
+*
+* @returns `accountUnlink`, `passkeyDelete`, and `totpDelete`.
+*/
+function createFactorUnlinkHelpers(config) {
+	const accountUnlink = async (ctx, args) => {
+		const accountDoc = await ctx.runQuery(config.component.account.get, { id: args.accountId });
+		if (accountDoc === null) throw convexError({
+			code: ErrorCode.ACCOUNT_NOT_FOUND,
+			message: "Account not found."
+		});
+		await ctx.runMutation(config.component.account.remove, { id: args.accountId });
+		const userId = accountDoc.userId;
+		const provider = accountDoc.provider;
+		await emitAuthEvent(ctx, config, {
+			kind: "account.unlinked",
+			actor: {
+				type: "user",
+				id: userId
+			},
+			subject: {
+				type: "account",
+				id: args.accountId
+			},
+			targets: [{
+				kind: "user",
+				id: userId
+			}],
+			outcome: "success",
+			data: {
+				accountId: args.accountId,
+				provider
+			}
+		});
+		return {
+			accountId: args.accountId,
+			userId,
+			provider
+		};
+	};
+	const passkeyDelete = async (ctx, args) => {
+		const passkeyDoc = await ctx.runQuery(config.component.factor.passkey.get, { id: args.passkeyId });
+		if (passkeyDoc === null) throw convexError({
+			code: ErrorCode.PASSKEY_NOT_FOUND,
+			message: "Passkey not found."
+		});
+		await ctx.runMutation(config.component.factor.passkey.remove, { id: args.passkeyId });
+		const userId = passkeyDoc.userId;
+		await emitAuthEvent(ctx, config, {
+			kind: "passkey.removed",
+			actor: {
+				type: "user",
+				id: userId
+			},
+			subject: {
+				type: "passkey",
+				id: args.passkeyId
+			},
+			targets: [{
+				kind: "user",
+				id: userId
+			}],
+			outcome: "success",
+			data: { passkeyId: args.passkeyId }
+		});
+		return {
+			passkeyId: args.passkeyId,
+			userId
+		};
+	};
+	const totpDelete = async (ctx, args) => {
+		const totpDoc = await ctx.runQuery(config.component.factor.totp.get, { id: args.totpId });
+		if (totpDoc === null) throw convexError({
+			code: ErrorCode.TOTP_NOT_FOUND,
+			message: "TOTP factor not found."
+		});
+		await ctx.runMutation(config.component.factor.totp.remove, { id: args.totpId });
+		const userId = totpDoc.userId;
+		await emitAuthEvent(ctx, config, {
+			kind: "totp.removed",
+			actor: {
+				type: "user",
+				id: userId
+			},
+			subject: {
+				type: "totp",
+				id: args.totpId
+			},
+			targets: [{
+				kind: "user",
+				id: userId
+			}],
+			outcome: "success",
+			data: { totpId: args.totpId }
+		});
+		return {
+			totpId: args.totpId,
+			userId
+		};
+	};
+	return {
+		accountUnlink,
+		passkeyDelete,
+		totpDelete
+	};
+}
+
+//#endregion
+export { createFactorUnlinkHelpers };
+//# sourceMappingURL=factors.js.map

package/dist/server/services/providers.js

@@ -0,0 +1,23 @@
+import { LOG_LEVELS } from "../../shared/log.js";
+import { ErrorCode } from "../../shared/codes.js";
+import { listAvailableProviders } from "../config.js";
+import { ConvexError } from "convex/values";
+
+//#region src/server/services/providers.ts
+const createProviderRegistry = (config, logger) => ({ getProviderOrThrow: (id, allowExtraProviders = false) => {
+	const provider = config.providers.find((configuredProvider) => configuredProvider.id === id) ?? (allowExtraProviders ? config.extraProviders.find((configuredProvider) => configuredProvider.id === id) : void 0);
+	if (provider === void 0) {
+		const detail = `Provider \`${id}\` is not configured, available providers are ${listAvailableProviders(config, allowExtraProviders)}.`;
+		logger.log(LOG_LEVELS.ERROR, detail);
+		throw new ConvexError({
+			code: ErrorCode.PROVIDER_NOT_CONFIGURED,
+			message: detail,
+			provider: id
+		});
+	}
+	return provider;
+} });
+
+//#endregion
+export { createProviderRegistry };
+//# sourceMappingURL=providers.js.map

package/dist/server/services/resolve.js

@@ -0,0 +1,17 @@
+import { logMessage } from "../../shared/log.js";
+import { configDefaults } from "../config.js";
+import { createProviderRegistry } from "./providers.js";
+
+//#region src/server/services/resolve.ts
+const logger = { log: (level, ...args) => logMessage("convex-auth", level, args) };
+function resolveServerServices(config) {
+	const configValue = configDefaults(config);
+	return {
+		config: configValue,
+		providerRegistry: createProviderRegistry(configValue, logger)
+	};
+}
+
+//#endregion
+export { resolveServerServices };
+//# sourceMappingURL=resolve.js.map

package/dist/server/session/lifecycle.d.ts

@@ -0,0 +1,23 @@
+import { RefreshToken } from "../../shared/brand.js";
+import { SessionTokenIdentityClaims } from "../types.js";
+import { GenericId } from "convex/values";
+
+//#region src/server/session/lifecycle.d.ts
+/**
+ * Mutation-side session issuance result. The mutation creates the session
+ * and refresh-token rows; JWT signing happens on the action side so the
+ * transaction commits without paying the signing CPU cost.
+ */
+type SessionIssuance = {
+  userId: GenericId<"User">;
+  sessionId: GenericId<"Session">;
+  identity: SessionTokenIdentityClaims;
+  /**
+   * Encoded refresh token (`${refreshTokenId}|${sessionId}`), or `null` when
+   * the caller opted out of refresh-token issuance (e.g. TOTP step-up).
+   */
+  refreshToken: RefreshToken | null;
+};
+//#endregion
+export { SessionIssuance };
+//# sourceMappingURL=lifecycle.d.ts.map