@estifanos-sh/convex-auth 0.0.2 → 0.0.3

package/dist/component/account.d.ts

@@ -1,67 +1,73 @@
 import { SessionRows } from "./session.js";
-import * as convex_values2561 from "convex/values";
-import * as convex_server109 from "convex/server";
+import * as convex_values2031 from "convex/values";
+import * as convex_server105 from "convex/server";
 
 //#region src/component/account.d.ts
 declare namespace account_d_exports {
   export { beginCredentialsSignIn, completeCredentialsSignIn, create, get, list, remove, update };
 }
-type AcceptedCredentialsSignIn = SessionRows & {
+type AcceptedCredentialsSignIn = Omit<SessionRows, "epoch"> & {
   status: "accepted";
 };
 /** Reserve a password attempt and load all sign-in state in one transaction. */
-declare const beginCredentialsSignIn: convex_server109.RegisteredMutation<"public", {
+declare const beginCredentialsSignIn: convex_server105.RegisteredMutation<"public", {
   provider: string;
   providerAccountId: string;
+  limitIdentifier: string;
   maxAttemptsPerHour: number;
   reserveAttempt: boolean;
   includeTotp: boolean;
 }, Promise<{
-  status: "invalid";
+  status: "limited";
   account?: undefined;
   user?: undefined;
   hasTotp?: undefined;
 } | {
-  status: "limited";
+  status: "invalid";
   account?: undefined;
   user?: undefined;
   hasTotp?: undefined;
 } | {
   status: "ready";
   account: {
-    _id: convex_values2561.GenericId<"Account">;
+    _id: convex_values2031.GenericId<"Account">;
     _creationTime: number;
-    emailVerified?: string | undefined;
     extend?: any;
     secret?: string | undefined;
+    emailVerified?: string | undefined;
     phoneVerified?: string | undefined;
-    userId: convex_values2561.GenericId<"User">;
     provider: string;
+    userId: convex_values2031.GenericId<"User">;
     providerAccountId: string;
   };
   user: {
-    _id: convex_values2561.GenericId<"User">;
+    _id: convex_values2031.GenericId<"User">;
     _creationTime: number;
-    name?: string | undefined;
     email?: string | undefined;
-    image?: string | undefined;
+    extend?: any;
     phone?: string | undefined;
+    name?: string | undefined;
     firstName?: string | undefined;
     lastName?: string | undefined;
+    image?: string | undefined;
     emailVerificationTime?: number | undefined;
     phoneVerificationTime?: number | undefined;
     isAnonymous?: boolean | undefined;
-    lastActiveGroup?: convex_values2561.GenericId<"Group"> | undefined;
-    extend?: any;
+    lastActiveGroup?: convex_values2031.GenericId<"Group"> | undefined;
+    sessionEpoch?: number | undefined;
   };
   hasTotp: boolean;
 }>>;
 /** Refund a verified password attempt and optionally issue its session atomically. */
-declare const completeCredentialsSignIn: convex_server109.RegisteredMutation<"public", {
-  replaceSessionId?: convex_values2561.GenericId<"Session"> | undefined;
-  accountId: convex_values2561.GenericId<"Account">;
+declare const completeCredentialsSignIn: convex_server105.RegisteredMutation<"public", {
+  replaceSession?: {
+    sessionId: convex_values2031.GenericId<"Session">;
+    authenticatedUserId: convex_values2031.GenericId<"User">;
+  } | undefined;
+  accountId: convex_values2031.GenericId<"Account">;
   sessionExpirationTime: number;
   refreshTokenExpirationTime: number;
+  limitIdentifier: string;
   issueSession: boolean;
   generateTokens: boolean;
 }, Promise<AcceptedCredentialsSignIn | {
@@ -73,53 +79,53 @@ declare const completeCredentialsSignIn: convex_server109.RegisteredMutation<"pu
  * Read an account by id, or by `{ provider, providerAccountId }` when both
  * are given. Returns `null` when no selector matches.
  */
-declare const get: convex_server109.RegisteredQuery<"public", {
-  id?: convex_values2561.GenericId<"Account"> | undefined;
+declare const get: convex_server105.RegisteredQuery<"public", {
+  id?: convex_values2031.GenericId<"Account"> | undefined;
   provider?: string | undefined;
   providerAccountId?: string | undefined;
 }, Promise<{
-  _id: convex_values2561.GenericId<"Account">;
+  _id: convex_values2031.GenericId<"Account">;
   _creationTime: number;
-  emailVerified?: string | undefined;
   extend?: any;
   secret?: string | undefined;
+  emailVerified?: string | undefined;
   phoneVerified?: string | undefined;
-  userId: convex_values2561.GenericId<"User">;
   provider: string;
+  userId: convex_values2031.GenericId<"User">;
   providerAccountId: string;
 } | null>>;
 /** List the accounts owned by a user. */
-declare const list: convex_server109.RegisteredQuery<"public", {
-  userId: convex_values2561.GenericId<"User">;
+declare const list: convex_server105.RegisteredQuery<"public", {
+  userId: convex_values2031.GenericId<"User">;
 }, Promise<{
-  _id: convex_values2561.GenericId<"Account">;
+  _id: convex_values2031.GenericId<"Account">;
   _creationTime: number;
-  emailVerified?: string | undefined;
   extend?: any;
   secret?: string | undefined;
+  emailVerified?: string | undefined;
   phoneVerified?: string | undefined;
-  userId: convex_values2561.GenericId<"User">;
   provider: string;
+  userId: convex_values2031.GenericId<"User">;
   providerAccountId: string;
 }[]>>;
 /** Insert a new account. */
-declare const create: convex_server109.RegisteredMutation<"public", {
+declare const create: convex_server105.RegisteredMutation<"public", {
   extend?: any;
   secret?: string | undefined;
-  userId: convex_values2561.GenericId<"User">;
   provider: string;
+  userId: convex_values2031.GenericId<"User">;
   providerAccountId: string;
-}, Promise<convex_values2561.GenericId<"Account">>>;
+}, Promise<convex_values2031.GenericId<"Account">>>;
 /** Patch fields on an account. */
-declare const update: convex_server109.RegisteredMutation<"public", {
-  id: convex_values2561.GenericId<"Account">;
+declare const update: convex_server105.RegisteredMutation<"public", {
+  id: convex_values2031.GenericId<"Account">;
   patch: {
-    emailVerified?: string | undefined;
     extend?: any;
-    userId?: convex_values2561.GenericId<"User"> | undefined;
     provider?: string | undefined;
+    userId?: convex_values2031.GenericId<"User"> | undefined;
     providerAccountId?: string | undefined;
     secret?: string | undefined;
+    emailVerified?: string | undefined;
     phoneVerified?: string | undefined;
   };
 }, Promise<null>>;
@@ -127,10 +133,10 @@ declare const update: convex_server109.RegisteredMutation<"public", {
  * Delete an account. When `requireOtherAccount` is set, refuses to delete the
  * user's last remaining account so they are never left with none.
  */
-declare const remove: convex_server109.RegisteredMutation<"public", {
-  userId?: convex_values2561.GenericId<"User"> | undefined;
+declare const remove: convex_server105.RegisteredMutation<"public", {
+  userId?: convex_values2031.GenericId<"User"> | undefined;
   requireOtherAccount?: boolean | undefined;
-  id: convex_values2561.GenericId<"Account">;
+  id: convex_values2031.GenericId<"Account">;
 }, Promise<null>>;
 //#endregion
 export { account_d_exports };

package/dist/component/account.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"account.d.ts","names":[],"sources":["../../src/component/account.ts"],"mappings":";;;;;;;;KAmBK,yBAAA,GAA4B,WAAA;EAAgB,MAAA;AAAA;;cAGpC,sBAAA,mBAAsB,kBAAA;;;;;;;;;;;;;;;;;;;SAqDjC,iBAAA,CAAA,SAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;cAGW,yBAAA,mBAAyB,kBAAA;qBA4CpC,iBAAA,CAAA,SAAA;;;;;;;;;;;;;;;cAMW,GAAA,mBAAG,eAAA;OAmBd,iBAAA,CAAA,SAAA;;;;;;;;;;;;;;;cAGW,IAAA,mBAAI,eAAA;UASf,iBAAA,CAAA,SAAA;AAAA;;;;;;;;;;;;cAGW,MAAA,mBAAM,kBAAA;;;UAqCjB,iBAAA,CAAA,SAAA;;;;;cAGW,MAAA,mBAAM,kBAAA;MAkBjB,iBAAA,CAAA,SAAA;;;;;;;;;;;;;;;cAMI,MAAA,mBAAM,kBAAA;WAmCV,iBAAA,CAAA,SAAA"}
+{"version":3,"file":"account.d.ts","names":[],"sources":["../../src/component/account.ts"],"mappings":";;;;;;;;KAmBK,yBAAA,GAA4B,IAAA,CAAK,WAAA;EAA0B,MAAA;AAAA;;cAGnD,sBAAA,mBAAsB,kBAAA;;;;;;;;;;;;;;;;;;;;SAuDjC,iBAAA,CAAA,SAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;cAGW,yBAAA,mBAAyB,kBAAA;;eA6CpC,iBAAA,CAAA,SAAA;;;;;;;;;;;;;;;;;;cAMW,GAAA,mBAAG,eAAA;OAmBd,iBAAA,CAAA,SAAA;;;;;;;;;;;;;;;cAGW,IAAA,mBAAI,eAAA;UASf,iBAAA,CAAA,SAAA;AAAA;;;;;;;;;;;;cAGW,MAAA,mBAAM,kBAAA;;;;UAqCjB,iBAAA,CAAA,SAAA;;;;cAGW,MAAA,mBAAM,kBAAA;MAkBjB,iBAAA,CAAA,SAAA;;;;;;;;;;;;;;;cAMI,MAAA,mBAAM,kBAAA;WAmCV,iBAAA,CAAA,SAAA"}

package/dist/component/account.js

@@ -3,7 +3,7 @@ import { vAccountDoc, vUserDoc } from "./model.js";
 import { mutation, query } from "./_generated/server.js";
 import "./functions.js";
 import { recordSignInLimit, resetSignInLimit } from "./limits.js";
-import { createSessionRows } from "./session.js";
+import { createSessionRows, vSessionReplacement } from "./session.js";
 import { ConvexError, v } from "convex/values";
 
 //#region src/component/account.ts
@@ -21,6 +21,7 @@ const beginCredentialsSignIn = mutation({
 	args: {
 		provider: v.string(),
 		providerAccountId: v.string(),
+		limitIdentifier: v.string(),
 		maxAttemptsPerHour: v.number(),
 		reserveAttempt: v.boolean(),
 		includeTotp: v.boolean()
@@ -32,20 +33,16 @@ const beginCredentialsSignIn = mutation({
 		hasTotp: v.boolean()
 	})),
 	handler: async (ctx, args) => {
+		if (!(args.reserveAttempt ? await recordSignInLimit(ctx, {
+			identifier: args.limitIdentifier,
+			maxAttemptsPerHour: args.maxAttemptsPerHour
+		}) : {
+			ok: true,
+			retryAfter: void 0
+		}).ok) return { status: "limited" };
 		const account = await ctx.db.query("Account").withIndex("provider_account_id", (q) => q.eq("provider", args.provider).eq("providerAccountId", args.providerAccountId)).unique();
 		if (account === null) return { status: "invalid" };
-		const [user, totp, limit] = await Promise.all([
-			ctx.db.get("User", account.userId),
-			args.includeTotp ? ctx.db.query("TotpFactor").withIndex("user_id_verified", (q) => q.eq("userId", account.userId).eq("verified", true)).first() : Promise.resolve(null),
-			args.reserveAttempt ? recordSignInLimit(ctx, {
-				identifier: account._id,
-				maxAttemptsPerHour: args.maxAttemptsPerHour
-			}) : Promise.resolve({
-				ok: true,
-				retryAfter: void 0
-			})
-		]);
-		if (!limit.ok) return { status: "limited" };
+		const [user, totp] = await Promise.all([ctx.db.get("User", account.userId), args.includeTotp ? ctx.db.query("TotpFactor").withIndex("user_id_verified", (q) => q.eq("userId", account.userId).eq("verified", true)).first() : Promise.resolve(null)]);
 		if (user === null) return { status: "invalid" };
 		return {
 			status: "ready",
@@ -59,9 +56,10 @@ const beginCredentialsSignIn = mutation({
 const completeCredentialsSignIn = mutation({
 	args: {
 		accountId: v.id("Account"),
+		limitIdentifier: v.string(),
 		issueSession: v.boolean(),
 		generateTokens: v.boolean(),
-		replaceSessionId: v.optional(v.id("Session")),
+		replaceSession: v.optional(vSessionReplacement),
 		sessionExpirationTime: v.number(),
 		refreshTokenExpirationTime: v.number()
 	},
@@ -75,11 +73,11 @@ const completeCredentialsSignIn = mutation({
 	handler: async (ctx, args) => {
 		const account = await ctx.db.get("Account", args.accountId);
 		if (account === null) return { status: "rejected" };
-		await resetSignInLimit(ctx, account._id);
+		await resetSignInLimit(ctx, args.limitIdentifier);
 		if (!args.issueSession) return { status: "reset" };
 		const created = await createSessionRows(ctx, {
 			userId: account.userId,
-			replaceSessionId: args.replaceSessionId,
+			replaceSession: args.replaceSession,
 			sessionExpirationTime: args.sessionExpirationTime,
 			refreshTokenExpirationTime: args.generateTokens ? args.refreshTokenExpirationTime : void 0
 		});

package/dist/component/account.js.map

@@ -1 +1 @@
-{"version":3,"file":"account.js","names":[],"sources":["../../src/component/account.ts"],"sourcesContent":["/**\n * `component.account.*` — provider-linked auth accounts.\n *\n * Reads collapse into one overloaded `get`; `list`\n * takes the owning `userId`.\n *\n * @module\n */\n\nimport { ConvexError, v } from \"convex/values\";\nimport { ErrorCode } from \"../shared/codes\";\n\nimport { recordSignInLimit, resetSignInLimit } from \"./limits\";\nimport { mutation, query } from \"./functions\";\nimport { vAccountDoc, vUserDoc } from \"./model\";\nimport { createSessionRows, type SessionRows } from \"./session\";\n\nconst ACCOUNT_LIST_BATCH = 128;\n\ntype AcceptedCredentialsSignIn = SessionRows & { status: \"accepted\" };\n\n/** Reserve a password attempt and load all sign-in state in one transaction. */\nexport const beginCredentialsSignIn = mutation({\n  args: {\n    provider: v.string(),\n    providerAccountId: v.string(),\n    maxAttemptsPerHour: v.number(),\n    reserveAttempt: v.boolean(),\n    includeTotp: v.boolean(),\n  },\n  returns: v.union(\n    v.object({ status: v.literal(\"invalid\") }),\n    v.object({ status: v.literal(\"limited\") }),\n    v.object({\n      status: v.literal(\"ready\"),\n      account: vAccountDoc,\n      user: vUserDoc,\n      hasTotp: v.boolean(),\n    }),\n  ),\n  handler: async (ctx, args) => {\n    const account = await ctx.db\n      .query(\"Account\")\n      .withIndex(\"provider_account_id\", (q) =>\n        q.eq(\"provider\", args.provider).eq(\"providerAccountId\", args.providerAccountId),\n      )\n      .unique();\n    if (account === null) return { status: \"invalid\" as const };\n\n    const [user, totp, limit] = await Promise.all([\n      ctx.db.get(\"User\", account.userId),\n      args.includeTotp\n        ? ctx.db\n            .query(\"TotpFactor\")\n            .withIndex(\"user_id_verified\", (q) =>\n              q.eq(\"userId\", account.userId).eq(\"verified\", true),\n            )\n            .first()\n        : Promise.resolve(null),\n      args.reserveAttempt\n        ? recordSignInLimit(ctx, {\n            identifier: account._id,\n            maxAttemptsPerHour: args.maxAttemptsPerHour,\n          })\n        : Promise.resolve({ ok: true as const, retryAfter: undefined }),\n    ]);\n    if (!limit.ok) return { status: \"limited\" as const };\n    if (user === null) return { status: \"invalid\" as const };\n    return {\n      status: \"ready\" as const,\n      account,\n      user,\n      hasTotp: totp !== null,\n    };\n  },\n});\n\n/** Refund a verified password attempt and optionally issue its session atomically. */\nexport const completeCredentialsSignIn = mutation({\n  args: {\n    accountId: v.id(\"Account\"),\n    issueSession: v.boolean(),\n    generateTokens: v.boolean(),\n    replaceSessionId: v.optional(v.id(\"Session\")),\n    sessionExpirationTime: v.number(),\n    refreshTokenExpirationTime: v.number(),\n  },\n  returns: v.union(\n    v.object({ status: v.literal(\"rejected\") }),\n    v.object({ status: v.literal(\"reset\") }),\n    v.object({\n      status: v.literal(\"accepted\"),\n      user: vUserDoc,\n      sessionId: v.id(\"Session\"),\n      refreshTokenId: v.optional(v.id(\"RefreshToken\")),\n      replacedSessionId: v.optional(v.id(\"Session\")),\n    }),\n  ),\n  handler: async (ctx, args) => {\n    const account = await ctx.db.get(\"Account\", args.accountId);\n    if (account === null) return { status: \"rejected\" as const };\n    await resetSignInLimit(ctx, account._id);\n    if (!args.issueSession) return { status: \"reset\" as const };\n\n    const created = await createSessionRows(ctx, {\n      userId: account.userId,\n      replaceSessionId: args.replaceSessionId,\n      sessionExpirationTime: args.sessionExpirationTime,\n      refreshTokenExpirationTime: args.generateTokens ? args.refreshTokenExpirationTime : undefined,\n    });\n    if (created === null) return { status: \"rejected\" as const };\n    const result: AcceptedCredentialsSignIn = {\n      status: \"accepted\" as const,\n      user: created.user,\n      sessionId: created.sessionId,\n    };\n    if (created.refreshTokenId !== undefined) result.refreshTokenId = created.refreshTokenId;\n    if (created.replacedSessionId !== undefined) {\n      result.replacedSessionId = created.replacedSessionId;\n    }\n    return result;\n  },\n});\n\n/**\n * Read an account by id, or by `{ provider, providerAccountId }` when both\n * are given. Returns `null` when no selector matches.\n */\nexport const get = query({\n  args: {\n    id: v.optional(v.id(\"Account\")),\n    provider: v.optional(v.string()),\n    providerAccountId: v.optional(v.string()),\n  },\n  returns: v.union(vAccountDoc, v.null()),\n  handler: async (ctx, args) => {\n    if (args.provider !== undefined && args.providerAccountId !== undefined) {\n      return await ctx.db\n        .query(\"Account\")\n        .withIndex(\"provider_account_id\", (q) =>\n          q.eq(\"provider\", args.provider!).eq(\"providerAccountId\", args.providerAccountId!),\n        )\n        .unique();\n    }\n    if (args.id === undefined) return null;\n    return await ctx.db.get(\"Account\", args.id);\n  },\n});\n\n/** List the accounts owned by a user. */\nexport const list = query({\n  args: { userId: v.id(\"User\") },\n  returns: v.array(vAccountDoc),\n  handler: async (ctx, { userId }) => {\n    return await ctx.db\n      .query(\"Account\")\n      .withIndex(\"user_id_provider\", (q) => q.eq(\"userId\", userId))\n      .take(ACCOUNT_LIST_BATCH);\n  },\n});\n\n/** Insert a new account. */\nexport const create = mutation({\n  args: {\n    userId: v.id(\"User\"),\n    provider: v.string(),\n    providerAccountId: v.string(),\n    secret: v.optional(v.string()),\n    extend: v.optional(v.any()),\n  },\n  returns: v.id(\"Account\"),\n  handler: async (ctx, args) => {\n    // Dedup on the (provider, providerAccountId) identity. A bare insert let two\n    // concurrent or retried provisioning ceremonies — SCIM POST retries, a\n    // passkey double-submit — create duplicate Account rows, which then made\n    // `account.get(...).unique()` throw on every future lookup (a permanent\n    // sign-in lockout / rogue credential attribution). The index-range read plus\n    // insert in this single mutation is OCC-atomic: a racing insert into the same\n    // range conflicts and retries, then observes the winner's row below.\n    const existing = await ctx.db\n      .query(\"Account\")\n      .withIndex(\"provider_account_id\", (q) =>\n        q.eq(\"provider\", args.provider).eq(\"providerAccountId\", args.providerAccountId),\n      )\n      .first();\n    if (existing !== null) {\n      if (existing.userId !== args.userId) {\n        // Already linked to a different user — reject rather than silently\n        // attribute the identity (e.g. an attacker registering a passkey\n        // credentialId that already belongs to a victim).\n        throw new ConvexError({\n          code: ErrorCode.ACCOUNT_ALREADY_LINKED,\n          message: \"This account is already linked to another user.\",\n        });\n      }\n      return existing._id;\n    }\n    return await ctx.db.insert(\"Account\", args);\n  },\n});\n\n/** Patch fields on an account. */\nexport const update = mutation({\n  args: {\n    id: v.id(\"Account\"),\n    patch: v.object({\n      userId: v.optional(v.id(\"User\")),\n      provider: v.optional(v.string()),\n      providerAccountId: v.optional(v.string()),\n      secret: v.optional(v.string()),\n      emailVerified: v.optional(v.string()),\n      phoneVerified: v.optional(v.string()),\n      extend: v.optional(v.any()),\n    }),\n  },\n  returns: v.null(),\n  handler: async (ctx, { id: accountId, patch }) => {\n    await ctx.db.patch(\"Account\", accountId, patch);\n    return null;\n  },\n});\n\n/**\n * Delete an account. When `requireOtherAccount` is set, refuses to delete the\n * user's last remaining account so they are never left with none.\n */\nconst remove = mutation({\n  args: {\n    id: v.id(\"Account\"),\n    userId: v.optional(v.id(\"User\")),\n    requireOtherAccount: v.optional(v.boolean()),\n  },\n  returns: v.null(),\n  handler: async (ctx, { id: accountId, userId, requireOtherAccount }) => {\n    const doc = await ctx.db.get(\"Account\", accountId);\n    if (doc === null || (userId !== undefined && doc.userId !== userId)) {\n      throw new ConvexError({\n        code: ErrorCode.ACCOUNT_NOT_FOUND,\n        message: \"Account not found.\",\n      });\n    }\n    if (requireOtherAccount === true) {\n      let otherFound = false;\n      for await (const sibling of ctx.db\n        .query(\"Account\")\n        .withIndex(\"user_id_provider\", (q) => q.eq(\"userId\", doc.userId))) {\n        if (sibling._id !== accountId) {\n          otherFound = true;\n          break;\n        }\n      }\n      if (!otherFound) {\n        throw new ConvexError({\n          code: ErrorCode.INVALID_PARAMETERS,\n          message: \"The provided parameters are invalid.\",\n        });\n      }\n    }\n    await ctx.db.delete(\"Account\", accountId);\n    return null;\n  },\n});\n\nexport { remove };\n"],"mappings":";;;;;;;;;;;;;;;;;AAiBA,MAAM,qBAAqB;;AAK3B,MAAa,yBAAyB,SAAS;CAC7C,MAAM;EACJ,UAAU,EAAE,QAAQ;EACpB,mBAAmB,EAAE,QAAQ;EAC7B,oBAAoB,EAAE,QAAQ;EAC9B,gBAAgB,EAAE,SAAS;EAC3B,aAAa,EAAE,SAAS;EACzB;CACD,SAAS,EAAE,MACT,EAAE,OAAO,EAAE,QAAQ,EAAE,QAAQ,UAAU,EAAE,CAAC,EAC1C,EAAE,OAAO,EAAE,QAAQ,EAAE,QAAQ,UAAU,EAAE,CAAC,EAC1C,EAAE,OAAO;EACP,QAAQ,EAAE,QAAQ,QAAQ;EAC1B,SAAS;EACT,MAAM;EACN,SAAS,EAAE,SAAS;EACrB,CAAC,CACH;CACD,SAAS,OAAO,KAAK,SAAS;EAC5B,MAAM,UAAU,MAAM,IAAI,GACvB,MAAM,UAAU,CAChB,UAAU,wBAAwB,MACjC,EAAE,GAAG,YAAY,KAAK,SAAS,CAAC,GAAG,qBAAqB,KAAK,kBAAkB,CAChF,CACA,QAAQ;AACX,MAAI,YAAY,KAAM,QAAO,EAAE,QAAQ,WAAoB;EAE3D,MAAM,CAAC,MAAM,MAAM,SAAS,MAAM,QAAQ,IAAI;GAC5C,IAAI,GAAG,IAAI,QAAQ,QAAQ,OAAO;GAClC,KAAK,cACD,IAAI,GACD,MAAM,aAAa,CACnB,UAAU,qBAAqB,MAC9B,EAAE,GAAG,UAAU,QAAQ,OAAO,CAAC,GAAG,YAAY,KAAK,CACpD,CACA,OAAO,GACV,QAAQ,QAAQ,KAAK;GACzB,KAAK,iBACD,kBAAkB,KAAK;IACrB,YAAY,QAAQ;IACpB,oBAAoB,KAAK;IAC1B,CAAC,GACF,QAAQ,QAAQ;IAAE,IAAI;IAAe,YAAY;IAAW,CAAC;GAClE,CAAC;AACF,MAAI,CAAC,MAAM,GAAI,QAAO,EAAE,QAAQ,WAAoB;AACpD,MAAI,SAAS,KAAM,QAAO,EAAE,QAAQ,WAAoB;AACxD,SAAO;GACL,QAAQ;GACR;GACA;GACA,SAAS,SAAS;GACnB;;CAEJ,CAAC;;AAGF,MAAa,4BAA4B,SAAS;CAChD,MAAM;EACJ,WAAW,EAAE,GAAG,UAAU;EAC1B,cAAc,EAAE,SAAS;EACzB,gBAAgB,EAAE,SAAS;EAC3B,kBAAkB,EAAE,SAAS,EAAE,GAAG,UAAU,CAAC;EAC7C,uBAAuB,EAAE,QAAQ;EACjC,4BAA4B,EAAE,QAAQ;EACvC;CACD,SAAS,EAAE,MACT,EAAE,OAAO,EAAE,QAAQ,EAAE,QAAQ,WAAW,EAAE,CAAC,EAC3C,EAAE,OAAO,EAAE,QAAQ,EAAE,QAAQ,QAAQ,EAAE,CAAC,EACxC,EAAE,OAAO;EACP,QAAQ,EAAE,QAAQ,WAAW;EAC7B,MAAM;EACN,WAAW,EAAE,GAAG,UAAU;EAC1B,gBAAgB,EAAE,SAAS,EAAE,GAAG,eAAe,CAAC;EAChD,mBAAmB,EAAE,SAAS,EAAE,GAAG,UAAU,CAAC;EAC/C,CAAC,CACH;CACD,SAAS,OAAO,KAAK,SAAS;EAC5B,MAAM,UAAU,MAAM,IAAI,GAAG,IAAI,WAAW,KAAK,UAAU;AAC3D,MAAI,YAAY,KAAM,QAAO,EAAE,QAAQ,YAAqB;AAC5D,QAAM,iBAAiB,KAAK,QAAQ,IAAI;AACxC,MAAI,CAAC,KAAK,aAAc,QAAO,EAAE,QAAQ,SAAkB;EAE3D,MAAM,UAAU,MAAM,kBAAkB,KAAK;GAC3C,QAAQ,QAAQ;GAChB,kBAAkB,KAAK;GACvB,uBAAuB,KAAK;GAC5B,4BAA4B,KAAK,iBAAiB,KAAK,6BAA6B;GACrF,CAAC;AACF,MAAI,YAAY,KAAM,QAAO,EAAE,QAAQ,YAAqB;EAC5D,MAAM,SAAoC;GACxC,QAAQ;GACR,MAAM,QAAQ;GACd,WAAW,QAAQ;GACpB;AACD,MAAI,QAAQ,mBAAmB,OAAW,QAAO,iBAAiB,QAAQ;AAC1E,MAAI,QAAQ,sBAAsB,OAChC,QAAO,oBAAoB,QAAQ;AAErC,SAAO;;CAEV,CAAC;;;;;AAMF,MAAa,MAAM,MAAM;CACvB,MAAM;EACJ,IAAI,EAAE,SAAS,EAAE,GAAG,UAAU,CAAC;EAC/B,UAAU,EAAE,SAAS,EAAE,QAAQ,CAAC;EAChC,mBAAmB,EAAE,SAAS,EAAE,QAAQ,CAAC;EAC1C;CACD,SAAS,EAAE,MAAM,aAAa,EAAE,MAAM,CAAC;CACvC,SAAS,OAAO,KAAK,SAAS;AAC5B,MAAI,KAAK,aAAa,UAAa,KAAK,sBAAsB,OAC5D,QAAO,MAAM,IAAI,GACd,MAAM,UAAU,CAChB,UAAU,wBAAwB,MACjC,EAAE,GAAG,YAAY,KAAK,SAAU,CAAC,GAAG,qBAAqB,KAAK,kBAAmB,CAClF,CACA,QAAQ;AAEb,MAAI,KAAK,OAAO,OAAW,QAAO;AAClC,SAAO,MAAM,IAAI,GAAG,IAAI,WAAW,KAAK,GAAG;;CAE9C,CAAC;;AAGF,MAAa,OAAO,MAAM;CACxB,MAAM,EAAE,QAAQ,EAAE,GAAG,OAAO,EAAE;CAC9B,SAAS,EAAE,MAAM,YAAY;CAC7B,SAAS,OAAO,KAAK,EAAE,aAAa;AAClC,SAAO,MAAM,IAAI,GACd,MAAM,UAAU,CAChB,UAAU,qBAAqB,MAAM,EAAE,GAAG,UAAU,OAAO,CAAC,CAC5D,KAAK,mBAAmB;;CAE9B,CAAC;;AAGF,MAAa,SAAS,SAAS;CAC7B,MAAM;EACJ,QAAQ,EAAE,GAAG,OAAO;EACpB,UAAU,EAAE,QAAQ;EACpB,mBAAmB,EAAE,QAAQ;EAC7B,QAAQ,EAAE,SAAS,EAAE,QAAQ,CAAC;EAC9B,QAAQ,EAAE,SAAS,EAAE,KAAK,CAAC;EAC5B;CACD,SAAS,EAAE,GAAG,UAAU;CACxB,SAAS,OAAO,KAAK,SAAS;EAQ5B,MAAM,WAAW,MAAM,IAAI,GACxB,MAAM,UAAU,CAChB,UAAU,wBAAwB,MACjC,EAAE,GAAG,YAAY,KAAK,SAAS,CAAC,GAAG,qBAAqB,KAAK,kBAAkB,CAChF,CACA,OAAO;AACV,MAAI,aAAa,MAAM;AACrB,OAAI,SAAS,WAAW,KAAK,OAI3B,OAAM,IAAI,YAAY;IACpB,MAAM,UAAU;IAChB,SAAS;IACV,CAAC;AAEJ,UAAO,SAAS;;AAElB,SAAO,MAAM,IAAI,GAAG,OAAO,WAAW,KAAK;;CAE9C,CAAC;;AAGF,MAAa,SAAS,SAAS;CAC7B,MAAM;EACJ,IAAI,EAAE,GAAG,UAAU;EACnB,OAAO,EAAE,OAAO;GACd,QAAQ,EAAE,SAAS,EAAE,GAAG,OAAO,CAAC;GAChC,UAAU,EAAE,SAAS,EAAE,QAAQ,CAAC;GAChC,mBAAmB,EAAE,SAAS,EAAE,QAAQ,CAAC;GACzC,QAAQ,EAAE,SAAS,EAAE,QAAQ,CAAC;GAC9B,eAAe,EAAE,SAAS,EAAE,QAAQ,CAAC;GACrC,eAAe,EAAE,SAAS,EAAE,QAAQ,CAAC;GACrC,QAAQ,EAAE,SAAS,EAAE,KAAK,CAAC;GAC5B,CAAC;EACH;CACD,SAAS,EAAE,MAAM;CACjB,SAAS,OAAO,KAAK,EAAE,IAAI,WAAW,YAAY;AAChD,QAAM,IAAI,GAAG,MAAM,WAAW,WAAW,MAAM;AAC/C,SAAO;;CAEV,CAAC;;;;;AAMF,MAAM,SAAS,SAAS;CACtB,MAAM;EACJ,IAAI,EAAE,GAAG,UAAU;EACnB,QAAQ,EAAE,SAAS,EAAE,GAAG,OAAO,CAAC;EAChC,qBAAqB,EAAE,SAAS,EAAE,SAAS,CAAC;EAC7C;CACD,SAAS,EAAE,MAAM;CACjB,SAAS,OAAO,KAAK,EAAE,IAAI,WAAW,QAAQ,0BAA0B;EACtE,MAAM,MAAM,MAAM,IAAI,GAAG,IAAI,WAAW,UAAU;AAClD,MAAI,QAAQ,QAAS,WAAW,UAAa,IAAI,WAAW,OAC1D,OAAM,IAAI,YAAY;GACpB,MAAM,UAAU;GAChB,SAAS;GACV,CAAC;AAEJ,MAAI,wBAAwB,MAAM;GAChC,IAAI,aAAa;AACjB,cAAW,MAAM,WAAW,IAAI,GAC7B,MAAM,UAAU,CAChB,UAAU,qBAAqB,MAAM,EAAE,GAAG,UAAU,IAAI,OAAO,CAAC,CACjE,KAAI,QAAQ,QAAQ,WAAW;AAC7B,iBAAa;AACb;;AAGJ,OAAI,CAAC,WACH,OAAM,IAAI,YAAY;IACpB,MAAM,UAAU;IAChB,SAAS;IACV,CAAC;;AAGN,QAAM,IAAI,GAAG,OAAO,WAAW,UAAU;AACzC,SAAO;;CAEV,CAAC"}
+{"version":3,"file":"account.js","names":[],"sources":["../../src/component/account.ts"],"sourcesContent":["/**\n * `component.account.*` — provider-linked auth accounts.\n *\n * Reads collapse into one overloaded `get`; `list`\n * takes the owning `userId`.\n *\n * @module\n */\n\nimport { ConvexError, v } from \"convex/values\";\nimport { ErrorCode } from \"../shared/codes\";\n\nimport { recordSignInLimit, resetSignInLimit } from \"./limits\";\nimport { mutation, query } from \"./functions\";\nimport { vAccountDoc, vUserDoc } from \"./model\";\nimport { createSessionRows, type SessionRows, vSessionReplacement } from \"./session\";\n\nconst ACCOUNT_LIST_BATCH = 128;\n\ntype AcceptedCredentialsSignIn = Omit<SessionRows, \"epoch\"> & { status: \"accepted\" };\n\n/** Reserve a password attempt and load all sign-in state in one transaction. */\nexport const beginCredentialsSignIn = mutation({\n  args: {\n    provider: v.string(),\n    providerAccountId: v.string(),\n    limitIdentifier: v.string(),\n    maxAttemptsPerHour: v.number(),\n    reserveAttempt: v.boolean(),\n    includeTotp: v.boolean(),\n  },\n  returns: v.union(\n    v.object({ status: v.literal(\"invalid\") }),\n    v.object({ status: v.literal(\"limited\") }),\n    v.object({\n      status: v.literal(\"ready\"),\n      account: vAccountDoc,\n      user: vUserDoc,\n      hasTotp: v.boolean(),\n    }),\n  ),\n  handler: async (ctx, args) => {\n    const limit = args.reserveAttempt\n      ? await recordSignInLimit(ctx, {\n          identifier: args.limitIdentifier,\n          maxAttemptsPerHour: args.maxAttemptsPerHour,\n        })\n      : { ok: true as const, retryAfter: undefined };\n    if (!limit.ok) return { status: \"limited\" as const };\n\n    const account = await ctx.db\n      .query(\"Account\")\n      .withIndex(\"provider_account_id\", (q) =>\n        q.eq(\"provider\", args.provider).eq(\"providerAccountId\", args.providerAccountId),\n      )\n      .unique();\n    if (account === null) return { status: \"invalid\" as const };\n\n    const [user, totp] = await Promise.all([\n      ctx.db.get(\"User\", account.userId),\n      args.includeTotp\n        ? ctx.db\n            .query(\"TotpFactor\")\n            .withIndex(\"user_id_verified\", (q) =>\n              q.eq(\"userId\", account.userId).eq(\"verified\", true),\n            )\n            .first()\n        : Promise.resolve(null),\n    ]);\n    if (user === null) return { status: \"invalid\" as const };\n    return {\n      status: \"ready\" as const,\n      account,\n      user,\n      hasTotp: totp !== null,\n    };\n  },\n});\n\n/** Refund a verified password attempt and optionally issue its session atomically. */\nexport const completeCredentialsSignIn = mutation({\n  args: {\n    accountId: v.id(\"Account\"),\n    limitIdentifier: v.string(),\n    issueSession: v.boolean(),\n    generateTokens: v.boolean(),\n    replaceSession: v.optional(vSessionReplacement),\n    sessionExpirationTime: v.number(),\n    refreshTokenExpirationTime: v.number(),\n  },\n  returns: v.union(\n    v.object({ status: v.literal(\"rejected\") }),\n    v.object({ status: v.literal(\"reset\") }),\n    v.object({\n      status: v.literal(\"accepted\"),\n      user: vUserDoc,\n      sessionId: v.id(\"Session\"),\n      refreshTokenId: v.optional(v.id(\"RefreshToken\")),\n      replacedSessionId: v.optional(v.id(\"Session\")),\n    }),\n  ),\n  handler: async (ctx, args) => {\n    const account = await ctx.db.get(\"Account\", args.accountId);\n    if (account === null) return { status: \"rejected\" as const };\n    await resetSignInLimit(ctx, args.limitIdentifier);\n    if (!args.issueSession) return { status: \"reset\" as const };\n\n    const created = await createSessionRows(ctx, {\n      userId: account.userId,\n      replaceSession: args.replaceSession,\n      sessionExpirationTime: args.sessionExpirationTime,\n      refreshTokenExpirationTime: args.generateTokens ? args.refreshTokenExpirationTime : undefined,\n    });\n    if (created === null) return { status: \"rejected\" as const };\n    const result: AcceptedCredentialsSignIn = {\n      status: \"accepted\" as const,\n      user: created.user,\n      sessionId: created.sessionId,\n    };\n    if (created.refreshTokenId !== undefined) result.refreshTokenId = created.refreshTokenId;\n    if (created.replacedSessionId !== undefined) {\n      result.replacedSessionId = created.replacedSessionId;\n    }\n    return result;\n  },\n});\n\n/**\n * Read an account by id, or by `{ provider, providerAccountId }` when both\n * are given. Returns `null` when no selector matches.\n */\nexport const get = query({\n  args: {\n    id: v.optional(v.id(\"Account\")),\n    provider: v.optional(v.string()),\n    providerAccountId: v.optional(v.string()),\n  },\n  returns: v.union(vAccountDoc, v.null()),\n  handler: async (ctx, args) => {\n    if (args.provider !== undefined && args.providerAccountId !== undefined) {\n      return await ctx.db\n        .query(\"Account\")\n        .withIndex(\"provider_account_id\", (q) =>\n          q.eq(\"provider\", args.provider!).eq(\"providerAccountId\", args.providerAccountId!),\n        )\n        .unique();\n    }\n    if (args.id === undefined) return null;\n    return await ctx.db.get(\"Account\", args.id);\n  },\n});\n\n/** List the accounts owned by a user. */\nexport const list = query({\n  args: { userId: v.id(\"User\") },\n  returns: v.array(vAccountDoc),\n  handler: async (ctx, { userId }) => {\n    return await ctx.db\n      .query(\"Account\")\n      .withIndex(\"user_id_provider\", (q) => q.eq(\"userId\", userId))\n      .take(ACCOUNT_LIST_BATCH);\n  },\n});\n\n/** Insert a new account. */\nexport const create = mutation({\n  args: {\n    userId: v.id(\"User\"),\n    provider: v.string(),\n    providerAccountId: v.string(),\n    secret: v.optional(v.string()),\n    extend: v.optional(v.any()),\n  },\n  returns: v.id(\"Account\"),\n  handler: async (ctx, args) => {\n    // Dedup on the (provider, providerAccountId) identity. A bare insert let two\n    // concurrent or retried provisioning ceremonies — SCIM POST retries, a\n    // passkey double-submit — create duplicate Account rows, which then made\n    // `account.get(...).unique()` throw on every future lookup (a permanent\n    // sign-in lockout / rogue credential attribution). The index-range read plus\n    // insert in this single mutation is OCC-atomic: a racing insert into the same\n    // range conflicts and retries, then observes the winner's row below.\n    const existing = await ctx.db\n      .query(\"Account\")\n      .withIndex(\"provider_account_id\", (q) =>\n        q.eq(\"provider\", args.provider).eq(\"providerAccountId\", args.providerAccountId),\n      )\n      .first();\n    if (existing !== null) {\n      if (existing.userId !== args.userId) {\n        // Already linked to a different user — reject rather than silently\n        // attribute the identity (e.g. an attacker registering a passkey\n        // credentialId that already belongs to a victim).\n        throw new ConvexError({\n          code: ErrorCode.ACCOUNT_ALREADY_LINKED,\n          message: \"This account is already linked to another user.\",\n        });\n      }\n      return existing._id;\n    }\n    return await ctx.db.insert(\"Account\", args);\n  },\n});\n\n/** Patch fields on an account. */\nexport const update = mutation({\n  args: {\n    id: v.id(\"Account\"),\n    patch: v.object({\n      userId: v.optional(v.id(\"User\")),\n      provider: v.optional(v.string()),\n      providerAccountId: v.optional(v.string()),\n      secret: v.optional(v.string()),\n      emailVerified: v.optional(v.string()),\n      phoneVerified: v.optional(v.string()),\n      extend: v.optional(v.any()),\n    }),\n  },\n  returns: v.null(),\n  handler: async (ctx, { id: accountId, patch }) => {\n    await ctx.db.patch(\"Account\", accountId, patch);\n    return null;\n  },\n});\n\n/**\n * Delete an account. When `requireOtherAccount` is set, refuses to delete the\n * user's last remaining account so they are never left with none.\n */\nconst remove = mutation({\n  args: {\n    id: v.id(\"Account\"),\n    userId: v.optional(v.id(\"User\")),\n    requireOtherAccount: v.optional(v.boolean()),\n  },\n  returns: v.null(),\n  handler: async (ctx, { id: accountId, userId, requireOtherAccount }) => {\n    const doc = await ctx.db.get(\"Account\", accountId);\n    if (doc === null || (userId !== undefined && doc.userId !== userId)) {\n      throw new ConvexError({\n        code: ErrorCode.ACCOUNT_NOT_FOUND,\n        message: \"Account not found.\",\n      });\n    }\n    if (requireOtherAccount === true) {\n      let otherFound = false;\n      for await (const sibling of ctx.db\n        .query(\"Account\")\n        .withIndex(\"user_id_provider\", (q) => q.eq(\"userId\", doc.userId))) {\n        if (sibling._id !== accountId) {\n          otherFound = true;\n          break;\n        }\n      }\n      if (!otherFound) {\n        throw new ConvexError({\n          code: ErrorCode.INVALID_PARAMETERS,\n          message: \"The provided parameters are invalid.\",\n        });\n      }\n    }\n    await ctx.db.delete(\"Account\", accountId);\n    return null;\n  },\n});\n\nexport { remove };\n"],"mappings":";;;;;;;;;;;;;;;;;AAiBA,MAAM,qBAAqB;;AAK3B,MAAa,yBAAyB,SAAS;CAC7C,MAAM;EACJ,UAAU,EAAE,QAAQ;EACpB,mBAAmB,EAAE,QAAQ;EAC7B,iBAAiB,EAAE,QAAQ;EAC3B,oBAAoB,EAAE,QAAQ;EAC9B,gBAAgB,EAAE,SAAS;EAC3B,aAAa,EAAE,SAAS;EACzB;CACD,SAAS,EAAE,MACT,EAAE,OAAO,EAAE,QAAQ,EAAE,QAAQ,UAAU,EAAE,CAAC,EAC1C,EAAE,OAAO,EAAE,QAAQ,EAAE,QAAQ,UAAU,EAAE,CAAC,EAC1C,EAAE,OAAO;EACP,QAAQ,EAAE,QAAQ,QAAQ;EAC1B,SAAS;EACT,MAAM;EACN,SAAS,EAAE,SAAS;EACrB,CAAC,CACH;CACD,SAAS,OAAO,KAAK,SAAS;AAO5B,MAAI,EANU,KAAK,iBACf,MAAM,kBAAkB,KAAK;GAC3B,YAAY,KAAK;GACjB,oBAAoB,KAAK;GAC1B,CAAC,GACF;GAAE,IAAI;GAAe,YAAY;GAAW,EACrC,GAAI,QAAO,EAAE,QAAQ,WAAoB;EAEpD,MAAM,UAAU,MAAM,IAAI,GACvB,MAAM,UAAU,CAChB,UAAU,wBAAwB,MACjC,EAAE,GAAG,YAAY,KAAK,SAAS,CAAC,GAAG,qBAAqB,KAAK,kBAAkB,CAChF,CACA,QAAQ;AACX,MAAI,YAAY,KAAM,QAAO,EAAE,QAAQ,WAAoB;EAE3D,MAAM,CAAC,MAAM,QAAQ,MAAM,QAAQ,IAAI,CACrC,IAAI,GAAG,IAAI,QAAQ,QAAQ,OAAO,EAClC,KAAK,cACD,IAAI,GACD,MAAM,aAAa,CACnB,UAAU,qBAAqB,MAC9B,EAAE,GAAG,UAAU,QAAQ,OAAO,CAAC,GAAG,YAAY,KAAK,CACpD,CACA,OAAO,GACV,QAAQ,QAAQ,KAAK,CAC1B,CAAC;AACF,MAAI,SAAS,KAAM,QAAO,EAAE,QAAQ,WAAoB;AACxD,SAAO;GACL,QAAQ;GACR;GACA;GACA,SAAS,SAAS;GACnB;;CAEJ,CAAC;;AAGF,MAAa,4BAA4B,SAAS;CAChD,MAAM;EACJ,WAAW,EAAE,GAAG,UAAU;EAC1B,iBAAiB,EAAE,QAAQ;EAC3B,cAAc,EAAE,SAAS;EACzB,gBAAgB,EAAE,SAAS;EAC3B,gBAAgB,EAAE,SAAS,oBAAoB;EAC/C,uBAAuB,EAAE,QAAQ;EACjC,4BAA4B,EAAE,QAAQ;EACvC;CACD,SAAS,EAAE,MACT,EAAE,OAAO,EAAE,QAAQ,EAAE,QAAQ,WAAW,EAAE,CAAC,EAC3C,EAAE,OAAO,EAAE,QAAQ,EAAE,QAAQ,QAAQ,EAAE,CAAC,EACxC,EAAE,OAAO;EACP,QAAQ,EAAE,QAAQ,WAAW;EAC7B,MAAM;EACN,WAAW,EAAE,GAAG,UAAU;EAC1B,gBAAgB,EAAE,SAAS,EAAE,GAAG,eAAe,CAAC;EAChD,mBAAmB,EAAE,SAAS,EAAE,GAAG,UAAU,CAAC;EAC/C,CAAC,CACH;CACD,SAAS,OAAO,KAAK,SAAS;EAC5B,MAAM,UAAU,MAAM,IAAI,GAAG,IAAI,WAAW,KAAK,UAAU;AAC3D,MAAI,YAAY,KAAM,QAAO,EAAE,QAAQ,YAAqB;AAC5D,QAAM,iBAAiB,KAAK,KAAK,gBAAgB;AACjD,MAAI,CAAC,KAAK,aAAc,QAAO,EAAE,QAAQ,SAAkB;EAE3D,MAAM,UAAU,MAAM,kBAAkB,KAAK;GAC3C,QAAQ,QAAQ;GAChB,gBAAgB,KAAK;GACrB,uBAAuB,KAAK;GAC5B,4BAA4B,KAAK,iBAAiB,KAAK,6BAA6B;GACrF,CAAC;AACF,MAAI,YAAY,KAAM,QAAO,EAAE,QAAQ,YAAqB;EAC5D,MAAM,SAAoC;GACxC,QAAQ;GACR,MAAM,QAAQ;GACd,WAAW,QAAQ;GACpB;AACD,MAAI,QAAQ,mBAAmB,OAAW,QAAO,iBAAiB,QAAQ;AAC1E,MAAI,QAAQ,sBAAsB,OAChC,QAAO,oBAAoB,QAAQ;AAErC,SAAO;;CAEV,CAAC;;;;;AAMF,MAAa,MAAM,MAAM;CACvB,MAAM;EACJ,IAAI,EAAE,SAAS,EAAE,GAAG,UAAU,CAAC;EAC/B,UAAU,EAAE,SAAS,EAAE,QAAQ,CAAC;EAChC,mBAAmB,EAAE,SAAS,EAAE,QAAQ,CAAC;EAC1C;CACD,SAAS,EAAE,MAAM,aAAa,EAAE,MAAM,CAAC;CACvC,SAAS,OAAO,KAAK,SAAS;AAC5B,MAAI,KAAK,aAAa,UAAa,KAAK,sBAAsB,OAC5D,QAAO,MAAM,IAAI,GACd,MAAM,UAAU,CAChB,UAAU,wBAAwB,MACjC,EAAE,GAAG,YAAY,KAAK,SAAU,CAAC,GAAG,qBAAqB,KAAK,kBAAmB,CAClF,CACA,QAAQ;AAEb,MAAI,KAAK,OAAO,OAAW,QAAO;AAClC,SAAO,MAAM,IAAI,GAAG,IAAI,WAAW,KAAK,GAAG;;CAE9C,CAAC;;AAGF,MAAa,OAAO,MAAM;CACxB,MAAM,EAAE,QAAQ,EAAE,GAAG,OAAO,EAAE;CAC9B,SAAS,EAAE,MAAM,YAAY;CAC7B,SAAS,OAAO,KAAK,EAAE,aAAa;AAClC,SAAO,MAAM,IAAI,GACd,MAAM,UAAU,CAChB,UAAU,qBAAqB,MAAM,EAAE,GAAG,UAAU,OAAO,CAAC,CAC5D,KAAK,mBAAmB;;CAE9B,CAAC;;AAGF,MAAa,SAAS,SAAS;CAC7B,MAAM;EACJ,QAAQ,EAAE,GAAG,OAAO;EACpB,UAAU,EAAE,QAAQ;EACpB,mBAAmB,EAAE,QAAQ;EAC7B,QAAQ,EAAE,SAAS,EAAE,QAAQ,CAAC;EAC9B,QAAQ,EAAE,SAAS,EAAE,KAAK,CAAC;EAC5B;CACD,SAAS,EAAE,GAAG,UAAU;CACxB,SAAS,OAAO,KAAK,SAAS;EAQ5B,MAAM,WAAW,MAAM,IAAI,GACxB,MAAM,UAAU,CAChB,UAAU,wBAAwB,MACjC,EAAE,GAAG,YAAY,KAAK,SAAS,CAAC,GAAG,qBAAqB,KAAK,kBAAkB,CAChF,CACA,OAAO;AACV,MAAI,aAAa,MAAM;AACrB,OAAI,SAAS,WAAW,KAAK,OAI3B,OAAM,IAAI,YAAY;IACpB,MAAM,UAAU;IAChB,SAAS;IACV,CAAC;AAEJ,UAAO,SAAS;;AAElB,SAAO,MAAM,IAAI,GAAG,OAAO,WAAW,KAAK;;CAE9C,CAAC;;AAGF,MAAa,SAAS,SAAS;CAC7B,MAAM;EACJ,IAAI,EAAE,GAAG,UAAU;EACnB,OAAO,EAAE,OAAO;GACd,QAAQ,EAAE,SAAS,EAAE,GAAG,OAAO,CAAC;GAChC,UAAU,EAAE,SAAS,EAAE,QAAQ,CAAC;GAChC,mBAAmB,EAAE,SAAS,EAAE,QAAQ,CAAC;GACzC,QAAQ,EAAE,SAAS,EAAE,QAAQ,CAAC;GAC9B,eAAe,EAAE,SAAS,EAAE,QAAQ,CAAC;GACrC,eAAe,EAAE,SAAS,EAAE,QAAQ,CAAC;GACrC,QAAQ,EAAE,SAAS,EAAE,KAAK,CAAC;GAC5B,CAAC;EACH;CACD,SAAS,EAAE,MAAM;CACjB,SAAS,OAAO,KAAK,EAAE,IAAI,WAAW,YAAY;AAChD,QAAM,IAAI,GAAG,MAAM,WAAW,WAAW,MAAM;AAC/C,SAAO;;CAEV,CAAC;;;;;AAMF,MAAM,SAAS,SAAS;CACtB,MAAM;EACJ,IAAI,EAAE,GAAG,UAAU;EACnB,QAAQ,EAAE,SAAS,EAAE,GAAG,OAAO,CAAC;EAChC,qBAAqB,EAAE,SAAS,EAAE,SAAS,CAAC;EAC7C;CACD,SAAS,EAAE,MAAM;CACjB,SAAS,OAAO,KAAK,EAAE,IAAI,WAAW,QAAQ,0BAA0B;EACtE,MAAM,MAAM,MAAM,IAAI,GAAG,IAAI,WAAW,UAAU;AAClD,MAAI,QAAQ,QAAS,WAAW,UAAa,IAAI,WAAW,OAC1D,OAAM,IAAI,YAAY;GACpB,MAAM,UAAU;GAChB,SAAS;GACV,CAAC;AAEJ,MAAI,wBAAwB,MAAM;GAChC,IAAI,aAAa;AACjB,cAAW,MAAM,WAAW,IAAI,GAC7B,MAAM,UAAU,CAChB,UAAU,qBAAqB,MAAM,EAAE,GAAG,UAAU,IAAI,OAAO,CAAC,CACjE,KAAI,QAAQ,QAAQ,WAAW;AAC7B,iBAAa;AACb;;AAGJ,OAAI,CAAC,WACH,OAAM,IAAI,YAAY;IACpB,MAAM,UAAU;IAChB,SAAS;IACV,CAAC;;AAGN,QAAM,IAAI,GAAG,OAAO,WAAW,UAAU;AACzC,SAAO;;CAEV,CAAC"}

package/dist/component/connection/audit.d.ts

@@ -1,5 +1,5 @@
-import * as convex_values2852 from "convex/values";
-import * as convex_server207 from "convex/server";
+import * as convex_values3277 from "convex/values";
+import * as convex_server212 from "convex/server";
 
 //#region src/component/connection/audit.d.ts
 declare namespace audit_d_exports {
@@ -16,9 +16,9 @@ declare namespace audit_d_exports {
  * an allowlist). Requires exactly one of `connectionId` or `groupId` — passing
  * neither throws rather than scanning the entire audit log.
  */
-declare const list: convex_server207.RegisteredQuery<"public", {
-  connectionId?: convex_values2852.GenericId<"GroupConnection"> | undefined;
-  groupId?: convex_values2852.GenericId<"Group"> | undefined;
+declare const list: convex_server212.RegisteredQuery<"public", {
+  connectionId?: convex_values3277.GenericId<"GroupConnection"> | undefined;
+  groupId?: convex_values3277.GenericId<"Group"> | undefined;
   paginationOpts: {
     id?: number;
     endCursor?: string | null;
@@ -29,55 +29,55 @@ declare const list: convex_server207.RegisteredQuery<"public", {
   };
 }, Promise<{
   page: {
-    _id: convex_values2852.GenericId<"AuthEventProjection">;
+    _id: convex_values3277.GenericId<"AuthEventProjection">;
     _creationTime: number;
     eventId: string;
-    targetKind: "user" | "connection" | "group" | "session" | "api_key" | "oauth_client" | "global";
+    targetKind: "user" | "session" | "api_key" | "connection" | "oauth_client" | "group" | "global";
     targetId: string;
     kind: "user.created" | "user.updated" | "session.signed_in" | "session.signed_out" | "session.invalidated" | "session.refresh_exchanged" | "session.refresh_reuse_detected" | "account.linked" | "account.unlinked" | "password.changed" | "passkey.added" | "passkey.removed" | "totp.enrolled" | "totp.removed" | "email.verified" | "phone.verified" | "api_key.created" | "api_key.revoked" | "oauth.client.created" | "oauth.client.revoked" | "oauth.code.created" | "oauth.token.created" | "oauth.token.exchanged" | "oauth.refresh.reuse_detected" | "oauth.refresh.revoked" | "connection.created" | "connection.updated" | "connection.removed" | "connection.login.succeeded" | "connection.login.failed" | "connection.domain.verification_requested" | "connection.domain.verified" | "connection.policy.updated" | "connection.saml.set" | "connection.saml.refreshed" | "connection.oidc.set" | "connection.scim.set" | "connection.scim.read" | "connection.scim.user.provisioned" | "connection.scim.user.updated" | "connection.scim.user.deactivated" | "connection.scim.user.reactivated" | "connection.scim.group.provisioned" | "connection.scim.group.updated" | "connection.scim.group.deactivated" | "connection.scim.group.reactivated" | "webhook.endpoint.created" | "webhook.endpoint.disabled" | "webhook.delivery.created" | "webhook.delivery.attempted" | "webhook.delivery.succeeded" | "webhook.delivery.failed";
-    category: "email" | "phone" | "password" | "oauth" | "scim" | "user" | "connection" | "session" | "account" | "passkey" | "totp" | "api_key" | "webhook" | "security";
+    category: "email" | "password" | "phone" | "user" | "session" | "account" | "passkey" | "totp" | "api_key" | "oauth" | "connection" | "scim" | "webhook" | "security";
     occurredAt: number;
-    actorType: "scim" | "user" | "api_key" | "webhook" | "oauth_client" | "system" | "anonymous";
+    actorType: "user" | "api_key" | "scim" | "webhook" | "system" | "oauth_client" | "anonymous";
     actorId: string | undefined;
-    subjectType: "email" | "phone" | "user" | "connection" | "group" | "session" | "account" | "passkey" | "totp" | "api_key" | "oauth_client" | "system" | "oauth_code" | "scim_identity" | "webhook_endpoint" | "webhook_delivery";
+    subjectType: "email" | "phone" | "user" | "session" | "account" | "passkey" | "totp" | "api_key" | "connection" | "system" | "oauth_client" | "oauth_code" | "group" | "scim_identity" | "webhook_endpoint" | "webhook_delivery";
     subjectId: string | undefined;
     outcome: "success" | "failure";
     errorCode: string | undefined;
     requestId: string | undefined;
     ip: undefined;
     data: {
+      profile?: Record<string, any> | undefined;
       type?: string | undefined;
       provider?: string | undefined;
-      profile?: Record<string, any> | undefined;
       existingUserId?: string | undefined;
     } | {
       method?: string | undefined;
       provider: string;
     } | {
+      flow?: "reset" | "change" | undefined;
       userId?: string | undefined;
-      sessionId?: string | undefined;
       reason?: string | undefined;
+      sessionId?: string | undefined;
       refreshTokenId?: string | undefined;
-      flow?: "reset" | "change" | undefined;
     } | {
-      accountId?: string | undefined;
       provider?: string | undefined;
       providerAccountId?: string | undefined;
+      accountId?: string | undefined;
     } | {
-      name?: string | undefined;
-      credentialId?: string | undefined;
       reason?: string | undefined;
       passkeyId?: string | undefined;
+      credentialId?: string | undefined;
       totpId?: string | undefined;
       keyId?: string | undefined;
+      name?: string | undefined;
       prefix?: string | undefined;
     } | {
       email?: string | undefined;
       phone?: string | undefined;
       userId?: string | undefined;
     } | {
-      name?: string | undefined;
       userId?: string | undefined;
+      name?: string | undefined;
       clientId?: string | undefined;
       codeId?: string | undefined;
       scopes?: string[] | undefined;
@@ -85,16 +85,15 @@ declare const list: convex_server207.RegisteredQuery<"public", {
       grantType?: string | undefined;
       resource?: string | undefined;
     } | {
+      errorCode?: string | undefined;
       userId?: string | undefined;
       connectionId?: string | undefined;
-      verifiedAt?: number | undefined;
-      expiresAt?: number | undefined;
-      version?: number | undefined;
+      changed?: string[] | undefined;
       protocol?: "oidc" | "saml" | undefined;
       domain?: string | undefined;
       recordName?: string | undefined;
-      errorCode?: string | undefined;
-      changed?: string[] | undefined;
+      expiresAt?: number | undefined;
+      verifiedAt?: number | undefined;
       metadataUrl?: string | undefined;
       domains?: string[] | undefined;
       issuer?: string | undefined;
@@ -102,28 +101,29 @@ declare const list: convex_server207.RegisteredQuery<"public", {
       jwksUri?: string | undefined;
       audience?: string | string[] | undefined;
       tokenEndpointAuthMethod?: string | undefined;
+      version?: number | undefined;
     } | {
       userId?: string | undefined;
+      scimConfigId?: string | undefined;
+      resourceType?: "user" | "group" | undefined;
+      resourceId?: string | undefined;
       operation?: string | undefined;
       externalId?: string | undefined;
-      groupId?: string | undefined;
       active?: boolean | undefined;
-      resourceType?: "user" | "group" | undefined;
-      scimConfigId?: string | undefined;
-      resourceId?: string | undefined;
+      groupId?: string | undefined;
     } | {
-      status?: number | undefined;
       endpointId?: string | undefined;
       deliveryId?: string | undefined;
       sourceEventId?: string | undefined;
       sourceEventType?: "user.created" | "user.updated" | "session.signed_in" | "session.signed_out" | "session.invalidated" | "session.refresh_exchanged" | "session.refresh_reuse_detected" | "account.linked" | "account.unlinked" | "password.changed" | "passkey.added" | "passkey.removed" | "totp.enrolled" | "totp.removed" | "email.verified" | "phone.verified" | "api_key.created" | "api_key.revoked" | "oauth.client.created" | "oauth.client.revoked" | "oauth.code.created" | "oauth.token.created" | "oauth.token.exchanged" | "oauth.refresh.reuse_detected" | "oauth.refresh.revoked" | "connection.created" | "connection.updated" | "connection.removed" | "connection.login.succeeded" | "connection.login.failed" | "connection.domain.verification_requested" | "connection.domain.verified" | "connection.policy.updated" | "connection.saml.set" | "connection.saml.refreshed" | "connection.oidc.set" | "connection.scim.set" | "connection.scim.read" | "connection.scim.user.provisioned" | "connection.scim.user.updated" | "connection.scim.user.deactivated" | "connection.scim.user.reactivated" | "connection.scim.group.provisioned" | "connection.scim.group.updated" | "connection.scim.group.deactivated" | "connection.scim.group.reactivated" | "webhook.endpoint.created" | "webhook.endpoint.disabled" | "webhook.delivery.created" | "webhook.delivery.attempted" | "webhook.delivery.succeeded" | "webhook.delivery.failed" | undefined;
       attemptCount?: number | undefined;
+      status?: number | undefined;
       error?: string | undefined;
     } | undefined;
   }[];
   isDone: boolean;
-  continueCursor: convex_server207.Cursor;
-  splitCursor?: convex_server207.Cursor | null;
+  continueCursor: convex_server212.Cursor;
+  splitCursor?: convex_server212.Cursor | null;
   pageStatus?: "SplitRecommended" | "SplitRequired" | null;
 }>>;
 //#endregion

package/dist/component/connection/audit.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"audit.d.ts","names":[],"sources":["../../../src/component/connection/audit.ts"],"mappings":";;;;;;;;;;;;;AA+GA;;;;;cAAa,IAAA,mBAAI,eAAA;iBAkCf,iBAAA,CAAA,SAAA"}
+{"version":3,"file":"audit.d.ts","names":[],"sources":["../../../src/component/connection/audit.ts"],"mappings":";;;;;;;;;;;;;AA8GA;;;;;cAAa,IAAA,mBAAI,eAAA;iBAkCf,iBAAA,CAAA,SAAA"}

package/dist/component/connection/audit.js

@@ -1,4 +1,5 @@
 import { ErrorCode } from "../../shared/codes.js";
+import { EVENT_KIND_CATEGORY } from "../../shared/event/kinds.js";
 import { vAuthEventProjectionDoc, vPaginated } from "../model.js";
 import schema_default from "../schema.js";
 import { query } from "../_generated/server.js";
@@ -83,7 +84,7 @@ const PUBLIC_DATA_KEYS = {
 };
 function publicData(kind, value) {
 	if (typeof value !== "object" || value === null || Array.isArray(value)) return void 0;
-	const keys = PUBLIC_DATA_KEYS[kind.startsWith("api_key.") ? "api_key" : kind.slice(0, kind.indexOf("."))] ?? [];
+	const keys = PUBLIC_DATA_KEYS[EVENT_KIND_CATEGORY[kind]] ?? [];
 	const source = value;
 	const redacted = {};
 	for (const key of keys) {

package/dist/component/connection/audit.js.map

@@ -1 +1 @@
-{"version":3,"file":"audit.js","names":["schema"],"sources":["../../../src/component/connection/audit.ts"],"sourcesContent":["/**\n * `component.connection.audit.*` - Connection audit projections backed by auth events.\n *\n * @module\n */\n\nimport { paginationOptsValidator } from \"convex/server\";\nimport { paginator } from \"convex-helpers/server/pagination\";\nimport { ConvexError, v, type Infer } from \"convex/values\";\n\nimport { ErrorCode } from \"../../shared/codes\";\nimport type { Doc } from \"../_generated/dataModel\";\nimport { query } from \"../functions\";\nimport { vAuthEventData, vAuthEventProjectionDoc, vPaginated } from \"../model\";\nimport schema from \"../schema\";\n\nconst PUBLIC_DATA_KEYS = {\n  user: [\"type\", \"provider\", \"existingUserId\"],\n  session: [\"provider\", \"method\", \"reason\"],\n  account: [\"provider\", \"accountId\"],\n  password: [\"userId\"],\n  passkey: [\"passkeyId\"],\n  totp: [\"totpId\"],\n  email: [\"userId\"],\n  phone: [\"userId\"],\n  api_key: [\"keyId\", \"name\", \"prefix\", \"reason\"],\n  oauth: [\"clientId\", \"codeId\", \"scopes\", \"grantType\", \"resource\"],\n  connection: [\n    \"connectionId\",\n    \"protocol\",\n    \"domain\",\n    \"recordName\",\n    \"expiresAt\",\n    \"verifiedAt\",\n    \"metadataUrl\",\n    \"domains\",\n    \"version\",\n    \"errorCode\",\n    \"issuer\",\n    \"discoveryUrl\",\n    \"jwksUri\",\n    \"audience\",\n    \"tokenEndpointAuthMethod\",\n  ],\n  scim: [\n    \"scimConfigId\",\n    \"resourceType\",\n    \"resourceId\",\n    \"operation\",\n    \"externalId\",\n    \"active\",\n    \"groupId\",\n    \"userId\",\n  ],\n  webhook: [\n    \"endpointId\",\n    \"deliveryId\",\n    \"sourceEventId\",\n    \"sourceEventType\",\n    \"attemptCount\",\n    \"status\",\n    \"error\",\n  ],\n  security: [\"reason\", \"errorCode\"],\n} as const;\n\nfunction publicData(kind: string, value: unknown): Infer<typeof vAuthEventData> | undefined {\n  if (typeof value !== \"object\" || value === null || Array.isArray(value)) return undefined;\n  const category = kind.startsWith(\"api_key.\")\n    ? \"api_key\"\n    : (kind.slice(0, kind.indexOf(\".\")) as keyof typeof PUBLIC_DATA_KEYS);\n  const keys = PUBLIC_DATA_KEYS[category] ?? [];\n  const source = value as Record<string, unknown>;\n  const redacted: Record<string, unknown> = {};\n  for (const key of keys) {\n    const nested = source[key];\n    if (nested !== undefined) redacted[key] = nested;\n  }\n  return Object.keys(redacted).length === 0\n    ? undefined\n    : (redacted as Infer<typeof vAuthEventData>);\n}\n\nfunction publicProjection(doc: Doc<\"AuthEventProjection\">) {\n  return {\n    _id: doc._id,\n    _creationTime: doc._creationTime,\n    eventId: doc.eventId,\n    targetKind: doc.targetKind,\n    targetId: doc.targetId,\n    kind: doc.kind,\n    category: doc.category,\n    occurredAt: doc.occurredAt,\n    actorType: doc.actorType,\n    actorId: doc.actorId,\n    subjectType: doc.subjectType,\n    subjectId: doc.subjectId,\n    outcome: doc.outcome,\n    errorCode: doc.errorCode,\n    requestId: doc.requestId,\n    ip: undefined,\n    data: publicData(doc.kind, doc.data),\n  };\n}\n\n/**\n * List audit-event projections for a connection or a group, newest first and\n * paginated. Rows are redacted to public fields (IP dropped, `data` narrowed to\n * an allowlist). Requires exactly one of `connectionId` or `groupId` — passing\n * neither throws rather than scanning the entire audit log.\n */\nexport const list = query({\n  args: {\n    connectionId: v.optional(v.id(\"GroupConnection\")),\n    groupId: v.optional(v.id(\"Group\")),\n    paginationOpts: paginationOptsValidator,\n  },\n  returns: vPaginated(vAuthEventProjectionDoc),\n  handler: async (ctx, args) => {\n    if (args.connectionId !== undefined) {\n      const result = await paginator(ctx.db, schema)\n        .query(\"AuthEventProjection\")\n        .withIndex(\"target_time\", (idx) =>\n          idx.eq(\"targetKind\", \"connection\").eq(\"targetId\", args.connectionId!),\n        )\n        .order(\"desc\")\n        .paginate(args.paginationOpts);\n      return { ...result, page: result.page.map(publicProjection) };\n    }\n    if (args.groupId !== undefined) {\n      const result = await paginator(ctx.db, schema)\n        .query(\"AuthEventProjection\")\n        .withIndex(\"target_time\", (idx) =>\n          idx.eq(\"targetKind\", \"group\").eq(\"targetId\", args.groupId!),\n        )\n        .order(\"desc\")\n        .paginate(args.paginationOpts);\n      return { ...result, page: result.page.map(publicProjection) };\n    }\n    throw new ConvexError({\n      code: ErrorCode.INVALID_PARAMETERS,\n      message:\n        \"connection.audit.list requires either `connectionId` or `groupId` to target the query. Passing neither would walk the entire audit log.\",\n    });\n  },\n});\n"],"mappings":";;;;;;;;;;;;;;;AAgBA,MAAM,mBAAmB;CACvB,MAAM;EAAC;EAAQ;EAAY;EAAiB;CAC5C,SAAS;EAAC;EAAY;EAAU;EAAS;CACzC,SAAS,CAAC,YAAY,YAAY;CAClC,UAAU,CAAC,SAAS;CACpB,SAAS,CAAC,YAAY;CACtB,MAAM,CAAC,SAAS;CAChB,OAAO,CAAC,SAAS;CACjB,OAAO,CAAC,SAAS;CACjB,SAAS;EAAC;EAAS;EAAQ;EAAU;EAAS;CAC9C,OAAO;EAAC;EAAY;EAAU;EAAU;EAAa;EAAW;CAChE,YAAY;EACV;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACD;CACD,MAAM;EACJ;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACD;CACD,SAAS;EACP;EACA;EACA;EACA;EACA;EACA;EACA;EACD;CACD,UAAU,CAAC,UAAU,YAAY;CAClC;AAED,SAAS,WAAW,MAAc,OAA0D;AAC1F,KAAI,OAAO,UAAU,YAAY,UAAU,QAAQ,MAAM,QAAQ,MAAM,CAAE,QAAO;CAIhF,MAAM,OAAO,iBAHI,KAAK,WAAW,WAAW,GACxC,YACC,KAAK,MAAM,GAAG,KAAK,QAAQ,IAAI,CAAC,KACM,EAAE;CAC7C,MAAM,SAAS;CACf,MAAM,WAAoC,EAAE;AAC5C,MAAK,MAAM,OAAO,MAAM;EACtB,MAAM,SAAS,OAAO;AACtB,MAAI,WAAW,OAAW,UAAS,OAAO;;AAE5C,QAAO,OAAO,KAAK,SAAS,CAAC,WAAW,IACpC,SACC;;AAGP,SAAS,iBAAiB,KAAiC;AACzD,QAAO;EACL,KAAK,IAAI;EACT,eAAe,IAAI;EACnB,SAAS,IAAI;EACb,YAAY,IAAI;EAChB,UAAU,IAAI;EACd,MAAM,IAAI;EACV,UAAU,IAAI;EACd,YAAY,IAAI;EAChB,WAAW,IAAI;EACf,SAAS,IAAI;EACb,aAAa,IAAI;EACjB,WAAW,IAAI;EACf,SAAS,IAAI;EACb,WAAW,IAAI;EACf,WAAW,IAAI;EACf,IAAI;EACJ,MAAM,WAAW,IAAI,MAAM,IAAI,KAAK;EACrC;;;;;;;;AASH,MAAa,OAAO,MAAM;CACxB,MAAM;EACJ,cAAc,EAAE,SAAS,EAAE,GAAG,kBAAkB,CAAC;EACjD,SAAS,EAAE,SAAS,EAAE,GAAG,QAAQ,CAAC;EAClC,gBAAgB;EACjB;CACD,SAAS,WAAW,wBAAwB;CAC5C,SAAS,OAAO,KAAK,SAAS;AAC5B,MAAI,KAAK,iBAAiB,QAAW;GACnC,MAAM,SAAS,MAAM,UAAU,IAAI,IAAIA,eAAO,CAC3C,MAAM,sBAAsB,CAC5B,UAAU,gBAAgB,QACzB,IAAI,GAAG,cAAc,aAAa,CAAC,GAAG,YAAY,KAAK,aAAc,CACtE,CACA,MAAM,OAAO,CACb,SAAS,KAAK,eAAe;AAChC,UAAO;IAAE,GAAG;IAAQ,MAAM,OAAO,KAAK,IAAI,iBAAiB;IAAE;;AAE/D,MAAI,KAAK,YAAY,QAAW;GAC9B,MAAM,SAAS,MAAM,UAAU,IAAI,IAAIA,eAAO,CAC3C,MAAM,sBAAsB,CAC5B,UAAU,gBAAgB,QACzB,IAAI,GAAG,cAAc,QAAQ,CAAC,GAAG,YAAY,KAAK,QAAS,CAC5D,CACA,MAAM,OAAO,CACb,SAAS,KAAK,eAAe;AAChC,UAAO;IAAE,GAAG;IAAQ,MAAM,OAAO,KAAK,IAAI,iBAAiB;IAAE;;AAE/D,QAAM,IAAI,YAAY;GACpB,MAAM,UAAU;GAChB,SACE;GACH,CAAC;;CAEL,CAAC"}
+{"version":3,"file":"audit.js","names":["schema"],"sources":["../../../src/component/connection/audit.ts"],"sourcesContent":["/**\n * `component.connection.audit.*` - Connection audit projections backed by auth events.\n *\n * @module\n */\n\nimport { paginationOptsValidator } from \"convex/server\";\nimport { paginator } from \"convex-helpers/server/pagination\";\nimport { ConvexError, v, type Infer } from \"convex/values\";\n\nimport { ErrorCode } from \"../../shared/codes\";\nimport { EVENT_KIND_CATEGORY, type AuthEventKind } from \"../../shared/event/kinds\";\nimport type { Doc } from \"../_generated/dataModel\";\nimport { query } from \"../functions\";\nimport { vAuthEventData, vAuthEventProjectionDoc, vPaginated } from \"../model\";\nimport schema from \"../schema\";\n\nconst PUBLIC_DATA_KEYS = {\n  user: [\"type\", \"provider\", \"existingUserId\"],\n  session: [\"provider\", \"method\", \"reason\"],\n  account: [\"provider\", \"accountId\"],\n  password: [\"userId\"],\n  passkey: [\"passkeyId\"],\n  totp: [\"totpId\"],\n  email: [\"userId\"],\n  phone: [\"userId\"],\n  api_key: [\"keyId\", \"name\", \"prefix\", \"reason\"],\n  oauth: [\"clientId\", \"codeId\", \"scopes\", \"grantType\", \"resource\"],\n  connection: [\n    \"connectionId\",\n    \"protocol\",\n    \"domain\",\n    \"recordName\",\n    \"expiresAt\",\n    \"verifiedAt\",\n    \"metadataUrl\",\n    \"domains\",\n    \"version\",\n    \"errorCode\",\n    \"issuer\",\n    \"discoveryUrl\",\n    \"jwksUri\",\n    \"audience\",\n    \"tokenEndpointAuthMethod\",\n  ],\n  scim: [\n    \"scimConfigId\",\n    \"resourceType\",\n    \"resourceId\",\n    \"operation\",\n    \"externalId\",\n    \"active\",\n    \"groupId\",\n    \"userId\",\n  ],\n  webhook: [\n    \"endpointId\",\n    \"deliveryId\",\n    \"sourceEventId\",\n    \"sourceEventType\",\n    \"attemptCount\",\n    \"status\",\n    \"error\",\n  ],\n  security: [\"reason\", \"errorCode\"],\n} as const;\n\nfunction publicData(kind: AuthEventKind, value: unknown): Infer<typeof vAuthEventData> | undefined {\n  if (typeof value !== \"object\" || value === null || Array.isArray(value)) return undefined;\n  const category = EVENT_KIND_CATEGORY[kind];\n  const keys = PUBLIC_DATA_KEYS[category] ?? [];\n  const source = value as Record<string, unknown>;\n  const redacted: Record<string, unknown> = {};\n  for (const key of keys) {\n    const nested = source[key];\n    if (nested !== undefined) redacted[key] = nested;\n  }\n  return Object.keys(redacted).length === 0\n    ? undefined\n    : (redacted as Infer<typeof vAuthEventData>);\n}\n\nfunction publicProjection(doc: Doc<\"AuthEventProjection\">) {\n  return {\n    _id: doc._id,\n    _creationTime: doc._creationTime,\n    eventId: doc.eventId,\n    targetKind: doc.targetKind,\n    targetId: doc.targetId,\n    kind: doc.kind,\n    category: doc.category,\n    occurredAt: doc.occurredAt,\n    actorType: doc.actorType,\n    actorId: doc.actorId,\n    subjectType: doc.subjectType,\n    subjectId: doc.subjectId,\n    outcome: doc.outcome,\n    errorCode: doc.errorCode,\n    requestId: doc.requestId,\n    ip: undefined,\n    data: publicData(doc.kind, doc.data),\n  };\n}\n\n/**\n * List audit-event projections for a connection or a group, newest first and\n * paginated. Rows are redacted to public fields (IP dropped, `data` narrowed to\n * an allowlist). Requires exactly one of `connectionId` or `groupId` — passing\n * neither throws rather than scanning the entire audit log.\n */\nexport const list = query({\n  args: {\n    connectionId: v.optional(v.id(\"GroupConnection\")),\n    groupId: v.optional(v.id(\"Group\")),\n    paginationOpts: paginationOptsValidator,\n  },\n  returns: vPaginated(vAuthEventProjectionDoc),\n  handler: async (ctx, args) => {\n    if (args.connectionId !== undefined) {\n      const result = await paginator(ctx.db, schema)\n        .query(\"AuthEventProjection\")\n        .withIndex(\"target_time\", (idx) =>\n          idx.eq(\"targetKind\", \"connection\").eq(\"targetId\", args.connectionId!),\n        )\n        .order(\"desc\")\n        .paginate(args.paginationOpts);\n      return { ...result, page: result.page.map(publicProjection) };\n    }\n    if (args.groupId !== undefined) {\n      const result = await paginator(ctx.db, schema)\n        .query(\"AuthEventProjection\")\n        .withIndex(\"target_time\", (idx) =>\n          idx.eq(\"targetKind\", \"group\").eq(\"targetId\", args.groupId!),\n        )\n        .order(\"desc\")\n        .paginate(args.paginationOpts);\n      return { ...result, page: result.page.map(publicProjection) };\n    }\n    throw new ConvexError({\n      code: ErrorCode.INVALID_PARAMETERS,\n      message:\n        \"connection.audit.list requires either `connectionId` or `groupId` to target the query. Passing neither would walk the entire audit log.\",\n    });\n  },\n});\n"],"mappings":";;;;;;;;;;;;;;;;AAiBA,MAAM,mBAAmB;CACvB,MAAM;EAAC;EAAQ;EAAY;EAAiB;CAC5C,SAAS;EAAC;EAAY;EAAU;EAAS;CACzC,SAAS,CAAC,YAAY,YAAY;CAClC,UAAU,CAAC,SAAS;CACpB,SAAS,CAAC,YAAY;CACtB,MAAM,CAAC,SAAS;CAChB,OAAO,CAAC,SAAS;CACjB,OAAO,CAAC,SAAS;CACjB,SAAS;EAAC;EAAS;EAAQ;EAAU;EAAS;CAC9C,OAAO;EAAC;EAAY;EAAU;EAAU;EAAa;EAAW;CAChE,YAAY;EACV;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACD;CACD,MAAM;EACJ;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACD;CACD,SAAS;EACP;EACA;EACA;EACA;EACA;EACA;EACA;EACD;CACD,UAAU,CAAC,UAAU,YAAY;CAClC;AAED,SAAS,WAAW,MAAqB,OAA0D;AACjG,KAAI,OAAO,UAAU,YAAY,UAAU,QAAQ,MAAM,QAAQ,MAAM,CAAE,QAAO;CAEhF,MAAM,OAAO,iBADI,oBAAoB,UACM,EAAE;CAC7C,MAAM,SAAS;CACf,MAAM,WAAoC,EAAE;AAC5C,MAAK,MAAM,OAAO,MAAM;EACtB,MAAM,SAAS,OAAO;AACtB,MAAI,WAAW,OAAW,UAAS,OAAO;;AAE5C,QAAO,OAAO,KAAK,SAAS,CAAC,WAAW,IACpC,SACC;;AAGP,SAAS,iBAAiB,KAAiC;AACzD,QAAO;EACL,KAAK,IAAI;EACT,eAAe,IAAI;EACnB,SAAS,IAAI;EACb,YAAY,IAAI;EAChB,UAAU,IAAI;EACd,MAAM,IAAI;EACV,UAAU,IAAI;EACd,YAAY,IAAI;EAChB,WAAW,IAAI;EACf,SAAS,IAAI;EACb,aAAa,IAAI;EACjB,WAAW,IAAI;EACf,SAAS,IAAI;EACb,WAAW,IAAI;EACf,WAAW,IAAI;EACf,IAAI;EACJ,MAAM,WAAW,IAAI,MAAM,IAAI,KAAK;EACrC;;;;;;;;AASH,MAAa,OAAO,MAAM;CACxB,MAAM;EACJ,cAAc,EAAE,SAAS,EAAE,GAAG,kBAAkB,CAAC;EACjD,SAAS,EAAE,SAAS,EAAE,GAAG,QAAQ,CAAC;EAClC,gBAAgB;EACjB;CACD,SAAS,WAAW,wBAAwB;CAC5C,SAAS,OAAO,KAAK,SAAS;AAC5B,MAAI,KAAK,iBAAiB,QAAW;GACnC,MAAM,SAAS,MAAM,UAAU,IAAI,IAAIA,eAAO,CAC3C,MAAM,sBAAsB,CAC5B,UAAU,gBAAgB,QACzB,IAAI,GAAG,cAAc,aAAa,CAAC,GAAG,YAAY,KAAK,aAAc,CACtE,CACA,MAAM,OAAO,CACb,SAAS,KAAK,eAAe;AAChC,UAAO;IAAE,GAAG;IAAQ,MAAM,OAAO,KAAK,IAAI,iBAAiB;IAAE;;AAE/D,MAAI,KAAK,YAAY,QAAW;GAC9B,MAAM,SAAS,MAAM,UAAU,IAAI,IAAIA,eAAO,CAC3C,MAAM,sBAAsB,CAC5B,UAAU,gBAAgB,QACzB,IAAI,GAAG,cAAc,QAAQ,CAAC,GAAG,YAAY,KAAK,QAAS,CAC5D,CACA,MAAM,OAAO,CACb,SAAS,KAAK,eAAe;AAChC,UAAO;IAAE,GAAG;IAAQ,MAAM,OAAO,KAAK,IAAI,iBAAiB;IAAE;;AAE/D,QAAM,IAAI,YAAY;GACpB,MAAM,UAAU;GAChB,SACE;GACH,CAAC;;CAEL,CAAC"}

package/dist/component/connection/cache.d.ts

@@ -1,4 +1,4 @@
-import * as convex_server210 from "convex/server";
+import * as convex_server215 from "convex/server";
 
 //#region src/component/connection/cache.d.ts
 declare namespace cache_d_exports {
@@ -27,7 +27,7 @@ declare namespace cache_d_exports {
 /**
  * Read-through fetch for OIDC discovery JSON. Cached 1h per URL.
  */
-declare const oidcDiscovery: convex_server210.RegisteredAction<"public", {
+declare const oidcDiscovery: convex_server215.RegisteredAction<"public", {
   runtimeOrigin?: string | undefined;
   externalHost?: string | undefined;
   url: string;
@@ -45,7 +45,7 @@ declare const oidcDiscovery: convex_server210.RegisteredAction<"public", {
  * Cached 2h per URL (separate from the runtime sign-in path so admin
  * dashboards don't share keys with hot-path traffic).
  */
-declare const oidcStatusDiscovery: convex_server210.RegisteredAction<"public", {
+declare const oidcStatusDiscovery: convex_server215.RegisteredAction<"public", {
   runtimeOrigin?: string | undefined;
   externalHost?: string | undefined;
   url: string;
@@ -61,19 +61,19 @@ declare const oidcStatusDiscovery: convex_server210.RegisteredAction<"public", {
 /**
  * Read-through fetch for SAML IdP metadata XML. Cached 24h per URL.
  */
-declare const samlMetadata: convex_server210.RegisteredAction<"public", {
+declare const samlMetadata: convex_server215.RegisteredAction<"public", {
   runtimeOrigin?: string | undefined;
   externalHost?: string | undefined;
   url: string;
 }, Promise<string>>;
 /** Invalidate a cached OIDC discovery entry (e.g. on `discoveryUrl` update). */
-declare const invalidateOidcDiscovery: convex_server210.RegisteredMutation<"public", {
+declare const invalidateOidcDiscovery: convex_server215.RegisteredMutation<"public", {
   runtimeOrigin?: string | undefined;
   externalHost?: string | undefined;
   url: string;
 }, Promise<null>>;
 /** Invalidate a cached SAML metadata entry (e.g. on `metadataUrl` update). */
-declare const invalidateSamlMetadata: convex_server210.RegisteredMutation<"public", {
+declare const invalidateSamlMetadata: convex_server215.RegisteredMutation<"public", {
   runtimeOrigin?: string | undefined;
   externalHost?: string | undefined;
   url: string;