@estifanos-sh/convex-auth 0.0.2 → 0.0.4

package/dist/component/user/key.js.map

@@ -1 +1 @@
-{"version":3,"file":"key.js","names":["schema"],"sources":["../../../src/component/user/key.ts"],"sourcesContent":["/**\n * `component.user.key.*` — API keys (programmatic access credentials,\n * a sub-resource of user).\n *\n * Reads collapse into one overloaded `get`.\n *\n * @module\n */\n\nimport { paginationOptsValidator } from \"convex/server\";\nimport { ConvexError, v } from \"convex/values\";\nimport { stream } from \"convex-helpers/server/stream\";\nimport { ErrorCode } from \"../../shared/codes\";\n\nimport { mutation, query } from \"../functions\";\nimport schema from \"../schema\";\nimport { vApiKeyDoc, vApiKeyRateLimit, vApiKeyScope, vPaginated } from \"../model\";\n\ntype ApiKeyRateLimit = { maxRequests: number; windowMs: number };\ntype ApiKeyUsePatch = {\n  rateLimitState?: { attemptsLeft: number; lastAttemptTime: number };\n  lastUsedAt?: number;\n};\n\nfunction isValidRateLimit(rateLimit: ApiKeyRateLimit): boolean {\n  return (\n    Number.isSafeInteger(rateLimit.maxRequests) &&\n    rateLimit.maxRequests > 0 &&\n    Number.isFinite(rateLimit.windowMs) &&\n    rateLimit.windowMs > 0\n  );\n}\n\nfunction assertValidRateLimit(rateLimit: ApiKeyRateLimit | undefined): void {\n  if (rateLimit !== undefined && !isValidRateLimit(rateLimit)) {\n    throw new ConvexError({\n      code: ErrorCode.INVALID_PARAMETERS,\n      message:\n        \"API key rate limits require a positive integer maxRequests and positive finite windowMs.\",\n    });\n  }\n}\n\n/**\n * Read an API key by id, or by `hashedKey` when given. Returns `null` when no\n * selector matches.\n */\nexport const get = query({\n  args: {\n    id: v.optional(v.id(\"ApiKey\")),\n    hashedKey: v.optional(v.string()),\n  },\n  returns: v.union(vApiKeyDoc, v.null()),\n  handler: async (ctx, args) => {\n    if (args.hashedKey !== undefined) {\n      return await ctx.db\n        .query(\"ApiKey\")\n        .withIndex(\"hashed_key\", (q) => q.eq(\"hashedKey\", args.hashedKey!))\n        .first();\n    }\n    if (args.id === undefined) return null;\n    return await ctx.db.get(\"ApiKey\", args.id);\n  },\n});\n\n/** List API keys, paginated, with optional `where` filters and ordering. */\nexport const list = query({\n  args: {\n    where: v.optional(\n      v.object({\n        userId: v.optional(v.id(\"User\")),\n        revoked: v.optional(v.boolean()),\n        name: v.optional(v.string()),\n        prefix: v.optional(v.string()),\n      }),\n    ),\n    paginationOpts: paginationOptsValidator,\n    orderBy: v.optional(\n      v.union(\n        v.literal(\"_creationTime\"),\n        v.literal(\"name\"),\n        v.literal(\"lastUsedAt\"),\n        v.literal(\"expiresAt\"),\n        v.literal(\"revoked\"),\n      ),\n    ),\n    order: v.optional(v.union(v.literal(\"asc\"), v.literal(\"desc\"))),\n  },\n  returns: vPaginated(vApiKeyDoc),\n  handler: async (ctx, args) => {\n    const where = args.where ?? {};\n    const order = args.order ?? \"desc\";\n\n    const base = stream(ctx.db, schema).query(\"ApiKey\");\n    let q;\n    if (where.userId !== undefined) {\n      q = base.withIndex(\"user_id\", (idx) => idx.eq(\"userId\", where.userId!));\n    } else {\n      q = base;\n    }\n\n    return await q\n      .order(order)\n      .filterWith(\n        async (d) =>\n          (where.revoked === undefined || d.revoked === where.revoked) &&\n          (where.name === undefined || d.name === where.name) &&\n          (where.prefix === undefined || d.prefix === where.prefix),\n      )\n      .paginate(args.paginationOpts);\n  },\n});\n\n/** Insert a new API key (stamped `createdAt`, `revoked: false`). */\nexport const create = mutation({\n  args: {\n    userId: v.id(\"User\"),\n    prefix: v.string(),\n    hashedKey: v.string(),\n    name: v.string(),\n    scopes: v.array(\n      v.object({\n        resource: v.string(),\n        actions: v.array(v.string()),\n      }),\n    ),\n    rateLimit: v.optional(vApiKeyRateLimit),\n    expiresAt: v.optional(v.number()),\n    extend: v.optional(v.any()),\n  },\n  returns: v.id(\"ApiKey\"),\n  handler: async (ctx, args) => {\n    assertValidRateLimit(args.rateLimit);\n    return await ctx.db.insert(\"ApiKey\", {\n      ...args,\n      createdAt: Date.now(),\n      revoked: false,\n    });\n  },\n});\n\n/** Patch fields on an API key; throws `KEY_NOT_FOUND` if it does not exist. */\nexport const update = mutation({\n  args: {\n    id: v.id(\"ApiKey\"),\n    patch: v.object({\n      name: v.optional(v.string()),\n      scopes: v.optional(v.array(vApiKeyScope)),\n      rateLimit: v.optional(vApiKeyRateLimit),\n      revoked: v.optional(v.boolean()),\n    }),\n  },\n  returns: v.null(),\n  handler: async (ctx, { id: keyId, patch }) => {\n    assertValidRateLimit(patch.rateLimit);\n    const key = await ctx.db.get(\"ApiKey\", keyId);\n    if (key === null) {\n      throw new ConvexError({\n        code: ErrorCode.KEY_NOT_FOUND,\n        message: \"API key not found\",\n        keyId,\n      });\n    }\n    await ctx.db.patch(\"ApiKey\", keyId, patch);\n    return null;\n  },\n});\n\n/**\n * Atomically enforce an API key's rate limit and refresh `lastUsedAt`, folding\n * the read → check → decrement of the token bucket into a SINGLE transaction on\n * the `ApiKey` row.\n *\n * The facade previously split that read (`key.get`) from the decrement\n * (`key.update`) across two transactions, so two concurrent verifications could\n * both read the same starting `rateLimitState`, both decide \"not limited\", and\n * both persist a decrement of the *same* state — the true atomic decrement was\n * lost and a burst could slip past the limit. Performing the whole\n * check-and-decrement here closes that window: the row's transaction serializes\n * concurrent callers, so each consumes its own token.\n *\n * The verification decision is made from the same transactional snapshot as\n * the rate-limit update. In particular, the mutation re-checks deletion,\n * revocation, expiration, and the current scopes instead of trusting the\n * facade's earlier hash lookup. A successful result returns the current owner\n * and scopes so a concurrent scope reduction cannot authenticate with stale\n * permissions.\n *\n * Returns `{ status: \"limited\" }` WITHOUT writing when the bucket is empty\n * (mirroring the facade's prior behavior of throwing before its update on the\n * limited branch); otherwise decrements the bucket (when configured) and\n * refreshes `lastUsedAt`. The token bucket refills linearly over the configured\n * window (the same algorithm as sign-in rate limiting); the math is inlined\n * here because component code cannot import from the server bundle.\n *\n * `lastUsedAt` is coarsened by the optional `coarsenMs` window: it is only\n * rewritten when unset or older than the window, so read-only bearer traffic on\n * a hot key stays read-only (no per-request write). When a rate-limit decrement\n * forces a write anyway, a fresh `lastUsedAt` is simply left as-is. Omitting\n * `coarsenMs` (or passing `0`) disables coarsening and refreshes every call.\n */\nexport const recordUse = mutation({\n  args: { id: v.id(\"ApiKey\"), coarsenMs: v.optional(v.number()) },\n  returns: v.union(\n    v.object({ status: v.literal(\"invalid\") }),\n    v.object({ status: v.literal(\"revoked\") }),\n    v.object({ status: v.literal(\"expired\") }),\n    v.object({ status: v.literal(\"limited\") }),\n    v.object({\n      status: v.literal(\"verified\"),\n      keyId: v.id(\"ApiKey\"),\n      userId: v.id(\"User\"),\n      scopes: v.array(vApiKeyScope),\n    }),\n  ),\n  handler: async (ctx, { id: keyId, coarsenMs }) => {\n    // Use the mutation's trusted transaction clock for validity and bucket math.\n    const now = Date.now();\n    const key = await ctx.db.get(\"ApiKey\", keyId);\n    if (key === null) {\n      return { status: \"invalid\" as const };\n    }\n    if (key.revoked) {\n      return { status: \"revoked\" as const };\n    }\n    if (key.expiresAt !== undefined && key.expiresAt < now) {\n      return { status: \"expired\" as const };\n    }\n    const patch: ApiKeyUsePatch = {};\n    if (key.rateLimit) {\n      const state = key.rateLimitState;\n      if (!state) {\n        patch.rateLimitState = {\n          attemptsLeft: key.rateLimit.maxRequests - 1,\n          lastAttemptTime: now,\n        };\n      } else {\n        const elapsed = Math.max(0, now - state.lastAttemptTime);\n        const refillRate = key.rateLimit.maxRequests / key.rateLimit.windowMs;\n        const refilled = Math.min(\n          key.rateLimit.maxRequests,\n          state.attemptsLeft + elapsed * refillRate,\n        );\n        if (refilled < 1) {\n          // Bucket empty: reject WITHOUT writing (matches the prior facade,\n          // which threw before its single `update`, leaving state untouched).\n          return { status: \"limited\" as const };\n        }\n        patch.rateLimitState = { attemptsLeft: refilled - 1, lastAttemptTime: now };\n      }\n    }\n    // Coarsen the `lastUsedAt` touch: only stamp it when unset or older than the\n    // caller's sampling window. With `coarsenMs` unset/0 the window is 0, so it\n    // refreshes every call.\n    const window = coarsenMs ?? 0;\n    const lastUsedAt = typeof key.lastUsedAt === \"number\" ? key.lastUsedAt : 0;\n    if (now - lastUsedAt >= window) {\n      patch.lastUsedAt = now;\n    }\n    // Nothing to persist — no rate-limit decrement and `lastUsedAt` still fresh:\n    // the hot path stays read-only.\n    if (patch.rateLimitState === undefined && patch.lastUsedAt === undefined) {\n      return {\n        status: \"verified\" as const,\n        keyId: key._id,\n        userId: key.userId,\n        scopes: key.scopes,\n      };\n    }\n    await ctx.db.patch(\"ApiKey\", keyId, patch);\n    return {\n      status: \"verified\" as const,\n      keyId: key._id,\n      userId: key.userId,\n      scopes: key.scopes,\n    };\n  },\n});\n\n/**\n * Atomically revoke an active API key and create its replacement.\n *\n * The caller pre-generates the replacement secret and passes only its hash and\n * display prefix. Reading the old row, validating its state, revoking it, and\n * inserting the replacement happen in one transaction, so concurrent rotations\n * cannot both mint a usable successor and an insert failure cannot strand the\n * caller with a revoked key and no replacement.\n */\nexport const rotate = mutation({\n  args: {\n    id: v.id(\"ApiKey\"),\n    prefix: v.string(),\n    hashedKey: v.string(),\n    name: v.optional(v.string()),\n    expiresAt: v.optional(v.number()),\n  },\n  returns: v.union(\n    v.object({ status: v.literal(\"invalid\") }),\n    v.object({ status: v.literal(\"revoked\") }),\n    v.object({ status: v.literal(\"invalid_rate_limit\") }),\n    v.object({\n      status: v.literal(\"rotated\"),\n      id: v.id(\"ApiKey\"),\n      userId: v.id(\"User\"),\n      name: v.string(),\n    }),\n  ),\n  handler: async (ctx, args) => {\n    const existing = await ctx.db.get(\"ApiKey\", args.id);\n    if (existing === null) {\n      return { status: \"invalid\" as const };\n    }\n    if (existing.revoked) {\n      return { status: \"revoked\" as const };\n    }\n    if (existing.rateLimit !== undefined && !isValidRateLimit(existing.rateLimit)) {\n      return { status: \"invalid_rate_limit\" as const };\n    }\n\n    const name = args.name ?? existing.name;\n    await ctx.db.patch(\"ApiKey\", existing._id, { revoked: true });\n    const id = await ctx.db.insert(\"ApiKey\", {\n      userId: existing.userId,\n      prefix: args.prefix,\n      hashedKey: args.hashedKey,\n      name,\n      scopes: existing.scopes,\n      rateLimit: existing.rateLimit,\n      expiresAt: args.expiresAt,\n      createdAt: Date.now(),\n      revoked: false,\n      extend: existing.extend,\n    });\n    return {\n      status: \"rotated\" as const,\n      id,\n      userId: existing.userId,\n      name,\n    };\n  },\n});\n\n/** Delete an API key; throws `KEY_NOT_FOUND` if it does not exist. */\nconst remove = mutation({\n  args: { id: v.id(\"ApiKey\") },\n  returns: v.null(),\n  handler: async (ctx, { id: keyId }) => {\n    const key = await ctx.db.get(\"ApiKey\", keyId);\n    if (key === null) {\n      throw new ConvexError({\n        code: ErrorCode.KEY_NOT_FOUND,\n        message: \"API key not found\",\n        keyId,\n      });\n    }\n    await ctx.db.delete(\"ApiKey\", keyId);\n    return null;\n  },\n});\n\nexport { remove };\n"],"mappings":";;;;;;;;;;;;;;;;;;AAwBA,SAAS,iBAAiB,WAAqC;AAC7D,QACE,OAAO,cAAc,UAAU,YAAY,IAC3C,UAAU,cAAc,KACxB,OAAO,SAAS,UAAU,SAAS,IACnC,UAAU,WAAW;;AAIzB,SAAS,qBAAqB,WAA8C;AAC1E,KAAI,cAAc,UAAa,CAAC,iBAAiB,UAAU,CACzD,OAAM,IAAI,YAAY;EACpB,MAAM,UAAU;EAChB,SACE;EACH,CAAC;;;;;;AAQN,MAAa,MAAM,MAAM;CACvB,MAAM;EACJ,IAAI,EAAE,SAAS,EAAE,GAAG,SAAS,CAAC;EAC9B,WAAW,EAAE,SAAS,EAAE,QAAQ,CAAC;EAClC;CACD,SAAS,EAAE,MAAM,YAAY,EAAE,MAAM,CAAC;CACtC,SAAS,OAAO,KAAK,SAAS;AAC5B,MAAI,KAAK,cAAc,OACrB,QAAO,MAAM,IAAI,GACd,MAAM,SAAS,CACf,UAAU,eAAe,MAAM,EAAE,GAAG,aAAa,KAAK,UAAW,CAAC,CAClE,OAAO;AAEZ,MAAI,KAAK,OAAO,OAAW,QAAO;AAClC,SAAO,MAAM,IAAI,GAAG,IAAI,UAAU,KAAK,GAAG;;CAE7C,CAAC;;AAGF,MAAa,OAAO,MAAM;CACxB,MAAM;EACJ,OAAO,EAAE,SACP,EAAE,OAAO;GACP,QAAQ,EAAE,SAAS,EAAE,GAAG,OAAO,CAAC;GAChC,SAAS,EAAE,SAAS,EAAE,SAAS,CAAC;GAChC,MAAM,EAAE,SAAS,EAAE,QAAQ,CAAC;GAC5B,QAAQ,EAAE,SAAS,EAAE,QAAQ,CAAC;GAC/B,CAAC,CACH;EACD,gBAAgB;EAChB,SAAS,EAAE,SACT,EAAE,MACA,EAAE,QAAQ,gBAAgB,EAC1B,EAAE,QAAQ,OAAO,EACjB,EAAE,QAAQ,aAAa,EACvB,EAAE,QAAQ,YAAY,EACtB,EAAE,QAAQ,UAAU,CACrB,CACF;EACD,OAAO,EAAE,SAAS,EAAE,MAAM,EAAE,QAAQ,MAAM,EAAE,EAAE,QAAQ,OAAO,CAAC,CAAC;EAChE;CACD,SAAS,WAAW,WAAW;CAC/B,SAAS,OAAO,KAAK,SAAS;EAC5B,MAAM,QAAQ,KAAK,SAAS,EAAE;EAC9B,MAAM,QAAQ,KAAK,SAAS;EAE5B,MAAM,OAAO,OAAO,IAAI,IAAIA,eAAO,CAAC,MAAM,SAAS;EACnD,IAAI;AACJ,MAAI,MAAM,WAAW,OACnB,KAAI,KAAK,UAAU,YAAY,QAAQ,IAAI,GAAG,UAAU,MAAM,OAAQ,CAAC;MAEvE,KAAI;AAGN,SAAO,MAAM,EACV,MAAM,MAAM,CACZ,WACC,OAAO,OACJ,MAAM,YAAY,UAAa,EAAE,YAAY,MAAM,aACnD,MAAM,SAAS,UAAa,EAAE,SAAS,MAAM,UAC7C,MAAM,WAAW,UAAa,EAAE,WAAW,MAAM,QACrD,CACA,SAAS,KAAK,eAAe;;CAEnC,CAAC;;AAGF,MAAa,SAAS,SAAS;CAC7B,MAAM;EACJ,QAAQ,EAAE,GAAG,OAAO;EACpB,QAAQ,EAAE,QAAQ;EAClB,WAAW,EAAE,QAAQ;EACrB,MAAM,EAAE,QAAQ;EAChB,QAAQ,EAAE,MACR,EAAE,OAAO;GACP,UAAU,EAAE,QAAQ;GACpB,SAAS,EAAE,MAAM,EAAE,QAAQ,CAAC;GAC7B,CAAC,CACH;EACD,WAAW,EAAE,SAAS,iBAAiB;EACvC,WAAW,EAAE,SAAS,EAAE,QAAQ,CAAC;EACjC,QAAQ,EAAE,SAAS,EAAE,KAAK,CAAC;EAC5B;CACD,SAAS,EAAE,GAAG,SAAS;CACvB,SAAS,OAAO,KAAK,SAAS;AAC5B,uBAAqB,KAAK,UAAU;AACpC,SAAO,MAAM,IAAI,GAAG,OAAO,UAAU;GACnC,GAAG;GACH,WAAW,KAAK,KAAK;GACrB,SAAS;GACV,CAAC;;CAEL,CAAC;;AAGF,MAAa,SAAS,SAAS;CAC7B,MAAM;EACJ,IAAI,EAAE,GAAG,SAAS;EAClB,OAAO,EAAE,OAAO;GACd,MAAM,EAAE,SAAS,EAAE,QAAQ,CAAC;GAC5B,QAAQ,EAAE,SAAS,EAAE,MAAM,aAAa,CAAC;GACzC,WAAW,EAAE,SAAS,iBAAiB;GACvC,SAAS,EAAE,SAAS,EAAE,SAAS,CAAC;GACjC,CAAC;EACH;CACD,SAAS,EAAE,MAAM;CACjB,SAAS,OAAO,KAAK,EAAE,IAAI,OAAO,YAAY;AAC5C,uBAAqB,MAAM,UAAU;AAErC,MADY,MAAM,IAAI,GAAG,IAAI,UAAU,MAAM,KACjC,KACV,OAAM,IAAI,YAAY;GACpB,MAAM,UAAU;GAChB,SAAS;GACT;GACD,CAAC;AAEJ,QAAM,IAAI,GAAG,MAAM,UAAU,OAAO,MAAM;AAC1C,SAAO;;CAEV,CAAC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAmCF,MAAa,YAAY,SAAS;CAChC,MAAM;EAAE,IAAI,EAAE,GAAG,SAAS;EAAE,WAAW,EAAE,SAAS,EAAE,QAAQ,CAAC;EAAE;CAC/D,SAAS,EAAE,MACT,EAAE,OAAO,EAAE,QAAQ,EAAE,QAAQ,UAAU,EAAE,CAAC,EAC1C,EAAE,OAAO,EAAE,QAAQ,EAAE,QAAQ,UAAU,EAAE,CAAC,EAC1C,EAAE,OAAO,EAAE,QAAQ,EAAE,QAAQ,UAAU,EAAE,CAAC,EAC1C,EAAE,OAAO,EAAE,QAAQ,EAAE,QAAQ,UAAU,EAAE,CAAC,EAC1C,EAAE,OAAO;EACP,QAAQ,EAAE,QAAQ,WAAW;EAC7B,OAAO,EAAE,GAAG,SAAS;EACrB,QAAQ,EAAE,GAAG,OAAO;EACpB,QAAQ,EAAE,MAAM,aAAa;EAC9B,CAAC,CACH;CACD,SAAS,OAAO,KAAK,EAAE,IAAI,OAAO,gBAAgB;EAEhD,MAAM,MAAM,KAAK,KAAK;EACtB,MAAM,MAAM,MAAM,IAAI,GAAG,IAAI,UAAU,MAAM;AAC7C,MAAI,QAAQ,KACV,QAAO,EAAE,QAAQ,WAAoB;AAEvC,MAAI,IAAI,QACN,QAAO,EAAE,QAAQ,WAAoB;AAEvC,MAAI,IAAI,cAAc,UAAa,IAAI,YAAY,IACjD,QAAO,EAAE,QAAQ,WAAoB;EAEvC,MAAM,QAAwB,EAAE;AAChC,MAAI,IAAI,WAAW;GACjB,MAAM,QAAQ,IAAI;AAClB,OAAI,CAAC,MACH,OAAM,iBAAiB;IACrB,cAAc,IAAI,UAAU,cAAc;IAC1C,iBAAiB;IAClB;QACI;IACL,MAAM,UAAU,KAAK,IAAI,GAAG,MAAM,MAAM,gBAAgB;IACxD,MAAM,aAAa,IAAI,UAAU,cAAc,IAAI,UAAU;IAC7D,MAAM,WAAW,KAAK,IACpB,IAAI,UAAU,aACd,MAAM,eAAe,UAAU,WAChC;AACD,QAAI,WAAW,EAGb,QAAO,EAAE,QAAQ,WAAoB;AAEvC,UAAM,iBAAiB;KAAE,cAAc,WAAW;KAAG,iBAAiB;KAAK;;;EAM/E,MAAM,SAAS,aAAa;AAE5B,MAAI,OADe,OAAO,IAAI,eAAe,WAAW,IAAI,aAAa,MACjD,OACtB,OAAM,aAAa;AAIrB,MAAI,MAAM,mBAAmB,UAAa,MAAM,eAAe,OAC7D,QAAO;GACL,QAAQ;GACR,OAAO,IAAI;GACX,QAAQ,IAAI;GACZ,QAAQ,IAAI;GACb;AAEH,QAAM,IAAI,GAAG,MAAM,UAAU,OAAO,MAAM;AAC1C,SAAO;GACL,QAAQ;GACR,OAAO,IAAI;GACX,QAAQ,IAAI;GACZ,QAAQ,IAAI;GACb;;CAEJ,CAAC;;;;;;;;;;AAWF,MAAa,SAAS,SAAS;CAC7B,MAAM;EACJ,IAAI,EAAE,GAAG,SAAS;EAClB,QAAQ,EAAE,QAAQ;EAClB,WAAW,EAAE,QAAQ;EACrB,MAAM,EAAE,SAAS,EAAE,QAAQ,CAAC;EAC5B,WAAW,EAAE,SAAS,EAAE,QAAQ,CAAC;EAClC;CACD,SAAS,EAAE,MACT,EAAE,OAAO,EAAE,QAAQ,EAAE,QAAQ,UAAU,EAAE,CAAC,EAC1C,EAAE,OAAO,EAAE,QAAQ,EAAE,QAAQ,UAAU,EAAE,CAAC,EAC1C,EAAE,OAAO,EAAE,QAAQ,EAAE,QAAQ,qBAAqB,EAAE,CAAC,EACrD,EAAE,OAAO;EACP,QAAQ,EAAE,QAAQ,UAAU;EAC5B,IAAI,EAAE,GAAG,SAAS;EAClB,QAAQ,EAAE,GAAG,OAAO;EACpB,MAAM,EAAE,QAAQ;EACjB,CAAC,CACH;CACD,SAAS,OAAO,KAAK,SAAS;EAC5B,MAAM,WAAW,MAAM,IAAI,GAAG,IAAI,UAAU,KAAK,GAAG;AACpD,MAAI,aAAa,KACf,QAAO,EAAE,QAAQ,WAAoB;AAEvC,MAAI,SAAS,QACX,QAAO,EAAE,QAAQ,WAAoB;AAEvC,MAAI,SAAS,cAAc,UAAa,CAAC,iBAAiB,SAAS,UAAU,CAC3E,QAAO,EAAE,QAAQ,sBAA+B;EAGlD,MAAM,OAAO,KAAK,QAAQ,SAAS;AACnC,QAAM,IAAI,GAAG,MAAM,UAAU,SAAS,KAAK,EAAE,SAAS,MAAM,CAAC;AAa7D,SAAO;GACL,QAAQ;GACR,IAdS,MAAM,IAAI,GAAG,OAAO,UAAU;IACvC,QAAQ,SAAS;IACjB,QAAQ,KAAK;IACb,WAAW,KAAK;IAChB;IACA,QAAQ,SAAS;IACjB,WAAW,SAAS;IACpB,WAAW,KAAK;IAChB,WAAW,KAAK,KAAK;IACrB,SAAS;IACT,QAAQ,SAAS;IAClB,CAAC;GAIA,QAAQ,SAAS;GACjB;GACD;;CAEJ,CAAC;;AAGF,MAAM,SAAS,SAAS;CACtB,MAAM,EAAE,IAAI,EAAE,GAAG,SAAS,EAAE;CAC5B,SAAS,EAAE,MAAM;CACjB,SAAS,OAAO,KAAK,EAAE,IAAI,YAAY;AAErC,MADY,MAAM,IAAI,GAAG,IAAI,UAAU,MAAM,KACjC,KACV,OAAM,IAAI,YAAY;GACpB,MAAM,UAAU;GAChB,SAAS;GACT;GACD,CAAC;AAEJ,QAAM,IAAI,GAAG,OAAO,UAAU,MAAM;AACpC,SAAO;;CAEV,CAAC"}
+{"version":3,"file":"key.js","names":["schema"],"sources":["../../../src/component/user/key.ts"],"sourcesContent":["/**\n * `component.user.key.*` — API keys (programmatic access credentials,\n * a sub-resource of user).\n *\n * Reads collapse into one overloaded `get`.\n *\n * @module\n */\n\nimport { paginationOptsValidator } from \"convex/server\";\nimport { ConvexError, v } from \"convex/values\";\nimport { stream } from \"convex-helpers/server/stream\";\nimport { ErrorCode } from \"../../shared/codes\";\n\nimport { mutation, query } from \"../_generated/server\";\nimport schema from \"../schema\";\nimport { vApiKeyDoc } from \"../documents\";\nimport { vApiKeyRateLimit, vApiKeyScope, vPaginated } from \"../model\";\n\ntype ApiKeyRateLimit = { maxRequests: number; windowMs: number };\ntype ApiKeyUsePatch = {\n  rateLimitState?: { attemptsLeft: number; lastAttemptTime: number };\n  lastUsedAt?: number;\n};\n\nfunction isValidRateLimit(rateLimit: ApiKeyRateLimit): boolean {\n  return (\n    Number.isSafeInteger(rateLimit.maxRequests) &&\n    rateLimit.maxRequests > 0 &&\n    Number.isFinite(rateLimit.windowMs) &&\n    rateLimit.windowMs > 0\n  );\n}\n\nfunction assertValidRateLimit(rateLimit: ApiKeyRateLimit | undefined): void {\n  if (rateLimit !== undefined && !isValidRateLimit(rateLimit)) {\n    throw new ConvexError({\n      code: ErrorCode.INVALID_PARAMETERS,\n      message:\n        \"API key rate limits require a positive integer maxRequests and positive finite windowMs.\",\n    });\n  }\n}\n\n/**\n * Read an API key by id, or by `hashedKey` when given. Returns `null` when no\n * selector matches.\n */\nexport const get = query({\n  args: {\n    id: v.optional(v.id(\"ApiKey\")),\n    hashedKey: v.optional(v.string()),\n  },\n  returns: v.union(vApiKeyDoc, v.null()),\n  handler: async (ctx, args) => {\n    if (args.hashedKey !== undefined) {\n      return await ctx.db\n        .query(\"ApiKey\")\n        .withIndex(\"hashed_key\", (q) => q.eq(\"hashedKey\", args.hashedKey!))\n        .first();\n    }\n    if (args.id === undefined) return null;\n    return await ctx.db.get(\"ApiKey\", args.id);\n  },\n});\n\n/** List API keys, paginated, with optional `where` filters and ordering. */\nexport const list = query({\n  args: {\n    where: v.optional(\n      v.object({\n        userId: v.optional(v.id(\"User\")),\n        revoked: v.optional(v.boolean()),\n        name: v.optional(v.string()),\n        prefix: v.optional(v.string()),\n      }),\n    ),\n    paginationOpts: paginationOptsValidator,\n    orderBy: v.optional(\n      v.union(\n        v.literal(\"_creationTime\"),\n        v.literal(\"name\"),\n        v.literal(\"lastUsedAt\"),\n        v.literal(\"expiresAt\"),\n        v.literal(\"revoked\"),\n      ),\n    ),\n    order: v.optional(v.union(v.literal(\"asc\"), v.literal(\"desc\"))),\n  },\n  returns: vPaginated(vApiKeyDoc),\n  handler: async (ctx, args) => {\n    const where = args.where ?? {};\n    const order = args.order ?? \"desc\";\n\n    const base = stream(ctx.db, schema).query(\"ApiKey\");\n    let q;\n    if (where.userId !== undefined) {\n      q = base.withIndex(\"user_id\", (idx) => idx.eq(\"userId\", where.userId!));\n    } else {\n      q = base;\n    }\n\n    return await q\n      .order(order)\n      .filterWith(\n        async (d) =>\n          (where.revoked === undefined || d.revoked === where.revoked) &&\n          (where.name === undefined || d.name === where.name) &&\n          (where.prefix === undefined || d.prefix === where.prefix),\n      )\n      .paginate(args.paginationOpts);\n  },\n});\n\n/** Insert a new API key (stamped `createdAt`, `revoked: false`). */\nexport const create = mutation({\n  args: {\n    userId: v.id(\"User\"),\n    prefix: v.string(),\n    hashedKey: v.string(),\n    name: v.string(),\n    scopes: v.array(\n      v.object({\n        resource: v.string(),\n        actions: v.array(v.string()),\n      }),\n    ),\n    rateLimit: v.optional(vApiKeyRateLimit),\n    expiresAt: v.optional(v.number()),\n    extend: v.optional(v.any()),\n  },\n  returns: v.id(\"ApiKey\"),\n  handler: async (ctx, args) => {\n    assertValidRateLimit(args.rateLimit);\n    return await ctx.db.insert(\"ApiKey\", {\n      ...args,\n      createdAt: Date.now(),\n      revoked: false,\n    });\n  },\n});\n\n/** Patch fields on an API key; throws `KEY_NOT_FOUND` if it does not exist. */\nexport const update = mutation({\n  args: {\n    id: v.id(\"ApiKey\"),\n    patch: v.object({\n      name: v.optional(v.string()),\n      scopes: v.optional(v.array(vApiKeyScope)),\n      rateLimit: v.optional(vApiKeyRateLimit),\n      revoked: v.optional(v.boolean()),\n    }),\n  },\n  returns: v.null(),\n  handler: async (ctx, { id: keyId, patch }) => {\n    assertValidRateLimit(patch.rateLimit);\n    const key = await ctx.db.get(\"ApiKey\", keyId);\n    if (key === null) {\n      throw new ConvexError({\n        code: ErrorCode.KEY_NOT_FOUND,\n        message: \"API key not found\",\n        keyId,\n      });\n    }\n    await ctx.db.patch(\"ApiKey\", keyId, patch);\n    return null;\n  },\n});\n\n/**\n * Atomically enforce an API key's rate limit and refresh `lastUsedAt`, folding\n * the read → check → decrement of the token bucket into a SINGLE transaction on\n * the `ApiKey` row.\n *\n * The facade previously split that read (`key.get`) from the decrement\n * (`key.update`) across two transactions, so two concurrent verifications could\n * both read the same starting `rateLimitState`, both decide \"not limited\", and\n * both persist a decrement of the *same* state — the true atomic decrement was\n * lost and a burst could slip past the limit. Performing the whole\n * check-and-decrement here closes that window: the row's transaction serializes\n * concurrent callers, so each consumes its own token.\n *\n * The verification decision is made from the same transactional snapshot as\n * the rate-limit update. In particular, the mutation re-checks deletion,\n * revocation, expiration, and the current scopes instead of trusting the\n * facade's earlier hash lookup. A successful result returns the current owner\n * and scopes so a concurrent scope reduction cannot authenticate with stale\n * permissions.\n *\n * Returns `{ status: \"limited\" }` WITHOUT writing when the bucket is empty\n * (mirroring the facade's prior behavior of throwing before its update on the\n * limited branch); otherwise decrements the bucket (when configured) and\n * refreshes `lastUsedAt`. The token bucket refills linearly over the configured\n * window (the same algorithm as sign-in rate limiting); the math is inlined\n * here because component code cannot import from the server bundle.\n *\n * `lastUsedAt` is coarsened by the optional `coarsenMs` window: it is only\n * rewritten when unset or older than the window, so read-only bearer traffic on\n * a hot key stays read-only (no per-request write). When a rate-limit decrement\n * forces a write anyway, a fresh `lastUsedAt` is simply left as-is. Omitting\n * `coarsenMs` (or passing `0`) disables coarsening and refreshes every call.\n */\nexport const recordUse = mutation({\n  args: { id: v.id(\"ApiKey\"), coarsenMs: v.optional(v.number()) },\n  returns: v.union(\n    v.object({ status: v.literal(\"invalid\") }),\n    v.object({ status: v.literal(\"revoked\") }),\n    v.object({ status: v.literal(\"expired\") }),\n    v.object({ status: v.literal(\"limited\") }),\n    v.object({\n      status: v.literal(\"verified\"),\n      keyId: v.id(\"ApiKey\"),\n      userId: v.id(\"User\"),\n      scopes: v.array(vApiKeyScope),\n    }),\n  ),\n  handler: async (ctx, { id: keyId, coarsenMs }) => {\n    // Use the mutation's trusted transaction clock for validity and bucket math.\n    const now = Date.now();\n    const key = await ctx.db.get(\"ApiKey\", keyId);\n    if (key === null) {\n      return { status: \"invalid\" as const };\n    }\n    if (key.revoked) {\n      return { status: \"revoked\" as const };\n    }\n    if (key.expiresAt !== undefined && key.expiresAt < now) {\n      return { status: \"expired\" as const };\n    }\n    const patch: ApiKeyUsePatch = {};\n    if (key.rateLimit) {\n      const state = key.rateLimitState;\n      if (!state) {\n        patch.rateLimitState = {\n          attemptsLeft: key.rateLimit.maxRequests - 1,\n          lastAttemptTime: now,\n        };\n      } else {\n        const elapsed = Math.max(0, now - state.lastAttemptTime);\n        const refillRate = key.rateLimit.maxRequests / key.rateLimit.windowMs;\n        const refilled = Math.min(\n          key.rateLimit.maxRequests,\n          state.attemptsLeft + elapsed * refillRate,\n        );\n        if (refilled < 1) {\n          // Bucket empty: reject WITHOUT writing (matches the prior facade,\n          // which threw before its single `update`, leaving state untouched).\n          return { status: \"limited\" as const };\n        }\n        patch.rateLimitState = { attemptsLeft: refilled - 1, lastAttemptTime: now };\n      }\n    }\n    // Coarsen the `lastUsedAt` touch: only stamp it when unset or older than the\n    // caller's sampling window. With `coarsenMs` unset/0 the window is 0, so it\n    // refreshes every call.\n    const window = coarsenMs ?? 0;\n    const lastUsedAt = typeof key.lastUsedAt === \"number\" ? key.lastUsedAt : 0;\n    if (now - lastUsedAt >= window) {\n      patch.lastUsedAt = now;\n    }\n    // Nothing to persist — no rate-limit decrement and `lastUsedAt` still fresh:\n    // the hot path stays read-only.\n    if (patch.rateLimitState === undefined && patch.lastUsedAt === undefined) {\n      return {\n        status: \"verified\" as const,\n        keyId: key._id,\n        userId: key.userId,\n        scopes: key.scopes,\n      };\n    }\n    await ctx.db.patch(\"ApiKey\", keyId, patch);\n    return {\n      status: \"verified\" as const,\n      keyId: key._id,\n      userId: key.userId,\n      scopes: key.scopes,\n    };\n  },\n});\n\n/**\n * Atomically revoke an active API key and create its replacement.\n *\n * The caller pre-generates the replacement secret and passes only its hash and\n * display prefix. Reading the old row, validating its state, revoking it, and\n * inserting the replacement happen in one transaction, so concurrent rotations\n * cannot both mint a usable successor and an insert failure cannot strand the\n * caller with a revoked key and no replacement.\n */\nexport const rotate = mutation({\n  args: {\n    id: v.id(\"ApiKey\"),\n    prefix: v.string(),\n    hashedKey: v.string(),\n    name: v.optional(v.string()),\n    expiresAt: v.optional(v.number()),\n  },\n  returns: v.union(\n    v.object({ status: v.literal(\"invalid\") }),\n    v.object({ status: v.literal(\"revoked\") }),\n    v.object({ status: v.literal(\"invalid_rate_limit\") }),\n    v.object({\n      status: v.literal(\"rotated\"),\n      id: v.id(\"ApiKey\"),\n      userId: v.id(\"User\"),\n      name: v.string(),\n    }),\n  ),\n  handler: async (ctx, args) => {\n    const existing = await ctx.db.get(\"ApiKey\", args.id);\n    if (existing === null) {\n      return { status: \"invalid\" as const };\n    }\n    if (existing.revoked) {\n      return { status: \"revoked\" as const };\n    }\n    if (existing.rateLimit !== undefined && !isValidRateLimit(existing.rateLimit)) {\n      return { status: \"invalid_rate_limit\" as const };\n    }\n\n    const name = args.name ?? existing.name;\n    await ctx.db.patch(\"ApiKey\", existing._id, { revoked: true });\n    const id = await ctx.db.insert(\"ApiKey\", {\n      userId: existing.userId,\n      prefix: args.prefix,\n      hashedKey: args.hashedKey,\n      name,\n      scopes: existing.scopes,\n      rateLimit: existing.rateLimit,\n      expiresAt: args.expiresAt,\n      createdAt: Date.now(),\n      revoked: false,\n      extend: existing.extend,\n    });\n    return {\n      status: \"rotated\" as const,\n      id,\n      userId: existing.userId,\n      name,\n    };\n  },\n});\n\n/** Delete an API key; throws `KEY_NOT_FOUND` if it does not exist. */\nconst remove = mutation({\n  args: { id: v.id(\"ApiKey\") },\n  returns: v.null(),\n  handler: async (ctx, { id: keyId }) => {\n    const key = await ctx.db.get(\"ApiKey\", keyId);\n    if (key === null) {\n      throw new ConvexError({\n        code: ErrorCode.KEY_NOT_FOUND,\n        message: \"API key not found\",\n        keyId,\n      });\n    }\n    await ctx.db.delete(\"ApiKey\", keyId);\n    return null;\n  },\n});\n\nexport { remove };\n"],"mappings":";;;;;;;;;;;;;;;;;;AAyBA,SAAS,iBAAiB,WAAqC;AAC7D,QACE,OAAO,cAAc,UAAU,YAAY,IAC3C,UAAU,cAAc,KACxB,OAAO,SAAS,UAAU,SAAS,IACnC,UAAU,WAAW;;AAIzB,SAAS,qBAAqB,WAA8C;AAC1E,KAAI,cAAc,UAAa,CAAC,iBAAiB,UAAU,CACzD,OAAM,IAAI,YAAY;EACpB,MAAM,UAAU;EAChB,SACE;EACH,CAAC;;;;;;AAQN,MAAa,MAAM,MAAM;CACvB,MAAM;EACJ,IAAI,EAAE,SAAS,EAAE,GAAG,SAAS,CAAC;EAC9B,WAAW,EAAE,SAAS,EAAE,QAAQ,CAAC;EAClC;CACD,SAAS,EAAE,MAAM,YAAY,EAAE,MAAM,CAAC;CACtC,SAAS,OAAO,KAAK,SAAS;AAC5B,MAAI,KAAK,cAAc,OACrB,QAAO,MAAM,IAAI,GACd,MAAM,SAAS,CACf,UAAU,eAAe,MAAM,EAAE,GAAG,aAAa,KAAK,UAAW,CAAC,CAClE,OAAO;AAEZ,MAAI,KAAK,OAAO,OAAW,QAAO;AAClC,SAAO,MAAM,IAAI,GAAG,IAAI,UAAU,KAAK,GAAG;;CAE7C,CAAC;;AAGF,MAAa,OAAO,MAAM;CACxB,MAAM;EACJ,OAAO,EAAE,SACP,EAAE,OAAO;GACP,QAAQ,EAAE,SAAS,EAAE,GAAG,OAAO,CAAC;GAChC,SAAS,EAAE,SAAS,EAAE,SAAS,CAAC;GAChC,MAAM,EAAE,SAAS,EAAE,QAAQ,CAAC;GAC5B,QAAQ,EAAE,SAAS,EAAE,QAAQ,CAAC;GAC/B,CAAC,CACH;EACD,gBAAgB;EAChB,SAAS,EAAE,SACT,EAAE,MACA,EAAE,QAAQ,gBAAgB,EAC1B,EAAE,QAAQ,OAAO,EACjB,EAAE,QAAQ,aAAa,EACvB,EAAE,QAAQ,YAAY,EACtB,EAAE,QAAQ,UAAU,CACrB,CACF;EACD,OAAO,EAAE,SAAS,EAAE,MAAM,EAAE,QAAQ,MAAM,EAAE,EAAE,QAAQ,OAAO,CAAC,CAAC;EAChE;CACD,SAAS,WAAW,WAAW;CAC/B,SAAS,OAAO,KAAK,SAAS;EAC5B,MAAM,QAAQ,KAAK,SAAS,EAAE;EAC9B,MAAM,QAAQ,KAAK,SAAS;EAE5B,MAAM,OAAO,OAAO,IAAI,IAAIA,eAAO,CAAC,MAAM,SAAS;EACnD,IAAI;AACJ,MAAI,MAAM,WAAW,OACnB,KAAI,KAAK,UAAU,YAAY,QAAQ,IAAI,GAAG,UAAU,MAAM,OAAQ,CAAC;MAEvE,KAAI;AAGN,SAAO,MAAM,EACV,MAAM,MAAM,CACZ,WACC,OAAO,OACJ,MAAM,YAAY,UAAa,EAAE,YAAY,MAAM,aACnD,MAAM,SAAS,UAAa,EAAE,SAAS,MAAM,UAC7C,MAAM,WAAW,UAAa,EAAE,WAAW,MAAM,QACrD,CACA,SAAS,KAAK,eAAe;;CAEnC,CAAC;;AAGF,MAAa,SAAS,SAAS;CAC7B,MAAM;EACJ,QAAQ,EAAE,GAAG,OAAO;EACpB,QAAQ,EAAE,QAAQ;EAClB,WAAW,EAAE,QAAQ;EACrB,MAAM,EAAE,QAAQ;EAChB,QAAQ,EAAE,MACR,EAAE,OAAO;GACP,UAAU,EAAE,QAAQ;GACpB,SAAS,EAAE,MAAM,EAAE,QAAQ,CAAC;GAC7B,CAAC,CACH;EACD,WAAW,EAAE,SAAS,iBAAiB;EACvC,WAAW,EAAE,SAAS,EAAE,QAAQ,CAAC;EACjC,QAAQ,EAAE,SAAS,EAAE,KAAK,CAAC;EAC5B;CACD,SAAS,EAAE,GAAG,SAAS;CACvB,SAAS,OAAO,KAAK,SAAS;AAC5B,uBAAqB,KAAK,UAAU;AACpC,SAAO,MAAM,IAAI,GAAG,OAAO,UAAU;GACnC,GAAG;GACH,WAAW,KAAK,KAAK;GACrB,SAAS;GACV,CAAC;;CAEL,CAAC;;AAGF,MAAa,SAAS,SAAS;CAC7B,MAAM;EACJ,IAAI,EAAE,GAAG,SAAS;EAClB,OAAO,EAAE,OAAO;GACd,MAAM,EAAE,SAAS,EAAE,QAAQ,CAAC;GAC5B,QAAQ,EAAE,SAAS,EAAE,MAAM,aAAa,CAAC;GACzC,WAAW,EAAE,SAAS,iBAAiB;GACvC,SAAS,EAAE,SAAS,EAAE,SAAS,CAAC;GACjC,CAAC;EACH;CACD,SAAS,EAAE,MAAM;CACjB,SAAS,OAAO,KAAK,EAAE,IAAI,OAAO,YAAY;AAC5C,uBAAqB,MAAM,UAAU;AAErC,MADY,MAAM,IAAI,GAAG,IAAI,UAAU,MAAM,KACjC,KACV,OAAM,IAAI,YAAY;GACpB,MAAM,UAAU;GAChB,SAAS;GACT;GACD,CAAC;AAEJ,QAAM,IAAI,GAAG,MAAM,UAAU,OAAO,MAAM;AAC1C,SAAO;;CAEV,CAAC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAmCF,MAAa,YAAY,SAAS;CAChC,MAAM;EAAE,IAAI,EAAE,GAAG,SAAS;EAAE,WAAW,EAAE,SAAS,EAAE,QAAQ,CAAC;EAAE;CAC/D,SAAS,EAAE,MACT,EAAE,OAAO,EAAE,QAAQ,EAAE,QAAQ,UAAU,EAAE,CAAC,EAC1C,EAAE,OAAO,EAAE,QAAQ,EAAE,QAAQ,UAAU,EAAE,CAAC,EAC1C,EAAE,OAAO,EAAE,QAAQ,EAAE,QAAQ,UAAU,EAAE,CAAC,EAC1C,EAAE,OAAO,EAAE,QAAQ,EAAE,QAAQ,UAAU,EAAE,CAAC,EAC1C,EAAE,OAAO;EACP,QAAQ,EAAE,QAAQ,WAAW;EAC7B,OAAO,EAAE,GAAG,SAAS;EACrB,QAAQ,EAAE,GAAG,OAAO;EACpB,QAAQ,EAAE,MAAM,aAAa;EAC9B,CAAC,CACH;CACD,SAAS,OAAO,KAAK,EAAE,IAAI,OAAO,gBAAgB;EAEhD,MAAM,MAAM,KAAK,KAAK;EACtB,MAAM,MAAM,MAAM,IAAI,GAAG,IAAI,UAAU,MAAM;AAC7C,MAAI,QAAQ,KACV,QAAO,EAAE,QAAQ,WAAoB;AAEvC,MAAI,IAAI,QACN,QAAO,EAAE,QAAQ,WAAoB;AAEvC,MAAI,IAAI,cAAc,UAAa,IAAI,YAAY,IACjD,QAAO,EAAE,QAAQ,WAAoB;EAEvC,MAAM,QAAwB,EAAE;AAChC,MAAI,IAAI,WAAW;GACjB,MAAM,QAAQ,IAAI;AAClB,OAAI,CAAC,MACH,OAAM,iBAAiB;IACrB,cAAc,IAAI,UAAU,cAAc;IAC1C,iBAAiB;IAClB;QACI;IACL,MAAM,UAAU,KAAK,IAAI,GAAG,MAAM,MAAM,gBAAgB;IACxD,MAAM,aAAa,IAAI,UAAU,cAAc,IAAI,UAAU;IAC7D,MAAM,WAAW,KAAK,IACpB,IAAI,UAAU,aACd,MAAM,eAAe,UAAU,WAChC;AACD,QAAI,WAAW,EAGb,QAAO,EAAE,QAAQ,WAAoB;AAEvC,UAAM,iBAAiB;KAAE,cAAc,WAAW;KAAG,iBAAiB;KAAK;;;EAM/E,MAAM,SAAS,aAAa;AAE5B,MAAI,OADe,OAAO,IAAI,eAAe,WAAW,IAAI,aAAa,MACjD,OACtB,OAAM,aAAa;AAIrB,MAAI,MAAM,mBAAmB,UAAa,MAAM,eAAe,OAC7D,QAAO;GACL,QAAQ;GACR,OAAO,IAAI;GACX,QAAQ,IAAI;GACZ,QAAQ,IAAI;GACb;AAEH,QAAM,IAAI,GAAG,MAAM,UAAU,OAAO,MAAM;AAC1C,SAAO;GACL,QAAQ;GACR,OAAO,IAAI;GACX,QAAQ,IAAI;GACZ,QAAQ,IAAI;GACb;;CAEJ,CAAC;;;;;;;;;;AAWF,MAAa,SAAS,SAAS;CAC7B,MAAM;EACJ,IAAI,EAAE,GAAG,SAAS;EAClB,QAAQ,EAAE,QAAQ;EAClB,WAAW,EAAE,QAAQ;EACrB,MAAM,EAAE,SAAS,EAAE,QAAQ,CAAC;EAC5B,WAAW,EAAE,SAAS,EAAE,QAAQ,CAAC;EAClC;CACD,SAAS,EAAE,MACT,EAAE,OAAO,EAAE,QAAQ,EAAE,QAAQ,UAAU,EAAE,CAAC,EAC1C,EAAE,OAAO,EAAE,QAAQ,EAAE,QAAQ,UAAU,EAAE,CAAC,EAC1C,EAAE,OAAO,EAAE,QAAQ,EAAE,QAAQ,qBAAqB,EAAE,CAAC,EACrD,EAAE,OAAO;EACP,QAAQ,EAAE,QAAQ,UAAU;EAC5B,IAAI,EAAE,GAAG,SAAS;EAClB,QAAQ,EAAE,GAAG,OAAO;EACpB,MAAM,EAAE,QAAQ;EACjB,CAAC,CACH;CACD,SAAS,OAAO,KAAK,SAAS;EAC5B,MAAM,WAAW,MAAM,IAAI,GAAG,IAAI,UAAU,KAAK,GAAG;AACpD,MAAI,aAAa,KACf,QAAO,EAAE,QAAQ,WAAoB;AAEvC,MAAI,SAAS,QACX,QAAO,EAAE,QAAQ,WAAoB;AAEvC,MAAI,SAAS,cAAc,UAAa,CAAC,iBAAiB,SAAS,UAAU,CAC3E,QAAO,EAAE,QAAQ,sBAA+B;EAGlD,MAAM,OAAO,KAAK,QAAQ,SAAS;AACnC,QAAM,IAAI,GAAG,MAAM,UAAU,SAAS,KAAK,EAAE,SAAS,MAAM,CAAC;AAa7D,SAAO;GACL,QAAQ;GACR,IAdS,MAAM,IAAI,GAAG,OAAO,UAAU;IACvC,QAAQ,SAAS;IACjB,QAAQ,KAAK;IACb,WAAW,KAAK;IAChB;IACA,QAAQ,SAAS;IACjB,WAAW,SAAS;IACpB,WAAW,KAAK;IAChB,WAAW,KAAK,KAAK;IACrB,SAAS;IACT,QAAQ,SAAS;IAClB,CAAC;GAIA,QAAQ,SAAS;GACjB;GACD;;CAEJ,CAAC;;AAGF,MAAM,SAAS,SAAS;CACtB,MAAM,EAAE,IAAI,EAAE,GAAG,SAAS,EAAE;CAC5B,SAAS,EAAE,MAAM;CACjB,SAAS,OAAO,KAAK,EAAE,IAAI,YAAY;AAErC,MADY,MAAM,IAAI,GAAG,IAAI,UAAU,MAAM,KACjC,KACV,OAAM,IAAI,YAAY;GACpB,MAAM,UAAU;GAChB,SAAS;GACT;GACD,CAAC;AAEJ,QAAM,IAAI,GAAG,OAAO,UAAU,MAAM;AACpC,SAAO;;CAEV,CAAC"}

package/dist/component/user.d.ts

@@ -1,5 +1,5 @@
-import * as convex_values2654 from "convex/values";
-import * as convex_server141 from "convex/server";
+import * as convex_values1665 from "convex/values";
+import * as convex_server115 from "convex/server";
 
 //#region src/component/user.d.ts
 declare namespace user_d_exports {
@@ -18,7 +18,7 @@ declare namespace user_d_exports {
  * selector:
  *
  * - `{ id }`           → `Doc<"User"> | null`
- * - `{ ids }`          → `(Doc<"User"> | null)[]` (order preserved, deduped)
+ * - `{ ids }`          → `(Doc<"User"> | null)[]` (order preserved, deduped; max 100 IDs)
  * - `{ verifiedEmail }`→ `Doc<"User"> | null` (exactly-one-or-null)
  * - `{ verifiedPhone }`→ `Doc<"User"> | null` (exactly-one-or-null)
  *
@@ -29,50 +29,52 @@ declare namespace user_d_exports {
  * await ctx.runQuery(component.user.get, { verifiedEmail: "a@b.com" });
  * ```
  */
-declare const get: convex_server141.RegisteredQuery<"public", {
+declare const get: convex_server115.RegisteredQuery<"public", {
+  id?: convex_values1665.GenericId<"User"> | undefined;
   verifiedEmail?: string | undefined;
-  id?: convex_values2654.GenericId<"User"> | undefined;
-  ids?: convex_values2654.GenericId<"User">[] | undefined;
+  ids?: convex_values1665.GenericId<"User">[] | undefined;
   verifiedPhone?: string | undefined;
 }, Promise<{
-  _id: convex_values2654.GenericId<"User">;
+  _id: convex_values1665.GenericId<"User">;
   _creationTime: number;
-  name?: string | undefined;
   email?: string | undefined;
-  image?: string | undefined;
   phone?: string | undefined;
+  extend?: any;
+  name?: string | undefined;
   firstName?: string | undefined;
   lastName?: string | undefined;
+  image?: string | undefined;
   emailVerificationTime?: number | undefined;
   phoneVerificationTime?: number | undefined;
   isAnonymous?: boolean | undefined;
-  lastActiveGroup?: convex_values2654.GenericId<"Group"> | undefined;
-  extend?: any;
+  lastActiveGroup?: convex_values1665.GenericId<"Group"> | undefined;
+  sessionEpoch: number;
 } | ({
-  _id: convex_values2654.GenericId<"User">;
+  _id: convex_values1665.GenericId<"User">;
   _creationTime: number;
-  name?: string | undefined;
   email?: string | undefined;
-  image?: string | undefined;
   phone?: string | undefined;
+  extend?: any;
+  name?: string | undefined;
   firstName?: string | undefined;
   lastName?: string | undefined;
+  image?: string | undefined;
   emailVerificationTime?: number | undefined;
   phoneVerificationTime?: number | undefined;
   isAnonymous?: boolean | undefined;
-  lastActiveGroup?: convex_values2654.GenericId<"Group"> | undefined;
-  extend?: any;
+  lastActiveGroup?: convex_values1665.GenericId<"Group"> | undefined;
+  sessionEpoch: number;
 } | null)[] | null>>;
 /** List users, paginated, with optional `where` filters and ordering. */
-declare const list: convex_server141.RegisteredQuery<"public", {
-  order?: "asc" | "desc" | undefined;
+declare const list: convex_server115.RegisteredQuery<"public", {
   where?: {
-    name?: string | undefined;
     email?: string | undefined;
     phone?: string | undefined;
+    name?: string | undefined;
     isAnonymous?: boolean | undefined;
   } | undefined;
-  orderBy?: "name" | "email" | "_creationTime" | "phone" | undefined;
+  orderBy?: "_creationTime" | "email" | "phone" | "name" | undefined;
+  order?: "asc" | "desc" | undefined;
   paginationOpts: {
     id?: number;
     endCursor?: string | null;
@@ -81,74 +83,76 @@ declare const list: convex_server141.RegisteredQuery<"public", {
     numItems: number;
     cursor: string | null;
   };
-}, Promise<convex_server141.PaginationResult<{
-  _id: convex_values2654.GenericId<"User">;
+}, Promise<convex_server115.PaginationResult<{
+  _id: convex_values1665.GenericId<"User">;
   _creationTime: number;
-  name?: string | undefined;
   email?: string | undefined;
-  image?: string | undefined;
   phone?: string | undefined;
+  extend?: any;
+  name?: string | undefined;
   firstName?: string | undefined;
   lastName?: string | undefined;
+  image?: string | undefined;
   emailVerificationTime?: number | undefined;
   phoneVerificationTime?: number | undefined;
   isAnonymous?: boolean | undefined;
-  lastActiveGroup?: convex_values2654.GenericId<"Group"> | undefined;
-  extend?: any;
+  lastActiveGroup?: convex_values1665.GenericId<"Group"> | undefined;
+  sessionEpoch: number;
 }>>>;
 /** Insert a new user. */
-declare const create: convex_server141.RegisteredMutation<"public", {
+declare const create: convex_server115.RegisteredMutation<"public", {
   data: {
-    name?: string | undefined;
     email?: string | undefined;
-    image?: string | undefined;
     phone?: string | undefined;
+    extend?: any;
+    name?: string | undefined;
     firstName?: string | undefined;
     lastName?: string | undefined;
+    image?: string | undefined;
     emailVerificationTime?: number | undefined;
     phoneVerificationTime?: number | undefined;
     isAnonymous?: boolean | undefined;
-    lastActiveGroup?: convex_values2654.GenericId<"Group"> | undefined;
-    extend?: any;
+    lastActiveGroup?: convex_values1665.GenericId<"Group"> | undefined;
   };
-}, Promise<convex_values2654.GenericId<"User">>>;
+}, Promise<convex_values1665.GenericId<"User">>>;
 /** Insert a user, or patch it when `id` is supplied. Returns the user id. */
-declare const upsert: convex_server141.RegisteredMutation<"public", {
-  id?: convex_values2654.GenericId<"User"> | undefined;
+declare const upsert: convex_server115.RegisteredMutation<"public", {
+  id?: convex_values1665.GenericId<"User"> | undefined;
   data: {
-    name?: string | undefined;
     email?: string | undefined;
-    image?: string | undefined;
     phone?: string | undefined;
+    extend?: any;
+    name?: string | undefined;
     firstName?: string | undefined;
     lastName?: string | undefined;
+    image?: string | undefined;
     emailVerificationTime?: number | undefined;
     phoneVerificationTime?: number | undefined;
     isAnonymous?: boolean | undefined;
-    lastActiveGroup?: convex_values2654.GenericId<"Group"> | undefined;
-    extend?: any;
+    lastActiveGroup?: convex_values1665.GenericId<"Group"> | undefined;
   };
-}, Promise<convex_values2654.GenericId<"User">>>;
+}, Promise<convex_values1665.GenericId<"User">>>;
 /** Patch fields on a user. */
-declare const update: convex_server141.RegisteredMutation<"public", {
-  id: convex_values2654.GenericId<"User">;
+declare const update: convex_server115.RegisteredMutation<"public", {
+  id: convex_values1665.GenericId<"User">;
   patch: {
-    name?: string | undefined;
     email?: string | undefined;
-    image?: string | undefined;
     phone?: string | undefined;
+    extend?: any;
+    name?: string | undefined;
     firstName?: string | undefined;
     lastName?: string | undefined;
+    image?: string | undefined;
     emailVerificationTime?: number | undefined;
     phoneVerificationTime?: number | undefined;
     isAnonymous?: boolean | undefined;
-    lastActiveGroup?: convex_values2654.GenericId<"Group"> | undefined;
-    extend?: any;
+    lastActiveGroup?: convex_values1665.GenericId<"Group"> | undefined;
+    sessionEpoch?: number | undefined;
   };
 }, Promise<null>>;
-/** Delete a user and all auth-owned child rows, bounded per table. */
-declare const remove: convex_server141.RegisteredMutation<"public", {
-  id: convex_values2654.GenericId<"User">;
+/** Delete a user and every auth-owned credential row in one bounded transaction. */
+declare const remove: convex_server115.RegisteredMutation<"public", {
+  id: convex_values1665.GenericId<"User">;
 }, Promise<null>>;
 //#endregion
 export { user_d_exports };

package/dist/component/user.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"user.d.ts","names":[],"sources":["../../src/component/user.ts"],"mappings":";;;;;;;;;;;;;;;;;;;;AA2CA;;;;;;;;;;;cAAa,GAAA,mBAAG,eAAA;;OAqCd,iBAAA,CAAA,SAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;cAGW,IAAA,mBAAI,eAAA;;;;;;;;;;;;;;;;;;OAsDf,iBAAA,CAAA,SAAA;;;;;;;;;;;;;;;cAGW,MAAA,mBAAM,kBAAA;;;;;;;;;;;sBAMjB,iBAAA,CAAA,SAAA;;;;;cAGW,MAAA,mBAAM,kBAAA;OAUjB,iBAAA,CAAA,SAAA;;;;;;;;;;;;;;;;cAGW,MAAA,mBAAM,kBAAA;MAOjB,iBAAA,CAAA,SAAA;;;;;;;;;;;;;;;;cAGI,MAAA,mBAAM,kBAAA;MAwFV,iBAAA,CAAA,SAAA;AAAA"}
+{"version":3,"file":"user.d.ts","names":[],"sources":["../../src/component/user.ts"],"mappings":";;;;;;;;;;;;;;;;;;;;AA2DA;;;;;;;;;;;cAAa,GAAA,mBAAG,eAAA;OAsCd,iBAAA,CAAA,SAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;cAGW,IAAA,mBAAI,eAAA;;;;;;;;;;;;;;;;;;OAsDf,iBAAA,CAAA,SAAA;;;;;;;;;;;;;;;;cAGW,MAAA,mBAAM,kBAAA;;;;;;;;;;;;sBAMjB,iBAAA,CAAA,SAAA;EAAA;AAAA;;cAGW,MAAA,mBAAM,kBAAA;OAUjB,iBAAA,CAAA,SAAA;;;;;;;;;;;;;;;;cAGW,MAAA,mBAAM,kBAAA;MAOjB,iBAAA,CAAA,SAAA;;;;;;;;;;;;;;;;;cAGI,MAAA,mBAAM,kBAAA;MA8RV,iBAAA,CAAA,SAAA;AAAA"}

package/dist/component/user.js

@@ -1,11 +1,11 @@
 import { ErrorCode } from "../shared/codes.js";
-import { vPaginated, vUserDoc } from "./model.js";
+import { vPaginated } from "./model.js";
 import schema_default from "./schema.js";
 import { mutation, query } from "./_generated/server.js";
-import "./functions.js";
+import { vUserDoc } from "./documents.js";
+import { assertBatchSelectorSize } from "./batch.js";
 import { ConvexError, v } from "convex/values";
 import { paginationOptsValidator } from "convex/server";
-import { partial } from "convex-helpers/validators";
 import { stream } from "convex-helpers/server/stream";
 
 //#region src/component/user.ts
@@ -16,17 +16,28 @@ import { stream } from "convex-helpers/server/stream";
 *
 * @module
 */
-const vUserInsertData = v.object(schema_default.tables.User.validator.fields);
-const vUserPatchData = v.object(partial(schema_default.tables.User.validator.fields));
-const CASCADE_MAX = 1e3;
-const tooMany = (count) => count > CASCADE_MAX;
+const vUserInsertData = schema_default.tables.User.validator.omit("sessionEpoch");
+const vUserPatchData = schema_default.tables.User.validator.partial();
+/**
+* Keep one complete user cascade within a single safe transaction.
+*/
+const CASCADE_MAX = 100;
+function assertCascadeSize(count) {
+	if (count > CASCADE_MAX) throw new ConvexError({
+		code: ErrorCode.CASCADE_TOO_LARGE,
+		message: `User cascade has more than ${CASCADE_MAX} dependent rows; delete child rows in bounded batches, then retry.`
+	});
+}
+function uniqueRows(rows) {
+	return Array.from(new Map(rows.map((row) => [row._id, row])).values());
+}
 /**
 * Read a user by identity. One overloaded function (single Convex
 * function with a unioned `args`/`returns`). Accepts exactly one
 * selector:
 *
 * - `{ id }`           → `Doc<"User"> | null`
-* - `{ ids }`          → `(Doc<"User"> | null)[]` (order preserved, deduped)
+* - `{ ids }`          → `(Doc<"User"> | null)[]` (order preserved, deduped; max 100 IDs)
 * - `{ verifiedEmail }`→ `Doc<"User"> | null` (exactly-one-or-null)
 * - `{ verifiedPhone }`→ `Doc<"User"> | null` (exactly-one-or-null)
 *
@@ -39,14 +50,15 @@ const tooMany = (count) => count > CASCADE_MAX;
 */
 const get = query({
 	args: {
-		id: v.optional(v.id("User")),
-		ids: v.optional(v.array(v.id("User"))),
+		id: v.optional(schema_default.id("User")),
+		ids: v.optional(v.array(schema_default.id("User"))),
 		verifiedEmail: v.optional(v.string()),
 		verifiedPhone: v.optional(v.string())
 	},
 	returns: v.union(vUserDoc, v.null(), v.array(v.union(vUserDoc, v.null()))),
 	handler: async (ctx, args) => {
 		if (args.ids !== void 0) {
+			assertBatchSelectorSize(args.ids, "ids");
 			if (args.ids.length === 0) return [];
 			const unique = Array.from(new Set(args.ids));
 			const docs = await Promise.all(unique.map((id) => ctx.db.get("User", id)));
@@ -94,30 +106,36 @@ const list = query({
 /** Insert a new user. */
 const create = mutation({
 	args: { data: vUserInsertData },
-	returns: v.id("User"),
+	returns: schema_default.id("User"),
 	handler: async (ctx, { data }) => {
-		return await ctx.db.insert("User", data);
+		return await ctx.db.insert("User", {
+			...data,
+			sessionEpoch: 0
+		});
 	}
 });
 /** Insert a user, or patch it when `id` is supplied. Returns the user id. */
 const upsert = mutation({
 	args: {
-		id: v.optional(v.id("User")),
+		id: v.optional(schema_default.id("User")),
 		data: vUserInsertData
 	},
-	returns: v.id("User"),
+	returns: schema_default.id("User"),
 	handler: async (ctx, { id, data }) => {
 		if (id !== void 0) {
 			await ctx.db.patch("User", id, data);
 			return id;
 		}
-		return await ctx.db.insert("User", data);
+		return await ctx.db.insert("User", {
+			...data,
+			sessionEpoch: 0
+		});
 	}
 });
 /** Patch fields on a user. */
 const update = mutation({
 	args: {
-		id: v.id("User"),
+		id: schema_default.id("User"),
 		patch: vUserPatchData
 	},
 	returns: v.null(),
@@ -126,29 +144,122 @@ const update = mutation({
 		return null;
 	}
 });
-/** Delete a user and all auth-owned child rows, bounded per table. */
+/** Delete a user and every auth-owned credential row in one bounded transaction. */
 const remove = mutation({
-	args: { id: v.id("User") },
+	args: { id: schema_default.id("User") },
 	returns: v.null(),
 	handler: async (ctx, { id: userId }) => {
 		if (await ctx.db.get("User", userId) === null) return null;
-		const [sessions, accounts, keys, members, passkeys, totps] = await Promise.all([
+		const [sessions, accounts, keys, members, passkeys, totps, emails, devicesByUser, scimIdentities, continuations, oauthCodesByUser, oauthGrantsByUser, oauthClients, invitesByAuthor, invitesByAcceptor, webhooks] = await Promise.all([
 			ctx.db.query("Session").withIndex("user_id", (q) => q.eq("userId", userId)).take(CASCADE_MAX + 1),
 			ctx.db.query("Account").withIndex("user_id_provider", (q) => q.eq("userId", userId)).take(CASCADE_MAX + 1),
 			ctx.db.query("ApiKey").withIndex("user_id", (q) => q.eq("userId", userId)).take(CASCADE_MAX + 1),
 			ctx.db.query("GroupMember").withIndex("user_id", (q) => q.eq("userId", userId)).take(CASCADE_MAX + 1),
 			ctx.db.query("Passkey").withIndex("user_id", (q) => q.eq("userId", userId)).take(CASCADE_MAX + 1),
-			ctx.db.query("TotpFactor").withIndex("user_id", (q) => q.eq("userId", userId)).take(CASCADE_MAX + 1)
+			ctx.db.query("TotpFactor").withIndex("user_id", (q) => q.eq("userId", userId)).take(CASCADE_MAX + 1),
+			ctx.db.query("UserEmail").withIndex("user_id", (q) => q.eq("userId", userId)).take(CASCADE_MAX + 1),
+			ctx.db.query("DeviceCode").withIndex("user_id", (q) => q.eq("userId", userId)).take(CASCADE_MAX + 1),
+			ctx.db.query("GroupConnectionScimIdentity").withIndex("user_id", (q) => q.eq("userId", userId)).take(CASCADE_MAX + 1),
+			ctx.db.query("AuthContinuation").withIndex("user_id_provider_operation_expiration_time", (q) => q.eq("subject.userId", userId)).take(CASCADE_MAX + 1),
+			ctx.db.query("OAuthCode").withIndex("user_id", (q) => q.eq("userId", userId)).take(CASCADE_MAX + 1),
+			ctx.db.query("OAuthRefreshGrant").withIndex("user_id", (q) => q.eq("userId", userId)).take(CASCADE_MAX + 1),
+			ctx.db.query("OAuthClient").withIndex("created_by", (q) => q.eq("createdBy", userId)).take(CASCADE_MAX + 1),
+			ctx.db.query("GroupInvite").withIndex("invited_by_user_id_status", (q) => q.eq("invitedByUserId", userId)).take(CASCADE_MAX + 1),
+			ctx.db.query("GroupInvite").withIndex("accepted_by_user_id", (q) => q.eq("acceptedByUserId", userId)).take(CASCADE_MAX + 1),
+			ctx.db.query("GroupWebhookEndpoint").withIndex("created_by_user_id", (q) => q.eq("createdByUserId", userId)).take(CASCADE_MAX + 1)
 		]);
-		if (tooMany(sessions.length) || tooMany(accounts.length) || tooMany(keys.length) || tooMany(members.length) || tooMany(passkeys.length) || tooMany(totps.length)) throw new ConvexError({
-			code: ErrorCode.CASCADE_TOO_LARGE,
-			message: `User has more than ${CASCADE_MAX} child rows in one or more tables; cascade delete is not safe in a single mutation. Delete child rows in bounded batches, then retry.`
-		});
-		const refreshTokens = sessions.length > 0 ? (await Promise.all(sessions.map((s) => ctx.db.query("RefreshToken").withIndex("session_id", (q) => q.eq("sessionId", s._id)).take(CASCADE_MAX + 1)))).flat() : [];
-		if (tooMany(refreshTokens.length)) throw new ConvexError({
-			code: ErrorCode.CASCADE_TOO_LARGE,
-			message: `User has more than ${CASCADE_MAX} refresh tokens across sessions; cascade delete is not safe in a single mutation.`
-		});
+		assertCascadeSize([
+			...sessions,
+			...accounts,
+			...keys,
+			...members,
+			...passkeys,
+			...totps,
+			...emails,
+			...devicesByUser,
+			...scimIdentities,
+			...continuations,
+			...oauthCodesByUser,
+			...oauthGrantsByUser,
+			...oauthClients,
+			...invitesByAuthor,
+			...invitesByAcceptor,
+			...webhooks
+		].length);
+		let remaining = CASCADE_MAX - [
+			...sessions,
+			...accounts,
+			...keys,
+			...members,
+			...passkeys,
+			...totps,
+			...emails,
+			...devicesByUser,
+			...scimIdentities,
+			...continuations,
+			...oauthCodesByUser,
+			...oauthGrantsByUser,
+			...oauthClients,
+			...invitesByAuthor,
+			...invitesByAcceptor,
+			...webhooks
+		].length;
+		async function collect(read) {
+			const rows = await read(remaining + 1);
+			if (rows.length > remaining) assertCascadeSize(CASCADE_MAX + 1);
+			remaining -= rows.length;
+			return rows;
+		}
+		const refreshTokens = [];
+		const devicesBySession = [];
+		const verificationCodes = [];
+		const resetsByAccount = [];
+		const resetsByContinuation = [];
+		const verifiersBySession = [];
+		const verifiersByContinuation = [];
+		for (const session of sessions) {
+			refreshTokens.push(...await collect((limit) => ctx.db.query("RefreshToken").withIndex("session_id", (q) => q.eq("sessionId", session._id)).take(limit)));
+			devicesBySession.push(...await collect((limit) => ctx.db.query("DeviceCode").withIndex("session_id", (q) => q.eq("sessionId", session._id)).take(limit)));
+			verifiersBySession.push(...await collect((limit) => ctx.db.query("AuthVerifier").withIndex("session_id", (q) => q.eq("sessionId", session._id)).take(limit)));
+		}
+		for (const account of accounts) {
+			verificationCodes.push(...await collect((limit) => ctx.db.query("VerificationCode").withIndex("account_id", (q) => q.eq("accountId", account._id)).take(limit)));
+			resetsByAccount.push(...await collect((limit) => ctx.db.query("PasswordReset").withIndex("account_id", (q) => q.eq("accountId", account._id)).take(limit)));
+		}
+		for (const continuation of continuations) {
+			resetsByContinuation.push(...await collect((limit) => ctx.db.query("PasswordReset").withIndex("continuation_id", (q) => q.eq("continuationId", continuation._id)).take(limit)));
+			verifiersByContinuation.push(...await collect((limit) => ctx.db.query("AuthVerifier").withIndex("continuation_id", (q) => q.eq("continuationId", continuation._id)).take(limit)));
+		}
+		const grants = oauthGrantsByUser;
+		const oauthTokens = [];
+		for (const grant of grants) oauthTokens.push(...await collect((limit) => ctx.db.query("OAuthRefreshToken").withIndex("grant_id", (q) => q.eq("grantId", grant._id)).take(limit)));
+		const devices = uniqueRows([...devicesByUser, ...devicesBySession]);
+		const resets = uniqueRows([...resetsByAccount, ...resetsByContinuation]);
+		const verifiers = uniqueRows([...verifiersBySession, ...verifiersByContinuation]);
+		const oauthCodes = oauthCodesByUser;
+		const invites = uniqueRows([...invitesByAuthor, ...invitesByAcceptor]);
+		assertCascadeSize([
+			...sessions,
+			...accounts,
+			...keys,
+			...members,
+			...passkeys,
+			...totps,
+			...emails,
+			...devices,
+			...scimIdentities,
+			...continuations,
+			...oauthCodes,
+			...grants,
+			...oauthClients,
+			...invites,
+			...webhooks,
+			...refreshTokens,
+			...verificationCodes,
+			...resets,
+			...verifiers,
+			...oauthTokens
+		].length);
 		await Promise.all([
 			...sessions.map((s) => ctx.db.delete("Session", s._id)),
 			...refreshTokens.map((r) => ctx.db.delete("RefreshToken", r._id)),
@@ -156,14 +267,24 @@ const remove = mutation({
 			...keys.map((k) => ctx.db.delete("ApiKey", k._id)),
 			...members.map((m) => ctx.db.delete("GroupMember", m._id)),
 			...passkeys.map((p) => ctx.db.delete("Passkey", p._id)),
-			...totps.map((t) => ctx.db.delete("TotpFactor", t._id))
+			...totps.map((t) => ctx.db.delete("TotpFactor", t._id)),
+			...emails.map((email) => ctx.db.delete("UserEmail", email._id)),
+			...devices.map((device) => ctx.db.delete("DeviceCode", device._id)),
+			...scimIdentities.map((identity) => ctx.db.delete("GroupConnectionScimIdentity", identity._id)),
+			...continuations.map((continuation) => ctx.db.delete("AuthContinuation", continuation._id)),
+			...oauthCodes.map((code) => ctx.db.delete("OAuthCode", code._id)),
+			...grants.map((grant) => ctx.db.delete("OAuthRefreshGrant", grant._id)),
+			...oauthTokens.map((token) => ctx.db.delete("OAuthRefreshToken", token._id)),
+			...verificationCodes.map((code) => ctx.db.delete("VerificationCode", code._id)),
+			...resets.map((reset) => ctx.db.delete("PasswordReset", reset._id)),
+			...verifiers.map((verifier) => ctx.db.delete("AuthVerifier", verifier._id)),
+			...oauthClients.map((client) => ctx.db.patch("OAuthClient", client._id, { createdBy: void 0 })),
+			...invites.map((invite) => ctx.db.patch("GroupInvite", invite._id, {
+				invitedByUserId: invite.invitedByUserId === userId ? void 0 : invite.invitedByUserId,
+				acceptedByUserId: invite.acceptedByUserId === userId ? void 0 : invite.acceptedByUserId
+			})),
+			...webhooks.map((webhook) => ctx.db.patch("GroupWebhookEndpoint", webhook._id, { createdByUserId: void 0 }))
 		]);
-		const ownedEmails = await ctx.db.query("UserEmail").withIndex("user_id", (q) => q.eq("userId", userId)).take(CASCADE_MAX + 1);
-		if (tooMany(ownedEmails.length)) throw new ConvexError({
-			code: ErrorCode.CASCADE_TOO_LARGE,
-			message: `User has more than ${CASCADE_MAX} emails; cascade delete is not safe in a single mutation.`
-		});
-		await Promise.all(ownedEmails.map((e) => ctx.db.delete("UserEmail", e._id)));
 		await ctx.db.delete("User", userId);
 		return null;
 	}