@estifanos-sh/convex-auth 0.0.2 → 0.0.4

package/dist/server/http.js

@@ -1,5 +1,5 @@
 import { ErrorCode } from "../shared/codes.js";
-import { createUnauthenticatedAuthContext, getAuthContextForUser, getSessionUserId } from "./context.js";
+import { createUnauthenticatedAuthContext, getAuthContext, getAuthContextForUser } from "./context.js";
 import { logError } from "./log.js";
 import { verifyOAuthToken } from "./tokens.js";
 import { buildCorsHeaders, corsPreflightHandler, corsPreflightResponse, registerCorsPreflight, withCors } from "./cors.js";
@@ -98,9 +98,9 @@ async function getHttpOAuthContext(auth, ctx, request, resource, issuer) {
 async function resolveHttpAuthContext(auth, ctx, request, resource, issuer) {
 	const oauthContext = await getHttpOAuthContext(auth, ctx, request, resource, issuer);
 	if (oauthContext !== null) return oauthContext;
-	const sessionUserId = await getSessionUserId(ctx);
-	if (sessionUserId !== null) return {
-		...await getAuthContextForUser(auth, ctx, sessionUserId),
+	const sessionContext = await getAuthContext(auth, ctx);
+	if (sessionContext !== null) return {
+		...sessionContext,
 		source: "session",
 		key: null,
 		oauth: null

package/dist/server/http.js.map

@@ -1 +1 @@
-{"version":3,"file":"http.js","names":["parseCookies"],"sources":["../../src/server/http.ts"],"sourcesContent":["import {\n  GenericActionCtx,\n  GenericDataModel,\n  HttpRouter,\n  UserIdentity,\n  httpActionGeneric,\n} from \"convex/server\";\nimport { ConvexError } from \"convex/values\";\nimport { parse as parseCookies } from \"cookie\";\n\nimport { ErrorCode } from \"../shared/codes\";\nimport {\n  buildCorsHeaders,\n  corsPreflightHandler,\n  corsPreflightResponse,\n  registerCorsPreflight,\n  withCors,\n} from \"./cors\";\nimport type { AuthContext, OptionalAuthContext, UserDoc } from \"./auth\";\nimport type { ComponentCtx, ComponentReadCtx as HttpQueryCtx } from \"./component/context\";\nimport {\n  createUnauthenticatedAuthContext,\n  getAuthContextForUser,\n  getSessionUserId,\n} from \"./context\";\nimport { logError } from \"./log\";\nimport { verifyOAuthToken } from \"./tokens\";\nimport type { CorsConfig, HttpKeyContext } from \"./types\";\nimport { extractBearerToken } from \"./utils/bearer\";\nimport type { WellKnownEndpoint, WellKnownResponse } from \"./wellknown\";\n\ntype HttpIdentityCtx = {\n  auth: {\n    getUserIdentity: () => Promise<UserIdentity | null>;\n  };\n};\ntype HttpContextCtx = HttpIdentityCtx & HttpQueryCtx;\n\ntype HttpContextAuthLike = {\n  user: {\n    get: (ctx: HttpQueryCtx, args: { id: string }) => Promise<UserDoc | null>;\n  };\n  active: {\n    get: (\n      ctx: HttpQueryCtx,\n      args: { userId: string },\n    ) => Promise<{\n      groupId: string;\n      roleIds: string[];\n      grants: string[];\n    } | null>;\n  };\n  key: {\n    verify: (\n      ctx: ComponentCtx,\n      args: { secret: string },\n    ) => Promise<{\n      userId: string;\n      keyId: string;\n      scopes: HttpKeyContext[\"key\"][\"scopes\"];\n    }>;\n  };\n};\n\ntype HttpContextRuntimeOptions = {\n  issuer?: () => string;\n};\n\n/**\n * Auth context returned by `auth.request.context(ctx, request)`.\n *\n * This resolves raw HTTP authentication in two steps:\n * 1. session auth from `ctx.auth.getUserIdentity()`\n * 2. API key auth from `Authorization: Bearer sk_*`\n *\n * The `source` field tells you which authentication path succeeded.\n * When `source === \"key\"`, the verified API key metadata is available on\n * `key`.\n *\n * @example\n * ```ts\n * const authContext = await auth.request.context(ctx, request);\n * if (authContext.source === \"key\") {\n *   console.log(authContext.key.keyId);\n * }\n * ```\n */\nexport type HttpAuthContext =\n  | (AuthContext & {\n      /** The request authenticated through a browser or session token. */\n      source: \"session\";\n      /** No API key was used for this request. */\n      key: null;\n      oauth: null;\n    })\n  | (AuthContext & {\n      /** The request authenticated through an API key. */\n      source: \"key\";\n      /** Verified API key metadata for the request. */\n      key: HttpKeyContext[\"key\"];\n      oauth: null;\n    })\n  | (AuthContext & {\n      source: \"oauth\";\n      key: null;\n      oauth: { clientId: string; scopes: string[] };\n    });\n\n/**\n * Nullable HTTP auth context returned by\n * `auth.request.context.optional(ctx, request)`.\n *\n * This preserves a stable auth-shaped object for raw `httpAction` handlers\n * that allow anonymous callers.\n */\nexport type OptionalHttpAuthContext =\n  | (OptionalAuthContext & {\n      /** No authentication source was resolved. */\n      source: null;\n      /** No API key metadata is available. */\n      key: null;\n      oauth: null;\n    })\n  | HttpAuthContext;\n\n/**\n * Configuration for {@link defineAuth().request.context}.\n *\n * This mirrors {@link AuthContextConfig} for raw HTTP handlers and adds support\n * for enriching mixed session/API-key auth results.\n *\n * @typeParam TResolve - Extra fields returned from `resolve()` and merged into\n *   the resolved HTTP auth context.\n *\n * @example\n * ```ts\n * const authContext = await auth.request.context(ctx, request, {\n *   resolve: async (_ctx, user, authState) => ({\n *     email: user.email,\n *     isMachineRequest: authState.source === \"key\",\n *   }),\n * });\n * ```\n */\nexport type HttpAuthContextConfig<\n  TResolve extends Record<string, unknown> = Record<string, never>,\n  TCtx extends HttpContextCtx = HttpContextCtx,\n> = {\n  /**\n   * Attach additional derived fields to the resolved HTTP auth context.\n   *\n   * This callback runs only when authentication succeeds.\n   */\n  resolve?: (ctx: TCtx, user: UserDoc, auth: HttpAuthContext) => Promise<TResolve> | TResolve;\n  /**\n   * Override or wrap HTTP auth resolution.\n   *\n   * Return `undefined` to use the built-in session-or-key resolver, `null` for\n   * an explicit unauthenticated state, or a fully resolved\n   * {@link HttpAuthContext}.\n   */\n  authResolve?: (\n    ctx: TCtx,\n    fallback: () => Promise<HttpAuthContext | null>,\n  ) => Promise<HttpAuthContext | null | undefined> | HttpAuthContext | null | undefined;\n  /**\n   * RFC 8707 resource assertion (opt-in). When set, an OAuth `at+jwt` bearer is\n   * only accepted on this route if its `resource` claim equals this value — so a\n   * token minted for a different protected resource is not honored here. Omit it\n   * (the default) to accept any valid OAuth identity; capability is still bounded\n   * by scope grant-intersection regardless. The `/mcp` route sets this to its\n   * canonical resource.\n   */\n  resource?: string;\n};\n\nfunction createNotSignedInError() {\n  return new ConvexError({\n    code: ErrorCode.NOT_SIGNED_IN,\n    message: \"Authentication required.\",\n  });\n}\n\n/** A `{ code, message }` error body for the non-OAuth JSON HTTP surface. */\nexport type JsonErrorBody = { code: string; message: string };\n\nfunction isJsonErrorBody(value: unknown): value is JsonErrorBody {\n  if (typeof value !== \"object\" || value === null) return false;\n  if (!(\"code\" in value) || !(\"message\" in value)) return false;\n  return typeof value.code === \"string\" && typeof value.message === \"string\";\n}\n\n/**\n * Extract a `{ code, message }` body from a thrown value for the non-OAuth JSON\n * HTTP surface. A structured `ConvexError` carrying `code`/`message` is surfaced\n * verbatim; anything else collapses to an opaque `INTERNAL_ERROR`.\n */\nexport function convexErrorToBody(error: unknown): JsonErrorBody {\n  if (error instanceof ConvexError && isJsonErrorBody(error.data)) return error.data;\n  return { code: ErrorCode.INTERNAL_ERROR, message: \"An unexpected error occurred.\" };\n}\n\n/**\n * Build a JSON error `Response` for the non-OAuth HTTP surface, in the single\n * `{ code, message }` shape. OAuth wire endpoints use the RFC 6749\n * `{ error, error_description }` shape instead (see `oauth/*`).\n */\nexport function jsonError(\n  status: number,\n  body: JsonErrorBody,\n  extraHeaders?: Record<string, string>,\n): Response {\n  return new Response(JSON.stringify(body), {\n    status,\n    headers: { \"Content-Type\": \"application/json\", ...extraHeaders },\n  });\n}\n\nasync function getHttpKeyContext(\n  auth: HttpContextAuthLike,\n  ctx: HttpContextCtx,\n  request: Request,\n): Promise<HttpAuthContext | null> {\n  const token = extractBearerToken(request);\n  if (token === null || !token.startsWith(\"sk_\")) {\n    return null;\n  }\n\n  try {\n    /**\n     * The `Bearer sk_*` branch only runs inside an HTTP action, where the\n     * resolved `ctx` additionally carries the `runMutation` that `key.verify`\n     * needs. The HTTP-context surface is otherwise query-shaped, so this one\n     * narrow assertion supplies that single missing member at the boundary.\n     */\n    const keyVerifyCtx: ComponentCtx = ctx as HttpContextCtx & Pick<ComponentCtx, \"runMutation\">;\n    const verified = await auth.key.verify(keyVerifyCtx, {\n      secret: token,\n    });\n    const authContext = await getAuthContextForUser(auth, ctx, verified.userId);\n    return {\n      ...authContext,\n      source: \"key\",\n      key: {\n        userId: verified.userId,\n        keyId: verified.keyId,\n        scopes: verified.scopes,\n      },\n      oauth: null,\n    };\n  } catch (err) {\n    console.error(\"[auth] HTTP key verification failed\", { err });\n    return null;\n  }\n}\n\nasync function getHttpOAuthContext(\n  auth: HttpContextAuthLike,\n  ctx: HttpContextCtx,\n  request: Request,\n  resource: string | undefined,\n  issuer: string | undefined,\n): Promise<HttpAuthContext | null> {\n  const token = extractBearerToken(request);\n  if (token === null || token.startsWith(\"sk_\")) return null;\n  const tokenOptions: NonNullable<Parameters<typeof verifyOAuthToken>[1]> = {};\n  if (issuer !== undefined) tokenOptions.issuer = issuer;\n  if (resource !== undefined) tokenOptions.resource = resource;\n  const oauthPayload = await verifyOAuthToken(token, tokenOptions);\n  if (!oauthPayload) return null;\n  try {\n    const authContext = await getAuthContextForUser(\n      auth,\n      ctx,\n      oauthPayload.userId,\n      oauthPayload.scopes,\n    );\n    return {\n      ...authContext,\n      source: \"oauth\",\n      key: null,\n      oauth: { clientId: oauthPayload.clientId, scopes: oauthPayload.scopes },\n    };\n  } catch {\n    return null;\n  }\n}\n\nasync function resolveHttpAuthContext(\n  auth: HttpContextAuthLike,\n  ctx: HttpContextCtx,\n  request: Request,\n  resource: string | undefined,\n  issuer: string | undefined,\n): Promise<HttpAuthContext | null> {\n  const oauthContext = await getHttpOAuthContext(auth, ctx, request, resource, issuer);\n  if (oauthContext !== null) return oauthContext;\n\n  const sessionUserId = await getSessionUserId(ctx);\n  if (sessionUserId !== null) {\n    const authContext = await getAuthContextForUser(auth, ctx, sessionUserId);\n    return {\n      ...authContext,\n      source: \"session\",\n      key: null,\n      oauth: null,\n    };\n  }\n\n  return await getHttpKeyContext(auth, ctx, request);\n}\n\n/**\n * Resolver for `auth.request.context(ctx, request, config?)`.\n *\n * Authentication sources are tried in a fixed order: OAuth access tokens\n * first (an `at+jwt` bearer is also a valid Convex identity, so it must be\n * classified as `oauth` before the session branch would claim it), then the\n * session identity, then `Bearer sk_*` API keys. Session therefore takes\n * precedence over an API key when both are present.\n */\nexport interface HttpContextResolver {\n  <\n    TResolve extends Record<string, unknown> = Record<string, never>,\n    TCtx extends HttpContextCtx = HttpContextCtx,\n  >(\n    ctx: TCtx,\n    request: Request,\n    config?: HttpAuthContextConfig<TResolve, TCtx>,\n  ): Promise<HttpAuthContext & TResolve>;\n}\n\n/**\n * Nullable variant for `auth.request.context.optional(ctx, request, config?)`.\n */\nexport interface OptionalHttpContextResolver {\n  <\n    TResolve extends Record<string, unknown> = Record<string, never>,\n    TCtx extends HttpContextCtx = HttpContextCtx,\n  >(\n    ctx: TCtx,\n    request: Request,\n    config?: HttpAuthContextConfig<TResolve, TCtx>,\n  ): Promise<OptionalHttpAuthContext & TResolve>;\n}\n\nasync function resolveHttpContext(\n  auth: HttpContextAuthLike,\n  ctx: HttpContextCtx,\n  request: Request,\n  config: HttpAuthContextConfig<Record<string, unknown>> | undefined,\n  optional: boolean,\n  options: HttpContextRuntimeOptions,\n) {\n  const fallback = () =>\n    resolveHttpAuthContext(auth, ctx, request, config?.resource, options.issuer?.());\n  const authOverride = config?.authResolve ? await config.authResolve(ctx, fallback) : undefined;\n  const resolved = authOverride === undefined ? await fallback() : authOverride;\n\n  if (resolved === null) {\n    if (!optional) {\n      throw createNotSignedInError();\n    }\n    return {\n      ...createUnauthenticatedAuthContext(),\n      source: null,\n      key: null,\n      oauth: null,\n    };\n  }\n\n  const extra = config?.resolve ? await config.resolve(ctx, resolved.user, resolved) : {};\n\n  return {\n    ...resolved,\n    ...extra,\n  };\n}\n\n/**\n * @internal\n * Create the implementation behind `auth.request.context(...)` and\n * `auth.request.context.optional(...)`.\n *\n * The two assertions below bind a concrete (monomorphic) closure to the\n * generic call-signature interfaces {@link HttpContextResolver} /\n * {@link OptionalHttpContextResolver}; TypeScript cannot infer those generics\n * from a non-generic body, so the typed assertion is the irreducible bridge.\n */\nexport function createHttpContext(\n  auth: HttpContextAuthLike,\n  options: HttpContextRuntimeOptions = {},\n): HttpContextResolver & { optional: OptionalHttpContextResolver } {\n  const required = ((\n    ctx: HttpContextCtx,\n    request: Request,\n    config?: HttpAuthContextConfig<Record<string, unknown>>,\n  ) => resolveHttpContext(auth, ctx, request, config, false, options)) as HttpContextResolver & {\n    optional: OptionalHttpContextResolver;\n  };\n\n  required.optional = ((\n    ctx: HttpContextCtx,\n    request: Request,\n    config?: HttpAuthContextConfig<Record<string, unknown>>,\n  ) =>\n    resolveHttpContext(auth, ctx, request, config, true, options)) as OptionalHttpContextResolver;\n\n  return required;\n}\n\n/**\n * Build the Bearer-key HTTP action wrapper behind `auth.request.action(...)`.\n *\n * Returns a function that wraps a handler with `Authorization: Bearer sk_*`\n * verification, optional scope checks, CORS headers, and JSON error envelopes.\n *\n * @param auth - Provides `key.verify` for API key verification.\n * @param defaultOrigins - Allowed CORS origins (or a getter) used when a route\n *   supplies no `cors` config.\n */\nexport function createHttpAction(\n  auth: {\n    key: {\n      verify: (\n        ctx: GenericActionCtx<GenericDataModel>,\n        args: { secret: string },\n      ) => Promise<{\n        userId: string;\n        keyId: string;\n        scopes: HttpKeyContext[\"key\"][\"scopes\"];\n      }>;\n    };\n  },\n  defaultOrigins: string[] | (() => string[]),\n) {\n  return (\n    handler: (\n      ctx: GenericActionCtx<GenericDataModel> & HttpKeyContext,\n      request: Request,\n    ) => Promise<Response | Record<string, unknown>>,\n    options?: {\n      scope?: { resource: string; action: string };\n      cors?: CorsConfig;\n    },\n  ) => {\n    return httpActionGeneric(async (genericCtx, request) => {\n      const corsHeaders = buildCorsHeaders(request, options?.cors, defaultOrigins);\n\n      try {\n        const rawKey = extractBearerToken(request);\n        if (rawKey === null) {\n          return jsonError(\n            401,\n            {\n              code: ErrorCode.MISSING_BEARER_TOKEN,\n              message: \"Missing or malformed Authorization: Bearer header.\",\n            },\n            corsHeaders,\n          );\n        }\n\n        let keyResult:\n          | {\n              ok: true;\n              value: {\n                userId: string;\n                keyId: string;\n                scopes: HttpKeyContext[\"key\"][\"scopes\"];\n              };\n            }\n          | { ok: false; error: unknown };\n        try {\n          const value = await auth.key.verify(genericCtx, { secret: rawKey });\n          keyResult = { ok: true, value };\n        } catch (error) {\n          keyResult = { ok: false, error };\n        }\n\n        if (!keyResult.ok) {\n          if (\n            keyResult.error instanceof ConvexError &&\n            typeof keyResult.error.data === \"object\" &&\n            keyResult.error.data !== null &&\n            \"code\" in keyResult.error.data &&\n            \"message\" in keyResult.error.data\n          ) {\n            return jsonError(403, convexErrorToBody(keyResult.error), corsHeaders);\n          }\n          throw keyResult.error;\n        }\n\n        if (\n          options?.scope &&\n          !keyResult.value.scopes.can(options.scope.resource, options.scope.action)\n        ) {\n          return jsonError(\n            403,\n            {\n              code: ErrorCode.SCOPE_CHECK_FAILED,\n              message: \"This API key does not have the required permissions.\",\n            },\n            corsHeaders,\n          );\n        }\n\n        const enrichedCtx = Object.assign(genericCtx, {\n          key: {\n            userId: keyResult.value.userId,\n            keyId: keyResult.value.keyId,\n            scopes: keyResult.value.scopes,\n          },\n        });\n        const result = await handler(enrichedCtx, request);\n\n        return result instanceof Response\n          ? (() => {\n              const headers = new Headers(result.headers);\n              for (const [k, val] of Object.entries(corsHeaders)) {\n                if (!headers.has(k)) headers.set(k, val);\n              }\n              return new Response(result.body, {\n                status: result.status,\n                statusText: result.statusText,\n                headers,\n              });\n            })()\n          : new Response(JSON.stringify(result), {\n              status: 200,\n              headers: {\n                ...corsHeaders,\n                \"Content-Type\": \"application/json\",\n              },\n            });\n      } catch (error) {\n        logError(error);\n        return jsonError(\n          500,\n          { code: ErrorCode.INTERNAL_ERROR, message: \"An unexpected error occurred.\" },\n          corsHeaders,\n        );\n      }\n    });\n  };\n}\n\n/**\n * Build the route registrar behind `auth.request.route(...)`.\n *\n * Returns a function that registers a Bearer-authenticated route plus its\n * matching `OPTIONS` CORS preflight in one call.\n *\n * @param wrapAction - The wrapper produced by {@link createHttpAction}.\n * @param defaultOrigins - Allowed CORS origins (or a getter) for the preflight.\n */\nexport function createHttpRoute(\n  wrapAction: ReturnType<typeof createHttpAction>,\n  defaultOrigins: string[] | (() => string[]),\n) {\n  return (\n    http: { route: (config: unknown) => void },\n    routeConfig: {\n      path: string;\n      method: \"GET\" | \"POST\" | \"PUT\" | \"PATCH\" | \"DELETE\";\n      handler: (\n        ctx: GenericActionCtx<GenericDataModel> & HttpKeyContext,\n        request: Request,\n      ) => Promise<Response | Record<string, unknown>>;\n      scope?: { resource: string; action: string };\n      cors?: CorsConfig;\n    },\n  ) => {\n    http.route({\n      path: routeConfig.path,\n      method: \"OPTIONS\",\n      handler: httpActionGeneric(async (_ctx, request) =>\n        corsPreflightResponse(request, routeConfig.cors, defaultOrigins),\n      ),\n    });\n\n    http.route({\n      path: routeConfig.path,\n      method: routeConfig.method,\n      handler: wrapAction(routeConfig.handler, {\n        scope: routeConfig.scope,\n        cors: routeConfig.cors,\n      }),\n    });\n  };\n}\n\n/**\n * Wrap an HTTP action so thrown `ConvexError`s become JSON error responses.\n *\n * Structured `{ code, message }` errors return `errorStatusCode`; other\n * `ConvexError`s return that status with a plain status text; any other error\n * is logged and returns a 500.\n *\n * @param errorStatusCode - Status used for `ConvexError`s.\n * @param action - The wrapped HTTP action.\n */\nexport function convertErrorsToResponse(\n  errorStatusCode: number,\n  action: (ctx: GenericActionCtx<GenericDataModel>, request: Request) => Promise<Response>,\n) {\n  return async (ctx: GenericActionCtx<GenericDataModel>, request: Request) => {\n    try {\n      return await action(ctx, request);\n    } catch (error) {\n      if (\n        error instanceof ConvexError &&\n        typeof error.data === \"object\" &&\n        error.data !== null &&\n        \"code\" in error.data &&\n        \"message\" in error.data\n      ) {\n        return jsonError(errorStatusCode, convexErrorToBody(error));\n      }\n      if (error instanceof ConvexError) {\n        return new Response(null, {\n          status: errorStatusCode,\n          statusText: typeof error.data === \"string\" ? error.data : \"Error\",\n        });\n      }\n      logError(error);\n      return new Response(null, {\n        status: 500,\n        statusText: \"Internal Server Error\",\n      });\n    }\n  };\n}\n\n/** Parse the request's `Cookie` header into a name-to-value record. */\nexport function getCookies(request: Request): Record<string, string | undefined> {\n  return parseCookies(request.headers.get(\"Cookie\") ?? \"\");\n}\n\n/** Parsed group connection runtime route: connection id, protocol, and remaining path segments. */\nexport type ConnectionRuntimeRoute = {\n  pathname?: string;\n  connectionId: string;\n  protocol: \"oidc\" | \"saml\" | \"scim\";\n  rest: string[];\n};\n\nfunction parseConnectionRuntimeRoute(\n  pathname: string,\n  routeBase: string,\n): ConnectionRuntimeRoute | null {\n  const runtimePrefix = `${routeBase}/`;\n  const runtimeParts = pathname.startsWith(runtimePrefix)\n    ? pathname.slice(runtimePrefix.length).split(\"/\").filter(Boolean)\n    : [];\n  const [runtimeConnectionId, protocol, ...rest] = runtimeParts;\n  if (\n    runtimeConnectionId === undefined ||\n    (protocol !== \"oidc\" && protocol !== \"saml\" && protocol !== \"scim\") ||\n    rest.length === 0\n  ) {\n    return null;\n  }\n  return {\n    pathname,\n    connectionId: runtimeConnectionId,\n    protocol,\n    rest,\n  };\n}\n\n/**\n * Register the OpenID discovery and JWKS endpoints on an HTTP router.\n *\n * Adds `<routeBase>/.well-known/openid-configuration` and\n * `<routeBase>/.well-known/jwks.json`. OAuth-specific discovery fields are\n * included only when `deps.oauth` is provided.\n *\n * Discovery is served at both the issuer prefix and the root, including the\n * RFC 8414 `oauth-authorization-server` path conventions, because clients\n * treat either the issuer (`/auth`) or the origin as the base. These exact\n * routes win over the static-hosting catch-all, so zero-config\n * `mcp login <url>` resolves to JSON rather than the SPA HTML fallback.\n */\nexport function addOpenIdRoutes(\n  http: HttpRouter,\n  deps: {\n    getIssuer: () => string;\n    getJwks: () => string;\n    routeBase?: string;\n    oauth?: {\n      scopes?: string[];\n    };\n  },\n) {\n  const cacheControl = \"public, max-age=15, stale-while-revalidate=15, stale-if-error=86400\";\n  const routeBase = deps.routeBase ?? \"\";\n\n  const buildMetadata = () => {\n    const issuer = deps.getIssuer();\n    const body: Record<string, unknown> = {\n      issuer,\n      jwks_uri: `${issuer}/.well-known/jwks.json`,\n    };\n    if (deps.oauth) {\n      body.authorization_endpoint = `${issuer}/oauth2/authorize`;\n      body.token_endpoint = `${issuer}/oauth2/token`;\n      body.registration_endpoint = `${issuer}/oauth2/register`;\n      body.response_types_supported = [\"code\"];\n      body.grant_types_supported = [\"authorization_code\", \"refresh_token\", \"client_credentials\"];\n      body.code_challenge_methods_supported = [\"S256\"];\n      body.token_endpoint_auth_methods_supported = [\n        \"client_secret_post\",\n        \"client_secret_basic\",\n        \"none\",\n      ];\n      body.scopes_supported = deps.oauth.scopes ?? [\"openid\", \"profile\", \"email\", \"offline_access\"];\n    }\n    return body;\n  };\n\n  const metadataHandler = httpActionGeneric(\n    withCors(async () => {\n      return new Response(JSON.stringify(buildMetadata()), {\n        status: 200,\n        headers: { \"Content-Type\": \"application/json\", \"Cache-Control\": cacheControl },\n      });\n    }),\n  );\n\n  const jwksHandler = httpActionGeneric(\n    withCors(async () => {\n      return new Response(deps.getJwks(), {\n        status: 200,\n        headers: { \"Content-Type\": \"application/json\", \"Cache-Control\": cacheControl },\n      });\n    }),\n  );\n\n  const oidcPaths = new Set<string>([\n    `${routeBase}/.well-known/openid-configuration`,\n    \"/.well-known/openid-configuration\",\n  ]);\n  const asPaths = deps.oauth\n    ? new Set<string>([\n        `/.well-known/oauth-authorization-server${routeBase}`,\n        `${routeBase}/.well-known/oauth-authorization-server`,\n        \"/.well-known/oauth-authorization-server\",\n      ])\n    : new Set<string>();\n  const jwksPaths = new Set<string>([\n    `${routeBase}/.well-known/jwks.json`,\n    \"/.well-known/jwks.json\",\n  ]);\n\n  for (const path of [...oidcPaths, ...asPaths]) {\n    http.route({ path, method: \"GET\", handler: metadataHandler });\n  }\n  for (const path of jwksPaths) {\n    http.route({ path, method: \"GET\", handler: jwksHandler });\n  }\n  registerCorsPreflight(http, [...oidcPaths, ...asPaths, ...jwksPaths]);\n}\n\n/** Register root `/.well-known/*` app discovery routes on an HTTP router. */\nexport function addWellKnownRoutes(\n  http: HttpRouter,\n  deps: {\n    getResponse: (endpoint: WellKnownEndpoint) => WellKnownResponse | null;\n  },\n) {\n  const routes: Array<{ endpoint: WellKnownEndpoint; path: string }> = [\n    {\n      endpoint: \"apple-app-site-association\",\n      path: \"/.well-known/apple-app-site-association\",\n    },\n    { endpoint: \"assetlinks.json\", path: \"/.well-known/assetlinks.json\" },\n    { endpoint: \"webauthn\", path: \"/.well-known/webauthn\" },\n    { endpoint: \"change-password\", path: \"/.well-known/change-password\" },\n    { endpoint: \"security.txt\", path: \"/.well-known/security.txt\" },\n  ];\n\n  for (const route of routes) {\n    http.route({\n      path: route.path,\n      method: \"GET\",\n      handler: httpActionGeneric(async () => {\n        const result = deps.getResponse(route.endpoint);\n        if (result === null) {\n          return new Response(null, { status: 404 });\n        }\n        return new Response(result.body, {\n          status: result.status,\n          headers: result.headers,\n        });\n      }),\n    });\n  }\n}\n\n/**\n * Register the OAuth sign-in and callback routes on an HTTP router.\n *\n * Adds `GET <routeBase>/signin/*` and `GET`/`POST <routeBase>/callback/*`.\n */\nexport function addAuthRoutes(\n  http: HttpRouter,\n  deps: {\n    handleSignIn: (ctx: GenericActionCtx<GenericDataModel>, request: Request) => Promise<Response>;\n    handleCallback: (\n      ctx: GenericActionCtx<GenericDataModel>,\n      request: Request,\n    ) => Promise<Response>;\n    routeBase?: string;\n  },\n) {\n  const routeBase = deps.routeBase ?? \"/api/auth\";\n  const routePrefix = routeBase === \"\" ? \"\" : routeBase;\n  http.route({\n    pathPrefix: `${routePrefix}/signin/`,\n    method: \"GET\",\n    handler: httpActionGeneric(deps.handleSignIn),\n  });\n\n  const callbackHandler = httpActionGeneric(deps.handleCallback);\n\n  http.route({\n    pathPrefix: `${routePrefix}/callback/`,\n    method: \"GET\",\n    handler: callbackHandler,\n  });\n\n  http.route({\n    pathPrefix: `${routePrefix}/callback/`,\n    method: \"POST\",\n    handler: callbackHandler,\n  });\n}\n\n/**\n * Register the OAuth provider authorize, token, registration, and RFC 7592\n * client-management endpoints on an HTTP router.\n *\n * Adds `GET <base>/oauth2/authorize`, `POST <base>/oauth2/token`,\n * `POST <base>/oauth2/register` (DCR), and `GET`/`PUT`/`DELETE`\n * `<base>/oauth2/register/<client_id>` (management). The exact `register` path\n * serves DCR; the `register/` prefix serves per-client management.\n */\nexport function addOAuthProviderRoutes(\n  http: HttpRouter,\n  deps: {\n    handleAuthorize: (\n      ctx: GenericActionCtx<GenericDataModel>,\n      request: Request,\n    ) => Promise<Response>;\n    handleToken: (ctx: GenericActionCtx<GenericDataModel>, request: Request) => Promise<Response>;\n    handleRegister: (\n      ctx: GenericActionCtx<GenericDataModel>,\n      request: Request,\n    ) => Promise<Response>;\n    handleManage: (ctx: GenericActionCtx<GenericDataModel>, request: Request) => Promise<Response>;\n    routeBase?: string;\n  },\n) {\n  const base = deps.routeBase ?? \"\";\n  const authorizePath = `${base}/oauth2/authorize`;\n  const tokenPath = `${base}/oauth2/token`;\n  const registerPath = `${base}/oauth2/register`;\n  const managePrefix = `${registerPath}/`;\n\n  http.route({\n    path: authorizePath,\n    method: \"GET\",\n    handler: httpActionGeneric(withCors(deps.handleAuthorize)),\n  });\n  http.route({\n    path: tokenPath,\n    method: \"POST\",\n    handler: httpActionGeneric(withCors(deps.handleToken)),\n  });\n  http.route({\n    path: registerPath,\n    method: \"POST\",\n    handler: httpActionGeneric(withCors(deps.handleRegister)),\n  });\n  for (const method of [\"GET\", \"PUT\", \"DELETE\"] as const) {\n    http.route({\n      pathPrefix: managePrefix,\n      method,\n      handler: httpActionGeneric(withCors(deps.handleManage)),\n    });\n  }\n  http.route({ pathPrefix: managePrefix, method: \"OPTIONS\", handler: corsPreflightHandler });\n  registerCorsPreflight(http, [authorizePath, tokenPath, registerPath]);\n}\n\n/**\n * Register the group connection runtime routes (SAML, OIDC, SCIM) on a router.\n *\n * Mounts method-specific handlers under `<routeBase>/<connectionId>/<protocol>/...`\n * (plus an optional shared OIDC callback path), dispatching by\n * `${protocol}:${endpoint}` and returning SCIM errors for unmatched\n * `PATCH`/`DELETE` requests.\n */\nexport function addConnectionRoutes(\n  http: HttpRouter,\n  deps: {\n    routeBase: string;\n    sharedOidcCallbackPath?: string;\n    convertErrorsToResponse: typeof convertErrorsToResponse;\n    handleSamlMetadata: (\n      ctx: GenericActionCtx<GenericDataModel>,\n      request: Request,\n      route: ConnectionRuntimeRoute,\n    ) => Promise<Response>;\n    handleSamlSignIn: (\n      ctx: GenericActionCtx<GenericDataModel>,\n      request: Request,\n      route: ConnectionRuntimeRoute,\n    ) => Promise<Response>;\n    handleOidcSignIn: (\n      ctx: GenericActionCtx<GenericDataModel>,\n      request: Request,\n      route: ConnectionRuntimeRoute,\n    ) => Promise<Response>;\n    handleOidcCallback: (\n      ctx: GenericActionCtx<GenericDataModel>,\n      request: Request,\n      route: ConnectionRuntimeRoute,\n    ) => Promise<Response>;\n    handleOidcSharedCallback: (\n      ctx: GenericActionCtx<GenericDataModel>,\n      request: Request,\n    ) => Promise<Response>;\n    handleSamlAcs: (\n      ctx: GenericActionCtx<GenericDataModel>,\n      request: Request,\n      route: ConnectionRuntimeRoute,\n    ) => Promise<Response>;\n    handleSamlSlo: (\n      ctx: GenericActionCtx<GenericDataModel>,\n      request: Request,\n      route: ConnectionRuntimeRoute,\n    ) => Promise<Response>;\n    handleScimRequest: (\n      ctx: GenericActionCtx<GenericDataModel>,\n      request: Request,\n    ) => Promise<Response>;\n    scimError: (status: number, scimType: string, detail: string) => Response;\n  },\n) {\n  const routePrefix = `${deps.routeBase}/`;\n  const sharedOidcCallbackPath = deps.sharedOidcCallbackPath\n    ? (() => {\n        if (/^https?:\\/\\//.test(deps.sharedOidcCallbackPath)) {\n          return new URL(deps.sharedOidcCallbackPath).pathname;\n        }\n        return deps.sharedOidcCallbackPath.startsWith(\"/\")\n          ? deps.sharedOidcCallbackPath\n          : `/${deps.sharedOidcCallbackPath}`;\n      })()\n    : undefined;\n\n  if (sharedOidcCallbackPath) {\n    http.route({\n      path: sharedOidcCallbackPath,\n      method: \"GET\",\n      handler: httpActionGeneric(\n        deps.convertErrorsToResponse(400, async (ctx, request) =>\n          deps.handleOidcSharedCallback(ctx, request),\n        ),\n      ),\n    });\n\n    http.route({\n      path: sharedOidcCallbackPath,\n      method: \"POST\",\n      handler: httpActionGeneric(\n        deps.convertErrorsToResponse(400, async (ctx, request) =>\n          deps.handleOidcSharedCallback(ctx, request),\n        ),\n      ),\n    });\n  }\n\n  type ConnRouteHandler = (\n    ctx: GenericActionCtx<GenericDataModel>,\n    request: Request,\n    route: ConnectionRuntimeRoute,\n  ) => Promise<Response>;\n  const scimRoute: ConnRouteHandler = (ctx, request) => deps.handleScimRequest(ctx, request);\n\n  const matchConnectionRoute = (\n    route: ConnectionRuntimeRoute | null,\n    handlers: Record<string, ConnRouteHandler>,\n  ): ConnRouteHandler | null => {\n    const endpoint = route?.rest[0];\n    if (!route || endpoint === undefined) return null;\n    const key =\n      route.protocol === \"scim\"\n        ? endpoint === \"v2\"\n          ? \"scim:v2\"\n          : null\n        : route.rest.length === 1\n          ? `${route.protocol}:${endpoint}`\n          : null;\n    return key ? (handlers[key] ?? null) : null;\n  };\n\n  const connectionRouteHandler = (handlers: Record<string, ConnRouteHandler>) =>\n    httpActionGeneric(\n      deps.convertErrorsToResponse(400, async (ctx, request) => {\n        const route = parseConnectionRuntimeRoute(new URL(request.url).pathname, deps.routeBase);\n        const handler = matchConnectionRoute(route, handlers);\n        if (!handler || !route) {\n          throw new ConvexError({\n            code: ErrorCode.INVALID_PARAMETERS,\n            message: \"Invalid connection runtime path.\",\n          });\n        }\n        return await handler(ctx, request, route);\n      }),\n    );\n\n  http.route({\n    pathPrefix: routePrefix,\n    method: \"GET\",\n    handler: connectionRouteHandler({\n      \"saml:metadata\": deps.handleSamlMetadata,\n      \"saml:signin\": deps.handleSamlSignIn,\n      \"saml:acs\": deps.handleSamlAcs,\n      \"saml:slo\": deps.handleSamlSlo,\n      \"oidc:signin\": deps.handleOidcSignIn,\n      \"oidc:callback\": deps.handleOidcCallback,\n      \"scim:v2\": scimRoute,\n    }),\n  });\n\n  http.route({\n    pathPrefix: routePrefix,\n    method: \"POST\",\n    handler: connectionRouteHandler({\n      \"saml:acs\": deps.handleSamlAcs,\n      \"saml:slo\": deps.handleSamlSlo,\n      \"oidc:callback\": deps.handleOidcCallback,\n      \"scim:v2\": scimRoute,\n    }),\n  });\n\n  http.route({\n    pathPrefix: routePrefix,\n    method: \"PUT\",\n    handler: connectionRouteHandler({\n      \"scim:v2\": scimRoute,\n    }),\n  });\n\n  for (const method of [\"PATCH\", \"DELETE\"] as const) {\n    http.route({\n      pathPrefix: routePrefix,\n      method,\n      handler: httpActionGeneric(async (ctx, request) => {\n        const route = parseConnectionRuntimeRoute(new URL(request.url).pathname, deps.routeBase);\n        if (!route || route.protocol !== \"scim\" || route.rest[0] !== \"v2\") {\n          return deps.scimError(404, \"notFound\", \"SCIM resource not found.\");\n        }\n        return await deps.handleScimRequest(ctx, request);\n      }),\n    });\n  }\n}\n"],"mappings":";;;;;;;;;;;AAgLA,SAAS,yBAAyB;AAChC,QAAO,IAAI,YAAY;EACrB,MAAM,UAAU;EAChB,SAAS;EACV,CAAC;;AAMJ,SAAS,gBAAgB,OAAwC;AAC/D,KAAI,OAAO,UAAU,YAAY,UAAU,KAAM,QAAO;AACxD,KAAI,EAAE,UAAU,UAAU,EAAE,aAAa,OAAQ,QAAO;AACxD,QAAO,OAAO,MAAM,SAAS,YAAY,OAAO,MAAM,YAAY;;;;;;;AAQpE,SAAgB,kBAAkB,OAA+B;AAC/D,KAAI,iBAAiB,eAAe,gBAAgB,MAAM,KAAK,CAAE,QAAO,MAAM;AAC9E,QAAO;EAAE,MAAM,UAAU;EAAgB,SAAS;EAAiC;;;;;;;AAQrF,SAAgB,UACd,QACA,MACA,cACU;AACV,QAAO,IAAI,SAAS,KAAK,UAAU,KAAK,EAAE;EACxC;EACA,SAAS;GAAE,gBAAgB;GAAoB,GAAG;GAAc;EACjE,CAAC;;AAGJ,eAAe,kBACb,MACA,KACA,SACiC;CACjC,MAAM,QAAQ,mBAAmB,QAAQ;AACzC,KAAI,UAAU,QAAQ,CAAC,MAAM,WAAW,MAAM,CAC5C,QAAO;AAGT,KAAI;;;;;;;EAOF,MAAM,eAA6B;EACnC,MAAM,WAAW,MAAM,KAAK,IAAI,OAAO,cAAc,EACnD,QAAQ,OACT,CAAC;AAEF,SAAO;GACL,GAFkB,MAAM,sBAAsB,MAAM,KAAK,SAAS,OAAO;GAGzE,QAAQ;GACR,KAAK;IACH,QAAQ,SAAS;IACjB,OAAO,SAAS;IAChB,QAAQ,SAAS;IAClB;GACD,OAAO;GACR;UACM,KAAK;AACZ,UAAQ,MAAM,uCAAuC,EAAE,KAAK,CAAC;AAC7D,SAAO;;;AAIX,eAAe,oBACb,MACA,KACA,SACA,UACA,QACiC;CACjC,MAAM,QAAQ,mBAAmB,QAAQ;AACzC,KAAI,UAAU,QAAQ,MAAM,WAAW,MAAM,CAAE,QAAO;CACtD,MAAM,eAAoE,EAAE;AAC5E,KAAI,WAAW,OAAW,cAAa,SAAS;AAChD,KAAI,aAAa,OAAW,cAAa,WAAW;CACpD,MAAM,eAAe,MAAM,iBAAiB,OAAO,aAAa;AAChE,KAAI,CAAC,aAAc,QAAO;AAC1B,KAAI;AAOF,SAAO;GACL,GAPkB,MAAM,sBACxB,MACA,KACA,aAAa,QACb,aAAa,OACd;GAGC,QAAQ;GACR,KAAK;GACL,OAAO;IAAE,UAAU,aAAa;IAAU,QAAQ,aAAa;IAAQ;GACxE;SACK;AACN,SAAO;;;AAIX,eAAe,uBACb,MACA,KACA,SACA,UACA,QACiC;CACjC,MAAM,eAAe,MAAM,oBAAoB,MAAM,KAAK,SAAS,UAAU,OAAO;AACpF,KAAI,iBAAiB,KAAM,QAAO;CAElC,MAAM,gBAAgB,MAAM,iBAAiB,IAAI;AACjD,KAAI,kBAAkB,KAEpB,QAAO;EACL,GAFkB,MAAM,sBAAsB,MAAM,KAAK,cAAc;EAGvE,QAAQ;EACR,KAAK;EACL,OAAO;EACR;AAGH,QAAO,MAAM,kBAAkB,MAAM,KAAK,QAAQ;;AAqCpD,eAAe,mBACb,MACA,KACA,SACA,QACA,UACA,SACA;CACA,MAAM,iBACJ,uBAAuB,MAAM,KAAK,SAAS,QAAQ,UAAU,QAAQ,UAAU,CAAC;CAClF,MAAM,eAAe,QAAQ,cAAc,MAAM,OAAO,YAAY,KAAK,SAAS,GAAG;CACrF,MAAM,WAAW,iBAAiB,SAAY,MAAM,UAAU,GAAG;AAEjE,KAAI,aAAa,MAAM;AACrB,MAAI,CAAC,SACH,OAAM,wBAAwB;AAEhC,SAAO;GACL,GAAG,kCAAkC;GACrC,QAAQ;GACR,KAAK;GACL,OAAO;GACR;;CAGH,MAAM,QAAQ,QAAQ,UAAU,MAAM,OAAO,QAAQ,KAAK,SAAS,MAAM,SAAS,GAAG,EAAE;AAEvF,QAAO;EACL,GAAG;EACH,GAAG;EACJ;;;;;;;;;;;;AAaH,SAAgB,kBACd,MACA,UAAqC,EAAE,EAC0B;CACjE,MAAM,aACJ,KACA,SACA,WACG,mBAAmB,MAAM,KAAK,SAAS,QAAQ,OAAO,QAAQ;AAInE,UAAS,aACP,KACA,SACA,WAEA,mBAAmB,MAAM,KAAK,SAAS,QAAQ,MAAM,QAAQ;AAE/D,QAAO;;;;;;;;;;;;AAaT,SAAgB,iBACd,MAYA,gBACA;AACA,SACE,SAIA,YAIG;AACH,SAAO,kBAAkB,OAAO,YAAY,YAAY;GACtD,MAAM,cAAc,iBAAiB,SAAS,SAAS,MAAM,eAAe;AAE5E,OAAI;IACF,MAAM,SAAS,mBAAmB,QAAQ;AAC1C,QAAI,WAAW,KACb,QAAO,UACL,KACA;KACE,MAAM,UAAU;KAChB,SAAS;KACV,EACD,YACD;IAGH,IAAI;AAUJ,QAAI;AAEF,iBAAY;MAAE,IAAI;MAAM,OADV,MAAM,KAAK,IAAI,OAAO,YAAY,EAAE,QAAQ,QAAQ,CAAC;MACpC;aACxB,OAAO;AACd,iBAAY;MAAE,IAAI;MAAO;MAAO;;AAGlC,QAAI,CAAC,UAAU,IAAI;AACjB,SACE,UAAU,iBAAiB,eAC3B,OAAO,UAAU,MAAM,SAAS,YAChC,UAAU,MAAM,SAAS,QACzB,UAAU,UAAU,MAAM,QAC1B,aAAa,UAAU,MAAM,KAE7B,QAAO,UAAU,KAAK,kBAAkB,UAAU,MAAM,EAAE,YAAY;AAExE,WAAM,UAAU;;AAGlB,QACE,SAAS,SACT,CAAC,UAAU,MAAM,OAAO,IAAI,QAAQ,MAAM,UAAU,QAAQ,MAAM,OAAO,CAEzE,QAAO,UACL,KACA;KACE,MAAM,UAAU;KAChB,SAAS;KACV,EACD,YACD;IAUH,MAAM,SAAS,MAAM,QAPD,OAAO,OAAO,YAAY,EAC5C,KAAK;KACH,QAAQ,UAAU,MAAM;KACxB,OAAO,UAAU,MAAM;KACvB,QAAQ,UAAU,MAAM;KACzB,EACF,CAAC,EACwC,QAAQ;AAElD,WAAO,kBAAkB,kBACd;KACL,MAAM,UAAU,IAAI,QAAQ,OAAO,QAAQ;AAC3C,UAAK,MAAM,CAAC,GAAG,QAAQ,OAAO,QAAQ,YAAY,CAChD,KAAI,CAAC,QAAQ,IAAI,EAAE,CAAE,SAAQ,IAAI,GAAG,IAAI;AAE1C,YAAO,IAAI,SAAS,OAAO,MAAM;MAC/B,QAAQ,OAAO;MACf,YAAY,OAAO;MACnB;MACD,CAAC;QACA,GACJ,IAAI,SAAS,KAAK,UAAU,OAAO,EAAE;KACnC,QAAQ;KACR,SAAS;MACP,GAAG;MACH,gBAAgB;MACjB;KACF,CAAC;YACC,OAAO;AACd,aAAS,MAAM;AACf,WAAO,UACL,KACA;KAAE,MAAM,UAAU;KAAgB,SAAS;KAAiC,EAC5E,YACD;;IAEH;;;;;;;;;;;;AAaN,SAAgB,gBACd,YACA,gBACA;AACA,SACE,MACA,gBAUG;AACH,OAAK,MAAM;GACT,MAAM,YAAY;GAClB,QAAQ;GACR,SAAS,kBAAkB,OAAO,MAAM,YACtC,sBAAsB,SAAS,YAAY,MAAM,eAAe,CACjE;GACF,CAAC;AAEF,OAAK,MAAM;GACT,MAAM,YAAY;GAClB,QAAQ,YAAY;GACpB,SAAS,WAAW,YAAY,SAAS;IACvC,OAAO,YAAY;IACnB,MAAM,YAAY;IACnB,CAAC;GACH,CAAC;;;;;;;;;;;;;AAcN,SAAgB,wBACd,iBACA,QACA;AACA,QAAO,OAAO,KAAyC,YAAqB;AAC1E,MAAI;AACF,UAAO,MAAM,OAAO,KAAK,QAAQ;WAC1B,OAAO;AACd,OACE,iBAAiB,eACjB,OAAO,MAAM,SAAS,YACtB,MAAM,SAAS,QACf,UAAU,MAAM,QAChB,aAAa,MAAM,KAEnB,QAAO,UAAU,iBAAiB,kBAAkB,MAAM,CAAC;AAE7D,OAAI,iBAAiB,YACnB,QAAO,IAAI,SAAS,MAAM;IACxB,QAAQ;IACR,YAAY,OAAO,MAAM,SAAS,WAAW,MAAM,OAAO;IAC3D,CAAC;AAEJ,YAAS,MAAM;AACf,UAAO,IAAI,SAAS,MAAM;IACxB,QAAQ;IACR,YAAY;IACb,CAAC;;;;;AAMR,SAAgB,WAAW,SAAsD;AAC/E,QAAOA,MAAa,QAAQ,QAAQ,IAAI,SAAS,IAAI,GAAG;;AAW1D,SAAS,4BACP,UACA,WAC+B;CAC/B,MAAM,gBAAgB,GAAG,UAAU;CAInC,MAAM,CAAC,qBAAqB,UAAU,GAAG,QAHpB,SAAS,WAAW,cAAc,GACnD,SAAS,MAAM,cAAc,OAAO,CAAC,MAAM,IAAI,CAAC,OAAO,QAAQ,GAC/D,EAAE;AAEN,KACE,wBAAwB,UACvB,aAAa,UAAU,aAAa,UAAU,aAAa,UAC5D,KAAK,WAAW,EAEhB,QAAO;AAET,QAAO;EACL;EACA,cAAc;EACd;EACA;EACD;;;;;;;;;;;;;;;AAgBH,SAAgB,gBACd,MACA,MAQA;CACA,MAAM,eAAe;CACrB,MAAM,YAAY,KAAK,aAAa;CAEpC,MAAM,sBAAsB;EAC1B,MAAM,SAAS,KAAK,WAAW;EAC/B,MAAM,OAAgC;GACpC;GACA,UAAU,GAAG,OAAO;GACrB;AACD,MAAI,KAAK,OAAO;AACd,QAAK,yBAAyB,GAAG,OAAO;AACxC,QAAK,iBAAiB,GAAG,OAAO;AAChC,QAAK,wBAAwB,GAAG,OAAO;AACvC,QAAK,2BAA2B,CAAC,OAAO;AACxC,QAAK,wBAAwB;IAAC;IAAsB;IAAiB;IAAqB;AAC1F,QAAK,mCAAmC,CAAC,OAAO;AAChD,QAAK,wCAAwC;IAC3C;IACA;IACA;IACD;AACD,QAAK,mBAAmB,KAAK,MAAM,UAAU;IAAC;IAAU;IAAW;IAAS;IAAiB;;AAE/F,SAAO;;CAGT,MAAM,kBAAkB,kBACtB,SAAS,YAAY;AACnB,SAAO,IAAI,SAAS,KAAK,UAAU,eAAe,CAAC,EAAE;GACnD,QAAQ;GACR,SAAS;IAAE,gBAAgB;IAAoB,iBAAiB;IAAc;GAC/E,CAAC;GACF,CACH;CAED,MAAM,cAAc,kBAClB,SAAS,YAAY;AACnB,SAAO,IAAI,SAAS,KAAK,SAAS,EAAE;GAClC,QAAQ;GACR,SAAS;IAAE,gBAAgB;IAAoB,iBAAiB;IAAc;GAC/E,CAAC;GACF,CACH;CAED,MAAM,YAAY,IAAI,IAAY,CAChC,GAAG,UAAU,oCACb,oCACD,CAAC;CACF,MAAM,UAAU,KAAK,QACjB,IAAI,IAAY;EACd,0CAA0C;EAC1C,GAAG,UAAU;EACb;EACD,CAAC,mBACF,IAAI,KAAa;CACrB,MAAM,YAAY,IAAI,IAAY,CAChC,GAAG,UAAU,yBACb,yBACD,CAAC;AAEF,MAAK,MAAM,QAAQ,CAAC,GAAG,WAAW,GAAG,QAAQ,CAC3C,MAAK,MAAM;EAAE;EAAM,QAAQ;EAAO,SAAS;EAAiB,CAAC;AAE/D,MAAK,MAAM,QAAQ,UACjB,MAAK,MAAM;EAAE;EAAM,QAAQ;EAAO,SAAS;EAAa,CAAC;AAE3D,uBAAsB,MAAM;EAAC,GAAG;EAAW,GAAG;EAAS,GAAG;EAAU,CAAC;;;AAIvE,SAAgB,mBACd,MACA,MAGA;AAYA,MAAK,MAAM,SAX0D;EACnE;GACE,UAAU;GACV,MAAM;GACP;EACD;GAAE,UAAU;GAAmB,MAAM;GAAgC;EACrE;GAAE,UAAU;GAAY,MAAM;GAAyB;EACvD;GAAE,UAAU;GAAmB,MAAM;GAAgC;EACrE;GAAE,UAAU;GAAgB,MAAM;GAA6B;EAChE,CAGC,MAAK,MAAM;EACT,MAAM,MAAM;EACZ,QAAQ;EACR,SAAS,kBAAkB,YAAY;GACrC,MAAM,SAAS,KAAK,YAAY,MAAM,SAAS;AAC/C,OAAI,WAAW,KACb,QAAO,IAAI,SAAS,MAAM,EAAE,QAAQ,KAAK,CAAC;AAE5C,UAAO,IAAI,SAAS,OAAO,MAAM;IAC/B,QAAQ,OAAO;IACf,SAAS,OAAO;IACjB,CAAC;IACF;EACH,CAAC;;;;;;;AASN,SAAgB,cACd,MACA,MAQA;CACA,MAAM,YAAY,KAAK,aAAa;CACpC,MAAM,cAAc,cAAc,KAAK,KAAK;AAC5C,MAAK,MAAM;EACT,YAAY,GAAG,YAAY;EAC3B,QAAQ;EACR,SAAS,kBAAkB,KAAK,aAAa;EAC9C,CAAC;CAEF,MAAM,kBAAkB,kBAAkB,KAAK,eAAe;AAE9D,MAAK,MAAM;EACT,YAAY,GAAG,YAAY;EAC3B,QAAQ;EACR,SAAS;EACV,CAAC;AAEF,MAAK,MAAM;EACT,YAAY,GAAG,YAAY;EAC3B,QAAQ;EACR,SAAS;EACV,CAAC;;;;;;;;;;;AAYJ,SAAgB,uBACd,MACA,MAaA;CACA,MAAM,OAAO,KAAK,aAAa;CAC/B,MAAM,gBAAgB,GAAG,KAAK;CAC9B,MAAM,YAAY,GAAG,KAAK;CAC1B,MAAM,eAAe,GAAG,KAAK;CAC7B,MAAM,eAAe,GAAG,aAAa;AAErC,MAAK,MAAM;EACT,MAAM;EACN,QAAQ;EACR,SAAS,kBAAkB,SAAS,KAAK,gBAAgB,CAAC;EAC3D,CAAC;AACF,MAAK,MAAM;EACT,MAAM;EACN,QAAQ;EACR,SAAS,kBAAkB,SAAS,KAAK,YAAY,CAAC;EACvD,CAAC;AACF,MAAK,MAAM;EACT,MAAM;EACN,QAAQ;EACR,SAAS,kBAAkB,SAAS,KAAK,eAAe,CAAC;EAC1D,CAAC;AACF,MAAK,MAAM,UAAU;EAAC;EAAO;EAAO;EAAS,CAC3C,MAAK,MAAM;EACT,YAAY;EACZ;EACA,SAAS,kBAAkB,SAAS,KAAK,aAAa,CAAC;EACxD,CAAC;AAEJ,MAAK,MAAM;EAAE,YAAY;EAAc,QAAQ;EAAW,SAAS;EAAsB,CAAC;AAC1F,uBAAsB,MAAM;EAAC;EAAe;EAAW;EAAa,CAAC;;;;;;;;;;AAWvE,SAAgB,oBACd,MACA,MA4CA;CACA,MAAM,cAAc,GAAG,KAAK,UAAU;CACtC,MAAM,yBAAyB,KAAK,gCACzB;AACL,MAAI,eAAe,KAAK,KAAK,uBAAuB,CAClD,QAAO,IAAI,IAAI,KAAK,uBAAuB,CAAC;AAE9C,SAAO,KAAK,uBAAuB,WAAW,IAAI,GAC9C,KAAK,yBACL,IAAI,KAAK;KACX,GACJ;AAEJ,KAAI,wBAAwB;AAC1B,OAAK,MAAM;GACT,MAAM;GACN,QAAQ;GACR,SAAS,kBACP,KAAK,wBAAwB,KAAK,OAAO,KAAK,YAC5C,KAAK,yBAAyB,KAAK,QAAQ,CAC5C,CACF;GACF,CAAC;AAEF,OAAK,MAAM;GACT,MAAM;GACN,QAAQ;GACR,SAAS,kBACP,KAAK,wBAAwB,KAAK,OAAO,KAAK,YAC5C,KAAK,yBAAyB,KAAK,QAAQ,CAC5C,CACF;GACF,CAAC;;CAQJ,MAAM,aAA+B,KAAK,YAAY,KAAK,kBAAkB,KAAK,QAAQ;CAE1F,MAAM,wBACJ,OACA,aAC4B;EAC5B,MAAM,WAAW,OAAO,KAAK;AAC7B,MAAI,CAAC,SAAS,aAAa,OAAW,QAAO;EAC7C,MAAM,MACJ,MAAM,aAAa,SACf,aAAa,OACX,YACA,OACF,MAAM,KAAK,WAAW,IACpB,GAAG,MAAM,SAAS,GAAG,aACrB;AACR,SAAO,MAAO,SAAS,QAAQ,OAAQ;;CAGzC,MAAM,0BAA0B,aAC9B,kBACE,KAAK,wBAAwB,KAAK,OAAO,KAAK,YAAY;EACxD,MAAM,QAAQ,4BAA4B,IAAI,IAAI,QAAQ,IAAI,CAAC,UAAU,KAAK,UAAU;EACxF,MAAM,UAAU,qBAAqB,OAAO,SAAS;AACrD,MAAI,CAAC,WAAW,CAAC,MACf,OAAM,IAAI,YAAY;GACpB,MAAM,UAAU;GAChB,SAAS;GACV,CAAC;AAEJ,SAAO,MAAM,QAAQ,KAAK,SAAS,MAAM;GACzC,CACH;AAEH,MAAK,MAAM;EACT,YAAY;EACZ,QAAQ;EACR,SAAS,uBAAuB;GAC9B,iBAAiB,KAAK;GACtB,eAAe,KAAK;GACpB,YAAY,KAAK;GACjB,YAAY,KAAK;GACjB,eAAe,KAAK;GACpB,iBAAiB,KAAK;GACtB,WAAW;GACZ,CAAC;EACH,CAAC;AAEF,MAAK,MAAM;EACT,YAAY;EACZ,QAAQ;EACR,SAAS,uBAAuB;GAC9B,YAAY,KAAK;GACjB,YAAY,KAAK;GACjB,iBAAiB,KAAK;GACtB,WAAW;GACZ,CAAC;EACH,CAAC;AAEF,MAAK,MAAM;EACT,YAAY;EACZ,QAAQ;EACR,SAAS,uBAAuB,EAC9B,WAAW,WACZ,CAAC;EACH,CAAC;AAEF,MAAK,MAAM,UAAU,CAAC,SAAS,SAAS,CACtC,MAAK,MAAM;EACT,YAAY;EACZ;EACA,SAAS,kBAAkB,OAAO,KAAK,YAAY;GACjD,MAAM,QAAQ,4BAA4B,IAAI,IAAI,QAAQ,IAAI,CAAC,UAAU,KAAK,UAAU;AACxF,OAAI,CAAC,SAAS,MAAM,aAAa,UAAU,MAAM,KAAK,OAAO,KAC3D,QAAO,KAAK,UAAU,KAAK,YAAY,2BAA2B;AAEpE,UAAO,MAAM,KAAK,kBAAkB,KAAK,QAAQ;IACjD;EACH,CAAC"}
+{"version":3,"file":"http.js","names":["parseCookies"],"sources":["../../src/server/http.ts"],"sourcesContent":["import {\n  GenericActionCtx,\n  GenericDataModel,\n  HttpRouter,\n  UserIdentity,\n  httpActionGeneric,\n} from \"convex/server\";\nimport { ConvexError, type GenericId } from \"convex/values\";\nimport { parse as parseCookies } from \"cookie\";\n\nimport { ErrorCode } from \"../shared/codes\";\nimport {\n  buildCorsHeaders,\n  corsPreflightHandler,\n  corsPreflightResponse,\n  registerCorsPreflight,\n  withCors,\n} from \"./cors\";\nimport type { AuthContext, OptionalAuthContext } from \"./auth\";\nimport type { UserDoc } from \"./context\";\nimport type { ComponentCtx, ComponentReadCtx as HttpQueryCtx } from \"./component/context\";\nimport {\n  createUnauthenticatedAuthContext,\n  getAuthContext,\n  getAuthContextForUser,\n  type AuthLike,\n} from \"./context\";\nimport { logError } from \"./log\";\nimport { verifyOAuthToken } from \"./tokens\";\nimport type { CorsConfig, HttpKeyContext } from \"./types\";\nimport { extractBearerToken } from \"./utils/bearer\";\nimport type { WellKnownEndpoint, WellKnownResponse } from \"./wellknown\";\n\ntype HttpIdentityCtx = {\n  auth: {\n    getUserIdentity: () => Promise<UserIdentity | null>;\n  };\n};\ntype HttpContextCtx = HttpIdentityCtx & HttpQueryCtx;\n\ntype HttpContextAuthLike = AuthLike & {\n  key: {\n    verify: (\n      ctx: ComponentCtx,\n      args: { secret: string },\n    ) => Promise<{\n      userId: GenericId<\"User\">;\n      keyId: GenericId<\"ApiKey\">;\n      scopes: HttpKeyContext[\"key\"][\"scopes\"];\n    }>;\n  };\n};\n\ntype HttpContextRuntimeOptions = {\n  issuer?: () => string;\n};\n\n/**\n * Auth context returned by `auth.request.context(ctx, request)`.\n *\n * This resolves raw HTTP authentication in two steps:\n * 1. session auth from `ctx.auth.getUserIdentity()`\n * 2. API key auth from `Authorization: Bearer sk_*`\n *\n * The `source` field tells you which authentication path succeeded.\n * When `source === \"key\"`, the verified API key metadata is available on\n * `key`.\n *\n * @example\n * ```ts\n * const authContext = await auth.request.context(ctx, request);\n * if (authContext.source === \"key\") {\n *   console.log(authContext.key.keyId);\n * }\n * ```\n */\nexport type HttpAuthContext =\n  | (AuthContext & {\n      /** The request authenticated through a browser or session token. */\n      source: \"session\";\n      /** No API key was used for this request. */\n      key: null;\n      oauth: null;\n    })\n  | (AuthContext & {\n      /** The request authenticated through an API key. */\n      source: \"key\";\n      /** Verified API key metadata for the request. */\n      key: HttpKeyContext[\"key\"];\n      oauth: null;\n    })\n  | (AuthContext & {\n      source: \"oauth\";\n      key: null;\n      oauth: { clientId: string; scopes: string[] };\n    });\n\n/**\n * Nullable HTTP auth context returned by\n * `auth.request.context.optional(ctx, request)`.\n *\n * This preserves a stable auth-shaped object for raw `httpAction` handlers\n * that allow anonymous callers.\n */\nexport type OptionalHttpAuthContext =\n  | (OptionalAuthContext & {\n      /** No authentication source was resolved. */\n      source: null;\n      /** No API key metadata is available. */\n      key: null;\n      oauth: null;\n    })\n  | HttpAuthContext;\n\n/**\n * Configuration for {@link defineAuth().request.context}.\n *\n * This mirrors {@link AuthContextConfig} for raw HTTP handlers and adds support\n * for enriching mixed session/API-key auth results.\n *\n * @typeParam TResolve - Extra fields returned from `resolve()` and merged into\n *   the resolved HTTP auth context.\n *\n * @example\n * ```ts\n * const authContext = await auth.request.context(ctx, request, {\n *   resolve: async (_ctx, user, authState) => ({\n *     email: user.email,\n *     isMachineRequest: authState.source === \"key\",\n *   }),\n * });\n * ```\n */\nexport type HttpAuthContextConfig<\n  TResolve extends Record<string, unknown> = Record<string, never>,\n  TCtx extends HttpContextCtx = HttpContextCtx,\n> = {\n  /**\n   * Attach additional derived fields to the resolved HTTP auth context.\n   *\n   * This callback runs only when authentication succeeds.\n   */\n  resolve?: (ctx: TCtx, user: UserDoc, auth: HttpAuthContext) => Promise<TResolve> | TResolve;\n  /**\n   * Override or wrap HTTP auth resolution.\n   *\n   * Return `undefined` to use the built-in session-or-key resolver, `null` for\n   * an explicit unauthenticated state, or a fully resolved\n   * {@link HttpAuthContext}.\n   */\n  authResolve?: (\n    ctx: TCtx,\n    fallback: () => Promise<HttpAuthContext | null>,\n  ) => Promise<HttpAuthContext | null | undefined> | HttpAuthContext | null | undefined;\n  /**\n   * RFC 8707 resource assertion (opt-in). When set, an OAuth `at+jwt` bearer is\n   * only accepted on this route if its `resource` claim equals this value — so a\n   * token minted for a different protected resource is not honored here. Omit it\n   * (the default) to accept any valid OAuth identity; capability is still bounded\n   * by scope grant-intersection regardless. The `/mcp` route sets this to its\n   * canonical resource.\n   */\n  resource?: string;\n};\n\nfunction createNotSignedInError() {\n  return new ConvexError({\n    code: ErrorCode.NOT_SIGNED_IN,\n    message: \"Authentication required.\",\n  });\n}\n\n/** A `{ code, message }` error body for the non-OAuth JSON HTTP surface. */\nexport type JsonErrorBody = { code: string; message: string };\n\nfunction isJsonErrorBody(value: unknown): value is JsonErrorBody {\n  if (typeof value !== \"object\" || value === null) return false;\n  if (!(\"code\" in value) || !(\"message\" in value)) return false;\n  return typeof value.code === \"string\" && typeof value.message === \"string\";\n}\n\n/**\n * Extract a `{ code, message }` body from a thrown value for the non-OAuth JSON\n * HTTP surface. A structured `ConvexError` carrying `code`/`message` is surfaced\n * verbatim; anything else collapses to an opaque `INTERNAL_ERROR`.\n */\nexport function convexErrorToBody(error: unknown): JsonErrorBody {\n  if (error instanceof ConvexError && isJsonErrorBody(error.data)) return error.data;\n  return { code: ErrorCode.INTERNAL_ERROR, message: \"An unexpected error occurred.\" };\n}\n\n/**\n * Build a JSON error `Response` for the non-OAuth HTTP surface, in the single\n * `{ code, message }` shape. OAuth wire endpoints use the RFC 6749\n * `{ error, error_description }` shape instead (see `oauth/*`).\n */\nexport function jsonError(\n  status: number,\n  body: JsonErrorBody,\n  extraHeaders?: Record<string, string>,\n): Response {\n  return new Response(JSON.stringify(body), {\n    status,\n    headers: { \"Content-Type\": \"application/json\", ...extraHeaders },\n  });\n}\n\nasync function getHttpKeyContext(\n  auth: HttpContextAuthLike,\n  ctx: HttpContextCtx,\n  request: Request,\n): Promise<HttpAuthContext | null> {\n  const token = extractBearerToken(request);\n  if (token === null || !token.startsWith(\"sk_\")) {\n    return null;\n  }\n\n  try {\n    /**\n     * The `Bearer sk_*` branch only runs inside an HTTP action, where the\n     * resolved `ctx` additionally carries the `runMutation` that `key.verify`\n     * needs. The HTTP-context surface is otherwise query-shaped, so this one\n     * narrow assertion supplies that single missing member at the boundary.\n     */\n    const keyVerifyCtx: ComponentCtx = ctx as HttpContextCtx & Pick<ComponentCtx, \"runMutation\">;\n    const verified = await auth.key.verify(keyVerifyCtx, {\n      secret: token,\n    });\n    const authContext = await getAuthContextForUser(auth, ctx, verified.userId);\n    return {\n      ...authContext,\n      source: \"key\",\n      key: {\n        userId: verified.userId,\n        keyId: verified.keyId,\n        scopes: verified.scopes,\n      },\n      oauth: null,\n    };\n  } catch (err) {\n    console.error(\"[auth] HTTP key verification failed\", { err });\n    return null;\n  }\n}\n\nasync function getHttpOAuthContext(\n  auth: HttpContextAuthLike,\n  ctx: HttpContextCtx,\n  request: Request,\n  resource: string | undefined,\n  issuer: string | undefined,\n): Promise<HttpAuthContext | null> {\n  const token = extractBearerToken(request);\n  if (token === null || token.startsWith(\"sk_\")) return null;\n  const tokenOptions: NonNullable<Parameters<typeof verifyOAuthToken>[1]> = {};\n  if (issuer !== undefined) tokenOptions.issuer = issuer;\n  if (resource !== undefined) tokenOptions.resource = resource;\n  const oauthPayload = await verifyOAuthToken(token, tokenOptions);\n  if (!oauthPayload) return null;\n  try {\n    const authContext = await getAuthContextForUser(\n      auth,\n      ctx,\n      oauthPayload.userId,\n      oauthPayload.scopes,\n    );\n    return {\n      ...authContext,\n      source: \"oauth\",\n      key: null,\n      oauth: { clientId: oauthPayload.clientId, scopes: oauthPayload.scopes },\n    };\n  } catch {\n    return null;\n  }\n}\n\nasync function resolveHttpAuthContext(\n  auth: HttpContextAuthLike,\n  ctx: HttpContextCtx,\n  request: Request,\n  resource: string | undefined,\n  issuer: string | undefined,\n): Promise<HttpAuthContext | null> {\n  const oauthContext = await getHttpOAuthContext(auth, ctx, request, resource, issuer);\n  if (oauthContext !== null) return oauthContext;\n\n  const sessionContext = await getAuthContext(auth, ctx);\n  if (sessionContext !== null) {\n    return {\n      ...sessionContext,\n      source: \"session\",\n      key: null,\n      oauth: null,\n    };\n  }\n\n  return await getHttpKeyContext(auth, ctx, request);\n}\n\n/**\n * Resolver for `auth.request.context(ctx, request, config?)`.\n *\n * Authentication sources are tried in a fixed order: OAuth access tokens\n * first (an `at+jwt` bearer is also a valid Convex identity, so it must be\n * classified as `oauth` before the session branch would claim it), then the\n * session identity, then `Bearer sk_*` API keys. Session therefore takes\n * precedence over an API key when both are present.\n */\nexport interface HttpContextResolver {\n  <\n    TResolve extends Record<string, unknown> = Record<string, never>,\n    TCtx extends HttpContextCtx = HttpContextCtx,\n  >(\n    ctx: TCtx,\n    request: Request,\n    config?: HttpAuthContextConfig<TResolve, TCtx>,\n  ): Promise<HttpAuthContext & TResolve>;\n}\n\n/**\n * Nullable variant for `auth.request.context.optional(ctx, request, config?)`.\n */\nexport interface OptionalHttpContextResolver {\n  <\n    TResolve extends Record<string, unknown> = Record<string, never>,\n    TCtx extends HttpContextCtx = HttpContextCtx,\n  >(\n    ctx: TCtx,\n    request: Request,\n    config?: HttpAuthContextConfig<TResolve, TCtx>,\n  ): Promise<OptionalHttpAuthContext & TResolve>;\n}\n\nasync function resolveHttpContext(\n  auth: HttpContextAuthLike,\n  ctx: HttpContextCtx,\n  request: Request,\n  config: HttpAuthContextConfig<Record<string, unknown>> | undefined,\n  optional: boolean,\n  options: HttpContextRuntimeOptions,\n) {\n  const fallback = () =>\n    resolveHttpAuthContext(auth, ctx, request, config?.resource, options.issuer?.());\n  const authOverride = config?.authResolve ? await config.authResolve(ctx, fallback) : undefined;\n  const resolved = authOverride === undefined ? await fallback() : authOverride;\n\n  if (resolved === null) {\n    if (!optional) {\n      throw createNotSignedInError();\n    }\n    return {\n      ...createUnauthenticatedAuthContext(),\n      source: null,\n      key: null,\n      oauth: null,\n    };\n  }\n\n  const extra = config?.resolve ? await config.resolve(ctx, resolved.user, resolved) : {};\n\n  return {\n    ...resolved,\n    ...extra,\n  };\n}\n\n/**\n * @internal\n * Create the implementation behind `auth.request.context(...)` and\n * `auth.request.context.optional(...)`.\n *\n * The two assertions below bind a concrete (monomorphic) closure to the\n * generic call-signature interfaces {@link HttpContextResolver} /\n * {@link OptionalHttpContextResolver}; TypeScript cannot infer those generics\n * from a non-generic body, so the typed assertion is the irreducible bridge.\n */\nexport function createHttpContext(\n  auth: HttpContextAuthLike,\n  options: HttpContextRuntimeOptions = {},\n): HttpContextResolver & { optional: OptionalHttpContextResolver } {\n  const required = ((\n    ctx: HttpContextCtx,\n    request: Request,\n    config?: HttpAuthContextConfig<Record<string, unknown>>,\n  ) => resolveHttpContext(auth, ctx, request, config, false, options)) as HttpContextResolver & {\n    optional: OptionalHttpContextResolver;\n  };\n\n  required.optional = ((\n    ctx: HttpContextCtx,\n    request: Request,\n    config?: HttpAuthContextConfig<Record<string, unknown>>,\n  ) =>\n    resolveHttpContext(auth, ctx, request, config, true, options)) as OptionalHttpContextResolver;\n\n  return required;\n}\n\n/**\n * Build the Bearer-key HTTP action wrapper behind `auth.request.action(...)`.\n *\n * Returns a function that wraps a handler with `Authorization: Bearer sk_*`\n * verification, optional scope checks, CORS headers, and JSON error envelopes.\n *\n * @param auth - Provides `key.verify` for API key verification.\n * @param defaultOrigins - Allowed CORS origins (or a getter) used when a route\n *   supplies no `cors` config.\n */\nexport function createHttpAction(\n  auth: {\n    key: {\n      verify: (\n        ctx: GenericActionCtx<GenericDataModel>,\n        args: { secret: string },\n      ) => Promise<{\n        userId: GenericId<\"User\">;\n        keyId: GenericId<\"ApiKey\">;\n        scopes: HttpKeyContext[\"key\"][\"scopes\"];\n      }>;\n    };\n  },\n  defaultOrigins: string[] | (() => string[]),\n) {\n  return (\n    handler: (\n      ctx: GenericActionCtx<GenericDataModel> & HttpKeyContext,\n      request: Request,\n    ) => Promise<Response | Record<string, unknown>>,\n    options?: {\n      scope?: { resource: string; action: string };\n      cors?: CorsConfig;\n    },\n  ) => {\n    return httpActionGeneric(async (genericCtx, request) => {\n      const corsHeaders = buildCorsHeaders(request, options?.cors, defaultOrigins);\n\n      try {\n        const rawKey = extractBearerToken(request);\n        if (rawKey === null) {\n          return jsonError(\n            401,\n            {\n              code: ErrorCode.MISSING_BEARER_TOKEN,\n              message: \"Missing or malformed Authorization: Bearer header.\",\n            },\n            corsHeaders,\n          );\n        }\n\n        let keyResult:\n          | {\n              ok: true;\n              value: {\n                userId: GenericId<\"User\">;\n                keyId: GenericId<\"ApiKey\">;\n                scopes: HttpKeyContext[\"key\"][\"scopes\"];\n              };\n            }\n          | { ok: false; error: unknown };\n        try {\n          const value = await auth.key.verify(genericCtx, { secret: rawKey });\n          keyResult = { ok: true, value };\n        } catch (error) {\n          keyResult = { ok: false, error };\n        }\n\n        if (!keyResult.ok) {\n          if (\n            keyResult.error instanceof ConvexError &&\n            typeof keyResult.error.data === \"object\" &&\n            keyResult.error.data !== null &&\n            \"code\" in keyResult.error.data &&\n            \"message\" in keyResult.error.data\n          ) {\n            return jsonError(403, convexErrorToBody(keyResult.error), corsHeaders);\n          }\n          throw keyResult.error;\n        }\n\n        if (\n          options?.scope &&\n          !keyResult.value.scopes.can(options.scope.resource, options.scope.action)\n        ) {\n          return jsonError(\n            403,\n            {\n              code: ErrorCode.SCOPE_CHECK_FAILED,\n              message: \"This API key does not have the required permissions.\",\n            },\n            corsHeaders,\n          );\n        }\n\n        const enrichedCtx = Object.assign(genericCtx, {\n          key: {\n            userId: keyResult.value.userId,\n            keyId: keyResult.value.keyId,\n            scopes: keyResult.value.scopes,\n          },\n        });\n        const result = await handler(enrichedCtx, request);\n\n        return result instanceof Response\n          ? (() => {\n              const headers = new Headers(result.headers);\n              for (const [k, val] of Object.entries(corsHeaders)) {\n                if (!headers.has(k)) headers.set(k, val);\n              }\n              return new Response(result.body, {\n                status: result.status,\n                statusText: result.statusText,\n                headers,\n              });\n            })()\n          : new Response(JSON.stringify(result), {\n              status: 200,\n              headers: {\n                ...corsHeaders,\n                \"Content-Type\": \"application/json\",\n              },\n            });\n      } catch (error) {\n        logError(error);\n        return jsonError(\n          500,\n          { code: ErrorCode.INTERNAL_ERROR, message: \"An unexpected error occurred.\" },\n          corsHeaders,\n        );\n      }\n    });\n  };\n}\n\n/**\n * Build the route registrar behind `auth.request.route(...)`.\n *\n * Returns a function that registers a Bearer-authenticated route plus its\n * matching `OPTIONS` CORS preflight in one call.\n *\n * @param wrapAction - The wrapper produced by {@link createHttpAction}.\n * @param defaultOrigins - Allowed CORS origins (or a getter) for the preflight.\n */\nexport function createHttpRoute(\n  wrapAction: ReturnType<typeof createHttpAction>,\n  defaultOrigins: string[] | (() => string[]),\n) {\n  return (\n    http: { route: (config: unknown) => void },\n    routeConfig: {\n      path: string;\n      method: \"GET\" | \"POST\" | \"PUT\" | \"PATCH\" | \"DELETE\";\n      handler: (\n        ctx: GenericActionCtx<GenericDataModel> & HttpKeyContext,\n        request: Request,\n      ) => Promise<Response | Record<string, unknown>>;\n      scope?: { resource: string; action: string };\n      cors?: CorsConfig;\n    },\n  ) => {\n    http.route({\n      path: routeConfig.path,\n      method: \"OPTIONS\",\n      handler: httpActionGeneric(async (_ctx, request) =>\n        corsPreflightResponse(request, routeConfig.cors, defaultOrigins),\n      ),\n    });\n\n    http.route({\n      path: routeConfig.path,\n      method: routeConfig.method,\n      handler: wrapAction(routeConfig.handler, {\n        scope: routeConfig.scope,\n        cors: routeConfig.cors,\n      }),\n    });\n  };\n}\n\n/**\n * Wrap an HTTP action so thrown `ConvexError`s become JSON error responses.\n *\n * Structured `{ code, message }` errors return `errorStatusCode`; other\n * `ConvexError`s return that status with a plain status text; any other error\n * is logged and returns a 500.\n *\n * @param errorStatusCode - Status used for `ConvexError`s.\n * @param action - The wrapped HTTP action.\n */\nexport function convertErrorsToResponse(\n  errorStatusCode: number,\n  action: (ctx: GenericActionCtx<GenericDataModel>, request: Request) => Promise<Response>,\n) {\n  return async (ctx: GenericActionCtx<GenericDataModel>, request: Request) => {\n    try {\n      return await action(ctx, request);\n    } catch (error) {\n      if (\n        error instanceof ConvexError &&\n        typeof error.data === \"object\" &&\n        error.data !== null &&\n        \"code\" in error.data &&\n        \"message\" in error.data\n      ) {\n        return jsonError(errorStatusCode, convexErrorToBody(error));\n      }\n      if (error instanceof ConvexError) {\n        return new Response(null, {\n          status: errorStatusCode,\n          statusText: typeof error.data === \"string\" ? error.data : \"Error\",\n        });\n      }\n      logError(error);\n      return new Response(null, {\n        status: 500,\n        statusText: \"Internal Server Error\",\n      });\n    }\n  };\n}\n\n/** Parse the request's `Cookie` header into a name-to-value record. */\nexport function getCookies(request: Request): Record<string, string | undefined> {\n  return parseCookies(request.headers.get(\"Cookie\") ?? \"\");\n}\n\n/** Parsed group connection runtime route: connection id, protocol, and remaining path segments. */\nexport type ConnectionRuntimeRoute = {\n  pathname?: string;\n  connectionId: string;\n  protocol: \"oidc\" | \"saml\" | \"scim\";\n  rest: string[];\n};\n\nfunction parseConnectionRuntimeRoute(\n  pathname: string,\n  routeBase: string,\n): ConnectionRuntimeRoute | null {\n  const runtimePrefix = `${routeBase}/`;\n  const runtimeParts = pathname.startsWith(runtimePrefix)\n    ? pathname.slice(runtimePrefix.length).split(\"/\").filter(Boolean)\n    : [];\n  const [runtimeConnectionId, protocol, ...rest] = runtimeParts;\n  if (\n    runtimeConnectionId === undefined ||\n    (protocol !== \"oidc\" && protocol !== \"saml\" && protocol !== \"scim\") ||\n    rest.length === 0\n  ) {\n    return null;\n  }\n  return {\n    pathname,\n    connectionId: runtimeConnectionId,\n    protocol,\n    rest,\n  };\n}\n\n/**\n * Register the OpenID discovery and JWKS endpoints on an HTTP router.\n *\n * Adds `<routeBase>/.well-known/openid-configuration` and\n * `<routeBase>/.well-known/jwks.json`. OAuth-specific discovery fields are\n * included only when `deps.oauth` is provided.\n *\n * Discovery is served at both the issuer prefix and the root, including the\n * RFC 8414 `oauth-authorization-server` path conventions, because clients\n * treat either the issuer (`/auth`) or the origin as the base. These exact\n * routes win over the static-hosting catch-all, so zero-config\n * `mcp login <url>` resolves to JSON rather than the SPA HTML fallback.\n */\nexport function addOpenIdRoutes(\n  http: HttpRouter,\n  deps: {\n    getIssuer: () => string;\n    getJwks: () => string;\n    routeBase?: string;\n    oauth?: {\n      scopes?: string[];\n    };\n  },\n) {\n  const cacheControl = \"public, max-age=15, stale-while-revalidate=15, stale-if-error=86400\";\n  const routeBase = deps.routeBase ?? \"\";\n\n  const buildMetadata = () => {\n    const issuer = deps.getIssuer();\n    const body: Record<string, unknown> = {\n      issuer,\n      jwks_uri: `${issuer}/.well-known/jwks.json`,\n    };\n    if (deps.oauth) {\n      body.authorization_endpoint = `${issuer}/oauth2/authorize`;\n      body.token_endpoint = `${issuer}/oauth2/token`;\n      body.registration_endpoint = `${issuer}/oauth2/register`;\n      body.response_types_supported = [\"code\"];\n      body.grant_types_supported = [\"authorization_code\", \"refresh_token\", \"client_credentials\"];\n      body.code_challenge_methods_supported = [\"S256\"];\n      body.token_endpoint_auth_methods_supported = [\n        \"client_secret_post\",\n        \"client_secret_basic\",\n        \"none\",\n      ];\n      body.scopes_supported = deps.oauth.scopes ?? [\"openid\", \"profile\", \"email\", \"offline_access\"];\n    }\n    return body;\n  };\n\n  const metadataHandler = httpActionGeneric(\n    withCors(async () => {\n      return new Response(JSON.stringify(buildMetadata()), {\n        status: 200,\n        headers: { \"Content-Type\": \"application/json\", \"Cache-Control\": cacheControl },\n      });\n    }),\n  );\n\n  const jwksHandler = httpActionGeneric(\n    withCors(async () => {\n      return new Response(deps.getJwks(), {\n        status: 200,\n        headers: { \"Content-Type\": \"application/json\", \"Cache-Control\": cacheControl },\n      });\n    }),\n  );\n\n  const oidcPaths = new Set<string>([\n    `${routeBase}/.well-known/openid-configuration`,\n    \"/.well-known/openid-configuration\",\n  ]);\n  const asPaths = deps.oauth\n    ? new Set<string>([\n        `/.well-known/oauth-authorization-server${routeBase}`,\n        `${routeBase}/.well-known/oauth-authorization-server`,\n        \"/.well-known/oauth-authorization-server\",\n      ])\n    : new Set<string>();\n  const jwksPaths = new Set<string>([\n    `${routeBase}/.well-known/jwks.json`,\n    \"/.well-known/jwks.json\",\n  ]);\n\n  for (const path of [...oidcPaths, ...asPaths]) {\n    http.route({ path, method: \"GET\", handler: metadataHandler });\n  }\n  for (const path of jwksPaths) {\n    http.route({ path, method: \"GET\", handler: jwksHandler });\n  }\n  registerCorsPreflight(http, [...oidcPaths, ...asPaths, ...jwksPaths]);\n}\n\n/** Register root `/.well-known/*` app discovery routes on an HTTP router. */\nexport function addWellKnownRoutes(\n  http: HttpRouter,\n  deps: {\n    getResponse: (endpoint: WellKnownEndpoint) => WellKnownResponse | null;\n  },\n) {\n  const routes: Array<{ endpoint: WellKnownEndpoint; path: string }> = [\n    {\n      endpoint: \"apple-app-site-association\",\n      path: \"/.well-known/apple-app-site-association\",\n    },\n    { endpoint: \"assetlinks.json\", path: \"/.well-known/assetlinks.json\" },\n    { endpoint: \"webauthn\", path: \"/.well-known/webauthn\" },\n    { endpoint: \"change-password\", path: \"/.well-known/change-password\" },\n    { endpoint: \"security.txt\", path: \"/.well-known/security.txt\" },\n  ];\n\n  for (const route of routes) {\n    http.route({\n      path: route.path,\n      method: \"GET\",\n      handler: httpActionGeneric(async () => {\n        const result = deps.getResponse(route.endpoint);\n        if (result === null) {\n          return new Response(null, { status: 404 });\n        }\n        return new Response(result.body, {\n          status: result.status,\n          headers: result.headers,\n        });\n      }),\n    });\n  }\n}\n\n/**\n * Register the OAuth sign-in and callback routes on an HTTP router.\n *\n * Adds `GET <routeBase>/signin/*` and `GET`/`POST <routeBase>/callback/*`.\n */\nexport function addAuthRoutes(\n  http: HttpRouter,\n  deps: {\n    handleSignIn: (ctx: GenericActionCtx<GenericDataModel>, request: Request) => Promise<Response>;\n    handleCallback: (\n      ctx: GenericActionCtx<GenericDataModel>,\n      request: Request,\n    ) => Promise<Response>;\n    routeBase?: string;\n  },\n) {\n  const routeBase = deps.routeBase ?? \"/api/auth\";\n  const routePrefix = routeBase === \"\" ? \"\" : routeBase;\n  http.route({\n    pathPrefix: `${routePrefix}/signin/`,\n    method: \"GET\",\n    handler: httpActionGeneric(deps.handleSignIn),\n  });\n\n  const callbackHandler = httpActionGeneric(deps.handleCallback);\n\n  http.route({\n    pathPrefix: `${routePrefix}/callback/`,\n    method: \"GET\",\n    handler: callbackHandler,\n  });\n\n  http.route({\n    pathPrefix: `${routePrefix}/callback/`,\n    method: \"POST\",\n    handler: callbackHandler,\n  });\n}\n\n/**\n * Register the OAuth provider authorize, token, registration, and RFC 7592\n * client-management endpoints on an HTTP router.\n *\n * Adds `GET <base>/oauth2/authorize`, `POST <base>/oauth2/token`,\n * `POST <base>/oauth2/register` (DCR), and `GET`/`PUT`/`DELETE`\n * `<base>/oauth2/register/<client_id>` (management). The exact `register` path\n * serves DCR; the `register/` prefix serves per-client management.\n */\nexport function addOAuthProviderRoutes(\n  http: HttpRouter,\n  deps: {\n    handleAuthorize: (\n      ctx: GenericActionCtx<GenericDataModel>,\n      request: Request,\n    ) => Promise<Response>;\n    handleToken: (ctx: GenericActionCtx<GenericDataModel>, request: Request) => Promise<Response>;\n    handleRegister: (\n      ctx: GenericActionCtx<GenericDataModel>,\n      request: Request,\n    ) => Promise<Response>;\n    handleManage: (ctx: GenericActionCtx<GenericDataModel>, request: Request) => Promise<Response>;\n    routeBase?: string;\n  },\n) {\n  const base = deps.routeBase ?? \"\";\n  const authorizePath = `${base}/oauth2/authorize`;\n  const tokenPath = `${base}/oauth2/token`;\n  const registerPath = `${base}/oauth2/register`;\n  const managePrefix = `${registerPath}/`;\n\n  http.route({\n    path: authorizePath,\n    method: \"GET\",\n    handler: httpActionGeneric(withCors(deps.handleAuthorize)),\n  });\n  http.route({\n    path: tokenPath,\n    method: \"POST\",\n    handler: httpActionGeneric(withCors(deps.handleToken)),\n  });\n  http.route({\n    path: registerPath,\n    method: \"POST\",\n    handler: httpActionGeneric(withCors(deps.handleRegister)),\n  });\n  for (const method of [\"GET\", \"PUT\", \"DELETE\"] as const) {\n    http.route({\n      pathPrefix: managePrefix,\n      method,\n      handler: httpActionGeneric(withCors(deps.handleManage)),\n    });\n  }\n  http.route({ pathPrefix: managePrefix, method: \"OPTIONS\", handler: corsPreflightHandler });\n  registerCorsPreflight(http, [authorizePath, tokenPath, registerPath]);\n}\n\n/**\n * Register the group connection runtime routes (SAML, OIDC, SCIM) on a router.\n *\n * Mounts method-specific handlers under `<routeBase>/<connectionId>/<protocol>/...`\n * (plus an optional shared OIDC callback path), dispatching by\n * `${protocol}:${endpoint}` and returning SCIM errors for unmatched\n * `PATCH`/`DELETE` requests.\n */\nexport function addConnectionRoutes(\n  http: HttpRouter,\n  deps: {\n    routeBase: string;\n    sharedOidcCallbackPath?: string;\n    convertErrorsToResponse: typeof convertErrorsToResponse;\n    handleSamlMetadata: (\n      ctx: GenericActionCtx<GenericDataModel>,\n      request: Request,\n      route: ConnectionRuntimeRoute,\n    ) => Promise<Response>;\n    handleSamlSignIn: (\n      ctx: GenericActionCtx<GenericDataModel>,\n      request: Request,\n      route: ConnectionRuntimeRoute,\n    ) => Promise<Response>;\n    handleOidcSignIn: (\n      ctx: GenericActionCtx<GenericDataModel>,\n      request: Request,\n      route: ConnectionRuntimeRoute,\n    ) => Promise<Response>;\n    handleOidcCallback: (\n      ctx: GenericActionCtx<GenericDataModel>,\n      request: Request,\n      route: ConnectionRuntimeRoute,\n    ) => Promise<Response>;\n    handleOidcSharedCallback: (\n      ctx: GenericActionCtx<GenericDataModel>,\n      request: Request,\n    ) => Promise<Response>;\n    handleSamlAcs: (\n      ctx: GenericActionCtx<GenericDataModel>,\n      request: Request,\n      route: ConnectionRuntimeRoute,\n    ) => Promise<Response>;\n    handleSamlSlo: (\n      ctx: GenericActionCtx<GenericDataModel>,\n      request: Request,\n      route: ConnectionRuntimeRoute,\n    ) => Promise<Response>;\n    handleScimRequest: (\n      ctx: GenericActionCtx<GenericDataModel>,\n      request: Request,\n    ) => Promise<Response>;\n    scimError: (status: number, scimType: string, detail: string) => Response;\n  },\n) {\n  const routePrefix = `${deps.routeBase}/`;\n  const sharedOidcCallbackPath = deps.sharedOidcCallbackPath\n    ? (() => {\n        if (/^https?:\\/\\//.test(deps.sharedOidcCallbackPath)) {\n          return new URL(deps.sharedOidcCallbackPath).pathname;\n        }\n        return deps.sharedOidcCallbackPath.startsWith(\"/\")\n          ? deps.sharedOidcCallbackPath\n          : `/${deps.sharedOidcCallbackPath}`;\n      })()\n    : undefined;\n\n  if (sharedOidcCallbackPath) {\n    http.route({\n      path: sharedOidcCallbackPath,\n      method: \"GET\",\n      handler: httpActionGeneric(\n        deps.convertErrorsToResponse(400, async (ctx, request) =>\n          deps.handleOidcSharedCallback(ctx, request),\n        ),\n      ),\n    });\n\n    http.route({\n      path: sharedOidcCallbackPath,\n      method: \"POST\",\n      handler: httpActionGeneric(\n        deps.convertErrorsToResponse(400, async (ctx, request) =>\n          deps.handleOidcSharedCallback(ctx, request),\n        ),\n      ),\n    });\n  }\n\n  type ConnRouteHandler = (\n    ctx: GenericActionCtx<GenericDataModel>,\n    request: Request,\n    route: ConnectionRuntimeRoute,\n  ) => Promise<Response>;\n  const scimRoute: ConnRouteHandler = (ctx, request) => deps.handleScimRequest(ctx, request);\n\n  const matchConnectionRoute = (\n    route: ConnectionRuntimeRoute | null,\n    handlers: Record<string, ConnRouteHandler>,\n  ): ConnRouteHandler | null => {\n    const endpoint = route?.rest[0];\n    if (!route || endpoint === undefined) return null;\n    const key =\n      route.protocol === \"scim\"\n        ? endpoint === \"v2\"\n          ? \"scim:v2\"\n          : null\n        : route.rest.length === 1\n          ? `${route.protocol}:${endpoint}`\n          : null;\n    return key ? (handlers[key] ?? null) : null;\n  };\n\n  const connectionRouteHandler = (handlers: Record<string, ConnRouteHandler>) =>\n    httpActionGeneric(\n      deps.convertErrorsToResponse(400, async (ctx, request) => {\n        const route = parseConnectionRuntimeRoute(new URL(request.url).pathname, deps.routeBase);\n        const handler = matchConnectionRoute(route, handlers);\n        if (!handler || !route) {\n          throw new ConvexError({\n            code: ErrorCode.INVALID_PARAMETERS,\n            message: \"Invalid connection runtime path.\",\n          });\n        }\n        return await handler(ctx, request, route);\n      }),\n    );\n\n  http.route({\n    pathPrefix: routePrefix,\n    method: \"GET\",\n    handler: connectionRouteHandler({\n      \"saml:metadata\": deps.handleSamlMetadata,\n      \"saml:signin\": deps.handleSamlSignIn,\n      \"saml:acs\": deps.handleSamlAcs,\n      \"saml:slo\": deps.handleSamlSlo,\n      \"oidc:signin\": deps.handleOidcSignIn,\n      \"oidc:callback\": deps.handleOidcCallback,\n      \"scim:v2\": scimRoute,\n    }),\n  });\n\n  http.route({\n    pathPrefix: routePrefix,\n    method: \"POST\",\n    handler: connectionRouteHandler({\n      \"saml:acs\": deps.handleSamlAcs,\n      \"saml:slo\": deps.handleSamlSlo,\n      \"oidc:callback\": deps.handleOidcCallback,\n      \"scim:v2\": scimRoute,\n    }),\n  });\n\n  http.route({\n    pathPrefix: routePrefix,\n    method: \"PUT\",\n    handler: connectionRouteHandler({\n      \"scim:v2\": scimRoute,\n    }),\n  });\n\n  for (const method of [\"PATCH\", \"DELETE\"] as const) {\n    http.route({\n      pathPrefix: routePrefix,\n      method,\n      handler: httpActionGeneric(async (ctx, request) => {\n        const route = parseConnectionRuntimeRoute(new URL(request.url).pathname, deps.routeBase);\n        if (!route || route.protocol !== \"scim\" || route.rest[0] !== \"v2\") {\n          return deps.scimError(404, \"notFound\", \"SCIM resource not found.\");\n        }\n        return await deps.handleScimRequest(ctx, request);\n      }),\n    });\n  }\n}\n"],"mappings":";;;;;;;;;;;AAqKA,SAAS,yBAAyB;AAChC,QAAO,IAAI,YAAY;EACrB,MAAM,UAAU;EAChB,SAAS;EACV,CAAC;;AAMJ,SAAS,gBAAgB,OAAwC;AAC/D,KAAI,OAAO,UAAU,YAAY,UAAU,KAAM,QAAO;AACxD,KAAI,EAAE,UAAU,UAAU,EAAE,aAAa,OAAQ,QAAO;AACxD,QAAO,OAAO,MAAM,SAAS,YAAY,OAAO,MAAM,YAAY;;;;;;;AAQpE,SAAgB,kBAAkB,OAA+B;AAC/D,KAAI,iBAAiB,eAAe,gBAAgB,MAAM,KAAK,CAAE,QAAO,MAAM;AAC9E,QAAO;EAAE,MAAM,UAAU;EAAgB,SAAS;EAAiC;;;;;;;AAQrF,SAAgB,UACd,QACA,MACA,cACU;AACV,QAAO,IAAI,SAAS,KAAK,UAAU,KAAK,EAAE;EACxC;EACA,SAAS;GAAE,gBAAgB;GAAoB,GAAG;GAAc;EACjE,CAAC;;AAGJ,eAAe,kBACb,MACA,KACA,SACiC;CACjC,MAAM,QAAQ,mBAAmB,QAAQ;AACzC,KAAI,UAAU,QAAQ,CAAC,MAAM,WAAW,MAAM,CAC5C,QAAO;AAGT,KAAI;;;;;;;EAOF,MAAM,eAA6B;EACnC,MAAM,WAAW,MAAM,KAAK,IAAI,OAAO,cAAc,EACnD,QAAQ,OACT,CAAC;AAEF,SAAO;GACL,GAFkB,MAAM,sBAAsB,MAAM,KAAK,SAAS,OAAO;GAGzE,QAAQ;GACR,KAAK;IACH,QAAQ,SAAS;IACjB,OAAO,SAAS;IAChB,QAAQ,SAAS;IAClB;GACD,OAAO;GACR;UACM,KAAK;AACZ,UAAQ,MAAM,uCAAuC,EAAE,KAAK,CAAC;AAC7D,SAAO;;;AAIX,eAAe,oBACb,MACA,KACA,SACA,UACA,QACiC;CACjC,MAAM,QAAQ,mBAAmB,QAAQ;AACzC,KAAI,UAAU,QAAQ,MAAM,WAAW,MAAM,CAAE,QAAO;CACtD,MAAM,eAAoE,EAAE;AAC5E,KAAI,WAAW,OAAW,cAAa,SAAS;AAChD,KAAI,aAAa,OAAW,cAAa,WAAW;CACpD,MAAM,eAAe,MAAM,iBAAiB,OAAO,aAAa;AAChE,KAAI,CAAC,aAAc,QAAO;AAC1B,KAAI;AAOF,SAAO;GACL,GAPkB,MAAM,sBACxB,MACA,KACA,aAAa,QACb,aAAa,OACd;GAGC,QAAQ;GACR,KAAK;GACL,OAAO;IAAE,UAAU,aAAa;IAAU,QAAQ,aAAa;IAAQ;GACxE;SACK;AACN,SAAO;;;AAIX,eAAe,uBACb,MACA,KACA,SACA,UACA,QACiC;CACjC,MAAM,eAAe,MAAM,oBAAoB,MAAM,KAAK,SAAS,UAAU,OAAO;AACpF,KAAI,iBAAiB,KAAM,QAAO;CAElC,MAAM,iBAAiB,MAAM,eAAe,MAAM,IAAI;AACtD,KAAI,mBAAmB,KACrB,QAAO;EACL,GAAG;EACH,QAAQ;EACR,KAAK;EACL,OAAO;EACR;AAGH,QAAO,MAAM,kBAAkB,MAAM,KAAK,QAAQ;;AAqCpD,eAAe,mBACb,MACA,KACA,SACA,QACA,UACA,SACA;CACA,MAAM,iBACJ,uBAAuB,MAAM,KAAK,SAAS,QAAQ,UAAU,QAAQ,UAAU,CAAC;CAClF,MAAM,eAAe,QAAQ,cAAc,MAAM,OAAO,YAAY,KAAK,SAAS,GAAG;CACrF,MAAM,WAAW,iBAAiB,SAAY,MAAM,UAAU,GAAG;AAEjE,KAAI,aAAa,MAAM;AACrB,MAAI,CAAC,SACH,OAAM,wBAAwB;AAEhC,SAAO;GACL,GAAG,kCAAkC;GACrC,QAAQ;GACR,KAAK;GACL,OAAO;GACR;;CAGH,MAAM,QAAQ,QAAQ,UAAU,MAAM,OAAO,QAAQ,KAAK,SAAS,MAAM,SAAS,GAAG,EAAE;AAEvF,QAAO;EACL,GAAG;EACH,GAAG;EACJ;;;;;;;;;;;;AAaH,SAAgB,kBACd,MACA,UAAqC,EAAE,EAC0B;CACjE,MAAM,aACJ,KACA,SACA,WACG,mBAAmB,MAAM,KAAK,SAAS,QAAQ,OAAO,QAAQ;AAInE,UAAS,aACP,KACA,SACA,WAEA,mBAAmB,MAAM,KAAK,SAAS,QAAQ,MAAM,QAAQ;AAE/D,QAAO;;;;;;;;;;;;AAaT,SAAgB,iBACd,MAYA,gBACA;AACA,SACE,SAIA,YAIG;AACH,SAAO,kBAAkB,OAAO,YAAY,YAAY;GACtD,MAAM,cAAc,iBAAiB,SAAS,SAAS,MAAM,eAAe;AAE5E,OAAI;IACF,MAAM,SAAS,mBAAmB,QAAQ;AAC1C,QAAI,WAAW,KACb,QAAO,UACL,KACA;KACE,MAAM,UAAU;KAChB,SAAS;KACV,EACD,YACD;IAGH,IAAI;AAUJ,QAAI;AAEF,iBAAY;MAAE,IAAI;MAAM,OADV,MAAM,KAAK,IAAI,OAAO,YAAY,EAAE,QAAQ,QAAQ,CAAC;MACpC;aACxB,OAAO;AACd,iBAAY;MAAE,IAAI;MAAO;MAAO;;AAGlC,QAAI,CAAC,UAAU,IAAI;AACjB,SACE,UAAU,iBAAiB,eAC3B,OAAO,UAAU,MAAM,SAAS,YAChC,UAAU,MAAM,SAAS,QACzB,UAAU,UAAU,MAAM,QAC1B,aAAa,UAAU,MAAM,KAE7B,QAAO,UAAU,KAAK,kBAAkB,UAAU,MAAM,EAAE,YAAY;AAExE,WAAM,UAAU;;AAGlB,QACE,SAAS,SACT,CAAC,UAAU,MAAM,OAAO,IAAI,QAAQ,MAAM,UAAU,QAAQ,MAAM,OAAO,CAEzE,QAAO,UACL,KACA;KACE,MAAM,UAAU;KAChB,SAAS;KACV,EACD,YACD;IAUH,MAAM,SAAS,MAAM,QAPD,OAAO,OAAO,YAAY,EAC5C,KAAK;KACH,QAAQ,UAAU,MAAM;KACxB,OAAO,UAAU,MAAM;KACvB,QAAQ,UAAU,MAAM;KACzB,EACF,CAAC,EACwC,QAAQ;AAElD,WAAO,kBAAkB,kBACd;KACL,MAAM,UAAU,IAAI,QAAQ,OAAO,QAAQ;AAC3C,UAAK,MAAM,CAAC,GAAG,QAAQ,OAAO,QAAQ,YAAY,CAChD,KAAI,CAAC,QAAQ,IAAI,EAAE,CAAE,SAAQ,IAAI,GAAG,IAAI;AAE1C,YAAO,IAAI,SAAS,OAAO,MAAM;MAC/B,QAAQ,OAAO;MACf,YAAY,OAAO;MACnB;MACD,CAAC;QACA,GACJ,IAAI,SAAS,KAAK,UAAU,OAAO,EAAE;KACnC,QAAQ;KACR,SAAS;MACP,GAAG;MACH,gBAAgB;MACjB;KACF,CAAC;YACC,OAAO;AACd,aAAS,MAAM;AACf,WAAO,UACL,KACA;KAAE,MAAM,UAAU;KAAgB,SAAS;KAAiC,EAC5E,YACD;;IAEH;;;;;;;;;;;;AAaN,SAAgB,gBACd,YACA,gBACA;AACA,SACE,MACA,gBAUG;AACH,OAAK,MAAM;GACT,MAAM,YAAY;GAClB,QAAQ;GACR,SAAS,kBAAkB,OAAO,MAAM,YACtC,sBAAsB,SAAS,YAAY,MAAM,eAAe,CACjE;GACF,CAAC;AAEF,OAAK,MAAM;GACT,MAAM,YAAY;GAClB,QAAQ,YAAY;GACpB,SAAS,WAAW,YAAY,SAAS;IACvC,OAAO,YAAY;IACnB,MAAM,YAAY;IACnB,CAAC;GACH,CAAC;;;;;;;;;;;;;AAcN,SAAgB,wBACd,iBACA,QACA;AACA,QAAO,OAAO,KAAyC,YAAqB;AAC1E,MAAI;AACF,UAAO,MAAM,OAAO,KAAK,QAAQ;WAC1B,OAAO;AACd,OACE,iBAAiB,eACjB,OAAO,MAAM,SAAS,YACtB,MAAM,SAAS,QACf,UAAU,MAAM,QAChB,aAAa,MAAM,KAEnB,QAAO,UAAU,iBAAiB,kBAAkB,MAAM,CAAC;AAE7D,OAAI,iBAAiB,YACnB,QAAO,IAAI,SAAS,MAAM;IACxB,QAAQ;IACR,YAAY,OAAO,MAAM,SAAS,WAAW,MAAM,OAAO;IAC3D,CAAC;AAEJ,YAAS,MAAM;AACf,UAAO,IAAI,SAAS,MAAM;IACxB,QAAQ;IACR,YAAY;IACb,CAAC;;;;;AAMR,SAAgB,WAAW,SAAsD;AAC/E,QAAOA,MAAa,QAAQ,QAAQ,IAAI,SAAS,IAAI,GAAG;;AAW1D,SAAS,4BACP,UACA,WAC+B;CAC/B,MAAM,gBAAgB,GAAG,UAAU;CAInC,MAAM,CAAC,qBAAqB,UAAU,GAAG,QAHpB,SAAS,WAAW,cAAc,GACnD,SAAS,MAAM,cAAc,OAAO,CAAC,MAAM,IAAI,CAAC,OAAO,QAAQ,GAC/D,EAAE;AAEN,KACE,wBAAwB,UACvB,aAAa,UAAU,aAAa,UAAU,aAAa,UAC5D,KAAK,WAAW,EAEhB,QAAO;AAET,QAAO;EACL;EACA,cAAc;EACd;EACA;EACD;;;;;;;;;;;;;;;AAgBH,SAAgB,gBACd,MACA,MAQA;CACA,MAAM,eAAe;CACrB,MAAM,YAAY,KAAK,aAAa;CAEpC,MAAM,sBAAsB;EAC1B,MAAM,SAAS,KAAK,WAAW;EAC/B,MAAM,OAAgC;GACpC;GACA,UAAU,GAAG,OAAO;GACrB;AACD,MAAI,KAAK,OAAO;AACd,QAAK,yBAAyB,GAAG,OAAO;AACxC,QAAK,iBAAiB,GAAG,OAAO;AAChC,QAAK,wBAAwB,GAAG,OAAO;AACvC,QAAK,2BAA2B,CAAC,OAAO;AACxC,QAAK,wBAAwB;IAAC;IAAsB;IAAiB;IAAqB;AAC1F,QAAK,mCAAmC,CAAC,OAAO;AAChD,QAAK,wCAAwC;IAC3C;IACA;IACA;IACD;AACD,QAAK,mBAAmB,KAAK,MAAM,UAAU;IAAC;IAAU;IAAW;IAAS;IAAiB;;AAE/F,SAAO;;CAGT,MAAM,kBAAkB,kBACtB,SAAS,YAAY;AACnB,SAAO,IAAI,SAAS,KAAK,UAAU,eAAe,CAAC,EAAE;GACnD,QAAQ;GACR,SAAS;IAAE,gBAAgB;IAAoB,iBAAiB;IAAc;GAC/E,CAAC;GACF,CACH;CAED,MAAM,cAAc,kBAClB,SAAS,YAAY;AACnB,SAAO,IAAI,SAAS,KAAK,SAAS,EAAE;GAClC,QAAQ;GACR,SAAS;IAAE,gBAAgB;IAAoB,iBAAiB;IAAc;GAC/E,CAAC;GACF,CACH;CAED,MAAM,YAAY,IAAI,IAAY,CAChC,GAAG,UAAU,oCACb,oCACD,CAAC;CACF,MAAM,UAAU,KAAK,QACjB,IAAI,IAAY;EACd,0CAA0C;EAC1C,GAAG,UAAU;EACb;EACD,CAAC,mBACF,IAAI,KAAa;CACrB,MAAM,YAAY,IAAI,IAAY,CAChC,GAAG,UAAU,yBACb,yBACD,CAAC;AAEF,MAAK,MAAM,QAAQ,CAAC,GAAG,WAAW,GAAG,QAAQ,CAC3C,MAAK,MAAM;EAAE;EAAM,QAAQ;EAAO,SAAS;EAAiB,CAAC;AAE/D,MAAK,MAAM,QAAQ,UACjB,MAAK,MAAM;EAAE;EAAM,QAAQ;EAAO,SAAS;EAAa,CAAC;AAE3D,uBAAsB,MAAM;EAAC,GAAG;EAAW,GAAG;EAAS,GAAG;EAAU,CAAC;;;AAIvE,SAAgB,mBACd,MACA,MAGA;AAYA,MAAK,MAAM,SAX0D;EACnE;GACE,UAAU;GACV,MAAM;GACP;EACD;GAAE,UAAU;GAAmB,MAAM;GAAgC;EACrE;GAAE,UAAU;GAAY,MAAM;GAAyB;EACvD;GAAE,UAAU;GAAmB,MAAM;GAAgC;EACrE;GAAE,UAAU;GAAgB,MAAM;GAA6B;EAChE,CAGC,MAAK,MAAM;EACT,MAAM,MAAM;EACZ,QAAQ;EACR,SAAS,kBAAkB,YAAY;GACrC,MAAM,SAAS,KAAK,YAAY,MAAM,SAAS;AAC/C,OAAI,WAAW,KACb,QAAO,IAAI,SAAS,MAAM,EAAE,QAAQ,KAAK,CAAC;AAE5C,UAAO,IAAI,SAAS,OAAO,MAAM;IAC/B,QAAQ,OAAO;IACf,SAAS,OAAO;IACjB,CAAC;IACF;EACH,CAAC;;;;;;;AASN,SAAgB,cACd,MACA,MAQA;CACA,MAAM,YAAY,KAAK,aAAa;CACpC,MAAM,cAAc,cAAc,KAAK,KAAK;AAC5C,MAAK,MAAM;EACT,YAAY,GAAG,YAAY;EAC3B,QAAQ;EACR,SAAS,kBAAkB,KAAK,aAAa;EAC9C,CAAC;CAEF,MAAM,kBAAkB,kBAAkB,KAAK,eAAe;AAE9D,MAAK,MAAM;EACT,YAAY,GAAG,YAAY;EAC3B,QAAQ;EACR,SAAS;EACV,CAAC;AAEF,MAAK,MAAM;EACT,YAAY,GAAG,YAAY;EAC3B,QAAQ;EACR,SAAS;EACV,CAAC;;;;;;;;;;;AAYJ,SAAgB,uBACd,MACA,MAaA;CACA,MAAM,OAAO,KAAK,aAAa;CAC/B,MAAM,gBAAgB,GAAG,KAAK;CAC9B,MAAM,YAAY,GAAG,KAAK;CAC1B,MAAM,eAAe,GAAG,KAAK;CAC7B,MAAM,eAAe,GAAG,aAAa;AAErC,MAAK,MAAM;EACT,MAAM;EACN,QAAQ;EACR,SAAS,kBAAkB,SAAS,KAAK,gBAAgB,CAAC;EAC3D,CAAC;AACF,MAAK,MAAM;EACT,MAAM;EACN,QAAQ;EACR,SAAS,kBAAkB,SAAS,KAAK,YAAY,CAAC;EACvD,CAAC;AACF,MAAK,MAAM;EACT,MAAM;EACN,QAAQ;EACR,SAAS,kBAAkB,SAAS,KAAK,eAAe,CAAC;EAC1D,CAAC;AACF,MAAK,MAAM,UAAU;EAAC;EAAO;EAAO;EAAS,CAC3C,MAAK,MAAM;EACT,YAAY;EACZ;EACA,SAAS,kBAAkB,SAAS,KAAK,aAAa,CAAC;EACxD,CAAC;AAEJ,MAAK,MAAM;EAAE,YAAY;EAAc,QAAQ;EAAW,SAAS;EAAsB,CAAC;AAC1F,uBAAsB,MAAM;EAAC;EAAe;EAAW;EAAa,CAAC;;;;;;;;;;AAWvE,SAAgB,oBACd,MACA,MA4CA;CACA,MAAM,cAAc,GAAG,KAAK,UAAU;CACtC,MAAM,yBAAyB,KAAK,gCACzB;AACL,MAAI,eAAe,KAAK,KAAK,uBAAuB,CAClD,QAAO,IAAI,IAAI,KAAK,uBAAuB,CAAC;AAE9C,SAAO,KAAK,uBAAuB,WAAW,IAAI,GAC9C,KAAK,yBACL,IAAI,KAAK;KACX,GACJ;AAEJ,KAAI,wBAAwB;AAC1B,OAAK,MAAM;GACT,MAAM;GACN,QAAQ;GACR,SAAS,kBACP,KAAK,wBAAwB,KAAK,OAAO,KAAK,YAC5C,KAAK,yBAAyB,KAAK,QAAQ,CAC5C,CACF;GACF,CAAC;AAEF,OAAK,MAAM;GACT,MAAM;GACN,QAAQ;GACR,SAAS,kBACP,KAAK,wBAAwB,KAAK,OAAO,KAAK,YAC5C,KAAK,yBAAyB,KAAK,QAAQ,CAC5C,CACF;GACF,CAAC;;CAQJ,MAAM,aAA+B,KAAK,YAAY,KAAK,kBAAkB,KAAK,QAAQ;CAE1F,MAAM,wBACJ,OACA,aAC4B;EAC5B,MAAM,WAAW,OAAO,KAAK;AAC7B,MAAI,CAAC,SAAS,aAAa,OAAW,QAAO;EAC7C,MAAM,MACJ,MAAM,aAAa,SACf,aAAa,OACX,YACA,OACF,MAAM,KAAK,WAAW,IACpB,GAAG,MAAM,SAAS,GAAG,aACrB;AACR,SAAO,MAAO,SAAS,QAAQ,OAAQ;;CAGzC,MAAM,0BAA0B,aAC9B,kBACE,KAAK,wBAAwB,KAAK,OAAO,KAAK,YAAY;EACxD,MAAM,QAAQ,4BAA4B,IAAI,IAAI,QAAQ,IAAI,CAAC,UAAU,KAAK,UAAU;EACxF,MAAM,UAAU,qBAAqB,OAAO,SAAS;AACrD,MAAI,CAAC,WAAW,CAAC,MACf,OAAM,IAAI,YAAY;GACpB,MAAM,UAAU;GAChB,SAAS;GACV,CAAC;AAEJ,SAAO,MAAM,QAAQ,KAAK,SAAS,MAAM;GACzC,CACH;AAEH,MAAK,MAAM;EACT,YAAY;EACZ,QAAQ;EACR,SAAS,uBAAuB;GAC9B,iBAAiB,KAAK;GACtB,eAAe,KAAK;GACpB,YAAY,KAAK;GACjB,YAAY,KAAK;GACjB,eAAe,KAAK;GACpB,iBAAiB,KAAK;GACtB,WAAW;GACZ,CAAC;EACH,CAAC;AAEF,MAAK,MAAM;EACT,YAAY;EACZ,QAAQ;EACR,SAAS,uBAAuB;GAC9B,YAAY,KAAK;GACjB,YAAY,KAAK;GACjB,iBAAiB,KAAK;GACtB,WAAW;GACZ,CAAC;EACH,CAAC;AAEF,MAAK,MAAM;EACT,YAAY;EACZ,QAAQ;EACR,SAAS,uBAAuB,EAC9B,WAAW,WACZ,CAAC;EACH,CAAC;AAEF,MAAK,MAAM,UAAU,CAAC,SAAS,SAAS,CACtC,MAAK,MAAM;EACT,YAAY;EACZ;EACA,SAAS,kBAAkB,OAAO,KAAK,YAAY;GACjD,MAAM,QAAQ,4BAA4B,IAAI,IAAI,QAAQ,IAAI,CAAC,UAAU,KAAK,UAAU;AACxF,OAAI,CAAC,SAAS,MAAM,aAAa,UAAU,MAAM,KAAK,OAAO,KAC3D,QAAO,KAAK,UAAU,KAAK,YAAY,2BAA2B;AAEpE,UAAO,MAAM,KAAK,kBAAkB,KAAK,QAAQ;IACjD;EACH,CAAC"}

package/dist/server/identity/claims.js

@@ -54,5 +54,5 @@ async function getAuthenticatedSessionIdOrNull(ctx) {
 }
 
 //#endregion
-export { getAuthenticatedSessionIdOrNull, getAuthenticatedUserIdOrNull, getUserIdentityOrNull, oauthScopesFromIdentity, userIdFromIdentity };
+export { getAuthenticatedSessionIdOrNull, getAuthenticatedUserIdOrNull, getUserIdentityOrNull, oauthScopesFromIdentity, sessionIdFromIdentity, userIdFromIdentity };
 //# sourceMappingURL=claims.js.map

package/dist/server/identity/convex.d.ts

@@ -10,6 +10,8 @@ declare module "convex/server" {
      * native identity access can read `identity.sid` directly.
      */
     readonly sid?: GenericId<"Session">;
+    /** Session epoch captured in the convex-auth access token. */
+    readonly session_epoch?: number;
   }
 } //# sourceMappingURL=convex.d.ts.map
 //# sourceMappingURL=convex.d.ts.map

package/dist/server/identity/convex.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"convex.d.ts","names":[],"sources":["../../../src/server/identity/convex.ts"],"mappings":";;;;YAGY,YAAA;IAHmC;;;;;;IAAA,SAUlC,GAAA,GAAM,SAAA;EAAA;AAAA"}
+{"version":3,"file":"convex.d.ts","names":[],"sources":["../../../src/server/identity/convex.ts"],"mappings":";;;;YAGY,YAAA;IAHmC;;;;;;IAAA,SAUlC,GAAA,GAAM,SAAA;IAEN;IAAA,SAAA,aAAA;EAAA;AAAA"}

package/dist/server/index.d.ts

@@ -1,17 +1,14 @@
-import { vGroupDoc, vGroupInviteDoc, vGroupMemberDoc, vPaginated, vUserDoc, vUserEmailDoc } from "../component/model.js";
-import { AuthComponentApi } from "./component/api.js";
 import { AuthEventKind } from "../shared/event/kinds.js";
 import { AuthEvent, AuthEventHandlerMap, AuthEventTarget, AuthEventWhere, authEvents } from "./events.js";
-import { AuthDataModel, Doc, GenericDoc, Grant, PermissionsConfig, RoleId } from "./types.js";
-import { AuthContext, AuthContextConfig, OptionalAuthContext, UserDoc } from "./context.js";
-import { AuthConfig, InferAuth } from "./facade.js";
+import { Grant, PermissionsConfig, RoleId } from "./types.js";
 import "./identity/convex.js";
 import { McpToolDef } from "./mcp.js";
+import { AuthContext, AuthContextConfig, OptionalAuthContext } from "./context.js";
+import { AuthConfig } from "./facade.js";
 import { WellKnownEndpoint, WellKnownOptions, WellKnownResponse, wellKnown } from "./wellknown.js";
 import { HttpAuthContext, HttpAuthContextConfig, OptionalHttpAuthContext } from "./http.js";
-import { AuthExtendValidators, AuthValidators, Group, Membership, Viewer, createAuthValidators } from "./validators.js";
-import { AuthApi, AuthApiBase, ConvexAuthResult, InferClientApi, defineAuth } from "./auth.js";
-import { AuthEnv, authEnv } from "./env.js";
+import { AuthExtendValidators, vAuthId } from "./validators.js";
+import { defineAuth } from "./auth.js";
 import { corsHeaders, corsPreflightHandler, registerCorsPreflight, withCors, withCorsResponse } from "./cors.js";
 import { AuthCookie, AuthCookieConfig, AuthCookies, PreloadResult, ServerOptions, authCookieNames, parseAuthCookies, serializeAuthCookies, server, shouldProxyAuthAction, structuredAuthCookies } from "./preload.js";
-export { type AuthApi, type AuthApiBase, type AuthComponentApi, type AuthConfig, type AuthContext, type AuthContextConfig, type AuthCookie, type AuthCookieConfig, type AuthCookies, type AuthDataModel, type AuthEnv, type AuthEvent, type AuthEventHandlerMap, type AuthEventKind, type AuthEventTarget, type AuthEventWhere, type AuthExtendValidators, type AuthValidators, type ConvexAuthResult, type Doc, type GenericDoc, type Grant, type Group, type HttpAuthContext, type HttpAuthContextConfig, type InferAuth, type InferClientApi, type McpToolDef, type Membership, type OptionalAuthContext, type OptionalHttpAuthContext, type PermissionsConfig, type PreloadResult, type RoleId, type ServerOptions, type UserDoc, type Viewer, type WellKnownEndpoint, type WellKnownOptions, type WellKnownResponse, authCookieNames, authEnv, authEvents, corsHeaders, corsPreflightHandler, createAuthValidators, defineAuth, parseAuthCookies, registerCorsPreflight, serializeAuthCookies, server, shouldProxyAuthAction, structuredAuthCookies, vGroupDoc, vGroupInviteDoc, vGroupMemberDoc, vPaginated, vUserDoc, vUserEmailDoc, wellKnown, withCors, withCorsResponse };
+export { type AuthConfig, type AuthContext, type AuthContextConfig, type AuthCookie, type AuthCookieConfig, type AuthCookies, type AuthEvent, type AuthEventHandlerMap, type AuthEventKind, type AuthEventTarget, type AuthEventWhere, type AuthExtendValidators, type Grant, type HttpAuthContext, type HttpAuthContextConfig, type McpToolDef, type OptionalAuthContext, type OptionalHttpAuthContext, type PermissionsConfig, type PreloadResult, type RoleId, type ServerOptions, type WellKnownEndpoint, type WellKnownOptions, type WellKnownResponse, authCookieNames, authEvents, corsHeaders, corsPreflightHandler, defineAuth, parseAuthCookies, registerCorsPreflight, serializeAuthCookies, server, shouldProxyAuthAction, structuredAuthCookies, vAuthId, wellKnown, withCors, withCorsResponse };

package/dist/server/index.js

@@ -1,11 +1,9 @@
 import "./identity/convex.js";
-import { authEnv } from "./env.js";
 import { authEvents } from "./events.js";
-import { vGroupDoc, vGroupInviteDoc, vGroupMemberDoc, vPaginated, vUserDoc, vUserEmailDoc } from "../component/model.js";
 import { corsHeaders, corsPreflightHandler, registerCorsPreflight, withCors, withCorsResponse } from "./cors.js";
 import { wellKnown } from "./wellknown.js";
-import { createAuthValidators } from "./validators.js";
+import { vAuthId } from "./validators.js";
 import { defineAuth } from "./auth.js";
 import { authCookieNames, parseAuthCookies, serializeAuthCookies, server, shouldProxyAuthAction, structuredAuthCookies } from "./preload.js";
 
-export { authCookieNames, authEnv, authEvents, corsHeaders, corsPreflightHandler, createAuthValidators, defineAuth, parseAuthCookies, registerCorsPreflight, serializeAuthCookies, server, shouldProxyAuthAction, structuredAuthCookies, vGroupDoc, vGroupInviteDoc, vGroupMemberDoc, vPaginated, vUserDoc, vUserEmailDoc, wellKnown, withCors, withCorsResponse };
+export { authCookieNames, authEvents, corsHeaders, corsPreflightHandler, defineAuth, parseAuthCookies, registerCorsPreflight, serializeAuthCookies, server, shouldProxyAuthAction, structuredAuthCookies, vAuthId, wellKnown, withCors, withCorsResponse };

package/dist/server/limits.js

@@ -1,3 +1,8 @@
+import { requireAuthKey } from "./env.js";
+import { SHA256 } from "@oslojs/crypto/sha2";
+import { encodeHexLowerCase } from "@oslojs/encoding";
+import { hmac } from "@oslojs/crypto/hmac";
+
 //#region src/server/limits.ts
 const DEFAULT_MAX_SIGN_IN_ATTEMPTS_PER_HOUR = 10;
 /** Resolve the configured guessable-secret attempt capacity. @internal */
@@ -5,6 +10,21 @@ function maxSignInAttempts(config) {
 	return config.signIn?.maxFailedAttemptsPerHour ?? DEFAULT_MAX_SIGN_IN_ATTEMPTS_PER_HOUR;
 }
 /**
+* Produce the opaque token-bucket key for a credentials sign-in identity.
+*
+* The component persists this value, so it must never contain the submitted
+* account identifier. It is deliberately derived before account lookup: known
+* and unknown accounts then consume the same bucket. The normalized identifier
+* treats user-facing credential IDs consistently without changing provider
+* account lookup semantics.
+*
+* @internal
+*/
+function credentialsSignInLimitIdentifier(provider, accountId) {
+	const canonical = JSON.stringify([provider, accountId.trim().toLowerCase()]);
+	return encodeHexLowerCase(hmac(SHA256, new TextEncoder().encode(requireAuthKey("webauthnMaskingKey")), new TextEncoder().encode(`credentials-sign-in:${canonical}`)));
+}
+/**
 * Check whether the given identifier is currently rate-limited.
 *
 * @internal
@@ -12,7 +32,8 @@ function maxSignInAttempts(config) {
 async function isSignInRateLimited(ctx, identifier, config) {
 	const { ok } = await ctx.runQuery(config.component.limits.signInCheck, {
 		identifier,
-		maxAttemptsPerHour: maxSignInAttempts(config)
+		maxAttemptsPerHour: maxSignInAttempts(config),
+		now: Date.now()
 	});
 	return !ok;
 }
@@ -37,5 +58,5 @@ async function resetSignInRateLimit(ctx, identifier, config) {
 }
 
 //#endregion
-export { isSignInRateLimited, maxSignInAttempts, recordFailedSignIn, resetSignInRateLimit };
+export { credentialsSignInLimitIdentifier, isSignInRateLimited, maxSignInAttempts, recordFailedSignIn, resetSignInRateLimit };
 //# sourceMappingURL=limits.js.map

package/dist/server/limits.js.map

@@ -1 +1 @@
-{"version":3,"file":"limits.js","names":[],"sources":["../../src/server/limits.ts"],"sourcesContent":["import type { FunctionReference, FunctionReturnType, OptionalRestArgs } from \"convex/server\";\n\nimport type { ConvexAuthConfig } from \"./types\";\n\nconst DEFAULT_MAX_SIGN_IN_ATTEMPTS_PER_HOUR = 10;\n\n/**\n * Minimal context the rate-limit helpers depend on. The component API is\n * threaded in via the explicit `config` argument, so only `runQuery` /\n * `runMutation` are required. Typed with the narrowest call shape the helpers\n * actually use so both mutation handlers (credentials sign-in) and action\n * handlers (the TOTP ceremony) satisfy it, despite their differing\n * `runQuery`/`runMutation` option overloads.\n *\n * @internal\n */\nexport type SignInLimitCtx = {\n  runQuery: <Query extends FunctionReference<\"query\", \"public\" | \"internal\">>(\n    query: Query,\n    ...args: OptionalRestArgs<Query>\n  ) => Promise<FunctionReturnType<Query>>;\n  runMutation: <Mutation extends FunctionReference<\"mutation\", \"public\" | \"internal\">>(\n    mutation: Mutation,\n    ...args: OptionalRestArgs<Mutation>\n  ) => Promise<FunctionReturnType<Mutation>>;\n};\n\n/**\n * Minimal config shape the rate-limit helpers depend on. Both\n * {@link ConvexAuthConfig} and `ConvexAuthMaterializedConfig` satisfy it, so\n * the helpers work from mutation and action handlers alike.\n *\n * @internal\n */\nexport type SignInLimitConfig = Pick<ConvexAuthConfig, \"component\" | \"signIn\">;\n\n/** Resolve the configured guessable-secret attempt capacity. @internal */\nexport function maxSignInAttempts(config: SignInLimitConfig) {\n  return config.signIn?.maxFailedAttemptsPerHour ?? DEFAULT_MAX_SIGN_IN_ATTEMPTS_PER_HOUR;\n}\n\n/**\n * Check whether the given identifier is currently rate-limited.\n *\n * @internal\n */\nexport async function isSignInRateLimited(\n  ctx: SignInLimitCtx,\n  identifier: string,\n  config: SignInLimitConfig,\n): Promise<boolean> {\n  const { ok } = await ctx.runQuery(config.component.limits.signInCheck, {\n    identifier,\n    maxAttemptsPerHour: maxSignInAttempts(config),\n  });\n  return !ok;\n}\n\n/**\n * Record a failed sign-in attempt for the given identifier.\n *\n * @internal\n */\nexport async function recordFailedSignIn(\n  ctx: SignInLimitCtx,\n  identifier: string,\n  config: SignInLimitConfig,\n): Promise<void> {\n  await ctx.runMutation(config.component.limits.signInRecord, {\n    identifier,\n    maxAttemptsPerHour: maxSignInAttempts(config),\n  });\n}\n\n/**\n * Reserve one sign-in attempt up front, consuming a token as part of the same\n * atomic component mutation. Returns `true` when the caller is **blocked** (the\n * bucket was already empty, so no token was taken) and `false` when a token was\n * successfully consumed and the caller may proceed.\n *\n * Unlike {@link isSignInRateLimited} — a non-consuming peek — this closes the\n * check-then-record TOCTOU that lets N concurrent guesses in an **action**\n * (TOTP / passkey verify) all pass a `check()` before any `limit()` commits.\n * Reserving before the verification makes each attempt consume a token\n * atomically, so the per-hour cap bounds *attempts*, not merely logged failures.\n *\n * A single normal attempt consumes exactly one token; callers refund it on a\n * successful verification via {@link resetSignInRateLimit}. On a failed\n * verification the caller must NOT also call {@link recordFailedSignIn} — the\n * reservation already counted the attempt.\n *\n * @internal\n */\nexport async function reserveSignInAttempt(\n  ctx: SignInLimitCtx,\n  identifier: string,\n  config: SignInLimitConfig,\n): Promise<boolean> {\n  const { ok } = await ctx.runMutation(config.component.limits.signInRecord, {\n    identifier,\n    maxAttemptsPerHour: maxSignInAttempts(config),\n  });\n  return !ok;\n}\n\n/**\n * Reset the rate limit for the given identifier.\n *\n * @internal\n */\nexport async function resetSignInRateLimit(\n  ctx: SignInLimitCtx,\n  identifier: string,\n  config: SignInLimitConfig,\n): Promise<void> {\n  await ctx.runMutation(config.component.limits.signInReset, { identifier });\n}\n"],"mappings":";AAIA,MAAM,wCAAwC;;AAiC9C,SAAgB,kBAAkB,QAA2B;AAC3D,QAAO,OAAO,QAAQ,4BAA4B;;;;;;;AAQpD,eAAsB,oBACpB,KACA,YACA,QACkB;CAClB,MAAM,EAAE,OAAO,MAAM,IAAI,SAAS,OAAO,UAAU,OAAO,aAAa;EACrE;EACA,oBAAoB,kBAAkB,OAAO;EAC9C,CAAC;AACF,QAAO,CAAC;;;;;;;AAQV,eAAsB,mBACpB,KACA,YACA,QACe;AACf,OAAM,IAAI,YAAY,OAAO,UAAU,OAAO,cAAc;EAC1D;EACA,oBAAoB,kBAAkB,OAAO;EAC9C,CAAC;;;;;;;AAuCJ,eAAsB,qBACpB,KACA,YACA,QACe;AACf,OAAM,IAAI,YAAY,OAAO,UAAU,OAAO,aAAa,EAAE,YAAY,CAAC"}
+{"version":3,"file":"limits.js","names":[],"sources":["../../src/server/limits.ts"],"sourcesContent":["import { hmac } from \"@oslojs/crypto/hmac\";\nimport { SHA256 } from \"@oslojs/crypto/sha2\";\nimport { encodeHexLowerCase } from \"@oslojs/encoding\";\nimport type { FunctionReference, FunctionReturnType, OptionalRestArgs } from \"convex/server\";\n\nimport { requireAuthKey } from \"./env\";\nimport type { ConvexAuthConfig } from \"./types\";\n\nconst DEFAULT_MAX_SIGN_IN_ATTEMPTS_PER_HOUR = 10;\n\n/**\n * Minimal context the rate-limit helpers depend on. The component API is\n * threaded in via the explicit `config` argument, so only `runQuery` /\n * `runMutation` are required. Typed with the narrowest call shape the helpers\n * actually use so both mutation handlers (credentials sign-in) and action\n * handlers (the TOTP ceremony) satisfy it, despite their differing\n * `runQuery`/`runMutation` option overloads.\n *\n * @internal\n */\nexport type SignInLimitCtx = {\n  runQuery: <Query extends FunctionReference<\"query\", \"public\" | \"internal\">>(\n    query: Query,\n    ...args: OptionalRestArgs<Query>\n  ) => Promise<FunctionReturnType<Query>>;\n  runMutation: <Mutation extends FunctionReference<\"mutation\", \"public\" | \"internal\">>(\n    mutation: Mutation,\n    ...args: OptionalRestArgs<Mutation>\n  ) => Promise<FunctionReturnType<Mutation>>;\n};\n\n/**\n * Minimal config shape the rate-limit helpers depend on. Both\n * {@link ConvexAuthConfig} and `ConvexAuthMaterializedConfig` satisfy it, so\n * the helpers work from mutation and action handlers alike.\n *\n * @internal\n */\nexport type SignInLimitConfig = Pick<ConvexAuthConfig, \"component\" | \"signIn\">;\n\n/** Resolve the configured guessable-secret attempt capacity. @internal */\nexport function maxSignInAttempts(config: SignInLimitConfig) {\n  return config.signIn?.maxFailedAttemptsPerHour ?? DEFAULT_MAX_SIGN_IN_ATTEMPTS_PER_HOUR;\n}\n\n/**\n * Produce the opaque token-bucket key for a credentials sign-in identity.\n *\n * The component persists this value, so it must never contain the submitted\n * account identifier. It is deliberately derived before account lookup: known\n * and unknown accounts then consume the same bucket. The normalized identifier\n * treats user-facing credential IDs consistently without changing provider\n * account lookup semantics.\n *\n * @internal\n */\nexport function credentialsSignInLimitIdentifier(provider: string, accountId: string) {\n  const canonical = JSON.stringify([provider, accountId.trim().toLowerCase()]);\n  return encodeHexLowerCase(\n    hmac(\n      SHA256,\n      new TextEncoder().encode(requireAuthKey(\"webauthnMaskingKey\")),\n      new TextEncoder().encode(`credentials-sign-in:${canonical}`),\n    ),\n  );\n}\n\n/**\n * Check whether the given identifier is currently rate-limited.\n *\n * @internal\n */\nexport async function isSignInRateLimited(\n  ctx: SignInLimitCtx,\n  identifier: string,\n  config: SignInLimitConfig,\n): Promise<boolean> {\n  const { ok } = await ctx.runQuery(config.component.limits.signInCheck, {\n    identifier,\n    maxAttemptsPerHour: maxSignInAttempts(config),\n    now: Date.now(),\n  });\n  return !ok;\n}\n\n/**\n * Record a failed sign-in attempt for the given identifier.\n *\n * @internal\n */\nexport async function recordFailedSignIn(\n  ctx: SignInLimitCtx,\n  identifier: string,\n  config: SignInLimitConfig,\n): Promise<void> {\n  await ctx.runMutation(config.component.limits.signInRecord, {\n    identifier,\n    maxAttemptsPerHour: maxSignInAttempts(config),\n  });\n}\n\n/**\n * Reserve one sign-in attempt up front, consuming a token as part of the same\n * atomic component mutation. Returns `true` when the caller is **blocked** (the\n * bucket was already empty, so no token was taken) and `false` when a token was\n * successfully consumed and the caller may proceed.\n *\n * Unlike {@link isSignInRateLimited} — a non-consuming peek — this closes the\n * check-then-record TOCTOU that lets N concurrent guesses in an **action**\n * (TOTP / passkey verify) all pass a `check()` before any `limit()` commits.\n * Reserving before the verification makes each attempt consume a token\n * atomically, so the per-hour cap bounds *attempts*, not merely logged failures.\n *\n * A single normal attempt consumes exactly one token; callers refund it on a\n * successful verification via {@link resetSignInRateLimit}. On a failed\n * verification the caller must NOT also call {@link recordFailedSignIn} — the\n * reservation already counted the attempt.\n *\n * @internal\n */\nexport async function reserveSignInAttempt(\n  ctx: SignInLimitCtx,\n  identifier: string,\n  config: SignInLimitConfig,\n): Promise<boolean> {\n  const { ok } = await ctx.runMutation(config.component.limits.signInRecord, {\n    identifier,\n    maxAttemptsPerHour: maxSignInAttempts(config),\n  });\n  return !ok;\n}\n\n/**\n * Reset the rate limit for the given identifier.\n *\n * @internal\n */\nexport async function resetSignInRateLimit(\n  ctx: SignInLimitCtx,\n  identifier: string,\n  config: SignInLimitConfig,\n): Promise<void> {\n  await ctx.runMutation(config.component.limits.signInReset, { identifier });\n}\n"],"mappings":";;;;;;AAQA,MAAM,wCAAwC;;AAiC9C,SAAgB,kBAAkB,QAA2B;AAC3D,QAAO,OAAO,QAAQ,4BAA4B;;;;;;;;;;;;;AAcpD,SAAgB,iCAAiC,UAAkB,WAAmB;CACpF,MAAM,YAAY,KAAK,UAAU,CAAC,UAAU,UAAU,MAAM,CAAC,aAAa,CAAC,CAAC;AAC5E,QAAO,mBACL,KACE,QACA,IAAI,aAAa,CAAC,OAAO,eAAe,qBAAqB,CAAC,EAC9D,IAAI,aAAa,CAAC,OAAO,uBAAuB,YAAY,CAC7D,CACF;;;;;;;AAQH,eAAsB,oBACpB,KACA,YACA,QACkB;CAClB,MAAM,EAAE,OAAO,MAAM,IAAI,SAAS,OAAO,UAAU,OAAO,aAAa;EACrE;EACA,oBAAoB,kBAAkB,OAAO;EAC7C,KAAK,KAAK,KAAK;EAChB,CAAC;AACF,QAAO,CAAC;;;;;;;AAQV,eAAsB,mBACpB,KACA,YACA,QACe;AACf,OAAM,IAAI,YAAY,OAAO,UAAU,OAAO,cAAc;EAC1D;EACA,oBAAoB,kBAAkB,OAAO;EAC9C,CAAC;;;;;;;AAuCJ,eAAsB,qBACpB,KACA,YACA,QACe;AACf,OAAM,IAAI,YAAY,OAAO,UAAU,OAAO,aAAa,EAAE,YAAY,CAAC"}

package/dist/server/mutations/calls.js

@@ -1,10 +1,11 @@
 import { callModifyAccount } from "./account.js";
 import { callCreateVerificationCode } from "./code.js";
 import { callCredentialsSignIn } from "./credentials/signin.js";
+import { callCreateAccountFromCredentials } from "./register.js";
+import { callCompleteCredentialEnrollment } from "./enrollment.js";
 import { callInvalidateSessions } from "./invalidate.js";
 import { callUserOAuth } from "./oauth.js";
 import { callRefreshSession } from "./refresh.js";
-import { callCreateAccountFromCredentials } from "./register.js";
 import { callRetrieveAccountWithCredentials } from "./retrieve.js";
 import { callVerifierSignature } from "./signature.js";
 import { callSignIn } from "./signin.js";
@@ -13,4 +14,4 @@ import { callVerifier } from "./verifier.js";
 import { callVerifyCodeAndSignIn } from "./verify.js";
 import { storeImpl, vStoreArgs } from "./store.js";
 
-export { callCreateAccountFromCredentials, callCreateVerificationCode, callCredentialsSignIn, callInvalidateSessions, callModifyAccount, callRefreshSession, callRetrieveAccountWithCredentials, callSignIn, callSignOut, callUserOAuth, callVerifier, callVerifierSignature, callVerifyCodeAndSignIn, storeImpl, vStoreArgs };
+export { callCompleteCredentialEnrollment, callCreateAccountFromCredentials, callCreateVerificationCode, callCredentialsSignIn, callInvalidateSessions, callModifyAccount, callRefreshSession, callRetrieveAccountWithCredentials, callSignIn, callSignOut, callUserOAuth, callVerifier, callVerifierSignature, callVerifyCodeAndSignIn, storeImpl, vStoreArgs };

package/dist/server/mutations/credentials/signin.js

@@ -3,10 +3,10 @@ import { queueAuthEvent } from "../../events.js";
 import { log, maybeRedact } from "../../log.js";
 import { encodeRefreshToken, refreshTokenExpirationTime } from "../../token/refresh.js";
 import { setActiveSpanAttributes, withSpan } from "../../utils/span.js";
-import { buildSessionIdentity, getAuthSessionId, sessionExpirationTime } from "../../session/lifecycle.js";
+import { buildSessionIdentity, getAuthSessionReplacement, sessionExpirationTime } from "../../session/lifecycle.js";
 import { verify } from "../../crypto.js";
 import { AUTH_STORE_REF } from "../store/refs.js";
-import { maxSignInAttempts } from "../../limits.js";
+import { credentialsSignInLimitIdentifier, maxSignInAttempts } from "../../limits.js";
 import { buildKnownSignInIdentityAttributes } from "../../telemetry.js";
 import { v } from "convex/values";
 
@@ -62,6 +62,7 @@ async function credentialsSignInImpl(ctx, args, getProviderOrThrow, config) {
 }
 async function credentialsSignInInner(ctx, args, getProviderOrThrow, config) {
 	const { provider: providerId, account, generateTokens, requireVerifiedEmail, enforceTotp } = args;
+	const limitIdentifier = credentialsSignInLimitIdentifier(providerId, account.id);
 	log(LOG_LEVELS.DEBUG, "credentialsSignInImpl args:", {
 		provider: providerId,
 		account: {
@@ -75,6 +76,7 @@ async function credentialsSignInInner(ctx, args, getProviderOrThrow, config) {
 	const begun = await ctx.runMutation(config.component.account.beginCredentialsSignIn, {
 		provider: providerId,
 		providerAccountId: account.id,
+		limitIdentifier,
 		maxAttemptsPerHour: maxSignInAttempts(config),
 		reserveAttempt: true,
 		includeTotp: enforceTotp
@@ -89,9 +91,10 @@ async function credentialsSignInInner(ctx, args, getProviderOrThrow, config) {
 	if (!await withSpan("convex-auth.credentials.verify", { providerId }, () => verify(getProviderOrThrow(providerId), account.secret, existingAccount.secret ?? ""))) return { kind: "invalidSecret" };
 	const complete = async (issueSession) => await ctx.runMutation(config.component.account.completeCredentialsSignIn, {
 		accountId: existingAccount._id,
+		limitIdentifier,
 		issueSession,
 		generateTokens,
-		replaceSessionId: issueSession ? await getAuthSessionId(ctx) ?? void 0 : void 0,
+		replaceSession: issueSession ? await getAuthSessionReplacement(ctx) : void 0,
 		sessionExpirationTime: sessionExpirationTime(config),
 		refreshTokenExpirationTime: refreshTokenExpirationTime(config)
 	});
@@ -183,6 +186,7 @@ async function credentialsSignInInner(ctx, args, getProviderOrThrow, config) {
 		issuance: {
 			userId,
 			sessionId,
+			sessionExpirationTime: completed.sessionExpirationTime,
 			identity: buildSessionIdentity(userId, sessionId, completed.user),
 			refreshToken: generateTokens && refreshTokenId !== void 0 ? encodeRefreshToken(refreshTokenId, sessionId) : null
 		},

package/dist/server/mutations/credentials/signin.js.map

@@ -1 +1 @@
-{"version":3,"file":"signin.js","names":["Provider.verify"],"sources":["../../../../src/server/mutations/credentials/signin.ts"],"sourcesContent":["/**\n * Credentials verification backed by two aggregate component transactions:\n * one to reserve/load sign-in state and one to refund-or-issue. This avoids a\n * separate component call for every account, user, factor, limiter, and session\n * operation.\n *\n * @internal\n */\n\nimport type { GenericDataModel } from \"convex/server\";\nimport { GenericId, Infer, v } from \"convex/values\";\n\nimport * as Provider from \"../../crypto\";\nimport type { Hashed } from \"../../../shared/brand\";\nimport { queueAuthEvent } from \"../../events\";\nimport { maxSignInAttempts } from \"../../limits\";\nimport { LOG_LEVELS, log, maybeRedact } from \"../../log\";\nimport {\n  buildSessionIdentity,\n  getAuthSessionId,\n  sessionExpirationTime,\n} from \"../../session/lifecycle\";\nimport type { SessionIssuance } from \"../../session/lifecycle\";\nimport { encodeRefreshToken, refreshTokenExpirationTime } from \"../../token/refresh\";\nimport { buildKnownSignInIdentityAttributes } from \"../../telemetry\";\nimport {\n  type CrossComponentUserDoc,\n  GenericActionCtxWithAuthConfig,\n  MutationCtx,\n} from \"../../types\";\nimport { setActiveSpanAttributes, withSpan } from \"../../utils/span\";\nimport { AUTH_STORE_REF } from \"../store/refs\";\n\n/**\n * A well-formed but intentionally unmatchable password hash. Verifying any\n * secret against it runs the provider's full (scrypt) work and always fails.\n * Used on the missing-account branch so sign-in spends comparable time whether\n * or not the account exists — closing the user-enumeration timing oracle.\n *\n * The prefix and params mirror the default password provider's scrypt format so\n * that provider performs a real scrypt hash; the salt and digest are all zero,\n * a digest scrypt can never actually produce, so verification never succeeds.\n */\nconst DUMMY_PASSWORD_HASH =\n  `scrypt:N=16384,r=16,p=1,dkLen=64$${\"0\".repeat(64)}$${\"0\".repeat(128)}` as Hashed<\"Password\">;\n\n/**\n * Run a throwaway secret verification purely to equalize timing on branches\n * that reject before the real verify would run. Never authenticates: it\n * verifies against {@link DUMMY_PASSWORD_HASH} (which cannot match) and swallows\n * any error, so a misconfigured or non-credentials provider still yields the\n * unified rejection rather than a distinguishable error or timing.\n */\nasync function burnVerifyForTiming(\n  getProviderOrThrow: Provider.GetProviderOrThrowFunc,\n  providerId: string,\n  secret: string,\n): Promise<void> {\n  try {\n    await Provider.verify(getProviderOrThrow(providerId), secret, DUMMY_PASSWORD_HASH);\n  } catch {\n    // Intentionally ignored — this path exists only to equalize timing.\n  }\n}\n\n/** Argument validator for the combined credentials-verify + session-issue mutation. */\nexport const vCredentialsSignInArgs = v.object({\n  provider: v.string(),\n  account: v.object({ id: v.string(), secret: v.string() }),\n  generateTokens: v.boolean(),\n  requireVerifiedEmail: v.boolean(),\n  enforceTotp: v.boolean(),\n});\n\ntype CredentialsSignInResult =\n  | { kind: \"invalidAccount\" }\n  | { kind: \"tooManyAttempts\" }\n  | { kind: \"invalidSecret\" }\n  | {\n      kind: \"emailVerificationRequired\";\n      account: { _id: string; emailVerified?: string };\n      user: {\n        _id: string;\n        email?: string;\n      };\n    }\n  | {\n      kind: \"signedIn\";\n      issuance: SessionIssuance;\n      account: { _id: string; emailVerified?: string };\n      user: {\n        _id: string;\n        email?: string;\n        hasTotp?: boolean;\n      };\n    }\n  | {\n      kind: \"totpRequired\";\n      account: { _id: string; emailVerified?: string };\n      user: { _id: string; email?: string };\n    };\n\n/**\n * Verify credentials and issue a session through one app mutation.\n *\n * Enforces sign-in rate limiting, optional verified-email and TOTP gates, and\n * returns a discriminated result (`invalidAccount`, `tooManyAttempts`,\n * `invalidSecret`, `emailVerificationRequired`, `totpRequired`, or `signedIn`).\n *\n * @internal\n */\nexport async function credentialsSignInImpl(\n  ctx: MutationCtx,\n  args: Infer<typeof vCredentialsSignInArgs>,\n  getProviderOrThrow: Provider.GetProviderOrThrowFunc,\n  config: Provider.Config,\n): Promise<CredentialsSignInResult> {\n  return withSpan(\n    \"convex-auth.mutations.credentialsSignIn\",\n    { provider: args.provider, generateTokens: args.generateTokens },\n    () => credentialsSignInInner(ctx, args, getProviderOrThrow, config),\n  );\n}\n\nasync function credentialsSignInInner(\n  ctx: MutationCtx,\n  args: Infer<typeof vCredentialsSignInArgs>,\n  getProviderOrThrow: Provider.GetProviderOrThrowFunc,\n  config: Provider.Config,\n): Promise<CredentialsSignInResult> {\n  const { provider: providerId, account, generateTokens, requireVerifiedEmail, enforceTotp } = args;\n  log(LOG_LEVELS.DEBUG, \"credentialsSignInImpl args:\", {\n    provider: providerId,\n    account: { id: account.id, secret: maybeRedact(account.secret) },\n    generateTokens,\n    requireVerifiedEmail,\n    enforceTotp,\n  });\n\n  const begun = (await ctx.runMutation(config.component.account.beginCredentialsSignIn, {\n    provider: providerId,\n    providerAccountId: account.id,\n    maxAttemptsPerHour: maxSignInAttempts(config),\n    reserveAttempt: true,\n    includeTotp: enforceTotp,\n  })) as\n    | { status: \"invalid\" }\n    | { status: \"limited\" }\n    | {\n        status: \"ready\";\n        account: {\n          _id: string;\n          userId: string;\n          secret?: string;\n          emailVerified?: string;\n        };\n        user: CrossComponentUserDoc;\n        hasTotp: boolean;\n      };\n  if (begun.status === \"invalid\") {\n    // A real account pays the full secret-verify (scrypt) cost below, so burn\n    // the same cost here before returning the unified rejection. Without this a\n    // missing account returns early and its faster response leaks (by timing)\n    // that the account does not exist. Result intentionally ignored.\n    await burnVerifyForTiming(getProviderOrThrow, providerId, account.secret);\n    return { kind: \"invalidAccount\" };\n  }\n  if (begun.status === \"limited\") {\n    return { kind: \"tooManyAttempts\" };\n  }\n  const existingAccount = begun.account;\n  const user = begun.user;\n\n  const verified = await withSpan(\"convex-auth.credentials.verify\", { providerId }, () =>\n    Provider.verify(\n      getProviderOrThrow(providerId),\n      account.secret,\n      (existingAccount.secret ?? \"\") as Hashed<\"Password\">,\n    ),\n  );\n  if (!verified) {\n    // beginCredentialsSignIn reserved this failed attempt transactionally.\n    return { kind: \"invalidSecret\" };\n  }\n\n  const complete = async (issueSession: boolean) =>\n    (await ctx.runMutation(config.component.account.completeCredentialsSignIn, {\n      accountId: existingAccount._id,\n      issueSession,\n      generateTokens,\n      replaceSessionId: issueSession ? ((await getAuthSessionId(ctx)) ?? undefined) : undefined,\n      sessionExpirationTime: sessionExpirationTime(config),\n      refreshTokenExpirationTime: refreshTokenExpirationTime(config),\n    })) as\n      | { status: \"rejected\" | \"reset\" }\n      | {\n          status: \"accepted\";\n          user: typeof user;\n          sessionId: string;\n          refreshTokenId?: string;\n          replacedSessionId?: string;\n        };\n\n  if (requireVerifiedEmail && !existingAccount.emailVerified) {\n    await complete(false);\n    return {\n      kind: \"emailVerificationRequired\",\n      account: {\n        _id: existingAccount._id,\n        emailVerified: existingAccount.emailVerified,\n      },\n      user: {\n        _id: user._id,\n        email: user.email,\n      },\n    };\n  }\n\n  if (enforceTotp && begun.hasTotp) {\n    await complete(false);\n    return {\n      kind: \"totpRequired\",\n      account: {\n        _id: existingAccount._id,\n        emailVerified: existingAccount.emailVerified,\n      },\n      user: { _id: user._id, email: user.email },\n    };\n  }\n\n  const completed = await complete(true);\n  if (completed.status !== \"accepted\") return { kind: \"invalidAccount\" };\n\n  const userId = completed.user._id as GenericId<\"User\">;\n  const sessionId = completed.sessionId as GenericId<\"Session\">;\n  setActiveSpanAttributes({\n    \"auth.signin.result\": \"success\",\n    ...buildKnownSignInIdentityAttributes(config, { userId, sessionId }, completed.user.email),\n  });\n  if (completed.replacedSessionId !== undefined) {\n    const replacedSessionId = completed.replacedSessionId as GenericId<\"Session\">;\n    await queueAuthEvent(ctx, config, {\n      kind: \"session.invalidated\",\n      actor: { type: \"system\" },\n      subject: { type: \"session\", id: replacedSessionId },\n      targets: [\n        { kind: \"user\", id: userId },\n        { kind: \"session\", id: replacedSessionId },\n      ],\n      outcome: \"success\",\n      data: { userId, reason: \"replaced\" },\n    });\n  }\n  await queueAuthEvent(ctx, config, {\n    kind: \"session.signed_in\",\n    actor: { type: \"user\", id: userId },\n    subject: { type: \"session\", id: sessionId },\n    targets: [\n      { kind: \"user\", id: userId },\n      { kind: \"session\", id: sessionId },\n    ],\n    outcome: \"success\",\n    data: { provider: providerId },\n  });\n  const refreshTokenId = completed.refreshTokenId as GenericId<\"RefreshToken\"> | undefined;\n  const issuance: SessionIssuance = {\n    userId,\n    sessionId,\n    identity: buildSessionIdentity(userId, sessionId, completed.user),\n    refreshToken:\n      generateTokens && refreshTokenId !== undefined\n        ? encodeRefreshToken(refreshTokenId, sessionId)\n        : null,\n  };\n\n  return {\n    kind: \"signedIn\",\n    issuance,\n    account: {\n      _id: existingAccount._id,\n      emailVerified: existingAccount.emailVerified,\n    },\n    user: {\n      _id: user._id,\n      email: user.email,\n      hasTotp: begun.hasTotp,\n    },\n  };\n}\n\n/** @internal */\nexport const callCredentialsSignIn = async <DataModel extends GenericDataModel>(\n  ctx: GenericActionCtxWithAuthConfig<DataModel>,\n  args: Infer<typeof vCredentialsSignInArgs>,\n): Promise<CredentialsSignInResult> => {\n  return (await ctx.runMutation(AUTH_STORE_REF, {\n    args: {\n      type: \"credentialsSignIn\",\n      ...args,\n    },\n  })) as CredentialsSignInResult;\n};\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;AA2CA,MAAM,sBACJ,oCAAoC,IAAI,OAAO,GAAG,CAAC,GAAG,IAAI,OAAO,IAAI;;;;;;;;AASvE,eAAe,oBACb,oBACA,YACA,QACe;AACf,KAAI;AACF,QAAMA,OAAgB,mBAAmB,WAAW,EAAE,QAAQ,oBAAoB;SAC5E;;;AAMV,MAAa,yBAAyB,EAAE,OAAO;CAC7C,UAAU,EAAE,QAAQ;CACpB,SAAS,EAAE,OAAO;EAAE,IAAI,EAAE,QAAQ;EAAE,QAAQ,EAAE,QAAQ;EAAE,CAAC;CACzD,gBAAgB,EAAE,SAAS;CAC3B,sBAAsB,EAAE,SAAS;CACjC,aAAa,EAAE,SAAS;CACzB,CAAC;;;;;;;;;;AAuCF,eAAsB,sBACpB,KACA,MACA,oBACA,QACkC;AAClC,QAAO,SACL,2CACA;EAAE,UAAU,KAAK;EAAU,gBAAgB,KAAK;EAAgB,QAC1D,uBAAuB,KAAK,MAAM,oBAAoB,OAAO,CACpE;;AAGH,eAAe,uBACb,KACA,MACA,oBACA,QACkC;CAClC,MAAM,EAAE,UAAU,YAAY,SAAS,gBAAgB,sBAAsB,gBAAgB;AAC7F,KAAI,WAAW,OAAO,+BAA+B;EACnD,UAAU;EACV,SAAS;GAAE,IAAI,QAAQ;GAAI,QAAQ,YAAY,QAAQ,OAAO;GAAE;EAChE;EACA;EACA;EACD,CAAC;CAEF,MAAM,QAAS,MAAM,IAAI,YAAY,OAAO,UAAU,QAAQ,wBAAwB;EACpF,UAAU;EACV,mBAAmB,QAAQ;EAC3B,oBAAoB,kBAAkB,OAAO;EAC7C,gBAAgB;EAChB,aAAa;EACd,CAAC;AAcF,KAAI,MAAM,WAAW,WAAW;AAK9B,QAAM,oBAAoB,oBAAoB,YAAY,QAAQ,OAAO;AACzE,SAAO,EAAE,MAAM,kBAAkB;;AAEnC,KAAI,MAAM,WAAW,UACnB,QAAO,EAAE,MAAM,mBAAmB;CAEpC,MAAM,kBAAkB,MAAM;CAC9B,MAAM,OAAO,MAAM;AASnB,KAAI,CAPa,MAAM,SAAS,kCAAkC,EAAE,YAAY,QAC9EA,OACE,mBAAmB,WAAW,EAC9B,QAAQ,QACP,gBAAgB,UAAU,GAC5B,CACF,CAGC,QAAO,EAAE,MAAM,iBAAiB;CAGlC,MAAM,WAAW,OAAO,iBACrB,MAAM,IAAI,YAAY,OAAO,UAAU,QAAQ,2BAA2B;EACzE,WAAW,gBAAgB;EAC3B;EACA;EACA,kBAAkB,eAAiB,MAAM,iBAAiB,IAAI,IAAK,SAAa;EAChF,uBAAuB,sBAAsB,OAAO;EACpD,4BAA4B,2BAA2B,OAAO;EAC/D,CAAC;AAUJ,KAAI,wBAAwB,CAAC,gBAAgB,eAAe;AAC1D,QAAM,SAAS,MAAM;AACrB,SAAO;GACL,MAAM;GACN,SAAS;IACP,KAAK,gBAAgB;IACrB,eAAe,gBAAgB;IAChC;GACD,MAAM;IACJ,KAAK,KAAK;IACV,OAAO,KAAK;IACb;GACF;;AAGH,KAAI,eAAe,MAAM,SAAS;AAChC,QAAM,SAAS,MAAM;AACrB,SAAO;GACL,MAAM;GACN,SAAS;IACP,KAAK,gBAAgB;IACrB,eAAe,gBAAgB;IAChC;GACD,MAAM;IAAE,KAAK,KAAK;IAAK,OAAO,KAAK;IAAO;GAC3C;;CAGH,MAAM,YAAY,MAAM,SAAS,KAAK;AACtC,KAAI,UAAU,WAAW,WAAY,QAAO,EAAE,MAAM,kBAAkB;CAEtE,MAAM,SAAS,UAAU,KAAK;CAC9B,MAAM,YAAY,UAAU;AAC5B,yBAAwB;EACtB,sBAAsB;EACtB,GAAG,mCAAmC,QAAQ;GAAE;GAAQ;GAAW,EAAE,UAAU,KAAK,MAAM;EAC3F,CAAC;AACF,KAAI,UAAU,sBAAsB,QAAW;EAC7C,MAAM,oBAAoB,UAAU;AACpC,QAAM,eAAe,KAAK,QAAQ;GAChC,MAAM;GACN,OAAO,EAAE,MAAM,UAAU;GACzB,SAAS;IAAE,MAAM;IAAW,IAAI;IAAmB;GACnD,SAAS,CACP;IAAE,MAAM;IAAQ,IAAI;IAAQ,EAC5B;IAAE,MAAM;IAAW,IAAI;IAAmB,CAC3C;GACD,SAAS;GACT,MAAM;IAAE;IAAQ,QAAQ;IAAY;GACrC,CAAC;;AAEJ,OAAM,eAAe,KAAK,QAAQ;EAChC,MAAM;EACN,OAAO;GAAE,MAAM;GAAQ,IAAI;GAAQ;EACnC,SAAS;GAAE,MAAM;GAAW,IAAI;GAAW;EAC3C,SAAS,CACP;GAAE,MAAM;GAAQ,IAAI;GAAQ,EAC5B;GAAE,MAAM;GAAW,IAAI;GAAW,CACnC;EACD,SAAS;EACT,MAAM,EAAE,UAAU,YAAY;EAC/B,CAAC;CACF,MAAM,iBAAiB,UAAU;AAWjC,QAAO;EACL,MAAM;EACN,UAZgC;GAChC;GACA;GACA,UAAU,qBAAqB,QAAQ,WAAW,UAAU,KAAK;GACjE,cACE,kBAAkB,mBAAmB,SACjC,mBAAmB,gBAAgB,UAAU,GAC7C;GACP;EAKC,SAAS;GACP,KAAK,gBAAgB;GACrB,eAAe,gBAAgB;GAChC;EACD,MAAM;GACJ,KAAK,KAAK;GACV,OAAO,KAAK;GACZ,SAAS,MAAM;GAChB;EACF;;;AAIH,MAAa,wBAAwB,OACnC,KACA,SACqC;AACrC,QAAQ,MAAM,IAAI,YAAY,gBAAgB,EAC5C,MAAM;EACJ,MAAM;EACN,GAAG;EACJ,EACF,CAAC"}
+{"version":3,"file":"signin.js","names":["Provider.verify"],"sources":["../../../../src/server/mutations/credentials/signin.ts"],"sourcesContent":["/**\n * Credentials verification backed by two aggregate component transactions:\n * one to reserve/load sign-in state and one to refund-or-issue. This avoids a\n * separate component call for every account, user, factor, limiter, and session\n * operation.\n *\n * @internal\n */\n\nimport type { GenericDataModel } from \"convex/server\";\nimport { GenericId, Infer, v } from \"convex/values\";\n\nimport * as Provider from \"../../crypto\";\nimport type { Hashed } from \"../../../shared/brand\";\nimport { queueAuthEvent } from \"../../events\";\nimport { credentialsSignInLimitIdentifier, maxSignInAttempts } from \"../../limits\";\nimport { LOG_LEVELS, log, maybeRedact } from \"../../log\";\nimport {\n  buildSessionIdentity,\n  getAuthSessionReplacement,\n  sessionExpirationTime,\n} from \"../../session/lifecycle\";\nimport type { SessionIssuance } from \"../../session/lifecycle\";\nimport { encodeRefreshToken, refreshTokenExpirationTime } from \"../../token/refresh\";\nimport { buildKnownSignInIdentityAttributes } from \"../../telemetry\";\nimport {\n  type CrossComponentUserDoc,\n  GenericActionCtxWithAuthConfig,\n  MutationCtx,\n} from \"../../types\";\nimport { setActiveSpanAttributes, withSpan } from \"../../utils/span\";\nimport { AUTH_STORE_REF } from \"../store/refs\";\n\n/**\n * A well-formed but intentionally unmatchable password hash. Verifying any\n * secret against it runs the provider's full (scrypt) work and always fails.\n * Used on the missing-account branch so sign-in spends comparable time whether\n * or not the account exists — closing the user-enumeration timing oracle.\n *\n * The prefix and params mirror the default password provider's scrypt format so\n * that provider performs a real scrypt hash; the salt and digest are all zero,\n * a digest scrypt can never actually produce, so verification never succeeds.\n */\nconst DUMMY_PASSWORD_HASH =\n  `scrypt:N=16384,r=16,p=1,dkLen=64$${\"0\".repeat(64)}$${\"0\".repeat(128)}` as Hashed<\"Password\">;\n\n/**\n * Run a throwaway secret verification purely to equalize timing on branches\n * that reject before the real verify would run. Never authenticates: it\n * verifies against {@link DUMMY_PASSWORD_HASH} (which cannot match) and swallows\n * any error, so a misconfigured or non-credentials provider still yields the\n * unified rejection rather than a distinguishable error or timing.\n */\nasync function burnVerifyForTiming(\n  getProviderOrThrow: Provider.GetProviderOrThrowFunc,\n  providerId: string,\n  secret: string,\n): Promise<void> {\n  try {\n    await Provider.verify(getProviderOrThrow(providerId), secret, DUMMY_PASSWORD_HASH);\n  } catch {\n    // Intentionally ignored — this path exists only to equalize timing.\n  }\n}\n\n/** Argument validator for the combined credentials-verify + session-issue mutation. */\nexport const vCredentialsSignInArgs = v.object({\n  provider: v.string(),\n  account: v.object({ id: v.string(), secret: v.string() }),\n  generateTokens: v.boolean(),\n  requireVerifiedEmail: v.boolean(),\n  enforceTotp: v.boolean(),\n});\n\ntype CredentialsSignInResult =\n  | { kind: \"invalidAccount\" }\n  | { kind: \"tooManyAttempts\" }\n  | { kind: \"invalidSecret\" }\n  | {\n      kind: \"emailVerificationRequired\";\n      account: { _id: string; emailVerified?: string };\n      user: {\n        _id: string;\n        email?: string;\n      };\n    }\n  | {\n      kind: \"signedIn\";\n      issuance: SessionIssuance;\n      account: { _id: string; emailVerified?: string };\n      user: {\n        _id: string;\n        email?: string;\n        hasTotp?: boolean;\n      };\n    }\n  | {\n      kind: \"totpRequired\";\n      account: { _id: string; emailVerified?: string };\n      user: { _id: string; email?: string };\n    };\n\n/**\n * Verify credentials and issue a session through one app mutation.\n *\n * Enforces sign-in rate limiting, optional verified-email and TOTP gates, and\n * returns a discriminated result (`invalidAccount`, `tooManyAttempts`,\n * `invalidSecret`, `emailVerificationRequired`, `totpRequired`, or `signedIn`).\n *\n * @internal\n */\nexport async function credentialsSignInImpl(\n  ctx: MutationCtx,\n  args: Infer<typeof vCredentialsSignInArgs>,\n  getProviderOrThrow: Provider.GetProviderOrThrowFunc,\n  config: Provider.Config,\n): Promise<CredentialsSignInResult> {\n  return withSpan(\n    \"convex-auth.mutations.credentialsSignIn\",\n    { provider: args.provider, generateTokens: args.generateTokens },\n    () => credentialsSignInInner(ctx, args, getProviderOrThrow, config),\n  );\n}\n\nasync function credentialsSignInInner(\n  ctx: MutationCtx,\n  args: Infer<typeof vCredentialsSignInArgs>,\n  getProviderOrThrow: Provider.GetProviderOrThrowFunc,\n  config: Provider.Config,\n): Promise<CredentialsSignInResult> {\n  const { provider: providerId, account, generateTokens, requireVerifiedEmail, enforceTotp } = args;\n  const limitIdentifier = credentialsSignInLimitIdentifier(providerId, account.id);\n  log(LOG_LEVELS.DEBUG, \"credentialsSignInImpl args:\", {\n    provider: providerId,\n    account: { id: account.id, secret: maybeRedact(account.secret) },\n    generateTokens,\n    requireVerifiedEmail,\n    enforceTotp,\n  });\n\n  const begun = (await ctx.runMutation(config.component.account.beginCredentialsSignIn, {\n    provider: providerId,\n    providerAccountId: account.id,\n    limitIdentifier,\n    maxAttemptsPerHour: maxSignInAttempts(config),\n    reserveAttempt: true,\n    includeTotp: enforceTotp,\n  })) as\n    | { status: \"invalid\" }\n    | { status: \"limited\" }\n    | {\n        status: \"ready\";\n        account: {\n          _id: string;\n          userId: string;\n          secret?: string;\n          emailVerified?: string;\n        };\n        user: CrossComponentUserDoc;\n        hasTotp: boolean;\n      };\n  if (begun.status === \"invalid\") {\n    // A real account pays the full secret-verify (scrypt) cost below, so burn\n    // the same cost here before returning the unified rejection. Without this a\n    // missing account returns early and its faster response leaks (by timing)\n    // that the account does not exist. Result intentionally ignored.\n    await burnVerifyForTiming(getProviderOrThrow, providerId, account.secret);\n    return { kind: \"invalidAccount\" };\n  }\n  if (begun.status === \"limited\") {\n    return { kind: \"tooManyAttempts\" };\n  }\n  const existingAccount = begun.account;\n  const user = begun.user;\n\n  const verified = await withSpan(\"convex-auth.credentials.verify\", { providerId }, () =>\n    Provider.verify(\n      getProviderOrThrow(providerId),\n      account.secret,\n      (existingAccount.secret ?? \"\") as Hashed<\"Password\">,\n    ),\n  );\n  if (!verified) {\n    // beginCredentialsSignIn reserved this failed attempt transactionally.\n    return { kind: \"invalidSecret\" };\n  }\n\n  const complete = async (issueSession: boolean) =>\n    (await ctx.runMutation(config.component.account.completeCredentialsSignIn, {\n      accountId: existingAccount._id,\n      limitIdentifier,\n      issueSession,\n      generateTokens,\n      replaceSession: issueSession ? await getAuthSessionReplacement(ctx) : undefined,\n      sessionExpirationTime: sessionExpirationTime(config),\n      refreshTokenExpirationTime: refreshTokenExpirationTime(config),\n    })) as\n      | { status: \"rejected\" | \"reset\" }\n      | {\n          status: \"accepted\";\n          user: typeof user;\n          sessionId: string;\n          sessionExpirationTime: number;\n          refreshTokenId?: string;\n          replacedSessionId?: string;\n        };\n\n  if (requireVerifiedEmail && !existingAccount.emailVerified) {\n    await complete(false);\n    return {\n      kind: \"emailVerificationRequired\",\n      account: {\n        _id: existingAccount._id,\n        emailVerified: existingAccount.emailVerified,\n      },\n      user: {\n        _id: user._id,\n        email: user.email,\n      },\n    };\n  }\n\n  if (enforceTotp && begun.hasTotp) {\n    await complete(false);\n    return {\n      kind: \"totpRequired\",\n      account: {\n        _id: existingAccount._id,\n        emailVerified: existingAccount.emailVerified,\n      },\n      user: { _id: user._id, email: user.email },\n    };\n  }\n\n  const completed = await complete(true);\n  if (completed.status !== \"accepted\") return { kind: \"invalidAccount\" };\n\n  const userId = completed.user._id as GenericId<\"User\">;\n  const sessionId = completed.sessionId as GenericId<\"Session\">;\n  setActiveSpanAttributes({\n    \"auth.signin.result\": \"success\",\n    ...buildKnownSignInIdentityAttributes(config, { userId, sessionId }, completed.user.email),\n  });\n  if (completed.replacedSessionId !== undefined) {\n    const replacedSessionId = completed.replacedSessionId as GenericId<\"Session\">;\n    await queueAuthEvent(ctx, config, {\n      kind: \"session.invalidated\",\n      actor: { type: \"system\" },\n      subject: { type: \"session\", id: replacedSessionId },\n      targets: [\n        { kind: \"user\", id: userId },\n        { kind: \"session\", id: replacedSessionId },\n      ],\n      outcome: \"success\",\n      data: { userId, reason: \"replaced\" },\n    });\n  }\n  await queueAuthEvent(ctx, config, {\n    kind: \"session.signed_in\",\n    actor: { type: \"user\", id: userId },\n    subject: { type: \"session\", id: sessionId },\n    targets: [\n      { kind: \"user\", id: userId },\n      { kind: \"session\", id: sessionId },\n    ],\n    outcome: \"success\",\n    data: { provider: providerId },\n  });\n  const refreshTokenId = completed.refreshTokenId as GenericId<\"RefreshToken\"> | undefined;\n  const issuance: SessionIssuance = {\n    userId,\n    sessionId,\n    sessionExpirationTime: completed.sessionExpirationTime,\n    identity: buildSessionIdentity(userId, sessionId, completed.user),\n    refreshToken:\n      generateTokens && refreshTokenId !== undefined\n        ? encodeRefreshToken(refreshTokenId, sessionId)\n        : null,\n  };\n\n  return {\n    kind: \"signedIn\",\n    issuance,\n    account: {\n      _id: existingAccount._id,\n      emailVerified: existingAccount.emailVerified,\n    },\n    user: {\n      _id: user._id,\n      email: user.email,\n      hasTotp: begun.hasTotp,\n    },\n  };\n}\n\n/** @internal */\nexport const callCredentialsSignIn = async <DataModel extends GenericDataModel>(\n  ctx: GenericActionCtxWithAuthConfig<DataModel>,\n  args: Infer<typeof vCredentialsSignInArgs>,\n): Promise<CredentialsSignInResult> => {\n  return (await ctx.runMutation(AUTH_STORE_REF, {\n    args: {\n      type: \"credentialsSignIn\",\n      ...args,\n    },\n  })) as CredentialsSignInResult;\n};\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;AA2CA,MAAM,sBACJ,oCAAoC,IAAI,OAAO,GAAG,CAAC,GAAG,IAAI,OAAO,IAAI;;;;;;;;AASvE,eAAe,oBACb,oBACA,YACA,QACe;AACf,KAAI;AACF,QAAMA,OAAgB,mBAAmB,WAAW,EAAE,QAAQ,oBAAoB;SAC5E;;;AAMV,MAAa,yBAAyB,EAAE,OAAO;CAC7C,UAAU,EAAE,QAAQ;CACpB,SAAS,EAAE,OAAO;EAAE,IAAI,EAAE,QAAQ;EAAE,QAAQ,EAAE,QAAQ;EAAE,CAAC;CACzD,gBAAgB,EAAE,SAAS;CAC3B,sBAAsB,EAAE,SAAS;CACjC,aAAa,EAAE,SAAS;CACzB,CAAC;;;;;;;;;;AAuCF,eAAsB,sBACpB,KACA,MACA,oBACA,QACkC;AAClC,QAAO,SACL,2CACA;EAAE,UAAU,KAAK;EAAU,gBAAgB,KAAK;EAAgB,QAC1D,uBAAuB,KAAK,MAAM,oBAAoB,OAAO,CACpE;;AAGH,eAAe,uBACb,KACA,MACA,oBACA,QACkC;CAClC,MAAM,EAAE,UAAU,YAAY,SAAS,gBAAgB,sBAAsB,gBAAgB;CAC7F,MAAM,kBAAkB,iCAAiC,YAAY,QAAQ,GAAG;AAChF,KAAI,WAAW,OAAO,+BAA+B;EACnD,UAAU;EACV,SAAS;GAAE,IAAI,QAAQ;GAAI,QAAQ,YAAY,QAAQ,OAAO;GAAE;EAChE;EACA;EACA;EACD,CAAC;CAEF,MAAM,QAAS,MAAM,IAAI,YAAY,OAAO,UAAU,QAAQ,wBAAwB;EACpF,UAAU;EACV,mBAAmB,QAAQ;EAC3B;EACA,oBAAoB,kBAAkB,OAAO;EAC7C,gBAAgB;EAChB,aAAa;EACd,CAAC;AAcF,KAAI,MAAM,WAAW,WAAW;AAK9B,QAAM,oBAAoB,oBAAoB,YAAY,QAAQ,OAAO;AACzE,SAAO,EAAE,MAAM,kBAAkB;;AAEnC,KAAI,MAAM,WAAW,UACnB,QAAO,EAAE,MAAM,mBAAmB;CAEpC,MAAM,kBAAkB,MAAM;CAC9B,MAAM,OAAO,MAAM;AASnB,KAAI,CAPa,MAAM,SAAS,kCAAkC,EAAE,YAAY,QAC9EA,OACE,mBAAmB,WAAW,EAC9B,QAAQ,QACP,gBAAgB,UAAU,GAC5B,CACF,CAGC,QAAO,EAAE,MAAM,iBAAiB;CAGlC,MAAM,WAAW,OAAO,iBACrB,MAAM,IAAI,YAAY,OAAO,UAAU,QAAQ,2BAA2B;EACzE,WAAW,gBAAgB;EAC3B;EACA;EACA;EACA,gBAAgB,eAAe,MAAM,0BAA0B,IAAI,GAAG;EACtE,uBAAuB,sBAAsB,OAAO;EACpD,4BAA4B,2BAA2B,OAAO;EAC/D,CAAC;AAWJ,KAAI,wBAAwB,CAAC,gBAAgB,eAAe;AAC1D,QAAM,SAAS,MAAM;AACrB,SAAO;GACL,MAAM;GACN,SAAS;IACP,KAAK,gBAAgB;IACrB,eAAe,gBAAgB;IAChC;GACD,MAAM;IACJ,KAAK,KAAK;IACV,OAAO,KAAK;IACb;GACF;;AAGH,KAAI,eAAe,MAAM,SAAS;AAChC,QAAM,SAAS,MAAM;AACrB,SAAO;GACL,MAAM;GACN,SAAS;IACP,KAAK,gBAAgB;IACrB,eAAe,gBAAgB;IAChC;GACD,MAAM;IAAE,KAAK,KAAK;IAAK,OAAO,KAAK;IAAO;GAC3C;;CAGH,MAAM,YAAY,MAAM,SAAS,KAAK;AACtC,KAAI,UAAU,WAAW,WAAY,QAAO,EAAE,MAAM,kBAAkB;CAEtE,MAAM,SAAS,UAAU,KAAK;CAC9B,MAAM,YAAY,UAAU;AAC5B,yBAAwB;EACtB,sBAAsB;EACtB,GAAG,mCAAmC,QAAQ;GAAE;GAAQ;GAAW,EAAE,UAAU,KAAK,MAAM;EAC3F,CAAC;AACF,KAAI,UAAU,sBAAsB,QAAW;EAC7C,MAAM,oBAAoB,UAAU;AACpC,QAAM,eAAe,KAAK,QAAQ;GAChC,MAAM;GACN,OAAO,EAAE,MAAM,UAAU;GACzB,SAAS;IAAE,MAAM;IAAW,IAAI;IAAmB;GACnD,SAAS,CACP;IAAE,MAAM;IAAQ,IAAI;IAAQ,EAC5B;IAAE,MAAM;IAAW,IAAI;IAAmB,CAC3C;GACD,SAAS;GACT,MAAM;IAAE;IAAQ,QAAQ;IAAY;GACrC,CAAC;;AAEJ,OAAM,eAAe,KAAK,QAAQ;EAChC,MAAM;EACN,OAAO;GAAE,MAAM;GAAQ,IAAI;GAAQ;EACnC,SAAS;GAAE,MAAM;GAAW,IAAI;GAAW;EAC3C,SAAS,CACP;GAAE,MAAM;GAAQ,IAAI;GAAQ,EAC5B;GAAE,MAAM;GAAW,IAAI;GAAW,CACnC;EACD,SAAS;EACT,MAAM,EAAE,UAAU,YAAY;EAC/B,CAAC;CACF,MAAM,iBAAiB,UAAU;AAYjC,QAAO;EACL,MAAM;EACN,UAbgC;GAChC;GACA;GACA,uBAAuB,UAAU;GACjC,UAAU,qBAAqB,QAAQ,WAAW,UAAU,KAAK;GACjE,cACE,kBAAkB,mBAAmB,SACjC,mBAAmB,gBAAgB,UAAU,GAC7C;GACP;EAKC,SAAS;GACP,KAAK,gBAAgB;GACrB,eAAe,gBAAgB;GAChC;EACD,MAAM;GACJ,KAAK,KAAK;GACV,OAAO,KAAK;GACZ,SAAS,MAAM;GAChB;EACF;;;AAIH,MAAa,wBAAwB,OACnC,KACA,SACqC;AACrC,QAAQ,MAAM,IAAI,YAAY,gBAAgB,EAC5C,MAAM;EACJ,MAAM;EACN,GAAG;EACJ,EACF,CAAC"}

package/dist/server/mutations/enrollment.js

@@ -0,0 +1,87 @@
+import { ErrorCode } from "../../shared/codes.js";
+import { AUTH_STORE_REF } from "./store/refs.js";
+import { createAccountFromHashedCredentialsImpl } from "./register.js";
+import { ConvexError, v } from "convex/values";
+
+//#region src/server/mutations/enrollment.ts
+const vAttestationEvidence = v.object({
+	verifier: v.string(),
+	aaguid: v.string(),
+	format: v.string(),
+	metadataDescription: v.optional(v.string()),
+	verifiedAt: v.number(),
+	status: v.literal("trusted")
+});
+/** Arguments for the single enrollment-commit transaction. */
+const vCompleteCredentialEnrollmentArgs = v.object({
+	continuationId: v.string(),
+	provider: v.string(),
+	credentialId: v.string(),
+	publicKey: v.bytes(),
+	algorithm: v.number(),
+	counter: v.number(),
+	transports: v.optional(v.array(v.string())),
+	deviceType: v.string(),
+	backedUp: v.boolean(),
+	name: v.optional(v.string()),
+	attestation: v.optional(vAttestationEvidence),
+	createdAt: v.number(),
+	now: v.number(),
+	sessionExpirationTime: v.number(),
+	refreshTokenExpirationTime: v.number()
+});
+/** Commit the staged identity, credential account, passkey, and session atomically. */
+async function completeCredentialEnrollmentImpl(ctx, args, services) {
+	const enrollment = await ctx.runQuery(services.config.component.token.enrollment.get, {
+		continuationId: args.continuationId,
+		provider: args.provider,
+		now: args.now
+	});
+	if (enrollment === null) return { status: "rejected" };
+	const provisioned = await createAccountFromHashedCredentialsImpl(ctx, {
+		provider: enrollment.provider,
+		account: {
+			id: enrollment.providerAccountId,
+			...enrollment.secret === void 0 ? {} : { secret: enrollment.secret }
+		},
+		profile: enrollment.profile,
+		shouldLinkViaEmail: enrollment.shouldLinkViaEmail,
+		shouldLinkViaPhone: enrollment.shouldLinkViaPhone
+	}, services.providerRegistry.getProviderOrThrow, services.config);
+	const completed = await ctx.runMutation(services.config.component.factor.passkey.completeEnrollment, {
+		userId: provisioned.user._id,
+		credentialId: args.credentialId,
+		publicKey: args.publicKey,
+		algorithm: args.algorithm,
+		counter: args.counter,
+		...args.transports === void 0 ? {} : { transports: args.transports },
+		deviceType: args.deviceType,
+		backedUp: args.backedUp,
+		...args.name === void 0 ? {} : { name: args.name },
+		...args.attestation === void 0 ? {} : { attestation: args.attestation },
+		createdAt: args.createdAt,
+		continuationId: args.continuationId,
+		enrollmentId: enrollment._id,
+		credentialsAccountId: provisioned.account._id,
+		provider: args.provider,
+		now: args.now,
+		sessionExpirationTime: args.sessionExpirationTime,
+		refreshTokenExpirationTime: args.refreshTokenExpirationTime
+	});
+	if (completed.status === "rejected") throw new ConvexError({
+		code: ErrorCode.CONTINUATION_INVALID,
+		message: "Invalid or expired credentials enrollment continuation."
+	});
+	return completed;
+}
+/** Call the atomic enrollment-commit store mutation from an auth action. */
+async function callCompleteCredentialEnrollment(ctx, args) {
+	return await ctx.runMutation(AUTH_STORE_REF, { args: {
+		type: "completeCredentialEnrollment",
+		...args
+	} });
+}
+
+//#endregion
+export { callCompleteCredentialEnrollment, completeCredentialEnrollmentImpl, vCompleteCredentialEnrollmentArgs };
+//# sourceMappingURL=enrollment.js.map