@lupinum/better-convex-nuxt 0.8.0-beta.40

package/dist/runtime/convex-auth/context.d.ts

@@ -0,0 +1,5 @@
+import type { GenericActionCtx, GenericDataModel, GenericMutationCtx, GenericQueryCtx } from 'convex/server';
+export type AuthCtx<DataModel extends GenericDataModel = GenericDataModel> = GenericQueryCtx<DataModel> | GenericMutationCtx<DataModel> | GenericActionCtx<DataModel>;
+export type WritableAuthCtx<DataModel extends GenericDataModel = GenericDataModel> = GenericMutationCtx<DataModel> | GenericActionCtx<DataModel>;
+export declare function isWritableAuthCtx<DataModel extends GenericDataModel>(ctx: AuthCtx<DataModel>): ctx is WritableAuthCtx<DataModel>;
+export declare function requireWritableAuthCtx<DataModel extends GenericDataModel>(ctx: AuthCtx<DataModel>): asserts ctx is WritableAuthCtx<DataModel>;

package/dist/runtime/convex-auth/context.js

@@ -0,0 +1,8 @@
+export function isWritableAuthCtx(ctx) {
+  return "runMutation" in ctx && typeof ctx.runMutation === "function";
+}
+export function requireWritableAuthCtx(ctx) {
+  if (!isWritableAuthCtx(ctx)) {
+    throw new Error("AUTH_WRITE_REQUIRES_MUTATION_OR_ACTION");
+  }
+}

package/dist/runtime/convex-auth/create-auth-component.d.ts

@@ -0,0 +1,41 @@
+import { type GenericDataModel, type HttpRouter } from 'convex/server';
+import type { AuthCtx, WritableAuthCtx } from './context.js';
+import { type OAuthLiveAccess } from './oauth-live-access.js';
+import type { AuthAdapterComponentApi, AuthComponentTriggers, AuthFunctions, CreateAuth } from './types.js';
+interface CreateAuthComponentOptions<DataModel extends GenericDataModel> {
+    authFunctions?: AuthFunctions;
+    triggers?: AuthComponentTriggers<DataModel>;
+}
+export declare function createAuthComponent<DataModel extends GenericDataModel, Api extends AuthAdapterComponentApi = AuthAdapterComponentApi>(component: Api, options?: CreateAuthComponentOptions<DataModel>): {
+    adapter: (ctx: AuthCtx<DataModel>) => import("better-auth/adapters").AdapterFactory<import("better-auth").BetterAuthOptions>;
+    safeGetAuthUser: (ctx: AuthCtx<DataModel>) => Promise<Record<string, unknown> | null>;
+    getAuthUser: (ctx: AuthCtx<DataModel>) => Promise<Record<string, unknown>>;
+    validateOAuthAccess: (ctx: AuthCtx<DataModel>, access: OAuthLiveAccess) => Promise<boolean>;
+    getAuth: <Auth>(createAuth: CreateAuth<DataModel, Auth>, ctx: WritableAuthCtx<DataModel>) => Promise<{
+        auth: Awaited<Auth>;
+        headers: Headers;
+    }>;
+    triggerFunctions: () => {
+        onCreate: import("convex/server").RegisteredMutation<"internal", {
+            model: string;
+            doc: any;
+        }, Promise<void | undefined>>;
+        onDelete: import("convex/server").RegisteredMutation<"internal", {
+            model: string;
+            doc: any;
+        }, Promise<void | undefined>>;
+        onUpdate: import("convex/server").RegisteredMutation<"internal", {
+            model: string;
+            newDoc: any;
+            oldDoc: any;
+        }, Promise<void | undefined>>;
+    };
+    jwksOperatorFunctions: <Auth>(createAuth: CreateAuth<DataModel, Auth>) => {
+        rotateSigningKey: import("convex/server").RegisteredAction<"internal", {}, Promise<import("./jwks-rotation.js").SigningKeyRotationMetadata>>;
+    };
+    registerRoutes: <Auth extends {
+        $context: Promise<unknown>;
+        handler: (request: Request) => Promise<Response>;
+    }>(http: HttpRouter, createAuth: CreateAuth<DataModel, Auth>) => void;
+};
+export {};

package/dist/runtime/convex-auth/create-auth-component.js

@@ -0,0 +1,157 @@
+import {
+  httpActionGeneric,
+  internalActionGeneric,
+  internalMutationGeneric
+} from "convex/server";
+import { ConvexError, v } from "convex/values";
+import {
+  CLIENT_IP_HEADER,
+  CLIENT_IP_SIGNATURE_HEADER,
+  VERIFIED_CLIENT_IP_HEADER,
+  normalizeClientIp,
+  verifySignedClientIp
+} from "../shared/client-ip.js";
+import { createConvexAuthAdapter } from "./adapter/create-adapter.js";
+import { INTERNAL_SESSION_HEADER } from "./internal-session.js";
+import { rotateSigningKeyWithOfficialJwt } from "./jwks-rotation.js";
+import { validateOAuthAccess } from "./oauth-live-access.js";
+import { requireAuthOrigin } from "./origin.js";
+function rewriteToPublicOrigin(request, publicOrigin, verifiedClientIp) {
+  const incoming = new URL(request.url);
+  const target = new URL(publicOrigin);
+  target.pathname = incoming.pathname;
+  target.search = incoming.search;
+  const headers = new Headers(request.headers);
+  for (const name of [...headers.keys()]) {
+    if (name.toLowerCase().startsWith("x-bcn-")) headers.delete(name);
+  }
+  headers.set(VERIFIED_CLIENT_IP_HEADER, verifiedClientIp);
+  return new Request(new Request(target, request), { headers });
+}
+async function resolveVerifiedClientIp(request, getDirectClientIp, proxyIpSecret) {
+  const clientIp = request.headers.get(CLIENT_IP_HEADER);
+  const signature = request.headers.get(CLIENT_IP_SIGNATURE_HEADER);
+  if (clientIp === null && signature === null) {
+    const directClientIp = normalizeClientIp(await getDirectClientIp());
+    if (!directClientIp) throw new TypeError("Trusted request metadata did not contain a client IP");
+    return directClientIp;
+  }
+  const forwardedClientIp = await verifySignedClientIp(clientIp, signature, proxyIpSecret);
+  if (!forwardedClientIp) {
+    throw new TypeError("Signed client IP headers are incomplete or invalid");
+  }
+  return forwardedClientIp;
+}
+function identityClaim(identity, name) {
+  const value = identity[name];
+  return typeof value === "string" && value.length > 0 ? value : void 0;
+}
+export function createAuthComponent(component, options = {}) {
+  const safeGetAuthSession = async (ctx) => {
+    const identity = await ctx.auth.getUserIdentity();
+    if (!identity) return null;
+    const claims = identity;
+    if (identityClaim(claims, "token_use") !== "convex-session") return null;
+    const sessionId = identityClaim(claims, "sid");
+    if (!sessionId) return null;
+    const session = await ctx.runQuery(component.adapter.findOne, {
+      model: "session",
+      where: [
+        { field: "id", value: sessionId },
+        { field: "userId", value: identity.subject },
+        { field: "expiresAt", operator: "gt", value: Date.now() }
+      ]
+    });
+    return session ? { identity, session } : null;
+  };
+  const safeGetAuthUser = async (ctx) => {
+    const authenticated = await safeGetAuthSession(ctx);
+    if (!authenticated) return null;
+    return await ctx.runQuery(component.adapter.findOne, {
+      model: "user",
+      where: [{ field: "id", value: authenticated.identity.subject }]
+    });
+  };
+  return {
+    adapter: (ctx) => createConvexAuthAdapter(ctx, component, {
+      authFunctions: options.authFunctions,
+      triggers: options.triggers
+    }),
+    safeGetAuthUser,
+    getAuthUser: async (ctx) => {
+      const user = await safeGetAuthUser(ctx);
+      if (!user) throw new ConvexError("Unauthenticated");
+      return user;
+    },
+    validateOAuthAccess: (ctx, access) => validateOAuthAccess(ctx, component, access),
+    getAuth: async (createAuth, ctx) => {
+      const authenticated = await safeGetAuthSession(ctx);
+      if (!authenticated || typeof authenticated.session.token !== "string") {
+        throw new ConvexError("Unauthenticated");
+      }
+      const auth = await createAuth(ctx);
+      if (auth && typeof auth === "object" && "$context" in auth) {
+        await auth.$context;
+      }
+      return {
+        auth,
+        headers: new Headers({
+          authorization: `Bearer ${authenticated.session.token}`,
+          [INTERNAL_SESSION_HEADER]: "1"
+        })
+      };
+    },
+    triggerFunctions: () => ({
+      onCreate: internalMutationGeneric({
+        args: { doc: v.any(), model: v.string() },
+        handler: async (ctx, args) => options.triggers?.[args.model]?.onCreate?.(ctx, args.doc)
+      }),
+      onDelete: internalMutationGeneric({
+        args: { doc: v.any(), model: v.string() },
+        handler: async (ctx, args) => options.triggers?.[args.model]?.onDelete?.(ctx, args.doc)
+      }),
+      onUpdate: internalMutationGeneric({
+        args: { model: v.string(), newDoc: v.any(), oldDoc: v.any() },
+        handler: async (ctx, args) => options.triggers?.[args.model]?.onUpdate?.(ctx, args.newDoc, args.oldDoc)
+      })
+    }),
+    jwksOperatorFunctions: (createAuth) => ({
+      rotateSigningKey: internalActionGeneric({
+        args: {},
+        handler: async (ctx) => {
+          const auth = await createAuth(ctx);
+          if (!auth || typeof auth !== "object" || !("$context" in auth)) {
+            throw new Error("AUTH_JWT_PLUGIN_REQUIRED");
+          }
+          const authContext = await auth.$context;
+          const jwtPlugin = authContext.getPlugin("jwt");
+          if (!jwtPlugin) throw new Error("AUTH_JWT_PLUGIN_REQUIRED");
+          return rotateSigningKeyWithOfficialJwt(
+            authContext,
+            jwtPlugin.options,
+            async (next) => ctx.runMutation(component.adapter.rotateSigningKey, { next })
+          );
+        }
+      })
+    }),
+    registerRoutes: (http, createAuth) => {
+      const handler = httpActionGeneric(async (ctx, request) => {
+        try {
+          const publicOrigin = requireAuthOrigin("SITE_URL");
+          const verifiedClientIp = await resolveVerifiedClientIp(
+            request,
+            async () => (await ctx.meta.getRequestMetadata()).ip,
+            process.env.BCN_AUTH_PROXY_IP_SECRET
+          );
+          const auth = await createAuth(ctx);
+          await auth.$context;
+          return await auth.handler(rewriteToPublicOrigin(request, publicOrigin, verifiedClientIp));
+        } catch {
+          return Response.json({ code: "AUTH_CONFIG_INVALID" }, { status: 500 });
+        }
+      });
+      http.route({ handler, method: "GET", pathPrefix: "/api/auth/" });
+      http.route({ handler, method: "POST", pathPrefix: "/api/auth/" });
+    }
+  };
+}

package/dist/runtime/convex-auth/index.d.ts

@@ -0,0 +1,11 @@
+export { defineAuthAdapterFunctions } from './adapter/define-functions.js';
+export { createAuthComponent } from './create-auth-component.js';
+export { requireAuthOrigin } from './origin.js';
+export { convexAuth } from './plugin.js';
+export { getConvexAuthProvider } from './provider.js';
+export { createBetterAuthMcpAccessVerifier, verifyOAuthBearerToken } from './oauth-resource.js';
+export { createUserProjectionTriggers } from './user-projection.js';
+export type { AuthCtx } from './context.js';
+export type { AuthComponentTriggers, AuthFunctions, CreateAuth } from './types.js';
+export type { BetterAuthMcpAccessVerifierOptions, VerifyOAuthBearerTokenOptions, } from './oauth-resource.js';
+export type { BetterAuthUserProjectionSource, CreateUserProjectionTriggersOptions, } from './user-projection.js';

package/dist/runtime/convex-auth/index.js

@@ -0,0 +1,7 @@
+export { defineAuthAdapterFunctions } from "./adapter/define-functions.js";
+export { createAuthComponent } from "./create-auth-component.js";
+export { requireAuthOrigin } from "./origin.js";
+export { convexAuth } from "./plugin.js";
+export { getConvexAuthProvider } from "./provider.js";
+export { createBetterAuthMcpAccessVerifier, verifyOAuthBearerToken } from "./oauth-resource.js";
+export { createUserProjectionTriggers } from "./user-projection.js";

package/dist/runtime/convex-auth/internal-session.d.ts

@@ -0,0 +1,2 @@
+/** Removed by both public HTTP boundaries; used only for in-process Better Auth API calls. */
+export declare const INTERNAL_SESSION_HEADER = "x-bcn-internal-session";

package/dist/runtime/convex-auth/internal-session.js

@@ -0,0 +1 @@
+export const INTERNAL_SESSION_HEADER = "x-bcn-internal-session";

package/dist/runtime/convex-auth/jwks-rotation.d.ts

@@ -0,0 +1,58 @@
+import type { Jwk, JwtOptions } from 'better-auth/plugins';
+import { createJwk } from 'better-auth/plugins';
+export declare const JWKS_MAX_TOKEN_LIFETIME_SECONDS: number;
+export declare const JWKS_CACHE_LIFETIME_SECONDS: number;
+export declare const JWKS_CLOCK_SKEW_SECONDS = 60;
+export declare const JWKS_GRACE_PERIOD_SECONDS: number;
+export declare const JWKS_CACHE_CONTROL = "public, max-age=300, must-revalidate";
+export declare const signingKeyCandidateValidator: import("convex/values").VObject<{
+    id: string;
+    alg: "RS256";
+    crv: null;
+    privateKey: string;
+    publicKey: string;
+}, {
+    alg: import("convex/values").VLiteral<"RS256", "required">;
+    crv: import("convex/values").VNull<null, "required">;
+    id: import("convex/values").VString<string, "required">;
+    privateKey: import("convex/values").VString<string, "required">;
+    publicKey: import("convex/values").VString<string, "required">;
+}, "required", "id" | "alg" | "crv" | "privateKey" | "publicKey">;
+export interface SigningKeyCandidate {
+    alg: 'RS256';
+    crv: null;
+    id: string;
+    privateKey: string;
+    publicKey: string;
+}
+export interface SigningKeyRotationMetadata {
+    createdAt: number;
+    newKid: string;
+    previousKids: string[];
+    previousVerifyUntil: number;
+    rotatedAt: number;
+}
+type BetterAuthEndpointContext = Parameters<typeof createJwk>[0]['context'];
+type CreateJwkAdapter = NonNullable<NonNullable<JwtOptions['adapter']>['createJwk']>;
+/**
+ * Validate and canonicalize the one public key shape emitted by the pinned
+ * Better Auth RS256 generator. A tuple update must review this projection.
+ */
+export declare function canonicalizePublicRsaJwk(value: string): string;
+export declare function normalizeSigningKeyCandidate(candidate: SigningKeyCandidate): SigningKeyCandidate;
+/**
+ * The JWT plugin reads these rows for both signing and public serialization.
+ * Keep the encrypted private field for signing, but replace the public JSON
+ * with the exact public projection before Better Auth spreads it into `/jwks`.
+ */
+export declare function sanitizeStoredJwk(jwk: Jwk): Jwk;
+export declare function createPublicJwksResponse(rows: Jwk[], method: string, now?: number): Response;
+export declare const rejectImplicitSigningKeyCreation: CreateJwkAdapter;
+export declare function assertSupportedJwksOptions(options: JwtOptions | undefined, code: string): void;
+/**
+ * Generate and encrypt a key through Better Auth, then let one Convex mutation
+ * own insertion and retirement. The generated action timestamp and any
+ * rotationInterval expiry are deliberately not forwarded to the mutation.
+ */
+export declare function rotateSigningKeyWithOfficialJwt(context: BetterAuthEndpointContext, options: JwtOptions, commit: (candidate: SigningKeyCandidate) => Promise<SigningKeyRotationMetadata>): Promise<SigningKeyRotationMetadata>;
+export {};

package/dist/runtime/convex-auth/jwks-rotation.js

@@ -0,0 +1,163 @@
+import { createJwk } from "better-auth/plugins";
+import { v } from "convex/values";
+export const JWKS_MAX_TOKEN_LIFETIME_SECONDS = 15 * 60;
+export const JWKS_CACHE_LIFETIME_SECONDS = 5 * 60;
+export const JWKS_CLOCK_SKEW_SECONDS = 60;
+export const JWKS_GRACE_PERIOD_SECONDS = JWKS_MAX_TOKEN_LIFETIME_SECONDS + JWKS_CACHE_LIFETIME_SECONDS + JWKS_CLOCK_SKEW_SECONDS;
+export const JWKS_CACHE_CONTROL = `public, max-age=${JWKS_CACHE_LIFETIME_SECONDS}, must-revalidate`;
+const MAX_KEY_ID_LENGTH = 256;
+const MAX_PUBLIC_JWK_LENGTH = 16 * 1024;
+const MAX_ENCRYPTED_PRIVATE_JWK_LENGTH = 64 * 1024;
+const PRIVATE_JWK_MEMBERS = /* @__PURE__ */ new Set(["d", "p", "q", "dp", "dq", "qi", "oth", "k"]);
+const PUBLIC_RSA_JWK_MEMBERS = /* @__PURE__ */ new Set(["e", "kty", "n"]);
+const VERSIONED_CIPHERTEXT_PATTERN = /^\$ba\$(?:0|[1-9]\d*)\$(?:[0-9a-f]{2})+$/u;
+export const signingKeyCandidateValidator = v.object({
+  alg: v.literal("RS256"),
+  crv: v.null(),
+  id: v.string(),
+  privateKey: v.string(),
+  publicKey: v.string()
+});
+function assertBoundedString(value, maximum, code) {
+  if (value.length === 0 || value.length > maximum) throw new Error(code);
+}
+function parseJson(value, maximum, code) {
+  assertBoundedString(value, maximum, code);
+  try {
+    return JSON.parse(value);
+  } catch {
+    throw new Error(code);
+  }
+}
+function assertNoPrivateJwkMembers(value) {
+  if (Array.isArray(value)) {
+    for (const entry of value) assertNoPrivateJwkMembers(entry);
+    return;
+  }
+  if (!value || typeof value !== "object") return;
+  for (const [name, entry] of Object.entries(value)) {
+    if (PRIVATE_JWK_MEMBERS.has(name)) throw new Error("AUTH_JWKS_PUBLIC_KEY_INVALID");
+    assertNoPrivateJwkMembers(entry);
+  }
+}
+export function canonicalizePublicRsaJwk(value) {
+  const parsed = parseJson(value, MAX_PUBLIC_JWK_LENGTH, "AUTH_JWKS_PUBLIC_KEY_INVALID");
+  if (!parsed || typeof parsed !== "object" || Array.isArray(parsed)) {
+    throw new Error("AUTH_JWKS_PUBLIC_KEY_INVALID");
+  }
+  assertNoPrivateJwkMembers(parsed);
+  const key = parsed;
+  if (Object.keys(key).some((name) => !PUBLIC_RSA_JWK_MEMBERS.has(name)) || key.kty !== "RSA" || typeof key.n !== "string" || key.n.length === 0 || typeof key.e !== "string" || key.e.length === 0) {
+    throw new Error("AUTH_JWKS_PUBLIC_KEY_INVALID");
+  }
+  return JSON.stringify({ kty: "RSA", n: key.n, e: key.e });
+}
+function assertVersionedEncryptedPrivateJwk(value) {
+  const parsed = parseJson(
+    value,
+    MAX_ENCRYPTED_PRIVATE_JWK_LENGTH,
+    "AUTH_JWKS_PRIVATE_KEY_NOT_ENCRYPTED"
+  );
+  if (typeof parsed !== "string" || !VERSIONED_CIPHERTEXT_PATTERN.test(parsed)) {
+    throw new Error("AUTH_JWKS_PRIVATE_KEY_NOT_ENCRYPTED");
+  }
+}
+export function normalizeSigningKeyCandidate(candidate) {
+  assertBoundedString(candidate.id, MAX_KEY_ID_LENGTH, "AUTH_JWKS_KEY_ID_INVALID");
+  if (/\p{C}/u.test(candidate.id)) throw new Error("AUTH_JWKS_KEY_ID_INVALID");
+  if (candidate.alg !== "RS256" || candidate.crv !== null) {
+    throw new Error("AUTH_JWKS_ALGORITHM_INVALID");
+  }
+  assertVersionedEncryptedPrivateJwk(candidate.privateKey);
+  return {
+    ...candidate,
+    publicKey: canonicalizePublicRsaJwk(candidate.publicKey)
+  };
+}
+export function sanitizeStoredJwk(jwk) {
+  return { ...jwk, publicKey: canonicalizePublicRsaJwk(jwk.publicKey) };
+}
+export function createPublicJwksResponse(rows, method, now = Date.now()) {
+  const live = rows.filter((row) => {
+    if (row.expiresAt === null || row.expiresAt === void 0) return true;
+    if (!(row.expiresAt instanceof Date) || !Number.isFinite(row.expiresAt.getTime())) {
+      throw new TypeError("AUTH_JWKS_EXPIRY_INVALID");
+    }
+    return row.expiresAt.getTime() + JWKS_GRACE_PERIOD_SECONDS * 1e3 > now;
+  });
+  if (live.length === 0) {
+    return new Response(
+      method === "HEAD" ? null : JSON.stringify({ code: "SERVICE_UNAVAILABLE", message: "Signing keys are not ready" }),
+      {
+        headers: {
+          "Cache-Control": "private, no-store",
+          "Content-Type": "application/json"
+        },
+        status: 503
+      }
+    );
+  }
+  const keys = live.map((stored) => {
+    const row = sanitizeStoredJwk(stored);
+    assertBoundedString(row.id, MAX_KEY_ID_LENGTH, "AUTH_JWKS_PUBLIC_KEY_INVALID");
+    if (/\p{C}/u.test(row.id) || row.alg !== "RS256" || row.crv !== null && row.crv !== void 0) {
+      throw new Error("AUTH_JWKS_PUBLIC_KEY_INVALID");
+    }
+    return {
+      alg: "RS256",
+      ...JSON.parse(row.publicKey),
+      kid: row.id
+    };
+  });
+  const headers = {
+    "Cache-Control": JWKS_CACHE_CONTROL,
+    "Content-Type": "application/json"
+  };
+  return method === "HEAD" ? new Response(null, { headers, status: 200 }) : Response.json({ keys }, { headers });
+}
+export const rejectImplicitSigningKeyCreation = async () => {
+  throw new Error("AUTH_JWKS_OPERATOR_SETUP_REQUIRED");
+};
+export function assertSupportedJwksOptions(options, code) {
+  if (!options || options.disableSettingJwtHeader !== true || options.jwks?.disablePrivateKeyEncryption !== false || options.jwks.gracePeriod !== JWKS_GRACE_PERIOD_SECONDS || options.jwks.keyPairConfig?.alg !== "RS256" || options.jwks.rotationInterval !== void 0 || options.jwks.remoteUrl !== void 0 || options.jwks.jwksPath !== void 0 && options.jwks.jwksPath !== "/jwks" || options.jwks.keyPairConfigs !== void 0 && options.jwks.keyPairConfigs.length !== 0 || options.adapter?.createJwk !== void 0 && options.adapter.createJwk !== rejectImplicitSigningKeyCreation) {
+    throw new Error(code);
+  }
+}
+export async function rotateSigningKeyWithOfficialJwt(context, options, commit) {
+  assertSupportedJwksOptions(options, "AUTH_JWKS_CONFIG_INVALID");
+  let committed;
+  await createJwk({ context }, {
+    ...options,
+    adapter: {
+      ...options.adapter,
+      createJwk: async (generated, endpointContext) => {
+        if (generated.alg !== "RS256" || generated.crv !== void 0) {
+          throw new Error("AUTH_JWKS_ALGORITHM_INVALID");
+        }
+        const id = endpointContext.context.generateId({ model: "jwks" });
+        if (typeof id !== "string" || id.length === 0) {
+          throw new Error("AUTH_JWKS_KEY_ID_INVALID");
+        }
+        const candidate = normalizeSigningKeyCandidate({
+          alg: generated.alg,
+          crv: null,
+          id,
+          privateKey: generated.privateKey,
+          publicKey: generated.publicKey
+        });
+        committed = await commit(candidate);
+        return {
+          ...generated,
+          alg: "RS256",
+          createdAt: new Date(committed.createdAt),
+          crv: void 0,
+          expiresAt: void 0,
+          id,
+          publicKey: candidate.publicKey
+        };
+      }
+    }
+  });
+  if (!committed) throw new Error("AUTH_JWKS_ROTATION_NOT_COMMITTED");
+  return committed;
+}

package/dist/runtime/convex-auth/oauth-live-access.d.ts

@@ -0,0 +1,17 @@
+import type { GenericDataModel } from 'convex/server';
+import type { AuthCtx } from './context.js';
+import type { AuthAdapterComponentApi } from './types.js';
+/** Provider-owned authority needed to revalidate a verified OAuth access token. */
+export interface OAuthLiveAccess {
+    readonly clientId: string;
+    readonly issuer: string;
+    readonly resource: string;
+    readonly scopes: readonly string[];
+    readonly sessionId: string;
+    readonly subject: string;
+}
+/**
+ * Rechecks provider-owned authority from indexed Better Auth records. A disabled resource remains
+ * valid for an already-issued token, matching the pinned provider; deleting it revokes access.
+ */
+export declare function validateOAuthAccess<DataModel extends GenericDataModel>(ctx: AuthCtx<DataModel>, component: AuthAdapterComponentApi, access: OAuthLiveAccess): Promise<boolean>;

package/dist/runtime/convex-auth/oauth-live-access.js

@@ -0,0 +1,78 @@
+function nonEmptyString(value) {
+  return typeof value === "string" && value.length > 0;
+}
+function stringArray(value) {
+  return Array.isArray(value) && value.every(nonEmptyString) && new Set(value).size === value.length ? value : void 0;
+}
+function containsEvery(values, required) {
+  const available = new Set(values);
+  return required.every((value) => available.has(value));
+}
+function validAccess(value) {
+  if (!value || !nonEmptyString(value.clientId) || !nonEmptyString(value.issuer) || !nonEmptyString(value.resource) || !nonEmptyString(value.sessionId) || !nonEmptyString(value.subject) || !Array.isArray(value.scopes) || value.scopes.length === 0 || !value.scopes.every(nonEmptyString)) {
+    return false;
+  }
+  return new Set(value.scopes).size === value.scopes.length;
+}
+async function findOne(ctx, component, model, where, select) {
+  return await ctx.runQuery(component.adapter.findOne, {
+    model,
+    select: [...select],
+    where: [...where]
+  });
+}
+export async function validateOAuthAccess(ctx, component, access) {
+  if (!validAccess(access)) return false;
+  try {
+    const [session, user, client, resource, link, consent] = await Promise.all([
+      findOne(
+        ctx,
+        component,
+        "session",
+        [{ field: "id", value: access.sessionId }],
+        ["expiresAt", "id", "userId"]
+      ),
+      findOne(ctx, component, "user", [{ field: "id", value: access.subject }], ["id"]),
+      findOne(
+        ctx,
+        component,
+        "oauthClient",
+        [{ field: "clientId", value: access.clientId }],
+        ["clientId", "disabled", "scopes"]
+      ),
+      findOne(
+        ctx,
+        component,
+        "oauthResource",
+        [{ field: "identifier", value: access.resource }],
+        ["allowedScopes", "identifier"]
+      ),
+      findOne(
+        ctx,
+        component,
+        "oauthClientResource",
+        [{ field: "id", value: `${access.clientId}::${access.resource}` }],
+        ["clientId", "id", "resourceId"]
+      ),
+      findOne(
+        ctx,
+        component,
+        "oauthConsent",
+        [
+          { field: "clientId", value: access.clientId },
+          { field: "userId", value: access.subject }
+        ],
+        ["clientId", "resources", "scopes", "userId"]
+      )
+    ]);
+    const clientScopes = stringArray(client?.scopes);
+    const resourceScopes = resource?.allowedScopes === null ? null : stringArray(resource?.allowedScopes);
+    const consentResources = stringArray(consent?.resources);
+    const consentScopes = stringArray(consent?.scopes);
+    return Boolean(
+      session && session.id === access.sessionId && session.userId === access.subject && typeof session.expiresAt === "number" && Number.isFinite(session.expiresAt) && session.expiresAt > Date.now() && user?.id === access.subject && client && client.clientId === access.clientId && client.disabled !== true && clientScopes && containsEvery(clientScopes, access.scopes) && resource && resource.identifier === access.resource && resourceScopes !== void 0 && (resourceScopes === null || containsEvery(resourceScopes, access.scopes)) && link && link.id === `${access.clientId}::${access.resource}` && link.clientId === access.clientId && link.resourceId === access.resource && consent && consent.clientId === access.clientId && consent.userId === access.subject && consentResources?.includes(access.resource) && consentScopes && containsEvery(consentScopes, access.scopes)
+    );
+  } catch {
+    return false;
+  }
+}

package/dist/runtime/convex-auth/oauth-provider-compat.d.ts

@@ -0,0 +1,10 @@
+import type { BetterAuthPlugin } from 'better-auth';
+import { type hardenOAuthProviderCallbacks, type PinnedOAuthProviderProfile } from './oauth-security.js';
+interface InstalledOAuthProviderPlugin extends BetterAuthPlugin {
+    options?: Record<string, unknown>;
+}
+export declare function validatePinnedOAuthProviderRuntime(context: Parameters<NonNullable<BetterAuthPlugin['init']>>[0], options: PinnedOAuthProviderProfile, hardened: ReturnType<typeof hardenOAuthProviderCallbacks>): InstalledOAuthProviderPlugin['options'];
+export declare function assertSafePinnedClientProvisioning(method: unknown, body: unknown, allowedScopes: readonly string[]): void;
+export declare function assertSafePinnedClientUpdate(method: unknown, body: unknown, allowedScopes: readonly string[]): void;
+export declare function assertSafePinnedResourceProvisioning(method: unknown, body: unknown, allowedScopes: readonly string[]): void;
+export {};