@lupinum/better-convex-nuxt 0.8.0-beta.40

package/dist/runtime/convex-auth/adapter/create-adapter.js

@@ -0,0 +1,308 @@
+import {
+  createAdapterFactory
+} from "better-auth/adapters";
+import { symmetricDecrypt, symmetricEncrypt } from "better-auth/crypto";
+import { createFunctionHandle } from "convex/server";
+import { isWritableAuthCtx, requireWritableAuthCtx } from "../context.js";
+import { createAuthSchema } from "./generate-schema.js";
+function toComponentWhere(where) {
+  return where?.map((condition) => ({
+    ...condition,
+    value: condition.value instanceof Date ? condition.value.getTime() : Array.isArray(condition.value) ? [...condition.value] : condition.value
+  }));
+}
+const encryptedEnvelopePrefix = "$ba$";
+function parseVersionedSecrets(raw) {
+  if (!raw) return [];
+  return raw.split(",").map((entry) => {
+    const separator = entry.indexOf(":");
+    const versionText = separator < 0 ? "" : entry.slice(0, separator).trim();
+    const value = separator < 0 ? "" : entry.slice(separator + 1).trim();
+    const version = Number(versionText);
+    if (!/^(?:0|[1-9]\d*)$/u.test(versionText) || !Number.isSafeInteger(version) || value.length === 0) {
+      throw new Error("AUTH_VERSIONED_SECRETS_INVALID");
+    }
+    return { value, version };
+  });
+}
+function idTokenSecretConfig(options) {
+  const entries = options.secrets ?? parseVersionedSecrets(process.env.BETTER_AUTH_SECRETS);
+  if (entries.length === 0) throw new Error("AUTH_VERSIONED_SECRETS_REQUIRED");
+  const keys = /* @__PURE__ */ new Map();
+  for (const entry of entries) {
+    if (keys.has(entry.version)) throw new Error("AUTH_VERSIONED_SECRETS_INVALID");
+    keys.set(entry.version, entry.value);
+  }
+  return {
+    currentVersion: entries[0].version,
+    keys
+  };
+}
+function assertNoLegacyAuthSecretEnvironment() {
+  if (process.env.BETTER_AUTH_SECRET !== void 0 || process.env.AUTH_SECRET !== void 0) {
+    throw new Error("AUTH_LEGACY_SECRET_UNSUPPORTED");
+  }
+}
+export function createAccountIdTokenProtector(options) {
+  assertNoLegacyAuthSecretEnvironment();
+  const accountModel = options.account?.modelName ?? "account";
+  const idTokenField = options.account?.fields?.idToken ?? "idToken";
+  const transform = async (model, data, direction) => {
+    if (model !== accountModel || !data || typeof data !== "object" || Array.isArray(data) || !(idTokenField in data)) {
+      return data;
+    }
+    const value = data[idTokenField];
+    if (value === null || value === void 0 || value === "") return data;
+    if (typeof value !== "string") throw new Error("AUTH_ID_TOKEN_INVALID");
+    if (options.account?.encryptOAuthTokens !== true) {
+      throw new Error("AUTH_OAUTH_TOKEN_ENCRYPTION_REQUIRED");
+    }
+    const secretConfig = idTokenSecretConfig(options);
+    if (direction === "reveal" && !value.startsWith(encryptedEnvelopePrefix)) {
+      throw new Error("AUTH_ID_TOKEN_AT_REST_UNENCRYPTED");
+    }
+    let transformed;
+    try {
+      if (direction === "protect") {
+        if (value.startsWith(encryptedEnvelopePrefix)) {
+          await symmetricDecrypt({ data: value, key: secretConfig });
+          transformed = value;
+        } else {
+          transformed = await symmetricEncrypt({ data: value, key: secretConfig });
+        }
+      } else {
+        transformed = await symmetricDecrypt({ data: value, key: secretConfig });
+      }
+    } catch {
+      throw new Error(
+        direction === "protect" ? "AUTH_ID_TOKEN_ENCRYPTION_FAILED" : "AUTH_ID_TOKEN_DECRYPTION_FAILED"
+      );
+    }
+    return { ...data, [idTokenField]: transformed };
+  };
+  return {
+    protect: (model, data) => transform(model, data, "protect"),
+    reveal: (model, data) => transform(model, data, "reveal")
+  };
+}
+function toEpochMilliseconds(data) {
+  if (data === null || data === void 0) return data;
+  const value = data instanceof Date ? data.getTime() : new Date(data).getTime();
+  if (!Number.isFinite(value)) throw new Error("AUTH_DATE_INVALID");
+  return value;
+}
+function toDate(data) {
+  if (data === null || data === void 0 || data instanceof Date) return data;
+  if (typeof data !== "number" || !Number.isFinite(data)) throw new Error("AUTH_DATE_INVALID");
+  return new Date(data);
+}
+async function collectPages(next, limit) {
+  if (limit !== void 0 && (!Number.isSafeInteger(limit) || limit < 0)) {
+    throw new Error("AUTH_LIMIT_INVALID");
+  }
+  if (limit === 0) return [];
+  const rows = [];
+  let cursor = null;
+  let complete = false;
+  while (!complete) {
+    const remaining = limit === void 0 ? 200 : Math.min(200, limit - rows.length);
+    if (remaining <= 0) break;
+    const cursorBefore = cursor;
+    const result = await next({ cursor, numItems: remaining });
+    rows.push(...result.page);
+    if (result.isDone || limit !== void 0 && rows.length >= limit) {
+      complete = true;
+      continue;
+    }
+    cursor = result.continueCursor;
+    if (cursor === cursorBefore && result.page.length === 0) {
+      throw new Error("AUTH_PAGINATION_STALLED");
+    }
+  }
+  return limit === void 0 ? rows : rows.slice(0, limit);
+}
+function configuredTriggerModels(triggers, event) {
+  return Object.entries(triggers ?? {}).flatMap(
+    ([model, configured]) => typeof configured?.[event] === "function" ? [model] : []
+  );
+}
+export function createConvexAuthAdapter(ctx, component, adapterOptions = {}) {
+  const handleCache = /* @__PURE__ */ new Map();
+  return createAdapterFactory({
+    config: {
+      adapterId: "@lupinum/better-convex-nuxt",
+      adapterName: "Better Convex Nuxt",
+      debugLogs: adapterOptions.debugLogs ?? false,
+      transaction: false,
+      supportsNumericIds: false,
+      supportsUUIDs: false,
+      supportsJSON: false,
+      supportsDates: false,
+      supportsBooleans: true,
+      supportsArrays: true,
+      usePlural: false,
+      customTransformInput: ({ data, fieldAttributes }) => fieldAttributes.type === "date" ? toEpochMilliseconds(data) : data,
+      customTransformOutput: ({ data, fieldAttributes }) => fieldAttributes.type === "date" ? toDate(data) : data
+    },
+    adapter: ({ getFieldName, getModelName, options }) => {
+      options.telemetry = { enabled: false };
+      if (options.advanced?.database?.joins) throw new Error("AUTH_JOINS_UNSUPPORTED");
+      const idTokens = createAccountIdTokenProtector(options);
+      const triggerModels = {
+        onCreate: configuredTriggerModels(adapterOptions.triggers, "onCreate").map(getModelName),
+        onDelete: configuredTriggerModels(adapterOptions.triggers, "onDelete").map(getModelName),
+        onUpdate: configuredTriggerModels(adapterOptions.triggers, "onUpdate").map(getModelName)
+      };
+      const triggerHandle = (model, event) => {
+        const cacheKey = `${event}:${model}`;
+        const existing = handleCache.get(cacheKey);
+        if (existing) return existing;
+        const reference = adapterOptions.authFunctions?.[event];
+        const value = reference && triggerModels[event].includes(model) ? createFunctionHandle(reference).then(String) : Promise.resolve(void 0);
+        handleCache.set(cacheKey, value);
+        return value;
+      };
+      const relationshipTriggerHandle = (event) => {
+        const cacheKey = `relationship:${event}`;
+        const existing = handleCache.get(cacheKey);
+        if (existing) return existing;
+        const reference = adapterOptions.authFunctions?.[event];
+        const value = reference && triggerModels[event].length > 0 ? createFunctionHandle(reference).then(String) : Promise.resolve(void 0);
+        handleCache.set(cacheKey, value);
+        return value;
+      };
+      const mapSelect = (model, select) => select?.map((field) => getFieldName({ model, field }));
+      const mapSort = (model, sortBy) => sortBy ? { ...sortBy, field: getFieldName({ model, field: sortBy.field }) } : void 0;
+      const adapter = {
+        options: { isRunMutationCtx: isWritableAuthCtx(ctx) },
+        createSchema: createAuthSchema,
+        create: async ({
+          model,
+          data
+        }) => {
+          requireWritableAuthCtx(ctx);
+          const created = await ctx.runMutation(component.adapter.create, {
+            model,
+            data: await idTokens.protect(model, data),
+            onCreateHandle: await triggerHandle(model, "onCreate")
+          });
+          return idTokens.reveal(model, created);
+        },
+        findOne: async ({
+          model,
+          where,
+          select
+        }) => {
+          const found = await ctx.runQuery(component.adapter.findOne, {
+            model,
+            where: toComponentWhere(where),
+            select: mapSelect(model, select)
+          });
+          return idTokens.reveal(model, found);
+        },
+        findMany: async ({
+          model,
+          where,
+          limit,
+          select,
+          sortBy,
+          offset
+        }) => {
+          if (offset !== void 0 && offset !== 0) throw new Error("AUTH_OFFSET_UNSUPPORTED");
+          const componentSelect = mapSelect(model, select);
+          const componentSortBy = mapSort(model, sortBy);
+          const rows = await collectPages(
+            (paginationOpts) => ctx.runQuery(component.adapter.findMany, {
+              model,
+              where: toComponentWhere(where),
+              select: componentSelect,
+              sortBy: componentSortBy,
+              paginationOpts
+            }),
+            limit
+          );
+          return Promise.all(rows.map((row) => idTokens.reveal(model, row)));
+        },
+        count: ({ model, where }) => ctx.runQuery(component.adapter.count, { model, where: toComponentWhere(where) }),
+        update: async ({
+          model,
+          where,
+          update
+        }) => {
+          requireWritableAuthCtx(ctx);
+          if (where.length === 0) return null;
+          const updated = await ctx.runMutation(component.adapter.updateOne, {
+            model,
+            where: toComponentWhere(where),
+            update: await idTokens.protect(model, update),
+            onUpdateHandle: await triggerHandle(model, "onUpdate")
+          });
+          return idTokens.reveal(model, updated);
+        },
+        updateMany: async ({ model, where, update }) => {
+          requireWritableAuthCtx(ctx);
+          return ctx.runMutation(component.adapter.updateMany, {
+            model,
+            where: toComponentWhere(where),
+            update: await idTokens.protect(model, update),
+            onUpdateHandle: await triggerHandle(model, "onUpdate")
+          });
+        },
+        delete: async ({ model, where }) => {
+          requireWritableAuthCtx(ctx);
+          await ctx.runMutation(component.adapter.deleteOne, {
+            model,
+            where: toComponentWhere(where),
+            onDeleteHandle: await relationshipTriggerHandle("onDelete"),
+            onDeleteModels: triggerModels.onDelete,
+            onUpdateHandle: await relationshipTriggerHandle("onUpdate"),
+            onUpdateModels: triggerModels.onUpdate
+          });
+        },
+        deleteMany: async ({ model, where }) => {
+          requireWritableAuthCtx(ctx);
+          return ctx.runMutation(component.adapter.deleteMany, {
+            model,
+            where: toComponentWhere(where),
+            onDeleteHandle: await relationshipTriggerHandle("onDelete"),
+            onDeleteModels: triggerModels.onDelete,
+            onUpdateHandle: await relationshipTriggerHandle("onUpdate"),
+            onUpdateModels: triggerModels.onUpdate
+          });
+        },
+        consumeOne: async ({
+          model,
+          where
+        }) => {
+          requireWritableAuthCtx(ctx);
+          const consumed = await ctx.runMutation(component.adapter.consumeOne, {
+            model,
+            where: toComponentWhere(where),
+            onDeleteHandle: await relationshipTriggerHandle("onDelete"),
+            onDeleteModels: triggerModels.onDelete,
+            onUpdateHandle: await relationshipTriggerHandle("onUpdate"),
+            onUpdateModels: triggerModels.onUpdate
+          });
+          return idTokens.reveal(model, consumed);
+        },
+        incrementOne: async ({
+          model,
+          where,
+          increment,
+          set
+        }) => {
+          requireWritableAuthCtx(ctx);
+          const incremented = await ctx.runMutation(component.adapter.incrementOne, {
+            model,
+            where: toComponentWhere(where),
+            increment,
+            set: await idTokens.protect(model, set),
+            onUpdateHandle: await triggerHandle(model, "onUpdate")
+          });
+          return idTokens.reveal(model, incremented);
+        }
+      };
+      return adapter;
+    }
+  });
+}

package/dist/runtime/convex-auth/adapter/define-functions.d.ts

@@ -0,0 +1,160 @@
+import { type SchemaDefinition } from 'convex/server';
+import type { AuthSchemaMetadata } from './metadata.js';
+export interface DefineAuthAdapterFunctionsOptions<Schema extends SchemaDefinition<any, any>> {
+    schema: Schema;
+    metadata: AuthSchemaMetadata;
+}
+export declare function defineAuthAdapterFunctions<Schema extends SchemaDefinition<any, any>>({ schema, metadata, }: DefineAuthAdapterFunctionsOptions<Schema>): {
+    create: import("convex/server").RegisteredMutation<"public", {
+        onCreateHandle?: string | undefined;
+        data: any;
+        model: string;
+    }, Promise<Record<string, unknown> | null>>;
+    findOne: import("convex/server").RegisteredQuery<"public", {
+        join?: any;
+        select?: string[] | undefined;
+        where?: {
+            mode?: "sensitive" | "insensitive" | undefined;
+            operator?: "in" | "lt" | "lte" | "gt" | "gte" | "eq" | "not_in" | "ne" | "contains" | "starts_with" | "ends_with" | undefined;
+            connector?: "AND" | "OR" | undefined;
+            value: string | number | boolean | string[] | number[] | null;
+            field: string;
+        }[] | undefined;
+        offset?: number | undefined;
+        sortBy?: {
+            field: string;
+            direction: "asc" | "desc";
+        } | undefined;
+        model: string;
+    }, Promise<Record<string, unknown> | null>>;
+    findMany: import("convex/server").RegisteredQuery<"public", {
+        join?: any;
+        select?: string[] | undefined;
+        where?: {
+            mode?: "sensitive" | "insensitive" | undefined;
+            operator?: "in" | "lt" | "lte" | "gt" | "gte" | "eq" | "not_in" | "ne" | "contains" | "starts_with" | "ends_with" | undefined;
+            connector?: "AND" | "OR" | undefined;
+            value: string | number | boolean | string[] | number[] | null;
+            field: string;
+        }[] | undefined;
+        limit?: number | undefined;
+        offset?: number | undefined;
+        sortBy?: {
+            field: string;
+            direction: "asc" | "desc";
+        } | undefined;
+        paginationOpts: {
+            id?: number;
+            endCursor?: string | null;
+            maximumRowsRead?: number;
+            maximumBytesRead?: number;
+            numItems: number;
+            cursor: string | null;
+        };
+        model: string;
+    }, Promise<any>>;
+    count: import("convex/server").RegisteredQuery<"public", {
+        where?: {
+            mode?: "sensitive" | "insensitive" | undefined;
+            operator?: "in" | "lt" | "lte" | "gt" | "gte" | "eq" | "not_in" | "ne" | "contains" | "starts_with" | "ends_with" | undefined;
+            connector?: "AND" | "OR" | undefined;
+            value: string | number | boolean | string[] | number[] | null;
+            field: string;
+        }[] | undefined;
+        model: string;
+    }, Promise<number>>;
+    updateOne: import("convex/server").RegisteredMutation<"public", {
+        onUpdateHandle?: string | undefined;
+        update: any;
+        model: string;
+        where: {
+            mode?: "sensitive" | "insensitive" | undefined;
+            operator?: "in" | "lt" | "lte" | "gt" | "gte" | "eq" | "not_in" | "ne" | "contains" | "starts_with" | "ends_with" | undefined;
+            connector?: "AND" | "OR" | undefined;
+            value: string | number | boolean | string[] | number[] | null;
+            field: string;
+        }[];
+    }, Promise<Record<string, unknown> | null>>;
+    updateMany: import("convex/server").RegisteredMutation<"public", {
+        onUpdateHandle?: string | undefined;
+        update: any;
+        model: string;
+        where: {
+            mode?: "sensitive" | "insensitive" | undefined;
+            operator?: "in" | "lt" | "lte" | "gt" | "gte" | "eq" | "not_in" | "ne" | "contains" | "starts_with" | "ends_with" | undefined;
+            connector?: "AND" | "OR" | undefined;
+            value: string | number | boolean | string[] | number[] | null;
+            field: string;
+        }[];
+    }, Promise<number>>;
+    deleteOne: import("convex/server").RegisteredMutation<"public", {
+        onDeleteHandle?: string | undefined;
+        onDeleteModels?: string[] | undefined;
+        onUpdateHandle?: string | undefined;
+        onUpdateModels?: string[] | undefined;
+        model: string;
+        where: {
+            mode?: "sensitive" | "insensitive" | undefined;
+            operator?: "in" | "lt" | "lte" | "gt" | "gte" | "eq" | "not_in" | "ne" | "contains" | "starts_with" | "ends_with" | undefined;
+            connector?: "AND" | "OR" | undefined;
+            value: string | number | boolean | string[] | number[] | null;
+            field: string;
+        }[];
+    }, Promise<Record<string, unknown> | null>>;
+    deleteMany: import("convex/server").RegisteredMutation<"public", {
+        onDeleteHandle?: string | undefined;
+        onDeleteModels?: string[] | undefined;
+        onUpdateHandle?: string | undefined;
+        onUpdateModels?: string[] | undefined;
+        model: string;
+        where: {
+            mode?: "sensitive" | "insensitive" | undefined;
+            operator?: "in" | "lt" | "lte" | "gt" | "gte" | "eq" | "not_in" | "ne" | "contains" | "starts_with" | "ends_with" | undefined;
+            connector?: "AND" | "OR" | undefined;
+            value: string | number | boolean | string[] | number[] | null;
+            field: string;
+        }[];
+    }, Promise<number>>;
+    consumeOne: import("convex/server").RegisteredMutation<"public", {
+        onDeleteHandle?: string | undefined;
+        onDeleteModels?: string[] | undefined;
+        onUpdateHandle?: string | undefined;
+        onUpdateModels?: string[] | undefined;
+        model: string;
+        where: {
+            mode?: "sensitive" | "insensitive" | undefined;
+            operator?: "in" | "lt" | "lte" | "gt" | "gte" | "eq" | "not_in" | "ne" | "contains" | "starts_with" | "ends_with" | undefined;
+            connector?: "AND" | "OR" | undefined;
+            value: string | number | boolean | string[] | number[] | null;
+            field: string;
+        }[];
+    }, Promise<Record<string, unknown> | null>>;
+    incrementOne: import("convex/server").RegisteredMutation<"public", {
+        set?: any;
+        onUpdateHandle?: string | undefined;
+        model: string;
+        where: {
+            mode?: "sensitive" | "insensitive" | undefined;
+            operator?: "in" | "lt" | "lte" | "gt" | "gte" | "eq" | "not_in" | "ne" | "contains" | "starts_with" | "ends_with" | undefined;
+            connector?: "AND" | "OR" | undefined;
+            value: string | number | boolean | string[] | number[] | null;
+            field: string;
+        }[];
+        increment: any;
+    }, Promise<Record<string, unknown> | null>>;
+    rotateSigningKey: import("convex/server").RegisteredMutation<"public", {
+        next: {
+            id: string;
+            alg: "RS256";
+            crv: null;
+            privateKey: string;
+            publicKey: string;
+        };
+    }, Promise<{
+        createdAt: number;
+        newKid: string;
+        previousKids: string[];
+        previousVerifyUntil: number;
+        rotatedAt: number;
+    }>>;
+};