@lupinum/better-convex-nuxt 1.0.0-beta.2 → 1.0.0-beta.3

package/dist/module.json

@@ -4,7 +4,7 @@
   "compatibility": {
     "nuxt": ">=4.5.2 <5"
   },
-  "version": "1.0.0-beta.2",
+  "version": "1.0.0-beta.3",
   "builder": {
     "@nuxt/module-builder": "1.0.2",
     "unbuild": "3.6.1"

package/dist/runtime/auth/better-auth-browser-adapter.d.ts

@@ -27,6 +27,7 @@ export declare function createBetterAuthBrowserAdapter(source: BetterAuthBrowser
 }, options?: {
     initialIdentityKey?: string;
 }): BetterConvexAuthAdapter & {
+    isRestrictedSession(): boolean;
     failClosed(message: string): void;
     dispose(): void;
 };

package/dist/runtime/auth/better-auth-browser-adapter.js

@@ -18,6 +18,7 @@ export function createBetterAuthBrowserAdapter(source, callbacks = { authenticat
   let observedSessionToken;
   let observedIdentityKey = options.initialIdentityKey;
   let cachedToken = null;
+  let restrictedGeneration;
   let snapshot = options.initialIdentityKey ? {
     status: "authenticated",
     identityKey: options.initialIdentityKey,
@@ -60,6 +61,7 @@ export function createBetterAuthBrowserAdapter(source, callbacks = { authenticat
     const retainsEstablishedSession = Boolean(value.error) && !isUnauthorized(value.error) && snapshot.status === "authenticated" && observedSessionToken === sessionToken && observedIdentityKey === key;
     if (retainsEstablishedSession) return;
     if (value.error || malformed) {
+      restrictedGeneration = void 0;
       cachedToken = null;
       sessionGeneration += 1;
       observedSessionToken = null;
@@ -80,10 +82,11 @@ export function createBetterAuthBrowserAdapter(source, callbacks = { authenticat
     if (changed) {
       sessionGeneration += 1;
       cachedToken = null;
+      restrictedGeneration = void 0;
     }
     observedSessionToken = sessionToken;
     observedIdentityKey = key;
-    snapshot = sessionToken && key ? {
+    snapshot = sessionToken && key && restrictedGeneration !== sessionGeneration ? {
       status: "authenticated",
       identityKey: key,
       sessionGeneration,
@@ -94,7 +97,7 @@ export function createBetterAuthBrowserAdapter(source, callbacks = { authenticat
       sessionGeneration,
       error: null
     };
-    if (!sessionToken) callbacks.anonymous(null);
+    if (snapshot.status === "anonymous") callbacks.anonymous(null);
     callbacks.sessionChanged?.(sessionToken, null, sessionGeneration);
     notify();
   };
@@ -145,6 +148,7 @@ export function createBetterAuthBrowserAdapter(source, callbacks = { authenticat
   };
   return Object.freeze({
     snapshot: () => snapshot,
+    isRestrictedSession: () => !disposed && restrictedGeneration === sessionGeneration && snapshot.status === "anonymous",
     subscribe(listener) {
       if (disposed) return () => {
       };
@@ -154,8 +158,17 @@ export function createBetterAuthBrowserAdapter(source, callbacks = { authenticat
     async fetchToken() {
       if (disposed || snapshot.status !== "authenticated") return null;
       const expectedKey = snapshot.identityKey;
+      const expectedGeneration = sessionGeneration;
       const outcome = await fetchConvexToken(source);
-      if (disposed || snapshot.status !== "authenticated" || snapshot.identityKey !== expectedKey) {
+      if (disposed || snapshot.status !== "authenticated" || snapshot.identityKey !== expectedKey || sessionGeneration !== expectedGeneration) {
+        return null;
+      }
+      if (outcome.restricted) {
+        cachedToken = null;
+        restrictedGeneration = expectedGeneration;
+        snapshot = { status: "anonymous", identityKey: null, sessionGeneration, error: null };
+        callbacks.anonymous(null);
+        notify();
         return null;
       }
       if (outcome.identity) {
@@ -187,6 +200,7 @@ export function createBetterAuthBrowserAdapter(source, callbacks = { authenticat
     },
     failClosed(message) {
       if (disposed) return;
+      restrictedGeneration = void 0;
       cachedToken = null;
       sessionGeneration += 1;
       snapshot = {
@@ -204,6 +218,7 @@ export function createBetterAuthBrowserAdapter(source, callbacks = { authenticat
     dispose() {
       if (disposed) return;
       disposed = true;
+      restrictedGeneration = void 0;
       stop();
       for (const cancel of [...cancelSessionSettlement]) cancel();
       cancelSessionSettlement.clear();

package/dist/runtime/auth/integrated-client.d.ts

@@ -10,7 +10,7 @@ export interface CanonicalSessionReconciler {
      * without changing its synchronous contract.
      */
     cancel(checkpoint: SessionCheckpoint): void;
-    /** Re-read the canonical provider session, then await its Convex acceptance. */
+    /** Re-read the provider session, then await matching Convex settlement (possibly anonymous). */
     reconcile(checkpoint: SessionCheckpoint): Promise<void>;
 }
 /**

package/dist/runtime/auth/token-fetcher.d.ts

@@ -39,7 +39,9 @@ export declare function decodeFetchedIdentity(token: string): FetchedIdentity |
  * The outcome of one total token fetch. `identity: null` with `authError: null`
  * is a clean anonymous result when the exchange succeeds with no token. A
  * definitive 401/403 means presented credentials were rejected and is reported
- * as an authentication error. `authError` is also set when a token decodes
+ * as an authentication error, except the exact live workforce continuation
+ * refusal. That result is restricted and grants no Convex identity.
+ * `authError` is also set when a token decodes
  * without a stable user id, or a transient transport failure exhausts the retry
  * loop. `definitive`
  * distinguishes such a transient (non-definitive) failure — over which a usable
@@ -49,6 +51,8 @@ export interface FetchOutcome {
     identity: FetchedIdentity | null;
     authError: string | null;
     definitive: boolean;
+    /** A live workforce cookie may continue setup, but cannot authenticate Convex. */
+    restricted?: true;
 }
 /**
  * Total Convex-token fetch; never throws.

package/dist/runtime/auth/token-fetcher.js

@@ -75,6 +75,9 @@ export async function fetchConvexToken(source, options = {}) {
           break;
         }
         if (response.error) {
+          if (typeof response.error === "object" && "status" in response.error && response.error.status === 403 && "code" in response.error && response.error.code === "AUTH_WORKFORCE_FULL_AUTH_REQUIRED") {
+            return { identity: null, authError: null, definitive: true, restricted: true };
+          }
           if (isDefinitiveAuthStatus(response.error)) {
             return {
               identity: null,

package/dist/runtime/cli/auth-schema.js

@@ -21,7 +21,8 @@ const SUPPORTED_SCHEMA_PLUGIN_IDS = /* @__PURE__ */ new Set([
   "two-factor",
   "email-otp",
   "jwt",
-  "oauth-provider"
+  "oauth-provider",
+  "bcn-workforce-schema"
 ]);
 function usage() {
   return [
@@ -88,7 +89,7 @@ function requireSchemaOptions(value) {
       const id = isRecord(plugin) && typeof plugin.id === "string" ? plugin.id : void 0;
       if (!id || !SUPPORTED_SCHEMA_PLUGIN_IDS.has(id) || seen.has(id)) {
         throw new Error(
-          `Schema config plugin at index ${index} is unsupported; the 1.0 profile admits organization, two-factor, email-otp, jwt, and oauth-provider once each.`
+          `Schema config plugin at index ${index} is unsupported; the 1.0 profile admits organization, two-factor, email-otp, jwt, oauth-provider, and bcn-workforce-schema once each.`
         );
       }
       seen.add(id);

package/dist/runtime/cli/init.js

@@ -41,7 +41,8 @@ export default app
 import schema from './schema'
 import schemaMetadata from './schemaMetadata'
 
-export const { consumeOne, count, create, deleteMany, deleteOne, findMany, findOne, incrementOne, rotateSigningKey, updateMany, updateOne } = defineAuthAdapterFunctions({ metadata: schemaMetadata, schema })
+// This module is inside the isolated betterAuth component, not the public app API.
+export const { assertProfile, consumeOne, count, create, deleteMany, deleteOne, findMany, findOne, incrementOne, rotateSigningKey, sessionAdmission, expireWorkforceSession, listWorkforceSessions, revokeAllWorkforceSessions, revokeWorkforceSession, touchWorkforceSession, updateMany, updateOne } = defineAuthAdapterFunctions({ metadata: schemaMetadata, schema })
 `,
   "convex/betterAuth/convex.config.ts": `import { defineComponent } from 'convex/server'
 

package/dist/runtime/convex-auth/adapter/create-adapter.js

@@ -1,10 +1,23 @@
 import {
   createAdapterFactory
 } from "better-auth/adapters";
+import { APIError } from "better-auth/api";
 import { symmetricDecrypt, symmetricEncrypt } from "better-auth/crypto";
 import { createFunctionHandle } from "convex/server";
+import { ConvexError } from "convex/values";
 import { isWritableAuthCtx, requireWritableAuthCtx } from "../context.js";
-import { createAuthSchema } from "./generate-schema.js";
+import { createWorkforceAdapterTransport } from "../workforce/adapter-transport.js";
+import { hasWorkforceSchema, workforceSchemaPlugin } from "../workforce/schema.js";
+import { createAuthSchema, generateAuthSchemaArtifacts } from "./generate-schema.js";
+function rejectReplay(error) {
+  if (error instanceof ConvexError && error.data === "AUTH_WORKFORCE_TOTP_REPLAYED") {
+    throw new APIError("FORBIDDEN", {
+      code: "INVALID_TWO_FACTOR_CODE",
+      message: "This code cannot be used. Wait for a new code and try again."
+    });
+  }
+  throw error;
+}
 function toComponentWhere(where) {
   return where?.map((condition) => ({
     ...condition,
@@ -144,9 +157,14 @@ export function createConvexAuthAdapter(ctx, component, adapterOptions = {}) {
       customTransformInput: ({ data, fieldAttributes }) => fieldAttributes.type === "date" ? toEpochMilliseconds(data) : data,
       customTransformOutput: ({ data, fieldAttributes }) => fieldAttributes.type === "date" ? toDate(data) : data
     },
-    adapter: ({ getFieldName, getModelName, options }) => {
+    adapter: ({ getFieldName, getModelName, options, schema }) => {
       options.telemetry = { enabled: false };
       if (options.advanced?.database?.joins) throw new Error("AUTH_JOINS_UNSUPPORTED");
+      const workforce = options.plugins?.some((plugin) => plugin.id === workforceSchemaPlugin.id) === true;
+      if (workforce && !hasWorkforceSchema(generateAuthSchemaArtifacts(schema).metadata)) {
+        throw new Error("AUTH_WORKFORCE_SCHEMA_MISMATCH");
+      }
+      const workforceTransport = createWorkforceAdapterTransport(workforce);
       const idTokens = createAccountIdTokenProtector(options);
       const triggerModels = {
         onCreate: configuredTriggerModels(adapterOptions.triggers, "onCreate").map(getModelName),
@@ -181,11 +199,14 @@ export function createConvexAuthAdapter(ctx, component, adapterOptions = {}) {
           data
         }) => {
           requireWritableAuthCtx(ctx);
+          const { operation, consumedChallenge } = await workforceTransport.create(model, data);
           const created = await ctx.runMutation(component.adapter.create, {
             model,
             data: await idTokens.protect(model, data),
-            onCreateHandle: await triggerHandle(model, "onCreate")
-          });
+            onCreateHandle: await triggerHandle(model, "onCreate"),
+            ...operation ? { workforce: operation } : {},
+            ...consumedChallenge ? { workforceConsumedChallenge: consumedChallenge } : {}
+          }).catch(rejectReplay);
           return idTokens.reveal(model, created);
         },
         findOne: async ({
@@ -193,10 +214,12 @@ export function createConvexAuthAdapter(ctx, component, adapterOptions = {}) {
           where,
           select
         }) => {
+          const operation = await workforceTransport.operation(model);
           const found = await ctx.runQuery(component.adapter.findOne, {
             model,
             where: toComponentWhere(where),
-            select: mapSelect(model, select)
+            select: mapSelect(model, select),
+            ...operation?.operation === "confirm-enrollment" ? { workforce: operation } : {}
           });
           return idTokens.reveal(model, found);
         },
@@ -231,12 +254,14 @@ export function createConvexAuthAdapter(ctx, component, adapterOptions = {}) {
         }) => {
           requireWritableAuthCtx(ctx);
           if (where.length === 0) return null;
+          const operation = await workforceTransport.operation();
           const updated = await ctx.runMutation(component.adapter.updateOne, {
             model,
             where: toComponentWhere(where),
             update: await idTokens.protect(model, update),
-            onUpdateHandle: await triggerHandle(model, "onUpdate")
-          });
+            onUpdateHandle: await triggerHandle(model, "onUpdate"),
+            ...operation ? { workforce: operation } : {}
+          }).catch(rejectReplay);
           return idTokens.reveal(model, updated);
         },
         updateMany: async ({ model, where, update }) => {
@@ -283,6 +308,7 @@ export function createConvexAuthAdapter(ctx, component, adapterOptions = {}) {
             onUpdateHandle: await relationshipTriggerHandle("onUpdate"),
             onUpdateModels: triggerModels.onUpdate
           });
+          await workforceTransport.consumed(model, consumed);
           return idTokens.reveal(model, consumed);
         },
         incrementOne: async ({
@@ -292,12 +318,14 @@ export function createConvexAuthAdapter(ctx, component, adapterOptions = {}) {
           set
         }) => {
           requireWritableAuthCtx(ctx);
+          const operation = await workforceTransport.operation();
           const incremented = await ctx.runMutation(component.adapter.incrementOne, {
             model,
             where: toComponentWhere(where),
             increment,
             set: await idTokens.protect(model, set),
-            onUpdateHandle: await triggerHandle(model, "onUpdate")
+            onUpdateHandle: await triggerHandle(model, "onUpdate"),
+            ...operation ? { workforce: operation } : {}
           });
           return idTokens.reveal(model, incremented);
         }

package/dist/runtime/convex-auth/adapter/define-functions.d.ts

@@ -1,18 +1,149 @@
 import { type SchemaDefinition } from 'convex/server';
+import { type GenericId } from 'convex/values';
 import type { AuthSchemaMetadata } from './metadata.js';
 export interface DefineAuthAdapterFunctionsOptions<Schema extends SchemaDefinition<any, any>> {
     schema: Schema;
     metadata: AuthSchemaMetadata;
 }
 export declare function defineAuthAdapterFunctions<Schema extends SchemaDefinition<any, any>>({ schema, metadata, }: DefineAuthAdapterFunctionsOptions<Schema>): {
+    touchWorkforceSession: import("convex/server").RegisteredMutation<"public", {
+        actor: {
+            userId: string;
+            sessionId: string;
+        };
+    }, Promise<{
+        expiresAt: number;
+    }>>;
+    listWorkforceSessions: import("convex/server").RegisteredQuery<"public", {
+        paginationOpts: {
+            cursor: string | null;
+            numItems: number;
+        };
+        actor: {
+            userId: string;
+            sessionId: string;
+        };
+    }, Promise<{
+        page: {
+            method: "password-only" | "totp-enrollment" | "password-totp" | "password-recovery";
+            expiresAt: number;
+            sessionId: string;
+            authenticatedAt: number;
+            sessionStartedAt: number;
+            isCurrent: boolean;
+        }[];
+        isDone: boolean;
+        continueCursor: string;
+    }>>;
+    revokeWorkforceSession: import("convex/server").RegisteredMutation<"public", {
+        actor: {
+            userId: string;
+            sessionId: string;
+        };
+        sessionId: string;
+    }, Promise<null>>;
+    revokeAllWorkforceSessions: import("convex/server").RegisteredMutation<"public", {
+        actor: {
+            userId: string;
+            sessionId: string;
+        };
+    }, Promise<null>>;
+    expireWorkforceSession: import("convex/server").RegisteredMutation<"internal", {
+        storageId: GenericId<"session">;
+    }, Promise<null>>;
+    assertProfile: import("convex/server").RegisteredQuery<"public", {
+        workforce: boolean;
+    }, null>;
+    sessionAdmission: import("convex/server").RegisteredQuery<"public", {
+        userId?: string | undefined;
+        sessionId: string;
+    }, Promise<{
+        user: Record<string, string | number | boolean | string[] | number[] | null>;
+        session: Record<string, string | number | boolean | string[] | number[] | null>;
+    } | null>>;
     create: import("convex/server").RegisteredMutation<"public", {
+        workforce?: {
+            replay?: {
+                userId: string;
+                digest: string;
+                factorId: string;
+                factorFingerprint: string;
+                matchingCounters: number[];
+            } | undefined;
+            userId: string;
+            sessionId: string;
+            operation: "change-password" | "begin-enrollment" | "confirm-enrollment" | "regenerate-backup-codes";
+            expectedGeneration: number;
+        } | {
+            userId: string;
+            operation: "password-sign-in";
+            expectedGeneration: number;
+        } | {
+            userId: string;
+            operation: "password-challenge";
+            expectedGeneration: number;
+            challengeId: string;
+        } | {
+            replay?: {
+                userId: string;
+                digest: string;
+                factorId: string;
+                factorFingerprint: string;
+                matchingCounters: number[];
+            } | undefined;
+            userId: string;
+            operation: "totp-sign-in" | "recovery-sign-in";
+            expectedGeneration: number;
+            challengeId: string;
+        } | undefined;
         onCreateHandle?: string | undefined;
+        workforceConsumedChallenge?: {
+            userId: string;
+            expiresAt: number;
+            operation: "totp-sign-in" | "recovery-sign-in";
+            expectedGeneration: number;
+            challengeId: string;
+        } | undefined;
         data: any;
         model: string;
-    }, Promise<Record<string, unknown> | null>>;
+    }, Promise<Record<string, string | number | boolean | string[] | number[] | null>>>;
     findOne: import("convex/server").RegisteredQuery<"public", {
         join?: any;
         select?: string[] | undefined;
+        workforce?: {
+            replay?: {
+                userId: string;
+                digest: string;
+                factorId: string;
+                factorFingerprint: string;
+                matchingCounters: number[];
+            } | undefined;
+            userId: string;
+            sessionId: string;
+            operation: "change-password" | "begin-enrollment" | "confirm-enrollment" | "regenerate-backup-codes";
+            expectedGeneration: number;
+        } | {
+            userId: string;
+            operation: "password-sign-in";
+            expectedGeneration: number;
+        } | {
+            userId: string;
+            operation: "password-challenge";
+            expectedGeneration: number;
+            challengeId: string;
+        } | {
+            replay?: {
+                userId: string;
+                digest: string;
+                factorId: string;
+                factorFingerprint: string;
+                matchingCounters: number[];
+            } | undefined;
+            userId: string;
+            operation: "totp-sign-in" | "recovery-sign-in";
+            expectedGeneration: number;
+            challengeId: string;
+        } | undefined;
         where?: {
             mode?: "sensitive" | "insensitive" | undefined;
             operator?: "in" | "lt" | "lte" | "gt" | "gte" | "eq" | "not_in" | "ne" | "contains" | "starts_with" | "ends_with" | undefined;
@@ -26,7 +157,7 @@ export declare function defineAuthAdapterFunctions<Schema extends SchemaDefiniti
             direction: "asc" | "desc";
         } | undefined;
         model: string;
-    }, Promise<Record<string, unknown> | null>>;
+    }, Promise<Record<string, string | number | boolean | string[] | number[] | null> | null>>;
     findMany: import("convex/server").RegisteredQuery<"public", {
         join?: any;
         select?: string[] | undefined;
@@ -52,7 +183,7 @@ export declare function defineAuthAdapterFunctions<Schema extends SchemaDefiniti
             cursor: string | null;
         };
         model: string;
-    }, Promise<any>>;
+    }, Promise<import("convex/server").PaginationResult<Record<string, string | number | boolean | string[] | number[] | null>>>>;
     count: import("convex/server").RegisteredQuery<"public", {
         where?: {
             mode?: "sensitive" | "insensitive" | undefined;
@@ -64,6 +195,40 @@ export declare function defineAuthAdapterFunctions<Schema extends SchemaDefiniti
         model: string;
     }, Promise<number>>;
     updateOne: import("convex/server").RegisteredMutation<"public", {
+        workforce?: {
+            replay?: {
+                userId: string;
+                digest: string;
+                factorId: string;
+                factorFingerprint: string;
+                matchingCounters: number[];
+            } | undefined;
+            userId: string;
+            sessionId: string;
+            operation: "change-password" | "begin-enrollment" | "confirm-enrollment" | "regenerate-backup-codes";
+            expectedGeneration: number;
+        } | {
+            userId: string;
+            operation: "password-sign-in";
+            expectedGeneration: number;
+        } | {
+            userId: string;
+            operation: "password-challenge";
+            expectedGeneration: number;
+            challengeId: string;
+        } | {
+            replay?: {
+                userId: string;
+                digest: string;
+                factorId: string;
+                factorFingerprint: string;
+                matchingCounters: number[];
+            } | undefined;
+            userId: string;
+            operation: "totp-sign-in" | "recovery-sign-in";
+            expectedGeneration: number;
+            challengeId: string;
+        } | undefined;
         onUpdateHandle?: string | undefined;
         update: any;
         model: string;
@@ -74,7 +239,7 @@ export declare function defineAuthAdapterFunctions<Schema extends SchemaDefiniti
             value: string | number | boolean | string[] | number[] | null;
             field: string;
         }[];
-    }, Promise<Record<string, unknown> | null>>;
+    }, Promise<Record<string, string | number | boolean | string[] | number[] | null> | null>>;
     updateMany: import("convex/server").RegisteredMutation<"public", {
         onUpdateHandle?: string | undefined;
         update: any;
@@ -100,7 +265,7 @@ export declare function defineAuthAdapterFunctions<Schema extends SchemaDefiniti
             value: string | number | boolean | string[] | number[] | null;
             field: string;
         }[];
-    }, Promise<Record<string, unknown> | null>>;
+    }, Promise<Record<string, string | number | boolean | string[] | number[] | null> | null>>;
     deleteMany: import("convex/server").RegisteredMutation<"public", {
         onDeleteHandle?: string | undefined;
         onDeleteModels?: string[] | undefined;
@@ -128,9 +293,43 @@ export declare function defineAuthAdapterFunctions<Schema extends SchemaDefiniti
             value: string | number | boolean | string[] | number[] | null;
             field: string;
         }[];
-    }, Promise<Record<string, unknown> | null>>;
+    }, Promise<Record<string, string | number | boolean | string[] | number[] | null> | null>>;
     incrementOne: import("convex/server").RegisteredMutation<"public", {
         set?: any;
+        workforce?: {
+            replay?: {
+                userId: string;
+                digest: string;
+                factorId: string;
+                factorFingerprint: string;
+                matchingCounters: number[];
+            } | undefined;
+            userId: string;
+            sessionId: string;
+            operation: "change-password" | "begin-enrollment" | "confirm-enrollment" | "regenerate-backup-codes";
+            expectedGeneration: number;
+        } | {
+            userId: string;
+            operation: "password-sign-in";
+            expectedGeneration: number;
+        } | {
+            userId: string;
+            operation: "password-challenge";
+            expectedGeneration: number;
+            challengeId: string;
+        } | {
+            replay?: {
+                userId: string;
+                digest: string;
+                factorId: string;
+                factorFingerprint: string;
+                matchingCounters: number[];
+            } | undefined;
+            userId: string;
+            operation: "totp-sign-in" | "recovery-sign-in";
+            expectedGeneration: number;
+            challengeId: string;
+        } | undefined;
         onUpdateHandle?: string | undefined;
         model: string;
         where: {
@@ -141,7 +340,7 @@ export declare function defineAuthAdapterFunctions<Schema extends SchemaDefiniti
             field: string;
         }[];
         increment: any;
-    }, Promise<Record<string, unknown> | null>>;
+    }, Promise<Record<string, string | number | boolean | string[] | number[] | null> | null>>;
     rotateSigningKey: import("convex/server").RegisteredMutation<"public", {
         onlyIfEmpty?: boolean | undefined;
         next: {