@robelest/convex-auth 0.0.1

package/src/server/implementation/mutations/retrieveAccountWithCredentials.ts

@@ -0,0 +1,87 @@
+import { Infer, v } from "convex/values";
+import { ActionCtx, Doc, MutationCtx } from "../types.js";
+import {
+  isSignInRateLimited,
+  recordFailedSignIn,
+  resetSignInRateLimit,
+} from "../rateLimit.js";
+import * as Provider from "../provider.js";
+import { LOG_LEVELS, logWithLevel, maybeRedact } from "../utils.js";
+import { createAuthDb } from "../db.js";
+
+export const retrieveAccountWithCredentialsArgs = v.object({
+  provider: v.string(),
+  account: v.object({ id: v.string(), secret: v.optional(v.string()) }),
+});
+
+type ReturnType =
+  | "InvalidAccountId"
+  | "TooManyFailedAttempts"
+  | "InvalidSecret"
+  | { account: Doc<"account">; user: Doc<"user"> };
+
+export async function retrieveAccountWithCredentialsImpl(
+  ctx: MutationCtx,
+  args: Infer<typeof retrieveAccountWithCredentialsArgs>,
+  getProviderOrThrow: Provider.GetProviderOrThrowFunc,
+  config: Provider.Config,
+): Promise<ReturnType> {
+  const { provider: providerId, account } = args;
+  const authDb =
+    config.component !== undefined ? createAuthDb(ctx, config.component) : null;
+  logWithLevel(LOG_LEVELS.DEBUG, "retrieveAccountWithCredentialsImpl args:", {
+    provider: providerId,
+    account: {
+      id: account.id,
+      secret: maybeRedact(account.secret ?? ""),
+    },
+  });
+  const existingAccount =
+    authDb !== null
+      ? ((await authDb.accounts.get(providerId, account.id)) as Doc<"account"> | null)
+      : await ctx.db
+          .query("account")
+          .withIndex("providerAndAccountId", (q) =>
+            q.eq("provider", providerId).eq("providerAccountId", account.id),
+          )
+          .unique();
+  if (existingAccount === null) {
+    return "InvalidAccountId";
+  }
+  if (account.secret !== undefined) {
+    if (await isSignInRateLimited(ctx, existingAccount._id, config)) {
+      return "TooManyFailedAttempts";
+    }
+    if (
+      !(await Provider.verify(
+        getProviderOrThrow(providerId),
+        account.secret,
+        existingAccount.secret ?? "",
+      ))
+    ) {
+      await recordFailedSignIn(ctx, existingAccount._id, config);
+      return "InvalidSecret";
+    }
+    await resetSignInRateLimit(ctx, existingAccount._id, config);
+  }
+  return {
+    account: existingAccount,
+    // TODO: Ian removed this
+    user:
+      authDb !== null
+        ? ((await authDb.users.getById(existingAccount.userId)) as unknown as Doc<"user">)
+        : (await ctx.db.get(existingAccount.userId))!,
+  };
+}
+
+export const callRetreiveAccountWithCredentials = async (
+  ctx: ActionCtx,
+  args: Infer<typeof retrieveAccountWithCredentialsArgs>,
+): Promise<ReturnType> => {
+  return ctx.runMutation("auth:store" as any, {
+    args: {
+      type: "retrieveAccountWithCredentials",
+      ...args,
+    },
+  });
+};

package/src/server/implementation/mutations/signIn.ts

@@ -0,0 +1,51 @@
+import { GenericId, Infer, v } from "convex/values";
+import { ActionCtx, MutationCtx, SessionInfo } from "../types.js";
+import * as Provider from "../provider.js";
+import {
+  createNewAndDeleteExistingSession,
+  maybeGenerateTokensForSession,
+} from "../sessions.js";
+import { LOG_LEVELS, logWithLevel } from "../utils.js";
+
+export const signInArgs = v.object({
+  userId: v.string(),
+  sessionId: v.optional(v.string()),
+  generateTokens: v.boolean(),
+});
+
+type ReturnType = SessionInfo;
+
+export async function signInImpl(
+  ctx: MutationCtx,
+  args: Infer<typeof signInArgs>,
+  config: Provider.Config,
+): Promise<ReturnType> {
+  logWithLevel(LOG_LEVELS.DEBUG, "signInImpl args:", args);
+  const { userId, sessionId: existingSessionId, generateTokens } = args;
+  const typedUserId = userId as GenericId<"user">;
+  const typedExistingSessionId = existingSessionId as
+    | GenericId<"session">
+    | undefined;
+  const sessionId =
+    typedExistingSessionId ??
+    (await createNewAndDeleteExistingSession(ctx, config, typedUserId));
+  return await maybeGenerateTokensForSession(
+    ctx,
+    config,
+    typedUserId,
+    sessionId,
+    generateTokens,
+  );
+}
+
+export const callSignIn = async (
+  ctx: ActionCtx,
+  args: Infer<typeof signInArgs>,
+): Promise<ReturnType> => {
+  return ctx.runMutation("auth:store" as any, {
+    args: {
+      type: "signIn",
+      ...args,
+    },
+  });
+};

package/src/server/implementation/mutations/signOut.ts

@@ -0,0 +1,38 @@
+import { GenericId } from "convex/values";
+import { ActionCtx, MutationCtx } from "../types.js";
+import { deleteSession, getAuthSessionId } from "../sessions.js";
+import * as Provider from "../provider.js";
+import { createAuthDb } from "../db.js";
+
+type ReturnType = {
+  userId: GenericId<"user">;
+  sessionId: GenericId<"session">;
+} | null;
+
+export async function signOutImpl(
+  ctx: MutationCtx,
+  config: Provider.Config,
+): Promise<ReturnType> {
+  const authDb =
+    config.component !== undefined ? createAuthDb(ctx, config.component) : null;
+  const sessionId = await getAuthSessionId(ctx);
+  if (sessionId !== null) {
+    const session =
+      authDb !== null
+        ? await authDb.sessions.getById(sessionId)
+        : await ctx.db.get(sessionId);
+    if (session !== null) {
+      await deleteSession(ctx, session, config);
+      return { userId: session.userId, sessionId: session._id };
+    }
+  }
+  return null;
+}
+
+export const callSignOut = async (ctx: ActionCtx): Promise<void> => {
+  return ctx.runMutation("auth:store" as any, {
+    args: {
+      type: "signOut",
+    },
+  });
+};

package/src/server/implementation/mutations/userOAuth.ts

@@ -0,0 +1,112 @@
+import { Infer, v } from "convex/values";
+import { ActionCtx, MutationCtx } from "../types.js";
+import * as Provider from "../provider.js";
+import { OAuthConfig } from "@auth/core/providers/oauth.js";
+import { upsertUserAndAccount } from "../users.js";
+import { generateRandomString, logWithLevel, sha256 } from "../utils.js";
+import { createAuthDb } from "../db.js";
+
+const OAUTH_SIGN_IN_EXPIRATION_MS = 1000 * 60 * 2; // 2 minutes
+
+export const userOAuthArgs = v.object({
+  provider: v.string(),
+  providerAccountId: v.string(),
+  profile: v.any(),
+  signature: v.string(),
+});
+
+type ReturnType = string;
+
+export async function userOAuthImpl(
+  ctx: MutationCtx,
+  args: Infer<typeof userOAuthArgs>,
+  getProviderOrThrow: Provider.GetProviderOrThrowFunc,
+  config: Provider.Config,
+): Promise<ReturnType> {
+  logWithLevel("DEBUG", "userOAuthImpl args:", args);
+  const { profile, provider, providerAccountId, signature } = args;
+  const authDb =
+    config.component !== undefined ? createAuthDb(ctx, config.component) : null;
+  const providerConfig = getProviderOrThrow(provider) as OAuthConfig<any>;
+  const existingAccount =
+    authDb !== null
+      ? await authDb.accounts.get(provider, providerAccountId)
+      : await ctx.db
+          .query("account")
+          .withIndex("providerAndAccountId", (q) =>
+            q.eq("provider", provider).eq("providerAccountId", providerAccountId),
+          )
+          .unique();
+
+  const verifier =
+    authDb !== null
+      ? await authDb.verifiers.getBySignature(signature)
+      : await ctx.db
+          .query("verifier")
+          .withIndex("signature", (q) => q.eq("signature", signature))
+          .unique();
+  if (verifier === null) {
+    throw new Error("Invalid state");
+  }
+
+  const { accountId } = await upsertUserAndAccount(
+    ctx,
+    verifier.sessionId ?? null,
+    existingAccount !== null ? { existingAccount } : { providerAccountId },
+    { type: "oauth", provider: providerConfig, profile },
+    config,
+  );
+
+  const code = generateRandomString(8, "0123456789");
+  if (authDb !== null) {
+    await authDb.verifiers.delete(verifier._id);
+  } else {
+    await ctx.db.delete(verifier._id);
+  }
+  const existingVerificationCode =
+    authDb !== null
+      ? await authDb.verificationCodes.getByAccountId(accountId)
+      : await ctx.db
+          .query("verification")
+          .withIndex("accountId", (q) => q.eq("accountId", accountId))
+          .unique();
+  if (existingVerificationCode !== null) {
+    if (authDb !== null) {
+      await authDb.verificationCodes.delete(existingVerificationCode._id);
+    } else {
+      await ctx.db.delete(existingVerificationCode._id);
+    }
+  }
+  if (authDb !== null) {
+    await authDb.verificationCodes.create({
+      code: await sha256(code),
+      accountId,
+      provider,
+      expirationTime: Date.now() + OAUTH_SIGN_IN_EXPIRATION_MS,
+      verifier: verifier._id,
+    });
+  } else {
+    await ctx.db.insert("verification", {
+      code: await sha256(code),
+      accountId,
+      provider,
+      expirationTime: Date.now() + OAUTH_SIGN_IN_EXPIRATION_MS,
+      // The use of a verifier means we don't need an identifier
+      // during verification.
+      verifier: verifier._id,
+    });
+  }
+  return code;
+}
+
+export const callUserOAuth = async (
+  ctx: ActionCtx,
+  args: Infer<typeof userOAuthArgs>,
+): Promise<ReturnType> => {
+  return ctx.runMutation("auth:store" as any, {
+    args: {
+      type: "userOAuth",
+      ...args,
+    },
+  });
+};

package/src/server/implementation/mutations/verifier.ts

@@ -0,0 +1,29 @@
+import { GenericId } from "convex/values";
+import { ActionCtx, MutationCtx } from "../types.js";
+import { getAuthSessionId } from "../sessions.js";
+import * as Provider from "../provider.js";
+import { createAuthDb } from "../db.js";
+
+type ReturnType = GenericId<"verifier">;
+
+export async function verifierImpl(
+  ctx: MutationCtx,
+  config: Provider.Config,
+): Promise<ReturnType> {
+  const sessionId = (await getAuthSessionId(ctx)) ?? undefined;
+  if (config.component !== undefined) {
+    return (await createAuthDb(ctx, config.component).verifiers.create(sessionId)) as
+      ReturnType;
+  }
+  return await ctx.db.insert("verifier", {
+    sessionId,
+  });
+}
+
+export const callVerifier = async (ctx: ActionCtx): Promise<ReturnType> => {
+  return ctx.runMutation("auth:store" as any, {
+    args: {
+      type: "verifier",
+    },
+  });
+};

package/src/server/implementation/mutations/verifierSignature.ts

@@ -0,0 +1,44 @@
+import { GenericId, Infer, v } from "convex/values";
+import { ActionCtx, MutationCtx } from "../types.js";
+import * as Provider from "../provider.js";
+import { createAuthDb } from "../db.js";
+
+export const verifierSignatureArgs = v.object({
+  verifier: v.string(),
+  signature: v.string(),
+});
+
+type ReturnType = void;
+
+export async function verifierSignatureImpl(
+  ctx: MutationCtx,
+  args: Infer<typeof verifierSignatureArgs>,
+  config: Provider.Config,
+): Promise<ReturnType> {
+  const { verifier, signature } = args;
+  const authDb =
+    config.component !== undefined ? createAuthDb(ctx, config.component) : null;
+  const verifierDoc =
+    authDb !== null
+      ? await authDb.verifiers.getById(verifier as GenericId<"verifier">)
+      : await ctx.db.get(verifier as GenericId<"verifier">);
+  if (verifierDoc === null) {
+    throw new Error("Invalid verifier");
+  }
+  if (authDb !== null) {
+    return await authDb.verifiers.patch(verifierDoc._id, { signature });
+  }
+  return await ctx.db.patch(verifierDoc._id, { signature });
+}
+
+export const callVerifierSignature = async (
+  ctx: ActionCtx,
+  args: Infer<typeof verifierSignatureArgs>,
+): Promise<void> => {
+  return ctx.runMutation("auth:store" as any, {
+    args: {
+      type: "verifierSignature",
+      ...args,
+    },
+  });
+};

package/src/server/implementation/mutations/verifyCodeAndSignIn.ts

@@ -0,0 +1,205 @@
+import { GenericId, Infer, v } from "convex/values";
+import { ActionCtx, MutationCtx, SessionInfo } from "../types.js";
+import {
+  isSignInRateLimited,
+  recordFailedSignIn,
+  resetSignInRateLimit,
+} from "../rateLimit.js";
+import * as Provider from "../provider.js";
+import {
+  createNewAndDeleteExistingSession,
+  getAuthSessionId,
+  maybeGenerateTokensForSession,
+} from "../sessions.js";
+import { ConvexAuthConfig } from "../../types.js";
+import { LOG_LEVELS, logWithLevel, sha256 } from "../utils.js";
+import { upsertUserAndAccount } from "../users.js";
+import { createAuthDb } from "../db.js";
+
+export const verifyCodeAndSignInArgs = v.object({
+  params: v.any(),
+  provider: v.optional(v.string()),
+  verifier: v.optional(v.string()),
+  generateTokens: v.boolean(),
+  allowExtraProviders: v.boolean(),
+});
+
+type ReturnType = null | SessionInfo;
+
+export async function verifyCodeAndSignInImpl(
+  ctx: MutationCtx,
+  args: Infer<typeof verifyCodeAndSignInArgs>,
+  getProviderOrThrow: Provider.GetProviderOrThrowFunc,
+  config: Provider.Config,
+): Promise<ReturnType> {
+  logWithLevel(LOG_LEVELS.DEBUG, "verifyCodeAndSignInImpl args:", {
+    params: { email: args.params.email, phone: args.params.phone },
+    provider: args.provider,
+    verifier: args.verifier,
+    generateTokens: args.generateTokens,
+    allowExtraProviders: args.allowExtraProviders,
+  });
+  const { generateTokens, provider, allowExtraProviders } = args;
+  const identifier = args.params.email ?? args.params.phone;
+  if (identifier !== undefined) {
+    if (await isSignInRateLimited(ctx, identifier, config)) {
+      logWithLevel(
+        LOG_LEVELS.ERROR,
+        "Too many failed attempts to verify code for this email",
+      );
+      return null;
+    }
+  }
+  const verifyResult = await verifyCodeOnly(
+    ctx,
+    args,
+    provider ?? null,
+    getProviderOrThrow,
+    allowExtraProviders,
+    config,
+    await getAuthSessionId(ctx),
+  );
+  if (verifyResult === null) {
+    if (identifier !== undefined) {
+      await recordFailedSignIn(ctx, identifier, config);
+    }
+    return null;
+  }
+  if (identifier !== undefined) {
+    await resetSignInRateLimit(ctx, identifier, config);
+  }
+  const { userId } = verifyResult;
+  const sessionId = await createNewAndDeleteExistingSession(
+    ctx,
+    config,
+    userId,
+  );
+  return await maybeGenerateTokensForSession(
+    ctx,
+    config,
+    userId,
+    sessionId,
+    generateTokens,
+  );
+}
+
+export const callVerifyCodeAndSignIn = async (
+  ctx: ActionCtx,
+  args: Infer<typeof verifyCodeAndSignInArgs>,
+): Promise<ReturnType> => {
+  return ctx.runMutation("auth:store" as any, {
+    args: {
+      type: "verifyCodeAndSignIn",
+      ...args,
+    },
+  });
+};
+
+async function verifyCodeOnly(
+  ctx: MutationCtx,
+  args: {
+    params: any;
+    verifier?: string;
+    identifier?: string;
+  },
+  /**
+   * There are two providers at play:
+   * 1. the provider that generated the code
+   * 2. the provider the account is tied to.
+   * This is because we allow signing into an account
+   * via another provider, see {@link signInViaProvider}.
+   * This is the first provider.
+   */
+  methodProviderId: string | null,
+  getProviderOrThrow: Provider.GetProviderOrThrowFunc,
+  allowExtraProviders: boolean,
+  config: ConvexAuthConfig,
+  sessionId: GenericId<"session"> | null,
+) {
+  const authDb =
+    config.component !== undefined ? createAuthDb(ctx, config.component) : null;
+  const { params, verifier } = args;
+  const codeHash = await sha256(params.code);
+  const verificationCode =
+    authDb !== null
+      ? await authDb.verificationCodes.getByCode(codeHash)
+      : await ctx.db
+          .query("verification")
+          .withIndex("code", (q) => q.eq("code", codeHash))
+          .unique();
+  if (verificationCode === null) {
+    logWithLevel(LOG_LEVELS.ERROR, "Invalid verification code");
+    return null;
+  }
+  if (authDb !== null) {
+    await authDb.verificationCodes.delete(verificationCode._id);
+  } else {
+    await ctx.db.delete(verificationCode._id);
+  }
+  if (verificationCode.verifier !== verifier) {
+    logWithLevel(LOG_LEVELS.ERROR, "Invalid verifier");
+    return null;
+  }
+  if (verificationCode.expirationTime < Date.now()) {
+    logWithLevel(LOG_LEVELS.ERROR, "Expired verification code");
+    return null;
+  }
+  const { accountId, emailVerified, phoneVerified } = verificationCode;
+  const account =
+    authDb !== null ? await authDb.accounts.getById(accountId) : await ctx.db.get(accountId);
+  if (account === null) {
+    logWithLevel(
+      LOG_LEVELS.ERROR,
+      "Account associated with this email has been deleted",
+    );
+    return null;
+  }
+  if (
+    methodProviderId !== null &&
+    verificationCode.provider !== methodProviderId
+  ) {
+    logWithLevel(
+      LOG_LEVELS.ERROR,
+      `Invalid provider "${methodProviderId}" for given \`code\`, ` +
+        `which was generated by provider "${verificationCode.provider}"`,
+    );
+    return null;
+  }
+  // OTP providers perform an additional check against the provided
+  // params.
+  const methodProvider = getProviderOrThrow(
+    verificationCode.provider,
+    allowExtraProviders,
+  );
+  if (
+    methodProvider !== null &&
+    (methodProvider.type === "email" || methodProvider.type === "phone") &&
+    methodProvider.authorize !== undefined
+  ) {
+    await methodProvider.authorize(args.params, account);
+  }
+  let userId = account.userId;
+  const provider = getProviderOrThrow(account.provider);
+  if (!(provider.type === "oauth" || provider.type === "oidc")) {
+    ({ userId } = await upsertUserAndAccount(
+      ctx,
+      sessionId,
+      { existingAccount: account },
+      {
+        type: "verification",
+        provider,
+        profile: {
+          ...(emailVerified !== undefined
+            ? { email: emailVerified, emailVerified: true }
+            : {}),
+          ...(phoneVerified !== undefined
+            ? { phone: phoneVerified, phoneVerified: true }
+            : {}),
+        },
+      },
+      config,
+    ));
+  }
+
+  return { providerAccountId: account.providerAccountId, userId };
+}

package/src/server/implementation/provider.ts

@@ -0,0 +1,38 @@
+import { AuthProviderMaterializedConfig } from "../types.js";
+
+export async function hash(provider: any, secret: string) {
+  if (provider.type !== "credentials") {
+    throw new Error(`Provider ${provider.id} is not a credentials provider`);
+  }
+  const hashSecretFn = provider.crypto?.hashSecret;
+  if (hashSecretFn === undefined) {
+    throw new Error(
+      `Provider ${provider.id} does not have a \`crypto.hashSecret\` function`,
+    );
+  }
+  return await hashSecretFn(secret);
+}
+
+export async function verify(
+  provider: AuthProviderMaterializedConfig,
+  secret: string,
+  hash: string,
+) {
+  if (provider.type !== "credentials") {
+    throw new Error(`Provider ${provider.id} is not a credentials provider`);
+  }
+  const verifySecretFn = provider.crypto?.verifySecret;
+  if (verifySecretFn === undefined) {
+    throw new Error(
+      `Provider ${provider.id} does not have a \`crypto.verifySecret\` function`,
+    );
+  }
+  return await verifySecretFn(secret, hash);
+}
+
+export type GetProviderOrThrowFunc = (
+  provider: string,
+  allowExtraProviders?: boolean,
+) => AuthProviderMaterializedConfig;
+
+export type Config = any;