@robelest/convex-auth 0.0.2-preview.1 → 0.0.2

package/dist/server/implementation/signIn.js

@@ -1,7 +1,9 @@
-import { callCreateVerificationCode, callRefreshSession, callSignIn, callVerifier, callVerifyCodeAndSignIn, } from "./mutations/index.js";
+import { callCreateVerificationCode, callRefreshSession, callSignIn, callVerifier, callVerifierSignature, callVerifyCodeAndSignIn, } from "./mutations/index.js";
 import { redirectAbsoluteUrl, setURLSearchParam } from "./redirects.js";
 import { requireEnv } from "../utils.js";
 import { generateRandomString } from "./utils.js";
+import { handlePasskey } from "./passkey.js";
+import { handleTotp, checkTotpRequired } from "./totp.js";
 const DEFAULT_EMAIL_VERIFICATION_CODE_DURATION_S = 60 * 60 * 24; // 24 hours
 export async function signInImpl(ctx, provider, args, options) {
     if (provider === null && args.refreshToken) {
@@ -34,6 +36,12 @@ export async function signInImpl(ctx, provider, args, options) {
     if (provider.type === "oauth" || provider.type === "oidc") {
         return handleOAuthProvider(ctx, provider, args, options);
     }
+    if (provider.type === "passkey") {
+        return handlePasskey(ctx, provider, args);
+    }
+    if (provider.type === "totp") {
+        return handleTotp(ctx, provider, args);
+    }
     const _typecheck = provider;
     throw new Error(`Provider type ${provider.type} is not supported yet`);
 }
@@ -104,6 +112,23 @@ async function handleCredentials(ctx, provider, args, options) {
     if (result === null) {
         return { kind: "signedIn", signedIn: null };
     }
+    // Check if user has TOTP 2FA enrolled before issuing tokens
+    const hasTotpEnrolled = await checkTotpRequired(ctx, result.userId);
+    if (hasTotpEnrolled) {
+        // Create session but withhold tokens — TOTP verification needed
+        const idsWithoutTokens = await callSignIn(ctx, {
+            userId: result.userId,
+            sessionId: result.sessionId,
+            generateTokens: false,
+        });
+        // Store userId in verifier so the TOTP verify flow can complete sign-in
+        const verifier = await callVerifier(ctx);
+        await callVerifierSignature(ctx, {
+            verifier,
+            signature: JSON.stringify({ userId: result.userId }),
+        });
+        return { kind: "totpRequired", verifier };
+    }
     const idsAndTokens = await callSignIn(ctx, {
         userId: result.userId,
         sessionId: result.sessionId,

package/dist/server/implementation/signIn.js.map

@@ -1 +1 @@
-{"version":3,"file":"signIn.js","sourceRoot":"","sources":["../../../src/server/implementation/signIn.ts"],"names":[],"mappings":"AAcA,OAAO,EACL,0BAA0B,EAC1B,kBAAkB,EAClB,UAAU,EACV,YAAY,EACZ,uBAAuB,GACxB,MAAM,sBAAsB,CAAC;AAC9B,OAAO,EAAE,mBAAmB,EAAE,iBAAiB,EAAE,MAAM,gBAAgB,CAAC;AACxE,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAEzC,OAAO,EAAE,oBAAoB,EAAE,MAAM,YAAY,CAAC;AAElD,MAAM,0CAA0C,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,CAAC,CAAC,WAAW;AAI5E,MAAM,CAAC,KAAK,UAAU,UAAU,CAC9B,GAAsB,EACtB,QAA+C,EAC/C,IAMC,EACD,OAGC;IAUD,IAAI,QAAQ,KAAK,IAAI,IAAI,IAAI,CAAC,YAAY,EAAE,CAAC;QAC3C,MAAM,MAAM,GAAW,CAAC,MAAM,kBAAkB,CAAC,GAAG,EAAE;YACpD,YAAY,EAAE,IAAI,CAAC,YAAY;SAChC,CAAC,CAAE,CAAC;QACL,OAAO,EAAE,IAAI,EAAE,eAAe,EAAE,QAAQ,EAAE,EAAE,MAAM,EAAE,EAAE,CAAC;IACzD,CAAC;IACD,IAAI,QAAQ,KAAK,IAAI,IAAI,IAAI,CAAC,MAAM,EAAE,IAAI,KAAK,SAAS,EAAE,CAAC;QACzD,MAAM,MAAM,GAAG,MAAM,uBAAuB,CAAC,GAAG,EAAE;YAChD,MAAM,EAAE,IAAI,CAAC,MAAM;YACnB,QAAQ,EAAE,IAAI,CAAC,QAAQ;YACvB,cAAc,EAAE,IAAI;YACpB,mBAAmB,EAAE,OAAO,CAAC,mBAAmB;SACjD,CAAC,CAAC;QACH,OAAO;YACL,IAAI,EAAE,UAAU;YAChB,QAAQ,EAAE,MAAM;SACjB,CAAC;IACJ,CAAC;IAED,IAAI,QAAQ,KAAK,IAAI,EAAE,CAAC;QACtB,MAAM,IAAI,KAAK,CACb,qEAAqE,CACtE,CAAC;IACJ,CAAC;IACD,IAAI,QAAQ,CAAC,IAAI,KAAK,OAAO,IAAI,QAAQ,CAAC,IAAI,KAAK,OAAO,EAAE,CAAC;QAC3D,OAAO,2BAA2B,CAAC,GAAG,EAAE,QAAQ,EAAE,IAAI,EAAE,OAAO,CAAC,CAAC;IACnE,CAAC;IACD,IAAI,QAAQ,CAAC,IAAI,KAAK,aAAa,EAAE,CAAC;QACpC,OAAO,iBAAiB,CAAC,GAAG,EAAE,QAAQ,EAAE,IAAI,EAAE,OAAO,CAAC,CAAC;IACzD,CAAC;IACD,IAAI,QAAQ,CAAC,IAAI,KAAK,OAAO,IAAI,QAAQ,CAAC,IAAI,KAAK,MAAM,EAAE,CAAC;QAC1D,OAAO,mBAAmB,CAAC,GAAG,EAAE,QAAQ,EAAE,IAAI,EAAE,OAAO,CAAC,CAAC;IAC3D,CAAC;IACD,MAAM,UAAU,GAAU,QAAQ,CAAC;IACnC,MAAM,IAAI,KAAK,CACb,iBAAkB,QAAgB,CAAC,IAAI,uBAAuB,CAC/D,CAAC;AACJ,CAAC;AAED,KAAK,UAAU,2BAA2B,CACxC,GAAsB,EACtB,QAAmC,EACnC,IAGC,EACD,OAGC;IAKD,IAAI,IAAI,CAAC,MAAM,EAAE,IAAI,KAAK,SAAS,EAAE,CAAC;QACpC,MAAM,MAAM,GAAG,MAAM,uBAAuB,CAAC,GAAG,EAAE;YAChD,MAAM,EAAE,IAAI,CAAC,MAAM;YACnB,QAAQ,EAAE,QAAQ,CAAC,EAAE;YACrB,cAAc,EAAE,OAAO,CAAC,cAAc;YACtC,mBAAmB,EAAE,OAAO,CAAC,mBAAmB;SACjD,CAAC,CAAC;QACH,IAAI,MAAM,KAAK,IAAI,EAAE,CAAC;YACpB,MAAM,IAAI,KAAK,CAAC,uBAAuB,CAAC,CAAC;QAC3C,CAAC;QACD,OAAO;YACL,IAAI,EAAE,UAAU;YAChB,QAAQ,EAAE,MAA+B;SAC1C,CAAC;IACJ,CAAC;IAED,MAAM,QAAQ,GACZ,gEAAgE,CAAC;IACnE,MAAM,IAAI,GAAG,QAAQ,CAAC,yBAAyB;QAC7C,CAAC,CAAC,MAAM,QAAQ,CAAC,yBAAyB,EAAE;QAC5C,CAAC,CAAC,oBAAoB,CAAC,EAAE,EAAE,QAAQ,CAAC,CAAC;IACvC,MAAM,cAAc,GAClB,IAAI,CAAC,GAAG,EAAE;QACV,CAAC,QAAQ,CAAC,MAAM,IAAI,0CAA0C,CAAC,GAAG,IAAI,CAAC;IAEzE,MAAM,UAAU,GAAG,MAAM,0BAA0B,CAAC,GAAG,EAAE;QACvD,QAAQ,EAAE,QAAQ,CAAC,EAAE;QACrB,SAAS,EAAE,IAAI,CAAC,SAAS;QACzB,KAAK,EAAE,IAAI,CAAC,MAAM,EAAE,KAAK;QACzB,KAAK,EAAE,IAAI,CAAC,MAAM,EAAE,KAAK;QACzB,IAAI;QACJ,cAAc;QACd,mBAAmB,EAAE,OAAO,CAAC,mBAAmB;KACjD,CAAC,CAAC;IACH,MAAM,WAAW,GAAG,MAAM,mBAAmB,CAC3C,GAAG,CAAC,IAAI,CAAC,MAAM,EACf,CAAC,IAAI,CAAC,MAAM,IAAI,EAAE,CAA4B,CAC/C,CAAC;IACF,MAAM,gBAAgB,GAAG;QACvB,UAAU;QACV,GAAG,EAAE,iBAAiB,CAAC,WAAW,EAAE,MAAM,EAAE,IAAI,CAAC;QACjD,KAAK,EAAE,IAAI;QACX,OAAO,EAAE,IAAI,IAAI,CAAC,cAAc,CAAC;KAClC,CAAC;IACF,IAAI,QAAQ,CAAC,IAAI,KAAK,OAAO,EAAE,CAAC;QAC9B,MAAM,QAAQ,CAAC,uBAAuB,CACpC;YACE,GAAG,gBAAgB;YACnB,QAAQ,EAAE;gBACR,GAAG,QAAQ;gBACX,IAAI;gBACF,0CAA0C;gBAC1C,QAAQ,CAAC,IAAI,KAAK,+BAA+B;oBACjD,QAAQ,CAAC,EAAE,KAAK,QAAQ;oBACtB,CAAC,CAAC,gCAAgC;oBAClC,CAAC,CAAC,QAAQ,CAAC,IAAI;aACpB;YACD,OAAO,EAAE,IAAI,OAAO,CAAC,kBAAkB,CAAC,EAAE,iBAAiB;YAC3D,KAAK,EAAE,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,KAAK;SAC7B;QACD,qEAAqE;QACrE,cAAc;QACd,GAAG,CACJ,CAAC;IACJ,CAAC;SAAM,IAAI,QAAQ,CAAC,IAAI,KAAK,OAAO,EAAE,CAAC;QACrC,MAAM,QAAQ,CAAC,uBAAuB,CACpC,EAAE,GAAG,gBAAgB,EAAE,QAAQ,EAAE,EACjC,GAAG,CACJ,CAAC;IACJ,CAAC;IACD,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;AAC5C,CAAC;AAED,KAAK,UAAU,iBAAiB,CAC9B,GAAsB,EACtB,QAAiC,EACjC,IAEC,EACD,OAEC;IAED,MAAM,MAAM,GAAG,MAAM,QAAQ,CAAC,SAAS,CAAC,IAAI,CAAC,MAAM,IAAI,EAAE,EAAE,GAAG,CAAC,CAAC;IAChE,IAAI,MAAM,KAAK,IAAI,EAAE,CAAC;QACpB,OAAO,EAAE,IAAI,EAAE,UAAU,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC;IAC9C,CAAC;IACD,MAAM,YAAY,GAAG,MAAM,UAAU,CAAC,GAAG,EAAE;QACzC,MAAM,EAAE,MAAM,CAAC,MAAM;QACrB,SAAS,EAAE,MAAM,CAAC,SAAS;QAC3B,cAAc,EAAE,OAAO,CAAC,cAAc;KACvC,CAAC,CAAC;IACH,OAAO;QACL,IAAI,EAAE,UAAU;QAChB,QAAQ,EAAE,YAAY;KACvB,CAAC;AACJ,CAAC;AAED,KAAK,UAAU,mBAAmB,CAChC,GAAsB,EACtB,QAA6C,EAC7C,IAGC,EACD,OAEC;IAKD,+BAA+B;IAC/B,uEAAuE;IACvE,0DAA0D;IAC1D,0DAA0D;IAC1D,sEAAsE;IACtE,4DAA4D;IAC5D,yDAAyD;IACzD,IAAI,IAAI,CAAC,MAAM,EAAE,IAAI,KAAK,SAAS,EAAE,CAAC;QACpC,MAAM,MAAM,GAAG,MAAM,uBAAuB,CAAC,GAAG,EAAE;YAChD,MAAM,EAAE,IAAI,CAAC,MAAM;YACnB,QAAQ,EAAE,IAAI,CAAC,QAAQ;YACvB,cAAc,EAAE,IAAI;YACpB,mBAAmB,EAAE,OAAO,CAAC,mBAAmB;SACjD,CAAC,CAAC;QACH,OAAO;YACL,IAAI,EAAE,UAAU;YAChB,QAAQ,EAAE,MAAsC;SACjD,CAAC;IACJ,CAAC;IACD,MAAM,QAAQ,GAAG,IAAI,GAAG,CACtB,CAAC,OAAO,CAAC,GAAG,CAAC,oBAAoB,IAAI,UAAU,CAAC,iBAAiB,CAAC,CAAC,GAAG,oBAAoB,QAAQ,CAAC,EAAE,EAAE,CACxG,CAAC;IACF,MAAM,QAAQ,GAAG,MAAM,YAAY,CAAC,GAAG,CAAC,CAAC;IACzC,QAAQ,CAAC,YAAY,CAAC,GAAG,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC;IAC5C,IAAI,IAAI,CAAC,MAAM,EAAE,UAAU,KAAK,SAAS,EAAE,CAAC;QAC1C,IAAI,OAAO,IAAI,CAAC,MAAM,CAAC,UAAU,KAAK,QAAQ,EAAE,CAAC;YAC/C,MAAM,IAAI,KAAK,CACb,+CAA+C,IAAI,CAAC,MAAM,CAAC,UAAU,EAAE,CACxE,CAAC;QACJ,CAAC;QACD,QAAQ,CAAC,YAAY,CAAC,GAAG,CAAC,YAAY,EAAE,IAAI,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC;IAClE,CAAC;IACD,OAAO,EAAE,IAAI,EAAE,UAAU,EAAE,QAAQ,EAAE,QAAQ,CAAC,QAAQ,EAAE,EAAE,QAAQ,EAAE,CAAC;AACvE,CAAC"}
+{"version":3,"file":"signIn.js","sourceRoot":"","sources":["../../../src/server/implementation/signIn.ts"],"names":[],"mappings":"AAgBA,OAAO,EACL,0BAA0B,EAC1B,kBAAkB,EAClB,UAAU,EACV,YAAY,EACZ,qBAAqB,EACrB,uBAAuB,GACxB,MAAM,sBAAsB,CAAC;AAC9B,OAAO,EAAE,mBAAmB,EAAE,iBAAiB,EAAE,MAAM,gBAAgB,CAAC;AACxE,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAEzC,OAAO,EAAE,oBAAoB,EAAE,MAAM,YAAY,CAAC;AAClD,OAAO,EAAE,aAAa,EAAE,MAAM,cAAc,CAAC;AAC7C,OAAO,EAAE,UAAU,EAAE,iBAAiB,EAAE,MAAM,WAAW,CAAC;AAE1D,MAAM,0CAA0C,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,CAAC,CAAC,WAAW;AAI5E,MAAM,CAAC,KAAK,UAAU,UAAU,CAC9B,GAAsB,EACtB,QAA+C,EAC/C,IAMC,EACD,OAGC;IAgBD,IAAI,QAAQ,KAAK,IAAI,IAAI,IAAI,CAAC,YAAY,EAAE,CAAC;QAC3C,MAAM,MAAM,GAAW,CAAC,MAAM,kBAAkB,CAAC,GAAG,EAAE;YACpD,YAAY,EAAE,IAAI,CAAC,YAAY;SAChC,CAAC,CAAE,CAAC;QACL,OAAO,EAAE,IAAI,EAAE,eAAe,EAAE,QAAQ,EAAE,EAAE,MAAM,EAAE,EAAE,CAAC;IACzD,CAAC;IACD,IAAI,QAAQ,KAAK,IAAI,IAAI,IAAI,CAAC,MAAM,EAAE,IAAI,KAAK,SAAS,EAAE,CAAC;QACzD,MAAM,MAAM,GAAG,MAAM,uBAAuB,CAAC,GAAG,EAAE;YAChD,MAAM,EAAE,IAAI,CAAC,MAAM;YACnB,QAAQ,EAAE,IAAI,CAAC,QAAQ;YACvB,cAAc,EAAE,IAAI;YACpB,mBAAmB,EAAE,OAAO,CAAC,mBAAmB;SACjD,CAAC,CAAC;QACH,OAAO;YACL,IAAI,EAAE,UAAU;YAChB,QAAQ,EAAE,MAAM;SACjB,CAAC;IACJ,CAAC;IAED,IAAI,QAAQ,KAAK,IAAI,EAAE,CAAC;QACtB,MAAM,IAAI,KAAK,CACb,qEAAqE,CACtE,CAAC;IACJ,CAAC;IACD,IAAI,QAAQ,CAAC,IAAI,KAAK,OAAO,IAAI,QAAQ,CAAC,IAAI,KAAK,OAAO,EAAE,CAAC;QAC3D,OAAO,2BAA2B,CAAC,GAAG,EAAE,QAAQ,EAAE,IAAI,EAAE,OAAO,CAAC,CAAC;IACnE,CAAC;IACD,IAAI,QAAQ,CAAC,IAAI,KAAK,aAAa,EAAE,CAAC;QACpC,OAAO,iBAAiB,CAAC,GAAG,EAAE,QAAQ,EAAE,IAAI,EAAE,OAAO,CAAC,CAAC;IACzD,CAAC;IACD,IAAI,QAAQ,CAAC,IAAI,KAAK,OAAO,IAAI,QAAQ,CAAC,IAAI,KAAK,MAAM,EAAE,CAAC;QAC1D,OAAO,mBAAmB,CAAC,GAAG,EAAE,QAAQ,EAAE,IAAI,EAAE,OAAO,CAAC,CAAC;IAC3D,CAAC;IACD,IAAI,QAAQ,CAAC,IAAI,KAAK,SAAS,EAAE,CAAC;QAChC,OAAO,aAAa,CAAC,GAAG,EAAE,QAAQ,EAAE,IAAI,CAAC,CAAC;IAC5C,CAAC;IACD,IAAI,QAAQ,CAAC,IAAI,KAAK,MAAM,EAAE,CAAC;QAC7B,OAAO,UAAU,CAAC,GAAG,EAAE,QAAQ,EAAE,IAAI,CAAC,CAAC;IACzC,CAAC;IACD,MAAM,UAAU,GAAU,QAAQ,CAAC;IACnC,MAAM,IAAI,KAAK,CACb,iBAAkB,QAAgB,CAAC,IAAI,uBAAuB,CAC/D,CAAC;AACJ,CAAC;AAED,KAAK,UAAU,2BAA2B,CACxC,GAAsB,EACtB,QAAmC,EACnC,IAGC,EACD,OAGC;IAKD,IAAI,IAAI,CAAC,MAAM,EAAE,IAAI,KAAK,SAAS,EAAE,CAAC;QACpC,MAAM,MAAM,GAAG,MAAM,uBAAuB,CAAC,GAAG,EAAE;YAChD,MAAM,EAAE,IAAI,CAAC,MAAM;YACnB,QAAQ,EAAE,QAAQ,CAAC,EAAE;YACrB,cAAc,EAAE,OAAO,CAAC,cAAc;YACtC,mBAAmB,EAAE,OAAO,CAAC,mBAAmB;SACjD,CAAC,CAAC;QACH,IAAI,MAAM,KAAK,IAAI,EAAE,CAAC;YACpB,MAAM,IAAI,KAAK,CAAC,uBAAuB,CAAC,CAAC;QAC3C,CAAC;QACD,OAAO;YACL,IAAI,EAAE,UAAU;YAChB,QAAQ,EAAE,MAA+B;SAC1C,CAAC;IACJ,CAAC;IAED,MAAM,QAAQ,GACZ,gEAAgE,CAAC;IACnE,MAAM,IAAI,GAAG,QAAQ,CAAC,yBAAyB;QAC7C,CAAC,CAAC,MAAM,QAAQ,CAAC,yBAAyB,EAAE;QAC5C,CAAC,CAAC,oBAAoB,CAAC,EAAE,EAAE,QAAQ,CAAC,CAAC;IACvC,MAAM,cAAc,GAClB,IAAI,CAAC,GAAG,EAAE;QACV,CAAC,QAAQ,CAAC,MAAM,IAAI,0CAA0C,CAAC,GAAG,IAAI,CAAC;IAEzE,MAAM,UAAU,GAAG,MAAM,0BAA0B,CAAC,GAAG,EAAE;QACvD,QAAQ,EAAE,QAAQ,CAAC,EAAE;QACrB,SAAS,EAAE,IAAI,CAAC,SAAS;QACzB,KAAK,EAAE,IAAI,CAAC,MAAM,EAAE,KAAK;QACzB,KAAK,EAAE,IAAI,CAAC,MAAM,EAAE,KAAK;QACzB,IAAI;QACJ,cAAc;QACd,mBAAmB,EAAE,OAAO,CAAC,mBAAmB;KACjD,CAAC,CAAC;IACH,MAAM,WAAW,GAAG,MAAM,mBAAmB,CAC3C,GAAG,CAAC,IAAI,CAAC,MAAM,EACf,CAAC,IAAI,CAAC,MAAM,IAAI,EAAE,CAA4B,CAC/C,CAAC;IACF,MAAM,gBAAgB,GAAG;QACvB,UAAU;QACV,GAAG,EAAE,iBAAiB,CAAC,WAAW,EAAE,MAAM,EAAE,IAAI,CAAC;QACjD,KAAK,EAAE,IAAI;QACX,OAAO,EAAE,IAAI,IAAI,CAAC,cAAc,CAAC;KAClC,CAAC;IACF,IAAI,QAAQ,CAAC,IAAI,KAAK,OAAO,EAAE,CAAC;QAC9B,MAAM,QAAQ,CAAC,uBAAuB,CACpC;YACE,GAAG,gBAAgB;YACnB,QAAQ,EAAE;gBACR,GAAG,QAAQ;gBACX,IAAI;gBACF,0CAA0C;gBAC1C,QAAQ,CAAC,IAAI,KAAK,+BAA+B;oBACjD,QAAQ,CAAC,EAAE,KAAK,QAAQ;oBACtB,CAAC,CAAC,gCAAgC;oBAClC,CAAC,CAAC,QAAQ,CAAC,IAAI;aACpB;YACD,OAAO,EAAE,IAAI,OAAO,CAAC,kBAAkB,CAAC,EAAE,iBAAiB;YAC3D,KAAK,EAAE,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,KAAK;SAC7B;QACD,qEAAqE;QACrE,cAAc;QACd,GAAG,CACJ,CAAC;IACJ,CAAC;SAAM,IAAI,QAAQ,CAAC,IAAI,KAAK,OAAO,EAAE,CAAC;QACrC,MAAM,QAAQ,CAAC,uBAAuB,CACpC,EAAE,GAAG,gBAAgB,EAAE,QAAQ,EAAE,EACjC,GAAG,CACJ,CAAC;IACJ,CAAC;IACD,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;AAC5C,CAAC;AAED,KAAK,UAAU,iBAAiB,CAC9B,GAAsB,EACtB,QAAiC,EACjC,IAEC,EACD,OAEC;IAKD,MAAM,MAAM,GAAG,MAAM,QAAQ,CAAC,SAAS,CAAC,IAAI,CAAC,MAAM,IAAI,EAAE,EAAE,GAAG,CAAC,CAAC;IAChE,IAAI,MAAM,KAAK,IAAI,EAAE,CAAC;QACpB,OAAO,EAAE,IAAI,EAAE,UAAU,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC;IAC9C,CAAC;IACD,4DAA4D;IAC5D,MAAM,eAAe,GAAG,MAAM,iBAAiB,CAAC,GAAG,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC;IACpE,IAAI,eAAe,EAAE,CAAC;QACpB,gEAAgE;QAChE,MAAM,gBAAgB,GAAG,MAAM,UAAU,CAAC,GAAG,EAAE;YAC7C,MAAM,EAAE,MAAM,CAAC,MAAM;YACrB,SAAS,EAAE,MAAM,CAAC,SAAS;YAC3B,cAAc,EAAE,KAAK;SACtB,CAAC,CAAC;QACH,wEAAwE;QACxE,MAAM,QAAQ,GAAG,MAAM,YAAY,CAAC,GAAG,CAAC,CAAC;QACzC,MAAM,qBAAqB,CAAC,GAAG,EAAE;YAC/B,QAAQ;YACR,SAAS,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,CAAC;SACrD,CAAC,CAAC;QACH,OAAO,EAAE,IAAI,EAAE,cAAc,EAAE,QAAQ,EAAE,CAAC;IAC5C,CAAC;IAED,MAAM,YAAY,GAAG,MAAM,UAAU,CAAC,GAAG,EAAE;QACzC,MAAM,EAAE,MAAM,CAAC,MAAM;QACrB,SAAS,EAAE,MAAM,CAAC,SAAS;QAC3B,cAAc,EAAE,OAAO,CAAC,cAAc;KACvC,CAAC,CAAC;IACH,OAAO;QACL,IAAI,EAAE,UAAU;QAChB,QAAQ,EAAE,YAAY;KACvB,CAAC;AACJ,CAAC;AAED,KAAK,UAAU,mBAAmB,CAChC,GAAsB,EACtB,QAA6C,EAC7C,IAGC,EACD,OAEC;IAKD,+BAA+B;IAC/B,uEAAuE;IACvE,0DAA0D;IAC1D,0DAA0D;IAC1D,sEAAsE;IACtE,4DAA4D;IAC5D,yDAAyD;IACzD,IAAI,IAAI,CAAC,MAAM,EAAE,IAAI,KAAK,SAAS,EAAE,CAAC;QACpC,MAAM,MAAM,GAAG,MAAM,uBAAuB,CAAC,GAAG,EAAE;YAChD,MAAM,EAAE,IAAI,CAAC,MAAM;YACnB,QAAQ,EAAE,IAAI,CAAC,QAAQ;YACvB,cAAc,EAAE,IAAI;YACpB,mBAAmB,EAAE,OAAO,CAAC,mBAAmB;SACjD,CAAC,CAAC;QACH,OAAO;YACL,IAAI,EAAE,UAAU;YAChB,QAAQ,EAAE,MAAsC;SACjD,CAAC;IACJ,CAAC;IACD,MAAM,QAAQ,GAAG,IAAI,GAAG,CACtB,CAAC,OAAO,CAAC,GAAG,CAAC,oBAAoB,IAAI,UAAU,CAAC,iBAAiB,CAAC,CAAC,GAAG,oBAAoB,QAAQ,CAAC,EAAE,EAAE,CACxG,CAAC;IACF,MAAM,QAAQ,GAAG,MAAM,YAAY,CAAC,GAAG,CAAC,CAAC;IACzC,QAAQ,CAAC,YAAY,CAAC,GAAG,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC;IAC5C,IAAI,IAAI,CAAC,MAAM,EAAE,UAAU,KAAK,SAAS,EAAE,CAAC;QAC1C,IAAI,OAAO,IAAI,CAAC,MAAM,CAAC,UAAU,KAAK,QAAQ,EAAE,CAAC;YAC/C,MAAM,IAAI,KAAK,CACb,+CAA+C,IAAI,CAAC,MAAM,CAAC,UAAU,EAAE,CACxE,CAAC;QACJ,CAAC;QACD,QAAQ,CAAC,YAAY,CAAC,GAAG,CAAC,YAAY,EAAE,IAAI,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC;IAClE,CAAC;IACD,OAAO,EAAE,IAAI,EAAE,UAAU,EAAE,QAAQ,EAAE,QAAQ,CAAC,QAAQ,EAAE,EAAE,QAAQ,EAAE,CAAC;AACvE,CAAC"}

package/dist/server/implementation/totp.d.ts

@@ -0,0 +1,40 @@
+/**
+ * Server-side TOTP ceremony logic for two-factor authentication.
+ *
+ * Handles the three phases of the TOTP flow:
+ * 1. setup   — generate a TOTP secret and `otpauth://` URI for enrollment
+ * 2. confirm — verify the first code from the authenticator app and mark
+ *              the enrollment as verified
+ * 3. verify  — verify a TOTP code during sign-in (2FA challenge)
+ *
+ * Uses `@oslojs/otp` for TOTP generation / verification and
+ * `@oslojs/encoding` for base-32 secret encoding.
+ */
+import { TotpProviderConfig, GenericActionCtxWithAuthConfig } from "../types.js";
+import { AuthDataModel, SessionInfo } from "./types.js";
+type EnrichedActionCtx = GenericActionCtxWithAuthConfig<AuthDataModel>;
+/**
+ * Main TOTP handler dispatched from signIn.ts.
+ *
+ * Routes to the appropriate phase based on `params.flow`.
+ */
+export declare function handleTotp(ctx: EnrichedActionCtx, provider: TotpProviderConfig, args: {
+    params?: Record<string, any>;
+    verifier?: string;
+}): Promise<{
+    kind: "signedIn";
+    signedIn: SessionInfo | null;
+} | {
+    kind: "totpSetup";
+    uri: string;
+    secret: string;
+    verifier: string;
+    totpId: string;
+}>;
+/**
+ * Check if a user has a verified TOTP enrollment.
+ * Called after credentials sign-in to determine if 2FA is needed.
+ */
+export declare function checkTotpRequired(ctx: EnrichedActionCtx, userId: string): Promise<boolean>;
+export {};
+//# sourceMappingURL=totp.d.ts.map

package/dist/server/implementation/totp.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"totp.d.ts","sourceRoot":"","sources":["../../../src/server/implementation/totp.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AASH,OAAO,EACL,kBAAkB,EAClB,8BAA8B,EAC/B,MAAM,aAAa,CAAC;AACrB,OAAO,EAAE,aAAa,EAAE,WAAW,EAAE,MAAM,YAAY,CAAC;AAIxD,KAAK,iBAAiB,GAAG,8BAA8B,CAAC,aAAa,CAAC,CAAC;AA2QvE;;;;GAIG;AACH,wBAAsB,UAAU,CAC9B,GAAG,EAAE,iBAAiB,EACtB,QAAQ,EAAE,kBAAkB,EAC5B,IAAI,EAAE;IACJ,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;IAC7B,QAAQ,CAAC,EAAE,MAAM,CAAC;CACnB,GACA,OAAO,CACN;IAAE,IAAI,EAAE,UAAU,CAAC;IAAC,QAAQ,EAAE,WAAW,GAAG,IAAI,CAAA;CAAE,GAClD;IACE,IAAI,EAAE,WAAW,CAAC;IAClB,GAAG,EAAE,MAAM,CAAC;IACZ,MAAM,EAAE,MAAM,CAAC;IACf,QAAQ,EAAE,MAAM,CAAC;IACjB,MAAM,EAAE,MAAM,CAAC;CAChB,CACJ,CA8BA;AAMD;;;GAGG;AACH,wBAAsB,iBAAiB,CACrC,GAAG,EAAE,iBAAiB,EACtB,MAAM,EAAE,MAAM,GACb,OAAO,CAAC,OAAO,CAAC,CAMlB"}

package/dist/server/implementation/totp.js

@@ -0,0 +1,211 @@
+/**
+ * Server-side TOTP ceremony logic for two-factor authentication.
+ *
+ * Handles the three phases of the TOTP flow:
+ * 1. setup   — generate a TOTP secret and `otpauth://` URI for enrollment
+ * 2. confirm — verify the first code from the authenticator app and mark
+ *              the enrollment as verified
+ * 3. verify  — verify a TOTP code during sign-in (2FA challenge)
+ *
+ * Uses `@oslojs/otp` for TOTP generation / verification and
+ * `@oslojs/encoding` for base-32 secret encoding.
+ */
+import { verifyTOTPWithGracePeriod, createTOTPKeyURI, } from "@oslojs/otp";
+import { encodeBase32LowerCaseNoPadding } from "@oslojs/encoding";
+import { callSignIn, callVerifier } from "./mutations/index.js";
+import { callVerifierSignature } from "./mutations/verifierSignature.js";
+// ============================================================================
+// Setup flow
+// ============================================================================
+/**
+ * Phase 1: Generate a TOTP secret and enrollment URI.
+ *
+ * Requires an authenticated user — TOTP enrollment always adds a second
+ * factor to an existing account.  The userId is taken from the current
+ * session identity.
+ */
+async function handleSetup(ctx, provider, params) {
+    // TOTP enrollment requires an authenticated user
+    const identity = await ctx.auth.getUserIdentity();
+    if (identity === null) {
+        throw new Error("TOTP enrollment requires an authenticated user. " +
+            "Sign in first, then add TOTP to your account.");
+    }
+    const [userId] = identity.subject.split("|");
+    // Generate a 20-byte random secret (160 bits, per RFC 4226 recommendation)
+    const secret = new Uint8Array(20);
+    crypto.getRandomValues(secret);
+    // Resolve the account name for the otpauth:// URI
+    let accountName = params.accountName;
+    if (!accountName) {
+        const user = await ctx.runQuery(ctx.auth.config.component.public.userGetById, { userId: userId });
+        accountName = user?.email ?? "user";
+    }
+    // Build the otpauth:// URI for QR code scanning
+    const uri = createTOTPKeyURI(provider.options.issuer, accountName, secret, provider.options.period, provider.options.digits);
+    // Encode the secret as base-32 for manual entry
+    const base32Secret = encodeBase32LowerCaseNoPadding(secret);
+    // Store enrolment metadata in a verifier so we can correlate the confirm step
+    const verifier = await callVerifier(ctx);
+    await callVerifierSignature(ctx, {
+        verifier,
+        signature: JSON.stringify({
+            secret: Array.from(secret),
+            userId,
+            digits: provider.options.digits,
+            period: provider.options.period,
+        }),
+    });
+    // Insert an UNVERIFIED TOTP record in the DB
+    const totpId = await ctx.runMutation(ctx.auth.config.component.public.totpInsert, {
+        userId: userId,
+        secret: secret.buffer.slice(secret.byteOffset, secret.byteOffset + secret.byteLength),
+        digits: provider.options.digits,
+        period: provider.options.period,
+        verified: false,
+        name: params.name,
+        createdAt: Date.now(),
+    });
+    return {
+        kind: "totpSetup",
+        uri,
+        secret: base32Secret,
+        verifier,
+        totpId: totpId,
+    };
+}
+// ============================================================================
+// Confirm flow
+// ============================================================================
+/**
+ * Phase 2: Verify the first code from the authenticator app.
+ *
+ * Requires an authenticated user.  Marks the TOTP enrollment as verified
+ * after confirming the code is correct.
+ */
+async function handleConfirm(ctx, provider, params, verifierValue) {
+    // TOTP confirmation requires an authenticated user
+    const identity = await ctx.auth.getUserIdentity();
+    if (identity === null) {
+        throw new Error("TOTP confirmation requires an authenticated user. " +
+            "Sign in first, then confirm your TOTP enrollment.");
+    }
+    const [userId] = identity.subject.split("|");
+    if (!verifierValue) {
+        throw new Error("Missing verifier");
+    }
+    if (!params.code) {
+        throw new Error("Missing `code` parameter");
+    }
+    if (!params.totpId) {
+        throw new Error("Missing `totpId` parameter");
+    }
+    // Look up the TOTP record
+    const totpDoc = await ctx.runQuery(ctx.auth.config.component.public.totpGetById, { totpId: params.totpId });
+    if (!totpDoc) {
+        throw new Error("TOTP enrollment not found");
+    }
+    if (totpDoc.verified) {
+        throw new Error("TOTP enrollment is already verified");
+    }
+    // Extract the secret from the TOTP record
+    const secret = new Uint8Array(totpDoc.secret);
+    // Verify the code with a 30-second grace period
+    const valid = verifyTOTPWithGracePeriod(secret, provider.options.period, provider.options.digits, params.code, 30);
+    if (!valid) {
+        throw new Error("Invalid TOTP code");
+    }
+    // Mark the enrollment as verified
+    await ctx.runMutation(ctx.auth.config.component.public.totpMarkVerified, { totpId: params.totpId, lastUsedAt: Date.now() });
+    // Clean up the verifier
+    await ctx.runMutation(ctx.auth.config.component.public.verifierDelete, { verifierId: verifierValue });
+    // Return tokens for the existing session
+    const signInResult = await callSignIn(ctx, {
+        userId: userId,
+        generateTokens: true,
+    });
+    return { kind: "signedIn", signedIn: signInResult };
+}
+// ============================================================================
+// Verify flow (2FA during sign-in)
+// ============================================================================
+/**
+ * Phase 3: Verify a TOTP code during sign-in.
+ *
+ * Does NOT require an authenticated user — this runs mid-sign-in as a
+ * second-factor challenge.  The userId is retrieved from the stored verifier.
+ */
+async function handleVerify(ctx, provider, params, verifierValue) {
+    if (!verifierValue) {
+        throw new Error("Missing verifier");
+    }
+    if (!params.code) {
+        throw new Error("Missing `code` parameter");
+    }
+    // Look up the verifier to retrieve the stored userId
+    const verifierDoc = await ctx.runQuery(ctx.auth.config.component.public.verifierGetById, { verifierId: verifierValue });
+    if (!verifierDoc) {
+        throw new Error("Invalid or expired verifier");
+    }
+    // Parse the signature to extract userId
+    const signatureData = JSON.parse(verifierDoc.signature);
+    const userId = signatureData.userId;
+    // Look up the user's verified TOTP enrollment
+    const totpDoc = await ctx.runQuery(ctx.auth.config.component.public.totpGetVerifiedByUserId, { userId: userId });
+    if (!totpDoc) {
+        throw new Error("No TOTP enrollment found");
+    }
+    // Extract the secret from the TOTP record
+    const secret = new Uint8Array(totpDoc.secret);
+    // Verify the code with a 30-second grace period
+    const valid = verifyTOTPWithGracePeriod(secret, totpDoc.period, totpDoc.digits, params.code, 30);
+    if (!valid) {
+        throw new Error("Invalid TOTP code");
+    }
+    // Update last used timestamp
+    await ctx.runMutation(ctx.auth.config.component.public.totpUpdateLastUsed, { totpId: totpDoc._id, lastUsedAt: Date.now() });
+    // Clean up the verifier
+    await ctx.runMutation(ctx.auth.config.component.public.verifierDelete, { verifierId: verifierValue });
+    // Sign in the user with tokens
+    const signInResult = await callSignIn(ctx, {
+        userId,
+        generateTokens: true,
+    });
+    return { kind: "signedIn", signedIn: signInResult };
+}
+// ============================================================================
+// Main dispatch
+// ============================================================================
+/**
+ * Main TOTP handler dispatched from signIn.ts.
+ *
+ * Routes to the appropriate phase based on `params.flow`.
+ */
+export async function handleTotp(ctx, provider, args) {
+    const flow = args.params?.flow;
+    if (!flow) {
+        throw new Error("Missing `flow` parameter. Expected one of: setup, confirm, verify");
+    }
+    switch (flow) {
+        case "setup":
+            return handleSetup(ctx, provider, args.params ?? {});
+        case "confirm":
+            return handleConfirm(ctx, provider, args.params ?? {}, args.verifier);
+        case "verify":
+            return handleVerify(ctx, provider, args.params ?? {}, args.verifier);
+        default:
+            throw new Error(`Unknown TOTP flow: ${flow}. Expected one of: setup, confirm, verify`);
+    }
+}
+// ============================================================================
+// Helpers
+// ============================================================================
+/**
+ * Check if a user has a verified TOTP enrollment.
+ * Called after credentials sign-in to determine if 2FA is needed.
+ */
+export async function checkTotpRequired(ctx, userId) {
+    const totpDoc = await ctx.runQuery(ctx.auth.config.component.public.totpGetVerifiedByUserId, { userId: userId });
+    return totpDoc !== null;
+}
+//# sourceMappingURL=totp.js.map

package/dist/server/implementation/totp.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"totp.js","sourceRoot":"","sources":["../../../src/server/implementation/totp.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAGH,OAAO,EAEL,yBAAyB,EACzB,gBAAgB,GACjB,MAAM,aAAa,CAAC;AACrB,OAAO,EAAE,8BAA8B,EAAE,MAAM,kBAAkB,CAAC;AAMlE,OAAO,EAAE,UAAU,EAAE,YAAY,EAAE,MAAM,sBAAsB,CAAC;AAChE,OAAO,EAAE,qBAAqB,EAAE,MAAM,kCAAkC,CAAC;AAIzE,+EAA+E;AAC/E,aAAa;AACb,+EAA+E;AAE/E;;;;;;GAMG;AACH,KAAK,UAAU,WAAW,CACxB,GAAsB,EACtB,QAA4B,EAC5B,MAA2B;IAQ3B,iDAAiD;IACjD,MAAM,QAAQ,GAAG,MAAM,GAAG,CAAC,IAAI,CAAC,eAAe,EAAE,CAAC;IAClD,IAAI,QAAQ,KAAK,IAAI,EAAE,CAAC;QACtB,MAAM,IAAI,KAAK,CACb,kDAAkD;YAChD,+CAA+C,CAClD,CAAC;IACJ,CAAC;IACD,MAAM,CAAC,MAAM,CAAC,GAAG,QAAQ,CAAC,OAAO,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAE7C,2EAA2E;IAC3E,MAAM,MAAM,GAAG,IAAI,UAAU,CAAC,EAAE,CAAC,CAAC;IAClC,MAAM,CAAC,eAAe,CAAC,MAAM,CAAC,CAAC;IAE/B,kDAAkD;IAClD,IAAI,WAAW,GAAW,MAAM,CAAC,WAAqB,CAAC;IACvD,IAAI,CAAC,WAAW,EAAE,CAAC;QACjB,MAAM,IAAI,GAAG,MAAM,GAAG,CAAC,QAAQ,CAC7B,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,MAAM,CAAC,WAAW,EAC5C,EAAE,MAAM,EAAE,MAAO,EAAE,CACpB,CAAC;QACF,WAAW,GAAI,IAAY,EAAE,KAAK,IAAI,MAAM,CAAC;IAC/C,CAAC;IAED,gDAAgD;IAChD,MAAM,GAAG,GAAG,gBAAgB,CAC1B,QAAQ,CAAC,OAAO,CAAC,MAAM,EACvB,WAAW,EACX,MAAM,EACN,QAAQ,CAAC,OAAO,CAAC,MAAM,EACvB,QAAQ,CAAC,OAAO,CAAC,MAAM,CACxB,CAAC;IAEF,gDAAgD;IAChD,MAAM,YAAY,GAAG,8BAA8B,CAAC,MAAM,CAAC,CAAC;IAE5D,8EAA8E;IAC9E,MAAM,QAAQ,GAAG,MAAM,YAAY,CAAC,GAAG,CAAC,CAAC;IACzC,MAAM,qBAAqB,CAAC,GAAG,EAAE;QAC/B,QAAQ;QACR,SAAS,EAAE,IAAI,CAAC,SAAS,CAAC;YACxB,MAAM,EAAE,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC;YAC1B,MAAM;YACN,MAAM,EAAE,QAAQ,CAAC,OAAO,CAAC,MAAM;YAC/B,MAAM,EAAE,QAAQ,CAAC,OAAO,CAAC,MAAM;SAChC,CAAC;KACH,CAAC,CAAC;IAEH,6CAA6C;IAC7C,MAAM,MAAM,GAAG,MAAM,GAAG,CAAC,WAAW,CAClC,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,MAAM,CAAC,UAAU,EAC3C;QACE,MAAM,EAAE,MAAa;QACrB,MAAM,EAAE,MAAM,CAAC,MAAM,CAAC,KAAK,CACzB,MAAM,CAAC,UAAU,EACjB,MAAM,CAAC,UAAU,GAAG,MAAM,CAAC,UAAU,CACtC;QACD,MAAM,EAAE,QAAQ,CAAC,OAAO,CAAC,MAAM;QAC/B,MAAM,EAAE,QAAQ,CAAC,OAAO,CAAC,MAAM;QAC/B,QAAQ,EAAE,KAAK;QACf,IAAI,EAAE,MAAM,CAAC,IAAI;QACjB,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE;KACtB,CACF,CAAC;IAEF,OAAO;QACL,IAAI,EAAE,WAAoB;QAC1B,GAAG;QACH,MAAM,EAAE,YAAY;QACpB,QAAQ;QACR,MAAM,EAAE,MAAgB;KACzB,CAAC;AACJ,CAAC;AAED,+EAA+E;AAC/E,eAAe;AACf,+EAA+E;AAE/E;;;;;GAKG;AACH,KAAK,UAAU,aAAa,CAC1B,GAAsB,EACtB,QAA4B,EAC5B,MAA2B,EAC3B,aAAiC;IAEjC,mDAAmD;IACnD,MAAM,QAAQ,GAAG,MAAM,GAAG,CAAC,IAAI,CAAC,eAAe,EAAE,CAAC;IAClD,IAAI,QAAQ,KAAK,IAAI,EAAE,CAAC;QACtB,MAAM,IAAI,KAAK,CACb,oDAAoD;YAClD,mDAAmD,CACtD,CAAC;IACJ,CAAC;IACD,MAAM,CAAC,MAAM,CAAC,GAAG,QAAQ,CAAC,OAAO,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAE7C,IAAI,CAAC,aAAa,EAAE,CAAC;QACnB,MAAM,IAAI,KAAK,CAAC,kBAAkB,CAAC,CAAC;IACtC,CAAC;IACD,IAAI,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC;QACjB,MAAM,IAAI,KAAK,CAAC,0BAA0B,CAAC,CAAC;IAC9C,CAAC;IACD,IAAI,CAAC,MAAM,CAAC,MAAM,EAAE,CAAC;QACnB,MAAM,IAAI,KAAK,CAAC,4BAA4B,CAAC,CAAC;IAChD,CAAC;IAED,0BAA0B;IAC1B,MAAM,OAAO,GAAG,MAAM,GAAG,CAAC,QAAQ,CAChC,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,MAAM,CAAC,WAAW,EAC5C,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,CAC1B,CAAC;IACF,IAAI,CAAC,OAAO,EAAE,CAAC;QACb,MAAM,IAAI,KAAK,CAAC,2BAA2B,CAAC,CAAC;IAC/C,CAAC;IACD,IAAK,OAAe,CAAC,QAAQ,EAAE,CAAC;QAC9B,MAAM,IAAI,KAAK,CAAC,qCAAqC,CAAC,CAAC;IACzD,CAAC;IAED,0CAA0C;IAC1C,MAAM,MAAM,GAAG,IAAI,UAAU,CAAE,OAAe,CAAC,MAAM,CAAC,CAAC;IAEvD,gDAAgD;IAChD,MAAM,KAAK,GAAG,yBAAyB,CACrC,MAAM,EACN,QAAQ,CAAC,OAAO,CAAC,MAAM,EACvB,QAAQ,CAAC,OAAO,CAAC,MAAM,EACvB,MAAM,CAAC,IAAI,EACX,EAAE,CACH,CAAC;IACF,IAAI,CAAC,KAAK,EAAE,CAAC;QACX,MAAM,IAAI,KAAK,CAAC,mBAAmB,CAAC,CAAC;IACvC,CAAC;IAED,kCAAkC;IAClC,MAAM,GAAG,CAAC,WAAW,CACnB,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,MAAM,CAAC,gBAAgB,EACjD,EAAE,MAAM,EAAE,MAAM,CAAC,MAAa,EAAE,UAAU,EAAE,IAAI,CAAC,GAAG,EAAE,EAAE,CACzD,CAAC;IAEF,wBAAwB;IACxB,MAAM,GAAG,CAAC,WAAW,CACnB,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,MAAM,CAAC,cAAc,EAC/C,EAAE,UAAU,EAAE,aAAa,EAAE,CAC9B,CAAC;IAEF,yCAAyC;IACzC,MAAM,YAAY,GAAG,MAAM,UAAU,CAAC,GAAG,EAAE;QACzC,MAAM,EAAE,MAAO;QACf,cAAc,EAAE,IAAI;KACrB,CAAC,CAAC;IAEH,OAAO,EAAE,IAAI,EAAE,UAAU,EAAE,QAAQ,EAAE,YAAY,EAAE,CAAC;AACtD,CAAC;AAED,+EAA+E;AAC/E,mCAAmC;AACnC,+EAA+E;AAE/E;;;;;GAKG;AACH,KAAK,UAAU,YAAY,CACzB,GAAsB,EACtB,QAA4B,EAC5B,MAA2B,EAC3B,aAAiC;IAEjC,IAAI,CAAC,aAAa,EAAE,CAAC;QACnB,MAAM,IAAI,KAAK,CAAC,kBAAkB,CAAC,CAAC;IACtC,CAAC;IACD,IAAI,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC;QACjB,MAAM,IAAI,KAAK,CAAC,0BAA0B,CAAC,CAAC;IAC9C,CAAC;IAED,qDAAqD;IACrD,MAAM,WAAW,GAAG,MAAM,GAAG,CAAC,QAAQ,CACpC,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,MAAM,CAAC,eAAe,EAChD,EAAE,UAAU,EAAE,aAAa,EAAE,CAC9B,CAAC;IACF,IAAI,CAAC,WAAW,EAAE,CAAC;QACjB,MAAM,IAAI,KAAK,CAAC,6BAA6B,CAAC,CAAC;IACjD,CAAC;IAED,wCAAwC;IACxC,MAAM,aAAa,GAAG,IAAI,CAAC,KAAK,CAAE,WAAmB,CAAC,SAAS,CAAC,CAAC;IACjE,MAAM,MAAM,GAAG,aAAa,CAAC,MAAgB,CAAC;IAE9C,8CAA8C;IAC9C,MAAM,OAAO,GAAG,MAAM,GAAG,CAAC,QAAQ,CAChC,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,MAAM,CAAC,uBAAuB,EACxD,EAAE,MAAM,EAAE,MAAa,EAAE,CAC1B,CAAC;IACF,IAAI,CAAC,OAAO,EAAE,CAAC;QACb,MAAM,IAAI,KAAK,CAAC,0BAA0B,CAAC,CAAC;IAC9C,CAAC;IAED,0CAA0C;IAC1C,MAAM,MAAM,GAAG,IAAI,UAAU,CAAE,OAAe,CAAC,MAAM,CAAC,CAAC;IAEvD,gDAAgD;IAChD,MAAM,KAAK,GAAG,yBAAyB,CACrC,MAAM,EACL,OAAe,CAAC,MAAM,EACtB,OAAe,CAAC,MAAM,EACvB,MAAM,CAAC,IAAI,EACX,EAAE,CACH,CAAC;IACF,IAAI,CAAC,KAAK,EAAE,CAAC;QACX,MAAM,IAAI,KAAK,CAAC,mBAAmB,CAAC,CAAC;IACvC,CAAC;IAED,6BAA6B;IAC7B,MAAM,GAAG,CAAC,WAAW,CACnB,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,MAAM,CAAC,kBAAkB,EACnD,EAAE,MAAM,EAAG,OAAe,CAAC,GAAG,EAAE,UAAU,EAAE,IAAI,CAAC,GAAG,EAAE,EAAE,CACzD,CAAC;IAEF,wBAAwB;IACxB,MAAM,GAAG,CAAC,WAAW,CACnB,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,MAAM,CAAC,cAAc,EAC/C,EAAE,UAAU,EAAE,aAAa,EAAE,CAC9B,CAAC;IAEF,+BAA+B;IAC/B,MAAM,YAAY,GAAG,MAAM,UAAU,CAAC,GAAG,EAAE;QACzC,MAAM;QACN,cAAc,EAAE,IAAI;KACrB,CAAC,CAAC;IAEH,OAAO,EAAE,IAAI,EAAE,UAAU,EAAE,QAAQ,EAAE,YAAY,EAAE,CAAC;AACtD,CAAC;AAED,+EAA+E;AAC/E,gBAAgB;AAChB,+EAA+E;AAE/E;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,UAAU,CAC9B,GAAsB,EACtB,QAA4B,EAC5B,IAGC;IAWD,MAAM,IAAI,GAAG,IAAI,CAAC,MAAM,EAAE,IAAI,CAAC;IAC/B,IAAI,CAAC,IAAI,EAAE,CAAC;QACV,MAAM,IAAI,KAAK,CACb,mEAAmE,CACpE,CAAC;IACJ,CAAC;IAED,QAAQ,IAAI,EAAE,CAAC;QACb,KAAK,OAAO;YACV,OAAO,WAAW,CAAC,GAAG,EAAE,QAAQ,EAAE,IAAI,CAAC,MAAM,IAAI,EAAE,CAAC,CAAC;QACvD,KAAK,SAAS;YACZ,OAAO,aAAa,CAClB,GAAG,EACH,QAAQ,EACR,IAAI,CAAC,MAAM,IAAI,EAAE,EACjB,IAAI,CAAC,QAAQ,CACd,CAAC;QACJ,KAAK,QAAQ;YACX,OAAO,YAAY,CACjB,GAAG,EACH,QAAQ,EACR,IAAI,CAAC,MAAM,IAAI,EAAE,EACjB,IAAI,CAAC,QAAQ,CACd,CAAC;QACJ;YACE,MAAM,IAAI,KAAK,CACb,sBAAsB,IAAI,2CAA2C,CACtE,CAAC;IACN,CAAC;AACH,CAAC;AAED,+EAA+E;AAC/E,UAAU;AACV,+EAA+E;AAE/E;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,iBAAiB,CACrC,GAAsB,EACtB,MAAc;IAEd,MAAM,OAAO,GAAG,MAAM,GAAG,CAAC,QAAQ,CAChC,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,MAAM,CAAC,uBAAuB,EACxD,EAAE,MAAM,EAAE,MAAa,EAAE,CAC1B,CAAC;IACF,OAAO,OAAO,KAAK,IAAI,CAAC;AAC1B,CAAC"}

package/dist/server/index.d.ts

@@ -6,6 +6,18 @@ export type AuthCookies = {
     refreshToken: string | null;
     verifier: string | null;
 };
+export type ServerOptions = {
+    /** Convex deployment URL. */
+    url: string;
+    apiRoute?: string;
+    cookieMaxAge?: number | null;
+    verbose?: boolean;
+    shouldHandleCode?: ((request: Request) => boolean | Promise<boolean>) | boolean;
+};
+export type RefreshResult = {
+    response?: Response;
+    cookies?: string[];
+};
 export declare function authCookieNames(host?: string): {
     token: string;
     refreshToken: string;
@@ -14,4 +26,10 @@ export declare function authCookieNames(host?: string): {
 export declare function parseAuthCookies(cookieHeader: string | null | undefined, host?: string): AuthCookies;
 export declare function serializeAuthCookies(cookies: AuthCookies, host?: string, config?: AuthCookieConfig): string[];
 export declare function shouldProxyAuthAction(pathname: string, apiRoute: string): boolean;
+export declare function server(options: ServerOptions): {
+    token(request: Request): string | null;
+    verify(request: Request): Promise<boolean>;
+    proxy(request: Request): Promise<Response>;
+    refresh(request: Request): Promise<RefreshResult>;
+};
 //# sourceMappingURL=index.d.ts.map

package/dist/server/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/server/index.ts"],"names":[],"mappings":"AAGA,MAAM,MAAM,gBAAgB,GAAG;IAC7B,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC;CACvB,CAAC;AAEF,MAAM,MAAM,WAAW,GAAG;IACxB,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;IACrB,YAAY,EAAE,MAAM,GAAG,IAAI,CAAC;IAC5B,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAC;CACzB,CAAC;AAEF,wBAAgB,eAAe,CAAC,IAAI,CAAC,EAAE,MAAM;;;;EAO5C;AAED,wBAAgB,gBAAgB,CAC9B,YAAY,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,EACvC,IAAI,CAAC,EAAE,MAAM,GACZ,WAAW,CAQb;AAED,wBAAgB,oBAAoB,CAClC,OAAO,EAAE,WAAW,EACpB,IAAI,CAAC,EAAE,MAAM,EACb,MAAM,GAAE,gBAAmC,YA4B5C;AAED,wBAAgB,qBAAqB,CAAC,QAAQ,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,WAKvE"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/server/index.ts"],"names":[],"mappings":"AASA,MAAM,MAAM,gBAAgB,GAAG;IAC7B,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC;CACvB,CAAC;AAEF,MAAM,MAAM,WAAW,GAAG;IACxB,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;IACrB,YAAY,EAAE,MAAM,GAAG,IAAI,CAAC;IAC5B,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAC;CACzB,CAAC;AAEF,MAAM,MAAM,aAAa,GAAG;IAC1B,6BAA6B;IAC7B,GAAG,EAAE,MAAM,CAAC;IACZ,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,YAAY,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC7B,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,gBAAgB,CAAC,EAAE,CAAC,CAAC,OAAO,EAAE,OAAO,KAAK,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC,GAAG,OAAO,CAAC;CACjF,CAAC;AAEF,MAAM,MAAM,aAAa,GAAG;IAC1B,QAAQ,CAAC,EAAE,QAAQ,CAAC;IACpB,OAAO,CAAC,EAAE,MAAM,EAAE,CAAC;CACpB,CAAC;AAEF,wBAAgB,eAAe,CAAC,IAAI,CAAC,EAAE,MAAM;;;;EAO5C;AAED,wBAAgB,gBAAgB,CAC9B,YAAY,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,EACvC,IAAI,CAAC,EAAE,MAAM,GACZ,WAAW,CAQb;AAED,wBAAgB,oBAAoB,CAClC,OAAO,EAAE,WAAW,EACpB,IAAI,CAAC,EAAE,MAAM,EACb,MAAM,GAAE,gBAAmC,YA4B5C;AAED,wBAAgB,qBAAqB,CAAC,QAAQ,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,WAKvE;AAOD,wBAAgB,MAAM,CAAC,OAAO,EAAE,aAAa;mBAsH1B,OAAO,GAAG,MAAM,GAAG,IAAI;oBAIhB,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC;mBAY3B,OAAO,GAAG,OAAO,CAAC,QAAQ,CAAC;qBAkHzB,OAAO,GAAG,OAAO,CAAC,aAAa,CAAC;EAkG1D"}

package/dist/server/index.js

@@ -1,3 +1,5 @@
+import { ConvexHttpClient } from "convex/browser";
+import { jwtDecode } from "jwt-decode";
 import { parse, serialize } from "cookie";
 import { isLocalHost } from "./utils.js";
 export function authCookieNames(host) {
@@ -51,4 +53,257 @@ export function shouldProxyAuthAction(pathname, apiRoute) {
     }
     return pathname === apiRoute || pathname === `${apiRoute}/`;
 }
+const REQUIRED_TOKEN_LIFETIME_MS = 60_000;
+const MINIMUM_REQUIRED_TOKEN_LIFETIME_MS = 10_000;
+export function server(options) {
+    const convexUrl = options.url;
+    const apiRoute = options.apiRoute ?? "/api/auth";
+    const cookieConfig = { maxAge: options.cookieMaxAge ?? null };
+    const verbose = options.verbose ?? false;
+    const logVerbose = (message) => {
+        if (!verbose) {
+            return;
+        }
+        console.debug(`${new Date().toISOString()} [convex-auth/server] ${message}`);
+    };
+    const cookieHost = (request) => {
+        return request.headers.get("host") ?? new URL(request.url).host;
+    };
+    const parseRequestCookies = (request) => {
+        return parseAuthCookies(request.headers.get("cookie"), cookieHost(request));
+    };
+    const attachCookies = (response, cookies) => {
+        for (const value of cookies) {
+            response.headers.append("Set-Cookie", value);
+        }
+        return response;
+    };
+    const jsonResponse = (body, status = 200) => {
+        return new Response(JSON.stringify(body), {
+            status,
+            headers: {
+                "Content-Type": "application/json",
+            },
+        });
+    };
+    const isCorsRequest = (request) => {
+        const originHeader = request.headers.get("origin");
+        if (originHeader === null) {
+            return false;
+        }
+        const requestUrl = new URL(request.url);
+        const originUrl = new URL(originHeader);
+        return (originUrl.host !== requestUrl.host ||
+            originUrl.protocol !== requestUrl.protocol);
+    };
+    const decodeToken = (token) => {
+        try {
+            return jwtDecode(token);
+        }
+        catch {
+            return null;
+        }
+    };
+    const convexClient = (token) => {
+        const client = new ConvexHttpClient(convexUrl);
+        if (token !== undefined && token !== null) {
+            client.setAuth(token);
+        }
+        return client;
+    };
+    const refreshTokens = async (request) => {
+        const cookies = parseRequestCookies(request);
+        const { token, refreshToken } = cookies;
+        if (refreshToken === null && token === null) {
+            logVerbose("No auth cookies found, skipping refresh");
+            return undefined;
+        }
+        if (refreshToken === null || token === null) {
+            logVerbose("Only one auth cookie present, clearing auth cookies");
+            return null;
+        }
+        const decodedToken = decodeToken(token);
+        if (decodedToken?.exp === undefined || decodedToken.iat === undefined) {
+            logVerbose("Failed to decode token, clearing auth cookies");
+            return null;
+        }
+        const totalTokenLifetimeMs = decodedToken.exp * 1000 - decodedToken.iat * 1000;
+        const minimumExpiration = Date.now() +
+            Math.min(REQUIRED_TOKEN_LIFETIME_MS, Math.max(MINIMUM_REQUIRED_TOKEN_LIFETIME_MS, totalTokenLifetimeMs / 10));
+        if (decodedToken.exp * 1000 > minimumExpiration) {
+            logVerbose("Token valid long enough, skipping refresh");
+            return undefined;
+        }
+        try {
+            const result = await convexClient().action("auth:signIn", {
+                refreshToken,
+            });
+            if (result.tokens === undefined) {
+                throw new Error("Invalid `auth:signIn` result for token refresh");
+            }
+            logVerbose(`Refreshed tokens, null=${result.tokens === null}`);
+            return result.tokens;
+        }
+        catch (error) {
+            console.error(error);
+            logVerbose("Token refresh failed, clearing auth cookies");
+            return null;
+        }
+    };
+    return {
+        token(request) {
+            return parseRequestCookies(request).token;
+        },
+        async verify(request) {
+            const token = parseRequestCookies(request).token;
+            if (token === null) {
+                return false;
+            }
+            const decodedToken = decodeToken(token);
+            if (decodedToken?.exp === undefined) {
+                return false;
+            }
+            return decodedToken.exp * 1000 > Date.now();
+        },
+        async proxy(request) {
+            const requestUrl = new URL(request.url);
+            if (!shouldProxyAuthAction(requestUrl.pathname, apiRoute)) {
+                return new Response("Invalid route", { status: 404 });
+            }
+            if (request.method !== "POST") {
+                return new Response("Invalid method", { status: 405 });
+            }
+            if (isCorsRequest(request)) {
+                return new Response("Invalid origin", { status: 403 });
+            }
+            const body = await request.json();
+            const action = body.action;
+            const args = (body.args ?? {});
+            if (action !== "auth:signIn" && action !== "auth:signOut") {
+                return new Response("Invalid action", { status: 400 });
+            }
+            const currentCookies = parseRequestCookies(request);
+            const host = cookieHost(request);
+            if (action === "auth:signIn") {
+                if (args.refreshToken !== undefined) {
+                    if (currentCookies.refreshToken === null) {
+                        return jsonResponse({ tokens: null });
+                    }
+                    args.refreshToken = currentCookies.refreshToken;
+                }
+                const client = convexClient(args.refreshToken !== undefined || args.params?.code !== undefined
+                    ? null
+                    : currentCookies.token);
+                try {
+                    const result = await client.action("auth:signIn", args);
+                    if (result.redirect !== undefined) {
+                        const response = jsonResponse({ redirect: result.redirect });
+                        return attachCookies(response, serializeAuthCookies({
+                            ...currentCookies,
+                            verifier: result.verifier ?? null,
+                        }, host, cookieConfig));
+                    }
+                    if (result.tokens !== undefined) {
+                        const response = jsonResponse({
+                            tokens: result.tokens === null
+                                ? null
+                                : { token: result.tokens.token, refreshToken: "dummy" },
+                        });
+                        return attachCookies(response, serializeAuthCookies({
+                            token: result.tokens?.token ?? null,
+                            refreshToken: result.tokens?.refreshToken ?? null,
+                            verifier: null,
+                        }, host, cookieConfig));
+                    }
+                    return jsonResponse(result);
+                }
+                catch (error) {
+                    const response = jsonResponse({ error: error.message }, 400);
+                    return attachCookies(response, serializeAuthCookies({
+                        token: null,
+                        refreshToken: null,
+                        verifier: null,
+                    }, host, cookieConfig));
+                }
+            }
+            try {
+                await convexClient(currentCookies.token).action("auth:signOut");
+            }
+            catch (error) {
+                console.error(error);
+            }
+            return attachCookies(jsonResponse(null), serializeAuthCookies({
+                token: null,
+                refreshToken: null,
+                verifier: null,
+            }, host, cookieConfig));
+        },
+        async refresh(request) {
+            const host = cookieHost(request);
+            if (isCorsRequest(request)) {
+                return {
+                    cookies: serializeAuthCookies({
+                        token: null,
+                        refreshToken: null,
+                        verifier: null,
+                    }, host, cookieConfig),
+                };
+            }
+            const requestUrl = new URL(request.url);
+            const code = requestUrl.searchParams.get("code");
+            const shouldHandleCode = options.shouldHandleCode === undefined
+                ? true
+                : typeof options.shouldHandleCode === "function"
+                    ? await options.shouldHandleCode(request)
+                    : options.shouldHandleCode;
+            if (code !== null &&
+                request.method === "GET" &&
+                request.headers.get("accept")?.includes("text/html") &&
+                shouldHandleCode) {
+                const requestCookies = parseRequestCookies(request);
+                const redirectUrl = new URL(requestUrl);
+                redirectUrl.searchParams.delete("code");
+                try {
+                    const result = await convexClient().action("auth:signIn", {
+                        params: { code },
+                        verifier: requestCookies.verifier ?? undefined,
+                    });
+                    if (result.tokens === undefined) {
+                        throw new Error("Invalid `auth:signIn` result for code exchange");
+                    }
+                    const response = Response.redirect(redirectUrl.toString(), 302);
+                    return {
+                        response: attachCookies(response, serializeAuthCookies({
+                            token: result.tokens?.token ?? null,
+                            refreshToken: result.tokens?.refreshToken ?? null,
+                            verifier: null,
+                        }, host, cookieConfig)),
+                    };
+                }
+                catch (error) {
+                    console.error(error);
+                    const response = Response.redirect(redirectUrl.toString(), 302);
+                    return {
+                        response: attachCookies(response, serializeAuthCookies({
+                            token: null,
+                            refreshToken: null,
+                            verifier: null,
+                        }, host, cookieConfig)),
+                    };
+                }
+            }
+            const tokens = await refreshTokens(request);
+            if (tokens === undefined) {
+                return {};
+            }
+            return {
+                cookies: serializeAuthCookies({
+                    token: tokens?.token ?? null,
+                    refreshToken: tokens?.refreshToken ?? null,
+                    verifier: null,
+                }, host, cookieConfig),
+            };
+        },
+    };
+}
 //# sourceMappingURL=index.js.map