@robelest/convex-auth 0.0.2-preview.2 → 0.0.2

package/src/cli/index.ts

@@ -11,12 +11,50 @@ import * as v from "valibot";
 import { actionDescription } from "./command.js";
 import { generateKeys } from "./generateKeys.js";
 
-new Command()
+const program = new Command()
   .name("@robelest/convex-auth")
   .description(
     "Add code and set environment variables for @robelest/convex-auth.\n\n" +
       "Full docs: https://deepwiki.com/robelest/convex-auth",
+  );
+
+// ---- Portal subcommand ----
+const portalCmd = program
+  .command("portal")
+  .description("Manage the auth admin portal");
+
+portalCmd
+  .command("upload")
+  .description("Upload portal static files to Convex storage")
+  .allowUnknownOption(true)
+  .allowExcessArguments(true)
+  .action(async () => {
+    // Pass remaining args after "portal upload" to the upload handler
+    const idx = process.argv.indexOf("upload");
+    const uploadArgs = idx >= 0 ? process.argv.slice(idx + 1) : [];
+    const { portalUploadMain } = await import("./portal-upload.js");
+    await portalUploadMain(uploadArgs);
+  });
+
+portalCmd
+  .command("link")
+  .description("Generate an admin invite link for the portal")
+  .option("--prod", "Use production deployment")
+  .option(
+    "--component <name>",
+    "Convex module with portal functions",
+    "auth",
   )
+  .action(async (opts) => {
+    const { portalLinkMain } = await import("./portal-link.js");
+    await portalLinkMain({
+      prod: opts.prod ?? false,
+      component: opts.component,
+    });
+  });
+
+// ---- Default setup command ----
+program
   .option(
     "--site-url <url>",
     "Your frontend app URL (e.g. 'http://localhost:5173' for dev, 'https://myapp.com' for prod)",
@@ -93,8 +131,9 @@ new Command()
     } else {
       printFinalSuccessMessage(config);
     }
-  })
-  .parse(process.argv);
+  });
+
+program.parse(process.argv);
 
 type ProjectConfig = {
   isExpo: boolean;
@@ -432,13 +471,16 @@ export default app;
 async function initializeAuth(config: ProjectConfig) {
   logStep(config, "Initialize auth file");
   const sourceTemplate = `\
-import { Auth } from "@robelest/convex-auth/component";
+import { Auth, Portal } from "@robelest/convex-auth/component";
 import { components } from "./_generated/api";
 
-export const { auth, signIn, signOut, store } = Auth({$$
-  component: components.auth,$$
+const auth = new Auth(components.auth, {$$
   providers: [$$],$$
 });
+
+export { auth };
+export const { signIn, signOut, store } = auth;
+export const { portalQuery, portalMutation, portalInternal } = Portal(auth);
 `;
   const source = templateToSource(sourceTemplate);
   const authPath = path.join(config.convexFolderPath, "auth");

package/src/cli/portal-link.ts

@@ -0,0 +1,112 @@
+#!/usr/bin/env node
+/**
+ * CLI tool to generate a portal admin invite link.
+ *
+ * Generates a random invite token, hashes it (SHA-256), stores the hash
+ * in the database via `createPortalInvite`, and prints a URL the admin
+ * can visit to accept the invite.
+ *
+ * Usage:
+ *   npx @robelest/convex-auth portal link [options]
+ *
+ * Options:
+ *   --prod                   Use production deployment
+ *   --component <name>       Convex component with portal functions (default: portal)
+ */
+
+import { randomBytes, createHash } from "crypto";
+import { execFile } from "child_process";
+
+// ---------------------------------------------------------------------------
+// Helpers
+// ---------------------------------------------------------------------------
+
+let useProd = false;
+
+/**
+ * Run a Convex internal function via the CLI.
+ * Follows the same pattern as portal-upload.ts.
+ */
+function convexRunAsync(
+  functionPath: string,
+  args: Record<string, unknown> = {},
+): Promise<string> {
+  return new Promise((resolve, reject) => {
+    const cmdArgs = [
+      "convex",
+      "run",
+      functionPath,
+      JSON.stringify(args),
+      "--typecheck=disable",
+      "--codegen=disable",
+    ];
+    if (useProd) cmdArgs.push("--prod");
+    execFile("npx", cmdArgs, { encoding: "utf-8" }, (error, stdout, stderr) => {
+      if (error) {
+        console.error("Convex run failed:", stderr || stdout);
+        reject(error);
+        return;
+      }
+      resolve(stdout.trim());
+    });
+  });
+}
+
+/**
+ * Generate a URL-safe random token (32 bytes → 43 chars base64url).
+ */
+function generateToken(): string {
+  return randomBytes(32).toString("base64url");
+}
+
+/**
+ * SHA-256 hash a token and return the hex digest.
+ */
+function hashToken(token: string): string {
+  return createHash("sha256").update(token).digest("hex");
+}
+
+// ---------------------------------------------------------------------------
+// Main
+// ---------------------------------------------------------------------------
+
+export async function portalLinkMain(opts: {
+  prod: boolean;
+  component: string;
+}): Promise<void> {
+  useProd = opts.prod;
+  const component = opts.component;
+
+  // 1. Generate a random token and its hash
+  const token = generateToken();
+  const tokenHash = hashToken(token);
+
+  console.log("Creating portal admin invite...");
+
+  // 2. Store the invite and get the portal URL back
+  let portalUrl: string;
+  try {
+    const raw = await convexRunAsync(`${component}:portalInternal`, {
+      action: "createPortalInvite",
+      tokenHash,
+    });
+    const result = JSON.parse(raw);
+    portalUrl = result.portalUrl;
+  } catch {
+    console.error(
+      "\nFailed to create invite. Make sure your Convex deployment is running",
+      "and the portal module is configured in your convex/ directory.",
+    );
+    process.exit(1);
+  }
+
+  // 3. Print the invite link
+  const inviteUrl = `${portalUrl}?invite=${token}`;
+
+  console.log("\nPortal admin invite created!\n");
+  console.log(`  ${inviteUrl}\n`);
+  console.log("This invite is single-use. Share it securely.");
+  if (useProd) {
+    console.log("(Using production deployment)");
+  }
+}

package/src/cli/portal-upload.ts

@@ -0,0 +1,411 @@
+#!/usr/bin/env node
+/**
+ * CLI tool to upload portal static files to Convex storage.
+ *
+ * Forked from @convex-dev/self-hosting upload, adapted to use the
+ * consolidated `portalInternal` internal mutation with action discriminator.
+ *
+ * Usage:
+ *   npx @robelest/convex-auth portal upload [options]
+ *
+ * Options:
+ *   --dist <path>            Path to dist directory (default: ./dist)
+ *   --component <name>       Convex module with portal functions (default: auth)
+ *   --prod                   Deploy to production deployment
+ *   --help                   Show help
+ */
+
+import { readFileSync, readdirSync, existsSync } from "fs";
+import { join, relative, extname, resolve } from "path";
+import { randomUUID } from "crypto";
+import { execSync, execFile, spawnSync } from "child_process";
+
+// MIME type mapping
+const MIME_TYPES: Record<string, string> = {
+  ".html": "text/html; charset=utf-8",
+  ".js": "application/javascript; charset=utf-8",
+  ".mjs": "application/javascript; charset=utf-8",
+  ".css": "text/css; charset=utf-8",
+  ".json": "application/json; charset=utf-8",
+  ".png": "image/png",
+  ".jpg": "image/jpeg",
+  ".jpeg": "image/jpeg",
+  ".gif": "image/gif",
+  ".svg": "image/svg+xml",
+  ".ico": "image/x-icon",
+  ".webp": "image/webp",
+  ".woff": "font/woff",
+  ".woff2": "font/woff2",
+  ".ttf": "font/ttf",
+  ".txt": "text/plain; charset=utf-8",
+  ".map": "application/json",
+  ".webmanifest": "application/manifest+json",
+  ".xml": "application/xml",
+};
+
+function getMimeType(path: string): string {
+  return MIME_TYPES[extname(path).toLowerCase()] || "application/octet-stream";
+}
+
+interface ParsedArgs {
+  dist: string;
+  component: string;
+  prod: boolean;
+  build: boolean;
+  concurrency: number;
+  help: boolean;
+}
+
+export function parsePortalUploadArgs(args: string[]): ParsedArgs {
+  const result: ParsedArgs = {
+    dist: "./dist",
+    component: "auth",
+    prod: false,
+    build: false,
+    concurrency: 5,
+    help: false,
+  };
+
+  for (let i = 0; i < args.length; i++) {
+    const arg = args[i];
+    if (arg === "--help" || arg === "-h") {
+      result.help = true;
+    } else if (arg === "--dist" || arg === "-d") {
+      result.dist = args[++i] || result.dist;
+    } else if (arg === "--component" || arg === "-c") {
+      result.component = args[++i] || result.component;
+    } else if (arg === "--prod") {
+      result.prod = true;
+    } else if (arg === "--no-prod" || arg === "--dev") {
+      result.prod = false;
+    } else if (arg === "--build" || arg === "-b") {
+      result.build = true;
+    } else if (arg === "--concurrency" || arg === "-j") {
+      const val = parseInt(args[++i], 10);
+      if (val > 0) result.concurrency = val;
+    }
+  }
+
+  return result;
+}
+
+function showHelp(): void {
+  console.log(`
+Usage: npx @robelest/convex-auth portal upload [options]
+
+Upload portal static files to Convex storage.
+
+Options:
+  -d, --dist <path>           Path to dist directory (default: ./dist)
+   -c, --component <name>      Convex module with portal functions (default: auth)
+      --prod                  Deploy to production deployment
+  -b, --build                 Run 'npm run build' before uploading
+  -j, --concurrency <n>       Number of parallel uploads (default: 5)
+  -h, --help                  Show this help message
+
+Examples:
+  npx @robelest/convex-auth portal upload
+  npx @robelest/convex-auth portal upload --dist packages/portal/build --prod
+  npx @robelest/convex-auth portal upload --build --prod
+`);
+}
+
+// Global flag for production mode
+let useProd = true;
+
+/**
+ * Run a Convex function via the CLI. Uses the consolidated `portalInternal`
+ * internal mutation with an `action` discriminator.
+ */
+function convexRunAsync(
+  functionPath: string,
+  args: Record<string, unknown> = {},
+): Promise<string> {
+  return new Promise((resolve, reject) => {
+    const cmdArgs = [
+      "convex",
+      "run",
+      functionPath,
+      JSON.stringify(args),
+      "--typecheck=disable",
+      "--codegen=disable",
+    ];
+    if (useProd) cmdArgs.push("--prod");
+    execFile("npx", cmdArgs, { encoding: "utf-8" }, (error, stdout, stderr) => {
+      if (error) {
+        console.error("Convex run failed:", stderr || stdout);
+        reject(error);
+        return;
+      }
+      resolve(stdout.trim());
+    });
+  });
+}
+
+/**
+ * Run the portalInternal function with a specific action.
+ */
+function runHosting(
+  componentName: string,
+  action: string,
+  extraArgs: Record<string, unknown> = {},
+): Promise<string> {
+  return convexRunAsync(`${componentName}:portalInternal`, {
+    action,
+    ...extraArgs,
+  });
+}
+
+async function uploadSingleFile(
+  file: { path: string; localPath: string; contentType: string },
+  componentName: string,
+  deploymentId: string,
+): Promise<{ path: string }> {
+  const content = readFileSync(file.localPath);
+
+  // Generate upload URL
+  const uploadUrlOutput = await runHosting(componentName, "generateUploadUrl");
+  const uploadUrl = JSON.parse(uploadUrlOutput);
+
+  // Upload to Convex storage
+  const response = await fetch(uploadUrl, {
+    method: "POST",
+    headers: { "Content-Type": file.contentType },
+    body: content,
+  });
+
+  const { storageId } = (await response.json()) as { storageId: string };
+
+  // Record the asset
+  await runHosting(componentName, "recordAsset", {
+    path: file.path,
+    storageId,
+    contentType: file.contentType,
+    deploymentId,
+  });
+
+  return { path: file.path };
+}
+
+async function uploadWithConcurrency(
+  files: Array<{ path: string; localPath: string; contentType: string }>,
+  componentName: string,
+  deploymentId: string,
+  concurrency: number,
+): Promise<void> {
+  const total = files.length;
+  let completed = 0;
+  let failed = false;
+
+  const pending = new Set<Promise<void>>();
+  const iterator = files[Symbol.iterator]();
+
+  function enqueue(): Promise<void> | undefined {
+    if (failed) return;
+    const next = iterator.next();
+    if (next.done) return;
+    const file = next.value;
+
+    const task = uploadSingleFile(file, componentName, deploymentId).then(
+      ({ path }) => {
+        completed++;
+        console.log(`  [${completed}/${total}] ${path}`);
+        pending.delete(task);
+      },
+    );
+
+    task.catch(() => {
+      failed = true;
+    });
+
+    pending.add(task);
+    return task;
+  }
+
+  // Fill initial pool
+  for (let i = 0; i < concurrency && i < total; i++) {
+    void enqueue();
+  }
+
+  // Process remaining files as slots open
+  while (pending.size > 0) {
+    await Promise.race(pending);
+    if (failed) {
+      await Promise.allSettled(pending);
+      throw new Error("Upload failed");
+    }
+    void enqueue();
+  }
+}
+
+function collectFiles(
+  dir: string,
+  baseDir: string,
+): Array<{ path: string; localPath: string; contentType: string }> {
+  const files: Array<{
+    path: string;
+    localPath: string;
+    contentType: string;
+  }> = [];
+
+  for (const entry of readdirSync(dir, { withFileTypes: true })) {
+    const fullPath = join(dir, entry.name);
+    if (entry.isDirectory()) {
+      files.push(...collectFiles(fullPath, baseDir));
+    } else if (entry.isFile()) {
+      files.push({
+        path: "/" + relative(baseDir, fullPath).replace(/\\/g, "/"),
+        localPath: fullPath,
+        contentType: getMimeType(fullPath),
+      });
+    }
+  }
+  return files;
+}
+
+/**
+ * Get the Convex site URL (.convex.site) from the cloud URL
+ */
+function getConvexSiteUrl(prod: boolean): string | null {
+  try {
+    const envFlag = prod ? "--prod" : "";
+    const result = execSync(`npx convex env get CONVEX_CLOUD_URL ${envFlag}`, {
+      stdio: "pipe",
+      encoding: "utf-8",
+    });
+    const cloudUrl = result.trim();
+    if (cloudUrl && cloudUrl.includes(".convex.cloud")) {
+      return cloudUrl.replace(".convex.cloud", ".convex.site");
+    }
+  } catch {
+    // Ignore errors
+  }
+  return null;
+}
+
+export async function portalUploadMain(rawArgs: string[]): Promise<void> {
+  const args = parsePortalUploadArgs(rawArgs);
+
+  if (args.help) {
+    showHelp();
+    process.exit(0);
+  }
+
+  // Set global prod flag
+  useProd = args.prod;
+
+  // Run build if requested
+  if (args.build) {
+    let convexUrl: string | null = null;
+
+    if (useProd) {
+      try {
+        const result = execSync("npx convex dashboard --prod --no-open", {
+          stdio: "pipe",
+          encoding: "utf-8",
+        });
+        const match = result.match(/dashboard\.convex\.dev\/d\/([a-z0-9-]+)/i);
+        if (match) {
+          convexUrl = `https://${match[1]}.convex.cloud`;
+        }
+      } catch {
+        console.error("Could not get production Convex URL.");
+        console.error(
+          "Make sure you have deployed to production: npx convex deploy",
+        );
+        process.exit(1);
+      }
+    } else {
+      if (existsSync(".env.local")) {
+        const envContent = readFileSync(".env.local", "utf-8");
+        const match = envContent.match(/(?:VITE_)?CONVEX_URL=(.+)/);
+        if (match) {
+          convexUrl = match[1].trim();
+        }
+      }
+    }
+
+    if (!convexUrl) {
+      console.error("Could not determine Convex URL for build.");
+      process.exit(1);
+    }
+
+    const envLabel = useProd ? "production" : "development";
+    console.log(`Building for ${envLabel}...`);
+    console.log(`   VITE_CONVEX_URL=${convexUrl}`);
+    console.log("");
+
+    const buildResult = spawnSync("npm", ["run", "build"], {
+      stdio: "inherit",
+      env: { ...process.env, VITE_CONVEX_URL: convexUrl },
+    });
+
+    if (buildResult.status !== 0) {
+      console.error("Build failed.");
+      process.exit(1);
+    }
+
+    console.log("");
+  }
+
+  const distDir = resolve(args.dist);
+  const componentName = args.component;
+
+  if (!existsSync(distDir)) {
+    console.error(`Error: dist directory not found: ${distDir}`);
+    console.error(
+      "Run your build command first (e.g., 'bun run build:portal' or add --build flag)",
+    );
+    process.exit(1);
+  }
+
+  const deploymentId = randomUUID();
+  const files = collectFiles(distDir, distDir);
+
+  const envLabel = useProd ? "production" : "development";
+  console.log(`Deploying portal to ${envLabel} environment`);
+  console.log(
+    `Uploading ${files.length} files with deployment ID: ${deploymentId}`,
+  );
+  console.log(`Component: ${componentName}`);
+  console.log("");
+
+  try {
+    await uploadWithConcurrency(
+      files,
+      componentName,
+      deploymentId,
+      args.concurrency,
+    );
+  } catch {
+    console.error("Upload failed.");
+    process.exit(1);
+  }
+
+  console.log("");
+
+  // Garbage collect old files
+  const gcOutput = await runHosting(componentName, "gcOldAssets", {
+    currentDeploymentId: deploymentId,
+  });
+  const gcResult = JSON.parse(gcOutput);
+
+  const deletedCount =
+    typeof gcResult === "number" ? gcResult : gcResult.deleted;
+
+  if (deletedCount > 0) {
+    console.log(
+      `Cleaned up ${deletedCount} old storage file(s) from previous deployments`,
+    );
+  }
+
+  console.log("");
+  console.log("Upload complete!");
+
+  // Show the deployment URL
+  const deployedSiteUrl = getConvexSiteUrl(useProd);
+  if (deployedSiteUrl) {
+    console.log("");
+    console.log(`Portal available at: ${deployedSiteUrl}/auth`);
+  }
+}