@robelest/convex-auth 0.0.4-preview.13 → 0.0.4-preview.15

package/src/component/schema.ts

@@ -1,6 +1,24 @@
 import { defineSchema, defineTable } from "convex/server";
 import { v } from "convex/values";
 
+import {
+  vApiKeyRateLimit,
+  vApiKeyRateLimitState,
+  vApiKeyScope,
+  vAuditActorType,
+  vAuditStatus,
+  vDeviceStatus,
+  vEnterprisePolicy,
+  vEnterpriseSecretKind,
+  vEnterpriseStatus,
+  vInviteStatus,
+  vScimResourceType,
+  vScimStatus,
+  vTag,
+  vWebhookDeliveryStatus,
+  vWebhookEndpointStatus,
+} from "./model";
+
 /**
  * Schema for the auth component.
  *
@@ -166,11 +184,7 @@ export default defineSchema({
     /** Minimum polling interval in seconds. */
     interval: v.number(),
     /** Current status of this device authorization session. */
-    status: v.union(
-      v.literal("pending"),
-      v.literal("authorized"),
-      v.literal("denied"),
-    ),
+    status: vDeviceStatus,
     /** Set when the user authorizes — links to the authorizing user. */
     userId: v.optional(v.id("User")),
     /** Set when the user authorizes — the session created for the device. */
@@ -201,7 +215,7 @@ export default defineSchema({
     type: v.optional(v.string()),
     parentGroupId: v.optional(v.id("Group")),
     /** Faceted classification tags. Normalized at write time (trimmed, lowercased). */
-    tags: v.optional(v.array(v.object({ key: v.string(), value: v.string() }))),
+    tags: v.optional(v.array(vTag)),
     extend: v.optional(v.any()),
   })
     .index("slug", ["slug"])
@@ -253,12 +267,7 @@ export default defineSchema({
     email: v.optional(v.string()),
     tokenHash: v.string(),
     role: v.optional(v.string()),
-    status: v.union(
-      v.literal("pending"),
-      v.literal("accepted"),
-      v.literal("revoked"),
-      v.literal("expired"),
-    ),
+    status: vInviteStatus,
     expiresTime: v.optional(v.number()),
     acceptedByUserId: v.optional(v.id("User")),
     acceptedTime: v.optional(v.number()),
@@ -287,11 +296,8 @@ export default defineSchema({
     groupId: v.id("Group"),
     slug: v.optional(v.string()),
     name: v.optional(v.string()),
-    status: v.union(
-      v.literal("draft"),
-      v.literal("active"),
-      v.literal("disabled"),
-    ),
+    status: vEnterpriseStatus,
+    policy: v.optional(vEnterprisePolicy),
     config: v.optional(v.any()),
     extend: v.optional(v.any()),
   })
@@ -313,21 +319,30 @@ export default defineSchema({
     .index("group_id", ["groupId"])
     .index("domain", ["domain"]),
 
+  /**
+   * Encrypted enterprise secrets stored separately from protocol config.
+   */
+  EnterpriseSecret: defineTable({
+    enterpriseId: v.id("Enterprise"),
+    groupId: v.id("Group"),
+    kind: vEnterpriseSecretKind,
+    ciphertext: v.string(),
+    updatedAt: v.number(),
+  })
+    .index("enterprise_id", ["enterpriseId"])
+    .index("enterprise_id_kind", ["enterpriseId", "kind"])
+    .index("group_id", ["groupId"]),
+
   /**
    * SCIM configuration for an enterprise tenant.
    */
   EnterpriseScimConfig: defineTable({
     enterpriseId: v.id("Enterprise"),
     groupId: v.id("Group"),
-    status: v.union(
-      v.literal("draft"),
-      v.literal("active"),
-      v.literal("disabled"),
-    ),
+    status: vScimStatus,
     basePath: v.string(),
     tokenHash: v.string(),
     lastRotatedAt: v.optional(v.number()),
-    deprovisionMode: v.optional(v.union(v.literal("soft"), v.literal("hard"))),
     extend: v.optional(v.any()),
   })
     .index("enterprise_id", ["enterpriseId"])
@@ -341,7 +356,7 @@ export default defineSchema({
   EnterpriseScimIdentity: defineTable({
     enterpriseId: v.id("Enterprise"),
     groupId: v.id("Group"),
-    resourceType: v.union(v.literal("user"), v.literal("group")),
+    resourceType: vScimResourceType,
     externalId: v.string(),
     userId: v.optional(v.id("User")),
     mappedGroupId: v.optional(v.id("Group")),
@@ -356,6 +371,7 @@ export default defineSchema({
       "resourceType",
       "externalId",
     ])
+    .index("enterprise_id_user_id", ["enterpriseId", "userId"])
     .index("user_id", ["userId"])
     .index("mapped_group_id", ["mappedGroupId"]),
 
@@ -366,17 +382,11 @@ export default defineSchema({
     enterpriseId: v.id("Enterprise"),
     groupId: v.id("Group"),
     eventType: v.string(),
-    actorType: v.union(
-      v.literal("user"),
-      v.literal("system"),
-      v.literal("scim"),
-      v.literal("api_key"),
-      v.literal("webhook"),
-    ),
+    actorType: vAuditActorType,
     actorId: v.optional(v.string()),
     subjectType: v.string(),
     subjectId: v.optional(v.string()),
-    status: v.union(v.literal("success"), v.literal("failure")),
+    status: vAuditStatus,
     occurredAt: v.number(),
     requestId: v.optional(v.string()),
     ip: v.optional(v.string()),
@@ -393,7 +403,7 @@ export default defineSchema({
     enterpriseId: v.id("Enterprise"),
     groupId: v.id("Group"),
     url: v.string(),
-    status: v.union(v.literal("active"), v.literal("disabled")),
+    status: vWebhookEndpointStatus,
     secretHash: v.string(),
     subscriptions: v.array(v.string()),
     createdByUserId: v.optional(v.id("User")),
@@ -414,12 +424,7 @@ export default defineSchema({
     endpointId: v.id("EnterpriseWebhookEndpoint"),
     auditEventId: v.optional(v.id("EnterpriseAuditEvent")),
     eventType: v.string(),
-    status: v.union(
-      v.literal("pending"),
-      v.literal("processing"),
-      v.literal("delivered"),
-      v.literal("failed"),
-    ),
+    status: vWebhookDeliveryStatus,
     attemptCount: v.number(),
     nextAttemptAt: v.number(),
     lastAttemptAt: v.optional(v.number()),
@@ -454,26 +459,11 @@ export default defineSchema({
     /** User-assigned name (e.g. "CI Pipeline", "Production API"). */
     name: v.string(),
     /** Scoped permissions: [{ resource: "users", actions: ["read", "list"] }]. */
-    scopes: v.array(
-      v.object({
-        resource: v.string(),
-        actions: v.array(v.string()),
-      }),
-    ),
+    scopes: v.array(vApiKeyScope),
     /** Optional per-key rate limit configuration. */
-    rateLimit: v.optional(
-      v.object({
-        maxRequests: v.number(),
-        windowMs: v.number(),
-      }),
-    ),
+    rateLimit: v.optional(vApiKeyRateLimit),
     /** Rate limit state tracking (token-bucket). */
-    rateLimitState: v.optional(
-      v.object({
-        attemptsLeft: v.number(),
-        lastAttemptTime: v.number(),
-      }),
-    ),
+    rateLimitState: v.optional(vApiKeyRateLimitState),
     /** Expiration timestamp. Null/undefined = never expires. */
     expiresAt: v.optional(v.number()),
     lastUsedAt: v.optional(v.number()),

package/src/providers/sso.ts

@@ -14,7 +14,7 @@
  * });
  *
  * // auth.sso is now available
- * await auth.sso.oidc.configure(ctx, { enterpriseId, clientId, ... });
+ * await auth.sso.admin.oidc.configure(ctx, { enterpriseId, clientId, ... });
  * ```
  *
  * Without `new SSO()` in the providers list, `auth.sso` is not

package/src/server/auth.ts

@@ -8,9 +8,9 @@ import type { UserIdentity } from "convex/server";
 import type { GenericId } from "convex/values";
 
 import type { AuthApiRefs } from "../client/index";
+import { Auth as AuthFactory } from "./factory";
 import { Fx } from "./fx";
 import { AuthError } from "./fx";
-import { Auth as AuthFactory } from "./implementation";
 import type { Doc } from "./types";
 import type {
   AuthProviderConfig,
@@ -47,14 +47,58 @@ export type AuthApiBase = {
   http: ReturnType<typeof AuthFactory>["auth"]["http"];
 };
 
-/** Auth API with SSO namespace — present only when `new SSO()` is in providers. */
+type InternalSsoApi = ReturnType<typeof AuthFactory>["auth"]["sso"];
+
+type PublicSsoAdminApi = {
+  connection: InternalSsoApi["connection"] & {
+    domain: {
+      list: InternalSsoApi["domain"]["list"];
+      validate: InternalSsoApi["domain"]["validate"];
+      set: (
+        ctx: Parameters<InternalSsoApi["connection"]["create"]>[0],
+        enterpriseId: string,
+        domains: Array<{
+          domain: string;
+          isPrimary?: boolean;
+          verifiedAt?: number;
+        }>,
+      ) => Promise<void>;
+    };
+  };
+  oidc: Omit<InternalSsoApi["oidc"], "signIn">;
+  saml: Omit<InternalSsoApi["saml"], "metadata">;
+  policy: InternalSsoApi["policy"];
+  audit: {
+    list: InternalSsoApi["audit"]["list"];
+  };
+  webhook: {
+    endpoint: InternalSsoApi["webhook"]["endpoint"];
+  };
+};
+
+type PublicSsoClientApi = {
+  signIn: InternalSsoApi["oidc"]["signIn"];
+  metadata: InternalSsoApi["saml"]["metadata"];
+};
+
+type PublicSsoApi = {
+  admin: PublicSsoAdminApi;
+  client: PublicSsoClientApi;
+};
+
+type PublicScimApi = {
+  admin: Omit<InternalSsoApi["scim"], "getConfigByToken" | "identity">;
+};
+
+/** Auth API with enterprise namespaces — present only when `new SSO()` is in providers. */
 export type AuthApi = AuthApiBase & {
-  sso: ReturnType<typeof AuthFactory>["auth"]["sso"];
+  sso: PublicSsoApi;
+  scim: PublicScimApi;
 };
 
 /**
  * The return type of `createAuth`. Conditional namespaces:
- * - `auth.sso` — only when `new SSO()` is in providers
+ * - `auth.sso` and `auth.scim` — only when `new SSO()` is in providers
  * - `auth.clientApi` — typed API refs for the client SDK with capabilities
  */
 export type ConvexAuthResult<P extends AuthProviderConfig[]> =
@@ -72,7 +116,7 @@ export type ConvexAuthResult<P extends AuthProviderConfig[]> =
  * // Frontend
  * import type { auth } from "../convex/auth";
  * import type { InferClientApi } from "@robelest/convex-auth/component";
- * const c = client<InferClientApi<typeof auth>>({ convex, api: { ... } });
+ * const c = client<InferClientApi<typeof auth>>({ convex, api: api.auth });
  * ```
  */
 export type InferClientApi<T> =
@@ -94,9 +138,9 @@ export type AuthLike = Pick<AuthApiBase, "user">;
 /**
  * Create an auth API object.
  *
- * When `new SSO()` is included in providers, `auth.sso` is available
- * on the returned object. Without it, `auth.sso` is absent and
- * accessing it is a TypeScript compile error.
+ * When `new SSO()` is included in providers, `auth.sso` and `auth.scim`
+ * are available on the returned object. Without it, those namespaces are
+ * absent and accessing them is a TypeScript compile error.
  */
 export function createAuth<P extends AuthProviderConfig[]>(
   component: ConvexAuthConfig["component"],
@@ -107,6 +151,138 @@ export function createAuth<P extends AuthProviderConfig[]>(
     component,
     providers: [...config.providers],
   });
+  const {
+    domain: domainApi,
+    scim: scimApi,
+    connection: connectionApi,
+    audit: auditApi,
+    webhook: webhookApi,
+    oidc: oidcApi,
+    saml: samlApi,
+    ...restSso
+  } = authResult.auth.sso as InternalSsoApi;
+
+  type SetEnterpriseDomains = PublicSsoAdminApi["connection"]["domain"]["set"];
+  type EnterpriseDomainInput = Array<{
+    domain: string;
+    isPrimary?: boolean;
+    verifiedAt?: number;
+  }>;
+  const setEnterpriseDomains: PublicSsoAdminApi["connection"]["domain"]["set"] =
+    async (
+      ctx: Parameters<SetEnterpriseDomains>[0],
+      enterpriseId: Parameters<SetEnterpriseDomains>[1],
+      domains: EnterpriseDomainInput,
+    ) => {
+      const enterprise = await connectionApi.get(ctx, enterpriseId);
+      if (enterprise === null) {
+        throw new AuthError(
+          "INVALID_PARAMETERS",
+          "Enterprise not found.",
+        ).toConvexError();
+      }
+
+      const normalized = domains.map((entry: (typeof domains)[number]) => ({
+        ...entry,
+        domain: entry.domain.trim().toLowerCase(),
+      }));
+      const deduped = new Map<string, (typeof normalized)[number]>();
+      for (const entry of normalized) {
+        if (entry.domain.length === 0) {
+          throw new AuthError(
+            "INVALID_PARAMETERS",
+            "Domain must not be empty.",
+          ).toConvexError();
+        }
+        if (deduped.has(entry.domain)) {
+          throw new AuthError(
+            "INVALID_PARAMETERS",
+            `Duplicate domain: ${entry.domain}`,
+          ).toConvexError();
+        }
+        deduped.set(entry.domain, entry);
+      }
+
+      const nextDomains = [...deduped.values()];
+      const primaryCount = nextDomains.filter(
+        (entry) => entry.isPrimary,
+      ).length;
+      if (primaryCount > 1) {
+        throw new AuthError(
+          "INVALID_PARAMETERS",
+          "Only one primary domain may be set.",
+        ).toConvexError();
+      }
+      if (nextDomains.length > 0 && primaryCount === 0) {
+        nextDomains[0] = { ...nextDomains[0], isPrimary: true };
+      }
+
+      const currentDomains = await domainApi.list(ctx, enterpriseId);
+      const currentByDomain = new Map<string, (typeof currentDomains)[number]>(
+        currentDomains.map((entry: (typeof currentDomains)[number]) => [
+          entry.domain.toLowerCase(),
+          entry,
+        ]),
+      );
+
+      for (const existing of currentDomains) {
+        if (!deduped.has(existing.domain.toLowerCase())) {
+          await domainApi.remove(ctx, existing._id);
+        }
+      }
+
+      for (const nextDomain of nextDomains) {
+        const current = currentByDomain.get(nextDomain.domain);
+        if (
+          current &&
+          current.isPrimary === Boolean(nextDomain.isPrimary) &&
+          current.verifiedAt === (nextDomain.verifiedAt ?? current.verifiedAt)
+        ) {
+          continue;
+        }
+        if (current) {
+          await domainApi.remove(ctx, current._id);
+        }
+        await domainApi.add(ctx, {
+          enterpriseId: enterprise._id,
+          groupId: enterprise.groupId,
+          domain: nextDomain.domain,
+          isPrimary: nextDomain.isPrimary,
+          verifiedAt: nextDomain.verifiedAt ?? current?.verifiedAt,
+        });
+      }
+    };
+
+  const publicSso: PublicSsoApi = {
+    admin: {
+      ...restSso,
+      oidc: {
+        ...oidcApi,
+      },
+      saml: {
+        ...samlApi,
+      },
+      connection: {
+        ...connectionApi,
+        domain: {
+          list: domainApi.list,
+          validate: domainApi.validate,
+          set: setEnterpriseDomains,
+        },
+      },
+      policy: restSso.policy,
+      audit: {
+        list: auditApi.list,
+      },
+      webhook: {
+        endpoint: webhookApi.endpoint,
+      },
+    },
+    client: {
+      signIn: oidcApi.signIn,
+      metadata: samlApi.metadata,
+    },
+  };
 
   return {
     signIn: authResult.signIn,
@@ -120,7 +296,14 @@ export function createAuth<P extends AuthProviderConfig[]>(
     member: authResult.auth.member,
     invite: authResult.auth.invite,
     key: authResult.auth.key,
-    sso: authResult.auth.sso,
+    sso: publicSso,
+    scim: {
+      admin: {
+        configure: scimApi.configure,
+        get: scimApi.get,
+        validate: scimApi.validate,
+      },
+    },
     http: authResult.auth.http,
   } as ConvexAuthResult<P>;
 }

package/src/server/cookies.ts

@@ -1,5 +1,6 @@
 import { isLocalHost } from "./utils";
 
+/** @internal */
 export const SHARED_COOKIE_OPTIONS = {
   httpOnly: true,
   sameSite: "none" as const,
@@ -9,6 +10,7 @@ export const SHARED_COOKIE_OPTIONS = {
 };
 
 const REDIRECT_MAX_AGE = 60 * 15; // 15 minutes in seconds
+/** @internal */
 export function redirectToParamCookie(providerId: string, redirectTo: string) {
   return {
     name: redirectToParamCookieName(providerId),
@@ -17,6 +19,7 @@ export function redirectToParamCookie(providerId: string, redirectTo: string) {
   };
 }
 
+/** @internal */
 export function useRedirectToParam(
   providerId: string,
   cookies: Record<string, string | undefined>,

package/src/server/db.ts

@@ -56,10 +56,13 @@ type AuthComponentApiLike = {
   };
 };
 
+/** @internal */
 export type AuthDbConfig = { component: AuthComponentApiLike };
 
+/** @internal */
 export type AuthDb = ReturnType<typeof authDb>;
 
+/** @internal */
 export function authDb(ctx: CtxLike, config: AuthDbConfig) {
   const component = config.component;
   return {

package/src/server/device.ts

@@ -13,6 +13,7 @@
 import { Fx } from "@robelest/fx";
 
 import { AuthError } from "./fx";
+import { userIdFromIdentitySubject } from "./identity";
 import { callSignIn } from "./mutations/index";
 import { DeviceProviderConfig, GenericActionCtxWithAuthConfig } from "./types";
 import {
@@ -63,6 +64,7 @@ type DeviceResult =
     }
   | { kind: "signedIn"; signedIn: SessionInfo | null };
 
+/** @internal */
 export const handleDevice = (
   ctx: EnrichedActionCtx,
   provider: DeviceProviderConfig,
@@ -187,7 +189,7 @@ export const handleDevice = (
         );
       }
 
-      const userId = identity.subject.split("|")[0]!;
+      const userId = userIdFromIdentitySubject(identity.subject);
       const doc = await queryDeviceByUserCode(ctx, params.userCode);
       if (doc === null) {
         throw new AuthError("DEVICE_INVALID_USER_CODE");