@robelest/convex-auth 0.0.4-preview.13 → 0.0.4-preview.15

package/src/server/keys.ts

@@ -39,6 +39,7 @@ const VISIBLE_PREFIX_EXTRA_CHARS = 4;
  * @param prefix - Key prefix, defaults to "sk_"
  * @returns `{ raw, hashedKey, displayPrefix }`
  */
+/** @internal */
 export async function generateApiKey(
   prefix: string = DEFAULT_KEY_PREFIX,
 ): Promise<{
@@ -65,6 +66,7 @@ export async function generateApiKey(
  *
  * Used during Bearer token verification to find the stored key record.
  */
+/** @internal */
 export async function hashApiKey(rawKey: string): Promise<string> {
   return sha256(rawKey);
 }
@@ -82,6 +84,7 @@ export async function hashApiKey(rawKey: string): Promise<string> {
  * A wildcard action `"*"` grants all actions on that resource.
  * A wildcard resource `"*"` grants the action on all resources.
  */
+/** @internal */
 export function buildScopeChecker(scopes: KeyScope[]): ScopeChecker {
   return {
     scopes,
@@ -107,6 +110,7 @@ export function buildScopeChecker(scopes: KeyScope[]): ScopeChecker {
  *
  * @returns `{ limited: boolean; newState: { attemptsLeft, lastAttemptTime } }`
  */
+/** @internal */
 export function checkKeyRateLimit(
   rateLimit: { maxRequests: number; windowMs: number },
   state: { attemptsLeft: number; lastAttemptTime: number } | undefined,

package/src/server/mutations/index.ts

@@ -96,7 +96,7 @@ export const storeImpl = async (
   config: Provider.Config,
 ) => {
   const args = fnArgs.args;
-  logWithLevel(LOG_LEVELS.INFO, `\`auth/store:run\` type: ${args.type}`);
+  logWithLevel(LOG_LEVELS.INFO, `\`auth:store\` type: ${args.type}`);
   return Fx.run(
     Fx.match(args, args.type, {
       signIn: (a) =>

package/src/server/mutations/oauth.ts

@@ -10,6 +10,7 @@ import {
   ENTERPRISE_SAML_PROVIDER_PREFIX,
   createSyntheticOAuthMaterializedConfig,
   isEnterpriseProviderId,
+  normalizeEnterprisePolicy,
 } from "../sso";
 import { MutationCtx } from "../types";
 import type { AuthProviderMaterializedConfig } from "../types";
@@ -92,9 +93,29 @@ export function userOAuthImpl(
       : provider.startsWith(ENTERPRISE_SAML_PROVIDER_PREFIX)
         ? provider.slice(ENTERPRISE_SAML_PROVIDER_PREFIX.length)
         : null;
-    // Always try to reuse SCIM-provisioned user by externalId for enterprise sign-ins.
+    const enterprise =
+      enterpriseId !== null
+        ? yield* Fx.promise(() =>
+            ctx.runQuery(config.component.public.enterpriseGet, {
+              enterpriseId,
+            }),
+          )
+        : null;
+    const enterprisePolicy = enterprise
+      ? normalizeEnterprisePolicy(enterprise.policy)
+      : null;
+    const enterpriseProtocol = provider.startsWith(
+      ENTERPRISE_OIDC_PROVIDER_PREFIX,
+    )
+      ? "oidc"
+      : provider.startsWith(ENTERPRISE_SAML_PROVIDER_PREFIX)
+        ? "saml"
+        : null;
+
     const existingScimIdentity =
-      enterpriseId !== null && existingAccount === null
+      enterpriseId !== null &&
+      existingAccount === null &&
+      enterprisePolicy?.provisioning.scimReuse.user === "externalId"
         ? yield* Fx.promise(() =>
             ctx.runQuery(config.component.public.enterpriseScimIdentityGet, {
               enterpriseId,
@@ -123,7 +144,14 @@ export function userOAuthImpl(
         {
           type: "oauth",
           provider: (isEnterpriseProviderId(provider)
-            ? createSyntheticOAuthMaterializedConfig(provider)
+            ? createSyntheticOAuthMaterializedConfig(provider, {
+                accountLinking:
+                  enterpriseProtocol === "oidc"
+                    ? enterprisePolicy?.identity.accountLinking.oidc
+                    : enterpriseProtocol === "saml"
+                      ? enterprisePolicy?.identity.accountLinking.saml
+                      : undefined,
+              })
             : getProviderOrThrow(provider)) as AuthProviderMaterializedConfig,
           profile,
           accountExtend: normalizeAccountExtend(
@@ -142,13 +170,13 @@ export function userOAuthImpl(
     // JIT group provisioning: if this is an enterprise SSO sign-in and the
     // enterprise connection has a groupId, auto-add the user as a member of
     // that group if they aren't already a member.
-    if (enterpriseId !== null) {
+    if (
+      enterpriseId !== null &&
+      enterprisePolicy?.provisioning.jit.mode === "createUserAndMembership"
+    ) {
       const account = yield* Fx.promise(() => db.accounts.getById(accountId));
       const userId = account?.userId;
       if (userId) {
-        const enterprise = yield* Fx.promise(() =>
-          ctx.runQuery(config.component.public.enterpriseGet, { enterpriseId }),
-        );
         const groupId = (enterprise as any)?.groupId as string | undefined;
         if (groupId) {
           const existingMembership = yield* Fx.promise(() =>
@@ -162,7 +190,7 @@ export function userOAuthImpl(
               ctx.runMutation(config.component.public.memberAdd, {
                 groupId,
                 userId,
-                role: "member",
+                role: enterprisePolicy.provisioning.jit.defaultRole,
                 status: "active",
               }),
             );

package/src/server/mutations/store.ts

@@ -1,7 +1,10 @@
+import { makeFunctionReference } from "convex/server";
+
 /**
  * Internal function reference for the library's store dispatch mutation.
  *
- * This remains string-based because the library code cannot import the
- * consumer app's generated `internal` API module.
+ * The package cannot import the consumer app's generated `api` module,
+ * so it uses a canonical function reference name that matches the app-level
+ * `export const { store } = auth` surface.
  */
-export const AUTH_STORE_REF = "auth/store:run" as any;
+export const AUTH_STORE_REF = makeFunctionReference("auth:store") as any;

package/src/server/oauth.ts

@@ -33,6 +33,7 @@ type OAuthProviderConfigLike = {
 // ============================================================================
 
 /** A cookie to be set on the HTTP response. */
+/** @internal */
 export interface OAuthCookie {
   name: string;
   value: string;
@@ -40,6 +41,7 @@ export interface OAuthCookie {
 }
 
 /** Result of creating an authorization URL. */
+/** @internal */
 export interface AuthorizationResult {
   redirect: string;
   cookies: OAuthCookie[];
@@ -47,6 +49,7 @@ export interface AuthorizationResult {
 }
 
 /** Result of handling an OAuth callback. */
+/** @internal */
 export interface CallbackResult {
   profile: OAuthProfile;
   providerAccountId: string;
@@ -98,6 +101,7 @@ function clearCookie(
  * Creates a signature string from the OAuth state parameters.
  * This is stored in the verifier table and validated during callback.
  */
+/** @internal */
 export function getAuthorizationSignature({
   codeVerifier,
   state,
@@ -251,6 +255,7 @@ function validateProfileId(
  *
  * Handles PKCE detection, state generation, and cookie creation.
  */
+/** @internal */
 export async function createOAuthAuthorizationURL(
   providerId: string,
   arcticProvider: any,
@@ -305,6 +310,7 @@ export async function createOAuthAuthorizationURL(
  *
  * Returns `Fx<CallbackResult, AuthError>` composed via `Fx.gen`.
  */
+/** @internal */
 export function handleOAuthCallback(
   providerId: string,
   arcticProvider: any,

package/src/server/passkey.ts

@@ -46,6 +46,7 @@ import type { Fx as FxType } from "@robelest/fx";
 
 import { authDb } from "./db";
 import { AuthError, Fx } from "./fx";
+import { userIdFromIdentitySubject } from "./identity";
 import { callSignIn, callVerifier } from "./mutations/index";
 import { callVerifierSignature } from "./mutations/signature";
 import { PasskeyProviderConfig, GenericActionCtxWithAuthConfig } from "./types";
@@ -300,7 +301,7 @@ export function handlePasskeyFx(
                 Fx.chain((id) =>
                   id === null
                     ? Fx.fail(new AuthError("PASSKEY_AUTH_REQUIRED"))
-                    : Fx.succeed(id.subject.split("|")[0]!),
+                    : Fx.succeed(userIdFromIdentitySubject(id.subject)),
                 ),
               ),
               resolveRpOptionsFx(provider),
@@ -382,7 +383,7 @@ export function handlePasskeyFx(
                 Fx.chain((id) =>
                   id === null
                     ? Fx.fail(new AuthError("PASSKEY_AUTH_REQUIRED"))
-                    : Fx.succeed(id.subject.split("|")[0]!),
+                    : Fx.succeed(userIdFromIdentitySubject(id.subject)),
                 ),
               ),
               resolveRpOptionsFx(provider),

package/src/server/provider.ts

@@ -11,6 +11,7 @@ import { errorMessage } from "./utils";
  * Validates that the provider is a credentials provider and has the
  * required crypto function, returning typed errors through the Fx channel.
  */
+/** @internal */
 export const hash = (provider: any, secret: string): Fx<string, AuthError> =>
   Fx.gen(function* () {
     if (provider.type !== "credentials") {
@@ -44,6 +45,7 @@ export const hash = (provider: any, secret: string): Fx<string, AuthError> =>
 /**
  * Verify a secret against a hash using the provider's `crypto.verifySecret` function.
  */
+/** @internal */
 export const verify = (
   provider: AuthProviderMaterializedConfig,
   secret: string,

package/src/server/providers.ts

@@ -33,6 +33,7 @@ function isClassProvider(
  *
  * @internal
  */
+/** @internal */
 export function configDefaults(config_: ConvexAuthConfig) {
   const config = materializeAndDefaultProviders(config_);
   // Collect extra providers from credentials providers
@@ -52,6 +53,7 @@ export function configDefaults(config_: ConvexAuthConfig) {
  *
  * @internal
  */
+/** @internal */
 export function materializeProvider(provider: AuthProviderConfig) {
   const config = { providers: [provider], component: {} as any };
   materializeAndDefaultProviders(config);
@@ -63,6 +65,7 @@ export function materializeProvider(provider: AuthProviderConfig) {
  *
  * @internal
  */
+/** @internal */
 export function listAvailableProviders(
   config: ReturnType<typeof configDefaults>,
   allowExtraProviders: boolean,

package/src/server/ratelimit.ts

@@ -11,6 +11,7 @@ const DEFAULT_MAX_SIGN_IN_ATTEMPTS_PER_HOUR = 10;
 /**
  * Check whether the given identifier is currently rate-limited.
  */
+/** @internal */
 export const isSignInRateLimited = (
   ctx: MutationCtx,
   identifier: string,
@@ -25,6 +26,7 @@ export const isSignInRateLimited = (
  *
  * If a record exists, decrement; otherwise create.
  */
+/** @internal */
 export const recordFailedSignIn = (
   ctx: MutationCtx,
   identifier: string,
@@ -67,6 +69,7 @@ export const recordFailedSignIn = (
 /**
  * Reset the rate limit for the given identifier (e.g. after successful sign-in).
  */
+/** @internal */
 export const resetSignInRateLimit = (
   ctx: MutationCtx,
   identifier: string,

package/src/server/redirects.ts

@@ -2,6 +2,7 @@ import { AuthError } from "./fx";
 import { ConvexAuthMaterializedConfig } from "./types";
 import { requireEnv } from "./utils";
 
+/** @internal */
 export async function redirectAbsoluteUrl(
   config: ConvexAuthMaterializedConfig,
   params: { redirectTo: unknown },
@@ -35,6 +36,7 @@ async function defaultRedirectCallback({ redirectTo }: { redirectTo: string }) {
 
 // Temporary work-around because Convex doesn't support
 // schemes other than http and https.
+/** @internal */
 export function setURLSearchParam(
   absoluteUrl: string,
   param: string,

package/src/server/refresh.ts

@@ -13,6 +13,7 @@ import {
 } from "./utils";
 
 const DEFAULT_SESSION_INACTIVE_DURATION_MS = 1000 * 60 * 60 * 24 * 30; // 30 days
+/** @internal */
 export const REFRESH_TOKEN_REUSE_WINDOW_MS = 10 * 1000; // 10 seconds
 
 // ---------------------------------------------------------------------------
@@ -22,6 +23,7 @@ export const REFRESH_TOKEN_REUSE_WINDOW_MS = 10 * 1000; // 10 seconds
 /**
  * Create a new refresh token for the given session.
  */
+/** @internal */
 export async function createRefreshToken(
   ctx: MutationCtx,
   config: ConvexAuthConfig,
@@ -46,6 +48,7 @@ export async function createRefreshToken(
 /**
  * Parse a compound refresh token string into its constituent IDs.
  */
+/** @internal */
 export const parseRefreshToken = (
   refreshToken: string,
 ): Fx<
@@ -82,6 +85,7 @@ export const parseRefreshToken = (
  * Mark all refresh tokens descending from the given refresh token as invalid
  * immediately. Used when we detect token reuse — revoke the entire tree.
  */
+/** @internal */
 export async function invalidateRefreshTokensInSubtree(
   ctx: MutationCtx,
   refreshToken: Doc<"RefreshToken">,
@@ -135,6 +139,7 @@ export async function invalidateRefreshTokensInSubtree(
  * Each validation step is a small composable function chained with `Fx.chain`.
  * On failure, the error message is logged and the pipeline folds to `null`.
  */
+/** @internal */
 export const refreshTokenIfValid = (
   ctx: MutationCtx,
   refreshTokenId: string,

package/src/server/sessions.ts

@@ -16,6 +16,7 @@ import {
 
 const DEFAULT_SESSION_TOTAL_DURATION_MS = 1000 * 60 * 60 * 24 * 30; // 30 days
 
+/** @internal */
 export async function maybeGenerateTokensForSession(
   ctx: MutationCtx,
   config: ConvexAuthConfig,
@@ -37,6 +38,7 @@ export async function maybeGenerateTokensForSession(
   };
 }
 
+/** @internal */
 export async function createNewAndDeleteExistingSession(
   ctx: MutationCtx,
   config: ConvexAuthConfig,
@@ -53,6 +55,7 @@ export async function createNewAndDeleteExistingSession(
   return await createSession(ctx, userId, config);
 }
 
+/** @internal */
 export async function generateTokensForSession(
   ctx: MutationCtx,
   config: ConvexAuthConfig,
@@ -102,6 +105,7 @@ async function createSession(
   )) as GenericId<"Session">;
 }
 
+/** @internal */
 export async function deleteSession(
   ctx: MutationCtx,
   session: Doc<"Session">,
@@ -117,6 +121,7 @@ export async function deleteSession(
  *
  * Internal helper used by auth runtime internals and `auth.session.current`.
  */
+/** @internal */
 export async function getAuthSessionId(ctx: { auth: Auth }) {
   const identity = await ctx.auth.getUserIdentity();
   if (identity === null) {

package/src/server/signin.ts

@@ -60,6 +60,7 @@ type SignInResult =
       interval: number;
     };
 
+/** @internal */
 export async function signInImpl(
   ctx: EnrichedActionCtx,
   provider: AuthProviderMaterializedConfig | null,