@robelest/convex-auth 0.0.4-preview.13 → 0.0.4-preview.16

package/dist/component/server/users.js.map

@@ -1 +1 @@
-{"version":3,"file":"users.js","names":[],"sources":["../../../src/server/users.ts"],"sourcesContent":["import { Fx } from \"@robelest/fx\";\nimport { GenericId } from \"convex/values\";\n\nimport { authDb } from \"./db\";\nimport { AuthError } from \"./fx\";\nimport { Doc, MutationCtx } from \"./types\";\nimport { AuthProviderMaterializedConfig, ConvexAuthConfig } from \"./types\";\nimport { LOG_LEVELS, logWithLevel } from \"./utils\";\n\ntype CreateOrUpdateUserArgs = {\n  type: \"oauth\" | \"credentials\" | \"email\" | \"phone\" | \"verification\";\n  provider: AuthProviderMaterializedConfig;\n  profile: Record<string, unknown> & {\n    email?: string;\n    phone?: string;\n    emailVerified?: boolean;\n    phoneVerified?: boolean;\n  };\n  accountExtend?: Record<string, unknown>;\n  shouldLinkViaEmail?: boolean;\n  shouldLinkViaPhone?: boolean;\n};\n\nfunction mergeExtend(\n  existing: unknown,\n  incoming: Record<string, unknown> | undefined,\n) {\n  if (!incoming) {\n    return undefined;\n  }\n  const existingRecord =\n    typeof existing === \"object\" &&\n    existing !== null &&\n    !Array.isArray(existing)\n      ? (existing as Record<string, unknown>)\n      : undefined;\n  return existingRecord ? { ...existingRecord, ...incoming } : incoming;\n}\n\nexport async function upsertUserAndAccount(\n  ctx: MutationCtx,\n  sessionId: GenericId<\"Session\"> | null,\n  account:\n    | { existingAccount: Doc<\"Account\"> }\n    | {\n        providerAccountId: string;\n        secret?: string;\n      },\n  args: CreateOrUpdateUserArgs,\n  config: ConvexAuthConfig,\n  opts?: { existingUserId?: GenericId<\"User\"> },\n): Promise<{\n  userId: GenericId<\"User\">;\n  accountId: GenericId<\"Account\">;\n}> {\n  const userId = await defaultCreateOrUpdateUser(\n    ctx,\n    sessionId,\n    \"existingAccount\" in account ? account.existingAccount : null,\n    args,\n    config,\n    opts?.existingUserId ?? null,\n  );\n  const accountId = await createOrUpdateAccount(\n    ctx,\n    userId,\n    account,\n    args,\n    config,\n  );\n  return { userId, accountId };\n}\n\nasync function defaultCreateOrUpdateUser(\n  ctx: MutationCtx,\n  existingSessionId: GenericId<\"Session\"> | null,\n  existingAccount: Doc<\"Account\"> | null,\n  args: CreateOrUpdateUserArgs,\n  config: ConvexAuthConfig,\n  existingUserIdOverride: GenericId<\"User\"> | null,\n) {\n  logWithLevel(LOG_LEVELS.DEBUG, \"defaultCreateOrUpdateUser args:\", {\n    existingAccountId: existingAccount?._id,\n    existingSessionId,\n    args,\n  });\n  const existingUserId = existingAccount?.userId ?? null;\n  const db = authDb(ctx, config);\n  if (config.callbacks?.createOrUpdateUser !== undefined) {\n    logWithLevel(LOG_LEVELS.DEBUG, \"Using custom createOrUpdateUser callback\");\n    return await config.callbacks.createOrUpdateUser(ctx, {\n      existingUserId,\n      ...args,\n    });\n  }\n\n  const {\n    provider,\n    profile: {\n      id: _profileId,\n      emailVerified: profileEmailVerified,\n      phoneVerified: profilePhoneVerified,\n      ...profile\n    },\n  } = args;\n  const emailVerified =\n    profileEmailVerified ??\n    (provider.type === \"oauth\" && provider.accountLinking !== \"none\");\n  const phoneVerified = profilePhoneVerified ?? false;\n  const shouldLinkViaEmail =\n    args.shouldLinkViaEmail || emailVerified || provider.type === \"email\";\n  const shouldLinkViaPhone =\n    args.shouldLinkViaPhone || phoneVerified || provider.type === \"phone\";\n\n  let userId = existingUserId ?? existingUserIdOverride;\n  if (existingUserId === null) {\n    const existingUserWithVerifiedEmailId =\n      typeof profile.email === \"string\" && shouldLinkViaEmail\n        ? ((await uniqueUserWithVerifiedEmail(ctx, profile.email, config))\n            ?._id ?? null)\n        : null;\n\n    const existingUserWithVerifiedPhoneId =\n      typeof profile.phone === \"string\" && shouldLinkViaPhone\n        ? ((await uniqueUserWithVerifiedPhone(ctx, profile.phone, config))\n            ?._id ?? null)\n        : null;\n    const linkDispatch = {\n      tag:\n        existingUserWithVerifiedEmailId !== null &&\n        existingUserWithVerifiedPhoneId !== null\n          ? \"both\"\n          : existingUserWithVerifiedEmailId !== null\n            ? \"email\"\n            : existingUserWithVerifiedPhoneId !== null\n              ? \"phone\"\n              : \"none\",\n      existingUserWithVerifiedEmailId,\n      existingUserWithVerifiedPhoneId,\n    } as const;\n\n    const linkHandlers = {\n      both: () =>\n        Fx.sync(() => {\n          logWithLevel(\n            LOG_LEVELS.DEBUG,\n            `Found existing email and phone verified users, so not linking: email: ${linkDispatch.existingUserWithVerifiedEmailId}, phone: ${linkDispatch.existingUserWithVerifiedPhoneId}`,\n          );\n          return null;\n        }),\n      email: () =>\n        Fx.sync(() => {\n          logWithLevel(\n            LOG_LEVELS.DEBUG,\n            `Found existing email verified user, linking: ${linkDispatch.existingUserWithVerifiedEmailId}`,\n          );\n          return linkDispatch.existingUserWithVerifiedEmailId;\n        }),\n      phone: () =>\n        Fx.sync(() => {\n          logWithLevel(\n            LOG_LEVELS.DEBUG,\n            `Found existing phone verified user, linking: ${linkDispatch.existingUserWithVerifiedPhoneId}`,\n          );\n          return linkDispatch.existingUserWithVerifiedPhoneId;\n        }),\n      none: () =>\n        Fx.sync(() => {\n          logWithLevel(\n            LOG_LEVELS.DEBUG,\n            \"No existing verified users found, creating new user\",\n          );\n          return null;\n        }),\n    } as const;\n\n    userId = await Fx.run(linkHandlers[linkDispatch.tag]());\n  }\n  const userData = {\n    ...(emailVerified ? { emailVerificationTime: Date.now() } : null),\n    ...(phoneVerified ? { phoneVerificationTime: Date.now() } : null),\n    ...profile,\n  };\n  const existingOrLinkedUserId = userId;\n  if (userId !== null) {\n    await Fx.run(\n      Fx.from({\n        ok: () => db.users.patch(userId!, userData),\n        err: (error) =>\n          new AuthError(\n            \"USER_UPDATE_FAILED\",\n            `Could not update user document with ID \\`${userId}\\`, ` +\n              `either the user has been deleted but their account has not, ` +\n              `or the profile data doesn't match the \\`users\\` table schema: ` +\n              `${(error as Error).message}`,\n          ),\n      }).pipe(Fx.recover((e) => Fx.fatal(e.toConvexError()))),\n    );\n  } else {\n    userId = (await db.users.insert(userData)) as GenericId<\"User\">;\n  }\n  const afterUserCreatedOrUpdated = config.callbacks?.afterUserCreatedOrUpdated;\n  if (afterUserCreatedOrUpdated !== undefined) {\n    logWithLevel(\n      LOG_LEVELS.DEBUG,\n      \"Calling custom afterUserCreatedOrUpdated callback\",\n    );\n    await afterUserCreatedOrUpdated(ctx, {\n      userId,\n      existingUserId: existingOrLinkedUserId,\n      ...args,\n    });\n  } else {\n    logWithLevel(\n      LOG_LEVELS.DEBUG,\n      \"No custom afterUserCreatedOrUpdated callback, skipping\",\n    );\n  }\n  return userId;\n}\n\nasync function uniqueUserWithVerifiedEmail(\n  ctx: MutationCtx,\n  email: string,\n  config: ConvexAuthConfig,\n) {\n  const db = authDb(ctx, config);\n  return (await db.users.findByVerifiedEmail(email)) as Doc<\"User\"> | null;\n}\n\nasync function uniqueUserWithVerifiedPhone(\n  ctx: MutationCtx,\n  phone: string,\n  config: ConvexAuthConfig,\n) {\n  const db = authDb(ctx, config);\n  return (await db.users.findByVerifiedPhone(phone)) as Doc<\"User\"> | null;\n}\n\nasync function createOrUpdateAccount(\n  ctx: MutationCtx,\n  userId: GenericId<\"User\">,\n  account:\n    | { existingAccount: Doc<\"Account\"> }\n    | {\n        providerAccountId: string;\n        secret?: string;\n      },\n  args: CreateOrUpdateUserArgs,\n  config: ConvexAuthConfig,\n) {\n  const db = authDb(ctx, config);\n  const mergedExtend =\n    \"existingAccount\" in account\n      ? mergeExtend(account.existingAccount.extend, args.accountExtend)\n      : args.accountExtend;\n  const accountId =\n    \"existingAccount\" in account\n      ? account.existingAccount._id\n      : ((await db.accounts.create({\n          userId,\n          provider: args.provider.id,\n          providerAccountId: account.providerAccountId,\n          secret: account.secret,\n          extend: mergedExtend,\n        })) as GenericId<\"Account\">);\n  // This is never used with the default `createOrUpdateUser` implementation,\n  // but it is used for manual linking via custom `createOrUpdateUser`:\n  if (\n    \"existingAccount\" in account &&\n    account.existingAccount.userId !== userId\n  ) {\n    await db.accounts.patch(accountId, { userId });\n  }\n  const accountPatchData: Record<string, unknown> = {};\n  if (mergedExtend) {\n    accountPatchData.extend = mergedExtend;\n  }\n  if (args.profile.emailVerified) {\n    accountPatchData.emailVerified = args.profile.email;\n  }\n  if (args.profile.phoneVerified) {\n    accountPatchData.phoneVerified = args.profile.phone;\n  }\n  if (Object.keys(accountPatchData).length > 0) {\n    await db.accounts.patch(accountId, accountPatchData);\n  }\n  return accountId;\n}\n"],"mappings":";;;;;;AAuBA,SAAS,YACP,UACA,UACA;AACA,KAAI,CAAC,SACH;CAEF,MAAM,iBACJ,OAAO,aAAa,YACpB,aAAa,QACb,CAAC,MAAM,QAAQ,SAAS,GACnB,WACD;AACN,QAAO,iBAAiB;EAAE,GAAG;EAAgB,GAAG;EAAU,GAAG;;AAG/D,eAAsB,qBACpB,KACA,WACA,SAMA,MACA,QACA,MAIC;CACD,MAAM,SAAS,MAAM,0BACnB,KACA,WACA,qBAAqB,UAAU,QAAQ,kBAAkB,MACzD,MACA,QACA,MAAM,kBAAkB,KACzB;AAQD,QAAO;EAAE;EAAQ,WAPC,MAAM,sBACtB,KACA,QACA,SACA,MACA,OACD;EAC2B;;AAG9B,eAAe,0BACb,KACA,mBACA,iBACA,MACA,QACA,wBACA;AACA,cAAa,WAAW,OAAO,mCAAmC;EAChE,mBAAmB,iBAAiB;EACpC;EACA;EACD,CAAC;CACF,MAAM,iBAAiB,iBAAiB,UAAU;CAClD,MAAM,KAAK,OAAO,KAAK,OAAO;AAC9B,KAAI,OAAO,WAAW,uBAAuB,QAAW;AACtD,eAAa,WAAW,OAAO,2CAA2C;AAC1E,SAAO,MAAM,OAAO,UAAU,mBAAmB,KAAK;GACpD;GACA,GAAG;GACJ,CAAC;;CAGJ,MAAM,EACJ,UACA,SAAS,EACP,IAAI,YACJ,eAAe,sBACf,eAAe,sBACf,GAAG,cAEH;CACJ,MAAM,gBACJ,yBACC,SAAS,SAAS,WAAW,SAAS,mBAAmB;CAC5D,MAAM,gBAAgB,wBAAwB;CAC9C,MAAM,qBACJ,KAAK,sBAAsB,iBAAiB,SAAS,SAAS;CAChE,MAAM,qBACJ,KAAK,sBAAsB,iBAAiB,SAAS,SAAS;CAEhE,IAAI,SAAS,kBAAkB;AAC/B,KAAI,mBAAmB,MAAM;EAC3B,MAAM,kCACJ,OAAO,QAAQ,UAAU,YAAY,sBAC/B,MAAM,4BAA4B,KAAK,QAAQ,OAAO,OAAO,GAC3D,OAAO,OACX;EAEN,MAAM,kCACJ,OAAO,QAAQ,UAAU,YAAY,sBAC/B,MAAM,4BAA4B,KAAK,QAAQ,OAAO,OAAO,GAC3D,OAAO,OACX;EACN,MAAM,eAAe;GACnB,KACE,oCAAoC,QACpC,oCAAoC,OAChC,SACA,oCAAoC,OAClC,UACA,oCAAoC,OAClC,UACA;GACV;GACA;GACD;AAqCD,WAAS,MAAM,GAAG,IAnCG;GACnB,YACE,GAAG,WAAW;AACZ,iBACE,WAAW,OACX,yEAAyE,aAAa,gCAAgC,WAAW,aAAa,kCAC/I;AACD,WAAO;KACP;GACJ,aACE,GAAG,WAAW;AACZ,iBACE,WAAW,OACX,gDAAgD,aAAa,kCAC9D;AACD,WAAO,aAAa;KACpB;GACJ,aACE,GAAG,WAAW;AACZ,iBACE,WAAW,OACX,gDAAgD,aAAa,kCAC9D;AACD,WAAO,aAAa;KACpB;GACJ,YACE,GAAG,WAAW;AACZ,iBACE,WAAW,OACX,sDACD;AACD,WAAO;KACP;GACL,CAEkC,aAAa,MAAM,CAAC;;CAEzD,MAAM,WAAW;EACf,GAAI,gBAAgB,EAAE,uBAAuB,KAAK,KAAK,EAAE,GAAG;EAC5D,GAAI,gBAAgB,EAAE,uBAAuB,KAAK,KAAK,EAAE,GAAG;EAC5D,GAAG;EACJ;CACD,MAAM,yBAAyB;AAC/B,KAAI,WAAW,KACb,OAAM,GAAG,IACP,GAAG,KAAK;EACN,UAAU,GAAG,MAAM,MAAM,QAAS,SAAS;EAC3C,MAAM,UACJ,IAAI,UACF,sBACA,4CAA4C,OAAO,gIAG7C,MAAgB,UACvB;EACJ,CAAC,CAAC,KAAK,GAAG,SAAS,MAAM,GAAG,MAAM,EAAE,eAAe,CAAC,CAAC,CAAC,CACxD;KAED,UAAU,MAAM,GAAG,MAAM,OAAO,SAAS;CAE3C,MAAM,4BAA4B,OAAO,WAAW;AACpD,KAAI,8BAA8B,QAAW;AAC3C,eACE,WAAW,OACX,oDACD;AACD,QAAM,0BAA0B,KAAK;GACnC;GACA,gBAAgB;GAChB,GAAG;GACJ,CAAC;OAEF,cACE,WAAW,OACX,yDACD;AAEH,QAAO;;AAGT,eAAe,4BACb,KACA,OACA,QACA;AAEA,QAAQ,MADG,OAAO,KAAK,OAAO,CACb,MAAM,oBAAoB,MAAM;;AAGnD,eAAe,4BACb,KACA,OACA,QACA;AAEA,QAAQ,MADG,OAAO,KAAK,OAAO,CACb,MAAM,oBAAoB,MAAM;;AAGnD,eAAe,sBACb,KACA,QACA,SAMA,MACA,QACA;CACA,MAAM,KAAK,OAAO,KAAK,OAAO;CAC9B,MAAM,eACJ,qBAAqB,UACjB,YAAY,QAAQ,gBAAgB,QAAQ,KAAK,cAAc,GAC/D,KAAK;CACX,MAAM,YACJ,qBAAqB,UACjB,QAAQ,gBAAgB,MACtB,MAAM,GAAG,SAAS,OAAO;EACzB;EACA,UAAU,KAAK,SAAS;EACxB,mBAAmB,QAAQ;EAC3B,QAAQ,QAAQ;EAChB,QAAQ;EACT,CAAC;AAGR,KACE,qBAAqB,WACrB,QAAQ,gBAAgB,WAAW,OAEnC,OAAM,GAAG,SAAS,MAAM,WAAW,EAAE,QAAQ,CAAC;CAEhD,MAAM,mBAA4C,EAAE;AACpD,KAAI,aACF,kBAAiB,SAAS;AAE5B,KAAI,KAAK,QAAQ,cACf,kBAAiB,gBAAgB,KAAK,QAAQ;AAEhD,KAAI,KAAK,QAAQ,cACf,kBAAiB,gBAAgB,KAAK,QAAQ;AAEhD,KAAI,OAAO,KAAK,iBAAiB,CAAC,SAAS,EACzC,OAAM,GAAG,SAAS,MAAM,WAAW,iBAAiB;AAEtD,QAAO"}
+{"version":3,"file":"users.js","names":[],"sources":["../../../src/server/users.ts"],"sourcesContent":["import { Fx } from \"@robelest/fx\";\nimport { GenericId } from \"convex/values\";\n\nimport { authDb } from \"./db\";\nimport { AuthError } from \"./fx\";\nimport { Doc, MutationCtx } from \"./types\";\nimport { AuthProviderMaterializedConfig, ConvexAuthConfig } from \"./types\";\nimport { LOG_LEVELS, logWithLevel } from \"./utils\";\n\ntype CreateOrUpdateUserArgs = {\n  type: \"oauth\" | \"credentials\" | \"email\" | \"phone\" | \"verification\";\n  provider: AuthProviderMaterializedConfig;\n  profile: Record<string, unknown> & {\n    email?: string;\n    phone?: string;\n    emailVerified?: boolean;\n    phoneVerified?: boolean;\n  };\n  accountExtend?: Record<string, unknown>;\n  shouldLinkViaEmail?: boolean;\n  shouldLinkViaPhone?: boolean;\n};\n\nfunction mergeExtend(\n  existing: unknown,\n  incoming: Record<string, unknown> | undefined,\n) {\n  if (!incoming) {\n    return undefined;\n  }\n  const existingRecord =\n    typeof existing === \"object\" &&\n    existing !== null &&\n    !Array.isArray(existing)\n      ? (existing as Record<string, unknown>)\n      : undefined;\n  return existingRecord ? { ...existingRecord, ...incoming } : incoming;\n}\n\n/** @internal */\nexport async function upsertUserAndAccount(\n  ctx: MutationCtx,\n  sessionId: GenericId<\"Session\"> | null,\n  account:\n    | { existingAccount: Doc<\"Account\"> }\n    | {\n        providerAccountId: string;\n        secret?: string;\n      },\n  args: CreateOrUpdateUserArgs,\n  config: ConvexAuthConfig,\n  opts?: { existingUserId?: GenericId<\"User\"> },\n): Promise<{\n  userId: GenericId<\"User\">;\n  accountId: GenericId<\"Account\">;\n}> {\n  const userId = await defaultCreateOrUpdateUser(\n    ctx,\n    sessionId,\n    \"existingAccount\" in account ? account.existingAccount : null,\n    args,\n    config,\n    opts?.existingUserId ?? null,\n  );\n  const accountId = await createOrUpdateAccount(\n    ctx,\n    userId,\n    account,\n    args,\n    config,\n  );\n  return { userId, accountId };\n}\n\nasync function defaultCreateOrUpdateUser(\n  ctx: MutationCtx,\n  existingSessionId: GenericId<\"Session\"> | null,\n  existingAccount: Doc<\"Account\"> | null,\n  args: CreateOrUpdateUserArgs,\n  config: ConvexAuthConfig,\n  existingUserIdOverride: GenericId<\"User\"> | null,\n) {\n  logWithLevel(LOG_LEVELS.DEBUG, \"defaultCreateOrUpdateUser args:\", {\n    existingAccountId: existingAccount?._id,\n    existingSessionId,\n    args,\n  });\n  const existingUserId = existingAccount?.userId ?? null;\n  const db = authDb(ctx, config);\n  if (config.callbacks?.createOrUpdateUser !== undefined) {\n    logWithLevel(LOG_LEVELS.DEBUG, \"Using custom createOrUpdateUser callback\");\n    return await config.callbacks.createOrUpdateUser(ctx, {\n      existingUserId,\n      ...args,\n    });\n  }\n\n  const {\n    provider,\n    profile: {\n      id: _profileId,\n      emailVerified: profileEmailVerified,\n      phoneVerified: profilePhoneVerified,\n      ...profile\n    },\n  } = args;\n  const emailVerified =\n    profileEmailVerified ??\n    (provider.type === \"oauth\" && provider.accountLinking !== \"none\");\n  const phoneVerified = profilePhoneVerified ?? false;\n  const shouldLinkViaEmail =\n    args.shouldLinkViaEmail || emailVerified || provider.type === \"email\";\n  const shouldLinkViaPhone =\n    args.shouldLinkViaPhone || phoneVerified || provider.type === \"phone\";\n\n  let userId = existingUserId ?? existingUserIdOverride;\n  if (existingUserId === null) {\n    const existingUserWithVerifiedEmailId =\n      typeof profile.email === \"string\" && shouldLinkViaEmail\n        ? ((await uniqueUserWithVerifiedEmail(ctx, profile.email, config))\n            ?._id ?? null)\n        : null;\n\n    const existingUserWithVerifiedPhoneId =\n      typeof profile.phone === \"string\" && shouldLinkViaPhone\n        ? ((await uniqueUserWithVerifiedPhone(ctx, profile.phone, config))\n            ?._id ?? null)\n        : null;\n    const linkDispatch = {\n      tag:\n        existingUserWithVerifiedEmailId !== null &&\n        existingUserWithVerifiedPhoneId !== null\n          ? \"both\"\n          : existingUserWithVerifiedEmailId !== null\n            ? \"email\"\n            : existingUserWithVerifiedPhoneId !== null\n              ? \"phone\"\n              : \"none\",\n      existingUserWithVerifiedEmailId,\n      existingUserWithVerifiedPhoneId,\n    } as const;\n\n    const linkHandlers = {\n      both: () =>\n        Fx.sync(() => {\n          logWithLevel(\n            LOG_LEVELS.DEBUG,\n            `Found existing email and phone verified users, so not linking: email: ${linkDispatch.existingUserWithVerifiedEmailId}, phone: ${linkDispatch.existingUserWithVerifiedPhoneId}`,\n          );\n          return null;\n        }),\n      email: () =>\n        Fx.sync(() => {\n          logWithLevel(\n            LOG_LEVELS.DEBUG,\n            `Found existing email verified user, linking: ${linkDispatch.existingUserWithVerifiedEmailId}`,\n          );\n          return linkDispatch.existingUserWithVerifiedEmailId;\n        }),\n      phone: () =>\n        Fx.sync(() => {\n          logWithLevel(\n            LOG_LEVELS.DEBUG,\n            `Found existing phone verified user, linking: ${linkDispatch.existingUserWithVerifiedPhoneId}`,\n          );\n          return linkDispatch.existingUserWithVerifiedPhoneId;\n        }),\n      none: () =>\n        Fx.sync(() => {\n          logWithLevel(\n            LOG_LEVELS.DEBUG,\n            \"No existing verified users found, creating new user\",\n          );\n          return null;\n        }),\n    } as const;\n\n    userId = await Fx.run(linkHandlers[linkDispatch.tag]());\n  }\n  const userData = {\n    ...(emailVerified ? { emailVerificationTime: Date.now() } : null),\n    ...(phoneVerified ? { phoneVerificationTime: Date.now() } : null),\n    ...profile,\n  };\n  const existingOrLinkedUserId = userId;\n  if (userId !== null) {\n    await Fx.run(\n      Fx.from({\n        ok: () => db.users.patch(userId!, userData),\n        err: (error) =>\n          new AuthError(\n            \"USER_UPDATE_FAILED\",\n            `Could not update user document with ID \\`${userId}\\`, ` +\n              `either the user has been deleted but their account has not, ` +\n              `or the profile data doesn't match the \\`users\\` table schema: ` +\n              `${(error as Error).message}`,\n          ),\n      }).pipe(Fx.recover((e) => Fx.fatal(e.toConvexError()))),\n    );\n  } else {\n    userId = (await db.users.insert(userData)) as GenericId<\"User\">;\n  }\n  const afterUserCreatedOrUpdated = config.callbacks?.afterUserCreatedOrUpdated;\n  if (afterUserCreatedOrUpdated !== undefined) {\n    logWithLevel(\n      LOG_LEVELS.DEBUG,\n      \"Calling custom afterUserCreatedOrUpdated callback\",\n    );\n    await afterUserCreatedOrUpdated(ctx, {\n      userId,\n      existingUserId: existingOrLinkedUserId,\n      ...args,\n    });\n  } else {\n    logWithLevel(\n      LOG_LEVELS.DEBUG,\n      \"No custom afterUserCreatedOrUpdated callback, skipping\",\n    );\n  }\n  return userId;\n}\n\nasync function uniqueUserWithVerifiedEmail(\n  ctx: MutationCtx,\n  email: string,\n  config: ConvexAuthConfig,\n) {\n  const db = authDb(ctx, config);\n  return (await db.users.findByVerifiedEmail(email)) as Doc<\"User\"> | null;\n}\n\nasync function uniqueUserWithVerifiedPhone(\n  ctx: MutationCtx,\n  phone: string,\n  config: ConvexAuthConfig,\n) {\n  const db = authDb(ctx, config);\n  return (await db.users.findByVerifiedPhone(phone)) as Doc<\"User\"> | null;\n}\n\nasync function createOrUpdateAccount(\n  ctx: MutationCtx,\n  userId: GenericId<\"User\">,\n  account:\n    | { existingAccount: Doc<\"Account\"> }\n    | {\n        providerAccountId: string;\n        secret?: string;\n      },\n  args: CreateOrUpdateUserArgs,\n  config: ConvexAuthConfig,\n) {\n  const db = authDb(ctx, config);\n  const mergedExtend =\n    \"existingAccount\" in account\n      ? mergeExtend(account.existingAccount.extend, args.accountExtend)\n      : args.accountExtend;\n  const accountId =\n    \"existingAccount\" in account\n      ? account.existingAccount._id\n      : ((await db.accounts.create({\n          userId,\n          provider: args.provider.id,\n          providerAccountId: account.providerAccountId,\n          secret: account.secret,\n          extend: mergedExtend,\n        })) as GenericId<\"Account\">);\n  // This is never used with the default `createOrUpdateUser` implementation,\n  // but it is used for manual linking via custom `createOrUpdateUser`:\n  if (\n    \"existingAccount\" in account &&\n    account.existingAccount.userId !== userId\n  ) {\n    await db.accounts.patch(accountId, { userId });\n  }\n  const accountPatchData: Record<string, unknown> = {};\n  if (mergedExtend) {\n    accountPatchData.extend = mergedExtend;\n  }\n  if (args.profile.emailVerified) {\n    accountPatchData.emailVerified = args.profile.email;\n  }\n  if (args.profile.phoneVerified) {\n    accountPatchData.phoneVerified = args.profile.phone;\n  }\n  if (Object.keys(accountPatchData).length > 0) {\n    await db.accounts.patch(accountId, accountPatchData);\n  }\n  return accountId;\n}\n"],"mappings":";;;;;;AAuBA,SAAS,YACP,UACA,UACA;AACA,KAAI,CAAC,SACH;CAEF,MAAM,iBACJ,OAAO,aAAa,YACpB,aAAa,QACb,CAAC,MAAM,QAAQ,SAAS,GACnB,WACD;AACN,QAAO,iBAAiB;EAAE,GAAG;EAAgB,GAAG;EAAU,GAAG;;;AAI/D,eAAsB,qBACpB,KACA,WACA,SAMA,MACA,QACA,MAIC;CACD,MAAM,SAAS,MAAM,0BACnB,KACA,WACA,qBAAqB,UAAU,QAAQ,kBAAkB,MACzD,MACA,QACA,MAAM,kBAAkB,KACzB;AAQD,QAAO;EAAE;EAAQ,WAPC,MAAM,sBACtB,KACA,QACA,SACA,MACA,OACD;EAC2B;;AAG9B,eAAe,0BACb,KACA,mBACA,iBACA,MACA,QACA,wBACA;AACA,cAAa,WAAW,OAAO,mCAAmC;EAChE,mBAAmB,iBAAiB;EACpC;EACA;EACD,CAAC;CACF,MAAM,iBAAiB,iBAAiB,UAAU;CAClD,MAAM,KAAK,OAAO,KAAK,OAAO;AAC9B,KAAI,OAAO,WAAW,uBAAuB,QAAW;AACtD,eAAa,WAAW,OAAO,2CAA2C;AAC1E,SAAO,MAAM,OAAO,UAAU,mBAAmB,KAAK;GACpD;GACA,GAAG;GACJ,CAAC;;CAGJ,MAAM,EACJ,UACA,SAAS,EACP,IAAI,YACJ,eAAe,sBACf,eAAe,sBACf,GAAG,cAEH;CACJ,MAAM,gBACJ,yBACC,SAAS,SAAS,WAAW,SAAS,mBAAmB;CAC5D,MAAM,gBAAgB,wBAAwB;CAC9C,MAAM,qBACJ,KAAK,sBAAsB,iBAAiB,SAAS,SAAS;CAChE,MAAM,qBACJ,KAAK,sBAAsB,iBAAiB,SAAS,SAAS;CAEhE,IAAI,SAAS,kBAAkB;AAC/B,KAAI,mBAAmB,MAAM;EAC3B,MAAM,kCACJ,OAAO,QAAQ,UAAU,YAAY,sBAC/B,MAAM,4BAA4B,KAAK,QAAQ,OAAO,OAAO,GAC3D,OAAO,OACX;EAEN,MAAM,kCACJ,OAAO,QAAQ,UAAU,YAAY,sBAC/B,MAAM,4BAA4B,KAAK,QAAQ,OAAO,OAAO,GAC3D,OAAO,OACX;EACN,MAAM,eAAe;GACnB,KACE,oCAAoC,QACpC,oCAAoC,OAChC,SACA,oCAAoC,OAClC,UACA,oCAAoC,OAClC,UACA;GACV;GACA;GACD;AAqCD,WAAS,MAAM,GAAG,IAnCG;GACnB,YACE,GAAG,WAAW;AACZ,iBACE,WAAW,OACX,yEAAyE,aAAa,gCAAgC,WAAW,aAAa,kCAC/I;AACD,WAAO;KACP;GACJ,aACE,GAAG,WAAW;AACZ,iBACE,WAAW,OACX,gDAAgD,aAAa,kCAC9D;AACD,WAAO,aAAa;KACpB;GACJ,aACE,GAAG,WAAW;AACZ,iBACE,WAAW,OACX,gDAAgD,aAAa,kCAC9D;AACD,WAAO,aAAa;KACpB;GACJ,YACE,GAAG,WAAW;AACZ,iBACE,WAAW,OACX,sDACD;AACD,WAAO;KACP;GACL,CAEkC,aAAa,MAAM,CAAC;;CAEzD,MAAM,WAAW;EACf,GAAI,gBAAgB,EAAE,uBAAuB,KAAK,KAAK,EAAE,GAAG;EAC5D,GAAI,gBAAgB,EAAE,uBAAuB,KAAK,KAAK,EAAE,GAAG;EAC5D,GAAG;EACJ;CACD,MAAM,yBAAyB;AAC/B,KAAI,WAAW,KACb,OAAM,GAAG,IACP,GAAG,KAAK;EACN,UAAU,GAAG,MAAM,MAAM,QAAS,SAAS;EAC3C,MAAM,UACJ,IAAI,UACF,sBACA,4CAA4C,OAAO,gIAG7C,MAAgB,UACvB;EACJ,CAAC,CAAC,KAAK,GAAG,SAAS,MAAM,GAAG,MAAM,EAAE,eAAe,CAAC,CAAC,CAAC,CACxD;KAED,UAAU,MAAM,GAAG,MAAM,OAAO,SAAS;CAE3C,MAAM,4BAA4B,OAAO,WAAW;AACpD,KAAI,8BAA8B,QAAW;AAC3C,eACE,WAAW,OACX,oDACD;AACD,QAAM,0BAA0B,KAAK;GACnC;GACA,gBAAgB;GAChB,GAAG;GACJ,CAAC;OAEF,cACE,WAAW,OACX,yDACD;AAEH,QAAO;;AAGT,eAAe,4BACb,KACA,OACA,QACA;AAEA,QAAQ,MADG,OAAO,KAAK,OAAO,CACb,MAAM,oBAAoB,MAAM;;AAGnD,eAAe,4BACb,KACA,OACA,QACA;AAEA,QAAQ,MADG,OAAO,KAAK,OAAO,CACb,MAAM,oBAAoB,MAAM;;AAGnD,eAAe,sBACb,KACA,QACA,SAMA,MACA,QACA;CACA,MAAM,KAAK,OAAO,KAAK,OAAO;CAC9B,MAAM,eACJ,qBAAqB,UACjB,YAAY,QAAQ,gBAAgB,QAAQ,KAAK,cAAc,GAC/D,KAAK;CACX,MAAM,YACJ,qBAAqB,UACjB,QAAQ,gBAAgB,MACtB,MAAM,GAAG,SAAS,OAAO;EACzB;EACA,UAAU,KAAK,SAAS;EACxB,mBAAmB,QAAQ;EAC3B,QAAQ,QAAQ;EAChB,QAAQ;EACT,CAAC;AAGR,KACE,qBAAqB,WACrB,QAAQ,gBAAgB,WAAW,OAEnC,OAAM,GAAG,SAAS,MAAM,WAAW,EAAE,QAAQ,CAAC;CAEhD,MAAM,mBAA4C,EAAE;AACpD,KAAI,aACF,kBAAiB,SAAS;AAE5B,KAAI,KAAK,QAAQ,cACf,kBAAiB,gBAAgB,KAAK,QAAQ;AAEhD,KAAI,KAAK,QAAQ,cACf,kBAAiB,gBAAgB,KAAK,QAAQ;AAEhD,KAAI,OAAO,KAAK,iBAAiB,CAAC,SAAS,EACzC,OAAM,GAAG,SAAS,MAAM,WAAW,iBAAiB;AAEtD,QAAO"}

package/dist/component/server/utils.js

@@ -1,7 +1,7 @@
 import { AuthError } from "./fx.js";
 import { generateRandomString } from "@oslojs/crypto/random";
 import { sha256 } from "@oslojs/crypto/sha2";
-import { encodeHexLowerCase } from "@oslojs/encoding";
+import { decodeBase64urlIgnorePadding, encodeBase64urlNoPadding, encodeHexLowerCase } from "@oslojs/encoding";
 
 //#region src/server/utils.ts
 /**
@@ -10,11 +10,13 @@ import { encodeHexLowerCase } from "@oslojs/encoding";
 * Uses `AuthError.toConvexError()` directly since this is a synchronous guard
 * called inline in many expressions — not suitable for Fx pipeline wrapping.
 */
+/** @internal */
 function requireEnv(name) {
 	const value = process.env[name];
 	if (value === void 0) throw new AuthError("MISSING_ENV_VAR", `Missing environment variable \`${name}\``, { variable: name }).toConvexError();
 	return value;
 }
+/** @internal */
 function isLocalHost(host) {
 	if (host === void 0) return false;
 	const raw = host.includes("://") ? host : `http://${host}`;
@@ -26,28 +28,36 @@ function isLocalHost(host) {
 	}
 	return url.hostname === "localhost" || url.hostname === "127.0.0.1" || url.hostname === "::1";
 }
+/** @internal */
 const TOKEN_SUB_CLAIM_DIVIDER = "|";
+/** @internal */
 const REFRESH_TOKEN_DIVIDER = "|";
+/** @internal */
 async function sha256$1(input) {
 	return encodeHexLowerCase(sha256(new TextEncoder().encode(input)));
 }
+/** @internal */
 function generateRandomString$1(length, alphabet) {
 	return generateRandomString({ read(bytes) {
 		crypto.getRandomValues(bytes);
 	} }, alphabet, length);
 }
+/** @internal */
 function errorMessage(error) {
 	return error instanceof Error ? error.message : String(error);
 }
+/** @internal */
 function logError(error) {
 	logWithLevel(LOG_LEVELS.ERROR, error instanceof Error ? error.message + "\n" + error.stack?.replace("\\n", "\n") : error);
 }
+/** @internal */
 const LOG_LEVELS = {
 	ERROR: "ERROR",
 	WARN: "WARN",
 	INFO: "INFO",
 	DEBUG: "DEBUG"
 };
+/** @internal */
 function logWithLevel(level, ...args) {
 	const configuredLogLevel = LOG_LEVELS[process.env.AUTH_LOG_LEVEL ?? "INFO"] ?? "INFO";
 	switch (level) {
@@ -66,6 +76,7 @@ function logWithLevel(level, ...args) {
 	}
 }
 const UNREDACTED_LENGTH = 5;
+/** @internal */
 function maybeRedact(value) {
 	if (value === "") return "";
 	if (process.env.AUTH_LOG_SECRETS !== "true") {
@@ -73,7 +84,38 @@ function maybeRedact(value) {
 		return value.substring(0, UNREDACTED_LENGTH) + "<redacted>" + value.substring(value.length - UNREDACTED_LENGTH);
 	} else return value;
 }
+const SECRET_KEY_ENV = "AUTH_SECRET_ENCRYPTION_KEY";
+const SECRET_IV_LENGTH = 12;
+function toArrayBuffer(bytes) {
+	return bytes.buffer.slice(bytes.byteOffset, bytes.byteOffset + bytes.byteLength);
+}
+async function getSecretCryptoKey() {
+	const material = requireEnv(SECRET_KEY_ENV);
+	const rawKey = sha256(new TextEncoder().encode(material));
+	return await crypto.subtle.importKey("raw", toArrayBuffer(rawKey), { name: "AES-GCM" }, false, ["encrypt", "decrypt"]);
+}
+/** @internal */
+async function encryptSecret(value) {
+	const key = await getSecretCryptoKey();
+	const iv = crypto.getRandomValues(new Uint8Array(SECRET_IV_LENGTH));
+	const encrypted = await crypto.subtle.encrypt({
+		name: "AES-GCM",
+		iv: toArrayBuffer(iv)
+	}, key, toArrayBuffer(new TextEncoder().encode(value)));
+	return `${encodeBase64urlNoPadding(iv)}.${encodeBase64urlNoPadding(new Uint8Array(encrypted))}`;
+}
+/** @internal */
+async function decryptSecret(ciphertext) {
+	const [ivEncoded, payloadEncoded] = ciphertext.split(".");
+	if (!ivEncoded || !payloadEncoded) throw new AuthError("INVALID_PARAMETERS", "Stored enterprise secret is malformed.").toConvexError();
+	const key = await getSecretCryptoKey();
+	const decrypted = await crypto.subtle.decrypt({
+		name: "AES-GCM",
+		iv: toArrayBuffer(decodeBase64urlIgnorePadding(ivEncoded))
+	}, key, toArrayBuffer(decodeBase64urlIgnorePadding(payloadEncoded)));
+	return new TextDecoder().decode(decrypted);
+}
 
 //#endregion
-export { LOG_LEVELS, REFRESH_TOKEN_DIVIDER, TOKEN_SUB_CLAIM_DIVIDER, errorMessage, generateRandomString$1 as generateRandomString, isLocalHost, logError, logWithLevel, maybeRedact, requireEnv, sha256$1 as sha256 };
+export { LOG_LEVELS, REFRESH_TOKEN_DIVIDER, TOKEN_SUB_CLAIM_DIVIDER, decryptSecret, encryptSecret, errorMessage, generateRandomString$1 as generateRandomString, isLocalHost, logError, logWithLevel, maybeRedact, requireEnv, sha256$1 as sha256 };
 //# sourceMappingURL=utils.js.map

package/dist/component/server/utils.js.map

@@ -1 +1 @@
-{"version":3,"file":"utils.js","names":["sha256","rawSha256","generateRandomString","osloGenerateRandomString"],"sources":["../../../src/server/utils.ts"],"sourcesContent":["import {\n  RandomReader,\n  generateRandomString as osloGenerateRandomString,\n} from \"@oslojs/crypto/random\";\nimport { sha256 as rawSha256 } from \"@oslojs/crypto/sha2\";\nimport { encodeHexLowerCase } from \"@oslojs/encoding\";\n\nimport { AuthError } from \"./fx\";\n\n/**\n * Require an environment variable to be set, throwing at config time if missing.\n *\n * Uses `AuthError.toConvexError()` directly since this is a synchronous guard\n * called inline in many expressions — not suitable for Fx pipeline wrapping.\n */\nexport function requireEnv(name: string) {\n  const value = process.env[name];\n  if (value === undefined) {\n    throw new AuthError(\n      \"MISSING_ENV_VAR\",\n      `Missing environment variable \\`${name}\\``,\n      { variable: name },\n    ).toConvexError();\n  }\n  return value;\n}\n\nexport function isLocalHost(host?: string) {\n  if (host === undefined) {\n    return false;\n  }\n  const raw = host.includes(\"://\") ? host : `http://${host}`;\n  let url: URL;\n  try {\n    url = new URL(raw);\n  } catch {\n    return false;\n  }\n  return (\n    url.hostname === \"localhost\" ||\n    url.hostname === \"127.0.0.1\" ||\n    url.hostname === \"::1\"\n  );\n}\n\n// Internal server utilities (merged from former internalUtils.ts)\n\nexport const TOKEN_SUB_CLAIM_DIVIDER = \"|\";\nexport const REFRESH_TOKEN_DIVIDER = \"|\";\n\nexport async function sha256(input: string) {\n  return encodeHexLowerCase(rawSha256(new TextEncoder().encode(input)));\n}\n\nexport function generateRandomString(length: number, alphabet: string) {\n  const random: RandomReader = {\n    read(bytes) {\n      crypto.getRandomValues(bytes as Uint8Array<ArrayBuffer>);\n    },\n  };\n\n  return osloGenerateRandomString(random, alphabet, length);\n}\n\nexport function errorMessage(error: unknown) {\n  return error instanceof Error ? error.message : String(error);\n}\n\nexport function logError(error: unknown) {\n  logWithLevel(\n    LOG_LEVELS.ERROR,\n    error instanceof Error\n      ? error.message + \"\\n\" + error.stack?.replace(\"\\\\n\", \"\\n\")\n      : error,\n  );\n}\n\nexport const LOG_LEVELS = {\n  ERROR: \"ERROR\",\n  WARN: \"WARN\",\n  INFO: \"INFO\",\n  DEBUG: \"DEBUG\",\n} as const;\ntype LogLevel = keyof typeof LOG_LEVELS;\n\nexport function logWithLevel(level: LogLevel, ...args: unknown[]) {\n  const configuredLogLevel =\n    LOG_LEVELS[\n      (process.env.AUTH_LOG_LEVEL as LogLevel | undefined) ?? \"INFO\"\n    ] ?? \"INFO\";\n  switch (level) {\n    case \"ERROR\":\n      console.error(...args);\n      break;\n    case \"WARN\":\n      if (configuredLogLevel !== \"ERROR\") {\n        console.warn(...args);\n      }\n      break;\n    case \"INFO\":\n      if (configuredLogLevel === \"INFO\" || configuredLogLevel === \"DEBUG\") {\n        console.info(...args);\n      }\n      break;\n    case \"DEBUG\":\n      if (configuredLogLevel === \"DEBUG\") {\n        console.debug(...args);\n      }\n      break;\n  }\n}\n\nconst UNREDACTED_LENGTH = 5;\nexport function maybeRedact(value: string) {\n  if (value === \"\") {\n    return \"\";\n  }\n  const shouldRedact = process.env.AUTH_LOG_SECRETS !== \"true\";\n  if (shouldRedact) {\n    if (value.length < UNREDACTED_LENGTH * 2) {\n      return \"<redacted>\";\n    }\n    return (\n      value.substring(0, UNREDACTED_LENGTH) +\n      \"<redacted>\" +\n      value.substring(value.length - UNREDACTED_LENGTH)\n    );\n  } else {\n    return value;\n  }\n}\n"],"mappings":";;;;;;;;;;;;AAeA,SAAgB,WAAW,MAAc;CACvC,MAAM,QAAQ,QAAQ,IAAI;AAC1B,KAAI,UAAU,OACZ,OAAM,IAAI,UACR,mBACA,kCAAkC,KAAK,KACvC,EAAE,UAAU,MAAM,CACnB,CAAC,eAAe;AAEnB,QAAO;;AAGT,SAAgB,YAAY,MAAe;AACzC,KAAI,SAAS,OACX,QAAO;CAET,MAAM,MAAM,KAAK,SAAS,MAAM,GAAG,OAAO,UAAU;CACpD,IAAI;AACJ,KAAI;AACF,QAAM,IAAI,IAAI,IAAI;SACZ;AACN,SAAO;;AAET,QACE,IAAI,aAAa,eACjB,IAAI,aAAa,eACjB,IAAI,aAAa;;AAMrB,MAAa,0BAA0B;AACvC,MAAa,wBAAwB;AAErC,eAAsBA,SAAO,OAAe;AAC1C,QAAO,mBAAmBC,OAAU,IAAI,aAAa,CAAC,OAAO,MAAM,CAAC,CAAC;;AAGvE,SAAgBC,uBAAqB,QAAgB,UAAkB;AAOrE,QAAOC,qBANsB,EAC3B,KAAK,OAAO;AACV,SAAO,gBAAgB,MAAiC;IAE3D,EAEuC,UAAU,OAAO;;AAG3D,SAAgB,aAAa,OAAgB;AAC3C,QAAO,iBAAiB,QAAQ,MAAM,UAAU,OAAO,MAAM;;AAG/D,SAAgB,SAAS,OAAgB;AACvC,cACE,WAAW,OACX,iBAAiB,QACb,MAAM,UAAU,OAAO,MAAM,OAAO,QAAQ,OAAO,KAAK,GACxD,MACL;;AAGH,MAAa,aAAa;CACxB,OAAO;CACP,MAAM;CACN,MAAM;CACN,OAAO;CACR;AAGD,SAAgB,aAAa,OAAiB,GAAG,MAAiB;CAChE,MAAM,qBACJ,WACG,QAAQ,IAAI,kBAA2C,WACrD;AACP,SAAQ,OAAR;EACE,KAAK;AACH,WAAQ,MAAM,GAAG,KAAK;AACtB;EACF,KAAK;AACH,OAAI,uBAAuB,QACzB,SAAQ,KAAK,GAAG,KAAK;AAEvB;EACF,KAAK;AACH,OAAI,uBAAuB,UAAU,uBAAuB,QAC1D,SAAQ,KAAK,GAAG,KAAK;AAEvB;EACF,KAAK;AACH,OAAI,uBAAuB,QACzB,SAAQ,MAAM,GAAG,KAAK;AAExB;;;AAIN,MAAM,oBAAoB;AAC1B,SAAgB,YAAY,OAAe;AACzC,KAAI,UAAU,GACZ,QAAO;AAGT,KADqB,QAAQ,IAAI,qBAAqB,QACpC;AAChB,MAAI,MAAM,SAAS,oBAAoB,EACrC,QAAO;AAET,SACE,MAAM,UAAU,GAAG,kBAAkB,GACrC,eACA,MAAM,UAAU,MAAM,SAAS,kBAAkB;OAGnD,QAAO"}
+{"version":3,"file":"utils.js","names":["sha256","rawSha256","generateRandomString","osloGenerateRandomString"],"sources":["../../../src/server/utils.ts"],"sourcesContent":["import {\n  RandomReader,\n  generateRandomString as osloGenerateRandomString,\n} from \"@oslojs/crypto/random\";\nimport { sha256 as rawSha256 } from \"@oslojs/crypto/sha2\";\nimport {\n  decodeBase64urlIgnorePadding,\n  encodeBase64urlNoPadding,\n  encodeHexLowerCase,\n} from \"@oslojs/encoding\";\n\nimport { AuthError } from \"./fx\";\n\n/**\n * Require an environment variable to be set, throwing at config time if missing.\n *\n * Uses `AuthError.toConvexError()` directly since this is a synchronous guard\n * called inline in many expressions — not suitable for Fx pipeline wrapping.\n */\n/** @internal */\nexport function requireEnv(name: string) {\n  const value = process.env[name];\n  if (value === undefined) {\n    throw new AuthError(\n      \"MISSING_ENV_VAR\",\n      `Missing environment variable \\`${name}\\``,\n      { variable: name },\n    ).toConvexError();\n  }\n  return value;\n}\n\n/** @internal */\nexport function isLocalHost(host?: string) {\n  if (host === undefined) {\n    return false;\n  }\n  const raw = host.includes(\"://\") ? host : `http://${host}`;\n  let url: URL;\n  try {\n    url = new URL(raw);\n  } catch {\n    return false;\n  }\n  return (\n    url.hostname === \"localhost\" ||\n    url.hostname === \"127.0.0.1\" ||\n    url.hostname === \"::1\"\n  );\n}\n\n// Internal server utilities (merged from former internalUtils.ts)\n\n/** @internal */\nexport const TOKEN_SUB_CLAIM_DIVIDER = \"|\";\n/** @internal */\nexport const REFRESH_TOKEN_DIVIDER = \"|\";\n\n/** @internal */\nexport async function sha256(input: string) {\n  return encodeHexLowerCase(rawSha256(new TextEncoder().encode(input)));\n}\n\n/** @internal */\nexport function generateRandomString(length: number, alphabet: string) {\n  const random: RandomReader = {\n    read(bytes) {\n      crypto.getRandomValues(bytes as Uint8Array<ArrayBuffer>);\n    },\n  };\n\n  return osloGenerateRandomString(random, alphabet, length);\n}\n\n/** @internal */\nexport function errorMessage(error: unknown) {\n  return error instanceof Error ? error.message : String(error);\n}\n\n/** @internal */\nexport function logError(error: unknown) {\n  logWithLevel(\n    LOG_LEVELS.ERROR,\n    error instanceof Error\n      ? error.message + \"\\n\" + error.stack?.replace(\"\\\\n\", \"\\n\")\n      : error,\n  );\n}\n\n/** @internal */\nexport const LOG_LEVELS = {\n  ERROR: \"ERROR\",\n  WARN: \"WARN\",\n  INFO: \"INFO\",\n  DEBUG: \"DEBUG\",\n} as const;\ntype LogLevel = keyof typeof LOG_LEVELS;\n\n/** @internal */\nexport function logWithLevel(level: LogLevel, ...args: unknown[]) {\n  const configuredLogLevel =\n    LOG_LEVELS[\n      (process.env.AUTH_LOG_LEVEL as LogLevel | undefined) ?? \"INFO\"\n    ] ?? \"INFO\";\n  switch (level) {\n    case \"ERROR\":\n      console.error(...args);\n      break;\n    case \"WARN\":\n      if (configuredLogLevel !== \"ERROR\") {\n        console.warn(...args);\n      }\n      break;\n    case \"INFO\":\n      if (configuredLogLevel === \"INFO\" || configuredLogLevel === \"DEBUG\") {\n        console.info(...args);\n      }\n      break;\n    case \"DEBUG\":\n      if (configuredLogLevel === \"DEBUG\") {\n        console.debug(...args);\n      }\n      break;\n  }\n}\n\nconst UNREDACTED_LENGTH = 5;\n/** @internal */\nexport function maybeRedact(value: string) {\n  if (value === \"\") {\n    return \"\";\n  }\n  const shouldRedact = process.env.AUTH_LOG_SECRETS !== \"true\";\n  if (shouldRedact) {\n    if (value.length < UNREDACTED_LENGTH * 2) {\n      return \"<redacted>\";\n    }\n    return (\n      value.substring(0, UNREDACTED_LENGTH) +\n      \"<redacted>\" +\n      value.substring(value.length - UNREDACTED_LENGTH)\n    );\n  } else {\n    return value;\n  }\n}\n\nconst SECRET_KEY_ENV = \"AUTH_SECRET_ENCRYPTION_KEY\";\nconst SECRET_IV_LENGTH = 12;\n\nfunction toArrayBuffer(bytes: Uint8Array) {\n  return bytes.buffer.slice(\n    bytes.byteOffset,\n    bytes.byteOffset + bytes.byteLength,\n  ) as ArrayBuffer;\n}\n\nasync function getSecretCryptoKey() {\n  const material = requireEnv(SECRET_KEY_ENV);\n  const rawKey = rawSha256(new TextEncoder().encode(material));\n  return await crypto.subtle.importKey(\n    \"raw\",\n    toArrayBuffer(rawKey),\n    { name: \"AES-GCM\" },\n    false,\n    [\"encrypt\", \"decrypt\"],\n  );\n}\n\n/** @internal */\nexport async function encryptSecret(value: string) {\n  const key = await getSecretCryptoKey();\n  const iv = crypto.getRandomValues(new Uint8Array(SECRET_IV_LENGTH));\n  const encrypted = await crypto.subtle.encrypt(\n    { name: \"AES-GCM\", iv: toArrayBuffer(iv) },\n    key,\n    toArrayBuffer(new TextEncoder().encode(value)),\n  );\n  return `${encodeBase64urlNoPadding(iv)}.${encodeBase64urlNoPadding(new Uint8Array(encrypted))}`;\n}\n\n/** @internal */\nexport async function decryptSecret(ciphertext: string) {\n  const [ivEncoded, payloadEncoded] = ciphertext.split(\".\");\n  if (!ivEncoded || !payloadEncoded) {\n    throw new AuthError(\n      \"INVALID_PARAMETERS\",\n      \"Stored enterprise secret is malformed.\",\n    ).toConvexError();\n  }\n  const key = await getSecretCryptoKey();\n  const decrypted = await crypto.subtle.decrypt(\n    {\n      name: \"AES-GCM\",\n      iv: toArrayBuffer(decodeBase64urlIgnorePadding(ivEncoded)),\n    },\n    key,\n    toArrayBuffer(decodeBase64urlIgnorePadding(payloadEncoded)),\n  );\n  return new TextDecoder().decode(decrypted);\n}\n"],"mappings":";;;;;;;;;;;;;AAoBA,SAAgB,WAAW,MAAc;CACvC,MAAM,QAAQ,QAAQ,IAAI;AAC1B,KAAI,UAAU,OACZ,OAAM,IAAI,UACR,mBACA,kCAAkC,KAAK,KACvC,EAAE,UAAU,MAAM,CACnB,CAAC,eAAe;AAEnB,QAAO;;;AAIT,SAAgB,YAAY,MAAe;AACzC,KAAI,SAAS,OACX,QAAO;CAET,MAAM,MAAM,KAAK,SAAS,MAAM,GAAG,OAAO,UAAU;CACpD,IAAI;AACJ,KAAI;AACF,QAAM,IAAI,IAAI,IAAI;SACZ;AACN,SAAO;;AAET,QACE,IAAI,aAAa,eACjB,IAAI,aAAa,eACjB,IAAI,aAAa;;;AAOrB,MAAa,0BAA0B;;AAEvC,MAAa,wBAAwB;;AAGrC,eAAsBA,SAAO,OAAe;AAC1C,QAAO,mBAAmBC,OAAU,IAAI,aAAa,CAAC,OAAO,MAAM,CAAC,CAAC;;;AAIvE,SAAgBC,uBAAqB,QAAgB,UAAkB;AAOrE,QAAOC,qBANsB,EAC3B,KAAK,OAAO;AACV,SAAO,gBAAgB,MAAiC;IAE3D,EAEuC,UAAU,OAAO;;;AAI3D,SAAgB,aAAa,OAAgB;AAC3C,QAAO,iBAAiB,QAAQ,MAAM,UAAU,OAAO,MAAM;;;AAI/D,SAAgB,SAAS,OAAgB;AACvC,cACE,WAAW,OACX,iBAAiB,QACb,MAAM,UAAU,OAAO,MAAM,OAAO,QAAQ,OAAO,KAAK,GACxD,MACL;;;AAIH,MAAa,aAAa;CACxB,OAAO;CACP,MAAM;CACN,MAAM;CACN,OAAO;CACR;;AAID,SAAgB,aAAa,OAAiB,GAAG,MAAiB;CAChE,MAAM,qBACJ,WACG,QAAQ,IAAI,kBAA2C,WACrD;AACP,SAAQ,OAAR;EACE,KAAK;AACH,WAAQ,MAAM,GAAG,KAAK;AACtB;EACF,KAAK;AACH,OAAI,uBAAuB,QACzB,SAAQ,KAAK,GAAG,KAAK;AAEvB;EACF,KAAK;AACH,OAAI,uBAAuB,UAAU,uBAAuB,QAC1D,SAAQ,KAAK,GAAG,KAAK;AAEvB;EACF,KAAK;AACH,OAAI,uBAAuB,QACzB,SAAQ,MAAM,GAAG,KAAK;AAExB;;;AAIN,MAAM,oBAAoB;;AAE1B,SAAgB,YAAY,OAAe;AACzC,KAAI,UAAU,GACZ,QAAO;AAGT,KADqB,QAAQ,IAAI,qBAAqB,QACpC;AAChB,MAAI,MAAM,SAAS,oBAAoB,EACrC,QAAO;AAET,SACE,MAAM,UAAU,GAAG,kBAAkB,GACrC,eACA,MAAM,UAAU,MAAM,SAAS,kBAAkB;OAGnD,QAAO;;AAIX,MAAM,iBAAiB;AACvB,MAAM,mBAAmB;AAEzB,SAAS,cAAc,OAAmB;AACxC,QAAO,MAAM,OAAO,MAClB,MAAM,YACN,MAAM,aAAa,MAAM,WAC1B;;AAGH,eAAe,qBAAqB;CAClC,MAAM,WAAW,WAAW,eAAe;CAC3C,MAAM,SAASF,OAAU,IAAI,aAAa,CAAC,OAAO,SAAS,CAAC;AAC5D,QAAO,MAAM,OAAO,OAAO,UACzB,OACA,cAAc,OAAO,EACrB,EAAE,MAAM,WAAW,EACnB,OACA,CAAC,WAAW,UAAU,CACvB;;;AAIH,eAAsB,cAAc,OAAe;CACjD,MAAM,MAAM,MAAM,oBAAoB;CACtC,MAAM,KAAK,OAAO,gBAAgB,IAAI,WAAW,iBAAiB,CAAC;CACnE,MAAM,YAAY,MAAM,OAAO,OAAO,QACpC;EAAE,MAAM;EAAW,IAAI,cAAc,GAAG;EAAE,EAC1C,KACA,cAAc,IAAI,aAAa,CAAC,OAAO,MAAM,CAAC,CAC/C;AACD,QAAO,GAAG,yBAAyB,GAAG,CAAC,GAAG,yBAAyB,IAAI,WAAW,UAAU,CAAC;;;AAI/F,eAAsB,cAAc,YAAoB;CACtD,MAAM,CAAC,WAAW,kBAAkB,WAAW,MAAM,IAAI;AACzD,KAAI,CAAC,aAAa,CAAC,eACjB,OAAM,IAAI,UACR,sBACA,yCACD,CAAC,eAAe;CAEnB,MAAM,MAAM,MAAM,oBAAoB;CACtC,MAAM,YAAY,MAAM,OAAO,OAAO,QACpC;EACE,MAAM;EACN,IAAI,cAAc,6BAA6B,UAAU,CAAC;EAC3D,EACD,KACA,cAAc,6BAA6B,eAAe,CAAC,CAC5D;AACD,QAAO,IAAI,aAAa,CAAC,OAAO,UAAU"}

package/dist/providers/anonymous.d.ts

@@ -1,6 +1,6 @@
 import { GenericActionCtxWithAuthConfig } from "../server/types.js";
-import { Value } from "convex/values";
 import { DocumentByName, GenericDataModel, WithoutSystemFields } from "convex/server";
+import { Value } from "convex/values";
 
 //#region src/providers/anonymous.d.ts
 /**

package/dist/providers/credentials.d.ts

@@ -1,6 +1,6 @@
 import { AuthProviderConfig, GenericActionCtxWithAuthConfig } from "../server/types.js";
-import { GenericId, Value } from "convex/values";
 import { GenericDataModel } from "convex/server";
+import { GenericId, Value } from "convex/values";
 
 //#region src/providers/credentials.d.ts
 /**

package/dist/providers/password.d.ts

@@ -1,7 +1,7 @@
 import { CredentialsConfig } from "./credentials.js";
 import { EmailConfig, GenericActionCtxWithAuthConfig } from "../server/types.js";
-import { Value } from "convex/values";
 import { DocumentByName, GenericDataModel, WithoutSystemFields } from "convex/server";
+import { Value } from "convex/values";
 
 //#region src/providers/password.d.ts
 /**

package/dist/providers/sso.d.ts

@@ -15,7 +15,7 @@
  * });
  *
  * // auth.sso is now available
- * await auth.sso.oidc.configure(ctx, { enterpriseId, clientId, ... });
+ * await auth.sso.admin.oidc.configure(ctx, { enterpriseId, clientId, ... });
  * ```
  *
  * Without `new SSO()` in the providers list, `auth.sso` is not

package/dist/providers/sso.js.map

@@ -1 +1 @@
-{"version":3,"file":"sso.js","names":[],"sources":["../../src/providers/sso.ts"],"sourcesContent":["/**\n * Enterprise SSO provider (OIDC + SAML + SCIM).\n *\n * Adding `new SSO()` to your providers list enables enterprise SSO\n * sign-in flows and registers the OIDC, SAML, and SCIM runtime HTTP\n * routes. It also makes `auth.sso.*` available on the auth\n * object returned by `createAuth`.\n *\n * ```ts\n * import { SSO } from \"@robelest/convex-auth/providers\";\n *\n * const auth = createAuth(components.auth, {\n *   providers: [new SSO(), new Password()],\n * });\n *\n * // auth.sso is now available\n * await auth.sso.oidc.configure(ctx, { enterpriseId, clientId, ... });\n * ```\n *\n * Without `new SSO()` in the providers list, `auth.sso` is not\n * present on the returned object and accessing it is a TypeScript error.\n *\n * @module\n */\n\nimport type { SSOProviderConfig } from \"../server/types\";\n\n/**\n * Enterprise SSO provider.\n *\n * Zero-configuration — sensible defaults are applied for all enterprise\n * protocols (OIDC, SAML, SCIM). Per-tenant configuration is done at\n * runtime via `auth.sso.*` helpers.\n *\n * @example\n * ```ts\n * import { createAuth } from \"@robelest/convex-auth/component\";\n * import { SSO, Password } from \"@robelest/convex-auth/providers\";\n * import { components } from \"./_generated/api\";\n *\n * export const auth = createAuth(components.auth, {\n *   providers: [new SSO(), new Password()],\n * });\n * ```\n */\nexport class SSO {\n  readonly id = \"enterprise-sso\";\n  readonly type = \"sso\" as const;\n\n  /** @internal Convert to the internal materialized config shape. */\n  _toMaterialized(): SSOProviderConfig {\n    return { id: this.id, type: \"sso\" };\n  }\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;AA6CA,IAAa,MAAb,MAAiB;CACf,AAAS,KAAK;CACd,AAAS,OAAO;;CAGhB,kBAAqC;AACnC,SAAO;GAAE,IAAI,KAAK;GAAI,MAAM;GAAO"}
+{"version":3,"file":"sso.js","names":[],"sources":["../../src/providers/sso.ts"],"sourcesContent":["/**\n * Enterprise SSO provider (OIDC + SAML + SCIM).\n *\n * Adding `new SSO()` to your providers list enables enterprise SSO\n * sign-in flows and registers the OIDC, SAML, and SCIM runtime HTTP\n * routes. It also makes `auth.sso.*` available on the auth\n * object returned by `createAuth`.\n *\n * ```ts\n * import { SSO } from \"@robelest/convex-auth/providers\";\n *\n * const auth = createAuth(components.auth, {\n *   providers: [new SSO(), new Password()],\n * });\n *\n * // auth.sso is now available\n * await auth.sso.admin.oidc.configure(ctx, { enterpriseId, clientId, ... });\n * ```\n *\n * Without `new SSO()` in the providers list, `auth.sso` is not\n * present on the returned object and accessing it is a TypeScript error.\n *\n * @module\n */\n\nimport type { SSOProviderConfig } from \"../server/types\";\n\n/**\n * Enterprise SSO provider.\n *\n * Zero-configuration — sensible defaults are applied for all enterprise\n * protocols (OIDC, SAML, SCIM). Per-tenant configuration is done at\n * runtime via `auth.sso.*` helpers.\n *\n * @example\n * ```ts\n * import { createAuth } from \"@robelest/convex-auth/component\";\n * import { SSO, Password } from \"@robelest/convex-auth/providers\";\n * import { components } from \"./_generated/api\";\n *\n * export const auth = createAuth(components.auth, {\n *   providers: [new SSO(), new Password()],\n * });\n * ```\n */\nexport class SSO {\n  readonly id = \"enterprise-sso\";\n  readonly type = \"sso\" as const;\n\n  /** @internal Convert to the internal materialized config shape. */\n  _toMaterialized(): SSOProviderConfig {\n    return { id: this.id, type: \"sso\" };\n  }\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;AA6CA,IAAa,MAAb,MAAiB;CACf,AAAS,KAAK;CACd,AAAS,OAAO;;CAGhB,kBAAqC;AACnC,SAAO;GAAE,IAAI,KAAK;GAAI,MAAM;GAAO"}

package/dist/server/auth.d.ts

@@ -1,8 +1,8 @@
-import { AuthProviderConfig, ConvexAuthConfig, Doc, HasDeviceProvider, HasPasskeyProvider, HasSSO, HasTotpProvider } from "./types.js";
+import { AuthAuthorizationConfig, AuthGrant, AuthProviderConfig, AuthRoleId, ConvexAuthConfig, Doc, HasDeviceProvider, HasPasskeyProvider, HasSSO, HasTotpProvider } from "./types.js";
 import { AuthApiRefs } from "../client/index.js";
-import { Auth as Auth$1 } from "./implementation.js";
-import { GenericId } from "convex/values";
+import { Auth as Auth$1 } from "./factory.js";
 import { UserIdentity } from "convex/server";
+import { GenericId } from "convex/values";
 
 //#region src/server/auth.d.ts
 /**
@@ -10,8 +10,66 @@ import { UserIdentity } from "convex/server";
  * minus `component` (which is passed as the first constructor argument).
  */
 type AuthConfig = Omit<ConvexAuthConfig, "component">;
+type MemberApiWithAuthorization<TAuthorization extends AuthAuthorizationConfig | undefined> = Omit<ReturnType<typeof Auth$1>["auth"]["member"], "create" | "list" | "update" | "inherit" | "require"> & {
+  create: (ctx: Parameters<ReturnType<typeof Auth$1>["auth"]["member"]["create"]>[0], data: {
+    groupId: string;
+    userId: string;
+    roleIds?: AuthRoleId<TAuthorization>[];
+    status?: string;
+    extend?: Record<string, unknown>;
+  }) => Promise<{
+    ok: true;
+    memberId: string;
+  }>;
+  list: (ctx: Parameters<ReturnType<typeof Auth$1>["auth"]["member"]["list"]>[0], opts?: {
+    where?: {
+      groupId?: string;
+      userId?: string;
+      roleId?: AuthRoleId<TAuthorization>;
+      status?: string;
+    };
+    limit?: number;
+    cursor?: string | null;
+    orderBy?: "_creationTime" | "status";
+    order?: "asc" | "desc";
+  }) => ReturnType<ReturnType<typeof Auth$1>["auth"]["member"]["list"]>;
+  update: (ctx: Parameters<ReturnType<typeof Auth$1>["auth"]["member"]["update"]>[0], memberId: string, data: Record<string, unknown> & {
+    roleIds?: AuthRoleId<TAuthorization>[];
+  }) => Promise<{
+    ok: true;
+    memberId: string;
+  }>;
+  inherit: (ctx: Parameters<ReturnType<typeof Auth$1>["auth"]["member"]["inherit"]>[0], opts: {
+    userId: string;
+    groupId: string;
+    roleIds?: AuthRoleId<TAuthorization>[];
+    grants?: AuthGrant<TAuthorization>[];
+    maxDepth?: number;
+  }) => ReturnType<ReturnType<typeof Auth$1>["auth"]["member"]["inherit"]>;
+  require: (ctx: Parameters<ReturnType<typeof Auth$1>["auth"]["member"]["require"]>[0], opts: {
+    userId: string;
+    groupId: string;
+    roleIds?: AuthRoleId<TAuthorization>[];
+    grants?: AuthGrant<TAuthorization>[];
+    maxDepth?: number;
+  }) => ReturnType<ReturnType<typeof Auth$1>["auth"]["member"]["require"]>;
+};
+type AccessApiWithAuthorization<TAuthorization extends AuthAuthorizationConfig | undefined> = {
+  check: (ctx: Parameters<ReturnType<typeof Auth$1>["auth"]["access"]["check"]>[0], opts: {
+    userId: string;
+    groupId: string;
+    grants: AuthGrant<TAuthorization>[];
+    maxDepth?: number;
+  }) => ReturnType<ReturnType<typeof Auth$1>["auth"]["access"]["check"]>;
+  require: (ctx: Parameters<ReturnType<typeof Auth$1>["auth"]["access"]["require"]>[0], opts: {
+    userId: string;
+    groupId: string;
+    grants: AuthGrant<TAuthorization>[];
+    maxDepth?: number;
+  }) => ReturnType<ReturnType<typeof Auth$1>["auth"]["access"]["require"]>;
+};
 /** The base auth API surface, without conditional namespaces. */
-type AuthApiBase = {
+type AuthApiBase<TAuthorization extends AuthAuthorizationConfig | undefined = undefined> = {
   signIn: ReturnType<typeof Auth$1>["signIn"];
   signOut: ReturnType<typeof Auth$1>["signOut"];
   store: ReturnType<typeof Auth$1>["store"];
@@ -20,21 +78,100 @@ type AuthApiBase = {
   provider: ReturnType<typeof Auth$1>["auth"]["provider"];
   account: ReturnType<typeof Auth$1>["auth"]["account"];
   group: ReturnType<typeof Auth$1>["auth"]["group"];
-  member: ReturnType<typeof Auth$1>["auth"]["member"];
+  member: MemberApiWithAuthorization<TAuthorization>;
+  access: AccessApiWithAuthorization<TAuthorization>;
   invite: ReturnType<typeof Auth$1>["auth"]["invite"];
   key: ReturnType<typeof Auth$1>["auth"]["key"];
   http: ReturnType<typeof Auth$1>["auth"]["http"];
 };
-/** Auth API with SSO namespace — present only when `new SSO()` is in providers. */
-type AuthApi = AuthApiBase & {
-  sso: ReturnType<typeof Auth$1>["auth"]["sso"];
+type InternalSsoApi = ReturnType<typeof Auth$1>["auth"]["sso"];
+type PublicSsoAdminApi = {
+  connection: InternalSsoApi["connection"] & {
+    domain: {
+      list: InternalSsoApi["domain"]["list"];
+      validate: InternalSsoApi["domain"]["validate"];
+      set: (ctx: Parameters<InternalSsoApi["connection"]["create"]>[0], enterpriseId: string, domains: Array<{
+        domain: string;
+        isPrimary?: boolean;
+      }>) => Promise<{
+        ok: true;
+        enterpriseId: string;
+        domains: Array<{
+          domainId: string;
+          domain: string;
+          isPrimary: boolean;
+          verified: boolean;
+          verifiedAt: number | null;
+        }>;
+      }>;
+      verification: {
+        request: (ctx: Parameters<InternalSsoApi["connection"]["create"]>[0], args: {
+          enterpriseId: string;
+          domain: string;
+        }) => Promise<{
+          ok: true;
+          enterpriseId: string;
+          domain: string;
+          requestedAt: number;
+          expiresAt: number;
+          challenge: {
+            recordType: "TXT";
+            recordName: string;
+            recordValue: string;
+          };
+        }>;
+        confirm: (ctx: Parameters<InternalSsoApi["connection"]["create"]>[0], args: {
+          enterpriseId: string;
+          domain: string;
+        }) => Promise<{
+          ok: boolean;
+          enterpriseId: string;
+          domain: string;
+          verifiedAt?: number;
+          checks: Array<{
+            name: string;
+            ok: boolean;
+            message?: string;
+          }>;
+        }>;
+      };
+    };
+  };
+  oidc: Omit<InternalSsoApi["oidc"], "signIn">;
+  saml: Omit<InternalSsoApi["saml"], "metadata">;
+  policy: InternalSsoApi["policy"];
+  audit: {
+    list: InternalSsoApi["audit"]["list"];
+  };
+  webhook: {
+    endpoint: InternalSsoApi["webhook"]["endpoint"];
+    delivery: {
+      list: InternalSsoApi["webhook"]["delivery"]["list"];
+    };
+  };
+};
+type PublicSsoClientApi = {
+  signIn: InternalSsoApi["oidc"]["signIn"];
+  metadata: InternalSsoApi["saml"]["metadata"];
+};
+type PublicSsoApi = {
+  admin: PublicSsoAdminApi;
+  client: PublicSsoClientApi;
+};
+type PublicScimApi = {
+  admin: Omit<InternalSsoApi["scim"], "getConfigByToken" | "identity">;
+};
+/** Auth API with enterprise namespaces — present only when `new SSO()` is in providers. */
+type AuthApi<TAuthorization extends AuthAuthorizationConfig | undefined = undefined> = AuthApiBase<TAuthorization> & {
+  sso: PublicSsoApi;
+  scim: PublicScimApi;
 };
 /**
  * The return type of `createAuth`. Conditional namespaces:
- * - `auth.sso` — only when `new SSO()` is in providers
+ * - `auth.sso` and `auth.scim` — only when `new SSO()` is in providers
  * - `auth.clientApi` — typed API refs for the client SDK with capabilities
  */
-type ConvexAuthResult<P extends AuthProviderConfig[]> = HasSSO<P> extends true ? AuthApi : AuthApiBase;
+type ConvexAuthResult<P extends AuthProviderConfig[], TAuthorization extends AuthAuthorizationConfig | undefined = undefined> = HasSSO<P> extends true ? AuthApi<TAuthorization> : AuthApiBase<TAuthorization>;
 /**
  * Infer the typed `AuthApiRefs` for the client SDK from a `createAuth` call.
  *
@@ -47,20 +184,29 @@ type ConvexAuthResult<P extends AuthProviderConfig[]> = HasSSO<P> extends true ?
  * // Frontend
  * import type { auth } from "../convex/auth";
  * import type { InferClientApi } from "@robelest/convex-auth/component";
- * const c = client<InferClientApi<typeof auth>>({ convex, api: { ... } });
+ * const c = client<InferClientApi<typeof auth>>({ convex, api: api.auth });
  * ```
  */
 type InferClientApi<T> = T extends ConvexAuthResult<infer P> ? AuthApiRefs<HasPasskeyProvider<P>, HasTotpProvider<P>, HasDeviceProvider<P>> : AuthApiRefs;
 /**
  * Create an auth API object.
  *
- * When `new SSO()` is included in providers, `auth.sso` is available
- * on the returned object. Without it, `auth.sso` is absent and
- * accessing it is a TypeScript compile error.
+ * When `new SSO()` is included in providers, `auth.sso` and `auth.scim`
+ * are available on the returned object. Without it, those namespaces are
+ * absent and accessing them is a TypeScript compile error.
  */
-declare function createAuth<P extends AuthProviderConfig[]>(component: ConvexAuthConfig["component"], config: Omit<AuthConfig, "providers"> & {
+declare function createAuth<P extends AuthProviderConfig[], TAuthorization extends AuthAuthorizationConfig | undefined = undefined>(component: ConvexAuthConfig["component"], config: Omit<AuthConfig, "providers" | "authorization"> & {
   providers: P;
-}): ConvexAuthResult<P>;
+  authorization?: TAuthorization;
+}): ConvexAuthResult<P, TAuthorization>;
+declare function defineRoles<const TRoles extends Record<string, {
+  label?: string;
+  grants: readonly string[];
+}>>(roles: TRoles): { [K in keyof TRoles]: {
+  id: K & string;
+  label?: TRoles[K]["label"];
+  grants: Array<TRoles[K]["grants"][number] & string>;
+} };
 type UserDoc = Doc<"User">;
 type AuthCtxConfig<TResolve extends Record<string, unknown> = Record<string, never>> = {
   optional?: boolean;
@@ -104,5 +250,5 @@ type InferAuth<T extends {
   }>;
 }> = Awaited<ReturnType<T["input"]>>["ctx"]["auth"];
 //#endregion
-export { AuthApi, AuthApiBase, AuthConfig, AuthCtx, AuthCtxConfig, ConvexAuthResult, InferAuth, InferClientApi, UserDoc, createAuth };
+export { AuthApi, AuthApiBase, AuthConfig, AuthCtx, AuthCtxConfig, ConvexAuthResult, InferAuth, InferClientApi, UserDoc, createAuth, defineRoles };
 //# sourceMappingURL=auth.d.ts.map

package/dist/server/auth.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"auth.d.ts","names":[],"sources":["../../src/server/auth.ts"],"mappings":";;;;;;;;AAkCA;;;KAHY,UAAA,GAAa,IAAA,CAAK,gBAAA;;KAGlB,WAAA;EACV,MAAA,EAAQ,UAAA,QAAkB,MAAA;EAC1B,OAAA,EAAS,UAAA,QAAkB,MAAA;EAC3B,KAAA,EAAO,UAAA,QAAkB,MAAA;EACzB,IAAA,EAAM,UAAA,QAAkB,MAAA;EACxB,OAAA,EAAS,UAAA,QAAkB,MAAA;EAC3B,QAAA,EAAU,UAAA,QAAkB,MAAA;EAC5B,OAAA,EAAS,UAAA,QAAkB,MAAA;EAC3B,KAAA,EAAO,UAAA,QAAkB,MAAA;EACzB,MAAA,EAAQ,UAAA,QAAkB,MAAA;EAC1B,MAAA,EAAQ,UAAA,QAAkB,MAAA;EAC1B,GAAA,EAAK,UAAA,QAAkB,MAAA;EACvB,IAAA,EAAM,UAAA,QAAkB,MAAA;AAAA;;KAId,OAAA,GAAU,WAAA;EACpB,GAAA,EAAK,UAAA,QAAkB,MAAA;AAAA;;;;;;KAQb,gBAAA,WAA2B,kBAAA,MACrC,MAAA,CAAO,CAAA,iBAAkB,OAAA,GAAU,WAAA;;;;;;;;;;;;;;;;KAiBzB,cAAA,MACV,CAAA,SAAU,gBAAA,YACN,WAAA,CACE,kBAAA,CAAmB,CAAA,GACnB,eAAA,CAAgB,CAAA,GAChB,iBAAA,CAAkB,CAAA,KAEpB,WAAA;;;;;;;;iBAgBU,UAAA,WAAqB,kBAAA,GAAA,CACnC,SAAA,EAAW,gBAAA,eACX,MAAA,EAAQ,IAAA,CAAK,UAAA;EAA6B,SAAA,EAAW,CAAA;AAAA,IACpD,gBAAA,CAAiB,CAAA;AAAA,KA4BR,OAAA,GAAU,GAAA;AAAA,KAEV,aAAA,kBACO,MAAA,oBAA0B,MAAA;EAE3C,QAAA;EACA,OAAA,IAAW,GAAA,OAAU,IAAA,EAAM,OAAA,KAAY,OAAA,CAAQ,QAAA,IAAY,QAAA;AAAA;;iBAI7C,OAAA,kBACG,MAAA,oBAA0B,MAAA,gBAAA,CAE3C,IAAA,EAAM,QAAA,EACN,MAAA,EAAQ,aAAA,CAAc,QAAA;EAAc,QAAA;AAAA;EAEpC,IAAA;EACA,KAAA,GACE,GAAA,OACA,KAAA,OACA,MAAA,WACG,OAAA;IACH,GAAA;MACE,IAAA;QACE,eAAA,QAAuB,OAAA,CAAQ,YAAA;QAC/B,MAAA,EAAQ,SAAA;QACR,IAAA,EAAM,OAAA;MAAA,IACJ,QAAA;IAAA;IAEN,IAAA;EAAA;AAAA;;iBAIY,OAAA,kBACG,MAAA,oBAA0B,MAAA,gBAAA,CAE3C,IAAA,EAAM,QAAA,EACN,MAAA,GAAS,aAAA,CAAc,QAAA;EAEvB,IAAA;EACA,KAAA,GACE,GAAA,OACA,KAAA,OACA,MAAA,WACG,OAAA;IACH,GAAA;MACE,IAAA;QACE,eAAA,QAAuB,OAAA,CAAQ,YAAA;QAC/B,MAAA,EAAQ,SAAA;QACR,IAAA,EAAM,OAAA;MAAA,IACJ,QAAA;IAAA;IAEN,IAAA;EAAA;AAAA;AAAA,KAgEQ,SAAA;EACE,KAAA,MAAW,IAAA,YAAgB,OAAA;IAAU,GAAA;MAAO,IAAA;IAAA;EAAA;AAAA,KACtD,OAAA,CAAQ,UAAA,CAAW,CAAA"}
+{"version":3,"file":"auth.d.ts","names":[],"sources":["../../src/server/auth.ts"],"mappings":";;;;;;;;AAmC6D;;;KAAjD,UAAA,GAAa,IAAA,CAAK,gBAAA;AAAA,KAEzB,0BAAA,wBACoB,uBAAA,gBACrB,IAAA,CACF,UAAA,QAAkB,MAAA;EAGlB,MAAA,GACE,GAAA,EAAK,UAAA,CACH,UAAA,QAAkB,MAAA,mCAEpB,IAAA;IACE,OAAA;IACA,MAAA;IACA,OAAA,GAAU,UAAA,CAAW,cAAA;IACrB,MAAA;IACA,MAAA,GAAS,MAAA;EAAA,MAER,OAAA;IAAU,EAAA;IAAU,QAAA;EAAA;EACzB,IAAA,GACE,GAAA,EAAK,UAAA,CACH,UAAA,QAAkB,MAAA,iCAEpB,IAAA;IACE,KAAA;MACE,OAAA;MACA,MAAA;MACA,MAAA,GAAS,UAAA,CAAW,cAAA;MACpB,MAAA;IAAA;IAEF,KAAA;IACA,MAAA;IACA,OAAA;IACA,KAAA;EAAA,MAEC,UAAA,CAAW,UAAA,QAAkB,MAAA;EAClC,MAAA,GACE,GAAA,EAAK,UAAA,CACH,UAAA,QAAkB,MAAA,mCAEpB,QAAA,UACA,IAAA,EAAM,MAAA;IAA4B,OAAA,GAAU,UAAA,CAAW,cAAA;EAAA,MACpD,OAAA;IAAU,EAAA;IAAU,QAAA;EAAA;EACzB,OAAA,GACE,GAAA,EAAK,UAAA,CACH,UAAA,QAAkB,MAAA,oCAEpB,IAAA;IACE,MAAA;IACA,OAAA;IACA,OAAA,GAAU,UAAA,CAAW,cAAA;IACrB,MAAA,GAAS,SAAA,CAAU,cAAA;IACnB,QAAA;EAAA,MAEC,UAAA,CAAW,UAAA,QAAkB,MAAA;EAClC,OAAA,GACE,GAAA,EAAK,UAAA,CACH,UAAA,QAAkB,MAAA,oCAEpB,IAAA;IACE,MAAA;IACA,OAAA;IACA,OAAA,GAAU,UAAA,CAAW,cAAA;IACrB,MAAA,GAAS,SAAA,CAAU,cAAA;IACnB,QAAA;EAAA,MAEC,UAAA,CAAW,UAAA,QAAkB,MAAA;AAAA;AAAA,KAG/B,0BAAA,wBACoB,uBAAA;EAEvB,KAAA,GACE,GAAA,EAAK,UAAA,CACH,UAAA,QAAkB,MAAA,kCAEpB,IAAA;IACE,MAAA;IACA,OAAA;IACA,MAAA,EAAQ,SAAA,CAAU,cAAA;IAClB,QAAA;EAAA,MAEC,UAAA,CAAW,UAAA,QAAkB,MAAA;EAClC,OAAA,GACE,GAAA,EAAK,UAAA,CACH,UAAA,QAAkB,MAAA,oCAEpB,IAAA;IACE,MAAA;IACA,OAAA;IACA,MAAA,EAAQ,SAAA,CAAU,cAAA;IAClB,QAAA;EAAA,MAEC,UAAA,CAAW,UAAA,QAAkB,MAAA;AAAA;;KAIxB,WAAA,wBACa,uBAAA;EAEvB,MAAA,EAAQ,UAAA,QAAkB,MAAA;EAC1B,OAAA,EAAS,UAAA,QAAkB,MAAA;EAC3B,KAAA,EAAO,UAAA,QAAkB,MAAA;EACzB,IAAA,EAAM,UAAA,QAAkB,MAAA;EACxB,OAAA,EAAS,UAAA,QAAkB,MAAA;EAC3B,QAAA,EAAU,UAAA,QAAkB,MAAA;EAC5B,OAAA,EAAS,UAAA,QAAkB,MAAA;EAC3B,KAAA,EAAO,UAAA,QAAkB,MAAA;EACzB,MAAA,EAAQ,0BAAA,CAA2B,cAAA;EACnC,MAAA,EAAQ,0BAAA,CAA2B,cAAA;EACnC,MAAA,EAAQ,UAAA,QAAkB,MAAA;EAC1B,GAAA,EAAK,UAAA,QAAkB,MAAA;EACvB,IAAA,EAAM,UAAA,QAAkB,MAAA;AAAA;AAAA,KAGrB,cAAA,GAAiB,UAAA,QAAkB,MAAA;AAAA,KAEnC,iBAAA;EACH,UAAA,EAAY,cAAA;IACV,MAAA;MACE,IAAA,EAAM,cAAA;MACN,QAAA,EAAU,cAAA;MACV,GAAA,GACE,GAAA,EAAK,UAAA,CAAW,cAAA,8BAChB,YAAA,UACA,OAAA,EAAS,KAAA;QACP,MAAA;QACA,SAAA;MAAA,OAEC,OAAA;QACH,EAAA;QACA,YAAA;QACA,OAAA,EAAS,KAAA;UACP,QAAA;UACA,MAAA;UACA,SAAA;UACA,QAAA;UACA,UAAA;QAAA;MAAA;MAGJ,YAAA;QACE,OAAA,GACE,GAAA,EAAK,UAAA,CAAW,cAAA,8BAChB,IAAA;UAAQ,YAAA;UAAsB,MAAA;QAAA,MAC3B,OAAA;UACH,EAAA;UACA,YAAA;UACA,MAAA;UACA,WAAA;UACA,SAAA;UACA,SAAA;YACE,UAAA;YACA,UAAA;YACA,WAAA;UAAA;QAAA;QAGJ,OAAA,GACE,GAAA,EAAK,UAAA,CAAW,cAAA,8BAChB,IAAA;UAAQ,YAAA;UAAsB,MAAA;QAAA,MAC3B,OAAA;UACH,EAAA;UACA,YAAA;UACA,MAAA;UACA,UAAA;UACA,MAAA,EAAQ,KAAA;YAAQ,IAAA;YAAc,EAAA;YAAa,OAAA;UAAA;QAAA;MAAA;IAAA;EAAA;EAKnD,IAAA,EAAM,IAAA,CAAK,cAAA;EACX,IAAA,EAAM,IAAA,CAAK,cAAA;EACX,MAAA,EAAQ,cAAA;EACR,KAAA;IACE,IAAA,EAAM,cAAA;EAAA;EAER,OAAA;IACE,QAAA,EAAU,cAAA;IACV,QAAA;MACE,IAAA,EAAM,cAAA;IAAA;EAAA;AAAA;AAAA,KAKP,kBAAA;EACH,MAAA,EAAQ,cAAA;EACR,QAAA,EAAU,cAAA;AAAA;AAAA,KAGP,YAAA;EACH,KAAA,EAAO,iBAAA;EACP,MAAA,EAAQ,kBAAA;AAAA;AAAA,KAGL,aAAA;EACH,KAAA,EAAO,IAAA,CAAK,cAAA;AAAA;;KAIF,OAAA,wBACa,uBAAA,4BACrB,WAAA,CAAY,cAAA;EACd,GAAA,EAAK,YAAA;EACL,IAAA,EAAM,aAAA;AAAA;;;;;;KAQI,gBAAA,WACA,kBAAA,2BACa,uBAAA,4BAEvB,MAAA,CAAO,CAAA,iBACH,OAAA,CAAQ,cAAA,IACR,WAAA,CAAY,cAAA;;;;;;;;;;;;;;;;KAiBN,cAAA,MACV,CAAA,SAAU,gBAAA,YACN,WAAA,CACE,kBAAA,CAAmB,CAAA,GACnB,eAAA,CAAgB,CAAA,GAChB,iBAAA,CAAkB,CAAA,KAEpB,WAAA;;;;;;;;iBAgBU,UAAA,WACJ,kBAAA,2BACa,uBAAA,yBAAA,CAEvB,SAAA,EAAW,gBAAA,eACX,MAAA,EAAQ,IAAA,CAAK,UAAA;EACX,SAAA,EAAW,CAAA;EACX,aAAA,GAAgB,cAAA;AAAA,IAEjB,gBAAA,CAAiB,CAAA,EAAG,cAAA;AAAA,iBA6LP,WAAA,sBACO,MAAA;EAEjB,KAAA;EAAgB,MAAA;AAAA,GAAA,CAGpB,KAAA,EAAO,MAAA,iBAEK,MAAA;EACV,EAAA,EAAI,CAAA;EACJ,KAAA,GAAQ,MAAA,CAAO,CAAA;EACf,MAAA,EAAQ,KAAA,CAAM,MAAA,CAAO,CAAA;AAAA;AAAA,KAyBb,OAAA,GAAU,GAAA;AAAA,KAEV,aAAA,kBACO,MAAA,oBAA0B,MAAA;EAE3C,QAAA;EACA,OAAA,IAAW,GAAA,OAAU,IAAA,EAAM,OAAA,KAAY,OAAA,CAAQ,QAAA,IAAY,QAAA;AAAA;;iBAI7C,OAAA,kBACG,MAAA,oBAA0B,MAAA,gBAAA,CAE3C,IAAA,EAAM,QAAA,EACN,MAAA,EAAQ,aAAA,CAAc,QAAA;EAAc,QAAA;AAAA;EAEpC,IAAA;EACA,KAAA,GACE,GAAA,OACA,KAAA,OACA,MAAA,WACG,OAAA;IACH,GAAA;MACE,IAAA;QACE,eAAA,QAAuB,OAAA,CAAQ,YAAA;QAC/B,MAAA,EAAQ,SAAA;QACR,IAAA,EAAM,OAAA;MAAA,IACJ,QAAA;IAAA;IAEN,IAAA;EAAA;AAAA;;iBAIY,OAAA,kBACG,MAAA,oBAA0B,MAAA,gBAAA,CAE3C,IAAA,EAAM,QAAA,EACN,MAAA,GAAS,aAAA,CAAc,QAAA;EAEvB,IAAA;EACA,KAAA,GACE,GAAA,OACA,KAAA,OACA,MAAA,WACG,OAAA;IACH,GAAA;MACE,IAAA;QACE,eAAA,QAAuB,OAAA,CAAQ,YAAA;QAC/B,MAAA,EAAQ,SAAA;QACR,IAAA,EAAM,OAAA;MAAA,IACJ,QAAA;IAAA;IAEN,IAAA;EAAA;AAAA;AAAA,KAgEQ,SAAA;EACE,KAAA,MAAW,IAAA,YAAgB,OAAA;IAAU,GAAA;MAAO,IAAA;IAAA;EAAA;AAAA,KACtD,OAAA,CAAQ,UAAA,CAAW,CAAA"}

package/dist/server/auth.js

@@ -1,13 +1,13 @@
-import { Fx } from "./fx.js";
-import { Auth } from "./implementation.js";
+import { AuthError, Fx } from "./fx.js";
+import { Auth } from "./factory.js";
 
 //#region src/server/auth.ts
 /**
 * Create an auth API object.
 *
-* When `new SSO()` is included in providers, `auth.sso` is available
-* on the returned object. Without it, `auth.sso` is absent and
-* accessing it is a TypeScript compile error.
+* When `new SSO()` is included in providers, `auth.sso` and `auth.scim`
+* are available on the returned object. Without it, those namespaces are
+* absent and accessing them is a TypeScript compile error.
 */
 function createAuth(component, config) {
 	const authResult = Auth({
@@ -15,6 +15,86 @@ function createAuth(component, config) {
 		component,
 		providers: [...config.providers]
 	});
+	const { domain: domainApi, scim: scimApi, connection: connectionApi, audit: auditApi, webhook: webhookApi, oidc: oidcApi, saml: samlApi, ...restSso } = authResult.auth.sso;
+	const setEnterpriseDomains = async (ctx, enterpriseId, domains) => {
+		const enterprise = await connectionApi.get(ctx, enterpriseId);
+		if (enterprise === null) throw new AuthError("INVALID_PARAMETERS", "Enterprise not found.").toConvexError();
+		const normalized = domains.map((entry) => ({
+			...entry,
+			domain: entry.domain.trim().toLowerCase()
+		}));
+		const deduped = /* @__PURE__ */ new Map();
+		for (const entry of normalized) {
+			if (entry.domain.length === 0) throw new AuthError("INVALID_PARAMETERS", "Domain must not be empty.").toConvexError();
+			if (deduped.has(entry.domain)) throw new AuthError("INVALID_PARAMETERS", `Duplicate domain: ${entry.domain}`).toConvexError();
+			deduped.set(entry.domain, entry);
+		}
+		const nextDomains = [...deduped.values()];
+		const primaryCount = nextDomains.filter((entry) => entry.isPrimary).length;
+		if (primaryCount > 1) throw new AuthError("INVALID_PARAMETERS", "Only one primary domain may be set.").toConvexError();
+		if (nextDomains.length > 0 && primaryCount === 0) nextDomains[0] = {
+			...nextDomains[0],
+			isPrimary: true
+		};
+		const currentDomains = await domainApi.list(ctx, enterpriseId);
+		const currentByDomain = new Map(currentDomains.map((entry) => [entry.domain.toLowerCase(), entry]));
+		for (const existing of currentDomains) if (!deduped.has(existing.domain.toLowerCase())) await domainApi.remove(ctx, existing._id);
+		for (const nextDomain of nextDomains) {
+			const current = currentByDomain.get(nextDomain.domain);
+			if (current && current.isPrimary === Boolean(nextDomain.isPrimary)) continue;
+			if (current) await domainApi.remove(ctx, current._id);
+			const domainId = await domainApi.add(ctx, {
+				enterpriseId: enterprise._id,
+				groupId: enterprise.groupId,
+				domain: nextDomain.domain,
+				isPrimary: nextDomain.isPrimary
+			});
+			if (current?.verifiedAt !== void 0) await ctx.runMutation(component.public.enterpriseDomainVerify, {
+				domainId,
+				verifiedAt: current.verifiedAt
+			});
+		}
+		return {
+			ok: true,
+			enterpriseId,
+			domains: (await domainApi.list(ctx, enterpriseId)).map((domain) => ({
+				domainId: domain._id,
+				domain: domain.domain,
+				isPrimary: domain.isPrimary,
+				verified: domain.verifiedAt !== void 0,
+				verifiedAt: domain.verifiedAt ?? null
+			}))
+		};
+	};
+	const publicSso = {
+		admin: {
+			...restSso,
+			oidc: { ...oidcApi },
+			saml: { ...samlApi },
+			connection: {
+				...connectionApi,
+				domain: {
+					list: domainApi.list,
+					validate: domainApi.validate,
+					set: setEnterpriseDomains,
+					verification: {
+						request: domainApi.verification.request,
+						confirm: domainApi.verification.confirm
+					}
+				}
+			},
+			policy: restSso.policy,
+			audit: { list: auditApi.list },
+			webhook: {
+				endpoint: webhookApi.endpoint,
+				delivery: { list: webhookApi.delivery.list }
+			}
+		},
+		client: {
+			signIn: oidcApi.signIn,
+			metadata: samlApi.metadata
+		}
+	};
 	return {
 		signIn: authResult.signIn,
 		signOut: authResult.signOut,
@@ -25,12 +105,25 @@ function createAuth(component, config) {
 		account: authResult.auth.account,
 		group: authResult.auth.group,
 		member: authResult.auth.member,
+		access: authResult.auth.access,
 		invite: authResult.auth.invite,
 		key: authResult.auth.key,
-		sso: authResult.auth.sso,
+		sso: publicSso,
+		scim: { admin: {
+			configure: scimApi.configure,
+			get: scimApi.get,
+			validate: scimApi.validate
+		} },
 		http: authResult.auth.http
 	};
 }
+function defineRoles(roles) {
+	return Object.fromEntries(Object.entries(roles).map(([id, role]) => [id, {
+		id,
+		...role.label ? { label: role.label } : {},
+		grants: [...role.grants]
+	}]));
+}
 function AuthCtx(auth, config) {
 	return {
 		args: {},
@@ -77,5 +170,5 @@ function AuthCtx(auth, config) {
 }
 
 //#endregion
-export { AuthCtx, createAuth };
+export { AuthCtx, createAuth, defineRoles };
 //# sourceMappingURL=auth.js.map