@robelest/convex-auth 0.0.4-preview.13 → 0.0.4-preview.16

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@robelest/convex-auth",
-  "version": "0.0.4-preview.13",
+  "version": "0.0.4-preview.16",
   "description": "Authentication for Convex",
   "keywords": [
     "auth",
@@ -106,8 +106,7 @@
     "build:version": "vp exec node ../../scripts/generate-version.js",
     "build:lib": "vp exec tsdown",
     "build:component:dts": "vp exec node ../../scripts/fix-component-entrypoint-dts.js",
-    "build:bin": "vp exec esbuild src/cli/index.ts --bundle --platform=node --format=cjs --outfile=dist/bin.cjs",
-    "build": "rm -rf dist && vp run build:version && vp run build:lib && vp run build:component:dts && vp run build:bin",
+    "build": "rm -rf dist && vp run build:version && vp run build:lib && vp run build:component:dts",
     "typecheck": "vp exec tsc --project tsconfig.server.json --noEmit && vp exec tsc --project tsconfig.client.json --noEmit && vp exec tsc --project tsconfig.component.json --noEmit",
     "typecheck:consumer": "vp exec tsc --project tsconfig.consumer.json --noEmit",
     "check:attw": "vp exec attw --pack . --profile esm-only --exclude-entrypoints ./test ./_generated/component.js",
@@ -116,8 +115,8 @@
     "docs": "vp run --cwd ../../docs dev",
     "lint": "vp run typecheck",
     "spellcheck": "cspell \"docs/pages/**/*.md*\"",
-    "test": "vp test --config ../../vite.config.ts --project convex --project node",
-    "test:once": "vp test --config ../../vite.config.ts --run --project convex --project node",
+    "test": "vp test --config ../../vite.config.ts --project convex --project node --project interop",
+    "test:once": "vp test --config ../../vite.config.ts --run --project convex --project node --project interop",
     "convex:dev": "vp exec convex dev",
     "convex:codegen": "vp exec convex codegen",
     "convex:codegen:component": "vp exec convex codegen --component-dir ./src/component",

package/src/cli/bin.ts

@@ -0,0 +1,5 @@
+#!/usr/bin/env node
+
+import { program } from "./index";
+
+program.parse(process.argv);

package/src/cli/index.ts

@@ -1,5 +1,3 @@
-#!/usr/bin/env node
-
 import { execFileSync } from "child_process";
 import {
   existsSync,
@@ -92,7 +90,7 @@ function convexCmd(...subArgs: string[]): { file: string; args: string[] } {
 // Commander program
 // ---------------------------------------------------------------------------
 
-const program = new Command()
+export const program = new Command()
   .name("@robelest/convex-auth")
   .version(version)
   .description(
@@ -174,8 +172,6 @@ program
     p.outro("Done!");
   });
 
-program.parse(process.argv);
-
 // ---------------------------------------------------------------------------
 // Types
 // ---------------------------------------------------------------------------
@@ -284,13 +280,22 @@ async function configureEnvVar(
 // ---------------------------------------------------------------------------
 
 async function configureKeys(config: ProjectConfig) {
-  logStep(config, "Configure private and public key");
-  const { JWT_PRIVATE_KEY, JWKS } = await generateKeys();
+  logStep(config, "Configure signing and encryption keys");
+  const { JWT_PRIVATE_KEY, JWKS, AUTH_SECRET_ENCRYPTION_KEY } =
+    await generateKeys();
   const existingPrivateKey = backendEnvVar(config, "JWT_PRIVATE_KEY");
   const existingJwks = backendEnvVar(config, "JWKS");
-  if (existingPrivateKey !== "" || existingJwks !== "") {
+  const existingSecretEncryptionKey = backendEnvVar(
+    config,
+    "AUTH_SECRET_ENCRYPTION_KEY",
+  );
+  if (
+    existingPrivateKey !== "" ||
+    existingJwks !== "" ||
+    existingSecretEncryptionKey !== ""
+  ) {
     const shouldOverwrite = await promptForConfirmation(
-      `The ${printDeployment(config)} already has JWT_PRIVATE_KEY or JWKS configured. Overwrite them?`,
+      `The ${printDeployment(config)} already has JWT_PRIVATE_KEY, JWKS, or AUTH_SECRET_ENCRYPTION_KEY configured. Overwrite them?`,
       { default: false },
     );
     if (!shouldOverwrite) {
@@ -300,6 +305,14 @@ async function configureKeys(config: ProjectConfig) {
   // Use --from-file to avoid shell quoting issues with multiline values
   await setEnvVarFromFile(config, "JWT_PRIVATE_KEY", JWT_PRIVATE_KEY);
   await setEnvVarFromFile(config, "JWKS", JWKS);
+  await setEnvVar(
+    config,
+    "AUTH_SECRET_ENCRYPTION_KEY",
+    AUTH_SECRET_ENCRYPTION_KEY,
+    {
+      hideValue: true,
+    },
+  );
 }
 
 // ---------------------------------------------------------------------------

package/src/cli/keys.ts

@@ -1,3 +1,5 @@
+import { randomBytes } from "node:crypto";
+
 import { exportJWK, exportPKCS8, generateKeyPair } from "jose";
 
 export async function generateKeys() {
@@ -9,6 +11,7 @@ export async function generateKeys() {
     return {
       JWT_PRIVATE_KEY: `${privateKey.trimEnd().replace(/\n/g, " ")}`,
       JWKS: jwks,
+      AUTH_SECRET_ENCRYPTION_KEY: randomBytes(32).toString("base64url"),
     };
   } catch (error) {
     console.error(

package/src/client/index.ts

@@ -128,13 +128,9 @@ export type AuthApiRefs<
   HasTotp extends boolean = boolean,
   HasDevice extends boolean = boolean,
 > = {
-  session: {
-    start: FunctionReference<"action", "public", any, any>;
-    stop: FunctionReference<"action", "public", any, any>;
-  };
-  store: {
-    run: FunctionReference<"mutation", "public", any, any>;
-  };
+  signIn: FunctionReference<"action", "public", any, any>;
+  signOut: FunctionReference<"action", "public", any, any>;
+  store: FunctionReference<"mutation", "public", any, any>;
   /** @internal Set automatically by `createAuth` — do not set manually. */
   _capabilities?: {
     passkey: HasPasskey;
@@ -194,7 +190,9 @@ export type AuthClient<
   (InferCaps<Api>["device"] extends true ? { device: DeviceClient } : {});
 
 /** Options for {@link client}. */
-export type ClientOptions = {
+export type ClientOptions<
+  Api extends AuthApiRefs<boolean, boolean, boolean> = AuthApiRefs,
+> = {
   /** Any Convex client (`ConvexClient` or `ConvexReactClient`). */
   convex: ConvexTransport;
   /**
@@ -206,11 +204,11 @@ export type ClientOptions = {
    * import { api } from "../convex/_generated/api";
    * client({
    *   convex,
-   *   api: { session: api.auth.session, store: api.auth.store },
+   *   api: api.auth,
    * });
    * ```
    */
-  api?: AuthApiRefs<boolean, boolean, boolean>;
+  api?: Api;
   /**
    * Convex deployment URL. Derived automatically from the client internals
    * when omitted — pass explicitly only if auto-detection fails.
@@ -321,9 +319,10 @@ function isRetriableProxyRefreshError(error: unknown): boolean {
  * ```ts
  * import { ConvexClient } from 'convex/browser';
  * import { client } from '@robelest/convex-auth/client';
+ * import { api } from '../convex/_generated/api';
  *
  * const convex = new ConvexClient(CONVEX_URL);
- * const auth = client({ convex });
+ * const auth = client({ convex, api: api.auth });
  * ```
  *
  * ### SSR / proxy mode
@@ -345,7 +344,7 @@ function isRetriableProxyRefreshError(error: unknown): boolean {
  */
 export function client<
   Api extends AuthApiRefs<boolean, boolean, boolean> = AuthApiRefs,
->(options: ClientOptions): AuthClient<Api> {
+>(options: ClientOptions<Api>): AuthClient<Api> {
   const { convex, proxyPath, api: apiRefs } = options;
   const proxy = proxyPath;
 
@@ -353,7 +352,7 @@ export function client<
     if (!apiRefs) {
       throw new Error(
         "The `api` option is required when `proxyPath` is not set. " +
-          "Pass { api: { session: api.auth.session, store: api.auth.store } }.",
+          "Pass { api: api.auth }.",
       );
     }
     return apiRefs;
@@ -856,7 +855,7 @@ export function client<
       Fx.from({
         ok: () =>
           httpClient!.action(
-            requireApiRefs().session.start,
+            requireApiRefs().signIn,
             "code" in args
               ? { params: { code: args.code }, verifier: args.verifier }
               : args,
@@ -1022,7 +1021,7 @@ export function client<
 
     if (proxy) {
       const result = (await proxyFetch({
-        action: "auth/session:start",
+        action: "auth:signIn",
         args: { provider, params },
       })) as SignInActionResult;
       return handleSignInActionResult(result, {
@@ -1034,7 +1033,7 @@ export function client<
     // SPA mode: call Convex directly.
     const verifier = (await storageGet(VERIFIER_STORAGE_KEY)) ?? undefined;
     await storageRemove(VERIFIER_STORAGE_KEY);
-    const result = (await convex.action(requireApiRefs().session.start, {
+    const result = (await convex.action(requireApiRefs().signIn, {
       provider,
       params,
       verifier,
@@ -1060,7 +1059,7 @@ export function client<
     if (proxy) {
       await Fx.run(
         Fx.from({
-          ok: () => proxyFetch({ action: "auth/session:stop", args: {} }),
+          ok: () => proxyFetch({ action: "auth:signOut", args: {} }),
           err: () => undefined,
         }).pipe(Fx.recover(() => Fx.succeed(undefined))),
       );
@@ -1072,7 +1071,7 @@ export function client<
     // SPA mode.
     await Fx.run(
       Fx.from({
-        ok: () => convex.action(requireApiRefs().session.stop, {}),
+        ok: () => convex.action(requireApiRefs().signOut, {}),
         err: () => undefined,
       }).pipe(Fx.recover(() => Fx.succeed(undefined))),
     );
@@ -1120,7 +1119,7 @@ export function client<
           Fx.from({
             ok: () =>
               proxyFetch({
-                action: "auth/session:start",
+                action: "auth:signIn",
                 args: { refreshToken: true },
               }),
             err: (e) => e,
@@ -1439,11 +1438,11 @@ export function client<
       let phase1Result: SignInActionResult;
       if (proxy) {
         phase1Result = (await proxyFetch({
-          action: "auth/session:start",
+          action: "auth:signIn",
           args: { provider: "passkey", params: phase1Params },
         })) as SignInActionResult;
       } else {
-        phase1Result = (await convex.action(requireApiRefs().session.start, {
+        phase1Result = (await convex.action(requireApiRefs().signIn, {
           provider: "passkey",
           params: phase1Params,
         })) as SignInActionResult;
@@ -1510,7 +1509,7 @@ export function client<
         // In proxy mode the verifier is stored in an httpOnly cookie by the proxy.
         // We pass it back explicitly so the proxy can forward it to Convex.
         phase2Result = (await proxyFetch({
-          action: "auth/session:start",
+          action: "auth:signIn",
           args: {
             provider: "passkey",
             params: phase2Params,
@@ -1518,7 +1517,7 @@ export function client<
           },
         })) as SignInActionResult;
       } else {
-        phase2Result = (await convex.action(requireApiRefs().session.start, {
+        phase2Result = (await convex.action(requireApiRefs().signIn, {
           provider: "passkey",
           params: phase2Params,
           verifier: phase1Result.verifier,
@@ -1614,11 +1613,11 @@ export function client<
       let phase1Result: SignInActionResult;
       if (proxy) {
         phase1Result = (await proxyFetch({
-          action: "auth/session:start",
+          action: "auth:signIn",
           args: { provider: "passkey", params: phase1Params },
         })) as SignInActionResult;
       } else {
-        phase1Result = (await convex.action(requireApiRefs().session.start, {
+        phase1Result = (await convex.action(requireApiRefs().signIn, {
           provider: "passkey",
           params: phase1Params,
         })) as SignInActionResult;
@@ -1670,7 +1669,7 @@ export function client<
       let phase2Result: SignInActionResult;
       if (proxy) {
         phase2Result = (await proxyFetch({
-          action: "auth/session:start",
+          action: "auth:signIn",
           args: {
             provider: "passkey",
             params: phase2Params,
@@ -1678,7 +1677,7 @@ export function client<
           },
         })) as SignInActionResult;
       } else {
-        phase2Result = (await convex.action(requireApiRefs().session.start, {
+        phase2Result = (await convex.action(requireApiRefs().signIn, {
           provider: "passkey",
           params: phase2Params,
           verifier: phase1Result.verifier,
@@ -1757,7 +1756,7 @@ export function client<
 
       if (proxy) {
         const result = await proxyFetch({
-          action: "auth/session:start",
+          action: "auth:signIn",
           args: { provider: "totp", params },
         });
         return {
@@ -1768,7 +1767,7 @@ export function client<
         };
       }
 
-      const result = await convex.action(requireApiRefs().session.start, {
+      const result = await convex.action(requireApiRefs().signIn, {
         provider: "totp",
         params,
       });
@@ -1800,7 +1799,7 @@ export function client<
 
       if (proxy) {
         const result = await proxyFetch({
-          action: "auth/session:start",
+          action: "auth:signIn",
           args: { provider: "totp", params, verifier: opts.verifier },
         });
         if (result.tokens) {
@@ -1815,7 +1814,7 @@ export function client<
         return;
       }
 
-      const result = await convex.action(requireApiRefs().session.start, {
+      const result = await convex.action(requireApiRefs().signIn, {
         provider: "totp",
         params,
         verifier: opts.verifier,
@@ -1850,7 +1849,7 @@ export function client<
 
       if (proxy) {
         const result = await proxyFetch({
-          action: "auth/session:start",
+          action: "auth:signIn",
           args: { provider: "totp", params, verifier: opts.verifier },
         });
         if (result.tokens) {
@@ -1865,7 +1864,7 @@ export function client<
         return;
       }
 
-      const result = await convex.action(requireApiRefs().session.start, {
+      const result = await convex.action(requireApiRefs().signIn, {
         provider: "totp",
         params,
         verifier: opts.verifier,
@@ -1919,11 +1918,11 @@ export function client<
 
               if (proxy) {
                 result = await proxyFetch({
-                  action: "auth/session:start",
+                  action: "auth:signIn",
                   args: { provider: "device", params },
                 });
               } else {
-                result = await convex.action(requireApiRefs().session.start, {
+                result = await convex.action(requireApiRefs().signIn, {
                   provider: "device",
                   params,
                 });
@@ -2013,11 +2012,11 @@ export function client<
 
       if (proxy) {
         await proxyFetch({
-          action: "auth/session:start",
+          action: "auth:signIn",
           args: { provider: "device", params },
         });
       } else {
-        await convex.action(requireApiRefs().session.start, {
+        await convex.action(requireApiRefs().signIn, {
           provider: "device",
           params,
         });

package/src/component/_generated/api.ts

@@ -10,7 +10,14 @@
 
 import type * as functions from "../functions.js";
 import type * as index from "../index.js";
+import type * as model from "../model.js";
 import type * as public_ from "../public.js";
+import type * as public_enterprise from "../public/enterprise.js";
+import type * as public_factors from "../public/factors.js";
+import type * as public_groups from "../public/groups.js";
+import type * as public_identity from "../public/identity.js";
+import type * as public_keys from "../public/keys.js";
+import type * as public_shared from "../public/shared.js";
 
 import type {
   ApiFromModules,
@@ -22,7 +29,14 @@ import { anyApi, componentsGeneric } from "convex/server";
 const fullApi: ApiFromModules<{
   functions: typeof functions;
   index: typeof index;
+  model: typeof model;
   public: typeof public_;
+  "public/enterprise": typeof public_enterprise;
+  "public/factors": typeof public_factors;
+  "public/groups": typeof public_groups;
+  "public/identity": typeof public_identity;
+  "public/keys": typeof public_keys;
+  "public/shared": typeof public_shared;
 }> = anyApi as any;
 
 /**