@robelest/convex-auth 0.0.4-preview.13 → 0.0.4-preview.16

package/src/server/index.ts

@@ -1,21 +1,787 @@
 import { ConvexHttpClient } from "convex/browser";
-import { makeFunctionReference } from "convex/server";
-import { ConvexError } from "convex/values";
+import {
+  actionGeneric,
+  makeFunctionReference,
+  mutationGeneric,
+  queryGeneric,
+} from "convex/server";
+import { ConvexError, v } from "convex/values";
 import { parse, serialize } from "cookie";
 import { jwtDecode } from "jwt-decode";
 
-import { Fx } from "./fx";
+import type { AuthApi } from "./auth";
+import {
+  enterpriseConnectionWhereValidator,
+  enterpriseDomainInputValidator,
+  enterpriseDomainVerificationInputValidator,
+  enterprisePolicyPatchValidator,
+  enterpriseSamlAttributeMappingValidator,
+  enterpriseSamlSpValidator,
+  enterpriseStatusValidator,
+} from "./enterpriseValidators";
 import type {
   SignInAction,
   SignInActionResult,
   SignOutAction,
-} from "./implementation";
+} from "./factory";
+import { Fx } from "./fx";
+import type { AuthAuthorizationConfig, AuthRoleId } from "./types";
 import { isLocalHost } from "./utils";
 
-const signInActionRef: SignInAction =
-  makeFunctionReference("auth/session:start");
-const signOutActionRef: SignOutAction =
-  makeFunctionReference("auth/session:stop");
+const signInActionRef: SignInAction = makeFunctionReference("auth:signIn");
+const signOutActionRef: SignOutAction = makeFunctionReference("auth:signOut");
+
+export type EnterpriseAdminPermission =
+  | "sso.connection.create"
+  | "sso.connection.read"
+  | "sso.connection.manage"
+  | "sso.domain.manage"
+  | "sso.protocol.manage"
+  | "sso.policy.manage"
+  | "sso.audit.read"
+  | "sso.webhook.manage"
+  | "scim.manage";
+
+export type EnterpriseAdminAuthorizationInput = {
+  userId: string;
+  permission: EnterpriseAdminPermission;
+  enterpriseId?: string;
+  groupId?: string;
+  resolvedGroupId: string | null;
+};
+
+export type EnterpriseAuthorizer = (
+  ctx: { auth: import("convex/server").Auth },
+  input: EnterpriseAdminAuthorizationInput,
+) => Promise<void>;
+
+type RoleRef<TRoleId extends string> = { id: TRoleId };
+
+type MountedEnterpriseOptions<TRoleId extends string = string> = {
+  admin?: {
+    authorized?: EnterpriseAuthorizer;
+    roles?: Array<TRoleId | RoleRef<TRoleId>>;
+  };
+};
+
+export type EnterpriseMountOptions<TRoleId extends string = string> = {
+  admin: {
+    authorized: EnterpriseAuthorizer;
+    roles?: Array<TRoleId | RoleRef<TRoleId>>;
+  };
+};
+
+type MountedEnterpriseTarget = {
+  enterpriseId?: string;
+  groupId?: string;
+  domain?: string;
+};
+
+function requireSignedInUser(auth: Pick<AuthApi, "user">) {
+  return async (ctx: { auth: import("convex/server").Auth }) => {
+    return await auth.user.require(ctx as never);
+  };
+}
+
+function normalizeCreatorRoleIds<TRoleId extends string>(
+  roles?: Array<TRoleId | RoleRef<TRoleId>>,
+) {
+  return roles?.map((role) => (typeof role === "string" ? role : role.id));
+}
+
+async function resolveMountedEnterpriseTarget(
+  auth: Pick<AuthApi, "sso">,
+  ctx: { auth: import("convex/server").Auth },
+  target: MountedEnterpriseTarget,
+) {
+  if (target.groupId !== undefined) {
+    return {
+      enterpriseId: target.enterpriseId,
+      groupId: target.groupId,
+      resolvedGroupId: target.groupId,
+    };
+  }
+
+  if (target.enterpriseId !== undefined) {
+    const enterprise = await auth.sso.admin.connection.get(
+      ctx as never,
+      target.enterpriseId,
+    );
+    if (enterprise === null) {
+      throw new ConvexError({
+        code: "INVALID_PARAMETERS",
+        message: "Enterprise not found.",
+      });
+    }
+    return {
+      enterpriseId: enterprise._id,
+      groupId: enterprise.groupId,
+      resolvedGroupId: enterprise.groupId,
+    };
+  }
+
+  if (target.domain !== undefined) {
+    const resolved = await auth.sso.admin.connection.getByDomain(
+      ctx as never,
+      target.domain,
+    );
+    if (resolved?.enterprise === undefined) {
+      throw new ConvexError({
+        code: "INVALID_PARAMETERS",
+        message: "Enterprise not found.",
+      });
+    }
+    return {
+      enterpriseId: resolved.enterprise._id,
+      groupId: resolved.enterprise.groupId,
+      resolvedGroupId: resolved.enterprise.groupId,
+    };
+  }
+
+  return {
+    enterpriseId: undefined,
+    groupId: undefined,
+    resolvedGroupId: null,
+  };
+}
+
+function createMountedAdminAuthorizer(
+  auth: Pick<AuthApi, "sso" | "user">,
+  options?: MountedEnterpriseOptions,
+) {
+  const requireUserId = requireSignedInUser(auth);
+
+  return async (
+    ctx: { auth: import("convex/server").Auth },
+    permission: EnterpriseAdminPermission,
+    target: MountedEnterpriseTarget = {},
+  ) => {
+    const userId = await requireUserId(ctx);
+    if (!options?.admin?.authorized) {
+      throw new ConvexError({
+        code: "FORBIDDEN",
+        message:
+          "Mounted enterprise admin APIs require an authorized callback.",
+      });
+    }
+    const resolved = await resolveMountedEnterpriseTarget(auth, ctx, target);
+    await options.admin.authorized(ctx, {
+      userId,
+      permission,
+      enterpriseId: resolved.enterpriseId,
+      groupId: resolved.groupId,
+      resolvedGroupId: resolved.resolvedGroupId,
+    });
+    return { userId, ...resolved };
+  };
+}
+
+/**
+ * Build optional public SSO management actions that apps can mount under
+ * `convex/auth/sso/**` when they want client-callable enterprise APIs.
+ *
+ * `admin` is for tenant-admin control-plane operations and should be mounted
+ * with an explicit authorization policy. `client` is for end-user sign-in
+ * helpers and does not require tenant-admin authorization.
+ */
+export function sso<
+  TAuthorization extends AuthAuthorizationConfig | undefined = undefined,
+>(
+  auth: Pick<AuthApi<TAuthorization>, "group" | "member" | "sso" | "user">,
+  options?: MountedEnterpriseOptions<AuthRoleId<TAuthorization>>,
+) {
+  const authorize = createMountedAdminAuthorizer(auth, options);
+  const adminRoleIds = normalizeCreatorRoleIds(options?.admin?.roles);
+
+  return {
+    admin: {
+      connection: {
+        create: mutationGeneric({
+          args: {
+            groupId: v.optional(v.string()),
+            name: v.optional(v.string()),
+            slug: v.optional(v.string()),
+            status: v.optional(enterpriseStatusValidator),
+            domain: v.optional(v.string()),
+          },
+          handler: async (ctx, args) => {
+            const { userId } = await authorize(ctx, "sso.connection.create", {
+              groupId: args.groupId,
+            });
+            const createsGroup = args.groupId === undefined;
+            const groupId =
+              args.groupId ??
+              (
+                await auth.group.create(ctx as never, {
+                  name: args.name?.trim() || args.slug?.trim() || "Enterprise",
+                  slug: args.slug,
+                  type: "enterprise",
+                })
+              ).groupId;
+            if (createsGroup) {
+              await auth.member.create(ctx as never, {
+                groupId,
+                userId,
+                roleIds: adminRoleIds,
+              });
+            }
+            const created = await auth.sso.admin.connection.create(
+              ctx as never,
+              {
+                groupId,
+                name: args.name,
+                slug: args.slug,
+                status: args.status,
+              },
+            );
+            if (args.domain) {
+              await auth.sso.admin.connection.domain.set(
+                ctx as never,
+                created.enterpriseId,
+                [{ domain: args.domain, isPrimary: true }],
+              );
+            }
+            return {
+              ...created,
+              groupId,
+              createdGroup: createsGroup,
+            };
+          },
+        }),
+        get: queryGeneric({
+          args: { enterpriseId: v.string() },
+          handler: async (ctx, args) => {
+            await authorize(ctx, "sso.connection.read", {
+              enterpriseId: args.enterpriseId,
+            });
+            return await auth.sso.admin.connection.get(
+              ctx as never,
+              args.enterpriseId,
+            );
+          },
+        }),
+        getByGroup: queryGeneric({
+          args: { groupId: v.string() },
+          handler: async (ctx, args) => {
+            await authorize(ctx, "sso.connection.read", {
+              groupId: args.groupId,
+            });
+            return await auth.sso.admin.connection.getByGroup(
+              ctx as never,
+              args.groupId,
+            );
+          },
+        }),
+        getByDomain: queryGeneric({
+          args: { domain: v.string() },
+          handler: async (ctx, args) => {
+            await authorize(ctx, "sso.connection.read", {
+              domain: args.domain,
+            });
+            return await auth.sso.admin.connection.getByDomain(
+              ctx as never,
+              args.domain,
+            );
+          },
+        }),
+        list: queryGeneric({
+          args: {
+            where: v.optional(enterpriseConnectionWhereValidator),
+            limit: v.optional(v.number()),
+            cursor: v.optional(v.union(v.string(), v.null())),
+            orderBy: v.optional(v.string()),
+            order: v.optional(v.union(v.literal("asc"), v.literal("desc"))),
+          },
+          handler: async (ctx, args) => {
+            await authorize(ctx, "sso.connection.read", {
+              groupId: args.where?.groupId,
+            });
+            return await auth.sso.admin.connection.list(
+              ctx as never,
+              args as never,
+            );
+          },
+        }),
+        update: mutationGeneric({
+          args: {
+            enterpriseId: v.string(),
+            data: v.object({
+              name: v.optional(v.string()),
+              slug: v.optional(v.string()),
+              status: v.optional(enterpriseStatusValidator),
+            }),
+          },
+          handler: async (ctx, args) => {
+            await authorize(ctx, "sso.connection.manage", {
+              enterpriseId: args.enterpriseId,
+            });
+            await auth.sso.admin.connection.update(
+              ctx as never,
+              args.enterpriseId,
+              args.data,
+            );
+            return { ok: true as const, enterpriseId: args.enterpriseId };
+          },
+        }),
+        delete: mutationGeneric({
+          args: { enterpriseId: v.string() },
+          handler: async (ctx, args) => {
+            await authorize(ctx, "sso.connection.manage", {
+              enterpriseId: args.enterpriseId,
+            });
+            return await auth.sso.admin.connection.delete(
+              ctx as never,
+              args.enterpriseId,
+            );
+          },
+        }),
+        status: queryGeneric({
+          args: { enterpriseId: v.string() },
+          handler: async (ctx, args) => {
+            await authorize(ctx, "sso.connection.read", {
+              enterpriseId: args.enterpriseId,
+            });
+            return await auth.sso.admin.connection.status(
+              ctx as never,
+              args.enterpriseId,
+            );
+          },
+        }),
+        domain: {
+          list: queryGeneric({
+            args: { enterpriseId: v.string() },
+            handler: async (ctx, args) => {
+              await authorize(ctx, "sso.connection.read", {
+                enterpriseId: args.enterpriseId,
+              });
+              return await auth.sso.admin.connection.domain.list(
+                ctx as never,
+                args.enterpriseId,
+              );
+            },
+          }),
+          validate: queryGeneric({
+            args: { enterpriseId: v.string() },
+            handler: async (ctx, args) => {
+              await authorize(ctx, "sso.domain.manage", {
+                enterpriseId: args.enterpriseId,
+              });
+              return await auth.sso.admin.connection.domain.validate(
+                ctx as never,
+                args.enterpriseId,
+              );
+            },
+          }),
+          set: mutationGeneric({
+            args: {
+              enterpriseId: v.string(),
+              domains: v.array(enterpriseDomainInputValidator),
+            },
+            handler: async (ctx, args) => {
+              await authorize(ctx, "sso.domain.manage", {
+                enterpriseId: args.enterpriseId,
+              });
+              return await auth.sso.admin.connection.domain.set(
+                ctx as never,
+                args.enterpriseId,
+                args.domains,
+              );
+            },
+          }),
+          verification: {
+            request: mutationGeneric({
+              args: enterpriseDomainVerificationInputValidator,
+              handler: async (ctx, args) => {
+                await authorize(ctx, "sso.domain.manage", {
+                  enterpriseId: args.enterpriseId,
+                });
+                return await auth.sso.admin.connection.domain.verification.request(
+                  ctx as never,
+                  args,
+                );
+              },
+            }),
+            confirm: actionGeneric({
+              args: enterpriseDomainVerificationInputValidator,
+              handler: async (ctx, args) => {
+                await authorize(ctx, "sso.domain.manage", {
+                  enterpriseId: args.enterpriseId,
+                });
+                return await auth.sso.admin.connection.domain.verification.confirm(
+                  ctx as never,
+                  args,
+                );
+              },
+            }),
+          },
+        },
+      },
+      oidc: {
+        configure: mutationGeneric({
+          args: {
+            enterpriseId: v.string(),
+            issuer: v.optional(v.string()),
+            discoveryUrl: v.optional(v.string()),
+            clientId: v.string(),
+            clientSecret: v.optional(v.string()),
+            scopes: v.optional(v.array(v.string())),
+            authorizationParams: v.optional(v.record(v.string(), v.string())),
+            clockToleranceSeconds: v.optional(v.number()),
+            strictIssuer: v.optional(v.boolean()),
+            extraFields: v.optional(v.record(v.string(), v.string())),
+          },
+          handler: async (ctx, args) => {
+            await authorize(ctx, "sso.protocol.manage", {
+              enterpriseId: args.enterpriseId,
+            });
+            return await auth.sso.admin.oidc.configure(ctx as never, args);
+          },
+        }),
+        get: queryGeneric({
+          args: { enterpriseId: v.string() },
+          handler: async (ctx, args) => {
+            await authorize(ctx, "sso.connection.read", {
+              enterpriseId: args.enterpriseId,
+            });
+            return await auth.sso.admin.oidc.get(
+              ctx as never,
+              args.enterpriseId,
+            );
+          },
+        }),
+        validate: actionGeneric({
+          args: { enterpriseId: v.string() },
+          handler: async (ctx, args) => {
+            await authorize(ctx, "sso.protocol.manage", {
+              enterpriseId: args.enterpriseId,
+            });
+            return await auth.sso.admin.oidc.validate(
+              ctx as never,
+              args.enterpriseId,
+            );
+          },
+        }),
+      },
+      saml: {
+        configure: actionGeneric({
+          args: {
+            enterpriseId: v.string(),
+            metadataXml: v.optional(v.string()),
+            metadataUrl: v.optional(v.string()),
+            domains: v.optional(v.array(v.string())),
+            signAuthnRequests: v.optional(v.boolean()),
+            attributeMapping: v.optional(
+              enterpriseSamlAttributeMappingValidator,
+            ),
+            sp: v.optional(enterpriseSamlSpValidator),
+          },
+          handler: async (ctx, args) => {
+            await authorize(ctx, "sso.protocol.manage", {
+              enterpriseId: args.enterpriseId,
+            });
+            return await auth.sso.admin.saml.configure(ctx as never, args);
+          },
+        }),
+        validate: queryGeneric({
+          args: { enterpriseId: v.string() },
+          handler: async (ctx, args) => {
+            await authorize(ctx, "sso.protocol.manage", {
+              enterpriseId: args.enterpriseId,
+            });
+            return await auth.sso.admin.saml.validate(
+              ctx as never,
+              args.enterpriseId,
+            );
+          },
+        }),
+      },
+      policy: {
+        get: queryGeneric({
+          args: { enterpriseId: v.string() },
+          handler: async (ctx, args) => {
+            await authorize(ctx, "sso.connection.read", {
+              enterpriseId: args.enterpriseId,
+            });
+            return await auth.sso.admin.policy.get(
+              ctx as never,
+              args.enterpriseId,
+            );
+          },
+        }),
+        update: mutationGeneric({
+          args: {
+            enterpriseId: v.string(),
+            patch: enterprisePolicyPatchValidator,
+          },
+          handler: async (ctx, args) => {
+            await authorize(ctx, "sso.policy.manage", {
+              enterpriseId: args.enterpriseId,
+            });
+            return await auth.sso.admin.policy.update(
+              ctx as never,
+              args.enterpriseId,
+              args.patch,
+            );
+          },
+        }),
+        validate: queryGeneric({
+          args: { enterpriseId: v.string() },
+          handler: async (ctx, args) => {
+            await authorize(ctx, "sso.policy.manage", {
+              enterpriseId: args.enterpriseId,
+            });
+            return await auth.sso.admin.policy.validate(
+              ctx as never,
+              args.enterpriseId,
+            );
+          },
+        }),
+      },
+      audit: {
+        list: queryGeneric({
+          args: {
+            enterpriseId: v.optional(v.string()),
+            groupId: v.optional(v.string()),
+            limit: v.optional(v.number()),
+          },
+          handler: async (ctx, args) => {
+            await authorize(ctx, "sso.audit.read", {
+              enterpriseId: args.enterpriseId,
+              groupId: args.groupId,
+            });
+            return await auth.sso.admin.audit.list(ctx as never, args);
+          },
+        }),
+      },
+      webhook: {
+        delivery: {
+          list: queryGeneric({
+            args: {
+              enterpriseId: v.string(),
+              limit: v.optional(v.number()),
+            },
+            handler: async (ctx, args) => {
+              await authorize(ctx, "sso.webhook.manage", {
+                enterpriseId: args.enterpriseId,
+              });
+              return await (auth.sso.admin.webhook as any).delivery.list(
+                ctx as never,
+                args,
+              );
+            },
+          }),
+        },
+        endpoint: {
+          create: mutationGeneric({
+            args: {
+              enterpriseId: v.string(),
+              url: v.string(),
+              secret: v.string(),
+              subscriptions: v.array(v.string()),
+              createdByUserId: v.optional(v.string()),
+            },
+            handler: async (ctx, args) => {
+              const { userId } = await authorize(ctx, "sso.webhook.manage", {
+                enterpriseId: args.enterpriseId,
+              });
+              const result = await auth.sso.admin.webhook.endpoint.create(
+                ctx as never,
+                {
+                  ...args,
+                  createdByUserId: args.createdByUserId ?? userId,
+                },
+              );
+              return {
+                _id: result.endpointId,
+                enterpriseId: args.enterpriseId,
+                url: args.url,
+                subscriptions: args.subscriptions,
+                createdByUserId: args.createdByUserId ?? userId,
+                status: "active",
+                failureCount: 0,
+              };
+            },
+          }),
+          list: queryGeneric({
+            args: { enterpriseId: v.string() },
+            handler: async (ctx, args) => {
+              await authorize(ctx, "sso.webhook.manage", {
+                enterpriseId: args.enterpriseId,
+              });
+              const endpoints = await auth.sso.admin.webhook.endpoint.list(
+                ctx as never,
+                args.enterpriseId,
+              );
+              return endpoints.map((endpoint: Record<string, unknown>) => {
+                const { secretHash: _secretHash, ...rest } = endpoint;
+                return rest;
+              });
+            },
+          }),
+          disable: mutationGeneric({
+            args: { endpointId: v.string() },
+            handler: async (ctx, args) => {
+              const endpoint = await auth.sso.admin.webhook.endpoint.get(
+                ctx as never,
+                args.endpointId,
+              );
+              if (!endpoint) {
+                throw new ConvexError({
+                  code: "INVALID_PARAMETERS",
+                  message: "Webhook endpoint not found.",
+                });
+              }
+              await authorize(ctx, "sso.webhook.manage", {
+                enterpriseId: endpoint.enterpriseId,
+                groupId: endpoint.groupId,
+              });
+              return await auth.sso.admin.webhook.endpoint.disable(
+                ctx as never,
+                args.endpointId,
+              );
+            },
+          }),
+        },
+      },
+    },
+    client: {
+      signIn: queryGeneric({
+        args: {
+          enterpriseId: v.optional(v.string()),
+          email: v.optional(v.string()),
+          domain: v.optional(v.string()),
+          redirectTo: v.optional(v.string()),
+        },
+        handler: async (ctx, args) => {
+          return await auth.sso.client.signIn(ctx as never, args);
+        },
+      }),
+      metadata: queryGeneric({
+        args: {
+          enterpriseId: v.string(),
+          entityId: v.optional(v.string()),
+          acsUrl: v.optional(v.string()),
+          sloUrl: v.optional(v.string()),
+        },
+        handler: async (ctx, args) => {
+          return await auth.sso.client.metadata(ctx as never, args);
+        },
+      }),
+    },
+  };
+}
+
+/**
+ * Build optional public SCIM management actions that apps can mount under
+ * `convex/auth/scim/**` when they want client-callable enterprise admin APIs.
+ */
+export function scim<
+  TAuthorization extends AuthAuthorizationConfig | undefined = undefined,
+>(
+  auth: Pick<AuthApi<TAuthorization>, "scim" | "sso" | "user">,
+  options?: MountedEnterpriseOptions<AuthRoleId<TAuthorization>>,
+) {
+  const authorize = createMountedAdminAuthorizer(auth, options);
+
+  return {
+    admin: {
+      configure: mutationGeneric({
+        args: {
+          enterpriseId: v.string(),
+          basePath: v.optional(v.string()),
+          status: v.optional(enterpriseStatusValidator),
+        },
+        handler: async (ctx, args) => {
+          await authorize(ctx, "scim.manage", {
+            enterpriseId: args.enterpriseId,
+          });
+          return await auth.scim.admin.configure(ctx as never, args);
+        },
+      }),
+      get: queryGeneric({
+        args: { enterpriseId: v.string() },
+        handler: async (ctx, args) => {
+          await authorize(ctx, "scim.manage", {
+            enterpriseId: args.enterpriseId,
+          });
+          return await auth.scim.admin.get(ctx as never, args.enterpriseId);
+        },
+      }),
+      validate: queryGeneric({
+        args: { enterpriseId: v.string() },
+        handler: async (ctx, args) => {
+          await authorize(ctx, "scim.manage", {
+            enterpriseId: args.enterpriseId,
+          });
+          return await auth.scim.admin.validate(
+            ctx as never,
+            args.enterpriseId,
+          );
+        },
+      }),
+    },
+  };
+}
+
+/**
+ * Build a flat mounted enterprise API surface for app-owned Convex exports.
+ *
+ * The returned object contains tenant-admin SSO and SCIM control-plane
+ * functions plus end-user enterprise sign-in helpers. The `authorized`
+ * callback is required for admin operations.
+ */
+export function enterprise<
+  TAuthorization extends AuthAuthorizationConfig | undefined = undefined,
+>(
+  auth: Pick<
+    AuthApi<TAuthorization>,
+    "group" | "member" | "scim" | "sso" | "user"
+  >,
+  options: EnterpriseMountOptions<AuthRoleId<TAuthorization>>,
+) {
+  const mountedSso = sso(auth, {
+    admin: options.admin,
+  });
+  const mountedScim = scim(auth, {
+    admin: { authorized: options.admin.authorized },
+  });
+
+  return {
+    createConnection: mountedSso.admin.connection.create,
+    getConnection: mountedSso.admin.connection.get,
+    getConnectionByGroup: mountedSso.admin.connection.getByGroup,
+    getConnectionByDomain: mountedSso.admin.connection.getByDomain,
+    listConnections: mountedSso.admin.connection.list,
+    updateConnection: mountedSso.admin.connection.update,
+    deleteConnection: mountedSso.admin.connection.delete,
+    getConnectionStatus: mountedSso.admin.connection.status,
+    listDomains: mountedSso.admin.connection.domain.list,
+    validateDomains: mountedSso.admin.connection.domain.validate,
+    setDomains: mountedSso.admin.connection.domain.set,
+    requestDomainVerification:
+      mountedSso.admin.connection.domain.verification.request,
+    confirmDomainVerification:
+      mountedSso.admin.connection.domain.verification.confirm,
+    configureOidc: mountedSso.admin.oidc.configure,
+    getOidc: mountedSso.admin.oidc.get,
+    validateOidc: mountedSso.admin.oidc.validate,
+    configureSaml: mountedSso.admin.saml.configure,
+    validateSaml: mountedSso.admin.saml.validate,
+    getPolicy: mountedSso.admin.policy.get,
+    updatePolicy: mountedSso.admin.policy.update,
+    validatePolicy: mountedSso.admin.policy.validate,
+    listAudit: mountedSso.admin.audit.list,
+    createWebhookEndpoint: mountedSso.admin.webhook.endpoint.create,
+    listWebhookEndpoints: mountedSso.admin.webhook.endpoint.list,
+    listWebhookDeliveries: mountedSso.admin.webhook.delivery.list,
+    disableWebhookEndpoint: mountedSso.admin.webhook.endpoint.disable,
+    configureScim: mountedScim.admin.configure,
+    getScim: mountedScim.admin.get,
+    validateScim: mountedScim.admin.validate,
+    signIn: mountedSso.client.signIn,
+    metadata: mountedSso.client.metadata,
+  };
+}
 
 /** Cookie lifetime configuration for auth tokens. */
 export type AuthCookieConfig = {
@@ -588,9 +1354,9 @@ export function server(options: ServerOptions) {
           : {};
 
       const actionDispatch =
-        action === "auth/session:start"
+        action === "auth:signIn"
           ? { action: "sessionStart" as const }
-          : action === "auth/session:stop"
+          : action === "auth:signOut"
             ? { action: "sessionStop" as const }
             : null;
 
@@ -943,37 +1709,37 @@ export function server(options: ServerOptions) {
                                   redirect: () =>
                                     Fx.fatal(
                                       new Error(
-                                        "Invalid `auth/session:start` result for sign-out fallback refresh",
+                                        "Invalid `auth:signIn` result for sign-out fallback refresh",
                                       ),
                                     ),
                                   started: () =>
                                     Fx.fatal(
                                       new Error(
-                                        "Invalid `auth/session:start` result for sign-out fallback refresh",
+                                        "Invalid `auth:signIn` result for sign-out fallback refresh",
                                       ),
                                     ),
                                   passkeyOptions: () =>
                                     Fx.fatal(
                                       new Error(
-                                        "Invalid `auth/session:start` result for sign-out fallback refresh",
+                                        "Invalid `auth:signIn` result for sign-out fallback refresh",
                                       ),
                                     ),
                                   totpRequired: () =>
                                     Fx.fatal(
                                       new Error(
-                                        "Invalid `auth/session:start` result for sign-out fallback refresh",
+                                        "Invalid `auth:signIn` result for sign-out fallback refresh",
                                       ),
                                     ),
                                   totpSetup: () =>
                                     Fx.fatal(
                                       new Error(
-                                        "Invalid `auth/session:start` result for sign-out fallback refresh",
+                                        "Invalid `auth:signIn` result for sign-out fallback refresh",
                                       ),
                                     ),
                                   deviceCode: () =>
                                     Fx.fatal(
                                       new Error(
-                                        "Invalid `auth/session:start` result for sign-out fallback refresh",
+                                        "Invalid `auth:signIn` result for sign-out fallback refresh",
                                       ),
                                     ),
                                 }),
@@ -1146,37 +1912,37 @@ export function server(options: ServerOptions) {
                       redirect: () =>
                         Fx.fatal(
                           new Error(
-                            "Invalid `auth/session:start` result for code exchange",
+                            "Invalid `auth:signIn` result for code exchange",
                           ),
                         ),
                       started: () =>
                         Fx.fatal(
                           new Error(
-                            "Invalid `auth/session:start` result for code exchange",
+                            "Invalid `auth:signIn` result for code exchange",
                           ),
                         ),
                       passkeyOptions: () =>
                         Fx.fatal(
                           new Error(
-                            "Invalid `auth/session:start` result for code exchange",
+                            "Invalid `auth:signIn` result for code exchange",
                           ),
                         ),
                       totpRequired: () =>
                         Fx.fatal(
                           new Error(
-                            "Invalid `auth/session:start` result for code exchange",
+                            "Invalid `auth:signIn` result for code exchange",
                           ),
                         ),
                       totpSetup: () =>
                         Fx.fatal(
                           new Error(
-                            "Invalid `auth/session:start` result for code exchange",
+                            "Invalid `auth:signIn` result for code exchange",
                           ),
                         ),
                       deviceCode: () =>
                         Fx.fatal(
                           new Error(
-                            "Invalid `auth/session:start` result for code exchange",
+                            "Invalid `auth:signIn` result for code exchange",
                           ),
                         ),
                     }),
@@ -1367,37 +2133,37 @@ export function server(options: ServerOptions) {
                       redirect: () =>
                         Fx.fatal(
                           new Error(
-                            "Invalid `auth/session:start` result for token refresh",
+                            "Invalid `auth:signIn` result for token refresh",
                           ),
                         ),
                       started: () =>
                         Fx.fatal(
                           new Error(
-                            "Invalid `auth/session:start` result for token refresh",
+                            "Invalid `auth:signIn` result for token refresh",
                           ),
                         ),
                       passkeyOptions: () =>
                         Fx.fatal(
                           new Error(
-                            "Invalid `auth/session:start` result for token refresh",
+                            "Invalid `auth:signIn` result for token refresh",
                           ),
                         ),
                       totpRequired: () =>
                         Fx.fatal(
                           new Error(
-                            "Invalid `auth/session:start` result for token refresh",
+                            "Invalid `auth:signIn` result for token refresh",
                           ),
                         ),
                       totpSetup: () =>
                         Fx.fatal(
                           new Error(
-                            "Invalid `auth/session:start` result for token refresh",
+                            "Invalid `auth:signIn` result for token refresh",
                           ),
                         ),
                       deviceCode: () =>
                         Fx.fatal(
                           new Error(
-                            "Invalid `auth/session:start` result for token refresh",
+                            "Invalid `auth:signIn` result for token refresh",
                           ),
                         ),
                     }),
@@ -1518,37 +2284,37 @@ export function server(options: ServerOptions) {
                           redirect: () =>
                             Fx.fatal(
                               new Error(
-                                "Invalid `auth/session:start` result for token refresh",
+                                "Invalid `auth:signIn` result for token refresh",
                               ),
                             ),
                           started: () =>
                             Fx.fatal(
                               new Error(
-                                "Invalid `auth/session:start` result for token refresh",
+                                "Invalid `auth:signIn` result for token refresh",
                               ),
                             ),
                           passkeyOptions: () =>
                             Fx.fatal(
                               new Error(
-                                "Invalid `auth/session:start` result for token refresh",
+                                "Invalid `auth:signIn` result for token refresh",
                               ),
                             ),
                           totpRequired: () =>
                             Fx.fatal(
                               new Error(
-                                "Invalid `auth/session:start` result for token refresh",
+                                "Invalid `auth:signIn` result for token refresh",
                               ),
                             ),
                           totpSetup: () =>
                             Fx.fatal(
                               new Error(
-                                "Invalid `auth/session:start` result for token refresh",
+                                "Invalid `auth:signIn` result for token refresh",
                               ),
                             ),
                           deviceCode: () =>
                             Fx.fatal(
                               new Error(
-                                "Invalid `auth/session:start` result for token refresh",
+                                "Invalid `auth:signIn` result for token refresh",
                               ),
                             ),
                         }),
@@ -1643,37 +2409,37 @@ export function server(options: ServerOptions) {
                               redirect: () =>
                                 Fx.fatal(
                                   new Error(
-                                    "Invalid `auth/session:start` result for token refresh",
+                                    "Invalid `auth:signIn` result for token refresh",
                                   ),
                                 ),
                               started: () =>
                                 Fx.fatal(
                                   new Error(
-                                    "Invalid `auth/session:start` result for token refresh",
+                                    "Invalid `auth:signIn` result for token refresh",
                                   ),
                                 ),
                               passkeyOptions: () =>
                                 Fx.fatal(
                                   new Error(
-                                    "Invalid `auth/session:start` result for token refresh",
+                                    "Invalid `auth:signIn` result for token refresh",
                                   ),
                                 ),
                               totpRequired: () =>
                                 Fx.fatal(
                                   new Error(
-                                    "Invalid `auth/session:start` result for token refresh",
+                                    "Invalid `auth:signIn` result for token refresh",
                                   ),
                                 ),
                               totpSetup: () =>
                                 Fx.fatal(
                                   new Error(
-                                    "Invalid `auth/session:start` result for token refresh",
+                                    "Invalid `auth:signIn` result for token refresh",
                                   ),
                                 ),
                               deviceCode: () =>
                                 Fx.fatal(
                                   new Error(
-                                    "Invalid `auth/session:start` result for token refresh",
+                                    "Invalid `auth:signIn` result for token refresh",
                                   ),
                                 ),
                             }),