@robelest/convex-auth 0.0.4-preview.16 → 0.0.4-preview.18

package/dist/server/index.js

@@ -12,7 +12,7 @@ const signInActionRef = makeFunctionReference("auth:signIn");
 const signOutActionRef = makeFunctionReference("auth:signOut");
 function requireSignedInUser(auth) {
 	return async (ctx) => {
-		return await auth.user.require(ctx);
+		return await auth.user.id(ctx);
 	};
 }
 function normalizeCreatorRoleIds(roles) {
@@ -58,19 +58,28 @@ function createMountedAdminAuthorizer(auth, options) {
 	const requireUserId = requireSignedInUser(auth);
 	return async (ctx, permission, target = {}) => {
 		const userId = await requireUserId(ctx);
-		if (!options?.admin?.authorized) throw new ConvexError({
-			code: "FORBIDDEN",
-			message: "Mounted enterprise admin APIs require an authorized callback."
-		});
+		if (userId === null) return {
+			ok: false,
+			code: "NOT_SIGNED_IN"
+		};
+		if (!options?.admin?.authorized) return {
+			ok: false,
+			code: "FORBIDDEN"
+		};
 		const resolved = await resolveMountedEnterpriseTarget(auth, ctx, target);
-		await options.admin.authorized(ctx, {
+		const authResult = await options.admin.authorized(ctx, {
 			userId,
 			permission,
 			enterpriseId: resolved.enterpriseId,
 			groupId: resolved.groupId,
 			resolvedGroupId: resolved.resolvedGroupId
 		});
+		if (authResult && !authResult.ok) return {
+			ok: false,
+			code: "FORBIDDEN"
+		};
 		return {
+			ok: true,
 			userId,
 			...resolved
 		};
@@ -99,7 +108,12 @@ function sso(auth, options) {
 						domain: v.optional(v.string())
 					},
 					handler: async (ctx, args) => {
-						const { userId } = await authorize(ctx, "sso.connection.create", { groupId: args.groupId });
+						const authResult = await authorize(ctx, "sso.connection.create", { groupId: args.groupId });
+						if (!authResult.ok) return {
+							ok: false,
+							code: authResult.code
+						};
+						const { userId } = authResult;
 						const createsGroup = args.groupId === void 0;
 						const groupId = args.groupId ?? (await auth.group.create(ctx, {
 							name: args.name?.trim() || args.slug?.trim() || "Enterprise",
@@ -131,21 +145,21 @@ function sso(auth, options) {
 				get: queryGeneric({
 					args: { enterpriseId: v.string() },
 					handler: async (ctx, args) => {
-						await authorize(ctx, "sso.connection.read", { enterpriseId: args.enterpriseId });
+						if (!(await authorize(ctx, "sso.connection.read", { enterpriseId: args.enterpriseId })).ok) return null;
 						return await auth.sso.admin.connection.get(ctx, args.enterpriseId);
 					}
 				}),
 				getByGroup: queryGeneric({
 					args: { groupId: v.string() },
 					handler: async (ctx, args) => {
-						await authorize(ctx, "sso.connection.read", { groupId: args.groupId });
+						if (!(await authorize(ctx, "sso.connection.read", { groupId: args.groupId })).ok) return null;
 						return await auth.sso.admin.connection.getByGroup(ctx, args.groupId);
 					}
 				}),
 				getByDomain: queryGeneric({
 					args: { domain: v.string() },
 					handler: async (ctx, args) => {
-						await authorize(ctx, "sso.connection.read", { domain: args.domain });
+						if (!(await authorize(ctx, "sso.connection.read", { domain: args.domain })).ok) return null;
 						return await auth.sso.admin.connection.getByDomain(ctx, args.domain);
 					}
 				}),
@@ -158,7 +172,7 @@ function sso(auth, options) {
 						order: v.optional(v.union(v.literal("asc"), v.literal("desc")))
 					},
 					handler: async (ctx, args) => {
-						await authorize(ctx, "sso.connection.read", { groupId: args.where?.groupId });
+						if (!(await authorize(ctx, "sso.connection.read", { groupId: args.where?.groupId })).ok) return null;
 						return await auth.sso.admin.connection.list(ctx, args);
 					}
 				}),
@@ -172,7 +186,11 @@ function sso(auth, options) {
 						})
 					},
 					handler: async (ctx, args) => {
-						await authorize(ctx, "sso.connection.manage", { enterpriseId: args.enterpriseId });
+						const _auth = await authorize(ctx, "sso.connection.manage", { enterpriseId: args.enterpriseId });
+						if (!_auth.ok) return {
+							ok: false,
+							code: _auth.code
+						};
 						await auth.sso.admin.connection.update(ctx, args.enterpriseId, args.data);
 						return {
 							ok: true,
@@ -183,14 +201,18 @@ function sso(auth, options) {
 				delete: mutationGeneric({
 					args: { enterpriseId: v.string() },
 					handler: async (ctx, args) => {
-						await authorize(ctx, "sso.connection.manage", { enterpriseId: args.enterpriseId });
+						const _auth = await authorize(ctx, "sso.connection.manage", { enterpriseId: args.enterpriseId });
+						if (!_auth.ok) return {
+							ok: false,
+							code: _auth.code
+						};
 						return await auth.sso.admin.connection.delete(ctx, args.enterpriseId);
 					}
 				}),
 				status: queryGeneric({
 					args: { enterpriseId: v.string() },
 					handler: async (ctx, args) => {
-						await authorize(ctx, "sso.connection.read", { enterpriseId: args.enterpriseId });
+						if (!(await authorize(ctx, "sso.connection.read", { enterpriseId: args.enterpriseId })).ok) return null;
 						return await auth.sso.admin.connection.status(ctx, args.enterpriseId);
 					}
 				}),
@@ -198,14 +220,14 @@ function sso(auth, options) {
 					list: queryGeneric({
 						args: { enterpriseId: v.string() },
 						handler: async (ctx, args) => {
-							await authorize(ctx, "sso.connection.read", { enterpriseId: args.enterpriseId });
+							if (!(await authorize(ctx, "sso.connection.read", { enterpriseId: args.enterpriseId })).ok) return null;
 							return await auth.sso.admin.connection.domain.list(ctx, args.enterpriseId);
 						}
 					}),
 					validate: queryGeneric({
 						args: { enterpriseId: v.string() },
 						handler: async (ctx, args) => {
-							await authorize(ctx, "sso.domain.manage", { enterpriseId: args.enterpriseId });
+							if (!(await authorize(ctx, "sso.domain.manage", { enterpriseId: args.enterpriseId })).ok) return null;
 							return await auth.sso.admin.connection.domain.validate(ctx, args.enterpriseId);
 						}
 					}),
@@ -215,7 +237,11 @@ function sso(auth, options) {
 							domains: v.array(enterpriseDomainInputValidator)
 						},
 						handler: async (ctx, args) => {
-							await authorize(ctx, "sso.domain.manage", { enterpriseId: args.enterpriseId });
+							const _auth = await authorize(ctx, "sso.domain.manage", { enterpriseId: args.enterpriseId });
+							if (!_auth.ok) return {
+								ok: false,
+								code: _auth.code
+							};
 							return await auth.sso.admin.connection.domain.set(ctx, args.enterpriseId, args.domains);
 						}
 					}),
@@ -223,14 +249,22 @@ function sso(auth, options) {
 						request: mutationGeneric({
 							args: enterpriseDomainVerificationInputValidator,
 							handler: async (ctx, args) => {
-								await authorize(ctx, "sso.domain.manage", { enterpriseId: args.enterpriseId });
+								const _auth = await authorize(ctx, "sso.domain.manage", { enterpriseId: args.enterpriseId });
+								if (!_auth.ok) return {
+									ok: false,
+									code: _auth.code
+								};
 								return await auth.sso.admin.connection.domain.verification.request(ctx, args);
 							}
 						}),
 						confirm: actionGeneric({
 							args: enterpriseDomainVerificationInputValidator,
 							handler: async (ctx, args) => {
-								await authorize(ctx, "sso.domain.manage", { enterpriseId: args.enterpriseId });
+								const _auth = await authorize(ctx, "sso.domain.manage", { enterpriseId: args.enterpriseId });
+								if (!_auth.ok) return {
+									ok: false,
+									code: _auth.code
+								};
 								return await auth.sso.admin.connection.domain.verification.confirm(ctx, args);
 							}
 						})
@@ -252,21 +286,29 @@ function sso(auth, options) {
 						extraFields: v.optional(v.record(v.string(), v.string()))
 					},
 					handler: async (ctx, args) => {
-						await authorize(ctx, "sso.protocol.manage", { enterpriseId: args.enterpriseId });
+						const _auth = await authorize(ctx, "sso.protocol.manage", { enterpriseId: args.enterpriseId });
+						if (!_auth.ok) return {
+							ok: false,
+							code: _auth.code
+						};
 						return await auth.sso.admin.oidc.configure(ctx, args);
 					}
 				}),
 				get: queryGeneric({
 					args: { enterpriseId: v.string() },
 					handler: async (ctx, args) => {
-						await authorize(ctx, "sso.connection.read", { enterpriseId: args.enterpriseId });
+						if (!(await authorize(ctx, "sso.connection.read", { enterpriseId: args.enterpriseId })).ok) return null;
 						return await auth.sso.admin.oidc.get(ctx, args.enterpriseId);
 					}
 				}),
 				validate: actionGeneric({
 					args: { enterpriseId: v.string() },
 					handler: async (ctx, args) => {
-						await authorize(ctx, "sso.protocol.manage", { enterpriseId: args.enterpriseId });
+						const _auth = await authorize(ctx, "sso.protocol.manage", { enterpriseId: args.enterpriseId });
+						if (!_auth.ok) return {
+							ok: false,
+							code: _auth.code
+						};
 						return await auth.sso.admin.oidc.validate(ctx, args.enterpriseId);
 					}
 				})
@@ -283,14 +325,18 @@ function sso(auth, options) {
 						sp: v.optional(enterpriseSamlSpValidator)
 					},
 					handler: async (ctx, args) => {
-						await authorize(ctx, "sso.protocol.manage", { enterpriseId: args.enterpriseId });
+						const _auth = await authorize(ctx, "sso.protocol.manage", { enterpriseId: args.enterpriseId });
+						if (!_auth.ok) return {
+							ok: false,
+							code: _auth.code
+						};
 						return await auth.sso.admin.saml.configure(ctx, args);
 					}
 				}),
 				validate: queryGeneric({
 					args: { enterpriseId: v.string() },
 					handler: async (ctx, args) => {
-						await authorize(ctx, "sso.protocol.manage", { enterpriseId: args.enterpriseId });
+						if (!(await authorize(ctx, "sso.protocol.manage", { enterpriseId: args.enterpriseId })).ok) return null;
 						return await auth.sso.admin.saml.validate(ctx, args.enterpriseId);
 					}
 				})
@@ -299,7 +345,7 @@ function sso(auth, options) {
 				get: queryGeneric({
 					args: { enterpriseId: v.string() },
 					handler: async (ctx, args) => {
-						await authorize(ctx, "sso.connection.read", { enterpriseId: args.enterpriseId });
+						if (!(await authorize(ctx, "sso.connection.read", { enterpriseId: args.enterpriseId })).ok) return null;
 						return await auth.sso.admin.policy.get(ctx, args.enterpriseId);
 					}
 				}),
@@ -309,14 +355,18 @@ function sso(auth, options) {
 						patch: enterprisePolicyPatchValidator
 					},
 					handler: async (ctx, args) => {
-						await authorize(ctx, "sso.policy.manage", { enterpriseId: args.enterpriseId });
+						const _auth = await authorize(ctx, "sso.policy.manage", { enterpriseId: args.enterpriseId });
+						if (!_auth.ok) return {
+							ok: false,
+							code: _auth.code
+						};
 						return await auth.sso.admin.policy.update(ctx, args.enterpriseId, args.patch);
 					}
 				}),
 				validate: queryGeneric({
 					args: { enterpriseId: v.string() },
 					handler: async (ctx, args) => {
-						await authorize(ctx, "sso.policy.manage", { enterpriseId: args.enterpriseId });
+						if (!(await authorize(ctx, "sso.policy.manage", { enterpriseId: args.enterpriseId })).ok) return null;
 						return await auth.sso.admin.policy.validate(ctx, args.enterpriseId);
 					}
 				})
@@ -328,10 +378,10 @@ function sso(auth, options) {
 					limit: v.optional(v.number())
 				},
 				handler: async (ctx, args) => {
-					await authorize(ctx, "sso.audit.read", {
+					if (!(await authorize(ctx, "sso.audit.read", {
 						enterpriseId: args.enterpriseId,
 						groupId: args.groupId
-					});
+					})).ok) return null;
 					return await auth.sso.admin.audit.list(ctx, args);
 				}
 			}) },
@@ -342,7 +392,7 @@ function sso(auth, options) {
 						limit: v.optional(v.number())
 					},
 					handler: async (ctx, args) => {
-						await authorize(ctx, "sso.webhook.manage", { enterpriseId: args.enterpriseId });
+						if (!(await authorize(ctx, "sso.webhook.manage", { enterpriseId: args.enterpriseId })).ok) return null;
 						return await auth.sso.admin.webhook.delivery.list(ctx, args);
 					}
 				}) },
@@ -356,7 +406,12 @@ function sso(auth, options) {
 							createdByUserId: v.optional(v.string())
 						},
 						handler: async (ctx, args) => {
-							const { userId } = await authorize(ctx, "sso.webhook.manage", { enterpriseId: args.enterpriseId });
+							const authResult = await authorize(ctx, "sso.webhook.manage", { enterpriseId: args.enterpriseId });
+							if (!authResult.ok) return {
+								ok: false,
+								code: authResult.code
+							};
+							const { userId } = authResult;
 							return {
 								_id: (await auth.sso.admin.webhook.endpoint.create(ctx, {
 									...args,
@@ -374,7 +429,7 @@ function sso(auth, options) {
 					list: queryGeneric({
 						args: { enterpriseId: v.string() },
 						handler: async (ctx, args) => {
-							await authorize(ctx, "sso.webhook.manage", { enterpriseId: args.enterpriseId });
+							if (!(await authorize(ctx, "sso.webhook.manage", { enterpriseId: args.enterpriseId })).ok) return null;
 							return (await auth.sso.admin.webhook.endpoint.list(ctx, args.enterpriseId)).map((endpoint) => {
 								const { secretHash: _secretHash, ...rest } = endpoint;
 								return rest;
@@ -385,14 +440,18 @@ function sso(auth, options) {
 						args: { endpointId: v.string() },
 						handler: async (ctx, args) => {
 							const endpoint = await auth.sso.admin.webhook.endpoint.get(ctx, args.endpointId);
-							if (!endpoint) throw new ConvexError({
-								code: "INVALID_PARAMETERS",
-								message: "Webhook endpoint not found."
-							});
-							await authorize(ctx, "sso.webhook.manage", {
+							if (!endpoint) return {
+								ok: false,
+								code: "INVALID_PARAMETERS"
+							};
+							const _auth = await authorize(ctx, "sso.webhook.manage", {
 								enterpriseId: endpoint.enterpriseId,
 								groupId: endpoint.groupId
 							});
+							if (!_auth.ok) return {
+								ok: false,
+								code: _auth.code
+							};
 							return await auth.sso.admin.webhook.endpoint.disable(ctx, args.endpointId);
 						}
 					})
@@ -439,21 +498,25 @@ function scim(auth, options) {
 				status: v.optional(enterpriseStatusValidator)
 			},
 			handler: async (ctx, args) => {
-				await authorize(ctx, "scim.manage", { enterpriseId: args.enterpriseId });
+				const _auth = await authorize(ctx, "scim.manage", { enterpriseId: args.enterpriseId });
+				if (!_auth.ok) return {
+					ok: false,
+					code: _auth.code
+				};
 				return await auth.scim.admin.configure(ctx, args);
 			}
 		}),
 		get: queryGeneric({
 			args: { enterpriseId: v.string() },
 			handler: async (ctx, args) => {
-				await authorize(ctx, "scim.manage", { enterpriseId: args.enterpriseId });
+				if (!(await authorize(ctx, "scim.manage", { enterpriseId: args.enterpriseId })).ok) return null;
 				return await auth.scim.admin.get(ctx, args.enterpriseId);
 			}
 		}),
 		validate: queryGeneric({
 			args: { enterpriseId: v.string() },
 			handler: async (ctx, args) => {
-				await authorize(ctx, "scim.manage", { enterpriseId: args.enterpriseId });
+				if (!(await authorize(ctx, "scim.manage", { enterpriseId: args.enterpriseId })).ok) return null;
 				return await auth.scim.admin.validate(ctx, args.enterpriseId);
 			}
 		})
@@ -702,6 +765,23 @@ function canParseUrl(value) {
 		return false;
 	}
 }
+function serializeAuthCookie(cookie) {
+	const parts = [`${cookie.name}=${cookie.value}`, `Path=${cookie.options.path}`];
+	if (cookie.options.httpOnly) parts.push("HttpOnly");
+	if (cookie.options.secure) parts.push("Secure");
+	if (cookie.options.sameSite) parts.push(`SameSite=${cookie.options.sameSite}`);
+	if (cookie.options.maxAge !== void 0) parts.push(`Max-Age=${cookie.options.maxAge}`);
+	if (cookie.options.expires) parts.push(`Expires=${cookie.options.expires.toUTCString()}`);
+	return parts.join("; ");
+}
+function buildRedirectResponse(location, cookies) {
+	const headers = new Headers({ Location: location });
+	for (const cookie of cookies) headers.append("Set-Cookie", serializeAuthCookie(cookie));
+	return new Response(null, {
+		status: 302,
+		headers
+	});
+}
 function deriveCookieNamespaceFromUrl(url) {
 	if (!canParseUrl(url)) return DERIVED_COOKIE_NAMESPACE_FALLBACK;
 	const parsed = new URL(url);
@@ -1031,6 +1111,7 @@ function server(options) {
 			const corsDispatch = originHeader !== null && (originUrl === null || originUrl.host !== normalizedHost || originUrl.protocol !== protocol) ? { kind: "crossOrigin" } : { kind: "sameOrigin" };
 			const corsRefreshResult = await Fx.run(Fx.match(corsDispatch, corsDispatch.kind, {
 				crossOrigin: () => ({
+					redirect: false,
 					cookies: [],
 					token: null
 				}),
@@ -1070,32 +1151,33 @@ function server(options) {
 					}).pipe(Fx.fold({
 						ok: (result) => {
 							redirectUrl.searchParams.delete("code");
+							const cookies = structuredAuthCookies({
+								token: result.tokens?.token ?? null,
+								refreshToken: result.tokens?.refreshToken ?? null,
+								verifier: null
+							}, host, cookieConfig, cookieNamespace);
 							return {
-								cookies: structuredAuthCookies({
-									token: result.tokens?.token ?? null,
-									refreshToken: result.tokens?.refreshToken ?? null,
-									verifier: null
-								}, host, cookieConfig, cookieNamespace),
-								redirect: redirectUrl.toString(),
-								token: result.tokens?.token ?? null
+								redirect: true,
+								response: buildRedirectResponse(redirectUrl.toString(), cookies)
 							};
 						},
 						err: (error) => {
 							console.error("[convex-auth/server] code exchange failed", error);
 							const errorCode = error instanceof ConvexError && typeof error.data === "object" && error.data !== null && typeof error.data.code === "string" ? error.data.code : null;
 							if (!(errorCode === "OAUTH_INVALID_STATE" || errorCode === "OAUTH_PROVIDER_ERROR" || errorCode === "OAUTH_MISSING_ID_TOKEN" || errorCode === "OAUTH_INVALID_PROFILE" || errorCode === "OAUTH_MISSING_VERIFIER" || errorCode === "INVALID_VERIFIER" || errorCode === "INVALID_VERIFICATION_CODE")) return {
+								redirect: false,
 								cookies: [],
 								token: currentCookies.token
 							};
 							redirectUrl.searchParams.delete("code");
+							const cookies = structuredAuthCookies({
+								token: currentCookies.token,
+								refreshToken: currentCookies.refreshToken,
+								verifier: null
+							}, host, cookieConfig, cookieNamespace);
 							return {
-								cookies: structuredAuthCookies({
-									token: currentCookies.token,
-									refreshToken: currentCookies.refreshToken,
-									verifier: null
-								}, host, cookieConfig, cookieNamespace),
-								redirect: redirectUrl.toString(),
-								token: currentCookies.token
+								redirect: true,
+								response: buildRedirectResponse(redirectUrl.toString(), cookies)
 							};
 						}
 					})));
@@ -1264,10 +1346,12 @@ function server(options) {
 				});
 			}));
 			if (tokens === void 0) return {
+				redirect: false,
 				cookies: [],
 				token: currentToken
 			};
 			return {
+				redirect: false,
 				cookies: structuredAuthCookies({
 					token: tokens?.token ?? null,
 					refreshToken: tokens?.refreshToken ?? null,