@robelest/convex-auth 0.0.4-preview.16 → 0.0.4-preview.18

package/src/component/public/groups.ts

@@ -39,10 +39,23 @@ export const groupCreate = mutation({
   handler: async (ctx, args) => {
     const { tags: rawTags, ...rest } = args;
     const normalizedTags = rawTags ? normalizeTags(rawTags) : undefined;
+    const isRoot = !args.parentGroupId;
+    // Compute rootGroupId: root groups self-reference, children inherit from parent
+    let rootGroupId: Id<"Group"> | undefined;
+    if (!isRoot && args.parentGroupId) {
+      const parent = await ctx.db.get(args.parentGroupId);
+      rootGroupId = parent?.rootGroupId ?? args.parentGroupId;
+    }
     const groupId = await ctx.db.insert("Group", {
       ...rest,
       tags: normalizedTags,
+      isRoot,
+      rootGroupId: isRoot ? undefined : rootGroupId,
     });
+    // Self-reference for root groups (need the ID after insert)
+    if (isRoot) {
+      await ctx.db.patch(groupId, { rootGroupId: groupId });
+    }
     // Sync companion group_tag rows
     if (normalizedTags) {
       for (const tag of normalizedTags) {
@@ -178,6 +191,10 @@ export const groupList = query({
         .withIndex("parent_group_id", (idx) =>
           idx.eq("parentGroupId", where.parentGroupId!),
         );
+    } else if (where.isRoot !== undefined) {
+      q = ctx.db
+        .query("Group")
+        .withIndex("is_root", (idx) => idx.eq("isRoot", where.isRoot!));
     } else {
       q = ctx.db.query("Group");
     }
@@ -186,10 +203,13 @@ export const groupList = query({
     if (where.name !== undefined) {
       q = q.filter((f) => f.eq(f.field("name"), where.name!));
     }
-    if (where.isRoot === true) {
-      q = q.filter((f) => f.eq(f.field("parentGroupId"), undefined));
-    } else if (where.isRoot === false) {
-      q = q.filter((f) => f.neq(f.field("parentGroupId"), undefined));
+    // isRoot filter when not already used as primary index
+    if (
+      where.isRoot !== undefined &&
+      where.parentGroupId === undefined &&
+      (where.type !== undefined || where.slug !== undefined)
+    ) {
+      q = q.filter((f) => f.eq(f.field("isRoot"), where.isRoot!));
     }
     // slug filter when not used as index
     if (where.slug !== undefined && where.type !== undefined) {
@@ -226,6 +246,38 @@ export const groupUpdate = mutation({
   args: { groupId: v.id("Group"), data: v.any() },
   returns: v.null(),
   handler: async (ctx, { groupId, data }) => {
+    // If parentGroupId is changing, recompute rootGroupId + isRoot for this group and descendants
+    if (data.parentGroupId !== undefined) {
+      const oldGroup = await ctx.db.get("Group", groupId);
+      const oldRootGroupId = oldGroup?.rootGroupId;
+      const newParentGroupId = data.parentGroupId as Id<"Group"> | undefined;
+      const newIsRoot = !newParentGroupId;
+      let newRootGroupId: Id<"Group">;
+      if (newIsRoot) {
+        newRootGroupId = groupId;
+      } else {
+        const parent = await ctx.db.get("Group", newParentGroupId!);
+        newRootGroupId = parent?.rootGroupId ?? newParentGroupId!;
+      }
+      data.isRoot = newIsRoot;
+      data.rootGroupId = newRootGroupId;
+      // Cascade to descendants if rootGroupId changed
+      if (oldRootGroupId && oldRootGroupId !== newRootGroupId) {
+        const descendants = await ctx.db
+          .query("Group")
+          .withIndex("root_group_id", (q) =>
+            q.eq("rootGroupId", oldRootGroupId),
+          )
+          .collect();
+        for (const desc of descendants) {
+          if (desc._id !== groupId) {
+            await ctx.db.patch("Group", desc._id, {
+              rootGroupId: newRootGroupId,
+            });
+          }
+        }
+      }
+    }
     // If tags are being updated, normalize and replace the full tag set
     if (data.tags !== undefined) {
       const normalizedTags: TagPair[] = Array.isArray(data.tags)
@@ -401,6 +453,15 @@ export const memberList = query({
         .withIndex("group_id_user_id", (idx) =>
           idx.eq("groupId", where.groupId!).eq("userId", where.userId!),
         );
+      if (where.status !== undefined) {
+        q = q.filter((f) => f.eq(f.field("status"), where.status!));
+      }
+    } else if (where.groupId !== undefined && where.status !== undefined) {
+      q = ctx.db
+        .query("GroupMember")
+        .withIndex("group_id_status", (idx) =>
+          idx.eq("groupId", where.groupId!).eq("status", where.status!),
+        );
     } else if (where.groupId !== undefined) {
       q = ctx.db
         .query("GroupMember")
@@ -409,12 +470,14 @@ export const memberList = query({
       q = ctx.db
         .query("GroupMember")
         .withIndex("user_id", (idx) => idx.eq("userId", where.userId!));
+      if (where.status !== undefined) {
+        q = q.filter((f) => f.eq(f.field("status"), where.status!));
+      }
     } else {
       q = ctx.db.query("GroupMember");
-    }
-
-    if (where.status !== undefined) {
-      q = q.filter((f) => f.eq(f.field("status"), where.status!));
+      if (where.status !== undefined) {
+        q = q.filter((f) => f.eq(f.field("status"), where.status!));
+      }
     }
 
     q = q.order(order);
@@ -470,6 +533,77 @@ export const memberGetByGroupAndUser = query({
   },
 });
 
+/**
+ * Resolve a user's membership by walking the group hierarchy from the
+ * requested group up to the root. Returns the first matching membership
+ * found. When `ancestry` is true, includes the list of traversed group IDs.
+ *
+ * This runs entirely inside the component (no cross-component RPCs per level).
+ */
+export const memberResolve = query({
+  args: {
+    userId: v.id("User"),
+    groupId: v.id("Group"),
+    maxDepth: v.optional(v.number()),
+    ancestry: v.optional(v.boolean()),
+  },
+  returns: v.object({
+    membership: v.union(vGroupMemberDoc, v.null()),
+    matchedGroupId: v.union(v.id("Group"), v.null()),
+    depth: v.union(v.number(), v.null()),
+    isDirect: v.boolean(),
+    isInherited: v.boolean(),
+    traversedGroupIds: v.optional(v.array(v.id("Group"))),
+  }),
+  handler: async (ctx, args) => {
+    const maxDepth = Math.max(0, Math.floor(args.maxDepth ?? 32));
+    const includeAncestry = args.ancestry ?? false;
+    const visited = new Set<string>();
+    const traversedGroupIds: Id<"Group">[] = [];
+    let currentGroupId: Id<"Group"> | undefined = args.groupId;
+    let depth = 0;
+
+    while (currentGroupId !== undefined && depth <= maxDepth) {
+      if (visited.has(currentGroupId)) break;
+      visited.add(currentGroupId);
+      if (includeAncestry) traversedGroupIds.push(currentGroupId);
+
+      const membership = await ctx.db
+        .query("GroupMember")
+        .withIndex("group_id_user_id", (q) =>
+          q.eq("groupId", currentGroupId!).eq("userId", args.userId),
+        )
+        .unique();
+
+      if (membership !== null) {
+        return {
+          membership,
+          matchedGroupId: currentGroupId,
+          depth,
+          isDirect: depth === 0,
+          isInherited: depth > 0,
+          ...(includeAncestry ? { traversedGroupIds } : {}),
+        };
+      }
+
+      const groupDoc: { parentGroupId?: Id<"Group"> } | null =
+        await ctx.db.get(currentGroupId);
+      if (!groupDoc?.parentGroupId) break;
+      currentGroupId = groupDoc.parentGroupId;
+      depth++;
+    }
+
+    return {
+      membership: null,
+      matchedGroupId: null,
+      depth: null,
+      isDirect: false,
+      isInherited: false,
+      ...(includeAncestry ? { traversedGroupIds } : {}),
+    };
+  },
+});
+
 /** Remove a member from a group by deleting the member record. */
 export const memberRemove = mutation({
   args: { memberId: v.id("GroupMember") },

package/src/component/public/identity.ts

@@ -114,8 +114,9 @@ export const userFindByVerifiedEmail = query({
   handler: async (ctx, { email }) => {
     const users = await ctx.db
       .query("User")
-      .withIndex("email", (q) => q.eq("email", email))
-      .filter((q) => q.neq(q.field("emailVerificationTime"), undefined))
+      .withIndex("email_verified", (q) =>
+        q.eq("email", email).gt("emailVerificationTime", undefined),
+      )
       .take(2);
     return users.length === 1 ? users[0] : null;
   },
@@ -132,8 +133,9 @@ export const userFindByVerifiedPhone = query({
   handler: async (ctx, { phone }) => {
     const users = await ctx.db
       .query("User")
-      .withIndex("phone", (q) => q.eq("phone", phone))
-      .filter((q) => q.neq(q.field("phoneVerificationTime"), undefined))
+      .withIndex("phone_verified", (q) =>
+        q.eq("phone", phone).gt("phoneVerificationTime", undefined),
+      )
       .take(2);
     return users.length === 1 ? users[0] : null;
   },
@@ -558,8 +560,9 @@ export const refreshTokenGetActive = query({
   handler: async (ctx, { sessionId }) => {
     return await ctx.db
       .query("RefreshToken")
-      .withIndex("session_id", (q) => q.eq("sessionId", sessionId as any))
-      .filter((q) => q.eq(q.field("firstUsedTime"), undefined))
+      .withIndex("session_id_first_used", (q) =>
+        q.eq("sessionId", sessionId as any).eq("firstUsedTime", undefined),
+      )
       .order("desc")
       .first();
   },

package/src/component/schema.ts

@@ -42,7 +42,9 @@ export default defineSchema({
     extend: v.optional(v.any()),
   })
     .index("email", ["email"])
-    .index("phone", ["phone"]),
+    .index("email_verified", ["email", "emailVerificationTime"])
+    .index("phone", ["phone"])
+    .index("phone_verified", ["phone", "phoneVerificationTime"]),
 
   /**
    * Active sessions. A single user can have multiple concurrent sessions
@@ -86,6 +88,7 @@ export default defineSchema({
     parentRefreshTokenId: v.optional(v.id("RefreshToken")),
   })
     .index("session_id", ["sessionId"])
+    .index("session_id_first_used", ["sessionId", "firstUsedTime"])
     .index("session_id_parent_refresh_token_id", [
       "sessionId",
       "parentRefreshTokenId",
@@ -167,7 +170,9 @@ export default defineSchema({
     name: v.optional(v.string()),
     createdAt: v.number(),
     lastUsedAt: v.optional(v.number()),
-  }).index("user_id", ["userId"]),
+  })
+    .index("user_id", ["userId"])
+    .index("user_id_verified", ["userId", "verified"]),
 
   /**
    * Device authorization codes (RFC 8628). Each record tracks a pending
@@ -214,12 +219,18 @@ export default defineSchema({
     slug: v.optional(v.string()),
     type: v.optional(v.string()),
     parentGroupId: v.optional(v.id("Group")),
+    /** Denormalized root group ID. Self-referencing for root groups. */
+    rootGroupId: v.optional(v.id("Group")),
+    /** Denormalized flag: `true` when `parentGroupId` is absent. */
+    isRoot: v.optional(v.boolean()),
     /** Faceted classification tags. Normalized at write time (trimmed, lowercased). */
     tags: v.optional(v.array(vTag)),
     extend: v.optional(v.any()),
   })
     .index("slug", ["slug"])
     .index("parent_group_id", ["parentGroupId"])
+    .index("root_group_id", ["rootGroupId"])
+    .index("is_root", ["isRoot"])
     .index("type", ["type"])
     .index("type_parent_group_id", ["type", "parentGroupId"]),
 
@@ -252,6 +263,7 @@ export default defineSchema({
   })
     .index("group_id", ["groupId"])
     .index("group_id_user_id", ["groupId", "userId"])
+    .index("group_id_status", ["groupId", "status"])
     .index("user_id", ["userId"]),
 
   /**

package/src/server/auth.ts

@@ -39,7 +39,7 @@ type MemberApiWithAuthorization<
   TAuthorization extends AuthAuthorizationConfig | undefined,
 > = Omit<
   ReturnType<typeof AuthFactory>["auth"]["member"],
-  "create" | "list" | "update" | "inherit" | "require"
+  "create" | "list" | "update" | "resolve"
 > & {
   create: (
     ctx: Parameters<
@@ -77,9 +77,9 @@ type MemberApiWithAuthorization<
     memberId: string,
     data: Record<string, unknown> & { roleIds?: AuthRoleId<TAuthorization>[] },
   ) => Promise<{ ok: true; memberId: string }>;
-  inherit: (
+  resolve: (
     ctx: Parameters<
-      ReturnType<typeof AuthFactory>["auth"]["member"]["inherit"]
+      ReturnType<typeof AuthFactory>["auth"]["member"]["resolve"]
     >[0],
     opts: {
       userId: string;
@@ -88,19 +88,7 @@ type MemberApiWithAuthorization<
       grants?: AuthGrant<TAuthorization>[];
       maxDepth?: number;
     },
-  ) => ReturnType<ReturnType<typeof AuthFactory>["auth"]["member"]["inherit"]>;
-  require: (
-    ctx: Parameters<
-      ReturnType<typeof AuthFactory>["auth"]["member"]["require"]
-    >[0],
-    opts: {
-      userId: string;
-      groupId: string;
-      roleIds?: AuthRoleId<TAuthorization>[];
-      grants?: AuthGrant<TAuthorization>[];
-      maxDepth?: number;
-    },
-  ) => ReturnType<ReturnType<typeof AuthFactory>["auth"]["member"]["require"]>;
+  ) => ReturnType<ReturnType<typeof AuthFactory>["auth"]["member"]["resolve"]>;
 };
 
 type AccessApiWithAuthorization<
@@ -117,17 +105,6 @@ type AccessApiWithAuthorization<
       maxDepth?: number;
     },
   ) => ReturnType<ReturnType<typeof AuthFactory>["auth"]["access"]["check"]>;
-  require: (
-    ctx: Parameters<
-      ReturnType<typeof AuthFactory>["auth"]["access"]["require"]
-    >[0],
-    opts: {
-      userId: string;
-      groupId: string;
-      grants: AuthGrant<TAuthorization>[];
-      maxDepth?: number;
-    },
-  ) => ReturnType<ReturnType<typeof AuthFactory>["auth"]["access"]["require"]>;
 };
 
 /** The base auth API surface, without conditional namespaces. */
@@ -488,38 +465,6 @@ export function createAuth<
   } as unknown as ConvexAuthResult<P, TAuthorization>;
 }
 
-export function defineRoles<
-  const TRoles extends Record<
-    string,
-    { label?: string; grants: readonly string[] }
-  >,
->(
-  roles: TRoles,
-): {
-  [K in keyof TRoles]: {
-    id: K & string;
-    label?: TRoles[K]["label"];
-    grants: Array<TRoles[K]["grants"][number] & string>;
-  };
-} {
-  return Object.fromEntries(
-    Object.entries(roles).map(([id, role]) => [
-      id,
-      {
-        id,
-        ...(role.label ? { label: role.label } : {}),
-        grants: [...role.grants],
-      },
-    ]),
-  ) as {
-    [K in keyof TRoles]: {
-      id: K & string;
-      label?: TRoles[K]["label"];
-      grants: Array<TRoles[K]["grants"][number] & string>;
-    };
-  };
-}
-
 // ============================================================================
 // AuthCtx — ctx enrichment for customQuery / customMutation
 // ============================================================================
@@ -593,7 +538,7 @@ export function AuthCtx(auth: AuthLike, config?: AuthCtxConfig<any>) {
       const userContext = await Fx.run(
         Fx.match(modeDispatch, modeDispatch.mode, {
           optional: async () => {
-            const userId = await auth.user.current(ctx);
+            const userId = await auth.user.id(ctx);
             if (!userId) {
               return null;
             }
@@ -601,7 +546,10 @@ export function AuthCtx(auth: AuthLike, config?: AuthCtxConfig<any>) {
             return { userId, user };
           },
           required: async () => {
-            const userId = await auth.user.require(ctx);
+            const userId = await auth.user.id(ctx);
+            if (!userId) {
+              return null;
+            }
             const user = await auth.user.get(ctx, userId);
             return { userId, user };
           },