@robelest/convex-auth 0.0.4-preview.16 → 0.0.4-preview.18

package/src/server/domains/core.ts

@@ -1,7 +1,6 @@
 import { Auth, GenericActionCtx, GenericDataModel } from "convex/server";
 import { GenericId } from "convex/values";
 
-import { AuthError, Fx } from "../fx";
 import {
   buildScopeChecker,
   checkKeyRateLimit,
@@ -92,28 +91,27 @@ export function createCoreDomains(deps: CoreDeps) {
   >;
 
   const getRoleDefinition = (roleId: string) => {
-    const role = roleDefinitions[roleId];
-    if (!role) {
-      throw new AuthError(
-        "INVALID_PARAMETERS",
-        `Unknown roleId "${roleId}".`,
-      ).toConvexError();
-    }
-    return role;
+    return roleDefinitions[roleId] ?? null;
   };
 
-  const normalizeRoleIds = (roleIds?: string[]) => {
+  const normalizeRoleIds = (
+    roleIds?: string[],
+  ):
+    | { ok: true; roleIds: string[] }
+    | { ok: false; invalidRoleIds: string[] } => {
     const normalized = Array.from(new Set(roleIds ?? []));
-    for (const roleId of normalized) {
-      getRoleDefinition(roleId);
+    const invalid = normalized.filter((id) => getRoleDefinition(id) === null);
+    if (invalid.length > 0) {
+      return { ok: false, invalidRoleIds: invalid };
     }
-    return normalized;
+    return { ok: true, roleIds: normalized };
   };
 
   const resolveGrantedPermissions = (roleIds?: string[]) => {
     const grants = new Set<string>();
     for (const roleId of roleIds ?? []) {
       const role = getRoleDefinition(roleId);
+      if (role === null) continue;
       for (const grant of role.grants) {
         grants.add(grant);
       }
@@ -121,8 +119,25 @@ export function createCoreDomains(deps: CoreDeps) {
     return Array.from(grants).sort();
   };
 
+  // Per-execution cache — attached to ctx so each function invocation has its own.
+  // Eliminates redundant cross-component RPCs for the same entity within a handler.
+  type CtxCache = {
+    users: Map<string, any>;
+    groups: Map<string, any>;
+  };
+  const AUTH_CACHE = Symbol("__convexAuthCache");
+  function cache(ctx: any): CtxCache {
+    if (!ctx[AUTH_CACHE]) {
+      ctx[AUTH_CACHE] = {
+        users: new Map(),
+        groups: new Map(),
+      } satisfies CtxCache;
+    }
+    return ctx[AUTH_CACHE];
+  }
+
   const user = {
-    current: async (
+    id: async (
       ctx: { auth: Auth } & Partial<ComponentCtx>,
       request?: Request,
     ): Promise<string | null> => {
@@ -135,33 +150,26 @@ export function createCoreDomains(deps: CoreDeps) {
         const authHeader = request.headers.get("Authorization");
         if (authHeader?.startsWith("Bearer sk_")) {
           const rawKey = authHeader.slice(7);
-          try {
-            const result = await getAuth().key.verify(
-              ctx as ComponentCtx,
-              rawKey,
-            );
+          const result = await getAuth().key.verify(
+            ctx as ComponentCtx,
+            rawKey,
+          );
+          if (result.ok) {
             return result.userId;
-          } catch {
-            return null;
           }
+          return null;
         }
       }
       return null;
     },
-    require: async (
-      ctx: { auth: Auth } & Partial<ComponentCtx>,
-      request?: Request,
-    ): Promise<string> => {
-      const userId = await user.current(ctx, request);
-      if (userId === null) {
-        throw new AuthError("NOT_SIGNED_IN").toConvexError();
-      }
-      return userId;
-    },
     get: async (ctx: ComponentReadCtx, userId: string) => {
-      return await ctx.runQuery(config.component.public.userGetById, {
+      const c = cache(ctx);
+      if (c.users.has(userId)) return c.users.get(userId);
+      const result = await ctx.runQuery(config.component.public.userGetById, {
         userId,
       });
+      c.users.set(userId, result);
+      return result;
     },
     list: async (
       ctx: ComponentReadCtx,
@@ -176,11 +184,9 @@ export function createCoreDomains(deps: CoreDeps) {
       return await ctx.runQuery(config.component.public.userList, opts);
     },
     viewer: async (ctx: ComponentAuthReadCtx) => {
-      const userId = await user.current(ctx);
+      const userId = await user.id(ctx);
       if (userId === null) return null;
-      return await ctx.runQuery(config.component.public.userGetById, {
-        userId,
-      });
+      return await user.get(ctx, userId);
     },
     update: async (
       ctx: ComponentCtx,
@@ -266,10 +272,7 @@ export function createCoreDomains(deps: CoreDeps) {
         passkeys.length +
         totps.length;
       if (!cascade && totalLinked > 0) {
-        throw new AuthError(
-          "INVALID_PARAMETERS",
-          `Cannot delete user with ${totalLinked} linked records. Pass { cascade: true } to delete all linked records, or remove them manually first.`,
-        ).toConvexError();
+        return { ok: false as const, code: "INVALID_PARAMETERS" as const };
       }
       const deletions: Promise<unknown>[] = [];
       for (const s of sessions)
@@ -356,7 +359,7 @@ export function createCoreDomains(deps: CoreDeps) {
     ) => {
       const result = await callRetrieveAccountWithCredentials(ctx, args);
       if (typeof result === "string") {
-        throw new AuthError("ACCOUNT_NOT_FOUND", result).toConvexError();
+        return null;
       }
       return result;
     },
@@ -372,20 +375,14 @@ export function createCoreDomains(deps: CoreDeps) {
         accountId,
       });
       if (doc === null) {
-        throw new AuthError(
-          "ACCOUNT_NOT_FOUND",
-          "Account not found.",
-        ).toConvexError();
+        return { ok: false as const, code: "ACCOUNT_NOT_FOUND" as const };
       }
       const allAccounts = (await ctx.runQuery(
         config.component.public.accountListByUser,
         { userId: (doc as any).userId },
       )) as Array<{ _id: string }>;
       if (allAccounts.length <= 1) {
-        throw new AuthError(
-          "INVALID_PARAMETERS",
-          "Cannot unlink the user's only account. This would lock them out.",
-        ).toConvexError();
+        return { ok: false as const, code: "INVALID_PARAMETERS" as const };
       }
       await ctx.runMutation(config.component.public.accountDelete, {
         accountId,
@@ -472,7 +469,13 @@ export function createCoreDomains(deps: CoreDeps) {
       return { ok: true, groupId };
     },
     get: async (ctx: ComponentReadCtx, groupId: string) => {
-      return await ctx.runQuery(config.component.public.groupGet, { groupId });
+      const c = cache(ctx);
+      if (c.groups.has(groupId)) return c.groups.get(groupId);
+      const result = await ctx.runQuery(config.component.public.groupGet, {
+        groupId,
+      });
+      c.groups.set(groupId, result);
+      return result;
     },
     list: async (
       ctx: ComponentReadCtx,
@@ -564,13 +567,19 @@ export function createCoreDomains(deps: CoreDeps) {
         status?: string;
         extend?: Record<string, unknown>;
       },
-    ): Promise<{ ok: true; memberId: string }> => {
-      const roleIds = normalizeRoleIds(data.roleIds);
+    ) => {
+      const normalized = normalizeRoleIds(data.roleIds);
+      if (!normalized.ok)
+        return {
+          ok: false as const,
+          code: "INVALID_ROLE_IDS" as const,
+          invalidRoleIds: normalized.invalidRoleIds,
+        };
       const memberId = (await ctx.runMutation(
         config.component.public.memberAdd,
-        { ...data, roleIds },
+        { ...data, roleIds: normalized.roleIds },
       )) as string;
-      return { ok: true, memberId };
+      return { ok: true as const, memberId };
     },
     get: async (ctx: ComponentReadCtx, memberId: string) => {
       return await ctx.runQuery(config.component.public.memberGet, {
@@ -620,11 +629,18 @@ export function createCoreDomains(deps: CoreDeps) {
     ) => {
       const nextData = { ...data };
       if ("roleIds" in nextData) {
-        nextData.roleIds = normalizeRoleIds(
+        const normalized = normalizeRoleIds(
           Array.isArray(nextData.roleIds)
             ? (nextData.roleIds as string[])
             : undefined,
         );
+        if (!normalized.ok)
+          return {
+            ok: false as const,
+            code: "INVALID_ROLE_IDS" as const,
+            invalidRoleIds: normalized.invalidRoleIds,
+          };
+        nextData.roleIds = normalized.roleIds;
       }
       await ctx.runMutation(config.component.public.memberUpdate, {
         memberId,
@@ -632,7 +648,7 @@ export function createCoreDomains(deps: CoreDeps) {
       });
       return { ok: true as const, memberId };
     },
-    inherit: async (
+    resolve: async (
       ctx: ComponentReadCtx,
       opts: {
         userId: string;
@@ -642,102 +658,105 @@ export function createCoreDomains(deps: CoreDeps) {
         maxDepth?: number;
       },
     ) => {
-      const requestedRoleIds = normalizeRoleIds(opts.roleIds);
+      const normalized = normalizeRoleIds(opts.roleIds);
+      if (!normalized.ok)
+        return {
+          ok: false as const,
+          code: "INVALID_ROLE_IDS" as const,
+          invalidRoleIds: normalized.invalidRoleIds,
+        };
+      const requestedRoleIds = normalized.roleIds;
       const roleFilter =
         requestedRoleIds.length > 0 ? new Set(requestedRoleIds) : null;
       const requiredGrants = Array.from(new Set(opts.grants ?? []));
       const maxDepth = Math.max(0, Math.floor(opts.maxDepth ?? 32));
-      const visited = new Set<string>();
-      const traversedGroupIds: string[] = [];
-      let currentGroupId: string | undefined = opts.groupId;
-      let depth = 0;
-      let cycleDetected = false;
-      let maxDepthReached = false;
-      while (currentGroupId !== undefined) {
-        if (depth > maxDepth) {
-          maxDepthReached = true;
-          break;
-        }
-        if (visited.has(currentGroupId)) {
-          cycleDetected = true;
-          break;
-        }
-        visited.add(currentGroupId);
-        traversedGroupIds.push(currentGroupId);
-        const membership = await member.getByUserAndGroup(ctx, {
-          userId: opts.userId,
-          groupId: currentGroupId,
-        });
-        const membershipRoleIds = membership?.roleIds ?? [];
-        const membershipGrants = resolveGrantedPermissions(membershipRoleIds);
-        if (
-          membership !== null &&
-          (roleFilter === null ||
-            membershipRoleIds.some((roleId: string) =>
-              roleFilter.has(roleId),
-            )) &&
-          requiredGrants.every((grant) => membershipGrants.includes(grant))
-        ) {
-          return {
-            requestedGroupId: opts.groupId,
-            matchedGroupId: currentGroupId,
-            membership,
-            roleIds: membershipRoleIds,
-            grants: membershipGrants,
-            missingGrants: [] as string[],
-            depth,
-            isDirect: depth === 0,
-            isInherited: depth > 0,
-            traversedGroupIds,
-            cycleDetected: false,
-            maxDepthReached: false,
-          };
-        }
-        const doc = await group.get(ctx, currentGroupId);
-        if (doc === null || doc.parentGroupId === undefined) break;
-        currentGroupId = doc.parentGroupId;
-        depth += 1;
-      }
-      return {
-        requestedGroupId: opts.groupId,
-        matchedGroupId: null,
-        membership: null,
-        roleIds: [] as string[],
-        grants: [] as string[],
-        missingGrants: requiredGrants,
-        depth: null,
-        isDirect: false,
-        isInherited: false,
-        traversedGroupIds,
-        cycleDetected,
-        maxDepthReached,
-      };
-    },
-    require: async (
-      ctx: ComponentReadCtx,
-      opts: {
-        userId: string;
-        groupId: string;
-        roleIds?: string[];
-        grants?: string[];
-        maxDepth?: number;
-      },
-    ) => {
-      const result = await member.inherit(ctx, opts);
+
+      // Single cross-component RPC — hierarchy walk happens inside the component
+      const result = await ctx.runQuery(config.component.public.memberResolve, {
+        userId: opts.userId,
+        groupId: opts.groupId,
+        maxDepth,
+        ancestry: true,
+      });
+
+      const traversedGroupIds = result.traversedGroupIds ?? [];
+
       if (result.membership === null) {
-        throw new AuthError(
-          "FORBIDDEN",
-          `User ${opts.userId} has no membership on group ${opts.groupId} or its ancestors.`,
-        ).toConvexError();
+        return {
+          requestedGroupId: opts.groupId,
+          matchedGroupId: null,
+          membership: null,
+          roleIds: [] as string[],
+          grants: [] as string[],
+          missingGrants: requiredGrants,
+          depth: null,
+          isDirect: false,
+          isInherited: false,
+          traversedGroupIds,
+          cycleDetected: false,
+          maxDepthReached: false,
+        };
+      }
+
+      // Grant resolution uses app-defined roles — stays server-side
+      const membershipRoleIds = (result.membership as any).roleIds ?? [];
+      const membershipGrants = resolveGrantedPermissions(membershipRoleIds);
+
+      // Check role filter
+      if (
+        roleFilter !== null &&
+        !membershipRoleIds.some((roleId: string) => roleFilter.has(roleId))
+      ) {
+        return {
+          requestedGroupId: opts.groupId,
+          matchedGroupId: null,
+          membership: null,
+          roleIds: [] as string[],
+          grants: [] as string[],
+          missingGrants: requiredGrants,
+          depth: null,
+          isDirect: false,
+          isInherited: false,
+          traversedGroupIds,
+          cycleDetected: false,
+          maxDepthReached: false,
+        };
+      }
+
+      // Check required grants
+      const missingGrants = requiredGrants.filter(
+        (grant) => !membershipGrants.includes(grant),
+      );
+      if (missingGrants.length > 0) {
+        return {
+          requestedGroupId: opts.groupId,
+          matchedGroupId: result.matchedGroupId,
+          membership: result.membership,
+          roleIds: membershipRoleIds,
+          grants: membershipGrants,
+          missingGrants,
+          depth: result.depth,
+          isDirect: result.isDirect,
+          isInherited: result.isInherited,
+          traversedGroupIds,
+          cycleDetected: false,
+          maxDepthReached: false,
+        };
       }
+
       return {
-        membership: result.membership,
+        requestedGroupId: opts.groupId,
         matchedGroupId: result.matchedGroupId,
-        roleIds: result.roleIds,
-        grants: result.grants,
+        membership: result.membership,
+        roleIds: membershipRoleIds,
+        grants: membershipGrants,
+        missingGrants: [] as string[],
+        depth: result.depth,
         isDirect: result.isDirect,
         isInherited: result.isInherited,
-        depth: result.depth,
+        traversedGroupIds,
+        cycleDetected: false,
+        maxDepthReached: false,
       };
     },
   };
@@ -753,12 +772,25 @@ export function createCoreDomains(deps: CoreDeps) {
       },
     ) => {
       const requiredGrants = Array.from(new Set(opts.grants));
-      const result = await member.inherit(ctx, {
+      const result = await member.resolve(ctx, {
         userId: opts.userId,
         groupId: opts.groupId,
         grants: requiredGrants,
         maxDepth: opts.maxDepth,
       });
+      if ("code" in result && result.code === "INVALID_ROLE_IDS") {
+        return {
+          ok: false,
+          membership: null,
+          matchedGroupId: null,
+          roleIds: [] as string[],
+          grants: [] as string[],
+          missingGrants: requiredGrants,
+          isDirect: false,
+          isInherited: false,
+          depth: null,
+        };
+      }
       const missingGrants = requiredGrants.filter(
         (grant) => !result.grants.includes(grant),
       );
@@ -774,24 +806,6 @@ export function createCoreDomains(deps: CoreDeps) {
         depth: result.depth,
       };
     },
-    require: async (
-      ctx: ComponentReadCtx,
-      opts: {
-        userId: string;
-        groupId: string;
-        grants: string[];
-        maxDepth?: number;
-      },
-    ) => {
-      const result = await access.check(ctx, opts);
-      if (!result.ok) {
-        throw new AuthError(
-          "FORBIDDEN",
-          `User ${opts.userId} is missing required grants on group ${opts.groupId}: ${result.missingGrants.join(", ")}.`,
-        ).toConvexError();
-      }
-      return result;
-    },
   };
 
   const invite = {
@@ -805,8 +819,14 @@ export function createCoreDomains(deps: CoreDeps) {
         expiresTime?: number;
         extend?: Record<string, unknown>;
       },
-    ): Promise<{ ok: true; inviteId: string; token: string }> => {
-      const roleIds = normalizeRoleIds(data.roleIds);
+    ) => {
+      const normalized = normalizeRoleIds(data.roleIds);
+      if (!normalized.ok)
+        return {
+          ok: false as const,
+          code: "INVALID_ROLE_IDS" as const,
+          invalidRoleIds: normalized.invalidRoleIds,
+        };
       const token = generateRandomString(
         inviteTokenLength,
         inviteTokenAlphabet,
@@ -814,9 +834,9 @@ export function createCoreDomains(deps: CoreDeps) {
       const tokenHash = await sha256(token);
       const inviteId = (await ctx.runMutation(
         config.component.public.inviteCreate,
-        { ...data, roleIds, tokenHash, status: "pending" },
+        { ...data, roleIds: normalized.roleIds, tokenHash, status: "pending" },
       )) as string;
-      return { ok: true, inviteId, token };
+      return { ok: true as const, inviteId, token };
     },
     get: async (ctx: ComponentReadCtx, inviteId: string) => {
       return await ctx.runQuery(config.component.public.inviteGet, {
@@ -923,46 +943,53 @@ export function createCoreDomains(deps: CoreDeps) {
     verify: async (
       ctx: ComponentCtx,
       rawKey: string,
-    ): Promise<{ userId: string; keyId: string; scopes: ScopeChecker }> => {
+    ): Promise<
+      | { ok: true; userId: string; keyId: string; scopes: ScopeChecker }
+      | {
+          ok: false;
+          code:
+            | "INVALID_API_KEY"
+            | "API_KEY_REVOKED"
+            | "API_KEY_EXPIRED"
+            | "API_KEY_RATE_LIMITED";
+        }
+    > => {
       const hashedKey = await hashApiKey(rawKey);
       const doc = (await ctx.runQuery(
         config.component.public.keyGetByHashedKey,
         { hashedKey },
       )) as KeyDoc | null;
-      return Fx.run(
-        Fx.gen(function* () {
-          yield* Fx.guard(!doc, Fx.fail(new AuthError("INVALID_API_KEY")));
-          const k = doc!;
-          yield* Fx.guard(k.revoked, Fx.fail(new AuthError("API_KEY_REVOKED")));
-          yield* Fx.guard(
-            !!(k.expiresAt && k.expiresAt < Date.now()),
-            Fx.fail(new AuthError("API_KEY_EXPIRED")),
-          );
-          const patchData: Record<string, unknown> = { lastUsedAt: Date.now() };
-          if (k.rateLimit) {
-            const { limited, newState } = checkKeyRateLimit(
-              k.rateLimit,
-              k.rateLimitState ?? undefined,
-            );
-            yield* Fx.guard(
-              limited,
-              Fx.fail(new AuthError("API_KEY_RATE_LIMITED")),
-            );
-            patchData.rateLimitState = newState;
-          }
-          yield* Fx.promise(() =>
-            ctx.runMutation(config.component.public.keyPatch, {
-              keyId: k._id,
-              data: patchData,
-            }),
-          );
-          return {
-            userId: k.userId,
-            keyId: k._id,
-            scopes: buildScopeChecker(k.scopes),
-          };
-        }).pipe(Fx.recover((e) => Fx.fatal(e.toConvexError()))),
-      );
+      if (!doc) {
+        return { ok: false as const, code: "INVALID_API_KEY" as const };
+      }
+      const k = doc;
+      if (k.revoked) {
+        return { ok: false as const, code: "API_KEY_REVOKED" as const };
+      }
+      if (k.expiresAt && k.expiresAt < Date.now()) {
+        return { ok: false as const, code: "API_KEY_EXPIRED" as const };
+      }
+      const patchData: Record<string, unknown> = { lastUsedAt: Date.now() };
+      if (k.rateLimit) {
+        const { limited, newState } = checkKeyRateLimit(
+          k.rateLimit,
+          k.rateLimitState ?? undefined,
+        );
+        if (limited) {
+          return { ok: false as const, code: "API_KEY_RATE_LIMITED" as const };
+        }
+        patchData.rateLimitState = newState;
+      }
+      await ctx.runMutation(config.component.public.keyPatch, {
+        keyId: k._id,
+        data: patchData,
+      });
+      return {
+        ok: true as const,
+        userId: k.userId,
+        keyId: k._id,
+        scopes: buildScopeChecker(k.scopes),
+      };
     },
     list: async (
       ctx: ComponentReadCtx,
@@ -1027,20 +1054,18 @@ export function createCoreDomains(deps: CoreDeps) {
       ctx: ComponentCtx,
       keyId: string,
       opts?: { name?: string; expiresAt?: number },
-    ): Promise<{ ok: true; keyId: string; secret: string }> => {
+    ): Promise<
+      | { ok: true; keyId: string; secret: string }
+      | { ok: false; code: "INVALID_PARAMETERS" | "API_KEY_REVOKED" }
+    > => {
       const existing = await ctx.runQuery(config.component.public.keyGetById, {
         keyId,
       });
-      if (!existing)
-        throw new AuthError(
-          "INVALID_PARAMETERS",
-          "API key not found.",
-        ).toConvexError();
+      if (!existing) {
+        return { ok: false as const, code: "INVALID_PARAMETERS" as const };
+      }
       if ((existing as any).revoked === true) {
-        throw new AuthError(
-          "API_KEY_REVOKED",
-          "Cannot rotate a key that is already revoked.",
-        ).toConvexError();
+        return { ok: false as const, code: "API_KEY_REVOKED" as const };
       }
       await ctx.runMutation(config.component.public.keyPatch, {
         keyId,