@robelest/convex-auth 0.0.4-preview.16 → 0.0.4-preview.18

package/src/server/index.ts

@@ -53,7 +53,7 @@ export type EnterpriseAdminAuthorizationInput = {
 export type EnterpriseAuthorizer = (
   ctx: { auth: import("convex/server").Auth },
   input: EnterpriseAdminAuthorizationInput,
-) => Promise<void>;
+) => Promise<void | { ok: false }>;
 
 type RoleRef<TRoleId extends string> = { id: TRoleId };
 
@@ -78,8 +78,10 @@ type MountedEnterpriseTarget = {
 };
 
 function requireSignedInUser(auth: Pick<AuthApi, "user">) {
-  return async (ctx: { auth: import("convex/server").Auth }) => {
-    return await auth.user.require(ctx as never);
+  return async (ctx: {
+    auth: import("convex/server").Auth;
+  }): Promise<string | null> => {
+    return await auth.user.id(ctx as never);
   };
 }
 
@@ -157,22 +159,24 @@ function createMountedAdminAuthorizer(
     target: MountedEnterpriseTarget = {},
   ) => {
     const userId = await requireUserId(ctx);
+    if (userId === null) {
+      return { ok: false as const, code: "NOT_SIGNED_IN" as const };
+    }
     if (!options?.admin?.authorized) {
-      throw new ConvexError({
-        code: "FORBIDDEN",
-        message:
-          "Mounted enterprise admin APIs require an authorized callback.",
-      });
+      return { ok: false as const, code: "FORBIDDEN" as const };
     }
     const resolved = await resolveMountedEnterpriseTarget(auth, ctx, target);
-    await options.admin.authorized(ctx, {
+    const authResult = await options.admin.authorized(ctx, {
       userId,
       permission,
       enterpriseId: resolved.enterpriseId,
       groupId: resolved.groupId,
       resolvedGroupId: resolved.resolvedGroupId,
     });
-    return { userId, ...resolved };
+    if (authResult && !authResult.ok) {
+      return { ok: false as const, code: "FORBIDDEN" as const };
+    }
+    return { ok: true as const, userId, ...resolved };
   };
 }
 
@@ -205,9 +209,12 @@ export function sso<
             domain: v.optional(v.string()),
           },
           handler: async (ctx, args) => {
-            const { userId } = await authorize(ctx, "sso.connection.create", {
+            const authResult = await authorize(ctx, "sso.connection.create", {
               groupId: args.groupId,
             });
+            if (!authResult.ok)
+              return { ok: false as const, code: authResult.code };
+            const { userId } = authResult;
             const createsGroup = args.groupId === undefined;
             const groupId =
               args.groupId ??
@@ -251,9 +258,10 @@ export function sso<
         get: queryGeneric({
           args: { enterpriseId: v.string() },
           handler: async (ctx, args) => {
-            await authorize(ctx, "sso.connection.read", {
+            const _auth = await authorize(ctx, "sso.connection.read", {
               enterpriseId: args.enterpriseId,
             });
+            if (!_auth.ok) return null;
             return await auth.sso.admin.connection.get(
               ctx as never,
               args.enterpriseId,
@@ -263,9 +271,10 @@ export function sso<
         getByGroup: queryGeneric({
           args: { groupId: v.string() },
           handler: async (ctx, args) => {
-            await authorize(ctx, "sso.connection.read", {
+            const _auth = await authorize(ctx, "sso.connection.read", {
               groupId: args.groupId,
             });
+            if (!_auth.ok) return null;
             return await auth.sso.admin.connection.getByGroup(
               ctx as never,
               args.groupId,
@@ -275,9 +284,10 @@ export function sso<
         getByDomain: queryGeneric({
           args: { domain: v.string() },
           handler: async (ctx, args) => {
-            await authorize(ctx, "sso.connection.read", {
+            const _auth = await authorize(ctx, "sso.connection.read", {
               domain: args.domain,
             });
+            if (!_auth.ok) return null;
             return await auth.sso.admin.connection.getByDomain(
               ctx as never,
               args.domain,
@@ -293,9 +303,10 @@ export function sso<
             order: v.optional(v.union(v.literal("asc"), v.literal("desc"))),
           },
           handler: async (ctx, args) => {
-            await authorize(ctx, "sso.connection.read", {
+            const _auth = await authorize(ctx, "sso.connection.read", {
               groupId: args.where?.groupId,
             });
+            if (!_auth.ok) return null;
             return await auth.sso.admin.connection.list(
               ctx as never,
               args as never,
@@ -312,9 +323,10 @@ export function sso<
             }),
           },
           handler: async (ctx, args) => {
-            await authorize(ctx, "sso.connection.manage", {
+            const _auth = await authorize(ctx, "sso.connection.manage", {
               enterpriseId: args.enterpriseId,
             });
+            if (!_auth.ok) return { ok: false as const, code: _auth.code };
             await auth.sso.admin.connection.update(
               ctx as never,
               args.enterpriseId,
@@ -326,9 +338,10 @@ export function sso<
         delete: mutationGeneric({
           args: { enterpriseId: v.string() },
           handler: async (ctx, args) => {
-            await authorize(ctx, "sso.connection.manage", {
+            const _auth = await authorize(ctx, "sso.connection.manage", {
               enterpriseId: args.enterpriseId,
             });
+            if (!_auth.ok) return { ok: false as const, code: _auth.code };
             return await auth.sso.admin.connection.delete(
               ctx as never,
               args.enterpriseId,
@@ -338,9 +351,10 @@ export function sso<
         status: queryGeneric({
           args: { enterpriseId: v.string() },
           handler: async (ctx, args) => {
-            await authorize(ctx, "sso.connection.read", {
+            const _auth = await authorize(ctx, "sso.connection.read", {
               enterpriseId: args.enterpriseId,
             });
+            if (!_auth.ok) return null;
             return await auth.sso.admin.connection.status(
               ctx as never,
               args.enterpriseId,
@@ -351,9 +365,10 @@ export function sso<
           list: queryGeneric({
             args: { enterpriseId: v.string() },
             handler: async (ctx, args) => {
-              await authorize(ctx, "sso.connection.read", {
+              const _auth = await authorize(ctx, "sso.connection.read", {
                 enterpriseId: args.enterpriseId,
               });
+              if (!_auth.ok) return null;
               return await auth.sso.admin.connection.domain.list(
                 ctx as never,
                 args.enterpriseId,
@@ -363,9 +378,10 @@ export function sso<
           validate: queryGeneric({
             args: { enterpriseId: v.string() },
             handler: async (ctx, args) => {
-              await authorize(ctx, "sso.domain.manage", {
+              const _auth = await authorize(ctx, "sso.domain.manage", {
                 enterpriseId: args.enterpriseId,
               });
+              if (!_auth.ok) return null;
               return await auth.sso.admin.connection.domain.validate(
                 ctx as never,
                 args.enterpriseId,
@@ -378,9 +394,10 @@ export function sso<
               domains: v.array(enterpriseDomainInputValidator),
             },
             handler: async (ctx, args) => {
-              await authorize(ctx, "sso.domain.manage", {
+              const _auth = await authorize(ctx, "sso.domain.manage", {
                 enterpriseId: args.enterpriseId,
               });
+              if (!_auth.ok) return { ok: false as const, code: _auth.code };
               return await auth.sso.admin.connection.domain.set(
                 ctx as never,
                 args.enterpriseId,
@@ -392,9 +409,10 @@ export function sso<
             request: mutationGeneric({
               args: enterpriseDomainVerificationInputValidator,
               handler: async (ctx, args) => {
-                await authorize(ctx, "sso.domain.manage", {
+                const _auth = await authorize(ctx, "sso.domain.manage", {
                   enterpriseId: args.enterpriseId,
                 });
+                if (!_auth.ok) return { ok: false as const, code: _auth.code };
                 return await auth.sso.admin.connection.domain.verification.request(
                   ctx as never,
                   args,
@@ -404,9 +422,10 @@ export function sso<
             confirm: actionGeneric({
               args: enterpriseDomainVerificationInputValidator,
               handler: async (ctx, args) => {
-                await authorize(ctx, "sso.domain.manage", {
+                const _auth = await authorize(ctx, "sso.domain.manage", {
                   enterpriseId: args.enterpriseId,
                 });
+                if (!_auth.ok) return { ok: false as const, code: _auth.code };
                 return await auth.sso.admin.connection.domain.verification.confirm(
                   ctx as never,
                   args,
@@ -431,18 +450,20 @@ export function sso<
             extraFields: v.optional(v.record(v.string(), v.string())),
           },
           handler: async (ctx, args) => {
-            await authorize(ctx, "sso.protocol.manage", {
+            const _auth = await authorize(ctx, "sso.protocol.manage", {
               enterpriseId: args.enterpriseId,
             });
+            if (!_auth.ok) return { ok: false as const, code: _auth.code };
             return await auth.sso.admin.oidc.configure(ctx as never, args);
           },
         }),
         get: queryGeneric({
           args: { enterpriseId: v.string() },
           handler: async (ctx, args) => {
-            await authorize(ctx, "sso.connection.read", {
+            const _auth = await authorize(ctx, "sso.connection.read", {
               enterpriseId: args.enterpriseId,
             });
+            if (!_auth.ok) return null;
             return await auth.sso.admin.oidc.get(
               ctx as never,
               args.enterpriseId,
@@ -452,9 +473,10 @@ export function sso<
         validate: actionGeneric({
           args: { enterpriseId: v.string() },
           handler: async (ctx, args) => {
-            await authorize(ctx, "sso.protocol.manage", {
+            const _auth = await authorize(ctx, "sso.protocol.manage", {
               enterpriseId: args.enterpriseId,
             });
+            if (!_auth.ok) return { ok: false as const, code: _auth.code };
             return await auth.sso.admin.oidc.validate(
               ctx as never,
               args.enterpriseId,
@@ -476,18 +498,20 @@ export function sso<
             sp: v.optional(enterpriseSamlSpValidator),
           },
           handler: async (ctx, args) => {
-            await authorize(ctx, "sso.protocol.manage", {
+            const _auth = await authorize(ctx, "sso.protocol.manage", {
               enterpriseId: args.enterpriseId,
             });
+            if (!_auth.ok) return { ok: false as const, code: _auth.code };
             return await auth.sso.admin.saml.configure(ctx as never, args);
           },
         }),
         validate: queryGeneric({
           args: { enterpriseId: v.string() },
           handler: async (ctx, args) => {
-            await authorize(ctx, "sso.protocol.manage", {
+            const _auth = await authorize(ctx, "sso.protocol.manage", {
               enterpriseId: args.enterpriseId,
             });
+            if (!_auth.ok) return null;
             return await auth.sso.admin.saml.validate(
               ctx as never,
               args.enterpriseId,
@@ -499,9 +523,10 @@ export function sso<
         get: queryGeneric({
           args: { enterpriseId: v.string() },
           handler: async (ctx, args) => {
-            await authorize(ctx, "sso.connection.read", {
+            const _auth = await authorize(ctx, "sso.connection.read", {
               enterpriseId: args.enterpriseId,
             });
+            if (!_auth.ok) return null;
             return await auth.sso.admin.policy.get(
               ctx as never,
               args.enterpriseId,
@@ -514,9 +539,10 @@ export function sso<
             patch: enterprisePolicyPatchValidator,
           },
           handler: async (ctx, args) => {
-            await authorize(ctx, "sso.policy.manage", {
+            const _auth = await authorize(ctx, "sso.policy.manage", {
               enterpriseId: args.enterpriseId,
             });
+            if (!_auth.ok) return { ok: false as const, code: _auth.code };
             return await auth.sso.admin.policy.update(
               ctx as never,
               args.enterpriseId,
@@ -527,9 +553,10 @@ export function sso<
         validate: queryGeneric({
           args: { enterpriseId: v.string() },
           handler: async (ctx, args) => {
-            await authorize(ctx, "sso.policy.manage", {
+            const _auth = await authorize(ctx, "sso.policy.manage", {
               enterpriseId: args.enterpriseId,
             });
+            if (!_auth.ok) return null;
             return await auth.sso.admin.policy.validate(
               ctx as never,
               args.enterpriseId,
@@ -545,10 +572,11 @@ export function sso<
             limit: v.optional(v.number()),
           },
           handler: async (ctx, args) => {
-            await authorize(ctx, "sso.audit.read", {
+            const _auth = await authorize(ctx, "sso.audit.read", {
               enterpriseId: args.enterpriseId,
               groupId: args.groupId,
             });
+            if (!_auth.ok) return null;
             return await auth.sso.admin.audit.list(ctx as never, args);
           },
         }),
@@ -561,9 +589,10 @@ export function sso<
               limit: v.optional(v.number()),
             },
             handler: async (ctx, args) => {
-              await authorize(ctx, "sso.webhook.manage", {
+              const _auth = await authorize(ctx, "sso.webhook.manage", {
                 enterpriseId: args.enterpriseId,
               });
+              if (!_auth.ok) return null;
               return await (auth.sso.admin.webhook as any).delivery.list(
                 ctx as never,
                 args,
@@ -581,9 +610,12 @@ export function sso<
               createdByUserId: v.optional(v.string()),
             },
             handler: async (ctx, args) => {
-              const { userId } = await authorize(ctx, "sso.webhook.manage", {
+              const authResult = await authorize(ctx, "sso.webhook.manage", {
                 enterpriseId: args.enterpriseId,
               });
+              if (!authResult.ok)
+                return { ok: false as const, code: authResult.code };
+              const { userId } = authResult;
               const result = await auth.sso.admin.webhook.endpoint.create(
                 ctx as never,
                 {
@@ -605,9 +637,10 @@ export function sso<
           list: queryGeneric({
             args: { enterpriseId: v.string() },
             handler: async (ctx, args) => {
-              await authorize(ctx, "sso.webhook.manage", {
+              const _auth = await authorize(ctx, "sso.webhook.manage", {
                 enterpriseId: args.enterpriseId,
               });
+              if (!_auth.ok) return null;
               const endpoints = await auth.sso.admin.webhook.endpoint.list(
                 ctx as never,
                 args.enterpriseId,
@@ -626,15 +659,16 @@ export function sso<
                 args.endpointId,
               );
               if (!endpoint) {
-                throw new ConvexError({
-                  code: "INVALID_PARAMETERS",
-                  message: "Webhook endpoint not found.",
-                });
+                return {
+                  ok: false as const,
+                  code: "INVALID_PARAMETERS" as const,
+                };
               }
-              await authorize(ctx, "sso.webhook.manage", {
+              const _auth = await authorize(ctx, "sso.webhook.manage", {
                 enterpriseId: endpoint.enterpriseId,
                 groupId: endpoint.groupId,
               });
+              if (!_auth.ok) return { ok: false as const, code: _auth.code };
               return await auth.sso.admin.webhook.endpoint.disable(
                 ctx as never,
                 args.endpointId,
@@ -692,27 +726,30 @@ export function scim<
           status: v.optional(enterpriseStatusValidator),
         },
         handler: async (ctx, args) => {
-          await authorize(ctx, "scim.manage", {
+          const _auth = await authorize(ctx, "scim.manage", {
             enterpriseId: args.enterpriseId,
           });
+          if (!_auth.ok) return { ok: false as const, code: _auth.code };
           return await auth.scim.admin.configure(ctx as never, args);
         },
       }),
       get: queryGeneric({
         args: { enterpriseId: v.string() },
         handler: async (ctx, args) => {
-          await authorize(ctx, "scim.manage", {
+          const _auth = await authorize(ctx, "scim.manage", {
             enterpriseId: args.enterpriseId,
           });
+          if (!_auth.ok) return null;
           return await auth.scim.admin.get(ctx as never, args.enterpriseId);
         },
       }),
       validate: queryGeneric({
         args: { enterpriseId: v.string() },
         handler: async (ctx, args) => {
-          await authorize(ctx, "scim.manage", {
+          const _auth = await authorize(ctx, "scim.manage", {
             enterpriseId: args.enterpriseId,
           });
+          if (!_auth.ok) return null;
           return await auth.scim.admin.validate(
             ctx as never,
             args.enterpriseId,
@@ -854,14 +891,21 @@ export type ServerOptions = {
     | boolean;
 };
 
-export type RefreshResult = {
-  /** Structured cookies to set on the response. */
-  cookies: AuthCookie[];
-  /** URL to redirect to (set after OAuth code exchange). */
-  redirect?: string;
-  /** JWT for SSR hydration, or `null` if not authenticated. */
-  token: string | null;
-};
+export type RefreshResult =
+  | {
+      /** Code exchange occurred — return the pre-built redirect `Response`. */
+      redirect: true;
+      /** 302 redirect with Set-Cookie headers already serialized. */
+      response: Response;
+    }
+  | {
+      /** No redirect — apply cookies and read the token. */
+      redirect: false;
+      /** Structured cookies to set on the response. */
+      cookies: AuthCookie[];
+      /** JWT for SSR hydration, or `null` if not authenticated. */
+      token: string | null;
+    };
 
 const TOKEN_COOKIE_BASE_NAME = "__convexAuthJWT";
 const REFRESH_COOKIE_BASE_NAME = "__convexAuthRefreshToken";
@@ -1126,6 +1170,33 @@ function canParseUrl(value: string): boolean {
   }
 }
 
+function serializeAuthCookie(cookie: AuthCookie): string {
+  const parts = [
+    `${cookie.name}=${cookie.value}`,
+    `Path=${cookie.options.path}`,
+  ];
+  if (cookie.options.httpOnly) parts.push("HttpOnly");
+  if (cookie.options.secure) parts.push("Secure");
+  if (cookie.options.sameSite)
+    parts.push(`SameSite=${cookie.options.sameSite}`);
+  if (cookie.options.maxAge !== undefined)
+    parts.push(`Max-Age=${cookie.options.maxAge}`);
+  if (cookie.options.expires)
+    parts.push(`Expires=${cookie.options.expires.toUTCString()}`);
+  return parts.join("; ");
+}
+
+function buildRedirectResponse(
+  location: string,
+  cookies: AuthCookie[],
+): Response {
+  const headers = new Headers({ Location: location });
+  for (const cookie of cookies) {
+    headers.append("Set-Cookie", serializeAuthCookie(cookie));
+  }
+  return new Response(null, { status: 302, headers });
+}
+
 function deriveCookieNamespaceFromUrl(url: string) {
   if (!canParseUrl(url)) return DERIVED_COOKIE_NAMESPACE_FALLBACK;
   const parsed = new URL(url);
@@ -1866,7 +1937,11 @@ export function server(options: ServerOptions) {
       const corsRefreshResult = await Fx.run(
         Fx.match(corsDispatch, corsDispatch.kind, {
           crossOrigin: () =>
-            ({ cookies: [], token: null }) satisfies RefreshResult,
+            ({
+              redirect: false,
+              cookies: [],
+              token: null,
+            }) satisfies RefreshResult,
           sameOrigin: () => null,
         }),
       );
@@ -1954,19 +2029,22 @@ export function server(options: ServerOptions) {
                 Fx.fold({
                   ok: (result): RefreshResult => {
                     redirectUrl.searchParams.delete("code");
+                    const cookies = structuredAuthCookies(
+                      {
+                        token: result.tokens?.token ?? null,
+                        refreshToken: result.tokens?.refreshToken ?? null,
+                        verifier: null,
+                      },
+                      host,
+                      cookieConfig,
+                      cookieNamespace,
+                    );
                     return {
-                      cookies: structuredAuthCookies(
-                        {
-                          token: result.tokens?.token ?? null,
-                          refreshToken: result.tokens?.refreshToken ?? null,
-                          verifier: null,
-                        },
-                        host,
-                        cookieConfig,
-                        cookieNamespace,
+                      redirect: true,
+                      response: buildRedirectResponse(
+                        redirectUrl.toString(),
+                        cookies,
                       ),
-                      redirect: redirectUrl.toString(),
-                      token: result.tokens?.token ?? null,
                     };
                   },
                   err: (error: unknown): RefreshResult => {
@@ -1993,24 +2071,28 @@ export function server(options: ServerOptions) {
                       errorCode === "INVALID_VERIFICATION_CODE";
                     if (!terminalCodeExchangeError) {
                       return {
+                        redirect: false,
                         cookies: [],
                         token: currentCookies.token,
                       };
                     }
                     redirectUrl.searchParams.delete("code");
+                    const cookies = structuredAuthCookies(
+                      {
+                        token: currentCookies.token,
+                        refreshToken: currentCookies.refreshToken,
+                        verifier: null,
+                      },
+                      host,
+                      cookieConfig,
+                      cookieNamespace,
+                    );
                     return {
-                      cookies: structuredAuthCookies(
-                        {
-                          token: currentCookies.token,
-                          refreshToken: currentCookies.refreshToken,
-                          verifier: null,
-                        },
-                        host,
-                        cookieConfig,
-                        cookieNamespace,
+                      redirect: true,
+                      response: buildRedirectResponse(
+                        redirectUrl.toString(),
+                        cookies,
                       ),
-                      redirect: redirectUrl.toString(),
-                      token: currentCookies.token,
                     };
                   },
                 }),
@@ -2501,10 +2583,11 @@ export function server(options: ServerOptions) {
         }),
       );
       if (tokens === undefined) {
-        return { cookies: [], token: currentToken };
+        return { redirect: false, cookies: [], token: currentToken };
       }
 
       return {
+        redirect: false,
         cookies: structuredAuthCookies(
           {
             token: tokens?.token ?? null,

package/src/server/signin.ts

@@ -142,6 +142,7 @@ function signInFx(
       passkey: (p) => handlePasskeyFx(ctx, p, args),
       totp: (p) => handleTotp(ctx, p, args),
       device: (p) => handleDevice(ctx, p, args),
+      sso: (_p) => handleSsoProviderFx(ctx, args),
     });
   });
 }
@@ -382,3 +383,54 @@ function handleOAuthProviderFx(
     };
   });
 }
+
+// ============================================================================
+// SSO (Enterprise OIDC / SAML)
+// ============================================================================
+
+function handleSsoProviderFx(
+  ctx: EnrichedActionCtx,
+  args: {
+    params?: Record<string, any>;
+  },
+): FxType<{ kind: "redirect"; redirect: string; verifier: string }, AuthError> {
+  return Fx.gen(function* () {
+    const enterpriseId = args.params?.enterpriseId;
+    if (!enterpriseId || typeof enterpriseId !== "string") {
+      return yield* Fx.fail(
+        new AuthError(
+          "SIGN_IN_MISSING_PARAMS",
+          "enterpriseId is required for SSO sign-in.",
+        ),
+      );
+    }
+
+    const protocol: "oidc" | "saml" = args.params?.protocol ?? "oidc";
+    if (protocol !== "oidc" && protocol !== "saml") {
+      return yield* Fx.fail(
+        new AuthError(
+          "SIGN_IN_MISSING_PARAMS",
+          `Invalid SSO protocol: ${protocol as string}. Expected "oidc" or "saml".`,
+        ),
+      );
+    }
+
+    const verifier = yield* Fx.promise(() => callVerifier(ctx));
+    const siteUrl =
+      process.env.CUSTOM_AUTH_SITE_URL ?? requireEnv("CONVEX_SITE_URL");
+    const redirect = new URL(
+      `${siteUrl}/api/auth/sso/${enterpriseId}/${protocol}/signin`,
+    );
+    redirect.searchParams.set("code", verifier);
+
+    if (typeof args.params?.redirectTo === "string") {
+      redirect.searchParams.set("redirectTo", args.params.redirectTo);
+    }
+
+    return {
+      kind: "redirect" as const,
+      redirect: redirect.toString(),
+      verifier,
+    };
+  });
+}

package/src/server/version.ts

@@ -1,2 +1,2 @@
 // Auto-generated by scripts/generate-version.js — do not edit.
-export const AUTH_VERSION = "0.0.4-preview.16";
+export const AUTH_VERSION = "0.0.4-preview.18";