@robelest/convex-auth 0.0.4-preview.16 → 0.0.4-preview.18

package/dist/component/server/domains/core.js

@@ -1,4 +1,3 @@
-import { AuthError, Fx } from "../fx.js";
 import { TOKEN_SUB_CLAIM_DIVIDER, generateRandomString, sha256 } from "../utils.js";
 import { buildScopeChecker, checkKeyRateLimit, generateApiKey, hashApiKey } from "../keys.js";
 import { materializeProvider } from "../providers.js";
@@ -12,25 +11,39 @@ function createCoreDomains(deps) {
 	const { config, getAuth, callInvalidateSessions, callCreateAccountFromCredentials, callRetrieveAccountWithCredentials, callModifyAccount, getEnrichCtx, inviteTokenAlphabet, inviteTokenLength } = deps;
 	const roleDefinitions = config.authorization.roles;
 	const getRoleDefinition = (roleId) => {
-		const role = roleDefinitions[roleId];
-		if (!role) throw new AuthError("INVALID_PARAMETERS", `Unknown roleId "${roleId}".`).toConvexError();
-		return role;
+		return roleDefinitions[roleId] ?? null;
 	};
 	const normalizeRoleIds = (roleIds) => {
 		const normalized = Array.from(new Set(roleIds ?? []));
-		for (const roleId of normalized) getRoleDefinition(roleId);
-		return normalized;
+		const invalid = normalized.filter((id) => getRoleDefinition(id) === null);
+		if (invalid.length > 0) return {
+			ok: false,
+			invalidRoleIds: invalid
+		};
+		return {
+			ok: true,
+			roleIds: normalized
+		};
 	};
 	const resolveGrantedPermissions = (roleIds) => {
 		const grants = /* @__PURE__ */ new Set();
 		for (const roleId of roleIds ?? []) {
 			const role = getRoleDefinition(roleId);
+			if (role === null) continue;
 			for (const grant of role.grants) grants.add(grant);
 		}
 		return Array.from(grants).sort();
 	};
+	const AUTH_CACHE = Symbol("__convexAuthCache");
+	function cache(ctx) {
+		if (!ctx[AUTH_CACHE]) ctx[AUTH_CACHE] = {
+			users: /* @__PURE__ */ new Map(),
+			groups: /* @__PURE__ */ new Map()
+		};
+		return ctx[AUTH_CACHE];
+	}
 	const user = {
-		current: async (ctx, request) => {
+		id: async (ctx, request) => {
 			const identity = await ctx.auth.getUserIdentity();
 			if (identity !== null) {
 				const [userId] = identity.subject.split(TOKEN_SUB_CLAIM_DIVIDER);
@@ -40,30 +53,27 @@ function createCoreDomains(deps) {
 				const authHeader = request.headers.get("Authorization");
 				if (authHeader?.startsWith("Bearer sk_")) {
 					const rawKey = authHeader.slice(7);
-					try {
-						return (await getAuth().key.verify(ctx, rawKey)).userId;
-					} catch {
-						return null;
-					}
+					const result = await getAuth().key.verify(ctx, rawKey);
+					if (result.ok) return result.userId;
+					return null;
 				}
 			}
 			return null;
 		},
-		require: async (ctx, request) => {
-			const userId = await user.current(ctx, request);
-			if (userId === null) throw new AuthError("NOT_SIGNED_IN").toConvexError();
-			return userId;
-		},
 		get: async (ctx, userId) => {
-			return await ctx.runQuery(config.component.public.userGetById, { userId });
+			const c = cache(ctx);
+			if (c.users.has(userId)) return c.users.get(userId);
+			const result = await ctx.runQuery(config.component.public.userGetById, { userId });
+			c.users.set(userId, result);
+			return result;
 		},
 		list: async (ctx, opts = {}) => {
 			return await ctx.runQuery(config.component.public.userList, opts);
 		},
 		viewer: async (ctx) => {
-			const userId = await user.current(ctx);
+			const userId = await user.id(ctx);
 			if (userId === null) return null;
-			return await ctx.runQuery(config.component.public.userGetById, { userId });
+			return await user.get(ctx, userId);
 		},
 		update: async (ctx, userId, data) => {
 			await ctx.runMutation(config.component.public.userPatch, {
@@ -116,7 +126,10 @@ function createCoreDomains(deps) {
 				ctx.runQuery(config.component.public.totpListByUserId, { userId })
 			]);
 			const totalLinked = sessions.length + accounts.length + keys.length + members.length + passkeys.length + totps.length;
-			if (!cascade && totalLinked > 0) throw new AuthError("INVALID_PARAMETERS", `Cannot delete user with ${totalLinked} linked records. Pass { cascade: true } to delete all linked records, or remove them manually first.`).toConvexError();
+			if (!cascade && totalLinked > 0) return {
+				ok: false,
+				code: "INVALID_PARAMETERS"
+			};
 			const deletions = [];
 			for (const s of sessions) deletions.push(ctx.runMutation(config.component.public.sessionDelete, { sessionId: s._id }));
 			for (const a of accounts) deletions.push(ctx.runMutation(config.component.public.accountDelete, { accountId: a._id }));
@@ -163,7 +176,7 @@ function createCoreDomains(deps) {
 		},
 		get: async (ctx, args) => {
 			const result = await callRetrieveAccountWithCredentials(ctx, args);
-			if (typeof result === "string") throw new AuthError("ACCOUNT_NOT_FOUND", result).toConvexError();
+			if (typeof result === "string") return null;
 			return result;
 		},
 		update: async (ctx, args) => {
@@ -175,8 +188,14 @@ function createCoreDomains(deps) {
 		},
 		delete: async (ctx, accountId) => {
 			const doc = await ctx.runQuery(config.component.public.accountGetById, { accountId });
-			if (doc === null) throw new AuthError("ACCOUNT_NOT_FOUND", "Account not found.").toConvexError();
-			if ((await ctx.runQuery(config.component.public.accountListByUser, { userId: doc.userId })).length <= 1) throw new AuthError("INVALID_PARAMETERS", "Cannot unlink the user's only account. This would lock them out.").toConvexError();
+			if (doc === null) return {
+				ok: false,
+				code: "ACCOUNT_NOT_FOUND"
+			};
+			if ((await ctx.runQuery(config.component.public.accountListByUser, { userId: doc.userId })).length <= 1) return {
+				ok: false,
+				code: "INVALID_PARAMETERS"
+			};
 			await ctx.runMutation(config.component.public.accountDelete, { accountId });
 			return {
 				ok: true,
@@ -232,7 +251,11 @@ function createCoreDomains(deps) {
 			};
 		},
 		get: async (ctx, groupId) => {
-			return await ctx.runQuery(config.component.public.groupGet, { groupId });
+			const c = cache(ctx);
+			if (c.groups.has(groupId)) return c.groups.get(groupId);
+			const result = await ctx.runQuery(config.component.public.groupGet, { groupId });
+			c.groups.set(groupId, result);
+			return result;
 		},
 		list: async (ctx, opts) => {
 			return await ctx.runQuery(config.component.public.groupList, {
@@ -301,12 +324,17 @@ function createCoreDomains(deps) {
 	};
 	const member = {
 		create: async (ctx, data) => {
-			const roleIds = normalizeRoleIds(data.roleIds);
+			const normalized = normalizeRoleIds(data.roleIds);
+			if (!normalized.ok) return {
+				ok: false,
+				code: "INVALID_ROLE_IDS",
+				invalidRoleIds: normalized.invalidRoleIds
+			};
 			return {
 				ok: true,
 				memberId: await ctx.runMutation(config.component.public.memberAdd, {
 					...data,
-					roleIds
+					roleIds: normalized.roleIds
 				})
 			};
 		},
@@ -334,7 +362,15 @@ function createCoreDomains(deps) {
 		},
 		update: async (ctx, memberId, data) => {
 			const nextData = { ...data };
-			if ("roleIds" in nextData) nextData.roleIds = normalizeRoleIds(Array.isArray(nextData.roleIds) ? nextData.roleIds : void 0);
+			if ("roleIds" in nextData) {
+				const normalized = normalizeRoleIds(Array.isArray(nextData.roleIds) ? nextData.roleIds : void 0);
+				if (!normalized.ok) return {
+					ok: false,
+					code: "INVALID_ROLE_IDS",
+					invalidRoleIds: normalized.invalidRoleIds
+				};
+				nextData.roleIds = normalized.roleIds;
+			}
 			await ctx.runMutation(config.component.public.memberUpdate, {
 				memberId,
 				data: nextData
@@ -344,54 +380,25 @@ function createCoreDomains(deps) {
 				memberId
 			};
 		},
-		inherit: async (ctx, opts) => {
-			const requestedRoleIds = normalizeRoleIds(opts.roleIds);
+		resolve: async (ctx, opts) => {
+			const normalized = normalizeRoleIds(opts.roleIds);
+			if (!normalized.ok) return {
+				ok: false,
+				code: "INVALID_ROLE_IDS",
+				invalidRoleIds: normalized.invalidRoleIds
+			};
+			const requestedRoleIds = normalized.roleIds;
 			const roleFilter = requestedRoleIds.length > 0 ? new Set(requestedRoleIds) : null;
 			const requiredGrants = Array.from(new Set(opts.grants ?? []));
 			const maxDepth = Math.max(0, Math.floor(opts.maxDepth ?? 32));
-			const visited = /* @__PURE__ */ new Set();
-			const traversedGroupIds = [];
-			let currentGroupId = opts.groupId;
-			let depth = 0;
-			let cycleDetected = false;
-			let maxDepthReached = false;
-			while (currentGroupId !== void 0) {
-				if (depth > maxDepth) {
-					maxDepthReached = true;
-					break;
-				}
-				if (visited.has(currentGroupId)) {
-					cycleDetected = true;
-					break;
-				}
-				visited.add(currentGroupId);
-				traversedGroupIds.push(currentGroupId);
-				const membership = await member.getByUserAndGroup(ctx, {
-					userId: opts.userId,
-					groupId: currentGroupId
-				});
-				const membershipRoleIds = membership?.roleIds ?? [];
-				const membershipGrants = resolveGrantedPermissions(membershipRoleIds);
-				if (membership !== null && (roleFilter === null || membershipRoleIds.some((roleId) => roleFilter.has(roleId))) && requiredGrants.every((grant) => membershipGrants.includes(grant))) return {
-					requestedGroupId: opts.groupId,
-					matchedGroupId: currentGroupId,
-					membership,
-					roleIds: membershipRoleIds,
-					grants: membershipGrants,
-					missingGrants: [],
-					depth,
-					isDirect: depth === 0,
-					isInherited: depth > 0,
-					traversedGroupIds,
-					cycleDetected: false,
-					maxDepthReached: false
-				};
-				const doc = await group.get(ctx, currentGroupId);
-				if (doc === null || doc.parentGroupId === void 0) break;
-				currentGroupId = doc.parentGroupId;
-				depth += 1;
-			}
-			return {
+			const result = await ctx.runQuery(config.component.public.memberResolve, {
+				userId: opts.userId,
+				groupId: opts.groupId,
+				maxDepth,
+				ancestry: true
+			});
+			const traversedGroupIds = result.traversedGroupIds ?? [];
+			if (result.membership === null) return {
 				requestedGroupId: opts.groupId,
 				matchedGroupId: null,
 				membership: null,
@@ -402,62 +409,103 @@ function createCoreDomains(deps) {
 				isDirect: false,
 				isInherited: false,
 				traversedGroupIds,
-				cycleDetected,
-				maxDepthReached
+				cycleDetected: false,
+				maxDepthReached: false
 			};
-		},
-		require: async (ctx, opts) => {
-			const result = await member.inherit(ctx, opts);
-			if (result.membership === null) throw new AuthError("FORBIDDEN", `User ${opts.userId} has no membership on group ${opts.groupId} or its ancestors.`).toConvexError();
-			return {
-				membership: result.membership,
+			const membershipRoleIds = result.membership.roleIds ?? [];
+			const membershipGrants = resolveGrantedPermissions(membershipRoleIds);
+			if (roleFilter !== null && !membershipRoleIds.some((roleId) => roleFilter.has(roleId))) return {
+				requestedGroupId: opts.groupId,
+				matchedGroupId: null,
+				membership: null,
+				roleIds: [],
+				grants: [],
+				missingGrants: requiredGrants,
+				depth: null,
+				isDirect: false,
+				isInherited: false,
+				traversedGroupIds,
+				cycleDetected: false,
+				maxDepthReached: false
+			};
+			const missingGrants = requiredGrants.filter((grant) => !membershipGrants.includes(grant));
+			if (missingGrants.length > 0) return {
+				requestedGroupId: opts.groupId,
 				matchedGroupId: result.matchedGroupId,
-				roleIds: result.roleIds,
-				grants: result.grants,
+				membership: result.membership,
+				roleIds: membershipRoleIds,
+				grants: membershipGrants,
+				missingGrants,
+				depth: result.depth,
 				isDirect: result.isDirect,
 				isInherited: result.isInherited,
-				depth: result.depth
+				traversedGroupIds,
+				cycleDetected: false,
+				maxDepthReached: false
 			};
-		}
-	};
-	const access = {
-		check: async (ctx, opts) => {
-			const requiredGrants = Array.from(new Set(opts.grants));
-			const result = await member.inherit(ctx, {
-				userId: opts.userId,
-				groupId: opts.groupId,
-				grants: requiredGrants,
-				maxDepth: opts.maxDepth
-			});
-			const missingGrants = requiredGrants.filter((grant) => !result.grants.includes(grant));
 			return {
-				ok: result.membership !== null && missingGrants.length === 0,
-				membership: result.membership,
+				requestedGroupId: opts.groupId,
 				matchedGroupId: result.matchedGroupId,
-				roleIds: result.roleIds,
-				grants: result.grants,
-				missingGrants,
+				membership: result.membership,
+				roleIds: membershipRoleIds,
+				grants: membershipGrants,
+				missingGrants: [],
+				depth: result.depth,
 				isDirect: result.isDirect,
 				isInherited: result.isInherited,
-				depth: result.depth
+				traversedGroupIds,
+				cycleDetected: false,
+				maxDepthReached: false
 			};
-		},
-		require: async (ctx, opts) => {
-			const result = await access.check(ctx, opts);
-			if (!result.ok) throw new AuthError("FORBIDDEN", `User ${opts.userId} is missing required grants on group ${opts.groupId}: ${result.missingGrants.join(", ")}.`).toConvexError();
-			return result;
 		}
 	};
+	const access = { check: async (ctx, opts) => {
+		const requiredGrants = Array.from(new Set(opts.grants));
+		const result = await member.resolve(ctx, {
+			userId: opts.userId,
+			groupId: opts.groupId,
+			grants: requiredGrants,
+			maxDepth: opts.maxDepth
+		});
+		if ("code" in result && result.code === "INVALID_ROLE_IDS") return {
+			ok: false,
+			membership: null,
+			matchedGroupId: null,
+			roleIds: [],
+			grants: [],
+			missingGrants: requiredGrants,
+			isDirect: false,
+			isInherited: false,
+			depth: null
+		};
+		const missingGrants = requiredGrants.filter((grant) => !result.grants.includes(grant));
+		return {
+			ok: result.membership !== null && missingGrants.length === 0,
+			membership: result.membership,
+			matchedGroupId: result.matchedGroupId,
+			roleIds: result.roleIds,
+			grants: result.grants,
+			missingGrants,
+			isDirect: result.isDirect,
+			isInherited: result.isInherited,
+			depth: result.depth
+		};
+	} };
 	const invite = {
 		create: async (ctx, data) => {
-			const roleIds = normalizeRoleIds(data.roleIds);
+			const normalized = normalizeRoleIds(data.roleIds);
+			if (!normalized.ok) return {
+				ok: false,
+				code: "INVALID_ROLE_IDS",
+				invalidRoleIds: normalized.invalidRoleIds
+			};
 			const token = generateRandomString(inviteTokenLength, inviteTokenAlphabet);
 			const tokenHash = await sha256(token);
 			return {
 				ok: true,
 				inviteId: await ctx.runMutation(config.component.public.inviteCreate, {
 					...data,
-					roleIds,
+					roleIds: normalized.roleIds,
 					tokenHash,
 					status: "pending"
 				}),
@@ -532,27 +580,38 @@ function createCoreDomains(deps) {
 		verify: async (ctx, rawKey) => {
 			const hashedKey = await hashApiKey(rawKey);
 			const doc = await ctx.runQuery(config.component.public.keyGetByHashedKey, { hashedKey });
-			return Fx.run(Fx.gen(function* () {
-				yield* Fx.guard(!doc, Fx.fail(new AuthError("INVALID_API_KEY")));
-				const k = doc;
-				yield* Fx.guard(k.revoked, Fx.fail(new AuthError("API_KEY_REVOKED")));
-				yield* Fx.guard(!!(k.expiresAt && k.expiresAt < Date.now()), Fx.fail(new AuthError("API_KEY_EXPIRED")));
-				const patchData = { lastUsedAt: Date.now() };
-				if (k.rateLimit) {
-					const { limited, newState } = checkKeyRateLimit(k.rateLimit, k.rateLimitState ?? void 0);
-					yield* Fx.guard(limited, Fx.fail(new AuthError("API_KEY_RATE_LIMITED")));
-					patchData.rateLimitState = newState;
-				}
-				yield* Fx.promise(() => ctx.runMutation(config.component.public.keyPatch, {
-					keyId: k._id,
-					data: patchData
-				}));
-				return {
-					userId: k.userId,
-					keyId: k._id,
-					scopes: buildScopeChecker(k.scopes)
+			if (!doc) return {
+				ok: false,
+				code: "INVALID_API_KEY"
+			};
+			const k = doc;
+			if (k.revoked) return {
+				ok: false,
+				code: "API_KEY_REVOKED"
+			};
+			if (k.expiresAt && k.expiresAt < Date.now()) return {
+				ok: false,
+				code: "API_KEY_EXPIRED"
+			};
+			const patchData = { lastUsedAt: Date.now() };
+			if (k.rateLimit) {
+				const { limited, newState } = checkKeyRateLimit(k.rateLimit, k.rateLimitState ?? void 0);
+				if (limited) return {
+					ok: false,
+					code: "API_KEY_RATE_LIMITED"
 				};
-			}).pipe(Fx.recover((e) => Fx.fatal(e.toConvexError()))));
+				patchData.rateLimitState = newState;
+			}
+			await ctx.runMutation(config.component.public.keyPatch, {
+				keyId: k._id,
+				data: patchData
+			});
+			return {
+				ok: true,
+				userId: k.userId,
+				keyId: k._id,
+				scopes: buildScopeChecker(k.scopes)
+			};
 		},
 		list: async (ctx, opts) => {
 			return await ctx.runQuery(config.component.public.keyList, {
@@ -595,8 +654,14 @@ function createCoreDomains(deps) {
 		},
 		rotate: async (ctx, keyId, opts) => {
 			const existing = await ctx.runQuery(config.component.public.keyGetById, { keyId });
-			if (!existing) throw new AuthError("INVALID_PARAMETERS", "API key not found.").toConvexError();
-			if (existing.revoked === true) throw new AuthError("API_KEY_REVOKED", "Cannot rotate a key that is already revoked.").toConvexError();
+			if (!existing) return {
+				ok: false,
+				code: "INVALID_PARAMETERS"
+			};
+			if (existing.revoked === true) return {
+				ok: false,
+				code: "API_KEY_REVOKED"
+			};
 			await ctx.runMutation(config.component.public.keyPatch, {
 				keyId,
 				data: { revoked: true }