@robelest/convex-auth 0.0.4-preview.18 → 0.0.4-preview.19

package/dist/server/limits.d.ts

@@ -0,0 +1 @@
+export { };

package/dist/server/{ratelimit.js → limits.js}

@@ -1,9 +1,9 @@
-import { AuthError } from "./fx.js";
+import { AuthError } from "./authError.js";
 import { errorMessage } from "./utils.js";
 import { authDb } from "./db.js";
 import { Fx } from "@robelest/fx";
 
-//#region src/server/ratelimit.ts
+//#region src/server/limits.ts
 const DEFAULT_MAX_SIGN_IN_ATTEMPTS_PER_HOUR = 10;
 /**
 * Check whether the given identifier is currently rate-limited.
@@ -58,4 +58,4 @@ const getRateLimitState = (ctx, identifier, config) => {
 
 //#endregion
 export { isSignInRateLimited, recordFailedSignIn, resetSignInRateLimit };
-//# sourceMappingURL=ratelimit.js.map
+//# sourceMappingURL=limits.js.map

package/dist/server/limits.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"limits.js","names":[],"sources":["../../src/server/limits.ts"],"sourcesContent":["import { Fx } from \"@robelest/fx\";\n\nimport { authDb } from \"./db\";\nimport { AuthError } from \"./authError\";\nimport { Doc, MutationCtx } from \"./types\";\nimport { ConvexAuthConfig } from \"./types\";\nimport { errorMessage } from \"./utils\";\n\nconst DEFAULT_MAX_SIGN_IN_ATTEMPTS_PER_HOUR = 10;\n\n/**\n * Check whether the given identifier is currently rate-limited.\n */\n/** @internal */\nexport const isSignInRateLimited = (\n  ctx: MutationCtx,\n  identifier: string,\n  config: ConvexAuthConfig,\n): Fx<boolean, AuthError> =>\n  getRateLimitState(ctx, identifier, config).pipe(\n    Fx.map((state) => state !== null && state.attemptsLeft < 1),\n  );\n\n/**\n * Record a failed sign-in attempt for the given identifier.\n *\n * If a record exists, decrement; otherwise create.\n */\n/** @internal */\nexport const recordFailedSignIn = (\n  ctx: MutationCtx,\n  identifier: string,\n  config: ConvexAuthConfig,\n): Fx<void, AuthError> =>\n  getRateLimitState(ctx, identifier, config).pipe(\n    Fx.chain((state) =>\n      state !== null\n        ? Fx.from({\n            ok: () =>\n              authDb(ctx, config).rateLimits.patch(state.limit._id, {\n                attemptsLeft: state.attemptsLeft - 1,\n                lastAttemptTime: Date.now(),\n              }),\n            err: (e) =>\n              new AuthError(\n                \"INTERNAL_ERROR\",\n                `Failed to patch rate limit: ${errorMessage(e)}`,\n              ),\n          })\n        : Fx.from({\n            ok: () =>\n              authDb(ctx, config).rateLimits.create({\n                identifier,\n                attemptsLeft:\n                  (config.signIn?.maxFailedAttemptsPerHour ??\n                    DEFAULT_MAX_SIGN_IN_ATTEMPTS_PER_HOUR) - 1,\n                lastAttemptTime: Date.now(),\n              }),\n            err: (e) =>\n              new AuthError(\n                \"INTERNAL_ERROR\",\n                `Failed to create rate limit: ${errorMessage(e)}`,\n              ),\n          }),\n    ),\n    Fx.map(() => undefined),\n  );\n\n/**\n * Reset the rate limit for the given identifier (e.g. after successful sign-in).\n */\n/** @internal */\nexport const resetSignInRateLimit = (\n  ctx: MutationCtx,\n  identifier: string,\n  config: ConvexAuthConfig,\n): Fx<void, AuthError> =>\n  getRateLimitState(ctx, identifier, config).pipe(\n    Fx.chain((state) =>\n      state !== null\n        ? Fx.from({\n            ok: () => authDb(ctx, config).rateLimits.delete(state.limit._id),\n            err: (e) =>\n              new AuthError(\n                \"INTERNAL_ERROR\",\n                `Failed to delete rate limit: ${errorMessage(e)}`,\n              ),\n          })\n        : Fx.unit,\n    ),\n  );\n\n// ---------------------------------------------------------------------------\n// Internal\n// ---------------------------------------------------------------------------\n\ntype RateLimitState = {\n  limit: Doc<\"RateLimit\"> & { attemptsLeft: number; lastAttemptTime: number };\n  attemptsLeft: number;\n} | null;\n\nconst getRateLimitState = (\n  ctx: MutationCtx,\n  identifier: string,\n  config: ConvexAuthConfig,\n): Fx<RateLimitState, AuthError> => {\n  const now = Date.now();\n  const maxAttemptsPerHour =\n    config.signIn?.maxFailedAttemptsPerHour ??\n    DEFAULT_MAX_SIGN_IN_ATTEMPTS_PER_HOUR;\n\n  return Fx.from({\n    ok: () => authDb(ctx, config).rateLimits.get(identifier),\n    err: (e) =>\n      new AuthError(\n        \"INTERNAL_ERROR\",\n        `Failed to get rate limit: ${errorMessage(e)}`,\n      ),\n  }).pipe(\n    Fx.map((raw) => {\n      const limit = raw as\n        | (Doc<\"RateLimit\"> & { attemptsLeft: number; lastAttemptTime: number })\n        | null;\n      if (limit === null) return null;\n      const elapsed = now - limit.lastAttemptTime;\n      const maxAttemptsPerMs = maxAttemptsPerHour / (60 * 60 * 1000);\n      const attemptsLeft = Math.min(\n        maxAttemptsPerHour,\n        limit.attemptsLeft + elapsed * maxAttemptsPerMs,\n      );\n      return { limit, attemptsLeft };\n    }),\n  );\n};\n"],"mappings":";;;;;;AAQA,MAAM,wCAAwC;;;;;AAM9C,MAAa,uBACX,KACA,YACA,WAEA,kBAAkB,KAAK,YAAY,OAAO,CAAC,KACzC,GAAG,KAAK,UAAU,UAAU,QAAQ,MAAM,eAAe,EAAE,CAC5D;;;;;;;AAQH,MAAa,sBACX,KACA,YACA,WAEA,kBAAkB,KAAK,YAAY,OAAO,CAAC,KACzC,GAAG,OAAO,UACR,UAAU,OACN,GAAG,KAAK;CACN,UACE,OAAO,KAAK,OAAO,CAAC,WAAW,MAAM,MAAM,MAAM,KAAK;EACpD,cAAc,MAAM,eAAe;EACnC,iBAAiB,KAAK,KAAK;EAC5B,CAAC;CACJ,MAAM,MACJ,IAAI,UACF,kBACA,+BAA+B,aAAa,EAAE,GAC/C;CACJ,CAAC,GACF,GAAG,KAAK;CACN,UACE,OAAO,KAAK,OAAO,CAAC,WAAW,OAAO;EACpC;EACA,eACG,OAAO,QAAQ,4BACd,yCAAyC;EAC7C,iBAAiB,KAAK,KAAK;EAC5B,CAAC;CACJ,MAAM,MACJ,IAAI,UACF,kBACA,gCAAgC,aAAa,EAAE,GAChD;CACJ,CAAC,CACP,EACD,GAAG,UAAU,OAAU,CACxB;;;;;AAMH,MAAa,wBACX,KACA,YACA,WAEA,kBAAkB,KAAK,YAAY,OAAO,CAAC,KACzC,GAAG,OAAO,UACR,UAAU,OACN,GAAG,KAAK;CACN,UAAU,OAAO,KAAK,OAAO,CAAC,WAAW,OAAO,MAAM,MAAM,IAAI;CAChE,MAAM,MACJ,IAAI,UACF,kBACA,gCAAgC,aAAa,EAAE,GAChD;CACJ,CAAC,GACF,GAAG,KACR,CACF;AAWH,MAAM,qBACJ,KACA,YACA,WACkC;CAClC,MAAM,MAAM,KAAK,KAAK;CACtB,MAAM,qBACJ,OAAO,QAAQ,4BACf;AAEF,QAAO,GAAG,KAAK;EACb,UAAU,OAAO,KAAK,OAAO,CAAC,WAAW,IAAI,WAAW;EACxD,MAAM,MACJ,IAAI,UACF,kBACA,6BAA6B,aAAa,EAAE,GAC7C;EACJ,CAAC,CAAC,KACD,GAAG,KAAK,QAAQ;EACd,MAAM,QAAQ;AAGd,MAAI,UAAU,KAAM,QAAO;EAC3B,MAAM,UAAU,MAAM,MAAM;EAC5B,MAAM,mBAAmB,sBAAsB,OAAU;AAKzD,SAAO;GAAE;GAAO,cAJK,KAAK,IACxB,oBACA,MAAM,eAAe,UAAU,iBAChC;GAC6B;GAC9B,CACH"}

package/dist/server/mounts.d.ts

@@ -0,0 +1,647 @@
+import { AuthAuthorizationConfig, AuthRoleId } from "./types.js";
+import { AuthApi } from "./auth.js";
+import * as convex_server0 from "convex/server";
+
+//#region src/server/mounts.d.ts
+/**
+ * Permission identifiers used by mounted enterprise admin APIs.
+ *
+ * These permission strings are passed to your {@link EnterpriseAuthorizer}
+ * callback so app code can decide whether the current user may perform a
+ * specific SSO or SCIM management operation.
+ *
+ * @example
+ * ```ts
+ * const authorized: EnterpriseAuthorizer = async (ctx, input) => {
+ *   if (input.permission === "sso.connection.create") {
+ *     // Only org admins may create SSO connections
+ *   }
+ * };
+ * ```
+ */
+type EnterpriseAdminPermission = "sso.connection.create" | "sso.connection.read" | "sso.connection.manage" | "sso.domain.manage" | "sso.protocol.manage" | "sso.policy.manage" | "sso.audit.read" | "sso.webhook.manage" | "scim.manage";
+/**
+ * Input passed to an {@link EnterpriseAuthorizer}.
+ *
+ * Contains the acting user, the requested permission, and the resolved
+ * enterprise/group scope for the operation being authorized.
+ */
+type EnterpriseAdminAuthorizationInput = {
+  /** The signed-in user's ID performing the admin action. */userId: string; /** The {@link EnterpriseAdminPermission} being requested. */
+  permission: EnterpriseAdminPermission; /** Enterprise document ID, if the operation targets a specific enterprise. */
+  enterpriseId?: string; /** Group document ID, if explicitly provided by the caller. */
+  groupId?: string; /** Resolved group ID from the enterprise record, or `null` when no enterprise context. */
+  resolvedGroupId: string | null;
+};
+/**
+ * App-defined authorization hook for mounted enterprise admin APIs.
+ *
+ * Return `void` (or resolve) to allow the operation, or `{ ok: false }` to deny it.
+ *
+ * @param ctx - Convex context with `ctx.auth` for identity checks.
+ * @param input - The {@link EnterpriseAdminAuthorizationInput} describing who is doing what.
+ * @returns `void` to allow, `{ ok: false }` to deny.
+ *
+ * @example
+ * ```ts
+ * import { EnterpriseAuthorizer } from "@robelest/convex-auth/server";
+ *
+ * const authorized: EnterpriseAuthorizer = async (ctx, input) => {
+ *   const identity = await ctx.auth.getUserIdentity();
+ *   if (!identity) return { ok: false };
+ *   // Allow all admin ops for the org owner
+ * };
+ * ```
+ */
+type EnterpriseAuthorizer = (ctx: {
+  auth: convex_server0.Auth;
+}, input: EnterpriseAdminAuthorizationInput) => Promise<void | {
+  ok: false;
+}>;
+type RoleRef<TRoleId extends string> = {
+  id: TRoleId;
+};
+type MountedEnterpriseOptions<TRoleId extends string = string> = {
+  admin?: {
+    authorized?: EnterpriseAuthorizer;
+    roles?: Array<TRoleId | RoleRef<TRoleId>>;
+  };
+};
+/**
+ * Configuration for {@link enterprise}, {@link sso}, and {@link scim}
+ * mounted admin APIs.
+ *
+ * @typeParam TRoleId - Role IDs that may be assigned to enterprise creators.
+ *
+ * @example
+ * ```ts
+ * import { enterprise, EnterpriseMountOptions } from "@robelest/convex-auth/server";
+ *
+ * const options: EnterpriseMountOptions = {
+ *   admin: {
+ *     authorized: async (ctx, input) => {
+ *       // Verify the user has permission for `input.permission`
+ *     },
+ *     roles: ["admin", "owner"],
+ *   },
+ * };
+ * ```
+ */
+type EnterpriseMountOptions<TRoleId extends string = string> = {
+  admin: {
+    authorized: EnterpriseAuthorizer;
+    roles?: Array<TRoleId | RoleRef<TRoleId>>;
+  };
+};
+/**
+ * Build optional public SSO management actions that apps can mount under
+ * `convex/auth/sso/**` when they want client-callable enterprise APIs.
+ *
+ * `admin` is for tenant-admin control-plane operations and should be mounted
+ * with an explicit authorization policy. `client` is for end-user sign-in
+ * helpers and does not require tenant-admin authorization.
+ *
+ * @param auth - Auth API subset providing `group`, `member`, `sso`, and `user` namespaces.
+ * @param options - Optional admin authorization config. See {@link EnterpriseMountOptions}.
+ * @typeParam TAuthorization - Optional authorization config for typed role IDs.
+ * @returns An object with `admin` (connection CRUD, OIDC/SAML protocol config, policy,
+ *   audit, webhooks, domain management) and `client` (signIn, metadata) namespaces.
+ *
+ * @example
+ * ```ts
+ * // convex/auth/sso.ts
+ * import { sso } from "@robelest/convex-auth/server";
+ * import { auth } from "../auth";
+ *
+ * const mounted = sso(auth, {
+ *   admin: {
+ *     authorized: async (ctx, input) => { /* check permissions *\/ },
+ *   },
+ * });
+ *
+ * export const createConnection = mounted.admin.connection.create;
+ * export const signIn = mounted.client.signIn;
+ * ```
+ *
+ * @see {@link scim}
+ * @see {@link enterprise}
+ */
+declare function sso<TAuthorization extends AuthAuthorizationConfig | undefined = undefined>(auth: Pick<AuthApi<TAuthorization>, "group" | "member" | "sso" | "user">, options?: MountedEnterpriseOptions<AuthRoleId<TAuthorization>>): {
+  admin: {
+    connection: {
+      create: convex_server0.RegisteredMutation<"public", {
+        status?: "draft" | "active" | "disabled" | undefined;
+        groupId?: string | undefined;
+        name?: string | undefined;
+        slug?: string | undefined;
+        domain?: string | undefined;
+      }, Promise<any>>;
+      get: convex_server0.RegisteredQuery<"public", {
+        enterpriseId: string;
+      }, Promise<any>>;
+      getByGroup: convex_server0.RegisteredQuery<"public", {
+        groupId: string;
+      }, Promise<any>>;
+      getByDomain: convex_server0.RegisteredQuery<"public", {
+        domain: string;
+      }, Promise<any>>;
+      list: convex_server0.RegisteredQuery<"public", {
+        limit?: number | undefined;
+        where?: {
+          status?: "draft" | "active" | "disabled" | undefined;
+          groupId?: string | undefined;
+          slug?: string | undefined;
+        } | undefined;
+        cursor?: string | null | undefined;
+        orderBy?: string | undefined;
+        order?: "asc" | "desc" | undefined;
+      }, Promise<any>>;
+      update: convex_server0.RegisteredMutation<"public", {
+        enterpriseId: string;
+        data: {
+          status?: "draft" | "active" | "disabled" | undefined;
+          name?: string | undefined;
+          slug?: string | undefined;
+        };
+      }, Promise<{
+        ok: false;
+        code: "NOT_SIGNED_IN" | "FORBIDDEN";
+        enterpriseId?: undefined;
+      } | {
+        ok: true;
+        enterpriseId: string;
+        code?: undefined;
+      }>>;
+      delete: convex_server0.RegisteredMutation<"public", {
+        enterpriseId: string;
+      }, Promise<any>>;
+      status: convex_server0.RegisteredQuery<"public", {
+        enterpriseId: string;
+      }, Promise<any>>;
+      domain: {
+        list: convex_server0.RegisteredQuery<"public", {
+          enterpriseId: string;
+        }, Promise<any>>;
+        validate: convex_server0.RegisteredQuery<"public", {
+          enterpriseId: string;
+        }, Promise<any>>;
+        set: convex_server0.RegisteredMutation<"public", {
+          enterpriseId: string;
+          domains: {
+            isPrimary?: boolean | undefined;
+            domain: string;
+          }[];
+        }, Promise<any>>;
+        verification: {
+          request: convex_server0.RegisteredMutation<"public", {
+            domain: string;
+            enterpriseId: string;
+          }, Promise<any>>;
+          confirm: convex_server0.RegisteredAction<"public", {
+            domain: string;
+            enterpriseId: string;
+          }, Promise<any>>;
+        };
+      };
+    };
+    oidc: {
+      configure: convex_server0.RegisteredMutation<"public", {
+        scopes?: string[] | undefined;
+        issuer?: string | undefined;
+        discoveryUrl?: string | undefined;
+        clientSecret?: string | undefined;
+        authorizationParams?: Record<string, string> | undefined;
+        clockToleranceSeconds?: number | undefined;
+        strictIssuer?: boolean | undefined;
+        extraFields?: Record<string, string> | undefined;
+        enterpriseId: string;
+        clientId: string;
+      }, Promise<any>>;
+      get: convex_server0.RegisteredQuery<"public", {
+        enterpriseId: string;
+      }, Promise<any>>;
+      validate: convex_server0.RegisteredAction<"public", {
+        enterpriseId: string;
+      }, Promise<any>>;
+    };
+    saml: {
+      configure: convex_server0.RegisteredAction<"public", {
+        domains?: string[] | undefined;
+        metadataXml?: string | undefined;
+        metadataUrl?: string | undefined;
+        signAuthnRequests?: boolean | undefined;
+        attributeMapping?: {
+          email?: string | undefined;
+          name?: string | undefined;
+          subject?: string | undefined;
+          firstName?: string | undefined;
+          lastName?: string | undefined;
+        } | undefined;
+        sp?: {
+          entityId?: string | undefined;
+          acsUrl?: string | undefined;
+          sloUrl?: string | undefined;
+          signingCert?: string | string[] | undefined;
+          encryptCert?: string | string[] | undefined;
+          privateKey?: string | undefined;
+          privateKeyPass?: string | undefined;
+          encPrivateKey?: string | undefined;
+          encPrivateKeyPass?: string | undefined;
+        } | undefined;
+        enterpriseId: string;
+      }, Promise<any>>;
+      validate: convex_server0.RegisteredQuery<"public", {
+        enterpriseId: string;
+      }, Promise<any>>;
+    };
+    policy: {
+      get: convex_server0.RegisteredQuery<"public", {
+        enterpriseId: string;
+      }, Promise<any>>;
+      update: convex_server0.RegisteredMutation<"public", {
+        enterpriseId: string;
+        patch: {
+          identity?: {
+            accountLinking?: {
+              oidc?: "verifiedEmail" | "none" | undefined;
+              saml?: "verifiedEmail" | "none" | undefined;
+            } | undefined;
+          } | undefined;
+          provisioning?: {
+            scimReuse?: {
+              user?: "none" | "externalId" | undefined;
+            } | undefined;
+            jit?: {
+              mode?: "off" | "createUser" | "createUserAndMembership" | undefined;
+              defaultRoleIds?: string[] | undefined;
+            } | undefined;
+            deprovision?: {
+              mode?: "soft" | "hard" | undefined;
+            } | undefined;
+          } | undefined;
+        };
+      }, Promise<any>>;
+      validate: convex_server0.RegisteredQuery<"public", {
+        enterpriseId: string;
+      }, Promise<any>>;
+    };
+    audit: {
+      list: convex_server0.RegisteredQuery<"public", {
+        groupId?: string | undefined;
+        limit?: number | undefined;
+        enterpriseId?: string | undefined;
+      }, Promise<any>>;
+    };
+    webhook: {
+      delivery: {
+        list: convex_server0.RegisteredQuery<"public", {
+          limit?: number | undefined;
+          enterpriseId: string;
+        }, Promise<any>>;
+      };
+      endpoint: {
+        create: convex_server0.RegisteredMutation<"public", {
+          createdByUserId?: string | undefined;
+          secret: string;
+          enterpriseId: string;
+          url: string;
+          subscriptions: string[];
+        }, Promise<{
+          ok: false;
+          code: "NOT_SIGNED_IN" | "FORBIDDEN";
+          _id?: undefined;
+          enterpriseId?: undefined;
+          url?: undefined;
+          subscriptions?: undefined;
+          createdByUserId?: undefined;
+          status?: undefined;
+          failureCount?: undefined;
+        } | {
+          _id: any;
+          enterpriseId: string;
+          url: string;
+          subscriptions: string[];
+          createdByUserId: string;
+          status: string;
+          failureCount: number;
+          ok?: undefined;
+          code?: undefined;
+        }>>;
+        list: convex_server0.RegisteredQuery<"public", {
+          enterpriseId: string;
+        }, Promise<any>>;
+        disable: convex_server0.RegisteredMutation<"public", {
+          endpointId: string;
+        }, Promise<any>>;
+      };
+    };
+  };
+  client: {
+    signIn: convex_server0.RegisteredQuery<"public", {
+      email?: string | undefined;
+      domain?: string | undefined;
+      enterpriseId?: string | undefined;
+      redirectTo?: string | undefined;
+    }, Promise<any>>;
+    metadata: convex_server0.RegisteredQuery<"public", {
+      entityId?: string | undefined;
+      acsUrl?: string | undefined;
+      sloUrl?: string | undefined;
+      enterpriseId: string;
+    }, Promise<any>>;
+  };
+};
+/**
+ * Build optional public SCIM management actions that apps can mount under
+ * `convex/auth/scim/**` when they want client-callable enterprise admin APIs.
+ *
+ * @param auth - Auth API subset providing `scim`, `sso`, and `user` namespaces.
+ * @param options - Optional admin authorization config. See {@link EnterpriseMountOptions}.
+ * @typeParam TAuthorization - Optional authorization config for typed role IDs.
+ * @returns An object with `admin.configure`, `admin.get`, and `admin.validate` actions.
+ *
+ * @example
+ * ```ts
+ * // convex/auth/scim.ts
+ * import { scim } from "@robelest/convex-auth/server";
+ * import { auth } from "../auth";
+ *
+ * const mounted = scim(auth, {
+ *   admin: {
+ *     authorized: async (ctx, input) => { /* check permissions *\/ },
+ *   },
+ * });
+ *
+ * export const configure = mounted.admin.configure;
+ * export const get = mounted.admin.get;
+ * export const validate = mounted.admin.validate;
+ * ```
+ *
+ * @see {@link sso}
+ * @see {@link enterprise}
+ */
+declare function scim<TAuthorization extends AuthAuthorizationConfig | undefined = undefined>(auth: Pick<AuthApi<TAuthorization>, "scim" | "sso" | "user">, options?: MountedEnterpriseOptions<AuthRoleId<TAuthorization>>): {
+  admin: {
+    configure: convex_server0.RegisteredMutation<"public", {
+      status?: "draft" | "active" | "disabled" | undefined;
+      basePath?: string | undefined;
+      enterpriseId: string;
+    }, Promise<any>>;
+    get: convex_server0.RegisteredQuery<"public", {
+      enterpriseId: string;
+    }, Promise<any>>;
+    validate: convex_server0.RegisteredQuery<"public", {
+      enterpriseId: string;
+    }, Promise<any>>;
+  };
+};
+/**
+ * Build a flat mounted enterprise API surface for app-owned Convex exports.
+ *
+ * Combines {@link sso} and {@link scim} into a single flat object with
+ * all SSO connection, protocol, policy, audit, webhook, and SCIM
+ * management functions plus end-user sign-in helpers. The `authorized`
+ * callback is required for all admin operations.
+ *
+ * @param auth - Auth API subset providing `group`, `member`, `scim`, `sso`, and `user` namespaces.
+ * @param options - Required {@link EnterpriseMountOptions} with an `admin.authorized` callback.
+ * @typeParam TAuthorization - Optional authorization config for typed role IDs.
+ * @returns A flat object with all enterprise management functions (e.g. `createConnection`,
+ *   `configureOidc`, `configureScim`, `signIn`, etc.).
+ *
+ * @example
+ * ```ts
+ * // convex/auth/enterprise.ts
+ * import { enterprise } from "@robelest/convex-auth/server";
+ * import { auth } from "../auth";
+ *
+ * const api = enterprise(auth, {
+ *   admin: {
+ *     authorized: async (ctx, input) => { /* check permissions *\/ },
+ *     roles: ["admin"],
+ *   },
+ * });
+ *
+ * export const createConnection = api.createConnection;
+ * export const configureOidc = api.configureOidc;
+ * export const signIn = api.signIn;
+ * ```
+ *
+ * @see {@link sso}
+ * @see {@link scim}
+ */
+declare function enterprise<TAuthorization extends AuthAuthorizationConfig | undefined = undefined>(auth: Pick<AuthApi<TAuthorization>, "group" | "member" | "scim" | "sso" | "user">, options: EnterpriseMountOptions<AuthRoleId<TAuthorization>>): {
+  createConnection: convex_server0.RegisteredMutation<"public", {
+    status?: "draft" | "active" | "disabled" | undefined;
+    groupId?: string | undefined;
+    name?: string | undefined;
+    slug?: string | undefined;
+    domain?: string | undefined;
+  }, Promise<any>>;
+  getConnection: convex_server0.RegisteredQuery<"public", {
+    enterpriseId: string;
+  }, Promise<any>>;
+  getConnectionByGroup: convex_server0.RegisteredQuery<"public", {
+    groupId: string;
+  }, Promise<any>>;
+  getConnectionByDomain: convex_server0.RegisteredQuery<"public", {
+    domain: string;
+  }, Promise<any>>;
+  listConnections: convex_server0.RegisteredQuery<"public", {
+    limit?: number | undefined;
+    where?: {
+      status?: "draft" | "active" | "disabled" | undefined;
+      groupId?: string | undefined;
+      slug?: string | undefined;
+    } | undefined;
+    cursor?: string | null | undefined;
+    orderBy?: string | undefined;
+    order?: "asc" | "desc" | undefined;
+  }, Promise<any>>;
+  updateConnection: convex_server0.RegisteredMutation<"public", {
+    enterpriseId: string;
+    data: {
+      status?: "draft" | "active" | "disabled" | undefined;
+      name?: string | undefined;
+      slug?: string | undefined;
+    };
+  }, Promise<{
+    ok: false;
+    code: "NOT_SIGNED_IN" | "FORBIDDEN";
+    enterpriseId?: undefined;
+  } | {
+    ok: true;
+    enterpriseId: string;
+    code?: undefined;
+  }>>;
+  deleteConnection: convex_server0.RegisteredMutation<"public", {
+    enterpriseId: string;
+  }, Promise<any>>;
+  getConnectionStatus: convex_server0.RegisteredQuery<"public", {
+    enterpriseId: string;
+  }, Promise<any>>;
+  listDomains: convex_server0.RegisteredQuery<"public", {
+    enterpriseId: string;
+  }, Promise<any>>;
+  validateDomains: convex_server0.RegisteredQuery<"public", {
+    enterpriseId: string;
+  }, Promise<any>>;
+  setDomains: convex_server0.RegisteredMutation<"public", {
+    enterpriseId: string;
+    domains: {
+      isPrimary?: boolean | undefined;
+      domain: string;
+    }[];
+  }, Promise<any>>;
+  requestDomainVerification: convex_server0.RegisteredMutation<"public", {
+    domain: string;
+    enterpriseId: string;
+  }, Promise<any>>;
+  confirmDomainVerification: convex_server0.RegisteredAction<"public", {
+    domain: string;
+    enterpriseId: string;
+  }, Promise<any>>;
+  configureOidc: convex_server0.RegisteredMutation<"public", {
+    scopes?: string[] | undefined;
+    issuer?: string | undefined;
+    discoveryUrl?: string | undefined;
+    clientSecret?: string | undefined;
+    authorizationParams?: Record<string, string> | undefined;
+    clockToleranceSeconds?: number | undefined;
+    strictIssuer?: boolean | undefined;
+    extraFields?: Record<string, string> | undefined;
+    enterpriseId: string;
+    clientId: string;
+  }, Promise<any>>;
+  getOidc: convex_server0.RegisteredQuery<"public", {
+    enterpriseId: string;
+  }, Promise<any>>;
+  validateOidc: convex_server0.RegisteredAction<"public", {
+    enterpriseId: string;
+  }, Promise<any>>;
+  configureSaml: convex_server0.RegisteredAction<"public", {
+    domains?: string[] | undefined;
+    metadataXml?: string | undefined;
+    metadataUrl?: string | undefined;
+    signAuthnRequests?: boolean | undefined;
+    attributeMapping?: {
+      email?: string | undefined;
+      name?: string | undefined;
+      subject?: string | undefined;
+      firstName?: string | undefined;
+      lastName?: string | undefined;
+    } | undefined;
+    sp?: {
+      entityId?: string | undefined;
+      acsUrl?: string | undefined;
+      sloUrl?: string | undefined;
+      signingCert?: string | string[] | undefined;
+      encryptCert?: string | string[] | undefined;
+      privateKey?: string | undefined;
+      privateKeyPass?: string | undefined;
+      encPrivateKey?: string | undefined;
+      encPrivateKeyPass?: string | undefined;
+    } | undefined;
+    enterpriseId: string;
+  }, Promise<any>>;
+  validateSaml: convex_server0.RegisteredQuery<"public", {
+    enterpriseId: string;
+  }, Promise<any>>;
+  getPolicy: convex_server0.RegisteredQuery<"public", {
+    enterpriseId: string;
+  }, Promise<any>>;
+  updatePolicy: convex_server0.RegisteredMutation<"public", {
+    enterpriseId: string;
+    patch: {
+      identity?: {
+        accountLinking?: {
+          oidc?: "verifiedEmail" | "none" | undefined;
+          saml?: "verifiedEmail" | "none" | undefined;
+        } | undefined;
+      } | undefined;
+      provisioning?: {
+        scimReuse?: {
+          user?: "none" | "externalId" | undefined;
+        } | undefined;
+        jit?: {
+          mode?: "off" | "createUser" | "createUserAndMembership" | undefined;
+          defaultRoleIds?: string[] | undefined;
+        } | undefined;
+        deprovision?: {
+          mode?: "soft" | "hard" | undefined;
+        } | undefined;
+      } | undefined;
+    };
+  }, Promise<any>>;
+  validatePolicy: convex_server0.RegisteredQuery<"public", {
+    enterpriseId: string;
+  }, Promise<any>>;
+  listAudit: convex_server0.RegisteredQuery<"public", {
+    groupId?: string | undefined;
+    limit?: number | undefined;
+    enterpriseId?: string | undefined;
+  }, Promise<any>>;
+  createWebhookEndpoint: convex_server0.RegisteredMutation<"public", {
+    createdByUserId?: string | undefined;
+    secret: string;
+    enterpriseId: string;
+    url: string;
+    subscriptions: string[];
+  }, Promise<{
+    ok: false;
+    code: "NOT_SIGNED_IN" | "FORBIDDEN";
+    _id?: undefined;
+    enterpriseId?: undefined;
+    url?: undefined;
+    subscriptions?: undefined;
+    createdByUserId?: undefined;
+    status?: undefined;
+    failureCount?: undefined;
+  } | {
+    _id: any;
+    enterpriseId: string;
+    url: string;
+    subscriptions: string[];
+    createdByUserId: string;
+    status: string;
+    failureCount: number;
+    ok?: undefined;
+    code?: undefined;
+  }>>;
+  listWebhookEndpoints: convex_server0.RegisteredQuery<"public", {
+    enterpriseId: string;
+  }, Promise<any>>;
+  listWebhookDeliveries: convex_server0.RegisteredQuery<"public", {
+    limit?: number | undefined;
+    enterpriseId: string;
+  }, Promise<any>>;
+  disableWebhookEndpoint: convex_server0.RegisteredMutation<"public", {
+    endpointId: string;
+  }, Promise<any>>;
+  configureScim: convex_server0.RegisteredMutation<"public", {
+    status?: "draft" | "active" | "disabled" | undefined;
+    basePath?: string | undefined;
+    enterpriseId: string;
+  }, Promise<any>>;
+  getScim: convex_server0.RegisteredQuery<"public", {
+    enterpriseId: string;
+  }, Promise<any>>;
+  validateScim: convex_server0.RegisteredQuery<"public", {
+    enterpriseId: string;
+  }, Promise<any>>;
+  signIn: convex_server0.RegisteredQuery<"public", {
+    email?: string | undefined;
+    domain?: string | undefined;
+    enterpriseId?: string | undefined;
+    redirectTo?: string | undefined;
+  }, Promise<any>>;
+  metadata: convex_server0.RegisteredQuery<"public", {
+    entityId?: string | undefined;
+    acsUrl?: string | undefined;
+    sloUrl?: string | undefined;
+    enterpriseId: string;
+  }, Promise<any>>;
+};
+//#endregion
+export { EnterpriseAdminAuthorizationInput, EnterpriseAdminPermission, EnterpriseAuthorizer, EnterpriseMountOptions, enterprise, scim, sso };
+//# sourceMappingURL=mounts.d.ts.map

package/dist/server/mounts.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"mounts.d.ts","names":[],"sources":["../../src/server/mounts.ts"],"mappings":";;;;;;;;AA+BA;;;;;AAiBA;;;;;;;;KAjBY,yBAAA;;;;AAkDZ;;;KAjCY,iCAAA;EAmCH,2DAjCP,MAAA,UAkCU;EAhCV,UAAA,EAAY,yBAAA,EA8BL;EA5BP,YAAA,WA4BA;EA1BA,OAAA,WA2BA;EAzBA,eAAA;AAAA;;;AA0BiC;;;;;;;;;AAEiB;;;;;;;;;KALxC,oBAAA,IACV,GAAA;EAAO,IAAA,EADuB,cAAA,CACO,IAAA;AAAA,GACrC,KAAA,EAAO,iCAAA,KACJ,OAAA;EAAiB,EAAA;AAAA;AAAA,KAEjB,OAAA;EAAoC,EAAA,EAAI,OAAA;AAAA;AAAA,KAExC,wBAAA;EACH,KAAA;IACE,UAAA,GAAa,oBAAA;IACb,KAAA,GAAQ,KAAA,CAAM,OAAA,GAAU,OAAA,CAAQ,OAAA;EAAA;AAAA;;;;;;;;;;;;;;;;;;;;AA6KpC;KArJY,sBAAA;EACV,KAAA;IACE,UAAA,EAAY,oBAAA;IACZ,KAAA,GAAQ,KAAA,CAAM,OAAA,GAAU,OAAA,CAAQ,OAAA;EAAA;AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;iBAkJpB,GAAA,wBACS,uBAAA,yBAAA,CAEvB,IAAA,EAAM,IAAA,CAAK,OAAA,CAAQ,cAAA,yCACnB,OAAA,GAAU,wBAAA,CAAyB,UAAA,CAAW,cAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;iBA8hBhC,IAAA,wBACS,uBAAA,yBAAA,CAEvB,IAAA,EAAM,IAAA,CAAK,OAAA,CAAQ,cAAA,6BACnB,OAAA,GAAU,wBAAA,CAAyB,UAAA,CAAW,cAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;iBAkFhC,UAAA,wBACS,uBAAA,yBAAA,CAEvB,IAAA,EAAM,IAAA,CACJ,OAAA,CAAQ,cAAA,kDAGV,OAAA,EAAS,sBAAA,CAAuB,UAAA,CAAW,cAAA"}