@robelest/convex-auth 0.0.4-preview.18 → 0.0.4-preview.19

package/dist/server/mutations/index.js

@@ -1,85 +1,15 @@
-import { LOG_LEVELS, logWithLevel } from "../utils.js";
-import { callModifyAccount, modifyAccountArgs, modifyAccountImpl } from "./account.js";
-import { callCreateVerificationCode, createVerificationCodeArgs, createVerificationCodeImpl } from "./code.js";
-import { callInvalidateSessions, invalidateSessionsArgs, invalidateSessionsImpl } from "./invalidate.js";
-import { callUserOAuth, userOAuthArgs, userOAuthImpl } from "./oauth.js";
-import { callRefreshSession, refreshSessionArgs, refreshSessionImpl } from "./refresh.js";
-import { callCreateAccountFromCredentials, createAccountFromCredentialsArgs, createAccountFromCredentialsImpl } from "./register.js";
-import { callRetreiveAccountWithCredentials, callRetrieveAccountWithCredentials, retrieveAccountWithCredentialsArgs, retrieveAccountWithCredentialsImpl } from "./retrieve.js";
-import { callVerifierSignature, verifierSignatureArgs, verifierSignatureImpl } from "./signature.js";
-import { callSignIn, signInArgs, signInImpl } from "./signin.js";
-import { callSignOut, signOutImpl } from "./signout.js";
-import { callVerifier, verifierImpl } from "./verifier.js";
-import { callVerifyCodeAndSignIn, verifyCodeAndSignInArgs, verifyCodeAndSignInImpl } from "./verify.js";
-import { Fx } from "@robelest/fx";
-import { v } from "convex/values";
+import { callModifyAccount } from "./account.js";
+import { callCreateVerificationCode } from "./code.js";
+import { callInvalidateSessions } from "./invalidate.js";
+import { callUserOAuth } from "./oauth.js";
+import { callRefreshSession } from "./refresh.js";
+import { callCreateAccountFromCredentials } from "./register.js";
+import { callRetrieveAccountWithCredentials } from "./retrieve.js";
+import { callVerifierSignature } from "./signature.js";
+import { callSignIn } from "./signin.js";
+import { callSignOut } from "./signout.js";
+import { callVerifier } from "./verifier.js";
+import { callVerifyCodeAndSignIn } from "./verify.js";
+import { storeArgs, storeImpl } from "./store.js";
 
-//#region src/server/mutations/index.ts
-const storeArgs = v.object({ args: v.union(v.object({
-	type: v.literal("signIn"),
-	...signInArgs.fields
-}), v.object({ type: v.literal("signOut") }), v.object({
-	type: v.literal("refreshSession"),
-	...refreshSessionArgs.fields
-}), v.object({
-	type: v.literal("verifyCodeAndSignIn"),
-	...verifyCodeAndSignInArgs.fields
-}), v.object({ type: v.literal("verifier") }), v.object({
-	type: v.literal("verifierSignature"),
-	...verifierSignatureArgs.fields
-}), v.object({
-	type: v.literal("userOAuth"),
-	...userOAuthArgs.fields
-}), v.object({
-	type: v.literal("createVerificationCode"),
-	...createVerificationCodeArgs.fields
-}), v.object({
-	type: v.literal("createAccountFromCredentials"),
-	...createAccountFromCredentialsArgs.fields
-}), v.object({
-	type: v.literal("retrieveAccountWithCredentials"),
-	...retrieveAccountWithCredentialsArgs.fields
-}), v.object({
-	type: v.literal("modifyAccount"),
-	...modifyAccountArgs.fields
-}), v.object({
-	type: v.literal("invalidateSessions"),
-	...invalidateSessionsArgs.fields
-})) });
-const storeImpl = async (ctx, fnArgs, getProviderOrThrow, config) => {
-	const args = fnArgs.args;
-	logWithLevel(LOG_LEVELS.INFO, `\`auth:store\` type: ${args.type}`);
-	return Fx.run(Fx.match(args, args.type, {
-		signIn: (a) => Fx.from({
-			ok: () => signInImpl(ctx, a, config),
-			err: (e) => e
-		}),
-		signOut: () => signOutImpl(ctx, config),
-		refreshSession: (a) => Fx.from({
-			ok: () => refreshSessionImpl(ctx, a, getProviderOrThrow, config),
-			err: (e) => e
-		}),
-		verifyCodeAndSignIn: (a) => Fx.from({
-			ok: () => verifyCodeAndSignInImpl(ctx, a, getProviderOrThrow, config),
-			err: (e) => e
-		}),
-		verifier: () => verifierImpl(ctx, config),
-		verifierSignature: (a) => verifierSignatureImpl(ctx, a, config).pipe(Fx.recover((e) => Fx.fatal(e.toConvexError()))),
-		userOAuth: (a) => userOAuthImpl(ctx, a, getProviderOrThrow, config).pipe(Fx.recover((e) => Fx.fatal(e.toConvexError()))),
-		createVerificationCode: (a) => Fx.from({
-			ok: () => createVerificationCodeImpl(ctx, a, getProviderOrThrow, config),
-			err: (e) => e
-		}),
-		createAccountFromCredentials: (a) => Fx.from({
-			ok: () => createAccountFromCredentialsImpl(ctx, a, getProviderOrThrow, config),
-			err: (e) => e
-		}),
-		retrieveAccountWithCredentials: (a) => retrieveAccountWithCredentialsImpl(ctx, a, getProviderOrThrow, config),
-		modifyAccount: (a) => modifyAccountImpl(ctx, a, getProviderOrThrow, config).pipe(Fx.recover((e) => Fx.fatal(e.toConvexError()))),
-		invalidateSessions: (a) => invalidateSessionsImpl(ctx, a, config)
-	}));
-};
-
-//#endregion
-export { callCreateAccountFromCredentials, callCreateVerificationCode, callInvalidateSessions, callModifyAccount, callRefreshSession, callRetreiveAccountWithCredentials, callRetrieveAccountWithCredentials, callSignIn, callSignOut, callUserOAuth, callVerifier, callVerifierSignature, callVerifyCodeAndSignIn, storeArgs, storeImpl };
-//# sourceMappingURL=index.js.map
+export { callCreateAccountFromCredentials, callCreateVerificationCode, callInvalidateSessions, callModifyAccount, callRefreshSession, callRetrieveAccountWithCredentials, callSignIn, callSignOut, callUserOAuth, callVerifier, callVerifierSignature, callVerifyCodeAndSignIn, storeArgs, storeImpl };

package/dist/server/mutations/invalidate.d.ts

@@ -1,17 +1,17 @@
 import { MutationCtx } from "../types.js";
-import { Config } from "../provider.js";
+import { Config } from "../crypto.js";
 import { Fx } from "@robelest/fx";
 import { GenericActionCtx, GenericDataModel } from "convex/server";
-import * as convex_values6 from "convex/values";
+import * as convex_values104 from "convex/values";
 import { Infer } from "convex/values";
 
 //#region src/server/mutations/invalidate.d.ts
-declare const invalidateSessionsArgs: convex_values6.VObject<{
+declare const invalidateSessionsArgs: convex_values104.VObject<{
   except?: string[] | undefined;
   userId: string;
 }, {
-  userId: convex_values6.VString<string, "required">;
-  except: convex_values6.VArray<string[] | undefined, convex_values6.VString<string, "required">, "optional">;
+  userId: convex_values104.VString<string, "required">;
+  except: convex_values104.VArray<string[] | undefined, convex_values104.VString<string, "required">, "optional">;
 }, "required", "userId" | "except">;
 declare const callInvalidateSessions: <DataModel extends GenericDataModel>(ctx: GenericActionCtx<DataModel>, args: Infer<typeof invalidateSessionsArgs>) => Promise<void>;
 declare function invalidateSessionsImpl(ctx: MutationCtx, args: Infer<typeof invalidateSessionsArgs>, config: Config): Fx<void, never>;

package/dist/server/mutations/invalidate.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"invalidate.d.ts","names":[],"sources":["../../../src/server/mutations/invalidate.ts"],"mappings":";;;;;;;;cAWa,sBAAA,iBAAsB,OAAA;;;;UAGjC,cAAA,CAAA,OAAA;;;cAEW,sBAAA,qBACO,gBAAA,EAElB,GAAA,EAAK,gBAAA,CAAiB,SAAA,GACtB,IAAA,EAAM,KAAA,QAAa,sBAAA,MAClB,OAAA;AAAA,iBASa,sBAAA,CACd,GAAA,EAAK,WAAA,EACL,IAAA,EAAM,KAAA,QAAa,sBAAA,GACnB,MAAA,EAAQ,MAAA,GACP,EAAA"}
+{"version":3,"file":"invalidate.d.ts","names":[],"sources":["../../../src/server/mutations/invalidate.ts"],"mappings":";;;;;;;;cAWa,sBAAA,mBAAsB,OAAA;;;;UAGjC,gBAAA,CAAA,OAAA;;;cAEW,sBAAA,qBACO,gBAAA,EAElB,GAAA,EAAK,gBAAA,CAAiB,SAAA,GACtB,IAAA,EAAM,KAAA,QAAa,sBAAA,MAClB,OAAA;AAAA,iBASa,sBAAA,CACd,GAAA,EAAK,WAAA,EACL,IAAA,EAAM,KAAA,QAAa,sBAAA,GACnB,MAAA,EAAQ,MAAA,GACP,EAAA"}

package/dist/server/mutations/invalidate.js

@@ -1,6 +1,6 @@
 import { LOG_LEVELS, logWithLevel } from "../utils.js";
 import { authDb } from "../db.js";
-import { AUTH_STORE_REF } from "./store.js";
+import { AUTH_STORE_REF } from "./store/refs.js";
 import { deleteSession } from "../sessions.js";
 import { Fx } from "@robelest/fx";
 import { v } from "convex/values";

package/dist/server/mutations/invalidate.js.map

@@ -1 +1 @@
-{"version":3,"file":"invalidate.js","names":[],"sources":["../../../src/server/mutations/invalidate.ts"],"sourcesContent":["import { Fx } from \"@robelest/fx\";\nimport type { GenericActionCtx, GenericDataModel } from \"convex/server\";\nimport { GenericId, Infer, v } from \"convex/values\";\n\nimport { authDb } from \"../db\";\nimport * as Provider from \"../provider\";\nimport { deleteSession } from \"../sessions\";\nimport { Doc, MutationCtx } from \"../types\";\nimport { LOG_LEVELS, logWithLevel } from \"../utils\";\nimport { AUTH_STORE_REF } from \"./store\";\n\nexport const invalidateSessionsArgs = v.object({\n  userId: v.string(),\n  except: v.optional(v.array(v.string())),\n});\n\nexport const callInvalidateSessions = async <\n  DataModel extends GenericDataModel,\n>(\n  ctx: GenericActionCtx<DataModel>,\n  args: Infer<typeof invalidateSessionsArgs>,\n): Promise<void> => {\n  return ctx.runMutation(AUTH_STORE_REF, {\n    args: {\n      type: \"invalidateSessions\",\n      ...args,\n    },\n  });\n};\n\nexport function invalidateSessionsImpl(\n  ctx: MutationCtx,\n  args: Infer<typeof invalidateSessionsArgs>,\n  config: Provider.Config,\n): Fx<void, never> {\n  return Fx.gen(function* () {\n    logWithLevel(LOG_LEVELS.DEBUG, \"invalidateSessionsImpl args:\", args);\n    const { userId, except } = args;\n    const exceptSet = new Set(except ?? []);\n    const typedUserId = userId as GenericId<\"User\">;\n    const sessions = (yield* Fx.promise(() =>\n      authDb(ctx, config).sessions.listByUser(typedUserId),\n    )) as Doc<\"Session\">[];\n    yield* Fx.each(sessions, (session: Doc<\"Session\">) =>\n      exceptSet.has(session._id)\n        ? Fx.unit\n        : Fx.promise(() => deleteSession(ctx, session, config)),\n    );\n  });\n}\n"],"mappings":";;;;;;;;AAWA,MAAa,yBAAyB,EAAE,OAAO;CAC7C,QAAQ,EAAE,QAAQ;CAClB,QAAQ,EAAE,SAAS,EAAE,MAAM,EAAE,QAAQ,CAAC,CAAC;CACxC,CAAC;AAEF,MAAa,yBAAyB,OAGpC,KACA,SACkB;AAClB,QAAO,IAAI,YAAY,gBAAgB,EACrC,MAAM;EACJ,MAAM;EACN,GAAG;EACJ,EACF,CAAC;;AAGJ,SAAgB,uBACd,KACA,MACA,QACiB;AACjB,QAAO,GAAG,IAAI,aAAa;AACzB,eAAa,WAAW,OAAO,gCAAgC,KAAK;EACpE,MAAM,EAAE,QAAQ,WAAW;EAC3B,MAAM,YAAY,IAAI,IAAI,UAAU,EAAE,CAAC;EACvC,MAAM,cAAc;EACpB,MAAM,WAAY,OAAO,GAAG,cAC1B,OAAO,KAAK,OAAO,CAAC,SAAS,WAAW,YAAY,CACrD;AACD,SAAO,GAAG,KAAK,WAAW,YACxB,UAAU,IAAI,QAAQ,IAAI,GACtB,GAAG,OACH,GAAG,cAAc,cAAc,KAAK,SAAS,OAAO,CAAC,CAC1D;GACD"}
+{"version":3,"file":"invalidate.js","names":[],"sources":["../../../src/server/mutations/invalidate.ts"],"sourcesContent":["import { Fx } from \"@robelest/fx\";\nimport type { GenericActionCtx, GenericDataModel } from \"convex/server\";\nimport { GenericId, Infer, v } from \"convex/values\";\n\nimport { authDb } from \"../db\";\nimport * as Provider from \"../crypto\";\nimport { deleteSession } from \"../sessions\";\nimport { Doc, MutationCtx } from \"../types\";\nimport { LOG_LEVELS, logWithLevel } from \"../utils\";\nimport { AUTH_STORE_REF } from \"./store/refs\";\n\nexport const invalidateSessionsArgs = v.object({\n  userId: v.string(),\n  except: v.optional(v.array(v.string())),\n});\n\nexport const callInvalidateSessions = async <\n  DataModel extends GenericDataModel,\n>(\n  ctx: GenericActionCtx<DataModel>,\n  args: Infer<typeof invalidateSessionsArgs>,\n): Promise<void> => {\n  return ctx.runMutation(AUTH_STORE_REF, {\n    args: {\n      type: \"invalidateSessions\",\n      ...args,\n    },\n  });\n};\n\nexport function invalidateSessionsImpl(\n  ctx: MutationCtx,\n  args: Infer<typeof invalidateSessionsArgs>,\n  config: Provider.Config,\n): Fx<void, never> {\n  return Fx.gen(function* () {\n    logWithLevel(LOG_LEVELS.DEBUG, \"invalidateSessionsImpl args:\", args);\n    const { userId, except } = args;\n    const exceptSet = new Set(except ?? []);\n    const typedUserId = userId as GenericId<\"User\">;\n    const sessions = (yield* Fx.promise(() =>\n      authDb(ctx, config).sessions.listByUser(typedUserId),\n    )) as Doc<\"Session\">[];\n    yield* Fx.each(sessions, (session: Doc<\"Session\">) =>\n      exceptSet.has(session._id)\n        ? Fx.unit\n        : Fx.promise(() => deleteSession(ctx, session, config)),\n    );\n  });\n}\n"],"mappings":";;;;;;;;AAWA,MAAa,yBAAyB,EAAE,OAAO;CAC7C,QAAQ,EAAE,QAAQ;CAClB,QAAQ,EAAE,SAAS,EAAE,MAAM,EAAE,QAAQ,CAAC,CAAC;CACxC,CAAC;AAEF,MAAa,yBAAyB,OAGpC,KACA,SACkB;AAClB,QAAO,IAAI,YAAY,gBAAgB,EACrC,MAAM;EACJ,MAAM;EACN,GAAG;EACJ,EACF,CAAC;;AAGJ,SAAgB,uBACd,KACA,MACA,QACiB;AACjB,QAAO,GAAG,IAAI,aAAa;AACzB,eAAa,WAAW,OAAO,gCAAgC,KAAK;EACpE,MAAM,EAAE,QAAQ,WAAW;EAC3B,MAAM,YAAY,IAAI,IAAI,UAAU,EAAE,CAAC;EACvC,MAAM,cAAc;EACpB,MAAM,WAAY,OAAO,GAAG,cAC1B,OAAO,KAAK,OAAO,CAAC,SAAS,WAAW,YAAY,CACrD;AACD,SAAO,GAAG,KAAK,WAAW,YACxB,UAAU,IAAI,QAAQ,IAAI,GACtB,GAAG,OACH,GAAG,cAAc,cAAc,KAAK,SAAS,OAAO,CAAC,CAC1D;GACD"}

package/dist/server/mutations/oauth.d.ts

@@ -1,24 +1,24 @@
 import { MutationCtx } from "../types.js";
-import { AuthError } from "../fx.js";
-import { Config, GetProviderOrThrowFunc } from "../provider.js";
+import { AuthError } from "../authError.js";
+import { Config, GetProviderOrThrowFunc } from "../crypto.js";
 import { Fx } from "@robelest/fx";
 import { GenericActionCtx, GenericDataModel } from "convex/server";
-import * as convex_values18 from "convex/values";
+import * as convex_values12 from "convex/values";
 import { Infer } from "convex/values";
 
 //#region src/server/mutations/oauth.d.ts
-declare const userOAuthArgs: convex_values18.VObject<{
+declare const userOAuthArgs: convex_values12.VObject<{
   accountExtend?: any;
   provider: string;
   signature: string;
   providerAccountId: string;
   profile: any;
 }, {
-  provider: convex_values18.VString<string, "required">;
-  providerAccountId: convex_values18.VString<string, "required">;
-  profile: convex_values18.VAny<any, "required", string>;
-  signature: convex_values18.VString<string, "required">;
-  accountExtend: convex_values18.VAny<any, "optional", string>;
+  provider: convex_values12.VString<string, "required">;
+  providerAccountId: convex_values12.VString<string, "required">;
+  profile: convex_values12.VAny<any, "required", string>;
+  signature: convex_values12.VString<string, "required">;
+  accountExtend: convex_values12.VAny<any, "optional", string>;
 }, "required", "provider" | "signature" | "providerAccountId" | "profile" | "accountExtend" | `profile.${string}` | `accountExtend.${string}`>;
 type ReturnType = string;
 declare function userOAuthImpl(ctx: MutationCtx, args: Infer<typeof userOAuthArgs>, getProviderOrThrow: GetProviderOrThrowFunc, config: Config): Fx<ReturnType, AuthError>;

package/dist/server/mutations/oauth.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"oauth.d.ts","names":[],"sources":["../../../src/server/mutations/oauth.ts"],"mappings":";;;;;;;;;cAsBa,aAAA,kBAAa,OAAA;;;;;;;YAMxB,eAAA,CAAA,OAAA;;;;;;KA8CG,UAAA;AAAA,iBAEW,aAAA,CACd,GAAA,EAAK,WAAA,EACL,IAAA,EAAM,KAAA,QAAa,aAAA,GACnB,kBAAA,EAAoB,sBAAA,EACpB,MAAA,EAAQ,MAAA,GACP,EAAA,CAAG,UAAA,EAAY,SAAA;AAAA,cA+IL,aAAA,qBAAyC,gBAAA,EACpD,GAAA,EAAK,gBAAA,CAAiB,SAAA,GACtB,IAAA,EAAM,KAAA,QAAa,aAAA,MAClB,OAAA,CAAQ,UAAA"}
+{"version":3,"file":"oauth.d.ts","names":[],"sources":["../../../src/server/mutations/oauth.ts"],"mappings":";;;;;;;;;cAwBa,aAAA,kBAAa,OAAA;;;;;;;YAMxB,eAAA,CAAA,OAAA;;;;;;KA8CG,UAAA;AAAA,iBAEW,aAAA,CACd,GAAA,EAAK,WAAA,EACL,IAAA,EAAM,KAAA,QAAa,aAAA,GACnB,kBAAA,EAAoB,sBAAA,EACpB,MAAA,EAAQ,MAAA,GACP,EAAA,CAAG,UAAA,EAAY,SAAA;AAAA,cA+IL,aAAA,qBAAyC,gBAAA,EACpD,GAAA,EAAK,gBAAA,CAAiB,SAAA,GACtB,IAAA,EAAM,KAAA,QAAa,aAAA,MAClB,OAAA,CAAQ,UAAA"}

package/dist/server/mutations/oauth.js

@@ -1,9 +1,11 @@
-import { AuthError } from "../fx.js";
+import { AuthError } from "../authError.js";
 import { generateRandomString, logWithLevel, sha256 } from "../utils.js";
 import { authDb } from "../db.js";
-import { AUTH_STORE_REF } from "./store.js";
+import { AUTH_STORE_REF } from "./store/refs.js";
 import { upsertUserAndAccount } from "../users.js";
-import { ENTERPRISE_OIDC_PROVIDER_PREFIX, ENTERPRISE_SAML_PROVIDER_PREFIX, createSyntheticOAuthMaterializedConfig, isEnterpriseProviderId, normalizeEnterprisePolicy } from "../sso.js";
+import { ENTERPRISE_OIDC_PROVIDER_PREFIX, ENTERPRISE_SAML_PROVIDER_PREFIX, isEnterpriseProviderId } from "../enterprise/shared.js";
+import { createSyntheticOAuthMaterializedConfig } from "../enterprise/oidc.js";
+import { normalizeEnterprisePolicy } from "../enterprise/policy.js";
 import { Fx } from "@robelest/fx";
 import { v } from "convex/values";
 

package/dist/server/mutations/oauth.js.map

@@ -1 +1 @@
-{"version":3,"file":"oauth.js","names":[],"sources":["../../../src/server/mutations/oauth.ts"],"sourcesContent":["import { Fx } from \"@robelest/fx\";\nimport type { GenericActionCtx, GenericDataModel } from \"convex/server\";\nimport { Infer, v } from \"convex/values\";\n\nimport { authDb } from \"../db\";\nimport { AuthError } from \"../fx\";\nimport * as Provider from \"../provider\";\nimport {\n  ENTERPRISE_OIDC_PROVIDER_PREFIX,\n  ENTERPRISE_SAML_PROVIDER_PREFIX,\n  createSyntheticOAuthMaterializedConfig,\n  isEnterpriseProviderId,\n  normalizeEnterprisePolicy,\n} from \"../sso\";\nimport { MutationCtx } from \"../types\";\nimport type { AuthProviderMaterializedConfig } from \"../types\";\nimport { upsertUserAndAccount } from \"../users\";\nimport { generateRandomString, logWithLevel, sha256 } from \"../utils\";\nimport { AUTH_STORE_REF } from \"./store\";\n\nconst OAUTH_SIGN_IN_EXPIRATION_MS = 1000 * 60 * 2; // 2 minutes\n\nexport const userOAuthArgs = v.object({\n  provider: v.string(),\n  providerAccountId: v.string(),\n  profile: v.any(),\n  signature: v.string(),\n  accountExtend: v.optional(v.any()),\n});\n\nfunction normalizeAccountExtend(\n  provider: string,\n  providerAccountId: string,\n  accountExtend: unknown,\n) {\n  const baseIdentity: Record<string, unknown> = {\n    type: \"oauth\",\n    provider,\n    providerAccountId,\n  };\n  if (provider.startsWith(ENTERPRISE_OIDC_PROVIDER_PREFIX)) {\n    baseIdentity.type = \"enterprise-oidc\";\n    baseIdentity.enterpriseId = provider.slice(\n      ENTERPRISE_OIDC_PROVIDER_PREFIX.length,\n    );\n  }\n  if (provider.startsWith(ENTERPRISE_SAML_PROVIDER_PREFIX)) {\n    baseIdentity.type = \"enterprise-saml\";\n    baseIdentity.enterpriseId = provider.slice(\n      ENTERPRISE_SAML_PROVIDER_PREFIX.length,\n    );\n  }\n  const provided =\n    typeof accountExtend === \"object\" &&\n    accountExtend !== null &&\n    !Array.isArray(accountExtend)\n      ? (accountExtend as Record<string, unknown>)\n      : undefined;\n  const providedIdentity =\n    provided &&\n    typeof provided.identity === \"object\" &&\n    provided.identity !== null &&\n    !Array.isArray(provided.identity)\n      ? (provided.identity as Record<string, unknown>)\n      : undefined;\n  return {\n    ...provided,\n    identity: {\n      ...baseIdentity,\n      ...providedIdentity,\n    },\n  };\n}\n\ntype ReturnType = string;\n\nexport function userOAuthImpl(\n  ctx: MutationCtx,\n  args: Infer<typeof userOAuthArgs>,\n  getProviderOrThrow: Provider.GetProviderOrThrowFunc,\n  config: Provider.Config,\n): Fx<ReturnType, AuthError> {\n  return Fx.gen(function* () {\n    logWithLevel(\"DEBUG\", \"userOAuthImpl args:\", args);\n    const { profile, provider, providerAccountId, signature, accountExtend } =\n      args;\n    const db = authDb(ctx, config);\n    const existingAccount = yield* Fx.promise(() =>\n      db.accounts.get(provider, providerAccountId),\n    );\n    const enterpriseId = provider.startsWith(ENTERPRISE_OIDC_PROVIDER_PREFIX)\n      ? provider.slice(ENTERPRISE_OIDC_PROVIDER_PREFIX.length)\n      : provider.startsWith(ENTERPRISE_SAML_PROVIDER_PREFIX)\n        ? provider.slice(ENTERPRISE_SAML_PROVIDER_PREFIX.length)\n        : null;\n    const enterprise =\n      enterpriseId !== null\n        ? yield* Fx.promise(() =>\n            ctx.runQuery(config.component.public.enterpriseGet, {\n              enterpriseId,\n            }),\n          )\n        : null;\n    const enterprisePolicy = enterprise\n      ? normalizeEnterprisePolicy(enterprise.policy)\n      : null;\n    const enterpriseProtocol = provider.startsWith(\n      ENTERPRISE_OIDC_PROVIDER_PREFIX,\n    )\n      ? \"oidc\"\n      : provider.startsWith(ENTERPRISE_SAML_PROVIDER_PREFIX)\n        ? \"saml\"\n        : null;\n\n    const existingScimIdentity =\n      enterpriseId !== null &&\n      existingAccount === null &&\n      enterprisePolicy?.provisioning.scimReuse.user === \"externalId\"\n        ? yield* Fx.promise(() =>\n            ctx.runQuery(config.component.public.enterpriseScimIdentityGet, {\n              enterpriseId,\n              resourceType: \"user\",\n              externalId: providerAccountId,\n            }),\n          )\n        : null;\n\n    const verifier = yield* Fx.from({\n      ok: () => db.verifiers.getBySignature(signature),\n      err: () => new AuthError(\"OAUTH_INVALID_STATE\"),\n    }).pipe(\n      Fx.chain((doc) =>\n        doc === null\n          ? Fx.fail(new AuthError(\"OAUTH_INVALID_STATE\"))\n          : Fx.succeed(doc),\n      ),\n    );\n\n    const { accountId } = yield* Fx.promise(() =>\n      upsertUserAndAccount(\n        ctx,\n        verifier.sessionId ?? null,\n        existingAccount !== null ? { existingAccount } : { providerAccountId },\n        {\n          type: \"oauth\",\n          provider: (isEnterpriseProviderId(provider)\n            ? createSyntheticOAuthMaterializedConfig(provider, {\n                accountLinking:\n                  enterpriseProtocol === \"oidc\"\n                    ? enterprisePolicy?.identity.accountLinking.oidc\n                    : enterpriseProtocol === \"saml\"\n                      ? enterprisePolicy?.identity.accountLinking.saml\n                      : undefined,\n              })\n            : getProviderOrThrow(provider)) as AuthProviderMaterializedConfig,\n          profile,\n          accountExtend: normalizeAccountExtend(\n            provider,\n            providerAccountId,\n            accountExtend,\n          ),\n        },\n        config,\n        existingScimIdentity?.userId\n          ? { existingUserId: existingScimIdentity.userId }\n          : undefined,\n      ),\n    );\n\n    // JIT group provisioning: if this is an enterprise SSO sign-in and the\n    // enterprise connection has a groupId, auto-add the user as a member of\n    // that group if they aren't already a member.\n    if (\n      enterpriseId !== null &&\n      enterprisePolicy?.provisioning.jit.mode === \"createUserAndMembership\"\n    ) {\n      const account = yield* Fx.promise(() => db.accounts.getById(accountId));\n      const userId = account?.userId;\n      if (userId) {\n        const groupId = (enterprise as any)?.groupId as string | undefined;\n        if (groupId) {\n          const existingMembership = yield* Fx.promise(() =>\n            ctx.runQuery(config.component.public.memberGetByGroupAndUser, {\n              userId,\n              groupId,\n            }),\n          );\n          if (existingMembership === null) {\n            yield* Fx.promise(() =>\n              ctx.runMutation(config.component.public.memberAdd, {\n                groupId,\n                userId,\n                roleIds: enterprisePolicy.provisioning.jit.defaultRoleIds,\n                status: \"active\",\n              }),\n            );\n          }\n        }\n      }\n    }\n\n    const code = generateRandomString(8, \"0123456789\");\n    yield* Fx.promise(() => db.verifiers.delete(verifier._id));\n    const existingVerificationCode = yield* Fx.promise(() =>\n      db.verificationCodes.getByAccountId(accountId),\n    );\n    if (existingVerificationCode !== null) {\n      yield* Fx.promise(() =>\n        db.verificationCodes.delete(existingVerificationCode._id),\n      );\n    }\n    yield* Fx.promise(async () =>\n      db.verificationCodes.create({\n        code: await sha256(code),\n        accountId,\n        provider,\n        expirationTime: Date.now() + OAUTH_SIGN_IN_EXPIRATION_MS,\n        verifier: verifier._id,\n      }),\n    );\n    return code;\n  });\n}\n\nexport const callUserOAuth = async <DataModel extends GenericDataModel>(\n  ctx: GenericActionCtx<DataModel>,\n  args: Infer<typeof userOAuthArgs>,\n): Promise<ReturnType> => {\n  return ctx.runMutation(AUTH_STORE_REF, {\n    args: {\n      type: \"userOAuth\",\n      ...args,\n    },\n  });\n};\n"],"mappings":";;;;;;;;;;AAoBA,MAAM,8BAA8B,MAAO,KAAK;AAEhD,MAAa,gBAAgB,EAAE,OAAO;CACpC,UAAU,EAAE,QAAQ;CACpB,mBAAmB,EAAE,QAAQ;CAC7B,SAAS,EAAE,KAAK;CAChB,WAAW,EAAE,QAAQ;CACrB,eAAe,EAAE,SAAS,EAAE,KAAK,CAAC;CACnC,CAAC;AAEF,SAAS,uBACP,UACA,mBACA,eACA;CACA,MAAM,eAAwC;EAC5C,MAAM;EACN;EACA;EACD;AACD,KAAI,SAAS,WAAW,gCAAgC,EAAE;AACxD,eAAa,OAAO;AACpB,eAAa,eAAe,SAAS,MACnC,gCAAgC,OACjC;;AAEH,KAAI,SAAS,WAAW,gCAAgC,EAAE;AACxD,eAAa,OAAO;AACpB,eAAa,eAAe,SAAS,MACnC,gCAAgC,OACjC;;CAEH,MAAM,WACJ,OAAO,kBAAkB,YACzB,kBAAkB,QAClB,CAAC,MAAM,QAAQ,cAAc,GACxB,gBACD;CACN,MAAM,mBACJ,YACA,OAAO,SAAS,aAAa,YAC7B,SAAS,aAAa,QACtB,CAAC,MAAM,QAAQ,SAAS,SAAS,GAC5B,SAAS,WACV;AACN,QAAO;EACL,GAAG;EACH,UAAU;GACR,GAAG;GACH,GAAG;GACJ;EACF;;AAKH,SAAgB,cACd,KACA,MACA,oBACA,QAC2B;AAC3B,QAAO,GAAG,IAAI,aAAa;AACzB,eAAa,SAAS,uBAAuB,KAAK;EAClD,MAAM,EAAE,SAAS,UAAU,mBAAmB,WAAW,kBACvD;EACF,MAAM,KAAK,OAAO,KAAK,OAAO;EAC9B,MAAM,kBAAkB,OAAO,GAAG,cAChC,GAAG,SAAS,IAAI,UAAU,kBAAkB,CAC7C;EACD,MAAM,eAAe,SAAS,WAAW,gCAAgC,GACrE,SAAS,MAAM,gCAAgC,OAAO,GACtD,SAAS,WAAW,gCAAgC,GAClD,SAAS,MAAM,gCAAgC,OAAO,GACtD;EACN,MAAM,aACJ,iBAAiB,OACb,OAAO,GAAG,cACR,IAAI,SAAS,OAAO,UAAU,OAAO,eAAe,EAClD,cACD,CAAC,CACH,GACD;EACN,MAAM,mBAAmB,aACrB,0BAA0B,WAAW,OAAO,GAC5C;EACJ,MAAM,qBAAqB,SAAS,WAClC,gCACD,GACG,SACA,SAAS,WAAW,gCAAgC,GAClD,SACA;EAEN,MAAM,uBACJ,iBAAiB,QACjB,oBAAoB,QACpB,kBAAkB,aAAa,UAAU,SAAS,eAC9C,OAAO,GAAG,cACR,IAAI,SAAS,OAAO,UAAU,OAAO,2BAA2B;GAC9D;GACA,cAAc;GACd,YAAY;GACb,CAAC,CACH,GACD;EAEN,MAAM,WAAW,OAAO,GAAG,KAAK;GAC9B,UAAU,GAAG,UAAU,eAAe,UAAU;GAChD,WAAW,IAAI,UAAU,sBAAsB;GAChD,CAAC,CAAC,KACD,GAAG,OAAO,QACR,QAAQ,OACJ,GAAG,KAAK,IAAI,UAAU,sBAAsB,CAAC,GAC7C,GAAG,QAAQ,IAAI,CACpB,CACF;EAED,MAAM,EAAE,cAAc,OAAO,GAAG,cAC9B,qBACE,KACA,SAAS,aAAa,MACtB,oBAAoB,OAAO,EAAE,iBAAiB,GAAG,EAAE,mBAAmB,EACtE;GACE,MAAM;GACN,UAAW,uBAAuB,SAAS,GACvC,uCAAuC,UAAU,EAC/C,gBACE,uBAAuB,SACnB,kBAAkB,SAAS,eAAe,OAC1C,uBAAuB,SACrB,kBAAkB,SAAS,eAAe,OAC1C,QACT,CAAC,GACF,mBAAmB,SAAS;GAChC;GACA,eAAe,uBACb,UACA,mBACA,cACD;GACF,EACD,QACA,sBAAsB,SAClB,EAAE,gBAAgB,qBAAqB,QAAQ,GAC/C,OACL,CACF;AAKD,MACE,iBAAiB,QACjB,kBAAkB,aAAa,IAAI,SAAS,2BAC5C;GAEA,MAAM,UADU,OAAO,GAAG,cAAc,GAAG,SAAS,QAAQ,UAAU,CAAC,GAC/C;AACxB,OAAI,QAAQ;IACV,MAAM,UAAW,YAAoB;AACrC,QAAI,SAOF;UAN2B,OAAO,GAAG,cACnC,IAAI,SAAS,OAAO,UAAU,OAAO,yBAAyB;MAC5D;MACA;MACD,CAAC,CACH,MAC0B,KACzB,QAAO,GAAG,cACR,IAAI,YAAY,OAAO,UAAU,OAAO,WAAW;MACjD;MACA;MACA,SAAS,iBAAiB,aAAa,IAAI;MAC3C,QAAQ;MACT,CAAC,CACH;;;;EAMT,MAAM,OAAO,qBAAqB,GAAG,aAAa;AAClD,SAAO,GAAG,cAAc,GAAG,UAAU,OAAO,SAAS,IAAI,CAAC;EAC1D,MAAM,2BAA2B,OAAO,GAAG,cACzC,GAAG,kBAAkB,eAAe,UAAU,CAC/C;AACD,MAAI,6BAA6B,KAC/B,QAAO,GAAG,cACR,GAAG,kBAAkB,OAAO,yBAAyB,IAAI,CAC1D;AAEH,SAAO,GAAG,QAAQ,YAChB,GAAG,kBAAkB,OAAO;GAC1B,MAAM,MAAM,OAAO,KAAK;GACxB;GACA;GACA,gBAAgB,KAAK,KAAK,GAAG;GAC7B,UAAU,SAAS;GACpB,CAAC,CACH;AACD,SAAO;GACP;;AAGJ,MAAa,gBAAgB,OAC3B,KACA,SACwB;AACxB,QAAO,IAAI,YAAY,gBAAgB,EACrC,MAAM;EACJ,MAAM;EACN,GAAG;EACJ,EACF,CAAC"}
+{"version":3,"file":"oauth.js","names":[],"sources":["../../../src/server/mutations/oauth.ts"],"sourcesContent":["import { Fx } from \"@robelest/fx\";\nimport type { GenericActionCtx, GenericDataModel } from \"convex/server\";\nimport { Infer, v } from \"convex/values\";\n\nimport { authDb } from \"../db\";\nimport { AuthError } from \"../authError\";\nimport * as Provider from \"../crypto\";\nimport {\n  createSyntheticOAuthMaterializedConfig,\n} from \"../enterprise/oidc\";\nimport { normalizeEnterprisePolicy } from \"../enterprise/policy\";\nimport {\n  ENTERPRISE_OIDC_PROVIDER_PREFIX,\n  ENTERPRISE_SAML_PROVIDER_PREFIX,\n  isEnterpriseProviderId,\n} from \"../enterprise/shared\";\nimport { MutationCtx } from \"../types\";\nimport type { AuthProviderMaterializedConfig } from \"../types\";\nimport { upsertUserAndAccount } from \"../users\";\nimport { generateRandomString, logWithLevel, sha256 } from \"../utils\";\nimport { AUTH_STORE_REF } from \"./store/refs\";\n\nconst OAUTH_SIGN_IN_EXPIRATION_MS = 1000 * 60 * 2; // 2 minutes\n\nexport const userOAuthArgs = v.object({\n  provider: v.string(),\n  providerAccountId: v.string(),\n  profile: v.any(),\n  signature: v.string(),\n  accountExtend: v.optional(v.any()),\n});\n\nfunction normalizeAccountExtend(\n  provider: string,\n  providerAccountId: string,\n  accountExtend: unknown,\n) {\n  const baseIdentity: Record<string, unknown> = {\n    type: \"oauth\",\n    provider,\n    providerAccountId,\n  };\n  if (provider.startsWith(ENTERPRISE_OIDC_PROVIDER_PREFIX)) {\n    baseIdentity.type = \"enterprise-oidc\";\n    baseIdentity.enterpriseId = provider.slice(\n      ENTERPRISE_OIDC_PROVIDER_PREFIX.length,\n    );\n  }\n  if (provider.startsWith(ENTERPRISE_SAML_PROVIDER_PREFIX)) {\n    baseIdentity.type = \"enterprise-saml\";\n    baseIdentity.enterpriseId = provider.slice(\n      ENTERPRISE_SAML_PROVIDER_PREFIX.length,\n    );\n  }\n  const provided =\n    typeof accountExtend === \"object\" &&\n    accountExtend !== null &&\n    !Array.isArray(accountExtend)\n      ? (accountExtend as Record<string, unknown>)\n      : undefined;\n  const providedIdentity =\n    provided &&\n    typeof provided.identity === \"object\" &&\n    provided.identity !== null &&\n    !Array.isArray(provided.identity)\n      ? (provided.identity as Record<string, unknown>)\n      : undefined;\n  return {\n    ...provided,\n    identity: {\n      ...baseIdentity,\n      ...providedIdentity,\n    },\n  };\n}\n\ntype ReturnType = string;\n\nexport function userOAuthImpl(\n  ctx: MutationCtx,\n  args: Infer<typeof userOAuthArgs>,\n  getProviderOrThrow: Provider.GetProviderOrThrowFunc,\n  config: Provider.Config,\n): Fx<ReturnType, AuthError> {\n  return Fx.gen(function* () {\n    logWithLevel(\"DEBUG\", \"userOAuthImpl args:\", args);\n    const { profile, provider, providerAccountId, signature, accountExtend } =\n      args;\n    const db = authDb(ctx, config);\n    const existingAccount = yield* Fx.promise(() =>\n      db.accounts.get(provider, providerAccountId),\n    );\n    const enterpriseId = provider.startsWith(ENTERPRISE_OIDC_PROVIDER_PREFIX)\n      ? provider.slice(ENTERPRISE_OIDC_PROVIDER_PREFIX.length)\n      : provider.startsWith(ENTERPRISE_SAML_PROVIDER_PREFIX)\n        ? provider.slice(ENTERPRISE_SAML_PROVIDER_PREFIX.length)\n        : null;\n    const enterprise =\n      enterpriseId !== null\n        ? yield* Fx.promise(() =>\n            ctx.runQuery(config.component.public.enterpriseGet, {\n              enterpriseId,\n            }),\n          )\n        : null;\n    const enterprisePolicy = enterprise\n      ? normalizeEnterprisePolicy(enterprise.policy)\n      : null;\n    const enterpriseProtocol = provider.startsWith(\n      ENTERPRISE_OIDC_PROVIDER_PREFIX,\n    )\n      ? \"oidc\"\n      : provider.startsWith(ENTERPRISE_SAML_PROVIDER_PREFIX)\n        ? \"saml\"\n        : null;\n\n    const existingScimIdentity =\n      enterpriseId !== null &&\n      existingAccount === null &&\n      enterprisePolicy?.provisioning.scimReuse.user === \"externalId\"\n        ? yield* Fx.promise(() =>\n            ctx.runQuery(config.component.public.enterpriseScimIdentityGet, {\n              enterpriseId,\n              resourceType: \"user\",\n              externalId: providerAccountId,\n            }),\n          )\n        : null;\n\n    const verifier = yield* Fx.from({\n      ok: () => db.verifiers.getBySignature(signature),\n      err: () => new AuthError(\"OAUTH_INVALID_STATE\"),\n    }).pipe(\n      Fx.chain((doc) =>\n        doc === null\n          ? Fx.fail(new AuthError(\"OAUTH_INVALID_STATE\"))\n          : Fx.succeed(doc),\n      ),\n    );\n\n    const { accountId } = yield* Fx.promise(() =>\n      upsertUserAndAccount(\n        ctx,\n        verifier.sessionId ?? null,\n        existingAccount !== null ? { existingAccount } : { providerAccountId },\n        {\n          type: \"oauth\",\n          provider: (isEnterpriseProviderId(provider)\n            ? createSyntheticOAuthMaterializedConfig(provider, {\n                accountLinking:\n                  enterpriseProtocol === \"oidc\"\n                    ? enterprisePolicy?.identity.accountLinking.oidc\n                    : enterpriseProtocol === \"saml\"\n                      ? enterprisePolicy?.identity.accountLinking.saml\n                      : undefined,\n              })\n            : getProviderOrThrow(provider)) as AuthProviderMaterializedConfig,\n          profile,\n          accountExtend: normalizeAccountExtend(\n            provider,\n            providerAccountId,\n            accountExtend,\n          ),\n        },\n        config,\n        existingScimIdentity?.userId\n          ? { existingUserId: existingScimIdentity.userId }\n          : undefined,\n      ),\n    );\n\n    // JIT group provisioning: if this is an enterprise SSO sign-in and the\n    // enterprise connection has a groupId, auto-add the user as a member of\n    // that group if they aren't already a member.\n    if (\n      enterpriseId !== null &&\n      enterprisePolicy?.provisioning.jit.mode === \"createUserAndMembership\"\n    ) {\n      const account = yield* Fx.promise(() => db.accounts.getById(accountId));\n      const userId = account?.userId;\n      if (userId) {\n        const groupId = (enterprise as any)?.groupId as string | undefined;\n        if (groupId) {\n          const existingMembership = yield* Fx.promise(() =>\n            ctx.runQuery(config.component.public.memberGetByGroupAndUser, {\n              userId,\n              groupId,\n            }),\n          );\n          if (existingMembership === null) {\n            yield* Fx.promise(() =>\n              ctx.runMutation(config.component.public.memberAdd, {\n                groupId,\n                userId,\n                roleIds: enterprisePolicy.provisioning.jit.defaultRoleIds,\n                status: \"active\",\n              }),\n            );\n          }\n        }\n      }\n    }\n\n    const code = generateRandomString(8, \"0123456789\");\n    yield* Fx.promise(() => db.verifiers.delete(verifier._id));\n    const existingVerificationCode = yield* Fx.promise(() =>\n      db.verificationCodes.getByAccountId(accountId),\n    );\n    if (existingVerificationCode !== null) {\n      yield* Fx.promise(() =>\n        db.verificationCodes.delete(existingVerificationCode._id),\n      );\n    }\n    yield* Fx.promise(async () =>\n      db.verificationCodes.create({\n        code: await sha256(code),\n        accountId,\n        provider,\n        expirationTime: Date.now() + OAUTH_SIGN_IN_EXPIRATION_MS,\n        verifier: verifier._id,\n      }),\n    );\n    return code;\n  });\n}\n\nexport const callUserOAuth = async <DataModel extends GenericDataModel>(\n  ctx: GenericActionCtx<DataModel>,\n  args: Infer<typeof userOAuthArgs>,\n): Promise<ReturnType> => {\n  return ctx.runMutation(AUTH_STORE_REF, {\n    args: {\n      type: \"userOAuth\",\n      ...args,\n    },\n  });\n};\n"],"mappings":";;;;;;;;;;;;AAsBA,MAAM,8BAA8B,MAAO,KAAK;AAEhD,MAAa,gBAAgB,EAAE,OAAO;CACpC,UAAU,EAAE,QAAQ;CACpB,mBAAmB,EAAE,QAAQ;CAC7B,SAAS,EAAE,KAAK;CAChB,WAAW,EAAE,QAAQ;CACrB,eAAe,EAAE,SAAS,EAAE,KAAK,CAAC;CACnC,CAAC;AAEF,SAAS,uBACP,UACA,mBACA,eACA;CACA,MAAM,eAAwC;EAC5C,MAAM;EACN;EACA;EACD;AACD,KAAI,SAAS,WAAW,gCAAgC,EAAE;AACxD,eAAa,OAAO;AACpB,eAAa,eAAe,SAAS,MACnC,gCAAgC,OACjC;;AAEH,KAAI,SAAS,WAAW,gCAAgC,EAAE;AACxD,eAAa,OAAO;AACpB,eAAa,eAAe,SAAS,MACnC,gCAAgC,OACjC;;CAEH,MAAM,WACJ,OAAO,kBAAkB,YACzB,kBAAkB,QAClB,CAAC,MAAM,QAAQ,cAAc,GACxB,gBACD;CACN,MAAM,mBACJ,YACA,OAAO,SAAS,aAAa,YAC7B,SAAS,aAAa,QACtB,CAAC,MAAM,QAAQ,SAAS,SAAS,GAC5B,SAAS,WACV;AACN,QAAO;EACL,GAAG;EACH,UAAU;GACR,GAAG;GACH,GAAG;GACJ;EACF;;AAKH,SAAgB,cACd,KACA,MACA,oBACA,QAC2B;AAC3B,QAAO,GAAG,IAAI,aAAa;AACzB,eAAa,SAAS,uBAAuB,KAAK;EAClD,MAAM,EAAE,SAAS,UAAU,mBAAmB,WAAW,kBACvD;EACF,MAAM,KAAK,OAAO,KAAK,OAAO;EAC9B,MAAM,kBAAkB,OAAO,GAAG,cAChC,GAAG,SAAS,IAAI,UAAU,kBAAkB,CAC7C;EACD,MAAM,eAAe,SAAS,WAAW,gCAAgC,GACrE,SAAS,MAAM,gCAAgC,OAAO,GACtD,SAAS,WAAW,gCAAgC,GAClD,SAAS,MAAM,gCAAgC,OAAO,GACtD;EACN,MAAM,aACJ,iBAAiB,OACb,OAAO,GAAG,cACR,IAAI,SAAS,OAAO,UAAU,OAAO,eAAe,EAClD,cACD,CAAC,CACH,GACD;EACN,MAAM,mBAAmB,aACrB,0BAA0B,WAAW,OAAO,GAC5C;EACJ,MAAM,qBAAqB,SAAS,WAClC,gCACD,GACG,SACA,SAAS,WAAW,gCAAgC,GAClD,SACA;EAEN,MAAM,uBACJ,iBAAiB,QACjB,oBAAoB,QACpB,kBAAkB,aAAa,UAAU,SAAS,eAC9C,OAAO,GAAG,cACR,IAAI,SAAS,OAAO,UAAU,OAAO,2BAA2B;GAC9D;GACA,cAAc;GACd,YAAY;GACb,CAAC,CACH,GACD;EAEN,MAAM,WAAW,OAAO,GAAG,KAAK;GAC9B,UAAU,GAAG,UAAU,eAAe,UAAU;GAChD,WAAW,IAAI,UAAU,sBAAsB;GAChD,CAAC,CAAC,KACD,GAAG,OAAO,QACR,QAAQ,OACJ,GAAG,KAAK,IAAI,UAAU,sBAAsB,CAAC,GAC7C,GAAG,QAAQ,IAAI,CACpB,CACF;EAED,MAAM,EAAE,cAAc,OAAO,GAAG,cAC9B,qBACE,KACA,SAAS,aAAa,MACtB,oBAAoB,OAAO,EAAE,iBAAiB,GAAG,EAAE,mBAAmB,EACtE;GACE,MAAM;GACN,UAAW,uBAAuB,SAAS,GACvC,uCAAuC,UAAU,EAC/C,gBACE,uBAAuB,SACnB,kBAAkB,SAAS,eAAe,OAC1C,uBAAuB,SACrB,kBAAkB,SAAS,eAAe,OAC1C,QACT,CAAC,GACF,mBAAmB,SAAS;GAChC;GACA,eAAe,uBACb,UACA,mBACA,cACD;GACF,EACD,QACA,sBAAsB,SAClB,EAAE,gBAAgB,qBAAqB,QAAQ,GAC/C,OACL,CACF;AAKD,MACE,iBAAiB,QACjB,kBAAkB,aAAa,IAAI,SAAS,2BAC5C;GAEA,MAAM,UADU,OAAO,GAAG,cAAc,GAAG,SAAS,QAAQ,UAAU,CAAC,GAC/C;AACxB,OAAI,QAAQ;IACV,MAAM,UAAW,YAAoB;AACrC,QAAI,SAOF;UAN2B,OAAO,GAAG,cACnC,IAAI,SAAS,OAAO,UAAU,OAAO,yBAAyB;MAC5D;MACA;MACD,CAAC,CACH,MAC0B,KACzB,QAAO,GAAG,cACR,IAAI,YAAY,OAAO,UAAU,OAAO,WAAW;MACjD;MACA;MACA,SAAS,iBAAiB,aAAa,IAAI;MAC3C,QAAQ;MACT,CAAC,CACH;;;;EAMT,MAAM,OAAO,qBAAqB,GAAG,aAAa;AAClD,SAAO,GAAG,cAAc,GAAG,UAAU,OAAO,SAAS,IAAI,CAAC;EAC1D,MAAM,2BAA2B,OAAO,GAAG,cACzC,GAAG,kBAAkB,eAAe,UAAU,CAC/C;AACD,MAAI,6BAA6B,KAC/B,QAAO,GAAG,cACR,GAAG,kBAAkB,OAAO,yBAAyB,IAAI,CAC1D;AAEH,SAAO,GAAG,QAAQ,YAChB,GAAG,kBAAkB,OAAO;GAC1B,MAAM,MAAM,OAAO,KAAK;GACxB;GACA;GACA,gBAAgB,KAAK,KAAK,GAAG;GAC7B,UAAU,SAAS;GACpB,CAAC,CACH;AACD,SAAO;GACP;;AAGJ,MAAa,gBAAgB,OAC3B,KACA,SACwB;AACxB,QAAO,IAAI,YAAY,gBAAgB,EACrC,MAAM;EACJ,MAAM;EACN,GAAG;EACJ,EACF,CAAC"}

package/dist/server/mutations/refresh.d.ts

@@ -1,14 +1,14 @@
 import { MutationCtx } from "../types.js";
-import { Config, GetProviderOrThrowFunc } from "../provider.js";
+import { Config, GetProviderOrThrowFunc } from "../crypto.js";
 import { GenericActionCtx, GenericDataModel } from "convex/server";
-import * as convex_values24 from "convex/values";
+import * as convex_values18 from "convex/values";
 import { Infer } from "convex/values";
 
 //#region src/server/mutations/refresh.d.ts
-declare const refreshSessionArgs: convex_values24.VObject<{
+declare const refreshSessionArgs: convex_values18.VObject<{
   refreshToken: string;
 }, {
-  refreshToken: convex_values24.VString<string, "required">;
+  refreshToken: convex_values18.VString<string, "required">;
 }, "required", "refreshToken">;
 type RefreshResult = null | {
   token: string;

package/dist/server/mutations/refresh.js

@@ -1,6 +1,6 @@
 import { logWithLevel, maybeRedact } from "../utils.js";
 import { authDb } from "../db.js";
-import { AUTH_STORE_REF } from "./store.js";
+import { AUTH_STORE_REF } from "./store/refs.js";
 import { REFRESH_TOKEN_REUSE_WINDOW_MS, invalidateRefreshTokensInSubtree, parseRefreshToken, refreshTokenIfValid } from "../refresh.js";
 import { generateTokensForSession } from "../sessions.js";
 import { Fx } from "@robelest/fx";

package/dist/server/mutations/refresh.js.map

@@ -1 +1 @@
-{"version":3,"file":"refresh.js","names":[],"sources":["../../../src/server/mutations/refresh.ts"],"sourcesContent":["import { Fx } from \"@robelest/fx\";\nimport type { GenericActionCtx, GenericDataModel } from \"convex/server\";\nimport { Infer, v } from \"convex/values\";\n\nimport { authDb } from \"../db\";\nimport { AuthError } from \"../fx\";\nimport * as Provider from \"../provider\";\nimport {\n  invalidateRefreshTokensInSubtree,\n  parseRefreshToken,\n  REFRESH_TOKEN_REUSE_WINDOW_MS,\n  refreshTokenIfValid,\n} from \"../refresh\";\nimport { generateTokensForSession } from \"../sessions\";\nimport { MutationCtx } from \"../types\";\nimport { logWithLevel, maybeRedact } from \"../utils\";\nimport { AUTH_STORE_REF } from \"./store\";\n\nexport const refreshSessionArgs = v.object({\n  refreshToken: v.string(),\n});\n\ntype RefreshResult = null | {\n  token: string;\n  refreshToken: string;\n};\n\n// ============================================================================\n// Small helpers for the refresh pipeline\n// ============================================================================\n\n/** A soft refresh failure — logged and collapsed to null at the boundary. */\nclass RefreshFailure {\n  readonly _tag = \"RefreshFailure\" as const;\n  constructor(readonly reason: string) {}\n}\n\n// ============================================================================\n// Main exported function\n// ============================================================================\n\nexport async function refreshSessionImpl(\n  ctx: MutationCtx,\n  args: Infer<typeof refreshSessionArgs>,\n  _getProviderOrThrow: Provider.GetProviderOrThrowFunc,\n  config: Provider.Config,\n): Promise<RefreshResult> {\n  const db = authDb(ctx, config);\n  const { refreshToken } = args;\n\n  return Fx.run(\n    parseRefreshToken(refreshToken).pipe(\n      Fx.recover((err: AuthError) => Fx.fail(new RefreshFailure(err.message))),\n      Fx.tap(({ refreshTokenId, sessionId: tokenSessionId }) =>\n        Fx.sync(() =>\n          logWithLevel(\n            \"DEBUG\",\n            `refreshSessionImpl args: Token ID: ${maybeRedact(refreshTokenId)} Session ID: ${maybeRedact(tokenSessionId)}`,\n          ),\n        ),\n      ),\n      Fx.chain(({ refreshTokenId, sessionId: tokenSessionId }) =>\n        refreshTokenIfValid(ctx, refreshTokenId, tokenSessionId, config).pipe(\n          Fx.chain((validationResult) =>\n            validationResult === null\n              ? Fx.gen(function* () {\n                  yield* Fx.from({\n                    ok: async () => {\n                      const session = await (db as any).sessions.getById(\n                        tokenSessionId,\n                      );\n                      if (session !== null) {\n                        await (db as any).sessions.delete(session._id);\n                      }\n                    },\n                    err: () =>\n                      new RefreshFailure(\n                        \"Skipping invalid session id during refresh cleanup\",\n                      ),\n                  }).pipe(\n                    Fx.recover((f) => {\n                      logWithLevel(\"DEBUG\", f.reason);\n                      return Fx.succeed(undefined as void);\n                    }),\n                  );\n\n                  yield* Fx.from({\n                    ok: () =>\n                      authDb(ctx, config).refreshTokens.deleteAll(\n                        tokenSessionId as any,\n                      ),\n                    err: () =>\n                      new RefreshFailure(\n                        \"Skipping invalid token session id during refresh token cleanup\",\n                      ),\n                  }).pipe(\n                    Fx.recover((f) => {\n                      logWithLevel(\"DEBUG\", f.reason);\n                      return Fx.succeed(undefined as void);\n                    }),\n                  );\n\n                  return null;\n                })\n              : (() => {\n                  const { session } = validationResult;\n                  const sessionId = session._id;\n                  const userId = session.userId;\n                  const tokenFirstUsed =\n                    validationResult.refreshTokenDoc.firstUsedTime;\n                  return tokenFirstUsed === undefined\n                    ? Fx.from({\n                        ok: async () => {\n                          await (db as any).refreshTokens.patch(\n                            refreshTokenId,\n                            {\n                              firstUsedTime: Date.now(),\n                            },\n                          );\n                          const result = await generateTokensForSession(\n                            ctx,\n                            config,\n                            {\n                              userId,\n                              sessionId,\n                              issuedRefreshTokenId: null,\n                              parentRefreshTokenId: refreshTokenId as any,\n                            },\n                          );\n                          const { refreshTokenId: newRefreshTokenId } =\n                            await Fx.run(\n                              parseRefreshToken(result.refreshToken),\n                            );\n                          logWithLevel(\n                            \"DEBUG\",\n                            `Exchanged ${maybeRedact(validationResult.refreshTokenDoc._id)} (first use) for new refresh token ${maybeRedact(newRefreshTokenId)}`,\n                          );\n                          return result;\n                        },\n                        err: () =>\n                          new RefreshFailure(\n                            \"Failed during first-use token exchange\",\n                          ),\n                      })\n                    : Fx.from({\n                        ok: () =>\n                          authDb(ctx, config).refreshTokens.getActive(\n                            tokenSessionId as any,\n                          ),\n                        err: () =>\n                          new RefreshFailure(\n                            \"Failed to load active refresh token\",\n                          ),\n                      }).pipe(\n                        Fx.chain((activeRefreshToken) => {\n                          logWithLevel(\n                            \"DEBUG\",\n                            `Active refresh token: ${maybeRedact(activeRefreshToken?._id ?? \"(none)\")}, parent ${maybeRedact(activeRefreshToken?.parentRefreshTokenId ?? \"(none)\")}`,\n                          );\n\n                          const reuseDispatch =\n                            activeRefreshToken !== null &&\n                            activeRefreshToken.parentRefreshTokenId ===\n                              refreshTokenId\n                              ? ({\n                                  tag: \"parentOfActive\",\n                                  activeRefreshToken,\n                                } as const)\n                              : tokenFirstUsed + REFRESH_TOKEN_REUSE_WINDOW_MS >\n                                  Date.now()\n                                ? ({ tag: \"withinReuseWindow\" } as const)\n                                : ({ tag: \"outsideReuseWindow\" } as const);\n\n                          if (reuseDispatch.tag === \"parentOfActive\") {\n                            return Fx.from({\n                              ok: () =>\n                                generateTokensForSession(ctx, config, {\n                                  userId,\n                                  sessionId,\n                                  issuedRefreshTokenId:\n                                    reuseDispatch.activeRefreshToken._id,\n                                  parentRefreshTokenId: refreshTokenId as any,\n                                }),\n                              err: () =>\n                                new RefreshFailure(\n                                  \"Failed to generate tokens for parent reuse\",\n                                ),\n                            }).pipe(\n                              Fx.tap(() =>\n                                Fx.sync(() =>\n                                  logWithLevel(\n                                    \"DEBUG\",\n                                    `Token ${maybeRedact(validationResult.refreshTokenDoc._id)} is parent of active refresh token ${maybeRedact(reuseDispatch.activeRefreshToken._id)}, so returning that token`,\n                                  ),\n                                ),\n                              ),\n                            );\n                          }\n\n                          if (reuseDispatch.tag === \"withinReuseWindow\") {\n                            return Fx.from({\n                              ok: async () => {\n                                const result = await generateTokensForSession(\n                                  ctx,\n                                  config,\n                                  {\n                                    userId,\n                                    sessionId,\n                                    issuedRefreshTokenId: null,\n                                    parentRefreshTokenId: refreshTokenId as any,\n                                  },\n                                );\n                                const { refreshTokenId: newRefreshTokenId } =\n                                  await Fx.run(\n                                    parseRefreshToken(result.refreshToken),\n                                  );\n                                logWithLevel(\n                                  \"DEBUG\",\n                                  `Exchanged ${maybeRedact(validationResult.refreshTokenDoc._id)} (reuse) for new refresh token ${maybeRedact(newRefreshTokenId)}`,\n                                );\n                                return result;\n                              },\n                              err: () =>\n                                new RefreshFailure(\n                                  \"Failed to generate tokens for reuse window\",\n                                ),\n                            });\n                          }\n\n                          logWithLevel(\n                            \"ERROR\",\n                            \"Refresh token used outside of reuse window\",\n                          );\n                          logWithLevel(\n                            \"DEBUG\",\n                            `Token ${maybeRedact(validationResult.refreshTokenDoc._id)} being used outside of reuse window, so invalidating all refresh tokens in subtree`,\n                          );\n                          return Fx.from({\n                            ok: async () => {\n                              const tokensToInvalidate =\n                                await invalidateRefreshTokensInSubtree(\n                                  ctx,\n                                  validationResult.refreshTokenDoc,\n                                  config,\n                                );\n                              logWithLevel(\n                                \"DEBUG\",\n                                `Invalidated ${tokensToInvalidate.length} refresh tokens in subtree: ${tokensToInvalidate\n                                  .map((token) => maybeRedact(token._id))\n                                  .join(\", \")}`,\n                              );\n                              return null;\n                            },\n                            err: () =>\n                              new RefreshFailure(\n                                \"Failed to invalidate refresh tokens in subtree\",\n                              ),\n                          });\n                        }),\n                      );\n                })(),\n          ),\n        ),\n      ),\n      Fx.fold({\n        ok: (result) => result,\n        err: (failure) => {\n          logWithLevel(\"DEBUG\", failure.reason);\n          return null;\n        },\n      }),\n    ),\n  );\n}\n\n// ============================================================================\n// Invalid token path — cleanup session and refresh tokens\n// ============================================================================\n\n// ============================================================================\n// Valid token path — dispatch on first-use / parent / reuse-window / stale\n// ============================================================================\n\n// ============================================================================\n// Action-level caller (unchanged — just forwards to mutation)\n// ============================================================================\n\nexport const callRefreshSession = async <DataModel extends GenericDataModel>(\n  ctx: GenericActionCtx<DataModel>,\n  args: Infer<typeof refreshSessionArgs>,\n): Promise<RefreshResult> => {\n  return ctx.runMutation(AUTH_STORE_REF, {\n    args: {\n      type: \"refreshSession\",\n      ...args,\n    },\n  });\n};\n"],"mappings":";;;;;;;;;AAkBA,MAAa,qBAAqB,EAAE,OAAO,EACzC,cAAc,EAAE,QAAQ,EACzB,CAAC;;AAYF,IAAM,iBAAN,MAAqB;CACnB,AAAS,OAAO;CAChB,YAAY,AAAS,QAAgB;EAAhB;;;AAOvB,eAAsB,mBACpB,KACA,MACA,qBACA,QACwB;CACxB,MAAM,KAAK,OAAO,KAAK,OAAO;CAC9B,MAAM,EAAE,iBAAiB;AAEzB,QAAO,GAAG,IACR,kBAAkB,aAAa,CAAC,KAC9B,GAAG,SAAS,QAAmB,GAAG,KAAK,IAAI,eAAe,IAAI,QAAQ,CAAC,CAAC,EACxE,GAAG,KAAK,EAAE,gBAAgB,WAAW,qBACnC,GAAG,WACD,aACE,SACA,sCAAsC,YAAY,eAAe,CAAC,eAAe,YAAY,eAAe,GAC7G,CACF,CACF,EACD,GAAG,OAAO,EAAE,gBAAgB,WAAW,qBACrC,oBAAoB,KAAK,gBAAgB,gBAAgB,OAAO,CAAC,KAC/D,GAAG,OAAO,qBACR,qBAAqB,OACjB,GAAG,IAAI,aAAa;AAClB,SAAO,GAAG,KAAK;GACb,IAAI,YAAY;IACd,MAAM,UAAU,MAAO,GAAW,SAAS,QACzC,eACD;AACD,QAAI,YAAY,KACd,OAAO,GAAW,SAAS,OAAO,QAAQ,IAAI;;GAGlD,WACE,IAAI,eACF,qDACD;GACJ,CAAC,CAAC,KACD,GAAG,SAAS,MAAM;AAChB,gBAAa,SAAS,EAAE,OAAO;AAC/B,UAAO,GAAG,QAAQ,OAAkB;IACpC,CACH;AAED,SAAO,GAAG,KAAK;GACb,UACE,OAAO,KAAK,OAAO,CAAC,cAAc,UAChC,eACD;GACH,WACE,IAAI,eACF,iEACD;GACJ,CAAC,CAAC,KACD,GAAG,SAAS,MAAM;AAChB,gBAAa,SAAS,EAAE,OAAO;AAC/B,UAAO,GAAG,QAAQ,OAAkB;IACpC,CACH;AAED,SAAO;GACP,UACK;EACL,MAAM,EAAE,YAAY;EACpB,MAAM,YAAY,QAAQ;EAC1B,MAAM,SAAS,QAAQ;EACvB,MAAM,iBACJ,iBAAiB,gBAAgB;AACnC,SAAO,mBAAmB,SACtB,GAAG,KAAK;GACN,IAAI,YAAY;AACd,UAAO,GAAW,cAAc,MAC9B,gBACA,EACE,eAAe,KAAK,KAAK,EAC1B,CACF;IACD,MAAM,SAAS,MAAM,yBACnB,KACA,QACA;KACE;KACA;KACA,sBAAsB;KACtB,sBAAsB;KACvB,CACF;IACD,MAAM,EAAE,gBAAgB,sBACtB,MAAM,GAAG,IACP,kBAAkB,OAAO,aAAa,CACvC;AACH,iBACE,SACA,aAAa,YAAY,iBAAiB,gBAAgB,IAAI,CAAC,qCAAqC,YAAY,kBAAkB,GACnI;AACD,WAAO;;GAET,WACE,IAAI,eACF,yCACD;GACJ,CAAC,GACF,GAAG,KAAK;GACN,UACE,OAAO,KAAK,OAAO,CAAC,cAAc,UAChC,eACD;GACH,WACE,IAAI,eACF,sCACD;GACJ,CAAC,CAAC,KACD,GAAG,OAAO,uBAAuB;AAC/B,gBACE,SACA,yBAAyB,YAAY,oBAAoB,OAAO,SAAS,CAAC,WAAW,YAAY,oBAAoB,wBAAwB,SAAS,GACvJ;GAED,MAAM,gBACJ,uBAAuB,QACvB,mBAAmB,yBACjB,iBACG;IACC,KAAK;IACL;IACD,GACD,iBAAiB,gCACf,KAAK,KAAK,GACT,EAAE,KAAK,qBAAqB,GAC5B,EAAE,KAAK,sBAAsB;AAEtC,OAAI,cAAc,QAAQ,iBACxB,QAAO,GAAG,KAAK;IACb,UACE,yBAAyB,KAAK,QAAQ;KACpC;KACA;KACA,sBACE,cAAc,mBAAmB;KACnC,sBAAsB;KACvB,CAAC;IACJ,WACE,IAAI,eACF,6CACD;IACJ,CAAC,CAAC,KACD,GAAG,UACD,GAAG,WACD,aACE,SACA,SAAS,YAAY,iBAAiB,gBAAgB,IAAI,CAAC,qCAAqC,YAAY,cAAc,mBAAmB,IAAI,CAAC,2BACnJ,CACF,CACF,CACF;AAGH,OAAI,cAAc,QAAQ,oBACxB,QAAO,GAAG,KAAK;IACb,IAAI,YAAY;KACd,MAAM,SAAS,MAAM,yBACnB,KACA,QACA;MACE;MACA;MACA,sBAAsB;MACtB,sBAAsB;MACvB,CACF;KACD,MAAM,EAAE,gBAAgB,sBACtB,MAAM,GAAG,IACP,kBAAkB,OAAO,aAAa,CACvC;AACH,kBACE,SACA,aAAa,YAAY,iBAAiB,gBAAgB,IAAI,CAAC,iCAAiC,YAAY,kBAAkB,GAC/H;AACD,YAAO;;IAET,WACE,IAAI,eACF,6CACD;IACJ,CAAC;AAGJ,gBACE,SACA,6CACD;AACD,gBACE,SACA,SAAS,YAAY,iBAAiB,gBAAgB,IAAI,CAAC,oFAC5D;AACD,UAAO,GAAG,KAAK;IACb,IAAI,YAAY;KACd,MAAM,qBACJ,MAAM,iCACJ,KACA,iBAAiB,iBACjB,OACD;AACH,kBACE,SACA,eAAe,mBAAmB,OAAO,8BAA8B,mBACpE,KAAK,UAAU,YAAY,MAAM,IAAI,CAAC,CACtC,KAAK,KAAK,GACd;AACD,YAAO;;IAET,WACE,IAAI,eACF,iDACD;IACJ,CAAC;IACF,CACH;KACH,CACT,CACF,CACF,EACD,GAAG,KAAK;EACN,KAAK,WAAW;EAChB,MAAM,YAAY;AAChB,gBAAa,SAAS,QAAQ,OAAO;AACrC,UAAO;;EAEV,CAAC,CACH,CACF;;AAeH,MAAa,qBAAqB,OAChC,KACA,SAC2B;AAC3B,QAAO,IAAI,YAAY,gBAAgB,EACrC,MAAM;EACJ,MAAM;EACN,GAAG;EACJ,EACF,CAAC"}
+{"version":3,"file":"refresh.js","names":[],"sources":["../../../src/server/mutations/refresh.ts"],"sourcesContent":["import { Fx } from \"@robelest/fx\";\nimport type { GenericActionCtx, GenericDataModel } from \"convex/server\";\nimport { Infer, v } from \"convex/values\";\n\nimport { authDb } from \"../db\";\nimport { AuthError } from \"../authError\";\nimport * as Provider from \"../crypto\";\nimport {\n  invalidateRefreshTokensInSubtree,\n  parseRefreshToken,\n  REFRESH_TOKEN_REUSE_WINDOW_MS,\n  refreshTokenIfValid,\n} from \"../refresh\";\nimport { generateTokensForSession } from \"../sessions\";\nimport { MutationCtx } from \"../types\";\nimport { logWithLevel, maybeRedact } from \"../utils\";\nimport { AUTH_STORE_REF } from \"./store/refs\";\n\nexport const refreshSessionArgs = v.object({\n  refreshToken: v.string(),\n});\n\ntype RefreshResult = null | {\n  token: string;\n  refreshToken: string;\n};\n\n// ============================================================================\n// Small helpers for the refresh pipeline\n// ============================================================================\n\n/** A soft refresh failure — logged and collapsed to null at the boundary. */\nclass RefreshFailure {\n  readonly _tag = \"RefreshFailure\" as const;\n  constructor(readonly reason: string) {}\n}\n\n// ============================================================================\n// Main exported function\n// ============================================================================\n\nexport async function refreshSessionImpl(\n  ctx: MutationCtx,\n  args: Infer<typeof refreshSessionArgs>,\n  _getProviderOrThrow: Provider.GetProviderOrThrowFunc,\n  config: Provider.Config,\n): Promise<RefreshResult> {\n  const db = authDb(ctx, config);\n  const { refreshToken } = args;\n\n  return Fx.run(\n    parseRefreshToken(refreshToken).pipe(\n      Fx.recover((err: AuthError) => Fx.fail(new RefreshFailure(err.message))),\n      Fx.tap(({ refreshTokenId, sessionId: tokenSessionId }) =>\n        Fx.sync(() =>\n          logWithLevel(\n            \"DEBUG\",\n            `refreshSessionImpl args: Token ID: ${maybeRedact(refreshTokenId)} Session ID: ${maybeRedact(tokenSessionId)}`,\n          ),\n        ),\n      ),\n      Fx.chain(({ refreshTokenId, sessionId: tokenSessionId }) =>\n        refreshTokenIfValid(ctx, refreshTokenId, tokenSessionId, config).pipe(\n          Fx.chain((validationResult) =>\n            validationResult === null\n              ? Fx.gen(function* () {\n                  yield* Fx.from({\n                    ok: async () => {\n                      const session = await (db as any).sessions.getById(\n                        tokenSessionId,\n                      );\n                      if (session !== null) {\n                        await (db as any).sessions.delete(session._id);\n                      }\n                    },\n                    err: () =>\n                      new RefreshFailure(\n                        \"Skipping invalid session id during refresh cleanup\",\n                      ),\n                  }).pipe(\n                    Fx.recover((f) => {\n                      logWithLevel(\"DEBUG\", f.reason);\n                      return Fx.succeed(undefined as void);\n                    }),\n                  );\n\n                  yield* Fx.from({\n                    ok: () =>\n                      authDb(ctx, config).refreshTokens.deleteAll(\n                        tokenSessionId as any,\n                      ),\n                    err: () =>\n                      new RefreshFailure(\n                        \"Skipping invalid token session id during refresh token cleanup\",\n                      ),\n                  }).pipe(\n                    Fx.recover((f) => {\n                      logWithLevel(\"DEBUG\", f.reason);\n                      return Fx.succeed(undefined as void);\n                    }),\n                  );\n\n                  return null;\n                })\n              : (() => {\n                  const { session } = validationResult;\n                  const sessionId = session._id;\n                  const userId = session.userId;\n                  const tokenFirstUsed =\n                    validationResult.refreshTokenDoc.firstUsedTime;\n                  return tokenFirstUsed === undefined\n                    ? Fx.from({\n                        ok: async () => {\n                          await (db as any).refreshTokens.patch(\n                            refreshTokenId,\n                            {\n                              firstUsedTime: Date.now(),\n                            },\n                          );\n                          const result = await generateTokensForSession(\n                            ctx,\n                            config,\n                            {\n                              userId,\n                              sessionId,\n                              issuedRefreshTokenId: null,\n                              parentRefreshTokenId: refreshTokenId as any,\n                            },\n                          );\n                          const { refreshTokenId: newRefreshTokenId } =\n                            await Fx.run(\n                              parseRefreshToken(result.refreshToken),\n                            );\n                          logWithLevel(\n                            \"DEBUG\",\n                            `Exchanged ${maybeRedact(validationResult.refreshTokenDoc._id)} (first use) for new refresh token ${maybeRedact(newRefreshTokenId)}`,\n                          );\n                          return result;\n                        },\n                        err: () =>\n                          new RefreshFailure(\n                            \"Failed during first-use token exchange\",\n                          ),\n                      })\n                    : Fx.from({\n                        ok: () =>\n                          authDb(ctx, config).refreshTokens.getActive(\n                            tokenSessionId as any,\n                          ),\n                        err: () =>\n                          new RefreshFailure(\n                            \"Failed to load active refresh token\",\n                          ),\n                      }).pipe(\n                        Fx.chain((activeRefreshToken) => {\n                          logWithLevel(\n                            \"DEBUG\",\n                            `Active refresh token: ${maybeRedact(activeRefreshToken?._id ?? \"(none)\")}, parent ${maybeRedact(activeRefreshToken?.parentRefreshTokenId ?? \"(none)\")}`,\n                          );\n\n                          const reuseDispatch =\n                            activeRefreshToken !== null &&\n                            activeRefreshToken.parentRefreshTokenId ===\n                              refreshTokenId\n                              ? ({\n                                  tag: \"parentOfActive\",\n                                  activeRefreshToken,\n                                } as const)\n                              : tokenFirstUsed + REFRESH_TOKEN_REUSE_WINDOW_MS >\n                                  Date.now()\n                                ? ({ tag: \"withinReuseWindow\" } as const)\n                                : ({ tag: \"outsideReuseWindow\" } as const);\n\n                          if (reuseDispatch.tag === \"parentOfActive\") {\n                            return Fx.from({\n                              ok: () =>\n                                generateTokensForSession(ctx, config, {\n                                  userId,\n                                  sessionId,\n                                  issuedRefreshTokenId:\n                                    reuseDispatch.activeRefreshToken._id,\n                                  parentRefreshTokenId: refreshTokenId as any,\n                                }),\n                              err: () =>\n                                new RefreshFailure(\n                                  \"Failed to generate tokens for parent reuse\",\n                                ),\n                            }).pipe(\n                              Fx.tap(() =>\n                                Fx.sync(() =>\n                                  logWithLevel(\n                                    \"DEBUG\",\n                                    `Token ${maybeRedact(validationResult.refreshTokenDoc._id)} is parent of active refresh token ${maybeRedact(reuseDispatch.activeRefreshToken._id)}, so returning that token`,\n                                  ),\n                                ),\n                              ),\n                            );\n                          }\n\n                          if (reuseDispatch.tag === \"withinReuseWindow\") {\n                            return Fx.from({\n                              ok: async () => {\n                                const result = await generateTokensForSession(\n                                  ctx,\n                                  config,\n                                  {\n                                    userId,\n                                    sessionId,\n                                    issuedRefreshTokenId: null,\n                                    parentRefreshTokenId: refreshTokenId as any,\n                                  },\n                                );\n                                const { refreshTokenId: newRefreshTokenId } =\n                                  await Fx.run(\n                                    parseRefreshToken(result.refreshToken),\n                                  );\n                                logWithLevel(\n                                  \"DEBUG\",\n                                  `Exchanged ${maybeRedact(validationResult.refreshTokenDoc._id)} (reuse) for new refresh token ${maybeRedact(newRefreshTokenId)}`,\n                                );\n                                return result;\n                              },\n                              err: () =>\n                                new RefreshFailure(\n                                  \"Failed to generate tokens for reuse window\",\n                                ),\n                            });\n                          }\n\n                          logWithLevel(\n                            \"ERROR\",\n                            \"Refresh token used outside of reuse window\",\n                          );\n                          logWithLevel(\n                            \"DEBUG\",\n                            `Token ${maybeRedact(validationResult.refreshTokenDoc._id)} being used outside of reuse window, so invalidating all refresh tokens in subtree`,\n                          );\n                          return Fx.from({\n                            ok: async () => {\n                              const tokensToInvalidate =\n                                await invalidateRefreshTokensInSubtree(\n                                  ctx,\n                                  validationResult.refreshTokenDoc,\n                                  config,\n                                );\n                              logWithLevel(\n                                \"DEBUG\",\n                                `Invalidated ${tokensToInvalidate.length} refresh tokens in subtree: ${tokensToInvalidate\n                                  .map((token) => maybeRedact(token._id))\n                                  .join(\", \")}`,\n                              );\n                              return null;\n                            },\n                            err: () =>\n                              new RefreshFailure(\n                                \"Failed to invalidate refresh tokens in subtree\",\n                              ),\n                          });\n                        }),\n                      );\n                })(),\n          ),\n        ),\n      ),\n      Fx.fold({\n        ok: (result) => result,\n        err: (failure) => {\n          logWithLevel(\"DEBUG\", failure.reason);\n          return null;\n        },\n      }),\n    ),\n  );\n}\n\n// ============================================================================\n// Invalid token path — cleanup session and refresh tokens\n// ============================================================================\n\n// ============================================================================\n// Valid token path — dispatch on first-use / parent / reuse-window / stale\n// ============================================================================\n\n// ============================================================================\n// Action-level caller (unchanged — just forwards to mutation)\n// ============================================================================\n\nexport const callRefreshSession = async <DataModel extends GenericDataModel>(\n  ctx: GenericActionCtx<DataModel>,\n  args: Infer<typeof refreshSessionArgs>,\n): Promise<RefreshResult> => {\n  return ctx.runMutation(AUTH_STORE_REF, {\n    args: {\n      type: \"refreshSession\",\n      ...args,\n    },\n  });\n};\n"],"mappings":";;;;;;;;;AAkBA,MAAa,qBAAqB,EAAE,OAAO,EACzC,cAAc,EAAE,QAAQ,EACzB,CAAC;;AAYF,IAAM,iBAAN,MAAqB;CACnB,AAAS,OAAO;CAChB,YAAY,AAAS,QAAgB;EAAhB;;;AAOvB,eAAsB,mBACpB,KACA,MACA,qBACA,QACwB;CACxB,MAAM,KAAK,OAAO,KAAK,OAAO;CAC9B,MAAM,EAAE,iBAAiB;AAEzB,QAAO,GAAG,IACR,kBAAkB,aAAa,CAAC,KAC9B,GAAG,SAAS,QAAmB,GAAG,KAAK,IAAI,eAAe,IAAI,QAAQ,CAAC,CAAC,EACxE,GAAG,KAAK,EAAE,gBAAgB,WAAW,qBACnC,GAAG,WACD,aACE,SACA,sCAAsC,YAAY,eAAe,CAAC,eAAe,YAAY,eAAe,GAC7G,CACF,CACF,EACD,GAAG,OAAO,EAAE,gBAAgB,WAAW,qBACrC,oBAAoB,KAAK,gBAAgB,gBAAgB,OAAO,CAAC,KAC/D,GAAG,OAAO,qBACR,qBAAqB,OACjB,GAAG,IAAI,aAAa;AAClB,SAAO,GAAG,KAAK;GACb,IAAI,YAAY;IACd,MAAM,UAAU,MAAO,GAAW,SAAS,QACzC,eACD;AACD,QAAI,YAAY,KACd,OAAO,GAAW,SAAS,OAAO,QAAQ,IAAI;;GAGlD,WACE,IAAI,eACF,qDACD;GACJ,CAAC,CAAC,KACD,GAAG,SAAS,MAAM;AAChB,gBAAa,SAAS,EAAE,OAAO;AAC/B,UAAO,GAAG,QAAQ,OAAkB;IACpC,CACH;AAED,SAAO,GAAG,KAAK;GACb,UACE,OAAO,KAAK,OAAO,CAAC,cAAc,UAChC,eACD;GACH,WACE,IAAI,eACF,iEACD;GACJ,CAAC,CAAC,KACD,GAAG,SAAS,MAAM;AAChB,gBAAa,SAAS,EAAE,OAAO;AAC/B,UAAO,GAAG,QAAQ,OAAkB;IACpC,CACH;AAED,SAAO;GACP,UACK;EACL,MAAM,EAAE,YAAY;EACpB,MAAM,YAAY,QAAQ;EAC1B,MAAM,SAAS,QAAQ;EACvB,MAAM,iBACJ,iBAAiB,gBAAgB;AACnC,SAAO,mBAAmB,SACtB,GAAG,KAAK;GACN,IAAI,YAAY;AACd,UAAO,GAAW,cAAc,MAC9B,gBACA,EACE,eAAe,KAAK,KAAK,EAC1B,CACF;IACD,MAAM,SAAS,MAAM,yBACnB,KACA,QACA;KACE;KACA;KACA,sBAAsB;KACtB,sBAAsB;KACvB,CACF;IACD,MAAM,EAAE,gBAAgB,sBACtB,MAAM,GAAG,IACP,kBAAkB,OAAO,aAAa,CACvC;AACH,iBACE,SACA,aAAa,YAAY,iBAAiB,gBAAgB,IAAI,CAAC,qCAAqC,YAAY,kBAAkB,GACnI;AACD,WAAO;;GAET,WACE,IAAI,eACF,yCACD;GACJ,CAAC,GACF,GAAG,KAAK;GACN,UACE,OAAO,KAAK,OAAO,CAAC,cAAc,UAChC,eACD;GACH,WACE,IAAI,eACF,sCACD;GACJ,CAAC,CAAC,KACD,GAAG,OAAO,uBAAuB;AAC/B,gBACE,SACA,yBAAyB,YAAY,oBAAoB,OAAO,SAAS,CAAC,WAAW,YAAY,oBAAoB,wBAAwB,SAAS,GACvJ;GAED,MAAM,gBACJ,uBAAuB,QACvB,mBAAmB,yBACjB,iBACG;IACC,KAAK;IACL;IACD,GACD,iBAAiB,gCACf,KAAK,KAAK,GACT,EAAE,KAAK,qBAAqB,GAC5B,EAAE,KAAK,sBAAsB;AAEtC,OAAI,cAAc,QAAQ,iBACxB,QAAO,GAAG,KAAK;IACb,UACE,yBAAyB,KAAK,QAAQ;KACpC;KACA;KACA,sBACE,cAAc,mBAAmB;KACnC,sBAAsB;KACvB,CAAC;IACJ,WACE,IAAI,eACF,6CACD;IACJ,CAAC,CAAC,KACD,GAAG,UACD,GAAG,WACD,aACE,SACA,SAAS,YAAY,iBAAiB,gBAAgB,IAAI,CAAC,qCAAqC,YAAY,cAAc,mBAAmB,IAAI,CAAC,2BACnJ,CACF,CACF,CACF;AAGH,OAAI,cAAc,QAAQ,oBACxB,QAAO,GAAG,KAAK;IACb,IAAI,YAAY;KACd,MAAM,SAAS,MAAM,yBACnB,KACA,QACA;MACE;MACA;MACA,sBAAsB;MACtB,sBAAsB;MACvB,CACF;KACD,MAAM,EAAE,gBAAgB,sBACtB,MAAM,GAAG,IACP,kBAAkB,OAAO,aAAa,CACvC;AACH,kBACE,SACA,aAAa,YAAY,iBAAiB,gBAAgB,IAAI,CAAC,iCAAiC,YAAY,kBAAkB,GAC/H;AACD,YAAO;;IAET,WACE,IAAI,eACF,6CACD;IACJ,CAAC;AAGJ,gBACE,SACA,6CACD;AACD,gBACE,SACA,SAAS,YAAY,iBAAiB,gBAAgB,IAAI,CAAC,oFAC5D;AACD,UAAO,GAAG,KAAK;IACb,IAAI,YAAY;KACd,MAAM,qBACJ,MAAM,iCACJ,KACA,iBAAiB,iBACjB,OACD;AACH,kBACE,SACA,eAAe,mBAAmB,OAAO,8BAA8B,mBACpE,KAAK,UAAU,YAAY,MAAM,IAAI,CAAC,CACtC,KAAK,KAAK,GACd;AACD,YAAO;;IAET,WACE,IAAI,eACF,iDACD;IACJ,CAAC;IACF,CACH;KACH,CACT,CACF,CACF,EACD,GAAG,KAAK;EACN,KAAK,WAAW;EAChB,MAAM,YAAY;AAChB,gBAAa,SAAS,QAAQ,OAAO;AACrC,UAAO;;EAEV,CAAC,CACH,CACF;;AAeH,MAAa,qBAAqB,OAChC,KACA,SAC2B;AAC3B,QAAO,IAAI,YAAY,gBAAgB,EACrC,MAAM;EACJ,MAAM;EACN,GAAG;EACJ,EACF,CAAC"}

package/dist/server/mutations/register.d.ts

@@ -1,11 +1,11 @@
 import { Doc, MutationCtx } from "../types.js";
-import { Config, GetProviderOrThrowFunc } from "../provider.js";
+import { Config, GetProviderOrThrowFunc } from "../crypto.js";
 import { GenericActionCtx, GenericDataModel } from "convex/server";
-import * as convex_values109 from "convex/values";
+import * as convex_values0 from "convex/values";
 import { Infer } from "convex/values";
 
 //#region src/server/mutations/register.d.ts
-declare const createAccountFromCredentialsArgs: convex_values109.VObject<{
+declare const createAccountFromCredentialsArgs: convex_values0.VObject<{
   shouldLinkViaEmail?: boolean | undefined;
   shouldLinkViaPhone?: boolean | undefined;
   provider: string;
@@ -15,17 +15,17 @@ declare const createAccountFromCredentialsArgs: convex_values109.VObject<{
     id: string;
   };
 }, {
-  provider: convex_values109.VString<string, "required">;
-  account: convex_values109.VObject<{
+  provider: convex_values0.VString<string, "required">;
+  account: convex_values0.VObject<{
     secret?: string | undefined;
     id: string;
   }, {
-    id: convex_values109.VString<string, "required">;
-    secret: convex_values109.VString<string | undefined, "optional">;
+    id: convex_values0.VString<string, "required">;
+    secret: convex_values0.VString<string | undefined, "optional">;
   }, "required", "id" | "secret">;
-  profile: convex_values109.VAny<any, "required", string>;
-  shouldLinkViaEmail: convex_values109.VBoolean<boolean | undefined, "optional">;
-  shouldLinkViaPhone: convex_values109.VBoolean<boolean | undefined, "optional">;
+  profile: convex_values0.VAny<any, "required", string>;
+  shouldLinkViaEmail: convex_values0.VBoolean<boolean | undefined, "optional">;
+  shouldLinkViaPhone: convex_values0.VBoolean<boolean | undefined, "optional">;
 }, "required", "provider" | "profile" | `profile.${string}` | "account" | "shouldLinkViaEmail" | "shouldLinkViaPhone" | "account.id" | "account.secret">;
 type ReturnType = {
   account: Doc<"Account">;

package/dist/server/mutations/register.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"register.d.ts","names":[],"sources":["../../../src/server/mutations/register.ts"],"mappings":";;;;;;;cAca,gCAAA,mBAAgC,OAAA;;;;;;;;;;YAM3C,gBAAA,CAAA,OAAA;;;;;;;;;;;;KAEG,UAAA;EAAe,OAAA,EAAS,GAAA;EAAgB,IAAA,EAAM,GAAA;AAAA;AAAA,iBAE7B,gCAAA,CACpB,GAAA,EAAK,WAAA,EACL,IAAA,EAAM,KAAA,QAAa,gCAAA,GACnB,kBAAA,EAAoB,sBAAA,EACpB,MAAA,EAAQ,MAAA,GACP,OAAA,CAAQ,UAAA;AAAA,cA8JE,gCAAA,qBACO,gBAAA,EAElB,GAAA,EAAK,gBAAA,CAAiB,SAAA,GACtB,IAAA,EAAM,KAAA,QAAa,gCAAA,MAClB,OAAA,CAAQ,UAAA"}
+{"version":3,"file":"register.d.ts","names":[],"sources":["../../../src/server/mutations/register.ts"],"mappings":";;;;;;;cAca,gCAAA,iBAAgC,OAAA;;;;;;;;;;YAM3C,cAAA,CAAA,OAAA;;;;;;;;;;;;KAEG,UAAA;EAAe,OAAA,EAAS,GAAA;EAAgB,IAAA,EAAM,GAAA;AAAA;AAAA,iBAE7B,gCAAA,CACpB,GAAA,EAAK,WAAA,EACL,IAAA,EAAM,KAAA,QAAa,gCAAA,GACnB,kBAAA,EAAoB,sBAAA,EACpB,MAAA,EAAQ,MAAA,GACP,OAAA,CAAQ,UAAA;AAAA,cA8JE,gCAAA,qBACO,gBAAA,EAElB,GAAA,EAAK,gBAAA,CAAiB,SAAA,GACtB,IAAA,EAAM,KAAA,QAAa,gCAAA,MAClB,OAAA,CAAQ,UAAA"}

package/dist/server/mutations/register.js

@@ -1,8 +1,8 @@
-import { AuthError } from "../fx.js";
+import { AuthError } from "../authError.js";
 import { LOG_LEVELS, logWithLevel, maybeRedact } from "../utils.js";
 import { authDb } from "../db.js";
-import { hash, verify } from "../provider.js";
-import { AUTH_STORE_REF } from "./store.js";
+import { hash, verify } from "../crypto.js";
+import { AUTH_STORE_REF } from "./store/refs.js";
 import { getAuthSessionId } from "../sessions.js";
 import { upsertUserAndAccount } from "../users.js";
 import { Fx } from "@robelest/fx";

package/dist/server/mutations/register.js.map

@@ -1 +1 @@
-{"version":3,"file":"register.js","names":["Provider.verify","Provider.hash"],"sources":["../../../src/server/mutations/register.ts"],"sourcesContent":["import { Fx } from \"@robelest/fx\";\nimport type { GenericActionCtx, GenericDataModel } from \"convex/server\";\nimport { Infer, v } from \"convex/values\";\n\nimport { authDb } from \"../db\";\nimport { AuthError } from \"../fx\";\nimport * as Provider from \"../provider\";\nimport { getAuthSessionId } from \"../sessions\";\nimport { Doc, MutationCtx } from \"../types\";\nimport { ConvexCredentialsConfig } from \"../types\";\nimport { upsertUserAndAccount } from \"../users\";\nimport { LOG_LEVELS, logWithLevel, maybeRedact } from \"../utils\";\nimport { AUTH_STORE_REF } from \"./store\";\n\nexport const createAccountFromCredentialsArgs = v.object({\n  provider: v.string(),\n  account: v.object({ id: v.string(), secret: v.optional(v.string()) }),\n  profile: v.any(),\n  shouldLinkViaEmail: v.optional(v.boolean()),\n  shouldLinkViaPhone: v.optional(v.boolean()),\n});\n\ntype ReturnType = { account: Doc<\"Account\">; user: Doc<\"User\"> };\n\nexport async function createAccountFromCredentialsImpl(\n  ctx: MutationCtx,\n  args: Infer<typeof createAccountFromCredentialsArgs>,\n  getProviderOrThrow: Provider.GetProviderOrThrowFunc,\n  config: Provider.Config,\n): Promise<ReturnType> {\n  logWithLevel(LOG_LEVELS.DEBUG, \"createAccountFromCredentialsImpl args:\", {\n    provider: args.provider,\n    account: {\n      id: args.account.id,\n      secret: maybeRedact(args.account.secret ?? \"\"),\n    },\n  });\n\n  const {\n    provider: providerId,\n    account,\n    profile,\n    shouldLinkViaEmail,\n    shouldLinkViaPhone,\n  } = args;\n  const db = authDb(ctx, config);\n  const provider = getProviderOrThrow(providerId) as ConvexCredentialsConfig;\n\n  return Fx.run(\n    Fx.from({\n      ok: () =>\n        db.accounts.get(\n          provider.id,\n          account.id,\n        ) as Promise<Doc<\"Account\"> | null>,\n      err: () => new AuthError(\"INTERNAL_ERROR\", \"Failed to look up account\"),\n    }).pipe(\n      Fx.chain((existingAccount) => {\n        if (existingAccount !== null) {\n          const verifyExistingAccountFx =\n            account.secret !== undefined\n              ? Provider.verify(\n                  provider,\n                  account.secret,\n                  existingAccount.secret ?? \"\",\n                ).pipe(\n                  Fx.chain((valid) =>\n                    valid\n                      ? Fx.succeed(undefined)\n                      : Fx.fail(\n                          new AuthError(\n                            \"ACCOUNT_ALREADY_EXISTS\",\n                            `Account ${account.id} already exists`,\n                          ),\n                        ),\n                  ),\n                )\n              : Fx.succeed(undefined);\n\n          return verifyExistingAccountFx.pipe(\n            Fx.chain(() =>\n              Fx.from({\n                ok: () =>\n                  db.users.getById(\n                    existingAccount.userId,\n                  ) as Promise<Doc<\"User\"> | null>,\n                err: () =>\n                  new AuthError(\n                    \"ACCOUNT_NOT_FOUND\",\n                    `Linked user for account ${account.id} was not found.`,\n                  ),\n              }).pipe(\n                Fx.chain((doc) =>\n                  doc === null\n                    ? Fx.fail(\n                        new AuthError(\n                          \"ACCOUNT_NOT_FOUND\",\n                          `Linked user for account ${account.id} was not found.`,\n                        ),\n                      )\n                    : Fx.succeed(doc),\n                ),\n              ),\n            ),\n            Fx.map((user) => ({\n              account: existingAccount,\n              user,\n            })),\n          );\n        }\n\n        const secretFx: Fx<string | undefined, AuthError> =\n          account.secret !== undefined\n            ? Provider.hash(provider, account.secret)\n            : Fx.succeed<string | undefined>(undefined);\n\n        return secretFx.pipe(\n          Fx.chain((secret) =>\n            Fx.from({\n              ok: async () =>\n                upsertUserAndAccount(\n                  ctx,\n                  await getAuthSessionId(ctx),\n                  { providerAccountId: account.id, secret },\n                  {\n                    type: \"credentials\",\n                    provider,\n                    profile,\n                    shouldLinkViaEmail,\n                    shouldLinkViaPhone,\n                  },\n                  config,\n                ),\n              err: () => new AuthError(\"INTERNAL_ERROR\"),\n            }),\n          ),\n          Fx.chain((result) => {\n            const { userId, accountId } = result as {\n              userId: string;\n              accountId: string;\n            };\n            return Fx.zip(\n              Fx.from({\n                ok: () =>\n                  db.accounts.getById(\n                    accountId,\n                  ) as Promise<Doc<\"Account\"> | null>,\n                err: () => new AuthError(\"INTERNAL_ERROR\"),\n              }),\n              Fx.from({\n                ok: () =>\n                  db.users.getById(userId) as Promise<Doc<\"User\"> | null>,\n                err: () => new AuthError(\"INTERNAL_ERROR\"),\n              }),\n            );\n          }),\n          Fx.chain((pair) => {\n            const [createdAccount, createdUser] = pair as [\n              Doc<\"Account\"> | null,\n              Doc<\"User\"> | null,\n            ];\n            return createdAccount === null\n              ? Fx.fail(\n                  new AuthError(\n                    \"ACCOUNT_NOT_FOUND\",\n                    `Created account was not found.`,\n                  ),\n                )\n              : createdUser === null\n                ? Fx.fail(\n                    new AuthError(\n                      \"USER_UPDATE_FAILED\",\n                      `Created user was not found.`,\n                    ),\n                  )\n                : Fx.succeed({\n                    account: createdAccount,\n                    user: createdUser,\n                  });\n          }),\n        );\n      }),\n      Fx.recover((e) => Fx.fatal((e as AuthError).toConvexError())),\n    ),\n  ) as Promise<ReturnType>;\n}\n\nexport const callCreateAccountFromCredentials = async <\n  DataModel extends GenericDataModel,\n>(\n  ctx: GenericActionCtx<DataModel>,\n  args: Infer<typeof createAccountFromCredentialsArgs>,\n): Promise<ReturnType> => {\n  return ctx.runMutation(AUTH_STORE_REF, {\n    args: {\n      type: \"createAccountFromCredentials\",\n      ...args,\n    },\n  });\n};\n"],"mappings":";;;;;;;;;;;AAcA,MAAa,mCAAmC,EAAE,OAAO;CACvD,UAAU,EAAE,QAAQ;CACpB,SAAS,EAAE,OAAO;EAAE,IAAI,EAAE,QAAQ;EAAE,QAAQ,EAAE,SAAS,EAAE,QAAQ,CAAC;EAAE,CAAC;CACrE,SAAS,EAAE,KAAK;CAChB,oBAAoB,EAAE,SAAS,EAAE,SAAS,CAAC;CAC3C,oBAAoB,EAAE,SAAS,EAAE,SAAS,CAAC;CAC5C,CAAC;AAIF,eAAsB,iCACpB,KACA,MACA,oBACA,QACqB;AACrB,cAAa,WAAW,OAAO,0CAA0C;EACvE,UAAU,KAAK;EACf,SAAS;GACP,IAAI,KAAK,QAAQ;GACjB,QAAQ,YAAY,KAAK,QAAQ,UAAU,GAAG;GAC/C;EACF,CAAC;CAEF,MAAM,EACJ,UAAU,YACV,SACA,SACA,oBACA,uBACE;CACJ,MAAM,KAAK,OAAO,KAAK,OAAO;CAC9B,MAAM,WAAW,mBAAmB,WAAW;AAE/C,QAAO,GAAG,IACR,GAAG,KAAK;EACN,UACE,GAAG,SAAS,IACV,SAAS,IACT,QAAQ,GACT;EACH,WAAW,IAAI,UAAU,kBAAkB,4BAA4B;EACxE,CAAC,CAAC,KACD,GAAG,OAAO,oBAAoB;AAC5B,MAAI,oBAAoB,KAqBtB,SAnBE,QAAQ,WAAW,SACfA,OACE,UACA,QAAQ,QACR,gBAAgB,UAAU,GAC3B,CAAC,KACA,GAAG,OAAO,UACR,QACI,GAAG,QAAQ,OAAU,GACrB,GAAG,KACD,IAAI,UACF,0BACA,WAAW,QAAQ,GAAG,iBACvB,CACF,CACN,CACF,GACD,GAAG,QAAQ,OAAU,EAEI,KAC7B,GAAG,YACD,GAAG,KAAK;GACN,UACE,GAAG,MAAM,QACP,gBAAgB,OACjB;GACH,WACE,IAAI,UACF,qBACA,2BAA2B,QAAQ,GAAG,iBACvC;GACJ,CAAC,CAAC,KACD,GAAG,OAAO,QACR,QAAQ,OACJ,GAAG,KACD,IAAI,UACF,qBACA,2BAA2B,QAAQ,GAAG,iBACvC,CACF,GACD,GAAG,QAAQ,IAAI,CACpB,CACF,CACF,EACD,GAAG,KAAK,UAAU;GAChB,SAAS;GACT;GACD,EAAE,CACJ;AAQH,UAJE,QAAQ,WAAW,SACfC,KAAc,UAAU,QAAQ,OAAO,GACvC,GAAG,QAA4B,OAAU,EAE/B,KACd,GAAG,OAAO,WACR,GAAG,KAAK;GACN,IAAI,YACF,qBACE,KACA,MAAM,iBAAiB,IAAI,EAC3B;IAAE,mBAAmB,QAAQ;IAAI;IAAQ,EACzC;IACE,MAAM;IACN;IACA;IACA;IACA;IACD,EACD,OACD;GACH,WAAW,IAAI,UAAU,iBAAiB;GAC3C,CAAC,CACH,EACD,GAAG,OAAO,WAAW;GACnB,MAAM,EAAE,QAAQ,cAAc;AAI9B,UAAO,GAAG,IACR,GAAG,KAAK;IACN,UACE,GAAG,SAAS,QACV,UACD;IACH,WAAW,IAAI,UAAU,iBAAiB;IAC3C,CAAC,EACF,GAAG,KAAK;IACN,UACE,GAAG,MAAM,QAAQ,OAAO;IAC1B,WAAW,IAAI,UAAU,iBAAiB;IAC3C,CAAC,CACH;IACD,EACF,GAAG,OAAO,SAAS;GACjB,MAAM,CAAC,gBAAgB,eAAe;AAItC,UAAO,mBAAmB,OACtB,GAAG,KACD,IAAI,UACF,qBACA,iCACD,CACF,GACD,gBAAgB,OACd,GAAG,KACD,IAAI,UACF,sBACA,8BACD,CACF,GACD,GAAG,QAAQ;IACT,SAAS;IACT,MAAM;IACP,CAAC;IACR,CACH;GACD,EACF,GAAG,SAAS,MAAM,GAAG,MAAO,EAAgB,eAAe,CAAC,CAAC,CAC9D,CACF;;AAGH,MAAa,mCAAmC,OAG9C,KACA,SACwB;AACxB,QAAO,IAAI,YAAY,gBAAgB,EACrC,MAAM;EACJ,MAAM;EACN,GAAG;EACJ,EACF,CAAC"}
+{"version":3,"file":"register.js","names":["Provider.verify","Provider.hash"],"sources":["../../../src/server/mutations/register.ts"],"sourcesContent":["import { Fx } from \"@robelest/fx\";\nimport type { GenericActionCtx, GenericDataModel } from \"convex/server\";\nimport { Infer, v } from \"convex/values\";\n\nimport { authDb } from \"../db\";\nimport { AuthError } from \"../authError\";\nimport * as Provider from \"../crypto\";\nimport { getAuthSessionId } from \"../sessions\";\nimport { Doc, MutationCtx } from \"../types\";\nimport { ConvexCredentialsConfig } from \"../types\";\nimport { upsertUserAndAccount } from \"../users\";\nimport { LOG_LEVELS, logWithLevel, maybeRedact } from \"../utils\";\nimport { AUTH_STORE_REF } from \"./store/refs\";\n\nexport const createAccountFromCredentialsArgs = v.object({\n  provider: v.string(),\n  account: v.object({ id: v.string(), secret: v.optional(v.string()) }),\n  profile: v.any(),\n  shouldLinkViaEmail: v.optional(v.boolean()),\n  shouldLinkViaPhone: v.optional(v.boolean()),\n});\n\ntype ReturnType = { account: Doc<\"Account\">; user: Doc<\"User\"> };\n\nexport async function createAccountFromCredentialsImpl(\n  ctx: MutationCtx,\n  args: Infer<typeof createAccountFromCredentialsArgs>,\n  getProviderOrThrow: Provider.GetProviderOrThrowFunc,\n  config: Provider.Config,\n): Promise<ReturnType> {\n  logWithLevel(LOG_LEVELS.DEBUG, \"createAccountFromCredentialsImpl args:\", {\n    provider: args.provider,\n    account: {\n      id: args.account.id,\n      secret: maybeRedact(args.account.secret ?? \"\"),\n    },\n  });\n\n  const {\n    provider: providerId,\n    account,\n    profile,\n    shouldLinkViaEmail,\n    shouldLinkViaPhone,\n  } = args;\n  const db = authDb(ctx, config);\n  const provider = getProviderOrThrow(providerId) as ConvexCredentialsConfig;\n\n  return Fx.run(\n    Fx.from({\n      ok: () =>\n        db.accounts.get(\n          provider.id,\n          account.id,\n        ) as Promise<Doc<\"Account\"> | null>,\n      err: () => new AuthError(\"INTERNAL_ERROR\", \"Failed to look up account\"),\n    }).pipe(\n      Fx.chain((existingAccount) => {\n        if (existingAccount !== null) {\n          const verifyExistingAccountFx =\n            account.secret !== undefined\n              ? Provider.verify(\n                  provider,\n                  account.secret,\n                  existingAccount.secret ?? \"\",\n                ).pipe(\n                  Fx.chain((valid) =>\n                    valid\n                      ? Fx.succeed(undefined)\n                      : Fx.fail(\n                          new AuthError(\n                            \"ACCOUNT_ALREADY_EXISTS\",\n                            `Account ${account.id} already exists`,\n                          ),\n                        ),\n                  ),\n                )\n              : Fx.succeed(undefined);\n\n          return verifyExistingAccountFx.pipe(\n            Fx.chain(() =>\n              Fx.from({\n                ok: () =>\n                  db.users.getById(\n                    existingAccount.userId,\n                  ) as Promise<Doc<\"User\"> | null>,\n                err: () =>\n                  new AuthError(\n                    \"ACCOUNT_NOT_FOUND\",\n                    `Linked user for account ${account.id} was not found.`,\n                  ),\n              }).pipe(\n                Fx.chain((doc) =>\n                  doc === null\n                    ? Fx.fail(\n                        new AuthError(\n                          \"ACCOUNT_NOT_FOUND\",\n                          `Linked user for account ${account.id} was not found.`,\n                        ),\n                      )\n                    : Fx.succeed(doc),\n                ),\n              ),\n            ),\n            Fx.map((user) => ({\n              account: existingAccount,\n              user,\n            })),\n          );\n        }\n\n        const secretFx: Fx<string | undefined, AuthError> =\n          account.secret !== undefined\n            ? Provider.hash(provider, account.secret)\n            : Fx.succeed<string | undefined>(undefined);\n\n        return secretFx.pipe(\n          Fx.chain((secret) =>\n            Fx.from({\n              ok: async () =>\n                upsertUserAndAccount(\n                  ctx,\n                  await getAuthSessionId(ctx),\n                  { providerAccountId: account.id, secret },\n                  {\n                    type: \"credentials\",\n                    provider,\n                    profile,\n                    shouldLinkViaEmail,\n                    shouldLinkViaPhone,\n                  },\n                  config,\n                ),\n              err: () => new AuthError(\"INTERNAL_ERROR\"),\n            }),\n          ),\n          Fx.chain((result) => {\n            const { userId, accountId } = result as {\n              userId: string;\n              accountId: string;\n            };\n            return Fx.zip(\n              Fx.from({\n                ok: () =>\n                  db.accounts.getById(\n                    accountId,\n                  ) as Promise<Doc<\"Account\"> | null>,\n                err: () => new AuthError(\"INTERNAL_ERROR\"),\n              }),\n              Fx.from({\n                ok: () =>\n                  db.users.getById(userId) as Promise<Doc<\"User\"> | null>,\n                err: () => new AuthError(\"INTERNAL_ERROR\"),\n              }),\n            );\n          }),\n          Fx.chain((pair) => {\n            const [createdAccount, createdUser] = pair as [\n              Doc<\"Account\"> | null,\n              Doc<\"User\"> | null,\n            ];\n            return createdAccount === null\n              ? Fx.fail(\n                  new AuthError(\n                    \"ACCOUNT_NOT_FOUND\",\n                    `Created account was not found.`,\n                  ),\n                )\n              : createdUser === null\n                ? Fx.fail(\n                    new AuthError(\n                      \"USER_UPDATE_FAILED\",\n                      `Created user was not found.`,\n                    ),\n                  )\n                : Fx.succeed({\n                    account: createdAccount,\n                    user: createdUser,\n                  });\n          }),\n        );\n      }),\n      Fx.recover((e) => Fx.fatal((e as AuthError).toConvexError())),\n    ),\n  ) as Promise<ReturnType>;\n}\n\nexport const callCreateAccountFromCredentials = async <\n  DataModel extends GenericDataModel,\n>(\n  ctx: GenericActionCtx<DataModel>,\n  args: Infer<typeof createAccountFromCredentialsArgs>,\n): Promise<ReturnType> => {\n  return ctx.runMutation(AUTH_STORE_REF, {\n    args: {\n      type: \"createAccountFromCredentials\",\n      ...args,\n    },\n  });\n};\n"],"mappings":";;;;;;;;;;;AAcA,MAAa,mCAAmC,EAAE,OAAO;CACvD,UAAU,EAAE,QAAQ;CACpB,SAAS,EAAE,OAAO;EAAE,IAAI,EAAE,QAAQ;EAAE,QAAQ,EAAE,SAAS,EAAE,QAAQ,CAAC;EAAE,CAAC;CACrE,SAAS,EAAE,KAAK;CAChB,oBAAoB,EAAE,SAAS,EAAE,SAAS,CAAC;CAC3C,oBAAoB,EAAE,SAAS,EAAE,SAAS,CAAC;CAC5C,CAAC;AAIF,eAAsB,iCACpB,KACA,MACA,oBACA,QACqB;AACrB,cAAa,WAAW,OAAO,0CAA0C;EACvE,UAAU,KAAK;EACf,SAAS;GACP,IAAI,KAAK,QAAQ;GACjB,QAAQ,YAAY,KAAK,QAAQ,UAAU,GAAG;GAC/C;EACF,CAAC;CAEF,MAAM,EACJ,UAAU,YACV,SACA,SACA,oBACA,uBACE;CACJ,MAAM,KAAK,OAAO,KAAK,OAAO;CAC9B,MAAM,WAAW,mBAAmB,WAAW;AAE/C,QAAO,GAAG,IACR,GAAG,KAAK;EACN,UACE,GAAG,SAAS,IACV,SAAS,IACT,QAAQ,GACT;EACH,WAAW,IAAI,UAAU,kBAAkB,4BAA4B;EACxE,CAAC,CAAC,KACD,GAAG,OAAO,oBAAoB;AAC5B,MAAI,oBAAoB,KAqBtB,SAnBE,QAAQ,WAAW,SACfA,OACE,UACA,QAAQ,QACR,gBAAgB,UAAU,GAC3B,CAAC,KACA,GAAG,OAAO,UACR,QACI,GAAG,QAAQ,OAAU,GACrB,GAAG,KACD,IAAI,UACF,0BACA,WAAW,QAAQ,GAAG,iBACvB,CACF,CACN,CACF,GACD,GAAG,QAAQ,OAAU,EAEI,KAC7B,GAAG,YACD,GAAG,KAAK;GACN,UACE,GAAG,MAAM,QACP,gBAAgB,OACjB;GACH,WACE,IAAI,UACF,qBACA,2BAA2B,QAAQ,GAAG,iBACvC;GACJ,CAAC,CAAC,KACD,GAAG,OAAO,QACR,QAAQ,OACJ,GAAG,KACD,IAAI,UACF,qBACA,2BAA2B,QAAQ,GAAG,iBACvC,CACF,GACD,GAAG,QAAQ,IAAI,CACpB,CACF,CACF,EACD,GAAG,KAAK,UAAU;GAChB,SAAS;GACT;GACD,EAAE,CACJ;AAQH,UAJE,QAAQ,WAAW,SACfC,KAAc,UAAU,QAAQ,OAAO,GACvC,GAAG,QAA4B,OAAU,EAE/B,KACd,GAAG,OAAO,WACR,GAAG,KAAK;GACN,IAAI,YACF,qBACE,KACA,MAAM,iBAAiB,IAAI,EAC3B;IAAE,mBAAmB,QAAQ;IAAI;IAAQ,EACzC;IACE,MAAM;IACN;IACA;IACA;IACA;IACD,EACD,OACD;GACH,WAAW,IAAI,UAAU,iBAAiB;GAC3C,CAAC,CACH,EACD,GAAG,OAAO,WAAW;GACnB,MAAM,EAAE,QAAQ,cAAc;AAI9B,UAAO,GAAG,IACR,GAAG,KAAK;IACN,UACE,GAAG,SAAS,QACV,UACD;IACH,WAAW,IAAI,UAAU,iBAAiB;IAC3C,CAAC,EACF,GAAG,KAAK;IACN,UACE,GAAG,MAAM,QAAQ,OAAO;IAC1B,WAAW,IAAI,UAAU,iBAAiB;IAC3C,CAAC,CACH;IACD,EACF,GAAG,OAAO,SAAS;GACjB,MAAM,CAAC,gBAAgB,eAAe;AAItC,UAAO,mBAAmB,OACtB,GAAG,KACD,IAAI,UACF,qBACA,iCACD,CACF,GACD,gBAAgB,OACd,GAAG,KACD,IAAI,UACF,sBACA,8BACD,CACF,GACD,GAAG,QAAQ;IACT,SAAS;IACT,MAAM;IACP,CAAC;IACR,CACH;GACD,EACF,GAAG,SAAS,MAAM,GAAG,MAAO,EAAgB,eAAe,CAAC,CAAC,CAC9D,CACF;;AAGH,MAAa,mCAAmC,OAG9C,KACA,SACwB;AACxB,QAAO,IAAI,YAAY,gBAAgB,EACrC,MAAM;EACJ,MAAM;EACN,GAAG;EACJ,EACF,CAAC"}

package/dist/server/mutations/retrieve.d.ts

@@ -1,25 +1,25 @@
 import { Doc, MutationCtx } from "../types.js";
-import { Config, GetProviderOrThrowFunc } from "../provider.js";
+import { Config, GetProviderOrThrowFunc } from "../crypto.js";
 import { Fx } from "@robelest/fx";
 import { GenericActionCtx, GenericDataModel } from "convex/server";
-import * as convex_values26 from "convex/values";
+import * as convex_values20 from "convex/values";
 import { Infer } from "convex/values";
 
 //#region src/server/mutations/retrieve.d.ts
-declare const retrieveAccountWithCredentialsArgs: convex_values26.VObject<{
+declare const retrieveAccountWithCredentialsArgs: convex_values20.VObject<{
   provider: string;
   account: {
     secret?: string | undefined;
     id: string;
   };
 }, {
-  provider: convex_values26.VString<string, "required">;
-  account: convex_values26.VObject<{
+  provider: convex_values20.VString<string, "required">;
+  account: convex_values20.VObject<{
     secret?: string | undefined;
     id: string;
   }, {
-    id: convex_values26.VString<string, "required">;
-    secret: convex_values26.VString<string | undefined, "optional">;
+    id: convex_values20.VString<string, "required">;
+    secret: convex_values20.VString<string | undefined, "optional">;
   }, "required", "id" | "secret">;
 }, "required", "provider" | "account" | "account.id" | "account.secret">;
 type ReturnType = "InvalidAccountId" | "TooManyFailedAttempts" | "InvalidSecret" | {
@@ -28,8 +28,6 @@ type ReturnType = "InvalidAccountId" | "TooManyFailedAttempts" | "InvalidSecret"
 };
 declare function retrieveAccountWithCredentialsImpl(ctx: MutationCtx, args: Infer<typeof retrieveAccountWithCredentialsArgs>, getProviderOrThrow: GetProviderOrThrowFunc, config: Config): Fx<ReturnType>;
 declare const callRetrieveAccountWithCredentials: <DataModel extends GenericDataModel>(ctx: GenericActionCtx<DataModel>, args: Infer<typeof retrieveAccountWithCredentialsArgs>) => Promise<ReturnType>;
-/** @deprecated Typo kept for backward compatibility. */
-declare const callRetreiveAccountWithCredentials: <DataModel extends GenericDataModel>(ctx: GenericActionCtx<DataModel>, args: Infer<typeof retrieveAccountWithCredentialsArgs>) => Promise<ReturnType>;
 //#endregion
-export { callRetreiveAccountWithCredentials, callRetrieveAccountWithCredentials, retrieveAccountWithCredentialsArgs, retrieveAccountWithCredentialsImpl };
+export { callRetrieveAccountWithCredentials, retrieveAccountWithCredentialsArgs, retrieveAccountWithCredentialsImpl };
 //# sourceMappingURL=retrieve.d.ts.map

package/dist/server/mutations/retrieve.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"retrieve.d.ts","names":[],"sources":["../../../src/server/mutations/retrieve.ts"],"mappings":";;;;;;;;cAgBa,kCAAA,kBAAkC,OAAA;;;;;;;YAG7C,eAAA,CAAA,OAAA;;;;;;;;;KAEG,UAAA;EAIC,OAAA,EAAS,GAAA;EAAgB,IAAA,EAAM,GAAA;AAAA;AAAA,iBAErB,kCAAA,CACd,GAAA,EAAK,WAAA,EACL,IAAA,EAAM,KAAA,QAAa,kCAAA,GACnB,kBAAA,EAAoB,sBAAA,EACpB,MAAA,EAAQ,MAAA,GACP,EAAA,CAAG,UAAA;AAAA,cAgEO,kCAAA,qBACO,gBAAA,EAElB,GAAA,EAAK,gBAAA,CAAiB,SAAA,GACtB,IAAA,EAAM,KAAA,QAAa,kCAAA,MAClB,OAAA,CAAQ,UAAA;;cAUE,kCAAA,qBAdO,gBAAA,EAAgB,GAAA,EAE7B,gBAAA,CAAiB,SAAA,GAAU,IAAA,EAC1B,KAAA,QAAa,kCAAA,MAClB,OAAA,CAAQ,UAAA"}
+{"version":3,"file":"retrieve.d.ts","names":[],"sources":["../../../src/server/mutations/retrieve.ts"],"mappings":";;;;;;;;cAgBa,kCAAA,kBAAkC,OAAA;;;;;;;YAG7C,eAAA,CAAA,OAAA;;;;;;;;;KAEG,UAAA;EAIC,OAAA,EAAS,GAAA;EAAgB,IAAA,EAAM,GAAA;AAAA;AAAA,iBAErB,kCAAA,CACd,GAAA,EAAK,WAAA,EACL,IAAA,EAAM,KAAA,QAAa,kCAAA,GACnB,kBAAA,EAAoB,sBAAA,EACpB,MAAA,EAAQ,MAAA,GACP,EAAA,CAAG,UAAA;AAAA,cAgEO,kCAAA,qBACO,gBAAA,EAElB,GAAA,EAAK,gBAAA,CAAiB,SAAA,GACtB,IAAA,EAAM,KAAA,QAAa,kCAAA,MAClB,OAAA,CAAQ,UAAA"}

package/dist/server/mutations/retrieve.js

@@ -1,9 +1,9 @@
-import { AuthError } from "../fx.js";
+import { AuthError } from "../authError.js";
 import { LOG_LEVELS, logWithLevel, maybeRedact } from "../utils.js";
 import { authDb } from "../db.js";
-import { verify } from "../provider.js";
-import { AUTH_STORE_REF } from "./store.js";
-import { isSignInRateLimited, recordFailedSignIn, resetSignInRateLimit } from "../ratelimit.js";
+import { verify } from "../crypto.js";
+import { AUTH_STORE_REF } from "./store/refs.js";
+import { isSignInRateLimited, recordFailedSignIn, resetSignInRateLimit } from "../limits.js";
 import { Fx } from "@robelest/fx";
 import { v } from "convex/values";
 
@@ -59,9 +59,7 @@ const callRetrieveAccountWithCredentials = async (ctx, args) => {
 		...args
 	} });
 };
-/** @deprecated Typo kept for backward compatibility. */
-const callRetreiveAccountWithCredentials = callRetrieveAccountWithCredentials;
 
 //#endregion
-export { callRetreiveAccountWithCredentials, callRetrieveAccountWithCredentials, retrieveAccountWithCredentialsArgs, retrieveAccountWithCredentialsImpl };
+export { callRetrieveAccountWithCredentials, retrieveAccountWithCredentialsArgs, retrieveAccountWithCredentialsImpl };
 //# sourceMappingURL=retrieve.js.map

package/dist/server/mutations/retrieve.js.map

@@ -1 +1 @@
-{"version":3,"file":"retrieve.js","names":["Provider.verify","v"],"sources":["../../../src/server/mutations/retrieve.ts"],"sourcesContent":["import { Fx } from \"@robelest/fx\";\nimport type { GenericActionCtx, GenericDataModel } from \"convex/server\";\nimport { Infer, v } from \"convex/values\";\n\nimport { authDb } from \"../db\";\nimport { AuthError } from \"../fx\";\nimport * as Provider from \"../provider\";\nimport {\n  isSignInRateLimited,\n  recordFailedSignIn,\n  resetSignInRateLimit,\n} from \"../ratelimit\";\nimport { Doc, MutationCtx } from \"../types\";\nimport { LOG_LEVELS, logWithLevel, maybeRedact } from \"../utils\";\nimport { AUTH_STORE_REF } from \"./store\";\n\nexport const retrieveAccountWithCredentialsArgs = v.object({\n  provider: v.string(),\n  account: v.object({ id: v.string(), secret: v.optional(v.string()) }),\n});\n\ntype ReturnType =\n  | \"InvalidAccountId\"\n  | \"TooManyFailedAttempts\"\n  | \"InvalidSecret\"\n  | { account: Doc<\"Account\">; user: Doc<\"User\"> };\n\nexport function retrieveAccountWithCredentialsImpl(\n  ctx: MutationCtx,\n  args: Infer<typeof retrieveAccountWithCredentialsArgs>,\n  getProviderOrThrow: Provider.GetProviderOrThrowFunc,\n  config: Provider.Config,\n): Fx<ReturnType> {\n  const { provider: providerId, account } = args;\n  const db = authDb(ctx, config);\n\n  logWithLevel(LOG_LEVELS.DEBUG, \"retrieveAccountWithCredentialsImpl args:\", {\n    provider: providerId,\n    account: { id: account.id, secret: maybeRedact(account.secret ?? \"\") },\n  });\n\n  return Fx.from({\n    ok: async () => {\n      const existingAccount = (await db.accounts.get(\n        providerId,\n        account.id,\n      )) as Doc<\"Account\"> | null;\n      if (existingAccount === null) {\n        return \"InvalidAccountId\" as const;\n      }\n\n      if (account.secret !== undefined) {\n        const limited = await Fx.run(\n          isSignInRateLimited(ctx, existingAccount._id, config),\n        );\n        if (limited) {\n          return \"TooManyFailedAttempts\" as const;\n        }\n\n        const valid = await Fx.run(\n          Provider.verify(\n            getProviderOrThrow(providerId),\n            account.secret,\n            existingAccount.secret ?? \"\",\n          ),\n        );\n        if (!valid) {\n          await Fx.run(recordFailedSignIn(ctx, existingAccount._id, config));\n          return \"InvalidSecret\" as const;\n        }\n\n        await Fx.run(resetSignInRateLimit(ctx, existingAccount._id, config));\n      }\n\n      const user = (await db.users.getById(\n        existingAccount.userId,\n      )) as Doc<\"User\"> | null;\n      if (user === null) {\n        logWithLevel(\n          LOG_LEVELS.ERROR,\n          `Account ${existingAccount._id} is linked to missing user ${existingAccount.userId}`,\n        );\n        return \"InvalidAccountId\" as const;\n      }\n\n      return { account: existingAccount, user } as const;\n    },\n    err: () => new AuthError(\"INTERNAL_ERROR\", \"Failed to look up account\"),\n  }).pipe(\n    Fx.fold({\n      ok: (v) => v as ReturnType,\n      err: () => \"InvalidAccountId\" as ReturnType,\n    }),\n  );\n}\n\nexport const callRetrieveAccountWithCredentials = async <\n  DataModel extends GenericDataModel,\n>(\n  ctx: GenericActionCtx<DataModel>,\n  args: Infer<typeof retrieveAccountWithCredentialsArgs>,\n): Promise<ReturnType> => {\n  return ctx.runMutation(AUTH_STORE_REF, {\n    args: {\n      type: \"retrieveAccountWithCredentials\",\n      ...args,\n    },\n  });\n};\n\n/** @deprecated Typo kept for backward compatibility. */\nexport const callRetreiveAccountWithCredentials =\n  callRetrieveAccountWithCredentials;\n"],"mappings":";;;;;;;;;;AAgBA,MAAa,qCAAqC,EAAE,OAAO;CACzD,UAAU,EAAE,QAAQ;CACpB,SAAS,EAAE,OAAO;EAAE,IAAI,EAAE,QAAQ;EAAE,QAAQ,EAAE,SAAS,EAAE,QAAQ,CAAC;EAAE,CAAC;CACtE,CAAC;AAQF,SAAgB,mCACd,KACA,MACA,oBACA,QACgB;CAChB,MAAM,EAAE,UAAU,YAAY,YAAY;CAC1C,MAAM,KAAK,OAAO,KAAK,OAAO;AAE9B,cAAa,WAAW,OAAO,4CAA4C;EACzE,UAAU;EACV,SAAS;GAAE,IAAI,QAAQ;GAAI,QAAQ,YAAY,QAAQ,UAAU,GAAG;GAAE;EACvE,CAAC;AAEF,QAAO,GAAG,KAAK;EACb,IAAI,YAAY;GACd,MAAM,kBAAmB,MAAM,GAAG,SAAS,IACzC,YACA,QAAQ,GACT;AACD,OAAI,oBAAoB,KACtB,QAAO;AAGT,OAAI,QAAQ,WAAW,QAAW;AAIhC,QAHgB,MAAM,GAAG,IACvB,oBAAoB,KAAK,gBAAgB,KAAK,OAAO,CACtD,CAEC,QAAO;AAUT,QAAI,CAPU,MAAM,GAAG,IACrBA,OACE,mBAAmB,WAAW,EAC9B,QAAQ,QACR,gBAAgB,UAAU,GAC3B,CACF,EACW;AACV,WAAM,GAAG,IAAI,mBAAmB,KAAK,gBAAgB,KAAK,OAAO,CAAC;AAClE,YAAO;;AAGT,UAAM,GAAG,IAAI,qBAAqB,KAAK,gBAAgB,KAAK,OAAO,CAAC;;GAGtE,MAAM,OAAQ,MAAM,GAAG,MAAM,QAC3B,gBAAgB,OACjB;AACD,OAAI,SAAS,MAAM;AACjB,iBACE,WAAW,OACX,WAAW,gBAAgB,IAAI,6BAA6B,gBAAgB,SAC7E;AACD,WAAO;;AAGT,UAAO;IAAE,SAAS;IAAiB;IAAM;;EAE3C,WAAW,IAAI,UAAU,kBAAkB,4BAA4B;EACxE,CAAC,CAAC,KACD,GAAG,KAAK;EACN,KAAK,QAAMC;EACX,WAAW;EACZ,CAAC,CACH;;AAGH,MAAa,qCAAqC,OAGhD,KACA,SACwB;AACxB,QAAO,IAAI,YAAY,gBAAgB,EACrC,MAAM;EACJ,MAAM;EACN,GAAG;EACJ,EACF,CAAC;;;AAIJ,MAAa,qCACX"}
+{"version":3,"file":"retrieve.js","names":["Provider.verify","v"],"sources":["../../../src/server/mutations/retrieve.ts"],"sourcesContent":["import { Fx } from \"@robelest/fx\";\nimport type { GenericActionCtx, GenericDataModel } from \"convex/server\";\nimport { Infer, v } from \"convex/values\";\n\nimport { authDb } from \"../db\";\nimport { AuthError } from \"../authError\";\nimport * as Provider from \"../crypto\";\nimport {\n  isSignInRateLimited,\n  recordFailedSignIn,\n  resetSignInRateLimit,\n} from \"../limits\";\nimport { Doc, MutationCtx } from \"../types\";\nimport { LOG_LEVELS, logWithLevel, maybeRedact } from \"../utils\";\nimport { AUTH_STORE_REF } from \"./store/refs\";\n\nexport const retrieveAccountWithCredentialsArgs = v.object({\n  provider: v.string(),\n  account: v.object({ id: v.string(), secret: v.optional(v.string()) }),\n});\n\ntype ReturnType =\n  | \"InvalidAccountId\"\n  | \"TooManyFailedAttempts\"\n  | \"InvalidSecret\"\n  | { account: Doc<\"Account\">; user: Doc<\"User\"> };\n\nexport function retrieveAccountWithCredentialsImpl(\n  ctx: MutationCtx,\n  args: Infer<typeof retrieveAccountWithCredentialsArgs>,\n  getProviderOrThrow: Provider.GetProviderOrThrowFunc,\n  config: Provider.Config,\n): Fx<ReturnType> {\n  const { provider: providerId, account } = args;\n  const db = authDb(ctx, config);\n\n  logWithLevel(LOG_LEVELS.DEBUG, \"retrieveAccountWithCredentialsImpl args:\", {\n    provider: providerId,\n    account: { id: account.id, secret: maybeRedact(account.secret ?? \"\") },\n  });\n\n  return Fx.from({\n    ok: async () => {\n      const existingAccount = (await db.accounts.get(\n        providerId,\n        account.id,\n      )) as Doc<\"Account\"> | null;\n      if (existingAccount === null) {\n        return \"InvalidAccountId\" as const;\n      }\n\n      if (account.secret !== undefined) {\n        const limited = await Fx.run(\n          isSignInRateLimited(ctx, existingAccount._id, config),\n        );\n        if (limited) {\n          return \"TooManyFailedAttempts\" as const;\n        }\n\n        const valid = await Fx.run(\n          Provider.verify(\n            getProviderOrThrow(providerId),\n            account.secret,\n            existingAccount.secret ?? \"\",\n          ),\n        );\n        if (!valid) {\n          await Fx.run(recordFailedSignIn(ctx, existingAccount._id, config));\n          return \"InvalidSecret\" as const;\n        }\n\n        await Fx.run(resetSignInRateLimit(ctx, existingAccount._id, config));\n      }\n\n      const user = (await db.users.getById(\n        existingAccount.userId,\n      )) as Doc<\"User\"> | null;\n      if (user === null) {\n        logWithLevel(\n          LOG_LEVELS.ERROR,\n          `Account ${existingAccount._id} is linked to missing user ${existingAccount.userId}`,\n        );\n        return \"InvalidAccountId\" as const;\n      }\n\n      return { account: existingAccount, user } as const;\n    },\n    err: () => new AuthError(\"INTERNAL_ERROR\", \"Failed to look up account\"),\n  }).pipe(\n    Fx.fold({\n      ok: (v) => v as ReturnType,\n      err: () => \"InvalidAccountId\" as ReturnType,\n    }),\n  );\n}\n\nexport const callRetrieveAccountWithCredentials = async <\n  DataModel extends GenericDataModel,\n>(\n  ctx: GenericActionCtx<DataModel>,\n  args: Infer<typeof retrieveAccountWithCredentialsArgs>,\n): Promise<ReturnType> => {\n  return ctx.runMutation(AUTH_STORE_REF, {\n    args: {\n      type: \"retrieveAccountWithCredentials\",\n      ...args,\n    },\n  });\n};\n"],"mappings":";;;;;;;;;;AAgBA,MAAa,qCAAqC,EAAE,OAAO;CACzD,UAAU,EAAE,QAAQ;CACpB,SAAS,EAAE,OAAO;EAAE,IAAI,EAAE,QAAQ;EAAE,QAAQ,EAAE,SAAS,EAAE,QAAQ,CAAC;EAAE,CAAC;CACtE,CAAC;AAQF,SAAgB,mCACd,KACA,MACA,oBACA,QACgB;CAChB,MAAM,EAAE,UAAU,YAAY,YAAY;CAC1C,MAAM,KAAK,OAAO,KAAK,OAAO;AAE9B,cAAa,WAAW,OAAO,4CAA4C;EACzE,UAAU;EACV,SAAS;GAAE,IAAI,QAAQ;GAAI,QAAQ,YAAY,QAAQ,UAAU,GAAG;GAAE;EACvE,CAAC;AAEF,QAAO,GAAG,KAAK;EACb,IAAI,YAAY;GACd,MAAM,kBAAmB,MAAM,GAAG,SAAS,IACzC,YACA,QAAQ,GACT;AACD,OAAI,oBAAoB,KACtB,QAAO;AAGT,OAAI,QAAQ,WAAW,QAAW;AAIhC,QAHgB,MAAM,GAAG,IACvB,oBAAoB,KAAK,gBAAgB,KAAK,OAAO,CACtD,CAEC,QAAO;AAUT,QAAI,CAPU,MAAM,GAAG,IACrBA,OACE,mBAAmB,WAAW,EAC9B,QAAQ,QACR,gBAAgB,UAAU,GAC3B,CACF,EACW;AACV,WAAM,GAAG,IAAI,mBAAmB,KAAK,gBAAgB,KAAK,OAAO,CAAC;AAClE,YAAO;;AAGT,UAAM,GAAG,IAAI,qBAAqB,KAAK,gBAAgB,KAAK,OAAO,CAAC;;GAGtE,MAAM,OAAQ,MAAM,GAAG,MAAM,QAC3B,gBAAgB,OACjB;AACD,OAAI,SAAS,MAAM;AACjB,iBACE,WAAW,OACX,WAAW,gBAAgB,IAAI,6BAA6B,gBAAgB,SAC7E;AACD,WAAO;;AAGT,UAAO;IAAE,SAAS;IAAiB;IAAM;;EAE3C,WAAW,IAAI,UAAU,kBAAkB,4BAA4B;EACxE,CAAC,CAAC,KACD,GAAG,KAAK;EACN,KAAK,QAAMC;EACX,WAAW;EACZ,CAAC,CACH;;AAGH,MAAa,qCAAqC,OAGhD,KACA,SACwB;AACxB,QAAO,IAAI,YAAY,gBAAgB,EACrC,MAAM;EACJ,MAAM;EACN,GAAG;EACJ,EACF,CAAC"}