@robelest/convex-auth 0.0.4-preview.18 → 0.0.4-preview.19

package/dist/server/mutations/verify.d.ts

@@ -1,22 +1,22 @@
 import { MutationCtx, SessionInfo } from "../types.js";
-import { Config, GetProviderOrThrowFunc } from "../provider.js";
+import { Config, GetProviderOrThrowFunc } from "../crypto.js";
 import { GenericActionCtx, GenericDataModel } from "convex/server";
-import * as convex_values31 from "convex/values";
+import * as convex_values108 from "convex/values";
 import { Infer } from "convex/values";
 
 //#region src/server/mutations/verify.d.ts
-declare const verifyCodeAndSignInArgs: convex_values31.VObject<{
+declare const verifyCodeAndSignInArgs: convex_values108.VObject<{
   provider?: string | undefined;
   verifier?: string | undefined;
   params: any;
   generateTokens: boolean;
   allowExtraProviders: boolean;
 }, {
-  params: convex_values31.VAny<any, "required", string>;
-  provider: convex_values31.VString<string | undefined, "optional">;
-  verifier: convex_values31.VString<string | undefined, "optional">;
-  generateTokens: convex_values31.VBoolean<boolean, "required">;
-  allowExtraProviders: convex_values31.VBoolean<boolean, "required">;
+  params: convex_values108.VAny<any, "required", string>;
+  provider: convex_values108.VString<string | undefined, "optional">;
+  verifier: convex_values108.VString<string | undefined, "optional">;
+  generateTokens: convex_values108.VBoolean<boolean, "required">;
+  allowExtraProviders: convex_values108.VBoolean<boolean, "required">;
 }, "required", "provider" | "params" | "verifier" | "generateTokens" | "allowExtraProviders" | `params.${string}`>;
 type ReturnType = null | SessionInfo;
 declare function verifyCodeAndSignInImpl(ctx: MutationCtx, args: Infer<typeof verifyCodeAndSignInArgs>, getProviderOrThrow: GetProviderOrThrowFunc, config: Config): Promise<ReturnType>;

package/dist/server/mutations/verify.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"verify.d.ts","names":[],"sources":["../../../src/server/mutations/verify.ts"],"mappings":";;;;;;;cA0Ba,uBAAA,kBAAuB,OAAA;;;;;;;UAMlC,eAAA,CAAA,IAAA;;;;;;KAEG,UAAA,UAAoB,WAAA;AAAA,iBAgBH,uBAAA,CACpB,GAAA,EAAK,WAAA,EACL,IAAA,EAAM,KAAA,QAAa,uBAAA,GACnB,kBAAA,EAAoB,sBAAA,EACpB,MAAA,EAAQ,MAAA,GACP,OAAA,CAAQ,UAAA;AAAA,cAsIE,uBAAA,qBACO,gBAAA,EAElB,GAAA,EAAK,gBAAA,CAAiB,SAAA,GACtB,IAAA,EAAM,KAAA,QAAa,uBAAA,MAClB,OAAA,CAAQ,UAAA"}
+{"version":3,"file":"verify.d.ts","names":[],"sources":["../../../src/server/mutations/verify.ts"],"mappings":";;;;;;;cA0Ba,uBAAA,mBAAuB,OAAA;;;;;;;UAMlC,gBAAA,CAAA,IAAA;;;;;;KAEG,UAAA,UAAoB,WAAA;AAAA,iBAgBH,uBAAA,CACpB,GAAA,EAAK,WAAA,EACL,IAAA,EAAM,KAAA,QAAa,uBAAA,GACnB,kBAAA,EAAoB,sBAAA,EACpB,MAAA,EAAQ,MAAA,GACP,OAAA,CAAQ,UAAA;AAAA,cAsIE,uBAAA,qBACO,gBAAA,EAElB,GAAA,EAAK,gBAAA,CAAiB,SAAA,GACtB,IAAA,EAAM,KAAA,QAAa,uBAAA,MAClB,OAAA,CAAQ,UAAA"}

package/dist/server/mutations/verify.js

@@ -1,10 +1,11 @@
 import { LOG_LEVELS, logWithLevel, requireEnv, sha256 } from "../utils.js";
 import { authDb } from "../db.js";
-import { AUTH_STORE_REF } from "./store.js";
+import { AUTH_STORE_REF } from "./store/refs.js";
 import { createNewAndDeleteExistingSession, getAuthSessionId, maybeGenerateTokensForSession } from "../sessions.js";
 import { upsertUserAndAccount } from "../users.js";
-import { createSyntheticOAuthMaterializedConfig, isEnterpriseProviderId } from "../sso.js";
-import { isSignInRateLimited, recordFailedSignIn, resetSignInRateLimit } from "../ratelimit.js";
+import { isEnterpriseProviderId } from "../enterprise/shared.js";
+import { createSyntheticOAuthMaterializedConfig } from "../enterprise/oidc.js";
+import { isSignInRateLimited, recordFailedSignIn, resetSignInRateLimit } from "../limits.js";
 import { Fx } from "@robelest/fx";
 import { v } from "convex/values";
 

package/dist/server/mutations/verify.js.map

@@ -1 +1 @@
-{"version":3,"file":"verify.js","names":[],"sources":["../../../src/server/mutations/verify.ts"],"sourcesContent":["import { Fx } from \"@robelest/fx\";\nimport type { GenericActionCtx, GenericDataModel } from \"convex/server\";\nimport { Infer, v } from \"convex/values\";\n\nimport { authDb } from \"../db\";\nimport * as Provider from \"../provider\";\nimport {\n  isSignInRateLimited,\n  recordFailedSignIn,\n  resetSignInRateLimit,\n} from \"../ratelimit\";\nimport {\n  createNewAndDeleteExistingSession,\n  getAuthSessionId,\n  maybeGenerateTokensForSession,\n} from \"../sessions\";\nimport {\n  createSyntheticOAuthMaterializedConfig,\n  isEnterpriseProviderId,\n} from \"../sso\";\nimport { MutationCtx, SessionInfo } from \"../types\";\nimport { upsertUserAndAccount } from \"../users\";\nimport { LOG_LEVELS, logWithLevel, sha256 } from \"../utils\";\nimport { requireEnv } from \"../utils\";\nimport { AUTH_STORE_REF } from \"./store\";\n\nexport const verifyCodeAndSignInArgs = v.object({\n  params: v.any(),\n  provider: v.optional(v.string()),\n  verifier: v.optional(v.string()),\n  generateTokens: v.boolean(),\n  allowExtraProviders: v.boolean(),\n});\n\ntype ReturnType = null | SessionInfo;\n\n// ============================================================================\n// Small validators for the verification pipeline\n// ============================================================================\n\n/** A soft verification failure — logged and collapsed to null at the boundary. */\nclass VerifyFailure {\n  readonly _tag = \"VerifyFailure\" as const;\n  constructor(readonly reason: string) {}\n}\n\n// ============================================================================\n// Main exported function\n// ============================================================================\n\nexport async function verifyCodeAndSignInImpl(\n  ctx: MutationCtx,\n  args: Infer<typeof verifyCodeAndSignInArgs>,\n  getProviderOrThrow: Provider.GetProviderOrThrowFunc,\n  config: Provider.Config,\n): Promise<ReturnType> {\n  logWithLevel(LOG_LEVELS.DEBUG, \"verifyCodeAndSignInImpl args:\", {\n    params: { email: args.params.email, phone: args.params.phone },\n    provider: args.provider,\n    verifier: args.verifier,\n    generateTokens: args.generateTokens,\n    allowExtraProviders: args.allowExtraProviders,\n  });\n\n  const { generateTokens, provider, allowExtraProviders } = args;\n  if (generateTokens) {\n    requireEnv(\"JWT_PRIVATE_KEY\");\n    requireEnv(\"JWKS\");\n    requireEnv(\"CONVEX_SITE_URL\");\n  }\n  const identifier: string | undefined = args.params.email ?? args.params.phone;\n\n  try {\n    if (identifier !== undefined) {\n      const limited = await Fx.run(\n        isSignInRateLimited(ctx, identifier, config),\n      );\n      if (limited) {\n        throw new VerifyFailure(\n          \"Too many failed attempts to verify code for this email\",\n        );\n      }\n    }\n\n    const db = authDb(ctx, config);\n    const { params, verifier } = args;\n    const hash = await sha256(params.code);\n    const code = await db.verificationCodes.getByCode(hash);\n    if (code === null) {\n      throw new VerifyFailure(\"Invalid verification code\");\n    }\n\n    await db.verificationCodes.delete(code._id);\n\n    if (code.verifier !== verifier) {\n      throw new VerifyFailure(\"Invalid verifier\");\n    }\n    if (code.expirationTime < Date.now()) {\n      throw new VerifyFailure(\"Expired verification code\");\n    }\n    if (provider !== undefined && code.provider !== provider) {\n      throw new VerifyFailure(\n        `Invalid provider \"${provider}\" for given \\`code\\``,\n      );\n    }\n\n    const account = await db.accounts.getById(code.accountId);\n    if (account === null) {\n      throw new VerifyFailure(\n        \"Account associated with this email has been deleted\",\n      );\n    }\n\n    const codeProvider = isEnterpriseProviderId(code.provider)\n      ? createSyntheticOAuthMaterializedConfig(code.provider)\n      : getProviderOrThrow(code.provider, allowExtraProviders);\n\n    if (\n      codeProvider !== null &&\n      (codeProvider.type === \"email\" || codeProvider.type === \"phone\") &&\n      codeProvider.authorize !== undefined\n    ) {\n      await codeProvider.authorize(args.params, account);\n    }\n\n    const methodProvider = isEnterpriseProviderId(account.provider)\n      ? createSyntheticOAuthMaterializedConfig(account.provider)\n      : getProviderOrThrow(account.provider);\n\n    const userId =\n      methodProvider.type === \"oauth\"\n        ? account.userId\n        : (\n            await upsertUserAndAccount(\n              ctx,\n              await getAuthSessionId(ctx),\n              { existingAccount: account },\n              {\n                type: \"verification\",\n                provider: methodProvider,\n                profile: {\n                  ...(code.emailVerified !== undefined\n                    ? { email: code.emailVerified, emailVerified: true }\n                    : {}),\n                  ...(code.phoneVerified !== undefined\n                    ? { phone: code.phoneVerified, phoneVerified: true }\n                    : {}),\n                },\n              },\n              config,\n            )\n          ).userId;\n\n    if (identifier !== undefined) {\n      await Fx.run(resetSignInRateLimit(ctx, identifier, config));\n    }\n\n    const sessionId = await createNewAndDeleteExistingSession(\n      ctx,\n      config,\n      userId,\n    );\n    return await maybeGenerateTokensForSession(\n      ctx,\n      config,\n      userId,\n      sessionId,\n      generateTokens,\n    );\n  } catch (error) {\n    if (error instanceof VerifyFailure) {\n      logWithLevel(LOG_LEVELS.ERROR, error.reason);\n      if (identifier !== undefined) {\n        await Fx.run(recordFailedSignIn(ctx, identifier, config));\n      }\n      return null;\n    }\n    logWithLevel(\n      LOG_LEVELS.ERROR,\n      `verifyCodeAndSignInImpl failed: ${String(error)}`,\n    );\n    return null;\n  }\n}\n\n// ============================================================================\n// Action-level caller (unchanged — just forwards to mutation)\n// ============================================================================\n\nexport const callVerifyCodeAndSignIn = async <\n  DataModel extends GenericDataModel,\n>(\n  ctx: GenericActionCtx<DataModel>,\n  args: Infer<typeof verifyCodeAndSignInArgs>,\n): Promise<ReturnType> => {\n  return ctx.runMutation(AUTH_STORE_REF, {\n    args: {\n      type: \"verifyCodeAndSignIn\",\n      ...args,\n    },\n  });\n};\n"],"mappings":";;;;;;;;;;;AA0BA,MAAa,0BAA0B,EAAE,OAAO;CAC9C,QAAQ,EAAE,KAAK;CACf,UAAU,EAAE,SAAS,EAAE,QAAQ,CAAC;CAChC,UAAU,EAAE,SAAS,EAAE,QAAQ,CAAC;CAChC,gBAAgB,EAAE,SAAS;CAC3B,qBAAqB,EAAE,SAAS;CACjC,CAAC;;AASF,IAAM,gBAAN,MAAoB;CAClB,AAAS,OAAO;CAChB,YAAY,AAAS,QAAgB;EAAhB;;;AAOvB,eAAsB,wBACpB,KACA,MACA,oBACA,QACqB;AACrB,cAAa,WAAW,OAAO,iCAAiC;EAC9D,QAAQ;GAAE,OAAO,KAAK,OAAO;GAAO,OAAO,KAAK,OAAO;GAAO;EAC9D,UAAU,KAAK;EACf,UAAU,KAAK;EACf,gBAAgB,KAAK;EACrB,qBAAqB,KAAK;EAC3B,CAAC;CAEF,MAAM,EAAE,gBAAgB,UAAU,wBAAwB;AAC1D,KAAI,gBAAgB;AAClB,aAAW,kBAAkB;AAC7B,aAAW,OAAO;AAClB,aAAW,kBAAkB;;CAE/B,MAAM,aAAiC,KAAK,OAAO,SAAS,KAAK,OAAO;AAExE,KAAI;AACF,MAAI,eAAe,QAIjB;OAHgB,MAAM,GAAG,IACvB,oBAAoB,KAAK,YAAY,OAAO,CAC7C,CAEC,OAAM,IAAI,cACR,yDACD;;EAIL,MAAM,KAAK,OAAO,KAAK,OAAO;EAC9B,MAAM,EAAE,QAAQ,aAAa;EAC7B,MAAM,OAAO,MAAM,OAAO,OAAO,KAAK;EACtC,MAAM,OAAO,MAAM,GAAG,kBAAkB,UAAU,KAAK;AACvD,MAAI,SAAS,KACX,OAAM,IAAI,cAAc,4BAA4B;AAGtD,QAAM,GAAG,kBAAkB,OAAO,KAAK,IAAI;AAE3C,MAAI,KAAK,aAAa,SACpB,OAAM,IAAI,cAAc,mBAAmB;AAE7C,MAAI,KAAK,iBAAiB,KAAK,KAAK,CAClC,OAAM,IAAI,cAAc,4BAA4B;AAEtD,MAAI,aAAa,UAAa,KAAK,aAAa,SAC9C,OAAM,IAAI,cACR,qBAAqB,SAAS,sBAC/B;EAGH,MAAM,UAAU,MAAM,GAAG,SAAS,QAAQ,KAAK,UAAU;AACzD,MAAI,YAAY,KACd,OAAM,IAAI,cACR,sDACD;EAGH,MAAM,eAAe,uBAAuB,KAAK,SAAS,GACtD,uCAAuC,KAAK,SAAS,GACrD,mBAAmB,KAAK,UAAU,oBAAoB;AAE1D,MACE,iBAAiB,SAChB,aAAa,SAAS,WAAW,aAAa,SAAS,YACxD,aAAa,cAAc,OAE3B,OAAM,aAAa,UAAU,KAAK,QAAQ,QAAQ;EAGpD,MAAM,iBAAiB,uBAAuB,QAAQ,SAAS,GAC3D,uCAAuC,QAAQ,SAAS,GACxD,mBAAmB,QAAQ,SAAS;EAExC,MAAM,SACJ,eAAe,SAAS,UACpB,QAAQ,UAEN,MAAM,qBACJ,KACA,MAAM,iBAAiB,IAAI,EAC3B,EAAE,iBAAiB,SAAS,EAC5B;GACE,MAAM;GACN,UAAU;GACV,SAAS;IACP,GAAI,KAAK,kBAAkB,SACvB;KAAE,OAAO,KAAK;KAAe,eAAe;KAAM,GAClD,EAAE;IACN,GAAI,KAAK,kBAAkB,SACvB;KAAE,OAAO,KAAK;KAAe,eAAe;KAAM,GAClD,EAAE;IACP;GACF,EACD,OACD,EACD;AAER,MAAI,eAAe,OACjB,OAAM,GAAG,IAAI,qBAAqB,KAAK,YAAY,OAAO,CAAC;AAQ7D,SAAO,MAAM,8BACX,KACA,QACA,QARgB,MAAM,kCACtB,KACA,QACA,OACD,EAMC,eACD;UACM,OAAO;AACd,MAAI,iBAAiB,eAAe;AAClC,gBAAa,WAAW,OAAO,MAAM,OAAO;AAC5C,OAAI,eAAe,OACjB,OAAM,GAAG,IAAI,mBAAmB,KAAK,YAAY,OAAO,CAAC;AAE3D,UAAO;;AAET,eACE,WAAW,OACX,mCAAmC,OAAO,MAAM,GACjD;AACD,SAAO;;;AAQX,MAAa,0BAA0B,OAGrC,KACA,SACwB;AACxB,QAAO,IAAI,YAAY,gBAAgB,EACrC,MAAM;EACJ,MAAM;EACN,GAAG;EACJ,EACF,CAAC"}
+{"version":3,"file":"verify.js","names":[],"sources":["../../../src/server/mutations/verify.ts"],"sourcesContent":["import { Fx } from \"@robelest/fx\";\nimport type { GenericActionCtx, GenericDataModel } from \"convex/server\";\nimport { Infer, v } from \"convex/values\";\n\nimport { authDb } from \"../db\";\nimport * as Provider from \"../crypto\";\nimport {\n  isSignInRateLimited,\n  recordFailedSignIn,\n  resetSignInRateLimit,\n} from \"../limits\";\nimport {\n  createNewAndDeleteExistingSession,\n  getAuthSessionId,\n  maybeGenerateTokensForSession,\n} from \"../sessions\";\nimport {\n  createSyntheticOAuthMaterializedConfig,\n} from \"../enterprise/oidc\";\nimport { isEnterpriseProviderId } from \"../enterprise/shared\";\nimport { MutationCtx, SessionInfo } from \"../types\";\nimport { upsertUserAndAccount } from \"../users\";\nimport { LOG_LEVELS, logWithLevel, sha256 } from \"../utils\";\nimport { requireEnv } from \"../utils\";\nimport { AUTH_STORE_REF } from \"./store/refs\";\n\nexport const verifyCodeAndSignInArgs = v.object({\n  params: v.any(),\n  provider: v.optional(v.string()),\n  verifier: v.optional(v.string()),\n  generateTokens: v.boolean(),\n  allowExtraProviders: v.boolean(),\n});\n\ntype ReturnType = null | SessionInfo;\n\n// ============================================================================\n// Small validators for the verification pipeline\n// ============================================================================\n\n/** A soft verification failure — logged and collapsed to null at the boundary. */\nclass VerifyFailure {\n  readonly _tag = \"VerifyFailure\" as const;\n  constructor(readonly reason: string) {}\n}\n\n// ============================================================================\n// Main exported function\n// ============================================================================\n\nexport async function verifyCodeAndSignInImpl(\n  ctx: MutationCtx,\n  args: Infer<typeof verifyCodeAndSignInArgs>,\n  getProviderOrThrow: Provider.GetProviderOrThrowFunc,\n  config: Provider.Config,\n): Promise<ReturnType> {\n  logWithLevel(LOG_LEVELS.DEBUG, \"verifyCodeAndSignInImpl args:\", {\n    params: { email: args.params.email, phone: args.params.phone },\n    provider: args.provider,\n    verifier: args.verifier,\n    generateTokens: args.generateTokens,\n    allowExtraProviders: args.allowExtraProviders,\n  });\n\n  const { generateTokens, provider, allowExtraProviders } = args;\n  if (generateTokens) {\n    requireEnv(\"JWT_PRIVATE_KEY\");\n    requireEnv(\"JWKS\");\n    requireEnv(\"CONVEX_SITE_URL\");\n  }\n  const identifier: string | undefined = args.params.email ?? args.params.phone;\n\n  try {\n    if (identifier !== undefined) {\n      const limited = await Fx.run(\n        isSignInRateLimited(ctx, identifier, config),\n      );\n      if (limited) {\n        throw new VerifyFailure(\n          \"Too many failed attempts to verify code for this email\",\n        );\n      }\n    }\n\n    const db = authDb(ctx, config);\n    const { params, verifier } = args;\n    const hash = await sha256(params.code);\n    const code = await db.verificationCodes.getByCode(hash);\n    if (code === null) {\n      throw new VerifyFailure(\"Invalid verification code\");\n    }\n\n    await db.verificationCodes.delete(code._id);\n\n    if (code.verifier !== verifier) {\n      throw new VerifyFailure(\"Invalid verifier\");\n    }\n    if (code.expirationTime < Date.now()) {\n      throw new VerifyFailure(\"Expired verification code\");\n    }\n    if (provider !== undefined && code.provider !== provider) {\n      throw new VerifyFailure(\n        `Invalid provider \"${provider}\" for given \\`code\\``,\n      );\n    }\n\n    const account = await db.accounts.getById(code.accountId);\n    if (account === null) {\n      throw new VerifyFailure(\n        \"Account associated with this email has been deleted\",\n      );\n    }\n\n    const codeProvider = isEnterpriseProviderId(code.provider)\n      ? createSyntheticOAuthMaterializedConfig(code.provider)\n      : getProviderOrThrow(code.provider, allowExtraProviders);\n\n    if (\n      codeProvider !== null &&\n      (codeProvider.type === \"email\" || codeProvider.type === \"phone\") &&\n      codeProvider.authorize !== undefined\n    ) {\n      await codeProvider.authorize(args.params, account);\n    }\n\n    const methodProvider = isEnterpriseProviderId(account.provider)\n      ? createSyntheticOAuthMaterializedConfig(account.provider)\n      : getProviderOrThrow(account.provider);\n\n    const userId =\n      methodProvider.type === \"oauth\"\n        ? account.userId\n        : (\n            await upsertUserAndAccount(\n              ctx,\n              await getAuthSessionId(ctx),\n              { existingAccount: account },\n              {\n                type: \"verification\",\n                provider: methodProvider,\n                profile: {\n                  ...(code.emailVerified !== undefined\n                    ? { email: code.emailVerified, emailVerified: true }\n                    : {}),\n                  ...(code.phoneVerified !== undefined\n                    ? { phone: code.phoneVerified, phoneVerified: true }\n                    : {}),\n                },\n              },\n              config,\n            )\n          ).userId;\n\n    if (identifier !== undefined) {\n      await Fx.run(resetSignInRateLimit(ctx, identifier, config));\n    }\n\n    const sessionId = await createNewAndDeleteExistingSession(\n      ctx,\n      config,\n      userId,\n    );\n    return await maybeGenerateTokensForSession(\n      ctx,\n      config,\n      userId,\n      sessionId,\n      generateTokens,\n    );\n  } catch (error) {\n    if (error instanceof VerifyFailure) {\n      logWithLevel(LOG_LEVELS.ERROR, error.reason);\n      if (identifier !== undefined) {\n        await Fx.run(recordFailedSignIn(ctx, identifier, config));\n      }\n      return null;\n    }\n    logWithLevel(\n      LOG_LEVELS.ERROR,\n      `verifyCodeAndSignInImpl failed: ${String(error)}`,\n    );\n    return null;\n  }\n}\n\n// ============================================================================\n// Action-level caller (unchanged — just forwards to mutation)\n// ============================================================================\n\nexport const callVerifyCodeAndSignIn = async <\n  DataModel extends GenericDataModel,\n>(\n  ctx: GenericActionCtx<DataModel>,\n  args: Infer<typeof verifyCodeAndSignInArgs>,\n): Promise<ReturnType> => {\n  return ctx.runMutation(AUTH_STORE_REF, {\n    args: {\n      type: \"verifyCodeAndSignIn\",\n      ...args,\n    },\n  });\n};\n"],"mappings":";;;;;;;;;;;;AA0BA,MAAa,0BAA0B,EAAE,OAAO;CAC9C,QAAQ,EAAE,KAAK;CACf,UAAU,EAAE,SAAS,EAAE,QAAQ,CAAC;CAChC,UAAU,EAAE,SAAS,EAAE,QAAQ,CAAC;CAChC,gBAAgB,EAAE,SAAS;CAC3B,qBAAqB,EAAE,SAAS;CACjC,CAAC;;AASF,IAAM,gBAAN,MAAoB;CAClB,AAAS,OAAO;CAChB,YAAY,AAAS,QAAgB;EAAhB;;;AAOvB,eAAsB,wBACpB,KACA,MACA,oBACA,QACqB;AACrB,cAAa,WAAW,OAAO,iCAAiC;EAC9D,QAAQ;GAAE,OAAO,KAAK,OAAO;GAAO,OAAO,KAAK,OAAO;GAAO;EAC9D,UAAU,KAAK;EACf,UAAU,KAAK;EACf,gBAAgB,KAAK;EACrB,qBAAqB,KAAK;EAC3B,CAAC;CAEF,MAAM,EAAE,gBAAgB,UAAU,wBAAwB;AAC1D,KAAI,gBAAgB;AAClB,aAAW,kBAAkB;AAC7B,aAAW,OAAO;AAClB,aAAW,kBAAkB;;CAE/B,MAAM,aAAiC,KAAK,OAAO,SAAS,KAAK,OAAO;AAExE,KAAI;AACF,MAAI,eAAe,QAIjB;OAHgB,MAAM,GAAG,IACvB,oBAAoB,KAAK,YAAY,OAAO,CAC7C,CAEC,OAAM,IAAI,cACR,yDACD;;EAIL,MAAM,KAAK,OAAO,KAAK,OAAO;EAC9B,MAAM,EAAE,QAAQ,aAAa;EAC7B,MAAM,OAAO,MAAM,OAAO,OAAO,KAAK;EACtC,MAAM,OAAO,MAAM,GAAG,kBAAkB,UAAU,KAAK;AACvD,MAAI,SAAS,KACX,OAAM,IAAI,cAAc,4BAA4B;AAGtD,QAAM,GAAG,kBAAkB,OAAO,KAAK,IAAI;AAE3C,MAAI,KAAK,aAAa,SACpB,OAAM,IAAI,cAAc,mBAAmB;AAE7C,MAAI,KAAK,iBAAiB,KAAK,KAAK,CAClC,OAAM,IAAI,cAAc,4BAA4B;AAEtD,MAAI,aAAa,UAAa,KAAK,aAAa,SAC9C,OAAM,IAAI,cACR,qBAAqB,SAAS,sBAC/B;EAGH,MAAM,UAAU,MAAM,GAAG,SAAS,QAAQ,KAAK,UAAU;AACzD,MAAI,YAAY,KACd,OAAM,IAAI,cACR,sDACD;EAGH,MAAM,eAAe,uBAAuB,KAAK,SAAS,GACtD,uCAAuC,KAAK,SAAS,GACrD,mBAAmB,KAAK,UAAU,oBAAoB;AAE1D,MACE,iBAAiB,SAChB,aAAa,SAAS,WAAW,aAAa,SAAS,YACxD,aAAa,cAAc,OAE3B,OAAM,aAAa,UAAU,KAAK,QAAQ,QAAQ;EAGpD,MAAM,iBAAiB,uBAAuB,QAAQ,SAAS,GAC3D,uCAAuC,QAAQ,SAAS,GACxD,mBAAmB,QAAQ,SAAS;EAExC,MAAM,SACJ,eAAe,SAAS,UACpB,QAAQ,UAEN,MAAM,qBACJ,KACA,MAAM,iBAAiB,IAAI,EAC3B,EAAE,iBAAiB,SAAS,EAC5B;GACE,MAAM;GACN,UAAU;GACV,SAAS;IACP,GAAI,KAAK,kBAAkB,SACvB;KAAE,OAAO,KAAK;KAAe,eAAe;KAAM,GAClD,EAAE;IACN,GAAI,KAAK,kBAAkB,SACvB;KAAE,OAAO,KAAK;KAAe,eAAe;KAAM,GAClD,EAAE;IACP;GACF,EACD,OACD,EACD;AAER,MAAI,eAAe,OACjB,OAAM,GAAG,IAAI,qBAAqB,KAAK,YAAY,OAAO,CAAC;AAQ7D,SAAO,MAAM,8BACX,KACA,QACA,QARgB,MAAM,kCACtB,KACA,QACA,OACD,EAMC,eACD;UACM,OAAO;AACd,MAAI,iBAAiB,eAAe;AAClC,gBAAa,WAAW,OAAO,MAAM,OAAO;AAC5C,OAAI,eAAe,OACjB,OAAM,GAAG,IAAI,mBAAmB,KAAK,YAAY,OAAO,CAAC;AAE3D,UAAO;;AAET,eACE,WAAW,OACX,mCAAmC,OAAO,MAAM,GACjD;AACD,SAAO;;;AAQX,MAAa,0BAA0B,OAGrC,KACA,SACwB;AACxB,QAAO,IAAI,YAAY,gBAAgB,EACrC,MAAM;EACJ,MAAM;EACN,GAAG;EACJ,EACF,CAAC"}

package/dist/server/oauth.js

@@ -1,4 +1,4 @@
-import { AuthError } from "./fx.js";
+import { AuthError } from "./authError.js";
 import { isLocalHost, logWithLevel } from "./utils.js";
 import { SHARED_COOKIE_OPTIONS } from "./cookies.js";
 import { Fx } from "@robelest/fx";

package/dist/server/oauth.js.map

@@ -1 +1 @@
-{"version":3,"file":"oauth.js","names":[],"sources":["../../src/server/oauth.ts"],"sourcesContent":["/**\n * Arctic-based OAuth flow implementation.\n *\n * Uses Arctic for OAuth provider integration.\n *\n * All functions return `Fx<A, AuthError>` composed via `Fx.gen` pipelines.\n *\n * @internal\n * @module\n */\n\nimport { Fx } from \"@robelest/fx\";\nimport * as arctic from \"arctic\";\n\nimport { SHARED_COOKIE_OPTIONS } from \"./cookies\";\nimport { AuthError } from \"./fx\";\nimport type { OAuthProfile } from \"./types\";\nimport { logWithLevel } from \"./utils\";\nimport { isLocalHost } from \"./utils\";\n\ntype OAuthProviderConfigLike = {\n  scopes?: string[];\n  profile?: (tokens: arctic.OAuth2Tokens) => Promise<OAuthProfile>;\n  nonce?: boolean;\n  validateTokens?: (\n    tokens: arctic.OAuth2Tokens,\n    ctx: { nonce?: string },\n  ) => Promise<void>;\n};\n\n// ============================================================================\n// Types\n// ============================================================================\n\n/** A cookie to be set on the HTTP response. */\n/** @internal */\nexport interface OAuthCookie {\n  name: string;\n  value: string;\n  options: Record<string, unknown>;\n}\n\n/** Result of creating an authorization URL. */\n/** @internal */\nexport interface AuthorizationResult {\n  redirect: string;\n  cookies: OAuthCookie[];\n  signature: string;\n}\n\n/** Result of handling an OAuth callback. */\n/** @internal */\nexport interface CallbackResult {\n  profile: OAuthProfile;\n  providerAccountId: string;\n  cookies: OAuthCookie[];\n  signature: string;\n}\n\n// ============================================================================\n// Cookie helpers\n// ============================================================================\n\nconst COOKIE_TTL = 60 * 15; // 15 minutes\n\nfunction oauthCookieName(type: \"state\" | \"pkce\" | \"nonce\", providerId: string) {\n  const prefix = !isLocalHost(process.env.CONVEX_SITE_URL) ? \"__Host-\" : \"\";\n  return prefix + providerId + \"OAuth\" + type;\n}\n\nfunction createCookie(\n  type: \"state\" | \"pkce\" | \"nonce\",\n  providerId: string,\n  value: string,\n): OAuthCookie {\n  const expires = new Date();\n  expires.setTime(expires.getTime() + COOKIE_TTL * 1000);\n  return {\n    name: oauthCookieName(type, providerId),\n    value,\n    options: { ...SHARED_COOKIE_OPTIONS, expires },\n  };\n}\n\nfunction clearCookie(\n  type: \"state\" | \"pkce\" | \"nonce\",\n  providerId: string,\n): OAuthCookie {\n  return {\n    name: oauthCookieName(type, providerId),\n    value: \"\",\n    options: { ...SHARED_COOKIE_OPTIONS, maxAge: 0 },\n  };\n}\n\n// ============================================================================\n// Signature (ConvexAuth-specific verifier mechanism)\n// ============================================================================\n\n/**\n * Creates a signature string from the OAuth state parameters.\n * This is stored in the verifier table and validated during callback.\n */\n/** @internal */\nexport function getAuthorizationSignature({\n  codeVerifier,\n  state,\n}: {\n  codeVerifier?: string;\n  state?: string;\n}) {\n  return [codeVerifier, state].filter((param) => param !== undefined).join(\" \");\n}\n\n// ============================================================================\n// PKCE Detection\n// ============================================================================\n\n/**\n * Detect whether an Arctic provider uses PKCE by checking the arity\n * of `createAuthorizationURL`. PKCE providers take 3 args\n * (state, codeVerifier, scopes), non-PKCE take 2 (state, scopes).\n */\nfunction isPKCEProvider(provider: any): boolean {\n  return (\n    typeof provider.createAuthorizationURL === \"function\" &&\n    provider.createAuthorizationURL.length >= 3\n  );\n}\n\n// ============================================================================\n// Token exchange — wraps Arctic's validateAuthorizationCode\n// ============================================================================\n\n/**\n * Exchange the authorization code for tokens via Arctic.\n * Maps Arctic-specific errors to typed `AuthError` failures.\n */\nfunction exchangeCode(\n  arcticProvider: any,\n  code: string,\n  codeVerifier: string | undefined,\n): Fx<arctic.OAuth2Tokens, AuthError> {\n  return Fx.from({\n    ok: () =>\n      isPKCEProvider(arcticProvider)\n        ? arcticProvider.validateAuthorizationCode(code, codeVerifier)\n        : arcticProvider.validateAuthorizationCode(code),\n    err: (e) => {\n      if (e instanceof arctic.OAuth2RequestError) {\n        return new AuthError(\n          \"OAUTH_PROVIDER_ERROR\",\n          `Token exchange failed: ${e.code}`,\n        );\n      }\n      if (e instanceof arctic.ArcticFetchError) {\n        return new AuthError(\n          \"OAUTH_PROVIDER_ERROR\",\n          `Network error during token exchange: ${e.message}`,\n        );\n      }\n      // Unknown error — treat as unrecoverable defect; we surface it as\n      // an AuthError here so the pipeline type stays Fx<_, AuthError>.\n      // The original `throw e` re-throw is replicated via Fx.fatal below.\n      return new AuthError(\n        \"OAUTH_PROVIDER_ERROR\",\n        `Unexpected error during token exchange: ${e instanceof Error ? e.message : String(e)}`,\n      );\n    },\n  }).pipe(\n    Fx.chain((tokens) => {\n      // If the original error was neither OAuth2RequestError nor\n      // ArcticFetchError the old code re-threw it raw. We replicate that\n      // by checking whether we created an \"Unexpected\" marker message\n      // — but since `Fx.from` already mapped it, we just pass through.\n      return Fx.succeed(tokens);\n    }),\n  );\n}\n\n/**\n * Extract the user profile from tokens using the config callback,\n * OIDC auto-decode, or fail if neither is available.\n */\nfunction extractProfile(\n  providerId: string,\n  oauthConfig: OAuthProviderConfigLike,\n  tokens: arctic.OAuth2Tokens,\n): Fx<OAuthProfile, AuthError> {\n  const hasIdToken =\n    \"id_token\" in tokens.data &&\n    typeof (tokens.data as any).id_token === \"string\";\n  const profileSource = oauthConfig.profile\n    ? { source: \"callback\" as const }\n    : hasIdToken\n      ? { source: \"idToken\" as const }\n      : { source: \"missing\" as const };\n\n  return Fx.match(profileSource, profileSource.source, {\n    callback: (_profileSource) =>\n      Fx.from({\n        ok: () => oauthConfig.profile!(tokens),\n        err: (e) =>\n          new AuthError(\n            \"OAUTH_INVALID_PROFILE\",\n            `Profile callback threw: ${e instanceof Error ? e.message : String(e)}`,\n          ),\n      }),\n    idToken: (_profileSource) => {\n      const claims = arctic.decodeIdToken(tokens.idToken()) as Record<\n        string,\n        unknown\n      >;\n      return Fx.succeed({\n        id: (claims.sub as string) ?? crypto.randomUUID(),\n        name: (claims.name as string) ?? undefined,\n        email: (claims.email as string) ?? undefined,\n        image: (claims.picture as string) ?? undefined,\n      });\n    },\n    missing: (_profileSource) =>\n      Fx.fail(\n        new AuthError(\n          \"OAUTH_INVALID_PROFILE\",\n          `Provider \"${providerId}\" does not return an ID token. ` +\n            `Add a \\`profile\\` callback in the OAuth() config to extract user info from the access token.`,\n        ),\n      ),\n  });\n}\n\n/**\n * Validate that the profile has a non-empty string `id`.\n */\nfunction validateProfileId(\n  providerId: string,\n  profile: OAuthProfile,\n): Fx<OAuthProfile, AuthError> {\n  return typeof profile.id === \"string\" && profile.id\n    ? Fx.succeed(profile)\n    : Fx.fail(\n        new AuthError(\n          \"OAUTH_INVALID_PROFILE\",\n          `The profile callback for \"${providerId}\" must return an object with a string \\`id\\` field.`,\n        ),\n      );\n}\n\n// ============================================================================\n// Authorization URL creation\n// ============================================================================\n\n/**\n * Create an OAuth authorization URL using an Arctic provider.\n *\n * Handles PKCE detection, state generation, and cookie creation.\n */\n/** @internal */\nexport async function createOAuthAuthorizationURL(\n  providerId: string,\n  arcticProvider: any,\n  oauthConfig: OAuthProviderConfigLike,\n): Promise<AuthorizationResult> {\n  const state = arctic.generateState();\n  const cookies: OAuthCookie[] = [];\n  let codeVerifier: string | undefined;\n\n  const scopes = oauthConfig.scopes ?? [];\n\n  let url: URL;\n\n  if (isPKCEProvider(arcticProvider)) {\n    codeVerifier = arctic.generateCodeVerifier();\n    url = arcticProvider.createAuthorizationURL(state, codeVerifier, scopes);\n    cookies.push(createCookie(\"pkce\", providerId, codeVerifier));\n  } else {\n    url = arcticProvider.createAuthorizationURL(state, scopes);\n  }\n\n  cookies.push(createCookie(\"state\", providerId, state));\n\n  if (oauthConfig.nonce === true) {\n    const nonce = arctic.generateState();\n    url.searchParams.set(\"nonce\", nonce);\n    cookies.push(createCookie(\"nonce\", providerId, nonce));\n  }\n\n  logWithLevel(\"DEBUG\", \"OAuth authorization URL created\", {\n    url: url.toString(),\n    providerId,\n    hasPKCE: !!codeVerifier,\n  });\n\n  const signature = getAuthorizationSignature({ codeVerifier, state });\n\n  return {\n    redirect: url.toString(),\n    cookies,\n    signature,\n  };\n}\n\n// ============================================================================\n// OAuth callback handling\n// ============================================================================\n\n/**\n * Handle the OAuth callback: validate state, exchange code for tokens,\n * extract profile.\n *\n * Returns `Fx<CallbackResult, AuthError>` composed via `Fx.gen`.\n */\n/** @internal */\nexport function handleOAuthCallback(\n  providerId: string,\n  arcticProvider: any,\n  oauthConfig: OAuthProviderConfigLike,\n  params: Record<string, string>,\n  cookies: Record<string, string | undefined>,\n): Fx<CallbackResult, AuthError> {\n  return Fx.gen(function* () {\n    const resCookies: OAuthCookie[] = [];\n\n    // 1. Validate state\n    const stateCookieName = oauthCookieName(\"state\", providerId);\n    const storedState = cookies[stateCookieName];\n    const returnedState = params.state;\n\n    yield* Fx.guard(\n      !storedState || !returnedState || storedState !== returnedState,\n      Fx.fail(new AuthError(\"OAUTH_INVALID_STATE\")),\n    );\n    resCookies.push(clearCookie(\"state\", providerId));\n\n    // Check for error from provider\n    if (params.error) {\n      const cause = {\n        providerId,\n        error: params.error,\n        error_description: params.error_description,\n      };\n      logWithLevel(\"DEBUG\", \"OAuthCallbackError\", cause);\n      yield* Fx.fail(\n        new AuthError(\n          \"OAUTH_PROVIDER_ERROR\",\n          \"OAuth provider returned an error\",\n          {\n            cause: JSON.stringify(cause),\n          },\n        ),\n      );\n    }\n\n    // 2. Get code\n    const code = yield* params.code != null\n      ? Fx.succeed(params.code)\n      : Fx.fail(\n          new AuthError(\n            \"OAUTH_PROVIDER_ERROR\",\n            \"Missing authorization code in callback\",\n          ),\n        );\n\n    // 3. Read PKCE verifier from cookie if applicable\n    let codeVerifier: string | undefined;\n    if (isPKCEProvider(arcticProvider)) {\n      const pkceCookieName = oauthCookieName(\"pkce\", providerId);\n      codeVerifier = yield* cookies[pkceCookieName] != null\n        ? Fx.succeed(cookies[pkceCookieName]!)\n        : Fx.fail(\n            new AuthError(\n              \"OAUTH_MISSING_VERIFIER\",\n              \"Missing PKCE verifier cookie for OAuth callback\",\n            ),\n          );\n      resCookies.push(clearCookie(\"pkce\", providerId));\n    }\n\n    let nonce: string | undefined;\n    if (oauthConfig.nonce === true) {\n      const nonceCookieName = oauthCookieName(\"nonce\", providerId);\n      nonce = yield* cookies[nonceCookieName] != null\n        ? Fx.succeed(cookies[nonceCookieName]!)\n        : Fx.fail(\n            new AuthError(\n              \"OAUTH_PROVIDER_ERROR\",\n              \"Missing nonce cookie for OAuth callback\",\n            ),\n          );\n      resCookies.push(clearCookie(\"nonce\", providerId));\n    }\n\n    // 4. Exchange code for tokens\n    const tokens = yield* exchangeCode(arcticProvider, code, codeVerifier);\n\n    if (oauthConfig.validateTokens !== undefined) {\n      yield* Fx.from({\n        ok: () => oauthConfig.validateTokens!(tokens, { nonce }),\n        err: (e) =>\n          new AuthError(\n            \"OAUTH_PROVIDER_ERROR\",\n            `Token validation failed: ${e instanceof Error ? e.message : String(e)}`,\n          ),\n      });\n    }\n\n    // 5. Extract profile\n    const rawProfile = yield* extractProfile(providerId, oauthConfig, tokens);\n    const profile = yield* validateProfileId(providerId, rawProfile);\n\n    logWithLevel(\"DEBUG\", \"OAuth callback profile extracted\", {\n      providerId,\n      profileId: profile.id,\n    });\n\n    // 6. Compute signature for verifier validation\n    const state = storedState!;\n    const signature = getAuthorizationSignature({ codeVerifier, state });\n\n    return {\n      profile,\n      providerAccountId: profile.id,\n      cookies: resCookies,\n      signature,\n    };\n  });\n}\n"],"mappings":";;;;;;;;;;;;;;;;;AA+DA,MAAM,aAAa;AAEnB,SAAS,gBAAgB,MAAkC,YAAoB;AAE7E,SADe,CAAC,YAAY,QAAQ,IAAI,gBAAgB,GAAG,YAAY,MACvD,aAAa,UAAU;;AAGzC,SAAS,aACP,MACA,YACA,OACa;CACb,MAAM,0BAAU,IAAI,MAAM;AAC1B,SAAQ,QAAQ,QAAQ,SAAS,GAAG,aAAa,IAAK;AACtD,QAAO;EACL,MAAM,gBAAgB,MAAM,WAAW;EACvC;EACA,SAAS;GAAE,GAAG;GAAuB;GAAS;EAC/C;;AAGH,SAAS,YACP,MACA,YACa;AACb,QAAO;EACL,MAAM,gBAAgB,MAAM,WAAW;EACvC,OAAO;EACP,SAAS;GAAE,GAAG;GAAuB,QAAQ;GAAG;EACjD;;;;;;;AAYH,SAAgB,0BAA0B,EACxC,cACA,SAIC;AACD,QAAO,CAAC,cAAc,MAAM,CAAC,QAAQ,UAAU,UAAU,OAAU,CAAC,KAAK,IAAI;;;;;;;AAY/E,SAAS,eAAe,UAAwB;AAC9C,QACE,OAAO,SAAS,2BAA2B,cAC3C,SAAS,uBAAuB,UAAU;;;;;;AAY9C,SAAS,aACP,gBACA,MACA,cACoC;AACpC,QAAO,GAAG,KAAK;EACb,UACE,eAAe,eAAe,GAC1B,eAAe,0BAA0B,MAAM,aAAa,GAC5D,eAAe,0BAA0B,KAAK;EACpD,MAAM,MAAM;AACV,OAAI,aAAa,OAAO,mBACtB,QAAO,IAAI,UACT,wBACA,0BAA0B,EAAE,OAC7B;AAEH,OAAI,aAAa,OAAO,iBACtB,QAAO,IAAI,UACT,wBACA,wCAAwC,EAAE,UAC3C;AAKH,UAAO,IAAI,UACT,wBACA,2CAA2C,aAAa,QAAQ,EAAE,UAAU,OAAO,EAAE,GACtF;;EAEJ,CAAC,CAAC,KACD,GAAG,OAAO,WAAW;AAKnB,SAAO,GAAG,QAAQ,OAAO;GACzB,CACH;;;;;;AAOH,SAAS,eACP,YACA,aACA,QAC6B;CAC7B,MAAM,aACJ,cAAc,OAAO,QACrB,OAAQ,OAAO,KAAa,aAAa;CAC3C,MAAM,gBAAgB,YAAY,UAC9B,EAAE,QAAQ,YAAqB,GAC/B,aACE,EAAE,QAAQ,WAAoB,GAC9B,EAAE,QAAQ,WAAoB;AAEpC,QAAO,GAAG,MAAM,eAAe,cAAc,QAAQ;EACnD,WAAW,mBACT,GAAG,KAAK;GACN,UAAU,YAAY,QAAS,OAAO;GACtC,MAAM,MACJ,IAAI,UACF,yBACA,2BAA2B,aAAa,QAAQ,EAAE,UAAU,OAAO,EAAE,GACtE;GACJ,CAAC;EACJ,UAAU,mBAAmB;GAC3B,MAAM,SAAS,OAAO,cAAc,OAAO,SAAS,CAAC;AAIrD,UAAO,GAAG,QAAQ;IAChB,IAAK,OAAO,OAAkB,OAAO,YAAY;IACjD,MAAO,OAAO,QAAmB;IACjC,OAAQ,OAAO,SAAoB;IACnC,OAAQ,OAAO,WAAsB;IACtC,CAAC;;EAEJ,UAAU,mBACR,GAAG,KACD,IAAI,UACF,yBACA,aAAa,WAAW,6HAEzB,CACF;EACJ,CAAC;;;;;AAMJ,SAAS,kBACP,YACA,SAC6B;AAC7B,QAAO,OAAO,QAAQ,OAAO,YAAY,QAAQ,KAC7C,GAAG,QAAQ,QAAQ,GACnB,GAAG,KACD,IAAI,UACF,yBACA,6BAA6B,WAAW,qDACzC,CACF;;;;;;;;AAaP,eAAsB,4BACpB,YACA,gBACA,aAC8B;CAC9B,MAAM,QAAQ,OAAO,eAAe;CACpC,MAAM,UAAyB,EAAE;CACjC,IAAI;CAEJ,MAAM,SAAS,YAAY,UAAU,EAAE;CAEvC,IAAI;AAEJ,KAAI,eAAe,eAAe,EAAE;AAClC,iBAAe,OAAO,sBAAsB;AAC5C,QAAM,eAAe,uBAAuB,OAAO,cAAc,OAAO;AACxE,UAAQ,KAAK,aAAa,QAAQ,YAAY,aAAa,CAAC;OAE5D,OAAM,eAAe,uBAAuB,OAAO,OAAO;AAG5D,SAAQ,KAAK,aAAa,SAAS,YAAY,MAAM,CAAC;AAEtD,KAAI,YAAY,UAAU,MAAM;EAC9B,MAAM,QAAQ,OAAO,eAAe;AACpC,MAAI,aAAa,IAAI,SAAS,MAAM;AACpC,UAAQ,KAAK,aAAa,SAAS,YAAY,MAAM,CAAC;;AAGxD,cAAa,SAAS,mCAAmC;EACvD,KAAK,IAAI,UAAU;EACnB;EACA,SAAS,CAAC,CAAC;EACZ,CAAC;CAEF,MAAM,YAAY,0BAA0B;EAAE;EAAc;EAAO,CAAC;AAEpE,QAAO;EACL,UAAU,IAAI,UAAU;EACxB;EACA;EACD;;;;;;;;;AAcH,SAAgB,oBACd,YACA,gBACA,aACA,QACA,SAC+B;AAC/B,QAAO,GAAG,IAAI,aAAa;EACzB,MAAM,aAA4B,EAAE;EAIpC,MAAM,cAAc,QADI,gBAAgB,SAAS,WAAW;EAE5D,MAAM,gBAAgB,OAAO;AAE7B,SAAO,GAAG,MACR,CAAC,eAAe,CAAC,iBAAiB,gBAAgB,eAClD,GAAG,KAAK,IAAI,UAAU,sBAAsB,CAAC,CAC9C;AACD,aAAW,KAAK,YAAY,SAAS,WAAW,CAAC;AAGjD,MAAI,OAAO,OAAO;GAChB,MAAM,QAAQ;IACZ;IACA,OAAO,OAAO;IACd,mBAAmB,OAAO;IAC3B;AACD,gBAAa,SAAS,sBAAsB,MAAM;AAClD,UAAO,GAAG,KACR,IAAI,UACF,wBACA,oCACA,EACE,OAAO,KAAK,UAAU,MAAM,EAC7B,CACF,CACF;;EAIH,MAAM,OAAO,OAAO,OAAO,QAAQ,OAC/B,GAAG,QAAQ,OAAO,KAAK,GACvB,GAAG,KACD,IAAI,UACF,wBACA,yCACD,CACF;EAGL,IAAI;AACJ,MAAI,eAAe,eAAe,EAAE;GAClC,MAAM,iBAAiB,gBAAgB,QAAQ,WAAW;AAC1D,kBAAe,OAAO,QAAQ,mBAAmB,OAC7C,GAAG,QAAQ,QAAQ,gBAAiB,GACpC,GAAG,KACD,IAAI,UACF,0BACA,kDACD,CACF;AACL,cAAW,KAAK,YAAY,QAAQ,WAAW,CAAC;;EAGlD,IAAI;AACJ,MAAI,YAAY,UAAU,MAAM;GAC9B,MAAM,kBAAkB,gBAAgB,SAAS,WAAW;AAC5D,WAAQ,OAAO,QAAQ,oBAAoB,OACvC,GAAG,QAAQ,QAAQ,iBAAkB,GACrC,GAAG,KACD,IAAI,UACF,wBACA,0CACD,CACF;AACL,cAAW,KAAK,YAAY,SAAS,WAAW,CAAC;;EAInD,MAAM,SAAS,OAAO,aAAa,gBAAgB,MAAM,aAAa;AAEtE,MAAI,YAAY,mBAAmB,OACjC,QAAO,GAAG,KAAK;GACb,UAAU,YAAY,eAAgB,QAAQ,EAAE,OAAO,CAAC;GACxD,MAAM,MACJ,IAAI,UACF,wBACA,4BAA4B,aAAa,QAAQ,EAAE,UAAU,OAAO,EAAE,GACvE;GACJ,CAAC;EAKJ,MAAM,UAAU,OAAO,kBAAkB,YADtB,OAAO,eAAe,YAAY,aAAa,OAAO,CACT;AAEhE,eAAa,SAAS,oCAAoC;GACxD;GACA,WAAW,QAAQ;GACpB,CAAC;EAIF,MAAM,YAAY,0BAA0B;GAAE;GAAc,OAD9C;GACqD,CAAC;AAEpE,SAAO;GACL;GACA,mBAAmB,QAAQ;GAC3B,SAAS;GACT;GACD;GACD"}
+{"version":3,"file":"oauth.js","names":[],"sources":["../../src/server/oauth.ts"],"sourcesContent":["/**\n * Arctic-based OAuth flow implementation.\n *\n * Uses Arctic for OAuth provider integration.\n *\n * All functions return `Fx<A, AuthError>` composed via `Fx.gen` pipelines.\n *\n * @internal\n * @module\n */\n\nimport { Fx } from \"@robelest/fx\";\nimport * as arctic from \"arctic\";\n\nimport { SHARED_COOKIE_OPTIONS } from \"./cookies\";\nimport { AuthError } from \"./authError\";\nimport type { OAuthProfile } from \"./types\";\nimport { logWithLevel } from \"./utils\";\nimport { isLocalHost } from \"./utils\";\n\ntype OAuthProviderConfigLike = {\n  scopes?: string[];\n  profile?: (tokens: arctic.OAuth2Tokens) => Promise<OAuthProfile>;\n  nonce?: boolean;\n  validateTokens?: (\n    tokens: arctic.OAuth2Tokens,\n    ctx: { nonce?: string },\n  ) => Promise<void>;\n};\n\n// ============================================================================\n// Types\n// ============================================================================\n\n/** A cookie to be set on the HTTP response. */\n/** @internal */\nexport interface OAuthCookie {\n  name: string;\n  value: string;\n  options: Record<string, unknown>;\n}\n\n/** Result of creating an authorization URL. */\n/** @internal */\nexport interface AuthorizationResult {\n  redirect: string;\n  cookies: OAuthCookie[];\n  signature: string;\n}\n\n/** Result of handling an OAuth callback. */\n/** @internal */\nexport interface CallbackResult {\n  profile: OAuthProfile;\n  providerAccountId: string;\n  cookies: OAuthCookie[];\n  signature: string;\n}\n\n// ============================================================================\n// Cookie helpers\n// ============================================================================\n\nconst COOKIE_TTL = 60 * 15; // 15 minutes\n\nfunction oauthCookieName(type: \"state\" | \"pkce\" | \"nonce\", providerId: string) {\n  const prefix = !isLocalHost(process.env.CONVEX_SITE_URL) ? \"__Host-\" : \"\";\n  return prefix + providerId + \"OAuth\" + type;\n}\n\nfunction createCookie(\n  type: \"state\" | \"pkce\" | \"nonce\",\n  providerId: string,\n  value: string,\n): OAuthCookie {\n  const expires = new Date();\n  expires.setTime(expires.getTime() + COOKIE_TTL * 1000);\n  return {\n    name: oauthCookieName(type, providerId),\n    value,\n    options: { ...SHARED_COOKIE_OPTIONS, expires },\n  };\n}\n\nfunction clearCookie(\n  type: \"state\" | \"pkce\" | \"nonce\",\n  providerId: string,\n): OAuthCookie {\n  return {\n    name: oauthCookieName(type, providerId),\n    value: \"\",\n    options: { ...SHARED_COOKIE_OPTIONS, maxAge: 0 },\n  };\n}\n\n// ============================================================================\n// Signature (ConvexAuth-specific verifier mechanism)\n// ============================================================================\n\n/**\n * Creates a signature string from the OAuth state parameters.\n * This is stored in the verifier table and validated during callback.\n */\n/** @internal */\nexport function getAuthorizationSignature({\n  codeVerifier,\n  state,\n}: {\n  codeVerifier?: string;\n  state?: string;\n}) {\n  return [codeVerifier, state].filter((param) => param !== undefined).join(\" \");\n}\n\n// ============================================================================\n// PKCE Detection\n// ============================================================================\n\n/**\n * Detect whether an Arctic provider uses PKCE by checking the arity\n * of `createAuthorizationURL`. PKCE providers take 3 args\n * (state, codeVerifier, scopes), non-PKCE take 2 (state, scopes).\n */\nfunction isPKCEProvider(provider: any): boolean {\n  return (\n    typeof provider.createAuthorizationURL === \"function\" &&\n    provider.createAuthorizationURL.length >= 3\n  );\n}\n\n// ============================================================================\n// Token exchange — wraps Arctic's validateAuthorizationCode\n// ============================================================================\n\n/**\n * Exchange the authorization code for tokens via Arctic.\n * Maps Arctic-specific errors to typed `AuthError` failures.\n */\nfunction exchangeCode(\n  arcticProvider: any,\n  code: string,\n  codeVerifier: string | undefined,\n): Fx<arctic.OAuth2Tokens, AuthError> {\n  return Fx.from({\n    ok: () =>\n      isPKCEProvider(arcticProvider)\n        ? arcticProvider.validateAuthorizationCode(code, codeVerifier)\n        : arcticProvider.validateAuthorizationCode(code),\n    err: (e) => {\n      if (e instanceof arctic.OAuth2RequestError) {\n        return new AuthError(\n          \"OAUTH_PROVIDER_ERROR\",\n          `Token exchange failed: ${e.code}`,\n        );\n      }\n      if (e instanceof arctic.ArcticFetchError) {\n        return new AuthError(\n          \"OAUTH_PROVIDER_ERROR\",\n          `Network error during token exchange: ${e.message}`,\n        );\n      }\n      // Unknown error — treat as unrecoverable defect; we surface it as\n      // an AuthError here so the pipeline type stays Fx<_, AuthError>.\n      // The original `throw e` re-throw is replicated via Fx.fatal below.\n      return new AuthError(\n        \"OAUTH_PROVIDER_ERROR\",\n        `Unexpected error during token exchange: ${e instanceof Error ? e.message : String(e)}`,\n      );\n    },\n  }).pipe(\n    Fx.chain((tokens) => {\n      // If the original error was neither OAuth2RequestError nor\n      // ArcticFetchError the old code re-threw it raw. We replicate that\n      // by checking whether we created an \"Unexpected\" marker message\n      // — but since `Fx.from` already mapped it, we just pass through.\n      return Fx.succeed(tokens);\n    }),\n  );\n}\n\n/**\n * Extract the user profile from tokens using the config callback,\n * OIDC auto-decode, or fail if neither is available.\n */\nfunction extractProfile(\n  providerId: string,\n  oauthConfig: OAuthProviderConfigLike,\n  tokens: arctic.OAuth2Tokens,\n): Fx<OAuthProfile, AuthError> {\n  const hasIdToken =\n    \"id_token\" in tokens.data &&\n    typeof (tokens.data as any).id_token === \"string\";\n  const profileSource = oauthConfig.profile\n    ? { source: \"callback\" as const }\n    : hasIdToken\n      ? { source: \"idToken\" as const }\n      : { source: \"missing\" as const };\n\n  return Fx.match(profileSource, profileSource.source, {\n    callback: (_profileSource) =>\n      Fx.from({\n        ok: () => oauthConfig.profile!(tokens),\n        err: (e) =>\n          new AuthError(\n            \"OAUTH_INVALID_PROFILE\",\n            `Profile callback threw: ${e instanceof Error ? e.message : String(e)}`,\n          ),\n      }),\n    idToken: (_profileSource) => {\n      const claims = arctic.decodeIdToken(tokens.idToken()) as Record<\n        string,\n        unknown\n      >;\n      return Fx.succeed({\n        id: (claims.sub as string) ?? crypto.randomUUID(),\n        name: (claims.name as string) ?? undefined,\n        email: (claims.email as string) ?? undefined,\n        image: (claims.picture as string) ?? undefined,\n      });\n    },\n    missing: (_profileSource) =>\n      Fx.fail(\n        new AuthError(\n          \"OAUTH_INVALID_PROFILE\",\n          `Provider \"${providerId}\" does not return an ID token. ` +\n            `Add a \\`profile\\` callback in the OAuth() config to extract user info from the access token.`,\n        ),\n      ),\n  });\n}\n\n/**\n * Validate that the profile has a non-empty string `id`.\n */\nfunction validateProfileId(\n  providerId: string,\n  profile: OAuthProfile,\n): Fx<OAuthProfile, AuthError> {\n  return typeof profile.id === \"string\" && profile.id\n    ? Fx.succeed(profile)\n    : Fx.fail(\n        new AuthError(\n          \"OAUTH_INVALID_PROFILE\",\n          `The profile callback for \"${providerId}\" must return an object with a string \\`id\\` field.`,\n        ),\n      );\n}\n\n// ============================================================================\n// Authorization URL creation\n// ============================================================================\n\n/**\n * Create an OAuth authorization URL using an Arctic provider.\n *\n * Handles PKCE detection, state generation, and cookie creation.\n */\n/** @internal */\nexport async function createOAuthAuthorizationURL(\n  providerId: string,\n  arcticProvider: any,\n  oauthConfig: OAuthProviderConfigLike,\n): Promise<AuthorizationResult> {\n  const state = arctic.generateState();\n  const cookies: OAuthCookie[] = [];\n  let codeVerifier: string | undefined;\n\n  const scopes = oauthConfig.scopes ?? [];\n\n  let url: URL;\n\n  if (isPKCEProvider(arcticProvider)) {\n    codeVerifier = arctic.generateCodeVerifier();\n    url = arcticProvider.createAuthorizationURL(state, codeVerifier, scopes);\n    cookies.push(createCookie(\"pkce\", providerId, codeVerifier));\n  } else {\n    url = arcticProvider.createAuthorizationURL(state, scopes);\n  }\n\n  cookies.push(createCookie(\"state\", providerId, state));\n\n  if (oauthConfig.nonce === true) {\n    const nonce = arctic.generateState();\n    url.searchParams.set(\"nonce\", nonce);\n    cookies.push(createCookie(\"nonce\", providerId, nonce));\n  }\n\n  logWithLevel(\"DEBUG\", \"OAuth authorization URL created\", {\n    url: url.toString(),\n    providerId,\n    hasPKCE: !!codeVerifier,\n  });\n\n  const signature = getAuthorizationSignature({ codeVerifier, state });\n\n  return {\n    redirect: url.toString(),\n    cookies,\n    signature,\n  };\n}\n\n// ============================================================================\n// OAuth callback handling\n// ============================================================================\n\n/**\n * Handle the OAuth callback: validate state, exchange code for tokens,\n * extract profile.\n *\n * Returns `Fx<CallbackResult, AuthError>` composed via `Fx.gen`.\n */\n/** @internal */\nexport function handleOAuthCallback(\n  providerId: string,\n  arcticProvider: any,\n  oauthConfig: OAuthProviderConfigLike,\n  params: Record<string, string>,\n  cookies: Record<string, string | undefined>,\n): Fx<CallbackResult, AuthError> {\n  return Fx.gen(function* () {\n    const resCookies: OAuthCookie[] = [];\n\n    // 1. Validate state\n    const stateCookieName = oauthCookieName(\"state\", providerId);\n    const storedState = cookies[stateCookieName];\n    const returnedState = params.state;\n\n    yield* Fx.guard(\n      !storedState || !returnedState || storedState !== returnedState,\n      Fx.fail(new AuthError(\"OAUTH_INVALID_STATE\")),\n    );\n    resCookies.push(clearCookie(\"state\", providerId));\n\n    // Check for error from provider\n    if (params.error) {\n      const cause = {\n        providerId,\n        error: params.error,\n        error_description: params.error_description,\n      };\n      logWithLevel(\"DEBUG\", \"OAuthCallbackError\", cause);\n      yield* Fx.fail(\n        new AuthError(\n          \"OAUTH_PROVIDER_ERROR\",\n          \"OAuth provider returned an error\",\n          {\n            cause: JSON.stringify(cause),\n          },\n        ),\n      );\n    }\n\n    // 2. Get code\n    const code = yield* params.code != null\n      ? Fx.succeed(params.code)\n      : Fx.fail(\n          new AuthError(\n            \"OAUTH_PROVIDER_ERROR\",\n            \"Missing authorization code in callback\",\n          ),\n        );\n\n    // 3. Read PKCE verifier from cookie if applicable\n    let codeVerifier: string | undefined;\n    if (isPKCEProvider(arcticProvider)) {\n      const pkceCookieName = oauthCookieName(\"pkce\", providerId);\n      codeVerifier = yield* cookies[pkceCookieName] != null\n        ? Fx.succeed(cookies[pkceCookieName]!)\n        : Fx.fail(\n            new AuthError(\n              \"OAUTH_MISSING_VERIFIER\",\n              \"Missing PKCE verifier cookie for OAuth callback\",\n            ),\n          );\n      resCookies.push(clearCookie(\"pkce\", providerId));\n    }\n\n    let nonce: string | undefined;\n    if (oauthConfig.nonce === true) {\n      const nonceCookieName = oauthCookieName(\"nonce\", providerId);\n      nonce = yield* cookies[nonceCookieName] != null\n        ? Fx.succeed(cookies[nonceCookieName]!)\n        : Fx.fail(\n            new AuthError(\n              \"OAUTH_PROVIDER_ERROR\",\n              \"Missing nonce cookie for OAuth callback\",\n            ),\n          );\n      resCookies.push(clearCookie(\"nonce\", providerId));\n    }\n\n    // 4. Exchange code for tokens\n    const tokens = yield* exchangeCode(arcticProvider, code, codeVerifier);\n\n    if (oauthConfig.validateTokens !== undefined) {\n      yield* Fx.from({\n        ok: () => oauthConfig.validateTokens!(tokens, { nonce }),\n        err: (e) =>\n          new AuthError(\n            \"OAUTH_PROVIDER_ERROR\",\n            `Token validation failed: ${e instanceof Error ? e.message : String(e)}`,\n          ),\n      });\n    }\n\n    // 5. Extract profile\n    const rawProfile = yield* extractProfile(providerId, oauthConfig, tokens);\n    const profile = yield* validateProfileId(providerId, rawProfile);\n\n    logWithLevel(\"DEBUG\", \"OAuth callback profile extracted\", {\n      providerId,\n      profileId: profile.id,\n    });\n\n    // 6. Compute signature for verifier validation\n    const state = storedState!;\n    const signature = getAuthorizationSignature({ codeVerifier, state });\n\n    return {\n      profile,\n      providerAccountId: profile.id,\n      cookies: resCookies,\n      signature,\n    };\n  });\n}\n"],"mappings":";;;;;;;;;;;;;;;;;AA+DA,MAAM,aAAa;AAEnB,SAAS,gBAAgB,MAAkC,YAAoB;AAE7E,SADe,CAAC,YAAY,QAAQ,IAAI,gBAAgB,GAAG,YAAY,MACvD,aAAa,UAAU;;AAGzC,SAAS,aACP,MACA,YACA,OACa;CACb,MAAM,0BAAU,IAAI,MAAM;AAC1B,SAAQ,QAAQ,QAAQ,SAAS,GAAG,aAAa,IAAK;AACtD,QAAO;EACL,MAAM,gBAAgB,MAAM,WAAW;EACvC;EACA,SAAS;GAAE,GAAG;GAAuB;GAAS;EAC/C;;AAGH,SAAS,YACP,MACA,YACa;AACb,QAAO;EACL,MAAM,gBAAgB,MAAM,WAAW;EACvC,OAAO;EACP,SAAS;GAAE,GAAG;GAAuB,QAAQ;GAAG;EACjD;;;;;;;AAYH,SAAgB,0BAA0B,EACxC,cACA,SAIC;AACD,QAAO,CAAC,cAAc,MAAM,CAAC,QAAQ,UAAU,UAAU,OAAU,CAAC,KAAK,IAAI;;;;;;;AAY/E,SAAS,eAAe,UAAwB;AAC9C,QACE,OAAO,SAAS,2BAA2B,cAC3C,SAAS,uBAAuB,UAAU;;;;;;AAY9C,SAAS,aACP,gBACA,MACA,cACoC;AACpC,QAAO,GAAG,KAAK;EACb,UACE,eAAe,eAAe,GAC1B,eAAe,0BAA0B,MAAM,aAAa,GAC5D,eAAe,0BAA0B,KAAK;EACpD,MAAM,MAAM;AACV,OAAI,aAAa,OAAO,mBACtB,QAAO,IAAI,UACT,wBACA,0BAA0B,EAAE,OAC7B;AAEH,OAAI,aAAa,OAAO,iBACtB,QAAO,IAAI,UACT,wBACA,wCAAwC,EAAE,UAC3C;AAKH,UAAO,IAAI,UACT,wBACA,2CAA2C,aAAa,QAAQ,EAAE,UAAU,OAAO,EAAE,GACtF;;EAEJ,CAAC,CAAC,KACD,GAAG,OAAO,WAAW;AAKnB,SAAO,GAAG,QAAQ,OAAO;GACzB,CACH;;;;;;AAOH,SAAS,eACP,YACA,aACA,QAC6B;CAC7B,MAAM,aACJ,cAAc,OAAO,QACrB,OAAQ,OAAO,KAAa,aAAa;CAC3C,MAAM,gBAAgB,YAAY,UAC9B,EAAE,QAAQ,YAAqB,GAC/B,aACE,EAAE,QAAQ,WAAoB,GAC9B,EAAE,QAAQ,WAAoB;AAEpC,QAAO,GAAG,MAAM,eAAe,cAAc,QAAQ;EACnD,WAAW,mBACT,GAAG,KAAK;GACN,UAAU,YAAY,QAAS,OAAO;GACtC,MAAM,MACJ,IAAI,UACF,yBACA,2BAA2B,aAAa,QAAQ,EAAE,UAAU,OAAO,EAAE,GACtE;GACJ,CAAC;EACJ,UAAU,mBAAmB;GAC3B,MAAM,SAAS,OAAO,cAAc,OAAO,SAAS,CAAC;AAIrD,UAAO,GAAG,QAAQ;IAChB,IAAK,OAAO,OAAkB,OAAO,YAAY;IACjD,MAAO,OAAO,QAAmB;IACjC,OAAQ,OAAO,SAAoB;IACnC,OAAQ,OAAO,WAAsB;IACtC,CAAC;;EAEJ,UAAU,mBACR,GAAG,KACD,IAAI,UACF,yBACA,aAAa,WAAW,6HAEzB,CACF;EACJ,CAAC;;;;;AAMJ,SAAS,kBACP,YACA,SAC6B;AAC7B,QAAO,OAAO,QAAQ,OAAO,YAAY,QAAQ,KAC7C,GAAG,QAAQ,QAAQ,GACnB,GAAG,KACD,IAAI,UACF,yBACA,6BAA6B,WAAW,qDACzC,CACF;;;;;;;;AAaP,eAAsB,4BACpB,YACA,gBACA,aAC8B;CAC9B,MAAM,QAAQ,OAAO,eAAe;CACpC,MAAM,UAAyB,EAAE;CACjC,IAAI;CAEJ,MAAM,SAAS,YAAY,UAAU,EAAE;CAEvC,IAAI;AAEJ,KAAI,eAAe,eAAe,EAAE;AAClC,iBAAe,OAAO,sBAAsB;AAC5C,QAAM,eAAe,uBAAuB,OAAO,cAAc,OAAO;AACxE,UAAQ,KAAK,aAAa,QAAQ,YAAY,aAAa,CAAC;OAE5D,OAAM,eAAe,uBAAuB,OAAO,OAAO;AAG5D,SAAQ,KAAK,aAAa,SAAS,YAAY,MAAM,CAAC;AAEtD,KAAI,YAAY,UAAU,MAAM;EAC9B,MAAM,QAAQ,OAAO,eAAe;AACpC,MAAI,aAAa,IAAI,SAAS,MAAM;AACpC,UAAQ,KAAK,aAAa,SAAS,YAAY,MAAM,CAAC;;AAGxD,cAAa,SAAS,mCAAmC;EACvD,KAAK,IAAI,UAAU;EACnB;EACA,SAAS,CAAC,CAAC;EACZ,CAAC;CAEF,MAAM,YAAY,0BAA0B;EAAE;EAAc;EAAO,CAAC;AAEpE,QAAO;EACL,UAAU,IAAI,UAAU;EACxB;EACA;EACD;;;;;;;;;AAcH,SAAgB,oBACd,YACA,gBACA,aACA,QACA,SAC+B;AAC/B,QAAO,GAAG,IAAI,aAAa;EACzB,MAAM,aAA4B,EAAE;EAIpC,MAAM,cAAc,QADI,gBAAgB,SAAS,WAAW;EAE5D,MAAM,gBAAgB,OAAO;AAE7B,SAAO,GAAG,MACR,CAAC,eAAe,CAAC,iBAAiB,gBAAgB,eAClD,GAAG,KAAK,IAAI,UAAU,sBAAsB,CAAC,CAC9C;AACD,aAAW,KAAK,YAAY,SAAS,WAAW,CAAC;AAGjD,MAAI,OAAO,OAAO;GAChB,MAAM,QAAQ;IACZ;IACA,OAAO,OAAO;IACd,mBAAmB,OAAO;IAC3B;AACD,gBAAa,SAAS,sBAAsB,MAAM;AAClD,UAAO,GAAG,KACR,IAAI,UACF,wBACA,oCACA,EACE,OAAO,KAAK,UAAU,MAAM,EAC7B,CACF,CACF;;EAIH,MAAM,OAAO,OAAO,OAAO,QAAQ,OAC/B,GAAG,QAAQ,OAAO,KAAK,GACvB,GAAG,KACD,IAAI,UACF,wBACA,yCACD,CACF;EAGL,IAAI;AACJ,MAAI,eAAe,eAAe,EAAE;GAClC,MAAM,iBAAiB,gBAAgB,QAAQ,WAAW;AAC1D,kBAAe,OAAO,QAAQ,mBAAmB,OAC7C,GAAG,QAAQ,QAAQ,gBAAiB,GACpC,GAAG,KACD,IAAI,UACF,0BACA,kDACD,CACF;AACL,cAAW,KAAK,YAAY,QAAQ,WAAW,CAAC;;EAGlD,IAAI;AACJ,MAAI,YAAY,UAAU,MAAM;GAC9B,MAAM,kBAAkB,gBAAgB,SAAS,WAAW;AAC5D,WAAQ,OAAO,QAAQ,oBAAoB,OACvC,GAAG,QAAQ,QAAQ,iBAAkB,GACrC,GAAG,KACD,IAAI,UACF,wBACA,0CACD,CACF;AACL,cAAW,KAAK,YAAY,SAAS,WAAW,CAAC;;EAInD,MAAM,SAAS,OAAO,aAAa,gBAAgB,MAAM,aAAa;AAEtE,MAAI,YAAY,mBAAmB,OACjC,QAAO,GAAG,KAAK;GACb,UAAU,YAAY,eAAgB,QAAQ,EAAE,OAAO,CAAC;GACxD,MAAM,MACJ,IAAI,UACF,wBACA,4BAA4B,aAAa,QAAQ,EAAE,UAAU,OAAO,EAAE,GACvE;GACJ,CAAC;EAKJ,MAAM,UAAU,OAAO,kBAAkB,YADtB,OAAO,eAAe,YAAY,aAAa,OAAO,CACT;AAEhE,eAAa,SAAS,oCAAoC;GACxD;GACA,WAAW,QAAQ;GACpB,CAAC;EAIF,MAAM,YAAY,0BAA0B;GAAE;GAAc,OAD9C;GACqD,CAAC;AAEpE,SAAO;GACL;GACA,mBAAmB,QAAQ;GAC3B,SAAS;GACT;GACD;GACD"}

package/dist/server/passkey.d.ts

@@ -1,5 +1,5 @@
 import { AuthDataModel, GenericActionCtxWithAuthConfig, PasskeyProviderConfig, SessionInfo } from "./types.js";
-import { AuthError } from "./fx.js";
+import { AuthError } from "./authError.js";
 import { Fx } from "@robelest/fx";
 
 //#region src/server/passkey.d.ts
@@ -23,5 +23,5 @@ declare function handlePasskeyFx(ctx: EnrichedActionCtx, provider: PasskeyProvid
   verifier?: string;
 }): Fx<PasskeyResult, AuthError>;
 //#endregion
-export { handlePasskeyFx as handlePasskey, handlePasskeyFx };
+export { handlePasskeyFx };
 //# sourceMappingURL=passkey.d.ts.map

package/dist/server/passkey.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"passkey.d.ts","names":[],"sources":["../../src/server/passkey.ts"],"mappings":";;;;;KAiEK,iBAAA,GAAoB,8BAAA,CAA+B,aAAA;;KAoKnD,aAAA;EACC,IAAA;EAAkB,QAAA,EAAU,WAAA;AAAA;EAC5B,IAAA;EAAwB,OAAA,EAAS,MAAA;EAAqB,QAAA;AAAA;;;;;;iBAgD5C,eAAA,CACd,GAAA,EAAK,iBAAA,EACL,QAAA,EAAU,qBAAA,EACV,IAAA;EACE,MAAA,GAAS,MAAA;EACT,QAAA;AAAA,IAED,EAAA,CAAO,aAAA,EAAe,SAAA"}
+{"version":3,"file":"passkey.d.ts","names":[],"sources":["../../src/server/passkey.ts"],"mappings":";;;;;KAmEK,iBAAA,GAAoB,8BAAA,CAA+B,aAAA;;KAoKnD,aAAA;EACC,IAAA;EAAkB,QAAA,EAAU,WAAA;AAAA;EAC5B,IAAA;EAAwB,OAAA,EAAS,MAAA;EAAqB,QAAA;AAAA;;;;;;iBAgD5C,eAAA,CACd,GAAA,EAAK,iBAAA,EACL,QAAA,EAAU,qBAAA,EACV,IAAA;EACE,MAAA,GAAS,MAAA;EACT,QAAA;AAAA,IAED,EAAA,CAAO,aAAA,EAAe,SAAA"}

package/dist/server/passkey.js

@@ -1,10 +1,11 @@
-import { AuthError, Fx } from "./fx.js";
+import { AuthError } from "./authError.js";
 import { userIdFromIdentitySubject } from "./identity.js";
 import { authDb } from "./db.js";
 import { callVerifierSignature } from "./mutations/signature.js";
 import { callSignIn } from "./mutations/signin.js";
 import { callVerifier } from "./mutations/verifier.js";
 import { mutatePasskeyInsert, mutatePasskeyUpdateCounter, mutateVerifierDelete, queryPasskeyByCredentialId, queryPasskeysByUserId, queryUserById, queryUserByVerifiedEmail, queryVerifierById } from "./types.js";
+import { Fx } from "@robelest/fx";
 import { sha256 } from "@oslojs/crypto/sha2";
 import { decodeBase64urlIgnorePadding, encodeBase64urlNoPadding } from "@oslojs/encoding";
 import { decodePKIXECDSASignature, decodeSEC1PublicKey, p256, verifyECDSASignature } from "@oslojs/crypto/ecdsa";
@@ -323,5 +324,5 @@ function handlePasskeyFx(ctx, provider, args) {
 }
 
 //#endregion
-export { handlePasskeyFx as handlePasskey, handlePasskeyFx };
+export { handlePasskeyFx };
 //# sourceMappingURL=passkey.js.map

package/dist/server/passkey.js.map

@@ -1 +1 @@
-{"version":3,"file":"passkey.js","names":["hasSiteUrl","hasRpId","siteUrl"],"sources":["../../src/server/passkey.ts"],"sourcesContent":["/**\n * Server-side WebAuthn ceremony logic for passkey authentication.\n *\n * Handles the four phases of the WebAuthn flow:\n * 1. registerOptions — generate PublicKeyCredentialCreationOptions\n * 2. registerVerify — verify attestation and store credential\n * 3. authOptions — generate PublicKeyCredentialRequestOptions\n * 4. authVerify — verify assertion signature and sign in\n *\n * Uses `@oslojs/webauthn` for attestation/assertion parsing and\n * `@oslojs/crypto` for signature verification.\n *\n * All functions return `Fx<A, AuthError>` composed via `Fx.chain` pipelines.\n *\n * @module\n */\n\nimport {\n  p256,\n  verifyECDSASignature,\n  decodeSEC1PublicKey,\n  decodePKIXECDSASignature,\n} from \"@oslojs/crypto/ecdsa\";\nimport {\n  RSAPublicKey,\n  decodePKCS1RSAPublicKey,\n  sha256ObjectIdentifier,\n  verifyRSASSAPKCS1v15Signature,\n} from \"@oslojs/crypto/rsa\";\nimport { sha256 } from \"@oslojs/crypto/sha2\";\nimport {\n  encodeBase64urlNoPadding,\n  decodeBase64urlIgnorePadding,\n} from \"@oslojs/encoding\";\nimport {\n  parseAttestationObject,\n  parseClientDataJSON,\n  parseAuthenticatorData,\n  createAssertionSignatureMessage,\n  ClientDataType,\n  coseAlgorithmES256,\n  coseAlgorithmRS256,\n  COSEKeyType,\n} from \"@oslojs/webauthn\";\nimport type { Fx as FxType } from \"@robelest/fx\";\n\nimport { authDb } from \"./db\";\nimport { AuthError, Fx } from \"./fx\";\nimport { userIdFromIdentitySubject } from \"./identity\";\nimport { callSignIn, callVerifier } from \"./mutations/index\";\nimport { callVerifierSignature } from \"./mutations/signature\";\nimport { PasskeyProviderConfig, GenericActionCtxWithAuthConfig } from \"./types\";\nimport {\n  AuthDataModel,\n  SessionInfo,\n  queryUserById,\n  queryUserByVerifiedEmail,\n  queryPasskeysByUserId,\n  queryPasskeyByCredentialId,\n  queryVerifierById,\n  mutatePasskeyInsert,\n  mutatePasskeyUpdateCounter,\n  mutateVerifierDelete,\n} from \"./types\";\n\ntype EnrichedActionCtx = GenericActionCtxWithAuthConfig<AuthDataModel>;\n\n// ============================================================================\n// Resolve RP options — Fx pipeline with validation\n// ============================================================================\n\n/** Resolved relying party configuration. */\ninterface RpOptions {\n  rpName: string;\n  rpId: string;\n  origin: string | string[];\n  attestation: string;\n  userVerification: string;\n  residentKey: string;\n  authenticatorAttachment?: string;\n  algorithms: number[];\n  challengeExpirationMs: number;\n}\n\n/**\n * Resolve passkey relying party options from provider config and environment.\n *\n * Returns `Fx<RpOptions, AuthError>` — fails if neither SITE_URL nor rpId\n * is configured.\n */\nconst resolveRpOptionsFx = (\n  provider: PasskeyProviderConfig,\n): FxType<RpOptions, AuthError> => {\n  const siteUrl = process.env.SITE_URL;\n  const hasSiteUrl = siteUrl !== undefined && siteUrl !== \"\";\n  const hasRpId = provider.options.rpId !== undefined;\n\n  return Fx.succeed({ siteUrl, hasSiteUrl, hasRpId }).pipe(\n    Fx.chain(({ siteUrl, hasSiteUrl, hasRpId }) =>\n      !hasSiteUrl && !hasRpId\n        ? Fx.fail(\n            new AuthError(\n              \"PASSKEY_MISSING_CONFIG\",\n              \"Passkey provider requires SITE_URL env var (your frontend URL) \" +\n                \"or explicit rpId / origin in the provider config. \" +\n                \"CONVEX_SITE_URL cannot be used because WebAuthn RP ID must match the frontend domain.\",\n            ),\n          )\n        : Fx.succeed(siteUrl),\n    ),\n    Fx.map((siteUrl) => {\n      const siteHostname = siteUrl ? new URL(siteUrl).hostname : undefined;\n      return {\n        rpName: provider.options.rpName ?? siteHostname ?? \"localhost\",\n        rpId: provider.options.rpId ?? siteHostname ?? \"localhost\",\n        origin: provider.options.origin ?? siteUrl ?? \"http://localhost\",\n        attestation: provider.options.attestation ?? \"none\",\n        userVerification: provider.options.userVerification ?? \"required\",\n        residentKey: provider.options.residentKey ?? \"preferred\",\n        authenticatorAttachment: provider.options.authenticatorAttachment,\n        algorithms: provider.options.algorithms ?? [\n          coseAlgorithmES256,\n          coseAlgorithmRS256,\n        ],\n        challengeExpirationMs:\n          provider.options.challengeExpirationMs ?? 300_000,\n      };\n    }),\n  );\n};\n\n// ============================================================================\n// Composable validators — small functions (A) => Fx<B, AuthError>\n// ============================================================================\n\n/** Verify client data type matches expected WebAuthn ceremony type. */\nconst verifyClientDataType =\n  <T extends { type: ClientDataType }>(\n    expectedType: ClientDataType,\n    label: string,\n  ) =>\n  (clientData: T): FxType<T, AuthError> =>\n    clientData.type === expectedType\n      ? Fx.succeed(clientData)\n      : Fx.fail(\n          new AuthError(\n            \"PASSKEY_INVALID_CLIENT_DATA\",\n            `Invalid client data type: expected ${label}`,\n          ),\n        );\n\n/** Verify origin is in the allowed list. */\nconst verifyOrigin =\n  (rp: RpOptions) =>\n  <T extends { origin: string }>(clientData: T): FxType<T, AuthError> => {\n    const allowed = Array.isArray(rp.origin) ? rp.origin : [rp.origin];\n    return allowed.includes(clientData.origin)\n      ? Fx.succeed(clientData)\n      : Fx.fail(\n          new AuthError(\n            \"PASSKEY_INVALID_ORIGIN\",\n            `Invalid origin: ${clientData.origin}, expected one of: ${allowed.join(\", \")}`,\n          ),\n        );\n  };\n\n/** Verify the challenge hash matches the stored verifier, then delete verifier. */\nconst verifyAndConsumeChallenge =\n  (ctx: EnrichedActionCtx, verifierValue: string) =>\n  <T extends { challenge: Uint8Array }>(\n    clientData: T,\n  ): FxType<T, AuthError> => {\n    const challengeHash = encodeBase64urlNoPadding(\n      new Uint8Array(sha256(clientData.challenge)),\n    );\n    return Fx.from({\n      ok: () => queryVerifierById(ctx, verifierValue),\n      err: () => new AuthError(\"PASSKEY_INVALID_CHALLENGE\"),\n    }).pipe(\n      Fx.chain((doc) =>\n        !doc || doc.signature !== challengeHash\n          ? Fx.fail(new AuthError(\"PASSKEY_INVALID_CHALLENGE\"))\n          : Fx.succeed(doc),\n      ),\n      Fx.chain(() =>\n        Fx.from({\n          ok: () => mutateVerifierDelete(ctx, verifierValue),\n          err: () => new AuthError(\"PASSKEY_INVALID_CHALLENGE\"),\n        }),\n      ),\n      Fx.map(() => clientData),\n    );\n  };\n\n/** Verify RP ID hash matches. */\nconst verifyRpId =\n  (rpId: string) =>\n  <T extends { verifyRelyingPartyIdHash: (id: string) => boolean }>(\n    authData: T,\n  ): FxType<T, AuthError> =>\n    authData.verifyRelyingPartyIdHash(rpId)\n      ? Fx.succeed(authData)\n      : Fx.fail(new AuthError(\"PASSKEY_RP_MISMATCH\"));\n\n/** Verify user presence and (optionally) user verification flags. */\nconst verifyUserFlags =\n  (rp: RpOptions) =>\n  <T extends { userPresent: boolean; userVerified: boolean }>(\n    authData: T,\n  ): FxType<T, AuthError> =>\n    !authData.userPresent\n      ? Fx.fail(new AuthError(\"PASSKEY_USER_PRESENCE\"))\n      : rp.userVerification === \"required\" && !authData.userVerified\n        ? Fx.fail(new AuthError(\"PASSKEY_USER_VERIFICATION\"))\n        : Fx.succeed(authData);\n\n// ============================================================================\n// Registration flow\n// ============================================================================\n\n// ============================================================================\n// Authentication flow\n// ============================================================================\n\n// ============================================================================\n// Main dispatch\n// ============================================================================\n\n/** Result type for all passkey flows. */\ntype PasskeyResult =\n  | { kind: \"signedIn\"; signedIn: SessionInfo | null }\n  | { kind: \"passkeyOptions\"; options: Record<string, any>; verifier: string };\n\nconst PASSKEY_FLOW = {\n  registerOptions: \"registerOptions\",\n  registerVerify: \"registerVerify\",\n  authOptions: \"authOptions\",\n  authVerify: \"authVerify\",\n} as const;\n\nconst PASSKEY_FLOWS = [\n  PASSKEY_FLOW.registerOptions,\n  PASSKEY_FLOW.registerVerify,\n  PASSKEY_FLOW.authOptions,\n  PASSKEY_FLOW.authVerify,\n] as const;\n\ntype PasskeyDispatch =\n  | { flow: typeof PASSKEY_FLOW.registerOptions }\n  | { flow: typeof PASSKEY_FLOW.registerVerify }\n  | { flow: typeof PASSKEY_FLOW.authOptions }\n  | { flow: typeof PASSKEY_FLOW.authVerify };\n\nconst resolvePasskeyDispatchFx = (\n  params: Record<string, unknown>,\n): FxType<PasskeyDispatch, AuthError> => {\n  const flow = params.flow;\n  return typeof flow === \"string\" && PASSKEY_FLOWS.includes(flow as never)\n    ? Fx.succeed({ flow: flow as (typeof PASSKEY_FLOWS)[number] })\n    : Fx.fail(\n        new AuthError(\n          \"PASSKEY_MISSING_FLOW\",\n          \"Missing `flow` parameter. Expected one of: registerOptions, registerVerify, authOptions, authVerify\",\n        ),\n      );\n};\n\nconst requirePasskeyVerifierFx = (\n  verifier: string | undefined,\n): FxType<string, AuthError> =>\n  verifier != null\n    ? Fx.succeed(verifier)\n    : Fx.fail(new AuthError(\"PASSKEY_MISSING_VERIFIER\"));\n\n/**\n * Main passkey handler dispatched from signIn.ts.\n *\n * Routes to the appropriate phase based on `params.flow` via `dispatchFx`.\n */\nexport function handlePasskeyFx(\n  ctx: EnrichedActionCtx,\n  provider: PasskeyProviderConfig,\n  args: {\n    params?: Record<string, any>;\n    verifier?: string;\n  },\n): FxType<PasskeyResult, AuthError> {\n  const params = (args.params ?? {}) as Record<string, any>;\n\n  return resolvePasskeyDispatchFx(params).pipe(\n    Fx.chain((dispatch) => {\n      const flowFx: FxType<PasskeyResult, AuthError> = Fx.match(dispatch).on(\n        \"flow\",\n        {\n          registerOptions: (_) =>\n            Fx.zip(\n              Fx.from({\n                ok: () => ctx.auth.getUserIdentity(),\n                err: () => new AuthError(\"PASSKEY_AUTH_REQUIRED\"),\n              }).pipe(\n                Fx.chain((id) =>\n                  id === null\n                    ? Fx.fail(new AuthError(\"PASSKEY_AUTH_REQUIRED\"))\n                    : Fx.succeed(userIdFromIdentitySubject(id.subject)),\n                ),\n              ),\n              resolveRpOptionsFx(provider),\n            ).pipe(\n              Fx.chain(([userId, rp]) => {\n                const challenge = new Uint8Array(32);\n                crypto.getRandomValues(challenge);\n                const challengeHash = encodeBase64urlNoPadding(\n                  new Uint8Array(sha256(challenge)),\n                );\n\n                return Fx.from({\n                  ok: async () => {\n                    const verifier = await callVerifier(ctx);\n                    await callVerifierSignature(ctx, {\n                      verifier,\n                      signature: challengeHash,\n                    });\n\n                    const user = await queryUserById(ctx, userId);\n                    const userName = params.userName ?? user?.email ?? \"user\";\n                    const userDisplayName =\n                      params.userDisplayName ?? user?.name ?? userName;\n\n                    const existing = await queryPasskeysByUserId(ctx, userId);\n                    const excludeCredentials = existing.map((pk) => ({\n                      id: pk.credentialId,\n                      transports: pk.transports,\n                    }));\n\n                    const userHandle = encodeBase64urlNoPadding(\n                      new TextEncoder().encode(userId),\n                    );\n\n                    const options = {\n                      rp: { name: rp.rpName, id: rp.rpId },\n                      user: {\n                        id: userHandle,\n                        name: userName,\n                        displayName: userDisplayName,\n                      },\n                      challenge: encodeBase64urlNoPadding(challenge),\n                      pubKeyCredParams: rp.algorithms.map((alg) => ({\n                        type: \"public-key\" as const,\n                        alg,\n                      })),\n                      timeout: rp.challengeExpirationMs,\n                      attestation: rp.attestation,\n                      authenticatorSelection: {\n                        residentKey: rp.residentKey,\n                        requireResidentKey: rp.residentKey === \"required\",\n                        userVerification: rp.userVerification,\n                        ...(rp.authenticatorAttachment\n                          ? {\n                              authenticatorAttachment:\n                                rp.authenticatorAttachment,\n                            }\n                          : {}),\n                      },\n                      excludeCredentials,\n                    };\n\n                    return {\n                      kind: \"passkeyOptions\" as const,\n                      options,\n                      verifier,\n                    };\n                  },\n                  err: () => new AuthError(\"INTERNAL_ERROR\"),\n                });\n              }),\n            ),\n          registerVerify: (_) =>\n            Fx.zip(\n              Fx.from({\n                ok: () => ctx.auth.getUserIdentity(),\n                err: () => new AuthError(\"PASSKEY_AUTH_REQUIRED\"),\n              }).pipe(\n                Fx.chain((id) =>\n                  id === null\n                    ? Fx.fail(new AuthError(\"PASSKEY_AUTH_REQUIRED\"))\n                    : Fx.succeed(userIdFromIdentitySubject(id.subject)),\n                ),\n              ),\n              resolveRpOptionsFx(provider),\n            ).pipe(\n              Fx.chain(([userId, rp]) =>\n                requirePasskeyVerifierFx(args.verifier).pipe(\n                  Fx.chain((verifier) => {\n                    const clientDataJSON = decodeBase64urlIgnorePadding(\n                      params.clientDataJSON,\n                    );\n                    const clientData = parseClientDataJSON(clientDataJSON);\n\n                    const verifiedClientDataFx = Fx.succeed(clientData).pipe(\n                      Fx.chain(\n                        verifyClientDataType(\n                          ClientDataType.Create,\n                          \"webauthn.create\",\n                        ),\n                      ),\n                      Fx.chain(verifyOrigin(rp)),\n                      Fx.chain(verifyAndConsumeChallenge(ctx, verifier)),\n                      Fx.map(() => {\n                        const attestationObjectBytes =\n                          decodeBase64urlIgnorePadding(\n                            params.attestationObject,\n                          );\n                        const attestation = parseAttestationObject(\n                          attestationObjectBytes,\n                        );\n                        return attestation.authenticatorData;\n                      }),\n                    );\n\n                    return verifiedClientDataFx.pipe(\n                      Fx.chain(verifyRpId(rp.rpId)),\n                      Fx.chain(verifyUserFlags(rp)),\n                      Fx.chain((authData) => {\n                        if (authData.credential == null) {\n                          return Fx.fail(\n                            new AuthError(\"PASSKEY_NO_CREDENTIAL\"),\n                          );\n                        }\n                        return Fx.succeed({\n                          authData,\n                          credential: authData.credential,\n                        });\n                      }),\n                      Fx.chain(({ authData, credential }) => {\n                        const credentialId = encodeBase64urlNoPadding(\n                          credential.id,\n                        );\n                        const publicKey = credential.publicKey;\n\n                        let algorithm: number;\n                        if (publicKey.isAlgorithmDefined()) {\n                          algorithm = publicKey.algorithm();\n                        } else {\n                          const keyType = publicKey.type();\n                          algorithm =\n                            keyType === COSEKeyType.EC2\n                              ? coseAlgorithmES256\n                              : keyType === COSEKeyType.RSA\n                                ? coseAlgorithmRS256\n                                : coseAlgorithmES256;\n                        }\n\n                        const handlers: Record<\n                          number,\n                          (() => FxType<Uint8Array, AuthError>) | undefined\n                        > = {\n                          [coseAlgorithmES256]: () => {\n                            const ec2 = publicKey.ec2();\n                            const xBytes = new Uint8Array(32);\n                            let vx = ec2.x;\n                            for (let i = 31; i >= 0; i--) {\n                              xBytes[i] = Number(vx & 0xffn);\n                              vx >>= 8n;\n                            }\n                            const yBytes = new Uint8Array(32);\n                            let vy = ec2.y;\n                            for (let i = 31; i >= 0; i--) {\n                              yBytes[i] = Number(vy & 0xffn);\n                              vy >>= 8n;\n                            }\n                            const bytes = new Uint8Array(65);\n                            bytes[0] = 0x04;\n                            bytes.set(xBytes, 1);\n                            bytes.set(yBytes, 33);\n                            return Fx.succeed(bytes);\n                          },\n                          [coseAlgorithmRS256]: () => {\n                            const rsa = publicKey.rsa();\n                            const rsaPubKey = new RSAPublicKey(rsa.n, rsa.e);\n                            return Fx.succeed(rsaPubKey.encodePKCS1());\n                          },\n                        };\n\n                        const handler = handlers[algorithm];\n                        return (\n                          handler\n                            ? handler()\n                            : Fx.fail(\n                                new AuthError(\n                                  \"PASSKEY_UNSUPPORTED_ALGORITHM\",\n                                  `Unsupported algorithm: ${algorithm}`,\n                                ),\n                              )\n                        ).pipe(\n                          Fx.chain((publicKeyBytes) =>\n                            Fx.from({\n                              ok: async () => {\n                                const deviceType =\n                                  params.deviceType ?? \"single-device\";\n                                const backedUp = params.backedUp ?? false;\n\n                                const db = authDb(ctx, ctx.auth.config);\n                                await db.accounts.create({\n                                  userId,\n                                  provider: provider.id,\n                                  providerAccountId: credentialId,\n                                });\n\n                                await mutatePasskeyInsert(ctx, {\n                                  userId,\n                                  credentialId,\n                                  publicKey: publicKeyBytes.buffer.slice(\n                                    publicKeyBytes.byteOffset,\n                                    publicKeyBytes.byteOffset +\n                                      publicKeyBytes.byteLength,\n                                  ),\n                                  algorithm,\n                                  counter: authData.signatureCounter,\n                                  transports: params.transports,\n                                  deviceType,\n                                  backedUp,\n                                  name: params.passkeyName,\n                                  createdAt: Date.now(),\n                                });\n\n                                const signInResult = await callSignIn(ctx, {\n                                  userId,\n                                  generateTokens: true,\n                                });\n\n                                return {\n                                  kind: \"signedIn\" as const,\n                                  signedIn: signInResult,\n                                };\n                              },\n                              err: () => new AuthError(\"INTERNAL_ERROR\"),\n                            }),\n                          ),\n                        );\n                      }),\n                    );\n                  }),\n                ),\n              ),\n            ),\n          authOptions: (_) =>\n            resolveRpOptionsFx(provider).pipe(\n              Fx.chain((rp) => {\n                const challenge = new Uint8Array(32);\n                crypto.getRandomValues(challenge);\n                const challengeHash = encodeBase64urlNoPadding(\n                  new Uint8Array(sha256(challenge)),\n                );\n\n                return Fx.from({\n                  ok: async () => {\n                    const verifier = await callVerifier(ctx);\n                    await callVerifierSignature(ctx, {\n                      verifier,\n                      signature: challengeHash,\n                    });\n\n                    let allowCredentials:\n                      | Array<{\n                          type: string;\n                          id: string;\n                          transports?: string[];\n                        }>\n                      | undefined;\n                    if (params.email) {\n                      const user = await queryUserByVerifiedEmail(\n                        ctx,\n                        params.email,\n                      );\n                      if (user) {\n                        const passkeys = await queryPasskeysByUserId(\n                          ctx,\n                          user._id,\n                        );\n                        if (passkeys.length > 0) {\n                          allowCredentials = passkeys.map((pk) => ({\n                            type: \"public-key\",\n                            id: pk.credentialId,\n                            transports: pk.transports,\n                          }));\n                        }\n                      }\n                    }\n\n                    const options: Record<string, any> = {\n                      challenge: encodeBase64urlNoPadding(challenge),\n                      timeout: rp.challengeExpirationMs,\n                      rpId: rp.rpId,\n                      userVerification: rp.userVerification,\n                    };\n\n                    if (allowCredentials) {\n                      options.allowCredentials = allowCredentials;\n                    }\n\n                    return {\n                      kind: \"passkeyOptions\" as const,\n                      options,\n                      verifier,\n                    };\n                  },\n                  err: () => new AuthError(\"INTERNAL_ERROR\"),\n                });\n              }),\n            ),\n          authVerify: (_) =>\n            Fx.zip(\n              resolveRpOptionsFx(provider),\n              requirePasskeyVerifierFx(args.verifier),\n            ).pipe(\n              Fx.chain(([rp, verifier]) => {\n                const clientDataJSON = decodeBase64urlIgnorePadding(\n                  params.clientDataJSON,\n                );\n                const clientData = parseClientDataJSON(clientDataJSON);\n\n                const verifiedClientDataFx = Fx.succeed(clientData).pipe(\n                  Fx.chain(\n                    verifyClientDataType(ClientDataType.Get, \"webauthn.get\"),\n                  ),\n                  Fx.chain(verifyOrigin(rp)),\n                  Fx.chain(verifyAndConsumeChallenge(ctx, verifier)),\n                  Fx.chain(() =>\n                    params.credentialId != null\n                      ? Fx.succeed(params.credentialId as string)\n                      : Fx.fail(\n                          new AuthError(\n                            \"PASSKEY_UNKNOWN_CREDENTIAL\",\n                            \"Missing credential ID\",\n                          ),\n                        ),\n                  ),\n                );\n\n                return verifiedClientDataFx.pipe(\n                  Fx.chain((credentialId) =>\n                    Fx.from({\n                      ok: () => queryPasskeyByCredentialId(ctx, credentialId),\n                      err: () => new AuthError(\"PASSKEY_UNKNOWN_CREDENTIAL\"),\n                    }).pipe(\n                      Fx.chain((passkey) =>\n                        passkey\n                          ? Fx.succeed(passkey)\n                          : Fx.fail(\n                              new AuthError(\n                                \"PASSKEY_UNKNOWN_CREDENTIAL\",\n                                \"Unknown credential\",\n                              ),\n                            ),\n                      ),\n                    ),\n                  ),\n                  Fx.chain((passkey) => {\n                    const authenticatorDataBytes = decodeBase64urlIgnorePadding(\n                      params.authenticatorData,\n                    );\n                    const authenticatorData = parseAuthenticatorData(\n                      authenticatorDataBytes,\n                    );\n\n                    const signature = decodeBase64urlIgnorePadding(\n                      params.signature,\n                    );\n                    const signatureMessage = createAssertionSignatureMessage(\n                      authenticatorDataBytes,\n                      clientDataJSON,\n                    );\n                    const messageHash = sha256(signatureMessage);\n\n                    const checkedAuthenticatorFx = Fx.succeed(\n                      authenticatorData,\n                    ).pipe(\n                      Fx.chain(verifyRpId(rp.rpId)),\n                      Fx.chain(verifyUserFlags(rp)),\n                    );\n\n                    const signatureVerifiedFx = checkedAuthenticatorFx.pipe(\n                      Fx.chain(() => {\n                        const storedPublicKeyBytes = new Uint8Array(\n                          passkey.publicKey,\n                        );\n                        const algorithmHandlers: Record<\n                          number,\n                          (() => FxType<void, AuthError>) | undefined\n                        > = {\n                          [coseAlgorithmES256]: () => {\n                            const ecPublicKey = decodeSEC1PublicKey(\n                              p256,\n                              storedPublicKeyBytes,\n                            );\n                            const ecdsaSignature =\n                              decodePKIXECDSASignature(signature);\n                            const valid = verifyECDSASignature(\n                              ecPublicKey,\n                              messageHash,\n                              ecdsaSignature,\n                            );\n                            return valid\n                              ? Fx.succeed(undefined as void)\n                              : Fx.fail(\n                                  new AuthError(\"PASSKEY_INVALID_SIGNATURE\"),\n                                );\n                          },\n                          [coseAlgorithmRS256]: () => {\n                            const rsaPublicKey =\n                              decodePKCS1RSAPublicKey(storedPublicKeyBytes);\n                            const valid = verifyRSASSAPKCS1v15Signature(\n                              rsaPublicKey,\n                              sha256ObjectIdentifier,\n                              messageHash,\n                              signature,\n                            );\n                            return valid\n                              ? Fx.succeed(undefined as void)\n                              : Fx.fail(\n                                  new AuthError(\"PASSKEY_INVALID_SIGNATURE\"),\n                                );\n                          },\n                        };\n\n                        const handler = algorithmHandlers[passkey.algorithm];\n                        return handler\n                          ? handler()\n                          : Fx.fail(\n                              new AuthError(\n                                \"PASSKEY_UNSUPPORTED_ALGORITHM\",\n                                `Unsupported algorithm: ${passkey.algorithm}`,\n                              ),\n                            );\n                      }),\n                    );\n\n                    const counterValidatedFx = signatureVerifiedFx.pipe(\n                      Fx.chain(() =>\n                        passkey.counter !== 0 &&\n                        authenticatorData.signatureCounter !== 0 &&\n                        authenticatorData.signatureCounter <= passkey.counter\n                          ? Fx.fail(new AuthError(\"PASSKEY_COUNTER_ERROR\"))\n                          : Fx.succeed(authenticatorData),\n                      ),\n                    );\n\n                    return counterValidatedFx.pipe(\n                      Fx.chain(() =>\n                        Fx.from({\n                          ok: async () => {\n                            await mutatePasskeyUpdateCounter(\n                              ctx,\n                              passkey._id,\n                              authenticatorData.signatureCounter,\n                              Date.now(),\n                            );\n\n                            const signInResult = await callSignIn(ctx, {\n                              userId: passkey.userId,\n                              generateTokens: true,\n                            });\n\n                            return {\n                              kind: \"signedIn\" as const,\n                              signedIn: signInResult,\n                            };\n                          },\n                          err: () => new AuthError(\"INTERNAL_ERROR\"),\n                        }),\n                      ),\n                    );\n                  }),\n                );\n              }),\n            ),\n        },\n      );\n      return flowFx;\n    }),\n  );\n}\n\n// Keep backward-compatible export name — callers can migrate to handlePasskeyFx\nexport { handlePasskeyFx as handlePasskey };\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AA0FA,MAAM,sBACJ,aACiC;CACjC,MAAM,UAAU,QAAQ,IAAI;CAC5B,MAAM,aAAa,YAAY,UAAa,YAAY;CACxD,MAAM,UAAU,SAAS,QAAQ,SAAS;AAE1C,QAAO,GAAG,QAAQ;EAAE;EAAS;EAAY;EAAS,CAAC,CAAC,KAClD,GAAG,OAAO,EAAE,oBAAS,0BAAY,yBAC/B,CAACA,gBAAc,CAACC,YACZ,GAAG,KACD,IAAI,UACF,0BACA,yMAGD,CACF,GACD,GAAG,QAAQC,UAAQ,CACxB,EACD,GAAG,KAAK,cAAY;EAClB,MAAM,eAAeA,YAAU,IAAI,IAAIA,UAAQ,CAAC,WAAW;AAC3D,SAAO;GACL,QAAQ,SAAS,QAAQ,UAAU,gBAAgB;GACnD,MAAM,SAAS,QAAQ,QAAQ,gBAAgB;GAC/C,QAAQ,SAAS,QAAQ,UAAUA,aAAW;GAC9C,aAAa,SAAS,QAAQ,eAAe;GAC7C,kBAAkB,SAAS,QAAQ,oBAAoB;GACvD,aAAa,SAAS,QAAQ,eAAe;GAC7C,yBAAyB,SAAS,QAAQ;GAC1C,YAAY,SAAS,QAAQ,cAAc,CACzC,oBACA,mBACD;GACD,uBACE,SAAS,QAAQ,yBAAyB;GAC7C;GACD,CACH;;;AAQH,MAAM,wBAEF,cACA,WAED,eACC,WAAW,SAAS,eAChB,GAAG,QAAQ,WAAW,GACtB,GAAG,KACD,IAAI,UACF,+BACA,sCAAsC,QACvC,CACF;;AAGT,MAAM,gBACH,QAC8B,eAAwC;CACrE,MAAM,UAAU,MAAM,QAAQ,GAAG,OAAO,GAAG,GAAG,SAAS,CAAC,GAAG,OAAO;AAClE,QAAO,QAAQ,SAAS,WAAW,OAAO,GACtC,GAAG,QAAQ,WAAW,GACtB,GAAG,KACD,IAAI,UACF,0BACA,mBAAmB,WAAW,OAAO,qBAAqB,QAAQ,KAAK,KAAK,GAC7E,CACF;;;AAIT,MAAM,6BACH,KAAwB,mBAEvB,eACyB;CACzB,MAAM,gBAAgB,yBACpB,IAAI,WAAW,OAAO,WAAW,UAAU,CAAC,CAC7C;AACD,QAAO,GAAG,KAAK;EACb,UAAU,kBAAkB,KAAK,cAAc;EAC/C,WAAW,IAAI,UAAU,4BAA4B;EACtD,CAAC,CAAC,KACD,GAAG,OAAO,QACR,CAAC,OAAO,IAAI,cAAc,gBACtB,GAAG,KAAK,IAAI,UAAU,4BAA4B,CAAC,GACnD,GAAG,QAAQ,IAAI,CACpB,EACD,GAAG,YACD,GAAG,KAAK;EACN,UAAU,qBAAqB,KAAK,cAAc;EAClD,WAAW,IAAI,UAAU,4BAA4B;EACtD,CAAC,CACH,EACD,GAAG,UAAU,WAAW,CACzB;;;AAIL,MAAM,cACH,UAEC,aAEA,SAAS,yBAAyB,KAAK,GACnC,GAAG,QAAQ,SAAS,GACpB,GAAG,KAAK,IAAI,UAAU,sBAAsB,CAAC;;AAGrD,MAAM,mBACH,QAEC,aAEA,CAAC,SAAS,cACN,GAAG,KAAK,IAAI,UAAU,wBAAwB,CAAC,GAC/C,GAAG,qBAAqB,cAAc,CAAC,SAAS,eAC9C,GAAG,KAAK,IAAI,UAAU,4BAA4B,CAAC,GACnD,GAAG,QAAQ,SAAS;AAmB9B,MAAM,eAAe;CACnB,iBAAiB;CACjB,gBAAgB;CAChB,aAAa;CACb,YAAY;CACb;AAED,MAAM,gBAAgB;CACpB,aAAa;CACb,aAAa;CACb,aAAa;CACb,aAAa;CACd;AAQD,MAAM,4BACJ,WACuC;CACvC,MAAM,OAAO,OAAO;AACpB,QAAO,OAAO,SAAS,YAAY,cAAc,SAAS,KAAc,GACpE,GAAG,QAAQ,EAAQ,MAAwC,CAAC,GAC5D,GAAG,KACD,IAAI,UACF,wBACA,sGACD,CACF;;AAGP,MAAM,4BACJ,aAEA,YAAY,OACR,GAAG,QAAQ,SAAS,GACpB,GAAG,KAAK,IAAI,UAAU,2BAA2B,CAAC;;;;;;AAOxD,SAAgB,gBACd,KACA,UACA,MAIkC;CAClC,MAAM,SAAU,KAAK,UAAU,EAAE;AAEjC,QAAO,yBAAyB,OAAO,CAAC,KACtC,GAAG,OAAO,aAAa;AAwerB,SAveiD,GAAG,MAAM,SAAS,CAAC,GAClE,QACA;GACE,kBAAkB,MAChB,GAAG,IACD,GAAG,KAAK;IACN,UAAU,IAAI,KAAK,iBAAiB;IACpC,WAAW,IAAI,UAAU,wBAAwB;IAClD,CAAC,CAAC,KACD,GAAG,OAAO,OACR,OAAO,OACH,GAAG,KAAK,IAAI,UAAU,wBAAwB,CAAC,GAC/C,GAAG,QAAQ,0BAA0B,GAAG,QAAQ,CAAC,CACtD,CACF,EACD,mBAAmB,SAAS,CAC7B,CAAC,KACA,GAAG,OAAO,CAAC,QAAQ,QAAQ;IACzB,MAAM,YAAY,IAAI,WAAW,GAAG;AACpC,WAAO,gBAAgB,UAAU;IACjC,MAAM,gBAAgB,yBACpB,IAAI,WAAW,OAAO,UAAU,CAAC,CAClC;AAED,WAAO,GAAG,KAAK;KACb,IAAI,YAAY;MACd,MAAM,WAAW,MAAM,aAAa,IAAI;AACxC,YAAM,sBAAsB,KAAK;OAC/B;OACA,WAAW;OACZ,CAAC;MAEF,MAAM,OAAO,MAAM,cAAc,KAAK,OAAO;MAC7C,MAAM,WAAW,OAAO,YAAY,MAAM,SAAS;MACnD,MAAM,kBACJ,OAAO,mBAAmB,MAAM,QAAQ;MAG1C,MAAM,sBADW,MAAM,sBAAsB,KAAK,OAAO,EACrB,KAAK,QAAQ;OAC/C,IAAI,GAAG;OACP,YAAY,GAAG;OAChB,EAAE;MAEH,MAAM,aAAa,yBACjB,IAAI,aAAa,CAAC,OAAO,OAAO,CACjC;AA8BD,aAAO;OACL,MAAM;OACN,SA9Bc;QACd,IAAI;SAAE,MAAM,GAAG;SAAQ,IAAI,GAAG;SAAM;QACpC,MAAM;SACJ,IAAI;SACJ,MAAM;SACN,aAAa;SACd;QACD,WAAW,yBAAyB,UAAU;QAC9C,kBAAkB,GAAG,WAAW,KAAK,SAAS;SAC5C,MAAM;SACN;SACD,EAAE;QACH,SAAS,GAAG;QACZ,aAAa,GAAG;QAChB,wBAAwB;SACtB,aAAa,GAAG;SAChB,oBAAoB,GAAG,gBAAgB;SACvC,kBAAkB,GAAG;SACrB,GAAI,GAAG,0BACH,EACE,yBACE,GAAG,yBACN,GACD,EAAE;SACP;QACD;QACD;OAKC;OACD;;KAEH,WAAW,IAAI,UAAU,iBAAiB;KAC3C,CAAC;KACF,CACH;GACH,iBAAiB,MACf,GAAG,IACD,GAAG,KAAK;IACN,UAAU,IAAI,KAAK,iBAAiB;IACpC,WAAW,IAAI,UAAU,wBAAwB;IAClD,CAAC,CAAC,KACD,GAAG,OAAO,OACR,OAAO,OACH,GAAG,KAAK,IAAI,UAAU,wBAAwB,CAAC,GAC/C,GAAG,QAAQ,0BAA0B,GAAG,QAAQ,CAAC,CACtD,CACF,EACD,mBAAmB,SAAS,CAC7B,CAAC,KACA,GAAG,OAAO,CAAC,QAAQ,QACjB,yBAAyB,KAAK,SAAS,CAAC,KACtC,GAAG,OAAO,aAAa;IAIrB,MAAM,aAAa,oBAHI,6BACrB,OAAO,eACR,CACqD;AAuBtD,WArB6B,GAAG,QAAQ,WAAW,CAAC,KAClD,GAAG,MACD,qBACE,eAAe,QACf,kBACD,CACF,EACD,GAAG,MAAM,aAAa,GAAG,CAAC,EAC1B,GAAG,MAAM,0BAA0B,KAAK,SAAS,CAAC,EAClD,GAAG,UAAU;AAQX,YAHoB,uBAHlB,6BACE,OAAO,kBACR,CAGF,CACkB;MACnB,CACH,CAE2B,KAC1B,GAAG,MAAM,WAAW,GAAG,KAAK,CAAC,EAC7B,GAAG,MAAM,gBAAgB,GAAG,CAAC,EAC7B,GAAG,OAAO,aAAa;AACrB,SAAI,SAAS,cAAc,KACzB,QAAO,GAAG,KACR,IAAI,UAAU,wBAAwB,CACvC;AAEH,YAAO,GAAG,QAAQ;MAChB;MACA,YAAY,SAAS;MACtB,CAAC;MACF,EACF,GAAG,OAAO,EAAE,UAAU,iBAAiB;KACrC,MAAM,eAAe,yBACnB,WAAW,GACZ;KACD,MAAM,YAAY,WAAW;KAE7B,IAAI;AACJ,SAAI,UAAU,oBAAoB,CAChC,aAAY,UAAU,WAAW;UAC5B;MACL,MAAM,UAAU,UAAU,MAAM;AAChC,kBACE,YAAY,YAAY,MACpB,qBACA,YAAY,YAAY,MACtB,qBACA;;KAkCV,MAAM,UA5BF;OACD,2BAA2B;OAC1B,MAAM,MAAM,UAAU,KAAK;OAC3B,MAAM,SAAS,IAAI,WAAW,GAAG;OACjC,IAAI,KAAK,IAAI;AACb,YAAK,IAAI,IAAI,IAAI,KAAK,GAAG,KAAK;AAC5B,eAAO,KAAK,OAAO,KAAK,KAAM;AAC9B,eAAO;;OAET,MAAM,SAAS,IAAI,WAAW,GAAG;OACjC,IAAI,KAAK,IAAI;AACb,YAAK,IAAI,IAAI,IAAI,KAAK,GAAG,KAAK;AAC5B,eAAO,KAAK,OAAO,KAAK,KAAM;AAC9B,eAAO;;OAET,MAAM,QAAQ,IAAI,WAAW,GAAG;AAChC,aAAM,KAAK;AACX,aAAM,IAAI,QAAQ,EAAE;AACpB,aAAM,IAAI,QAAQ,GAAG;AACrB,cAAO,GAAG,QAAQ,MAAM;;OAEzB,2BAA2B;OAC1B,MAAM,MAAM,UAAU,KAAK;OAC3B,MAAM,YAAY,IAAI,aAAa,IAAI,GAAG,IAAI,EAAE;AAChD,cAAO,GAAG,QAAQ,UAAU,aAAa,CAAC;;MAE7C,CAEwB;AACzB,aACE,UACI,SAAS,GACT,GAAG,KACD,IAAI,UACF,iCACA,0BAA0B,YAC3B,CACF,EACL,KACA,GAAG,OAAO,mBACR,GAAG,KAAK;MACN,IAAI,YAAY;OACd,MAAM,aACJ,OAAO,cAAc;OACvB,MAAM,WAAW,OAAO,YAAY;AAGpC,aADW,OAAO,KAAK,IAAI,KAAK,OAAO,CAC9B,SAAS,OAAO;QACvB;QACA,UAAU,SAAS;QACnB,mBAAmB;QACpB,CAAC;AAEF,aAAM,oBAAoB,KAAK;QAC7B;QACA;QACA,WAAW,eAAe,OAAO,MAC/B,eAAe,YACf,eAAe,aACb,eAAe,WAClB;QACD;QACA,SAAS,SAAS;QAClB,YAAY,OAAO;QACnB;QACA;QACA,MAAM,OAAO;QACb,WAAW,KAAK,KAAK;QACtB,CAAC;AAOF,cAAO;QACL,MAAM;QACN,UAPmB,MAAM,WAAW,KAAK;SACzC;SACA,gBAAgB;SACjB,CAAC;QAKD;;MAEH,WAAW,IAAI,UAAU,iBAAiB;MAC3C,CAAC,CACH,CACF;MACD,CACH;KACD,CACH,CACF,CACF;GACH,cAAc,MACZ,mBAAmB,SAAS,CAAC,KAC3B,GAAG,OAAO,OAAO;IACf,MAAM,YAAY,IAAI,WAAW,GAAG;AACpC,WAAO,gBAAgB,UAAU;IACjC,MAAM,gBAAgB,yBACpB,IAAI,WAAW,OAAO,UAAU,CAAC,CAClC;AAED,WAAO,GAAG,KAAK;KACb,IAAI,YAAY;MACd,MAAM,WAAW,MAAM,aAAa,IAAI;AACxC,YAAM,sBAAsB,KAAK;OAC/B;OACA,WAAW;OACZ,CAAC;MAEF,IAAI;AAOJ,UAAI,OAAO,OAAO;OAChB,MAAM,OAAO,MAAM,yBACjB,KACA,OAAO,MACR;AACD,WAAI,MAAM;QACR,MAAM,WAAW,MAAM,sBACrB,KACA,KAAK,IACN;AACD,YAAI,SAAS,SAAS,EACpB,oBAAmB,SAAS,KAAK,QAAQ;SACvC,MAAM;SACN,IAAI,GAAG;SACP,YAAY,GAAG;SAChB,EAAE;;;MAKT,MAAM,UAA+B;OACnC,WAAW,yBAAyB,UAAU;OAC9C,SAAS,GAAG;OACZ,MAAM,GAAG;OACT,kBAAkB,GAAG;OACtB;AAED,UAAI,iBACF,SAAQ,mBAAmB;AAG7B,aAAO;OACL,MAAM;OACN;OACA;OACD;;KAEH,WAAW,IAAI,UAAU,iBAAiB;KAC3C,CAAC;KACF,CACH;GACH,aAAa,MACX,GAAG,IACD,mBAAmB,SAAS,EAC5B,yBAAyB,KAAK,SAAS,CACxC,CAAC,KACA,GAAG,OAAO,CAAC,IAAI,cAAc;IAC3B,MAAM,iBAAiB,6BACrB,OAAO,eACR;IACD,MAAM,aAAa,oBAAoB,eAAe;AAoBtD,WAlB6B,GAAG,QAAQ,WAAW,CAAC,KAClD,GAAG,MACD,qBAAqB,eAAe,KAAK,eAAe,CACzD,EACD,GAAG,MAAM,aAAa,GAAG,CAAC,EAC1B,GAAG,MAAM,0BAA0B,KAAK,SAAS,CAAC,EAClD,GAAG,YACD,OAAO,gBAAgB,OACnB,GAAG,QAAQ,OAAO,aAAuB,GACzC,GAAG,KACD,IAAI,UACF,8BACA,wBACD,CACF,CACN,CACF,CAE2B,KAC1B,GAAG,OAAO,iBACR,GAAG,KAAK;KACN,UAAU,2BAA2B,KAAK,aAAa;KACvD,WAAW,IAAI,UAAU,6BAA6B;KACvD,CAAC,CAAC,KACD,GAAG,OAAO,YACR,UACI,GAAG,QAAQ,QAAQ,GACnB,GAAG,KACD,IAAI,UACF,8BACA,qBACD,CACF,CACN,CACF,CACF,EACD,GAAG,OAAO,YAAY;KACpB,MAAM,yBAAyB,6BAC7B,OAAO,kBACR;KACD,MAAM,oBAAoB,uBACxB,uBACD;KAED,MAAM,YAAY,6BAChB,OAAO,UACR;KAKD,MAAM,cAAc,OAJK,gCACvB,wBACA,eACD,CAC2C;AA2E5C,YAzE+B,GAAG,QAChC,kBACD,CAAC,KACA,GAAG,MAAM,WAAW,GAAG,KAAK,CAAC,EAC7B,GAAG,MAAM,gBAAgB,GAAG,CAAC,CAC9B,CAEkD,KACjD,GAAG,YAAY;MACb,MAAM,uBAAuB,IAAI,WAC/B,QAAQ,UACT;MAwCD,MAAM,UApCF;QACD,2BAA2B;AAY1B,eALc,qBANM,oBAClB,MACA,qBACD,EAKC,aAHA,yBAAyB,UAAU,CAKpC,GAEG,GAAG,QAAQ,OAAkB,GAC7B,GAAG,KACD,IAAI,UAAU,4BAA4B,CAC3C;;QAEN,2BAA2B;AAS1B,eANc,8BADZ,wBAAwB,qBAAqB,EAG7C,wBACA,aACA,UACD,GAEG,GAAG,QAAQ,OAAkB,GAC7B,GAAG,KACD,IAAI,UAAU,4BAA4B,CAC3C;;OAER,CAEiC,QAAQ;AAC1C,aAAO,UACH,SAAS,GACT,GAAG,KACD,IAAI,UACF,iCACA,0BAA0B,QAAQ,YACnC,CACF;OACL,CACH,CAE8C,KAC7C,GAAG,YACD,QAAQ,YAAY,KACpB,kBAAkB,qBAAqB,KACvC,kBAAkB,oBAAoB,QAAQ,UAC1C,GAAG,KAAK,IAAI,UAAU,wBAAwB,CAAC,GAC/C,GAAG,QAAQ,kBAAkB,CAClC,CACF,CAEyB,KACxB,GAAG,YACD,GAAG,KAAK;MACN,IAAI,YAAY;AACd,aAAM,2BACJ,KACA,QAAQ,KACR,kBAAkB,kBAClB,KAAK,KAAK,CACX;AAOD,cAAO;QACL,MAAM;QACN,UAPmB,MAAM,WAAW,KAAK;SACzC,QAAQ,QAAQ;SAChB,gBAAgB;SACjB,CAAC;QAKD;;MAEH,WAAW,IAAI,UAAU,iBAAiB;MAC3C,CAAC,CACH,CACF;MACD,CACH;KACD,CACH;GACJ,CACF;GAED,CACH"}
+{"version":3,"file":"passkey.js","names":["hasSiteUrl","hasRpId","siteUrl"],"sources":["../../src/server/passkey.ts"],"sourcesContent":["/**\n * Server-side WebAuthn ceremony logic for passkey authentication.\n *\n * Handles the four phases of the WebAuthn flow:\n * 1. registerOptions — generate PublicKeyCredentialCreationOptions\n * 2. registerVerify — verify attestation and store credential\n * 3. authOptions — generate PublicKeyCredentialRequestOptions\n * 4. authVerify — verify assertion signature and sign in\n *\n * Uses `@oslojs/webauthn` for attestation/assertion parsing and\n * `@oslojs/crypto` for signature verification.\n *\n * All functions return `Fx<A, AuthError>` composed via `Fx.chain` pipelines.\n *\n * @module\n */\n\nimport {\n  p256,\n  verifyECDSASignature,\n  decodeSEC1PublicKey,\n  decodePKIXECDSASignature,\n} from \"@oslojs/crypto/ecdsa\";\nimport {\n  RSAPublicKey,\n  decodePKCS1RSAPublicKey,\n  sha256ObjectIdentifier,\n  verifyRSASSAPKCS1v15Signature,\n} from \"@oslojs/crypto/rsa\";\nimport { sha256 } from \"@oslojs/crypto/sha2\";\nimport {\n  encodeBase64urlNoPadding,\n  decodeBase64urlIgnorePadding,\n} from \"@oslojs/encoding\";\nimport {\n  parseAttestationObject,\n  parseClientDataJSON,\n  parseAuthenticatorData,\n  createAssertionSignatureMessage,\n  ClientDataType,\n  coseAlgorithmES256,\n  coseAlgorithmRS256,\n  COSEKeyType,\n} from \"@oslojs/webauthn\";\nimport type { Fx as FxType } from \"@robelest/fx\";\n\nimport { authDb } from \"./db\";\nimport { Fx } from \"@robelest/fx\";\n\nimport { AuthError } from \"./authError\";\nimport { userIdFromIdentitySubject } from \"./identity\";\nimport { callSignIn, callVerifier } from \"./mutations/index\";\nimport { callVerifierSignature } from \"./mutations/signature\";\nimport { PasskeyProviderConfig, GenericActionCtxWithAuthConfig } from \"./types\";\nimport {\n  AuthDataModel,\n  SessionInfo,\n  queryUserById,\n  queryUserByVerifiedEmail,\n  queryPasskeysByUserId,\n  queryPasskeyByCredentialId,\n  queryVerifierById,\n  mutatePasskeyInsert,\n  mutatePasskeyUpdateCounter,\n  mutateVerifierDelete,\n} from \"./types\";\n\ntype EnrichedActionCtx = GenericActionCtxWithAuthConfig<AuthDataModel>;\n\n// ============================================================================\n// Resolve RP options — Fx pipeline with validation\n// ============================================================================\n\n/** Resolved relying party configuration. */\ninterface RpOptions {\n  rpName: string;\n  rpId: string;\n  origin: string | string[];\n  attestation: string;\n  userVerification: string;\n  residentKey: string;\n  authenticatorAttachment?: string;\n  algorithms: number[];\n  challengeExpirationMs: number;\n}\n\n/**\n * Resolve passkey relying party options from provider config and environment.\n *\n * Returns `Fx<RpOptions, AuthError>` — fails if neither SITE_URL nor rpId\n * is configured.\n */\nconst resolveRpOptionsFx = (\n  provider: PasskeyProviderConfig,\n): FxType<RpOptions, AuthError> => {\n  const siteUrl = process.env.SITE_URL;\n  const hasSiteUrl = siteUrl !== undefined && siteUrl !== \"\";\n  const hasRpId = provider.options.rpId !== undefined;\n\n  return Fx.succeed({ siteUrl, hasSiteUrl, hasRpId }).pipe(\n    Fx.chain(({ siteUrl, hasSiteUrl, hasRpId }) =>\n      !hasSiteUrl && !hasRpId\n        ? Fx.fail(\n            new AuthError(\n              \"PASSKEY_MISSING_CONFIG\",\n              \"Passkey provider requires SITE_URL env var (your frontend URL) \" +\n                \"or explicit rpId / origin in the provider config. \" +\n                \"CONVEX_SITE_URL cannot be used because WebAuthn RP ID must match the frontend domain.\",\n            ),\n          )\n        : Fx.succeed(siteUrl),\n    ),\n    Fx.map((siteUrl) => {\n      const siteHostname = siteUrl ? new URL(siteUrl).hostname : undefined;\n      return {\n        rpName: provider.options.rpName ?? siteHostname ?? \"localhost\",\n        rpId: provider.options.rpId ?? siteHostname ?? \"localhost\",\n        origin: provider.options.origin ?? siteUrl ?? \"http://localhost\",\n        attestation: provider.options.attestation ?? \"none\",\n        userVerification: provider.options.userVerification ?? \"required\",\n        residentKey: provider.options.residentKey ?? \"preferred\",\n        authenticatorAttachment: provider.options.authenticatorAttachment,\n        algorithms: provider.options.algorithms ?? [\n          coseAlgorithmES256,\n          coseAlgorithmRS256,\n        ],\n        challengeExpirationMs:\n          provider.options.challengeExpirationMs ?? 300_000,\n      };\n    }),\n  );\n};\n\n// ============================================================================\n// Composable validators — small functions (A) => Fx<B, AuthError>\n// ============================================================================\n\n/** Verify client data type matches expected WebAuthn ceremony type. */\nconst verifyClientDataType =\n  <T extends { type: ClientDataType }>(\n    expectedType: ClientDataType,\n    label: string,\n  ) =>\n  (clientData: T): FxType<T, AuthError> =>\n    clientData.type === expectedType\n      ? Fx.succeed(clientData)\n      : Fx.fail(\n          new AuthError(\n            \"PASSKEY_INVALID_CLIENT_DATA\",\n            `Invalid client data type: expected ${label}`,\n          ),\n        );\n\n/** Verify origin is in the allowed list. */\nconst verifyOrigin =\n  (rp: RpOptions) =>\n  <T extends { origin: string }>(clientData: T): FxType<T, AuthError> => {\n    const allowed = Array.isArray(rp.origin) ? rp.origin : [rp.origin];\n    return allowed.includes(clientData.origin)\n      ? Fx.succeed(clientData)\n      : Fx.fail(\n          new AuthError(\n            \"PASSKEY_INVALID_ORIGIN\",\n            `Invalid origin: ${clientData.origin}, expected one of: ${allowed.join(\", \")}`,\n          ),\n        );\n  };\n\n/** Verify the challenge hash matches the stored verifier, then delete verifier. */\nconst verifyAndConsumeChallenge =\n  (ctx: EnrichedActionCtx, verifierValue: string) =>\n  <T extends { challenge: Uint8Array }>(\n    clientData: T,\n  ): FxType<T, AuthError> => {\n    const challengeHash = encodeBase64urlNoPadding(\n      new Uint8Array(sha256(clientData.challenge)),\n    );\n    return Fx.from({\n      ok: () => queryVerifierById(ctx, verifierValue),\n      err: () => new AuthError(\"PASSKEY_INVALID_CHALLENGE\"),\n    }).pipe(\n      Fx.chain((doc) =>\n        !doc || doc.signature !== challengeHash\n          ? Fx.fail(new AuthError(\"PASSKEY_INVALID_CHALLENGE\"))\n          : Fx.succeed(doc),\n      ),\n      Fx.chain(() =>\n        Fx.from({\n          ok: () => mutateVerifierDelete(ctx, verifierValue),\n          err: () => new AuthError(\"PASSKEY_INVALID_CHALLENGE\"),\n        }),\n      ),\n      Fx.map(() => clientData),\n    );\n  };\n\n/** Verify RP ID hash matches. */\nconst verifyRpId =\n  (rpId: string) =>\n  <T extends { verifyRelyingPartyIdHash: (id: string) => boolean }>(\n    authData: T,\n  ): FxType<T, AuthError> =>\n    authData.verifyRelyingPartyIdHash(rpId)\n      ? Fx.succeed(authData)\n      : Fx.fail(new AuthError(\"PASSKEY_RP_MISMATCH\"));\n\n/** Verify user presence and (optionally) user verification flags. */\nconst verifyUserFlags =\n  (rp: RpOptions) =>\n  <T extends { userPresent: boolean; userVerified: boolean }>(\n    authData: T,\n  ): FxType<T, AuthError> =>\n    !authData.userPresent\n      ? Fx.fail(new AuthError(\"PASSKEY_USER_PRESENCE\"))\n      : rp.userVerification === \"required\" && !authData.userVerified\n        ? Fx.fail(new AuthError(\"PASSKEY_USER_VERIFICATION\"))\n        : Fx.succeed(authData);\n\n// ============================================================================\n// Registration flow\n// ============================================================================\n\n// ============================================================================\n// Authentication flow\n// ============================================================================\n\n// ============================================================================\n// Main dispatch\n// ============================================================================\n\n/** Result type for all passkey flows. */\ntype PasskeyResult =\n  | { kind: \"signedIn\"; signedIn: SessionInfo | null }\n  | { kind: \"passkeyOptions\"; options: Record<string, any>; verifier: string };\n\nconst PASSKEY_FLOW = {\n  registerOptions: \"registerOptions\",\n  registerVerify: \"registerVerify\",\n  authOptions: \"authOptions\",\n  authVerify: \"authVerify\",\n} as const;\n\nconst PASSKEY_FLOWS = [\n  PASSKEY_FLOW.registerOptions,\n  PASSKEY_FLOW.registerVerify,\n  PASSKEY_FLOW.authOptions,\n  PASSKEY_FLOW.authVerify,\n] as const;\n\ntype PasskeyDispatch =\n  | { flow: typeof PASSKEY_FLOW.registerOptions }\n  | { flow: typeof PASSKEY_FLOW.registerVerify }\n  | { flow: typeof PASSKEY_FLOW.authOptions }\n  | { flow: typeof PASSKEY_FLOW.authVerify };\n\nconst resolvePasskeyDispatchFx = (\n  params: Record<string, unknown>,\n): FxType<PasskeyDispatch, AuthError> => {\n  const flow = params.flow;\n  return typeof flow === \"string\" && PASSKEY_FLOWS.includes(flow as never)\n    ? Fx.succeed({ flow: flow as (typeof PASSKEY_FLOWS)[number] })\n    : Fx.fail(\n        new AuthError(\n          \"PASSKEY_MISSING_FLOW\",\n          \"Missing `flow` parameter. Expected one of: registerOptions, registerVerify, authOptions, authVerify\",\n        ),\n      );\n};\n\nconst requirePasskeyVerifierFx = (\n  verifier: string | undefined,\n): FxType<string, AuthError> =>\n  verifier != null\n    ? Fx.succeed(verifier)\n    : Fx.fail(new AuthError(\"PASSKEY_MISSING_VERIFIER\"));\n\n/**\n * Main passkey handler dispatched from signIn.ts.\n *\n * Routes to the appropriate phase based on `params.flow` via `dispatchFx`.\n */\nexport function handlePasskeyFx(\n  ctx: EnrichedActionCtx,\n  provider: PasskeyProviderConfig,\n  args: {\n    params?: Record<string, any>;\n    verifier?: string;\n  },\n): FxType<PasskeyResult, AuthError> {\n  const params = (args.params ?? {}) as Record<string, any>;\n\n  return resolvePasskeyDispatchFx(params).pipe(\n    Fx.chain((dispatch) => {\n      const flowFx: FxType<PasskeyResult, AuthError> = Fx.match(dispatch).on(\n        \"flow\",\n        {\n          registerOptions: (_) =>\n            Fx.zip(\n              Fx.from({\n                ok: () => ctx.auth.getUserIdentity(),\n                err: () => new AuthError(\"PASSKEY_AUTH_REQUIRED\"),\n              }).pipe(\n                Fx.chain((id) =>\n                  id === null\n                    ? Fx.fail(new AuthError(\"PASSKEY_AUTH_REQUIRED\"))\n                    : Fx.succeed(userIdFromIdentitySubject(id.subject)),\n                ),\n              ),\n              resolveRpOptionsFx(provider),\n            ).pipe(\n              Fx.chain(([userId, rp]) => {\n                const challenge = new Uint8Array(32);\n                crypto.getRandomValues(challenge);\n                const challengeHash = encodeBase64urlNoPadding(\n                  new Uint8Array(sha256(challenge)),\n                );\n\n                return Fx.from({\n                  ok: async () => {\n                    const verifier = await callVerifier(ctx);\n                    await callVerifierSignature(ctx, {\n                      verifier,\n                      signature: challengeHash,\n                    });\n\n                    const user = await queryUserById(ctx, userId);\n                    const userName = params.userName ?? user?.email ?? \"user\";\n                    const userDisplayName =\n                      params.userDisplayName ?? user?.name ?? userName;\n\n                    const existing = await queryPasskeysByUserId(ctx, userId);\n                    const excludeCredentials = existing.map((pk) => ({\n                      id: pk.credentialId,\n                      transports: pk.transports,\n                    }));\n\n                    const userHandle = encodeBase64urlNoPadding(\n                      new TextEncoder().encode(userId),\n                    );\n\n                    const options = {\n                      rp: { name: rp.rpName, id: rp.rpId },\n                      user: {\n                        id: userHandle,\n                        name: userName,\n                        displayName: userDisplayName,\n                      },\n                      challenge: encodeBase64urlNoPadding(challenge),\n                      pubKeyCredParams: rp.algorithms.map((alg) => ({\n                        type: \"public-key\" as const,\n                        alg,\n                      })),\n                      timeout: rp.challengeExpirationMs,\n                      attestation: rp.attestation,\n                      authenticatorSelection: {\n                        residentKey: rp.residentKey,\n                        requireResidentKey: rp.residentKey === \"required\",\n                        userVerification: rp.userVerification,\n                        ...(rp.authenticatorAttachment\n                          ? {\n                              authenticatorAttachment:\n                                rp.authenticatorAttachment,\n                            }\n                          : {}),\n                      },\n                      excludeCredentials,\n                    };\n\n                    return {\n                      kind: \"passkeyOptions\" as const,\n                      options,\n                      verifier,\n                    };\n                  },\n                  err: () => new AuthError(\"INTERNAL_ERROR\"),\n                });\n              }),\n            ),\n          registerVerify: (_) =>\n            Fx.zip(\n              Fx.from({\n                ok: () => ctx.auth.getUserIdentity(),\n                err: () => new AuthError(\"PASSKEY_AUTH_REQUIRED\"),\n              }).pipe(\n                Fx.chain((id) =>\n                  id === null\n                    ? Fx.fail(new AuthError(\"PASSKEY_AUTH_REQUIRED\"))\n                    : Fx.succeed(userIdFromIdentitySubject(id.subject)),\n                ),\n              ),\n              resolveRpOptionsFx(provider),\n            ).pipe(\n              Fx.chain(([userId, rp]) =>\n                requirePasskeyVerifierFx(args.verifier).pipe(\n                  Fx.chain((verifier) => {\n                    const clientDataJSON = decodeBase64urlIgnorePadding(\n                      params.clientDataJSON,\n                    );\n                    const clientData = parseClientDataJSON(clientDataJSON);\n\n                    const verifiedClientDataFx = Fx.succeed(clientData).pipe(\n                      Fx.chain(\n                        verifyClientDataType(\n                          ClientDataType.Create,\n                          \"webauthn.create\",\n                        ),\n                      ),\n                      Fx.chain(verifyOrigin(rp)),\n                      Fx.chain(verifyAndConsumeChallenge(ctx, verifier)),\n                      Fx.map(() => {\n                        const attestationObjectBytes =\n                          decodeBase64urlIgnorePadding(\n                            params.attestationObject,\n                          );\n                        const attestation = parseAttestationObject(\n                          attestationObjectBytes,\n                        );\n                        return attestation.authenticatorData;\n                      }),\n                    );\n\n                    return verifiedClientDataFx.pipe(\n                      Fx.chain(verifyRpId(rp.rpId)),\n                      Fx.chain(verifyUserFlags(rp)),\n                      Fx.chain((authData) => {\n                        if (authData.credential == null) {\n                          return Fx.fail(\n                            new AuthError(\"PASSKEY_NO_CREDENTIAL\"),\n                          );\n                        }\n                        return Fx.succeed({\n                          authData,\n                          credential: authData.credential,\n                        });\n                      }),\n                      Fx.chain(({ authData, credential }) => {\n                        const credentialId = encodeBase64urlNoPadding(\n                          credential.id,\n                        );\n                        const publicKey = credential.publicKey;\n\n                        let algorithm: number;\n                        if (publicKey.isAlgorithmDefined()) {\n                          algorithm = publicKey.algorithm();\n                        } else {\n                          const keyType = publicKey.type();\n                          algorithm =\n                            keyType === COSEKeyType.EC2\n                              ? coseAlgorithmES256\n                              : keyType === COSEKeyType.RSA\n                                ? coseAlgorithmRS256\n                                : coseAlgorithmES256;\n                        }\n\n                        const handlers: Record<\n                          number,\n                          (() => FxType<Uint8Array, AuthError>) | undefined\n                        > = {\n                          [coseAlgorithmES256]: () => {\n                            const ec2 = publicKey.ec2();\n                            const xBytes = new Uint8Array(32);\n                            let vx = ec2.x;\n                            for (let i = 31; i >= 0; i--) {\n                              xBytes[i] = Number(vx & 0xffn);\n                              vx >>= 8n;\n                            }\n                            const yBytes = new Uint8Array(32);\n                            let vy = ec2.y;\n                            for (let i = 31; i >= 0; i--) {\n                              yBytes[i] = Number(vy & 0xffn);\n                              vy >>= 8n;\n                            }\n                            const bytes = new Uint8Array(65);\n                            bytes[0] = 0x04;\n                            bytes.set(xBytes, 1);\n                            bytes.set(yBytes, 33);\n                            return Fx.succeed(bytes);\n                          },\n                          [coseAlgorithmRS256]: () => {\n                            const rsa = publicKey.rsa();\n                            const rsaPubKey = new RSAPublicKey(rsa.n, rsa.e);\n                            return Fx.succeed(rsaPubKey.encodePKCS1());\n                          },\n                        };\n\n                        const handler = handlers[algorithm];\n                        return (\n                          handler\n                            ? handler()\n                            : Fx.fail(\n                                new AuthError(\n                                  \"PASSKEY_UNSUPPORTED_ALGORITHM\",\n                                  `Unsupported algorithm: ${algorithm}`,\n                                ),\n                              )\n                        ).pipe(\n                          Fx.chain((publicKeyBytes) =>\n                            Fx.from({\n                              ok: async () => {\n                                const deviceType =\n                                  params.deviceType ?? \"single-device\";\n                                const backedUp = params.backedUp ?? false;\n\n                                const db = authDb(ctx, ctx.auth.config);\n                                await db.accounts.create({\n                                  userId,\n                                  provider: provider.id,\n                                  providerAccountId: credentialId,\n                                });\n\n                                await mutatePasskeyInsert(ctx, {\n                                  userId,\n                                  credentialId,\n                                  publicKey: publicKeyBytes.buffer.slice(\n                                    publicKeyBytes.byteOffset,\n                                    publicKeyBytes.byteOffset +\n                                      publicKeyBytes.byteLength,\n                                  ),\n                                  algorithm,\n                                  counter: authData.signatureCounter,\n                                  transports: params.transports,\n                                  deviceType,\n                                  backedUp,\n                                  name: params.passkeyName,\n                                  createdAt: Date.now(),\n                                });\n\n                                const signInResult = await callSignIn(ctx, {\n                                  userId,\n                                  generateTokens: true,\n                                });\n\n                                return {\n                                  kind: \"signedIn\" as const,\n                                  signedIn: signInResult,\n                                };\n                              },\n                              err: () => new AuthError(\"INTERNAL_ERROR\"),\n                            }),\n                          ),\n                        );\n                      }),\n                    );\n                  }),\n                ),\n              ),\n            ),\n          authOptions: (_) =>\n            resolveRpOptionsFx(provider).pipe(\n              Fx.chain((rp) => {\n                const challenge = new Uint8Array(32);\n                crypto.getRandomValues(challenge);\n                const challengeHash = encodeBase64urlNoPadding(\n                  new Uint8Array(sha256(challenge)),\n                );\n\n                return Fx.from({\n                  ok: async () => {\n                    const verifier = await callVerifier(ctx);\n                    await callVerifierSignature(ctx, {\n                      verifier,\n                      signature: challengeHash,\n                    });\n\n                    let allowCredentials:\n                      | Array<{\n                          type: string;\n                          id: string;\n                          transports?: string[];\n                        }>\n                      | undefined;\n                    if (params.email) {\n                      const user = await queryUserByVerifiedEmail(\n                        ctx,\n                        params.email,\n                      );\n                      if (user) {\n                        const passkeys = await queryPasskeysByUserId(\n                          ctx,\n                          user._id,\n                        );\n                        if (passkeys.length > 0) {\n                          allowCredentials = passkeys.map((pk) => ({\n                            type: \"public-key\",\n                            id: pk.credentialId,\n                            transports: pk.transports,\n                          }));\n                        }\n                      }\n                    }\n\n                    const options: Record<string, any> = {\n                      challenge: encodeBase64urlNoPadding(challenge),\n                      timeout: rp.challengeExpirationMs,\n                      rpId: rp.rpId,\n                      userVerification: rp.userVerification,\n                    };\n\n                    if (allowCredentials) {\n                      options.allowCredentials = allowCredentials;\n                    }\n\n                    return {\n                      kind: \"passkeyOptions\" as const,\n                      options,\n                      verifier,\n                    };\n                  },\n                  err: () => new AuthError(\"INTERNAL_ERROR\"),\n                });\n              }),\n            ),\n          authVerify: (_) =>\n            Fx.zip(\n              resolveRpOptionsFx(provider),\n              requirePasskeyVerifierFx(args.verifier),\n            ).pipe(\n              Fx.chain(([rp, verifier]) => {\n                const clientDataJSON = decodeBase64urlIgnorePadding(\n                  params.clientDataJSON,\n                );\n                const clientData = parseClientDataJSON(clientDataJSON);\n\n                const verifiedClientDataFx = Fx.succeed(clientData).pipe(\n                  Fx.chain(\n                    verifyClientDataType(ClientDataType.Get, \"webauthn.get\"),\n                  ),\n                  Fx.chain(verifyOrigin(rp)),\n                  Fx.chain(verifyAndConsumeChallenge(ctx, verifier)),\n                  Fx.chain(() =>\n                    params.credentialId != null\n                      ? Fx.succeed(params.credentialId as string)\n                      : Fx.fail(\n                          new AuthError(\n                            \"PASSKEY_UNKNOWN_CREDENTIAL\",\n                            \"Missing credential ID\",\n                          ),\n                        ),\n                  ),\n                );\n\n                return verifiedClientDataFx.pipe(\n                  Fx.chain((credentialId) =>\n                    Fx.from({\n                      ok: () => queryPasskeyByCredentialId(ctx, credentialId),\n                      err: () => new AuthError(\"PASSKEY_UNKNOWN_CREDENTIAL\"),\n                    }).pipe(\n                      Fx.chain((passkey) =>\n                        passkey\n                          ? Fx.succeed(passkey)\n                          : Fx.fail(\n                              new AuthError(\n                                \"PASSKEY_UNKNOWN_CREDENTIAL\",\n                                \"Unknown credential\",\n                              ),\n                            ),\n                      ),\n                    ),\n                  ),\n                  Fx.chain((passkey) => {\n                    const authenticatorDataBytes = decodeBase64urlIgnorePadding(\n                      params.authenticatorData,\n                    );\n                    const authenticatorData = parseAuthenticatorData(\n                      authenticatorDataBytes,\n                    );\n\n                    const signature = decodeBase64urlIgnorePadding(\n                      params.signature,\n                    );\n                    const signatureMessage = createAssertionSignatureMessage(\n                      authenticatorDataBytes,\n                      clientDataJSON,\n                    );\n                    const messageHash = sha256(signatureMessage);\n\n                    const checkedAuthenticatorFx = Fx.succeed(\n                      authenticatorData,\n                    ).pipe(\n                      Fx.chain(verifyRpId(rp.rpId)),\n                      Fx.chain(verifyUserFlags(rp)),\n                    );\n\n                    const signatureVerifiedFx = checkedAuthenticatorFx.pipe(\n                      Fx.chain(() => {\n                        const storedPublicKeyBytes = new Uint8Array(\n                          passkey.publicKey,\n                        );\n                        const algorithmHandlers: Record<\n                          number,\n                          (() => FxType<void, AuthError>) | undefined\n                        > = {\n                          [coseAlgorithmES256]: () => {\n                            const ecPublicKey = decodeSEC1PublicKey(\n                              p256,\n                              storedPublicKeyBytes,\n                            );\n                            const ecdsaSignature =\n                              decodePKIXECDSASignature(signature);\n                            const valid = verifyECDSASignature(\n                              ecPublicKey,\n                              messageHash,\n                              ecdsaSignature,\n                            );\n                            return valid\n                              ? Fx.succeed(undefined as void)\n                              : Fx.fail(\n                                  new AuthError(\"PASSKEY_INVALID_SIGNATURE\"),\n                                );\n                          },\n                          [coseAlgorithmRS256]: () => {\n                            const rsaPublicKey =\n                              decodePKCS1RSAPublicKey(storedPublicKeyBytes);\n                            const valid = verifyRSASSAPKCS1v15Signature(\n                              rsaPublicKey,\n                              sha256ObjectIdentifier,\n                              messageHash,\n                              signature,\n                            );\n                            return valid\n                              ? Fx.succeed(undefined as void)\n                              : Fx.fail(\n                                  new AuthError(\"PASSKEY_INVALID_SIGNATURE\"),\n                                );\n                          },\n                        };\n\n                        const handler = algorithmHandlers[passkey.algorithm];\n                        return handler\n                          ? handler()\n                          : Fx.fail(\n                              new AuthError(\n                                \"PASSKEY_UNSUPPORTED_ALGORITHM\",\n                                `Unsupported algorithm: ${passkey.algorithm}`,\n                              ),\n                            );\n                      }),\n                    );\n\n                    const counterValidatedFx = signatureVerifiedFx.pipe(\n                      Fx.chain(() =>\n                        passkey.counter !== 0 &&\n                        authenticatorData.signatureCounter !== 0 &&\n                        authenticatorData.signatureCounter <= passkey.counter\n                          ? Fx.fail(new AuthError(\"PASSKEY_COUNTER_ERROR\"))\n                          : Fx.succeed(authenticatorData),\n                      ),\n                    );\n\n                    return counterValidatedFx.pipe(\n                      Fx.chain(() =>\n                        Fx.from({\n                          ok: async () => {\n                            await mutatePasskeyUpdateCounter(\n                              ctx,\n                              passkey._id,\n                              authenticatorData.signatureCounter,\n                              Date.now(),\n                            );\n\n                            const signInResult = await callSignIn(ctx, {\n                              userId: passkey.userId,\n                              generateTokens: true,\n                            });\n\n                            return {\n                              kind: \"signedIn\" as const,\n                              signedIn: signInResult,\n                            };\n                          },\n                          err: () => new AuthError(\"INTERNAL_ERROR\"),\n                        }),\n                      ),\n                    );\n                  }),\n                );\n              }),\n            ),\n        },\n      );\n      return flowFx;\n    }),\n  );\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AA4FA,MAAM,sBACJ,aACiC;CACjC,MAAM,UAAU,QAAQ,IAAI;CAC5B,MAAM,aAAa,YAAY,UAAa,YAAY;CACxD,MAAM,UAAU,SAAS,QAAQ,SAAS;AAE1C,QAAO,GAAG,QAAQ;EAAE;EAAS;EAAY;EAAS,CAAC,CAAC,KAClD,GAAG,OAAO,EAAE,oBAAS,0BAAY,yBAC/B,CAACA,gBAAc,CAACC,YACZ,GAAG,KACD,IAAI,UACF,0BACA,yMAGD,CACF,GACD,GAAG,QAAQC,UAAQ,CACxB,EACD,GAAG,KAAK,cAAY;EAClB,MAAM,eAAeA,YAAU,IAAI,IAAIA,UAAQ,CAAC,WAAW;AAC3D,SAAO;GACL,QAAQ,SAAS,QAAQ,UAAU,gBAAgB;GACnD,MAAM,SAAS,QAAQ,QAAQ,gBAAgB;GAC/C,QAAQ,SAAS,QAAQ,UAAUA,aAAW;GAC9C,aAAa,SAAS,QAAQ,eAAe;GAC7C,kBAAkB,SAAS,QAAQ,oBAAoB;GACvD,aAAa,SAAS,QAAQ,eAAe;GAC7C,yBAAyB,SAAS,QAAQ;GAC1C,YAAY,SAAS,QAAQ,cAAc,CACzC,oBACA,mBACD;GACD,uBACE,SAAS,QAAQ,yBAAyB;GAC7C;GACD,CACH;;;AAQH,MAAM,wBAEF,cACA,WAED,eACC,WAAW,SAAS,eAChB,GAAG,QAAQ,WAAW,GACtB,GAAG,KACD,IAAI,UACF,+BACA,sCAAsC,QACvC,CACF;;AAGT,MAAM,gBACH,QAC8B,eAAwC;CACrE,MAAM,UAAU,MAAM,QAAQ,GAAG,OAAO,GAAG,GAAG,SAAS,CAAC,GAAG,OAAO;AAClE,QAAO,QAAQ,SAAS,WAAW,OAAO,GACtC,GAAG,QAAQ,WAAW,GACtB,GAAG,KACD,IAAI,UACF,0BACA,mBAAmB,WAAW,OAAO,qBAAqB,QAAQ,KAAK,KAAK,GAC7E,CACF;;;AAIT,MAAM,6BACH,KAAwB,mBAEvB,eACyB;CACzB,MAAM,gBAAgB,yBACpB,IAAI,WAAW,OAAO,WAAW,UAAU,CAAC,CAC7C;AACD,QAAO,GAAG,KAAK;EACb,UAAU,kBAAkB,KAAK,cAAc;EAC/C,WAAW,IAAI,UAAU,4BAA4B;EACtD,CAAC,CAAC,KACD,GAAG,OAAO,QACR,CAAC,OAAO,IAAI,cAAc,gBACtB,GAAG,KAAK,IAAI,UAAU,4BAA4B,CAAC,GACnD,GAAG,QAAQ,IAAI,CACpB,EACD,GAAG,YACD,GAAG,KAAK;EACN,UAAU,qBAAqB,KAAK,cAAc;EAClD,WAAW,IAAI,UAAU,4BAA4B;EACtD,CAAC,CACH,EACD,GAAG,UAAU,WAAW,CACzB;;;AAIL,MAAM,cACH,UAEC,aAEA,SAAS,yBAAyB,KAAK,GACnC,GAAG,QAAQ,SAAS,GACpB,GAAG,KAAK,IAAI,UAAU,sBAAsB,CAAC;;AAGrD,MAAM,mBACH,QAEC,aAEA,CAAC,SAAS,cACN,GAAG,KAAK,IAAI,UAAU,wBAAwB,CAAC,GAC/C,GAAG,qBAAqB,cAAc,CAAC,SAAS,eAC9C,GAAG,KAAK,IAAI,UAAU,4BAA4B,CAAC,GACnD,GAAG,QAAQ,SAAS;AAmB9B,MAAM,eAAe;CACnB,iBAAiB;CACjB,gBAAgB;CAChB,aAAa;CACb,YAAY;CACb;AAED,MAAM,gBAAgB;CACpB,aAAa;CACb,aAAa;CACb,aAAa;CACb,aAAa;CACd;AAQD,MAAM,4BACJ,WACuC;CACvC,MAAM,OAAO,OAAO;AACpB,QAAO,OAAO,SAAS,YAAY,cAAc,SAAS,KAAc,GACpE,GAAG,QAAQ,EAAQ,MAAwC,CAAC,GAC5D,GAAG,KACD,IAAI,UACF,wBACA,sGACD,CACF;;AAGP,MAAM,4BACJ,aAEA,YAAY,OACR,GAAG,QAAQ,SAAS,GACpB,GAAG,KAAK,IAAI,UAAU,2BAA2B,CAAC;;;;;;AAOxD,SAAgB,gBACd,KACA,UACA,MAIkC;CAClC,MAAM,SAAU,KAAK,UAAU,EAAE;AAEjC,QAAO,yBAAyB,OAAO,CAAC,KACtC,GAAG,OAAO,aAAa;AAwerB,SAveiD,GAAG,MAAM,SAAS,CAAC,GAClE,QACA;GACE,kBAAkB,MAChB,GAAG,IACD,GAAG,KAAK;IACN,UAAU,IAAI,KAAK,iBAAiB;IACpC,WAAW,IAAI,UAAU,wBAAwB;IAClD,CAAC,CAAC,KACD,GAAG,OAAO,OACR,OAAO,OACH,GAAG,KAAK,IAAI,UAAU,wBAAwB,CAAC,GAC/C,GAAG,QAAQ,0BAA0B,GAAG,QAAQ,CAAC,CACtD,CACF,EACD,mBAAmB,SAAS,CAC7B,CAAC,KACA,GAAG,OAAO,CAAC,QAAQ,QAAQ;IACzB,MAAM,YAAY,IAAI,WAAW,GAAG;AACpC,WAAO,gBAAgB,UAAU;IACjC,MAAM,gBAAgB,yBACpB,IAAI,WAAW,OAAO,UAAU,CAAC,CAClC;AAED,WAAO,GAAG,KAAK;KACb,IAAI,YAAY;MACd,MAAM,WAAW,MAAM,aAAa,IAAI;AACxC,YAAM,sBAAsB,KAAK;OAC/B;OACA,WAAW;OACZ,CAAC;MAEF,MAAM,OAAO,MAAM,cAAc,KAAK,OAAO;MAC7C,MAAM,WAAW,OAAO,YAAY,MAAM,SAAS;MACnD,MAAM,kBACJ,OAAO,mBAAmB,MAAM,QAAQ;MAG1C,MAAM,sBADW,MAAM,sBAAsB,KAAK,OAAO,EACrB,KAAK,QAAQ;OAC/C,IAAI,GAAG;OACP,YAAY,GAAG;OAChB,EAAE;MAEH,MAAM,aAAa,yBACjB,IAAI,aAAa,CAAC,OAAO,OAAO,CACjC;AA8BD,aAAO;OACL,MAAM;OACN,SA9Bc;QACd,IAAI;SAAE,MAAM,GAAG;SAAQ,IAAI,GAAG;SAAM;QACpC,MAAM;SACJ,IAAI;SACJ,MAAM;SACN,aAAa;SACd;QACD,WAAW,yBAAyB,UAAU;QAC9C,kBAAkB,GAAG,WAAW,KAAK,SAAS;SAC5C,MAAM;SACN;SACD,EAAE;QACH,SAAS,GAAG;QACZ,aAAa,GAAG;QAChB,wBAAwB;SACtB,aAAa,GAAG;SAChB,oBAAoB,GAAG,gBAAgB;SACvC,kBAAkB,GAAG;SACrB,GAAI,GAAG,0BACH,EACE,yBACE,GAAG,yBACN,GACD,EAAE;SACP;QACD;QACD;OAKC;OACD;;KAEH,WAAW,IAAI,UAAU,iBAAiB;KAC3C,CAAC;KACF,CACH;GACH,iBAAiB,MACf,GAAG,IACD,GAAG,KAAK;IACN,UAAU,IAAI,KAAK,iBAAiB;IACpC,WAAW,IAAI,UAAU,wBAAwB;IAClD,CAAC,CAAC,KACD,GAAG,OAAO,OACR,OAAO,OACH,GAAG,KAAK,IAAI,UAAU,wBAAwB,CAAC,GAC/C,GAAG,QAAQ,0BAA0B,GAAG,QAAQ,CAAC,CACtD,CACF,EACD,mBAAmB,SAAS,CAC7B,CAAC,KACA,GAAG,OAAO,CAAC,QAAQ,QACjB,yBAAyB,KAAK,SAAS,CAAC,KACtC,GAAG,OAAO,aAAa;IAIrB,MAAM,aAAa,oBAHI,6BACrB,OAAO,eACR,CACqD;AAuBtD,WArB6B,GAAG,QAAQ,WAAW,CAAC,KAClD,GAAG,MACD,qBACE,eAAe,QACf,kBACD,CACF,EACD,GAAG,MAAM,aAAa,GAAG,CAAC,EAC1B,GAAG,MAAM,0BAA0B,KAAK,SAAS,CAAC,EAClD,GAAG,UAAU;AAQX,YAHoB,uBAHlB,6BACE,OAAO,kBACR,CAGF,CACkB;MACnB,CACH,CAE2B,KAC1B,GAAG,MAAM,WAAW,GAAG,KAAK,CAAC,EAC7B,GAAG,MAAM,gBAAgB,GAAG,CAAC,EAC7B,GAAG,OAAO,aAAa;AACrB,SAAI,SAAS,cAAc,KACzB,QAAO,GAAG,KACR,IAAI,UAAU,wBAAwB,CACvC;AAEH,YAAO,GAAG,QAAQ;MAChB;MACA,YAAY,SAAS;MACtB,CAAC;MACF,EACF,GAAG,OAAO,EAAE,UAAU,iBAAiB;KACrC,MAAM,eAAe,yBACnB,WAAW,GACZ;KACD,MAAM,YAAY,WAAW;KAE7B,IAAI;AACJ,SAAI,UAAU,oBAAoB,CAChC,aAAY,UAAU,WAAW;UAC5B;MACL,MAAM,UAAU,UAAU,MAAM;AAChC,kBACE,YAAY,YAAY,MACpB,qBACA,YAAY,YAAY,MACtB,qBACA;;KAkCV,MAAM,UA5BF;OACD,2BAA2B;OAC1B,MAAM,MAAM,UAAU,KAAK;OAC3B,MAAM,SAAS,IAAI,WAAW,GAAG;OACjC,IAAI,KAAK,IAAI;AACb,YAAK,IAAI,IAAI,IAAI,KAAK,GAAG,KAAK;AAC5B,eAAO,KAAK,OAAO,KAAK,KAAM;AAC9B,eAAO;;OAET,MAAM,SAAS,IAAI,WAAW,GAAG;OACjC,IAAI,KAAK,IAAI;AACb,YAAK,IAAI,IAAI,IAAI,KAAK,GAAG,KAAK;AAC5B,eAAO,KAAK,OAAO,KAAK,KAAM;AAC9B,eAAO;;OAET,MAAM,QAAQ,IAAI,WAAW,GAAG;AAChC,aAAM,KAAK;AACX,aAAM,IAAI,QAAQ,EAAE;AACpB,aAAM,IAAI,QAAQ,GAAG;AACrB,cAAO,GAAG,QAAQ,MAAM;;OAEzB,2BAA2B;OAC1B,MAAM,MAAM,UAAU,KAAK;OAC3B,MAAM,YAAY,IAAI,aAAa,IAAI,GAAG,IAAI,EAAE;AAChD,cAAO,GAAG,QAAQ,UAAU,aAAa,CAAC;;MAE7C,CAEwB;AACzB,aACE,UACI,SAAS,GACT,GAAG,KACD,IAAI,UACF,iCACA,0BAA0B,YAC3B,CACF,EACL,KACA,GAAG,OAAO,mBACR,GAAG,KAAK;MACN,IAAI,YAAY;OACd,MAAM,aACJ,OAAO,cAAc;OACvB,MAAM,WAAW,OAAO,YAAY;AAGpC,aADW,OAAO,KAAK,IAAI,KAAK,OAAO,CAC9B,SAAS,OAAO;QACvB;QACA,UAAU,SAAS;QACnB,mBAAmB;QACpB,CAAC;AAEF,aAAM,oBAAoB,KAAK;QAC7B;QACA;QACA,WAAW,eAAe,OAAO,MAC/B,eAAe,YACf,eAAe,aACb,eAAe,WAClB;QACD;QACA,SAAS,SAAS;QAClB,YAAY,OAAO;QACnB;QACA;QACA,MAAM,OAAO;QACb,WAAW,KAAK,KAAK;QACtB,CAAC;AAOF,cAAO;QACL,MAAM;QACN,UAPmB,MAAM,WAAW,KAAK;SACzC;SACA,gBAAgB;SACjB,CAAC;QAKD;;MAEH,WAAW,IAAI,UAAU,iBAAiB;MAC3C,CAAC,CACH,CACF;MACD,CACH;KACD,CACH,CACF,CACF;GACH,cAAc,MACZ,mBAAmB,SAAS,CAAC,KAC3B,GAAG,OAAO,OAAO;IACf,MAAM,YAAY,IAAI,WAAW,GAAG;AACpC,WAAO,gBAAgB,UAAU;IACjC,MAAM,gBAAgB,yBACpB,IAAI,WAAW,OAAO,UAAU,CAAC,CAClC;AAED,WAAO,GAAG,KAAK;KACb,IAAI,YAAY;MACd,MAAM,WAAW,MAAM,aAAa,IAAI;AACxC,YAAM,sBAAsB,KAAK;OAC/B;OACA,WAAW;OACZ,CAAC;MAEF,IAAI;AAOJ,UAAI,OAAO,OAAO;OAChB,MAAM,OAAO,MAAM,yBACjB,KACA,OAAO,MACR;AACD,WAAI,MAAM;QACR,MAAM,WAAW,MAAM,sBACrB,KACA,KAAK,IACN;AACD,YAAI,SAAS,SAAS,EACpB,oBAAmB,SAAS,KAAK,QAAQ;SACvC,MAAM;SACN,IAAI,GAAG;SACP,YAAY,GAAG;SAChB,EAAE;;;MAKT,MAAM,UAA+B;OACnC,WAAW,yBAAyB,UAAU;OAC9C,SAAS,GAAG;OACZ,MAAM,GAAG;OACT,kBAAkB,GAAG;OACtB;AAED,UAAI,iBACF,SAAQ,mBAAmB;AAG7B,aAAO;OACL,MAAM;OACN;OACA;OACD;;KAEH,WAAW,IAAI,UAAU,iBAAiB;KAC3C,CAAC;KACF,CACH;GACH,aAAa,MACX,GAAG,IACD,mBAAmB,SAAS,EAC5B,yBAAyB,KAAK,SAAS,CACxC,CAAC,KACA,GAAG,OAAO,CAAC,IAAI,cAAc;IAC3B,MAAM,iBAAiB,6BACrB,OAAO,eACR;IACD,MAAM,aAAa,oBAAoB,eAAe;AAoBtD,WAlB6B,GAAG,QAAQ,WAAW,CAAC,KAClD,GAAG,MACD,qBAAqB,eAAe,KAAK,eAAe,CACzD,EACD,GAAG,MAAM,aAAa,GAAG,CAAC,EAC1B,GAAG,MAAM,0BAA0B,KAAK,SAAS,CAAC,EAClD,GAAG,YACD,OAAO,gBAAgB,OACnB,GAAG,QAAQ,OAAO,aAAuB,GACzC,GAAG,KACD,IAAI,UACF,8BACA,wBACD,CACF,CACN,CACF,CAE2B,KAC1B,GAAG,OAAO,iBACR,GAAG,KAAK;KACN,UAAU,2BAA2B,KAAK,aAAa;KACvD,WAAW,IAAI,UAAU,6BAA6B;KACvD,CAAC,CAAC,KACD,GAAG,OAAO,YACR,UACI,GAAG,QAAQ,QAAQ,GACnB,GAAG,KACD,IAAI,UACF,8BACA,qBACD,CACF,CACN,CACF,CACF,EACD,GAAG,OAAO,YAAY;KACpB,MAAM,yBAAyB,6BAC7B,OAAO,kBACR;KACD,MAAM,oBAAoB,uBACxB,uBACD;KAED,MAAM,YAAY,6BAChB,OAAO,UACR;KAKD,MAAM,cAAc,OAJK,gCACvB,wBACA,eACD,CAC2C;AA2E5C,YAzE+B,GAAG,QAChC,kBACD,CAAC,KACA,GAAG,MAAM,WAAW,GAAG,KAAK,CAAC,EAC7B,GAAG,MAAM,gBAAgB,GAAG,CAAC,CAC9B,CAEkD,KACjD,GAAG,YAAY;MACb,MAAM,uBAAuB,IAAI,WAC/B,QAAQ,UACT;MAwCD,MAAM,UApCF;QACD,2BAA2B;AAY1B,eALc,qBANM,oBAClB,MACA,qBACD,EAKC,aAHA,yBAAyB,UAAU,CAKpC,GAEG,GAAG,QAAQ,OAAkB,GAC7B,GAAG,KACD,IAAI,UAAU,4BAA4B,CAC3C;;QAEN,2BAA2B;AAS1B,eANc,8BADZ,wBAAwB,qBAAqB,EAG7C,wBACA,aACA,UACD,GAEG,GAAG,QAAQ,OAAkB,GAC7B,GAAG,KACD,IAAI,UAAU,4BAA4B,CAC3C;;OAER,CAEiC,QAAQ;AAC1C,aAAO,UACH,SAAS,GACT,GAAG,KACD,IAAI,UACF,iCACA,0BAA0B,QAAQ,YACnC,CACF;OACL,CACH,CAE8C,KAC7C,GAAG,YACD,QAAQ,YAAY,KACpB,kBAAkB,qBAAqB,KACvC,kBAAkB,oBAAoB,QAAQ,UAC1C,GAAG,KAAK,IAAI,UAAU,wBAAwB,CAAC,GAC/C,GAAG,QAAQ,kBAAkB,CAClC,CACF,CAEyB,KACxB,GAAG,YACD,GAAG,KAAK;MACN,IAAI,YAAY;AACd,aAAM,2BACJ,KACA,QAAQ,KACR,kBAAkB,kBAClB,KAAK,KAAK,CACX;AAOD,cAAO;QACL,MAAM;QACN,UAPmB,MAAM,WAAW,KAAK;SACzC,QAAQ,QAAQ;SAChB,gBAAgB;SACjB,CAAC;QAKD;;MAEH,WAAW,IAAI,UAAU,iBAAiB;MAC3C,CAAC,CACH,CACF;MACD,CACH;KACD,CACH;GACJ,CACF;GAED,CACH"}

package/dist/server/redirects.js

@@ -1,4 +1,4 @@
-import { AuthError } from "./fx.js";
+import { AuthError } from "./authError.js";
 import { requireEnv } from "./utils.js";
 
 //#region src/server/redirects.ts

package/dist/server/redirects.js.map

@@ -1 +1 @@
-{"version":3,"file":"redirects.js","names":[],"sources":["../../src/server/redirects.ts"],"sourcesContent":["import { AuthError } from \"./fx\";\nimport { ConvexAuthMaterializedConfig } from \"./types\";\nimport { requireEnv } from \"./utils\";\n\n/** @internal */\nexport async function redirectAbsoluteUrl(\n  config: ConvexAuthMaterializedConfig,\n  params: { redirectTo: unknown },\n) {\n  if (params.redirectTo === undefined) {\n    return requireEnv(\"SITE_URL\").replace(/\\/$/, \"\");\n  }\n  if (typeof params.redirectTo !== \"string\") {\n    throw new AuthError(\n      \"INVALID_REDIRECT\",\n      `Expected \\`redirectTo\\` to be a string, got ${params.redirectTo as any}`,\n    );\n  }\n  const redirectCallback =\n    config.callbacks?.redirect ?? defaultRedirectCallback;\n  try {\n    return await redirectCallback({ redirectTo: params.redirectTo });\n  } catch {\n    throw new AuthError(\"INTERNAL_ERROR\");\n  }\n}\n\nasync function defaultRedirectCallback({ redirectTo }: { redirectTo: string }) {\n  // Resolve relative paths against SITE_URL; absolute URLs are passed through\n  // as-is. The developer is trusted to provide valid redirect targets.\n  if (redirectTo.startsWith(\"?\") || redirectTo.startsWith(\"/\")) {\n    return `${requireEnv(\"SITE_URL\").replace(/\\/$/, \"\")}${redirectTo}`;\n  }\n  return redirectTo;\n}\n\n// Temporary work-around because Convex doesn't support\n// schemes other than http and https.\n/** @internal */\nexport function setURLSearchParam(\n  absoluteUrl: string,\n  param: string,\n  value: string,\n) {\n  const pattern = /([^:]+):(.*)/;\n  const [, scheme, rest] = absoluteUrl.match(pattern)!;\n  const hasNoDomain = /^\\/\\/(?:\\/|$|\\?)/.test(rest);\n  const startsWithPath = hasNoDomain && rest.startsWith(\"///\");\n  const url = new URL(\n    `http:${hasNoDomain ? \"//googblibok\" + rest.slice(2) : rest}`,\n  );\n  url.searchParams.set(param, value);\n  const [, , withParam] = url.toString().match(pattern)!;\n  return `${scheme}:${hasNoDomain ? (startsWithPath ? \"/\" : \"\") + \"//\" + withParam.slice(13) : withParam}`;\n}\n"],"mappings":";;;;;AAKA,eAAsB,oBACpB,QACA,QACA;AACA,KAAI,OAAO,eAAe,OACxB,QAAO,WAAW,WAAW,CAAC,QAAQ,OAAO,GAAG;AAElD,KAAI,OAAO,OAAO,eAAe,SAC/B,OAAM,IAAI,UACR,oBACA,+CAA+C,OAAO,aACvD;CAEH,MAAM,mBACJ,OAAO,WAAW,YAAY;AAChC,KAAI;AACF,SAAO,MAAM,iBAAiB,EAAE,YAAY,OAAO,YAAY,CAAC;SAC1D;AACN,QAAM,IAAI,UAAU,iBAAiB;;;AAIzC,eAAe,wBAAwB,EAAE,cAAsC;AAG7E,KAAI,WAAW,WAAW,IAAI,IAAI,WAAW,WAAW,IAAI,CAC1D,QAAO,GAAG,WAAW,WAAW,CAAC,QAAQ,OAAO,GAAG,GAAG;AAExD,QAAO;;;AAMT,SAAgB,kBACd,aACA,OACA,OACA;CACA,MAAM,UAAU;CAChB,MAAM,GAAG,QAAQ,QAAQ,YAAY,MAAM,QAAQ;CACnD,MAAM,cAAc,mBAAmB,KAAK,KAAK;CACjD,MAAM,iBAAiB,eAAe,KAAK,WAAW,MAAM;CAC5D,MAAM,MAAM,IAAI,IACd,QAAQ,cAAc,iBAAiB,KAAK,MAAM,EAAE,GAAG,OACxD;AACD,KAAI,aAAa,IAAI,OAAO,MAAM;CAClC,MAAM,KAAK,aAAa,IAAI,UAAU,CAAC,MAAM,QAAQ;AACrD,QAAO,GAAG,OAAO,GAAG,eAAe,iBAAiB,MAAM,MAAM,OAAO,UAAU,MAAM,GAAG,GAAG"}
+{"version":3,"file":"redirects.js","names":[],"sources":["../../src/server/redirects.ts"],"sourcesContent":["import { AuthError } from \"./authError\";\nimport { ConvexAuthMaterializedConfig } from \"./types\";\nimport { requireEnv } from \"./utils\";\n\n/** @internal */\nexport async function redirectAbsoluteUrl(\n  config: ConvexAuthMaterializedConfig,\n  params: { redirectTo: unknown },\n) {\n  if (params.redirectTo === undefined) {\n    return requireEnv(\"SITE_URL\").replace(/\\/$/, \"\");\n  }\n  if (typeof params.redirectTo !== \"string\") {\n    throw new AuthError(\n      \"INVALID_REDIRECT\",\n      `Expected \\`redirectTo\\` to be a string, got ${params.redirectTo as any}`,\n    );\n  }\n  const redirectCallback =\n    config.callbacks?.redirect ?? defaultRedirectCallback;\n  try {\n    return await redirectCallback({ redirectTo: params.redirectTo });\n  } catch {\n    throw new AuthError(\"INTERNAL_ERROR\");\n  }\n}\n\nasync function defaultRedirectCallback({ redirectTo }: { redirectTo: string }) {\n  // Resolve relative paths against SITE_URL; absolute URLs are passed through\n  // as-is. The developer is trusted to provide valid redirect targets.\n  if (redirectTo.startsWith(\"?\") || redirectTo.startsWith(\"/\")) {\n    return `${requireEnv(\"SITE_URL\").replace(/\\/$/, \"\")}${redirectTo}`;\n  }\n  return redirectTo;\n}\n\n// Temporary work-around because Convex doesn't support\n// schemes other than http and https.\n/** @internal */\nexport function setURLSearchParam(\n  absoluteUrl: string,\n  param: string,\n  value: string,\n) {\n  const pattern = /([^:]+):(.*)/;\n  const [, scheme, rest] = absoluteUrl.match(pattern)!;\n  const hasNoDomain = /^\\/\\/(?:\\/|$|\\?)/.test(rest);\n  const startsWithPath = hasNoDomain && rest.startsWith(\"///\");\n  const url = new URL(\n    `http:${hasNoDomain ? \"//googblibok\" + rest.slice(2) : rest}`,\n  );\n  url.searchParams.set(param, value);\n  const [, , withParam] = url.toString().match(pattern)!;\n  return `${scheme}:${hasNoDomain ? (startsWithPath ? \"/\" : \"\") + \"//\" + withParam.slice(13) : withParam}`;\n}\n"],"mappings":";;;;;AAKA,eAAsB,oBACpB,QACA,QACA;AACA,KAAI,OAAO,eAAe,OACxB,QAAO,WAAW,WAAW,CAAC,QAAQ,OAAO,GAAG;AAElD,KAAI,OAAO,OAAO,eAAe,SAC/B,OAAM,IAAI,UACR,oBACA,+CAA+C,OAAO,aACvD;CAEH,MAAM,mBACJ,OAAO,WAAW,YAAY;AAChC,KAAI;AACF,SAAO,MAAM,iBAAiB,EAAE,YAAY,OAAO,YAAY,CAAC;SAC1D;AACN,QAAM,IAAI,UAAU,iBAAiB;;;AAIzC,eAAe,wBAAwB,EAAE,cAAsC;AAG7E,KAAI,WAAW,WAAW,IAAI,IAAI,WAAW,WAAW,IAAI,CAC1D,QAAO,GAAG,WAAW,WAAW,CAAC,QAAQ,OAAO,GAAG,GAAG;AAExD,QAAO;;;AAMT,SAAgB,kBACd,aACA,OACA,OACA;CACA,MAAM,UAAU;CAChB,MAAM,GAAG,QAAQ,QAAQ,YAAY,MAAM,QAAQ;CACnD,MAAM,cAAc,mBAAmB,KAAK,KAAK;CACjD,MAAM,iBAAiB,eAAe,KAAK,WAAW,MAAM;CAC5D,MAAM,MAAM,IAAI,IACd,QAAQ,cAAc,iBAAiB,KAAK,MAAM,EAAE,GAAG,OACxD;AACD,KAAI,aAAa,IAAI,OAAO,MAAM;CAClC,MAAM,KAAK,aAAa,IAAI,UAAU,CAAC,MAAM,QAAQ;AACrD,QAAO,GAAG,OAAO,GAAG,eAAe,iBAAiB,MAAM,MAAM,OAAO,UAAU,MAAM,GAAG,GAAG"}

package/dist/server/refresh.js

@@ -1,4 +1,4 @@
-import { AuthError } from "./fx.js";
+import { AuthError } from "./authError.js";
 import { LOG_LEVELS, REFRESH_TOKEN_DIVIDER, logWithLevel, maybeRedact } from "./utils.js";
 import { authDb } from "./db.js";
 import { Fx } from "@robelest/fx";

package/dist/server/refresh.js.map

@@ -1 +1 @@
-{"version":3,"file":"refresh.js","names":[],"sources":["../../src/server/refresh.ts"],"sourcesContent":["import { Fx } from \"@robelest/fx\";\nimport { GenericId } from \"convex/values\";\n\nimport { authDb } from \"./db\";\nimport { AuthError } from \"./fx\";\nimport { Doc, MutationCtx } from \"./types\";\nimport { ConvexAuthConfig } from \"./types\";\nimport {\n  LOG_LEVELS,\n  REFRESH_TOKEN_DIVIDER,\n  logWithLevel,\n  maybeRedact,\n} from \"./utils\";\n\nconst DEFAULT_SESSION_INACTIVE_DURATION_MS = 1000 * 60 * 60 * 24 * 30; // 30 days\n/** @internal */\nexport const REFRESH_TOKEN_REUSE_WINDOW_MS = 10 * 1000; // 10 seconds\n\n// ---------------------------------------------------------------------------\n// Refresh token CRUD\n// ---------------------------------------------------------------------------\n\n/**\n * Create a new refresh token for the given session.\n */\n/** @internal */\nexport async function createRefreshToken(\n  ctx: MutationCtx,\n  config: ConvexAuthConfig,\n  sessionId: GenericId<\"Session\">,\n  parentRefreshTokenId: GenericId<\"RefreshToken\"> | null,\n): Promise<GenericId<\"RefreshToken\">> {\n  const expirationTime =\n    Date.now() +\n    (config.session?.inactiveDurationMs ??\n      (process.env.AUTH_SESSION_INACTIVE_DURATION_MS !== undefined\n        ? Number(process.env.AUTH_SESSION_INACTIVE_DURATION_MS)\n        : undefined) ??\n      DEFAULT_SESSION_INACTIVE_DURATION_MS);\n\n  return authDb(ctx, config).refreshTokens.create({\n    sessionId,\n    expirationTime,\n    parentRefreshTokenId: parentRefreshTokenId ?? undefined,\n  }) as Promise<GenericId<\"RefreshToken\">>;\n}\n\n/**\n * Parse a compound refresh token string into its constituent IDs.\n */\n/** @internal */\nexport const parseRefreshToken = (\n  refreshToken: string,\n): Fx<\n  {\n    refreshTokenId: GenericId<\"RefreshToken\">;\n    sessionId: GenericId<\"Session\">;\n  },\n  AuthError\n> => {\n  const [refreshTokenId, sessionId] = refreshToken.split(REFRESH_TOKEN_DIVIDER);\n  const msg = `Can't parse refresh token: ${maybeRedact(refreshToken)}`;\n  const refreshTokenIdFx: Fx<string, AuthError> =\n    refreshTokenId != null\n      ? Fx.succeed(refreshTokenId)\n      : Fx.fail(new AuthError(\"INVALID_REFRESH_TOKEN\", msg));\n\n  return refreshTokenIdFx.pipe(\n    Fx.chain((rtId) => {\n      const sessionIdFx: Fx<string, AuthError> =\n        sessionId != null\n          ? Fx.succeed(sessionId)\n          : Fx.fail(new AuthError(\"INVALID_REFRESH_TOKEN\", msg));\n      return sessionIdFx.pipe(\n        Fx.map((sId) => ({\n          refreshTokenId: rtId as GenericId<\"RefreshToken\">,\n          sessionId: sId as GenericId<\"Session\">,\n        })),\n      );\n    }),\n  );\n};\n\n/**\n * Mark all refresh tokens descending from the given refresh token as invalid\n * immediately. Used when we detect token reuse — revoke the entire tree.\n */\n/** @internal */\nexport async function invalidateRefreshTokensInSubtree(\n  ctx: MutationCtx,\n  refreshToken: Doc<\"RefreshToken\">,\n  config: ConvexAuthConfig,\n) {\n  const db = authDb(ctx, config);\n  const tokensToInvalidate = [refreshToken];\n  const visited = new Set<GenericId<\"RefreshToken\">>([refreshToken._id]);\n  let frontier: GenericId<\"RefreshToken\">[] = [refreshToken._id];\n  while (frontier.length > 0) {\n    const nextFrontier: GenericId<\"RefreshToken\">[] = [];\n    for (const currentTokenId of frontier) {\n      const children = (await db.refreshTokens.getChildren(\n        refreshToken.sessionId,\n        currentTokenId,\n      )) as Doc<\"RefreshToken\">[];\n      for (const child of children) {\n        if (visited.has(child._id)) continue;\n        visited.add(child._id);\n        tokensToInvalidate.push(child);\n        nextFrontier.push(child._id);\n      }\n    }\n    frontier = nextFrontier;\n  }\n  await Fx.run(\n    Fx.each(tokensToInvalidate, (token) =>\n      token.firstUsedTime === undefined ||\n      token.firstUsedTime > Date.now() - REFRESH_TOKEN_REUSE_WINDOW_MS\n        ? Fx.from({\n            ok: () =>\n              db.refreshTokens.patch(token._id, {\n                firstUsedTime: Date.now() - REFRESH_TOKEN_REUSE_WINDOW_MS,\n              }),\n            err: (e) => e as never,\n          })\n        : Fx.unit,\n    ),\n  );\n  return tokensToInvalidate;\n}\n\n// ---------------------------------------------------------------------------\n// Validation pipeline — the core of refresh token handling\n// ---------------------------------------------------------------------------\n\n/**\n * Validate a refresh token and its associated session.\n *\n * Returns `null` on any validation failure (matching original semantics).\n * Each validation step is a small composable function chained with `Fx.chain`.\n * On failure, the error message is logged and the pipeline folds to `null`.\n */\n/** @internal */\nexport const refreshTokenIfValid = (\n  ctx: MutationCtx,\n  refreshTokenId: string,\n  tokenSessionId: string,\n  config: ConvexAuthConfig,\n): Fx<\n  { session: Doc<\"Session\">; refreshTokenDoc: Doc<\"RefreshToken\"> } | null,\n  never\n> => {\n  const db = authDb(ctx, config);\n\n  const fetchDoc = <T>(\n    promise: () => Promise<T | null>,\n    failMsg: string,\n  ): Fx<T | null, never> =>\n    Fx.from({ ok: promise, err: () => failMsg }).pipe(\n      Fx.recover((msg) => {\n        logWithLevel(LOG_LEVELS.ERROR, msg);\n        return Fx.succeed(null as T | null);\n      }),\n    );\n\n  // The entire validation is a single pipeline:\n  // fetch token → not null → not expired → session matches → fetch session → not null → not expired → combine\n  return fetchDoc(\n    () =>\n      db.refreshTokens.getById(\n        refreshTokenId as GenericId<\"RefreshToken\">,\n      ) as Promise<Doc<\"RefreshToken\"> | null>,\n    \"Invalid refresh token format\",\n  )\n    .pipe(\n      Fx.chain((doc) =>\n        doc !== null ? Fx.succeed(doc) : Fx.fail(\"Invalid refresh token\"),\n      ),\n      Fx.chain((doc) =>\n        doc.expirationTime >= Date.now()\n          ? Fx.succeed(doc)\n          : Fx.fail(\"Expired refresh token\"),\n      ),\n      Fx.chain((doc) =>\n        doc.sessionId === tokenSessionId\n          ? Fx.succeed(doc)\n          : Fx.fail(\"Invalid refresh token session ID\"),\n      ),\n    )\n    .pipe(\n      Fx.chain((doc: Doc<\"RefreshToken\">) =>\n        fetchDoc(\n          () =>\n            db.sessions.getById(\n              doc.sessionId,\n            ) as Promise<Doc<\"Session\"> | null>,\n          \"Invalid refresh token session format\",\n        ).pipe(\n          Fx.chain((session) =>\n            session !== null\n              ? Fx.succeed(session)\n              : Fx.fail(\"Invalid refresh token session\"),\n          ),\n          Fx.chain((session) =>\n            session.expirationTime >= Date.now()\n              ? Fx.succeed(session)\n              : Fx.fail(\"Expired refresh token session\"),\n          ),\n          Fx.map((session) => ({\n            session,\n            refreshTokenDoc: doc,\n          })),\n        ),\n      ),\n      Fx.fold({\n        ok: (result) => result,\n        err: (msg) => {\n          logWithLevel(LOG_LEVELS.ERROR, msg);\n          return null;\n        },\n      }),\n    );\n};\n"],"mappings":";;;;;;AAcA,MAAM,uCAAuC,MAAO,KAAK,KAAK,KAAK;;AAEnE,MAAa,gCAAgC,KAAK;;;;;AAUlD,eAAsB,mBACpB,KACA,QACA,WACA,sBACoC;CACpC,MAAM,iBACJ,KAAK,KAAK,IACT,OAAO,SAAS,uBACd,QAAQ,IAAI,sCAAsC,SAC/C,OAAO,QAAQ,IAAI,kCAAkC,GACrD,WACJ;AAEJ,QAAO,OAAO,KAAK,OAAO,CAAC,cAAc,OAAO;EAC9C;EACA;EACA,sBAAsB,wBAAwB;EAC/C,CAAC;;;;;;AAOJ,MAAa,qBACX,iBAOG;CACH,MAAM,CAAC,gBAAgB,aAAa,aAAa,MAAM,sBAAsB;CAC7E,MAAM,MAAM,8BAA8B,YAAY,aAAa;AAMnE,SAJE,kBAAkB,OACd,GAAG,QAAQ,eAAe,GAC1B,GAAG,KAAK,IAAI,UAAU,yBAAyB,IAAI,CAAC,EAElC,KACtB,GAAG,OAAO,SAAS;AAKjB,UAHE,aAAa,OACT,GAAG,QAAQ,UAAU,GACrB,GAAG,KAAK,IAAI,UAAU,yBAAyB,IAAI,CAAC,EACvC,KACjB,GAAG,KAAK,SAAS;GACf,gBAAgB;GAChB,WAAW;GACZ,EAAE,CACJ;GACD,CACH;;;;;;;AAQH,eAAsB,iCACpB,KACA,cACA,QACA;CACA,MAAM,KAAK,OAAO,KAAK,OAAO;CAC9B,MAAM,qBAAqB,CAAC,aAAa;CACzC,MAAM,UAAU,IAAI,IAA+B,CAAC,aAAa,IAAI,CAAC;CACtE,IAAI,WAAwC,CAAC,aAAa,IAAI;AAC9D,QAAO,SAAS,SAAS,GAAG;EAC1B,MAAM,eAA4C,EAAE;AACpD,OAAK,MAAM,kBAAkB,UAAU;GACrC,MAAM,WAAY,MAAM,GAAG,cAAc,YACvC,aAAa,WACb,eACD;AACD,QAAK,MAAM,SAAS,UAAU;AAC5B,QAAI,QAAQ,IAAI,MAAM,IAAI,CAAE;AAC5B,YAAQ,IAAI,MAAM,IAAI;AACtB,uBAAmB,KAAK,MAAM;AAC9B,iBAAa,KAAK,MAAM,IAAI;;;AAGhC,aAAW;;AAEb,OAAM,GAAG,IACP,GAAG,KAAK,qBAAqB,UAC3B,MAAM,kBAAkB,UACxB,MAAM,gBAAgB,KAAK,KAAK,GAAG,gCAC/B,GAAG,KAAK;EACN,UACE,GAAG,cAAc,MAAM,MAAM,KAAK,EAChC,eAAe,KAAK,KAAK,GAAG,+BAC7B,CAAC;EACJ,MAAM,MAAM;EACb,CAAC,GACF,GAAG,KACR,CACF;AACD,QAAO;;;;;;;;;;AAeT,MAAa,uBACX,KACA,gBACA,gBACA,WAIG;CACH,MAAM,KAAK,OAAO,KAAK,OAAO;CAE9B,MAAM,YACJ,SACA,YAEA,GAAG,KAAK;EAAE,IAAI;EAAS,WAAW;EAAS,CAAC,CAAC,KAC3C,GAAG,SAAS,QAAQ;AAClB,eAAa,WAAW,OAAO,IAAI;AACnC,SAAO,GAAG,QAAQ,KAAiB;GACnC,CACH;AAIH,QAAO,eAEH,GAAG,cAAc,QACf,eACD,EACH,+BACD,CACE,KACC,GAAG,OAAO,QACR,QAAQ,OAAO,GAAG,QAAQ,IAAI,GAAG,GAAG,KAAK,wBAAwB,CAClE,EACD,GAAG,OAAO,QACR,IAAI,kBAAkB,KAAK,KAAK,GAC5B,GAAG,QAAQ,IAAI,GACf,GAAG,KAAK,wBAAwB,CACrC,EACD,GAAG,OAAO,QACR,IAAI,cAAc,iBACd,GAAG,QAAQ,IAAI,GACf,GAAG,KAAK,mCAAmC,CAChD,CACF,CACA,KACC,GAAG,OAAO,QACR,eAEI,GAAG,SAAS,QACV,IAAI,UACL,EACH,uCACD,CAAC,KACA,GAAG,OAAO,YACR,YAAY,OACR,GAAG,QAAQ,QAAQ,GACnB,GAAG,KAAK,gCAAgC,CAC7C,EACD,GAAG,OAAO,YACR,QAAQ,kBAAkB,KAAK,KAAK,GAChC,GAAG,QAAQ,QAAQ,GACnB,GAAG,KAAK,gCAAgC,CAC7C,EACD,GAAG,KAAK,aAAa;EACnB;EACA,iBAAiB;EAClB,EAAE,CACJ,CACF,EACD,GAAG,KAAK;EACN,KAAK,WAAW;EAChB,MAAM,QAAQ;AACZ,gBAAa,WAAW,OAAO,IAAI;AACnC,UAAO;;EAEV,CAAC,CACH"}
+{"version":3,"file":"refresh.js","names":[],"sources":["../../src/server/refresh.ts"],"sourcesContent":["import { Fx } from \"@robelest/fx\";\nimport { GenericId } from \"convex/values\";\n\nimport { authDb } from \"./db\";\nimport { AuthError } from \"./authError\";\nimport { Doc, MutationCtx } from \"./types\";\nimport { ConvexAuthConfig } from \"./types\";\nimport {\n  LOG_LEVELS,\n  REFRESH_TOKEN_DIVIDER,\n  logWithLevel,\n  maybeRedact,\n} from \"./utils\";\n\nconst DEFAULT_SESSION_INACTIVE_DURATION_MS = 1000 * 60 * 60 * 24 * 30; // 30 days\n/** @internal */\nexport const REFRESH_TOKEN_REUSE_WINDOW_MS = 10 * 1000; // 10 seconds\n\n// ---------------------------------------------------------------------------\n// Refresh token CRUD\n// ---------------------------------------------------------------------------\n\n/**\n * Create a new refresh token for the given session.\n */\n/** @internal */\nexport async function createRefreshToken(\n  ctx: MutationCtx,\n  config: ConvexAuthConfig,\n  sessionId: GenericId<\"Session\">,\n  parentRefreshTokenId: GenericId<\"RefreshToken\"> | null,\n): Promise<GenericId<\"RefreshToken\">> {\n  const expirationTime =\n    Date.now() +\n    (config.session?.inactiveDurationMs ??\n      (process.env.AUTH_SESSION_INACTIVE_DURATION_MS !== undefined\n        ? Number(process.env.AUTH_SESSION_INACTIVE_DURATION_MS)\n        : undefined) ??\n      DEFAULT_SESSION_INACTIVE_DURATION_MS);\n\n  return authDb(ctx, config).refreshTokens.create({\n    sessionId,\n    expirationTime,\n    parentRefreshTokenId: parentRefreshTokenId ?? undefined,\n  }) as Promise<GenericId<\"RefreshToken\">>;\n}\n\n/**\n * Parse a compound refresh token string into its constituent IDs.\n */\n/** @internal */\nexport const parseRefreshToken = (\n  refreshToken: string,\n): Fx<\n  {\n    refreshTokenId: GenericId<\"RefreshToken\">;\n    sessionId: GenericId<\"Session\">;\n  },\n  AuthError\n> => {\n  const [refreshTokenId, sessionId] = refreshToken.split(REFRESH_TOKEN_DIVIDER);\n  const msg = `Can't parse refresh token: ${maybeRedact(refreshToken)}`;\n  const refreshTokenIdFx: Fx<string, AuthError> =\n    refreshTokenId != null\n      ? Fx.succeed(refreshTokenId)\n      : Fx.fail(new AuthError(\"INVALID_REFRESH_TOKEN\", msg));\n\n  return refreshTokenIdFx.pipe(\n    Fx.chain((rtId) => {\n      const sessionIdFx: Fx<string, AuthError> =\n        sessionId != null\n          ? Fx.succeed(sessionId)\n          : Fx.fail(new AuthError(\"INVALID_REFRESH_TOKEN\", msg));\n      return sessionIdFx.pipe(\n        Fx.map((sId) => ({\n          refreshTokenId: rtId as GenericId<\"RefreshToken\">,\n          sessionId: sId as GenericId<\"Session\">,\n        })),\n      );\n    }),\n  );\n};\n\n/**\n * Mark all refresh tokens descending from the given refresh token as invalid\n * immediately. Used when we detect token reuse — revoke the entire tree.\n */\n/** @internal */\nexport async function invalidateRefreshTokensInSubtree(\n  ctx: MutationCtx,\n  refreshToken: Doc<\"RefreshToken\">,\n  config: ConvexAuthConfig,\n) {\n  const db = authDb(ctx, config);\n  const tokensToInvalidate = [refreshToken];\n  const visited = new Set<GenericId<\"RefreshToken\">>([refreshToken._id]);\n  let frontier: GenericId<\"RefreshToken\">[] = [refreshToken._id];\n  while (frontier.length > 0) {\n    const nextFrontier: GenericId<\"RefreshToken\">[] = [];\n    for (const currentTokenId of frontier) {\n      const children = (await db.refreshTokens.getChildren(\n        refreshToken.sessionId,\n        currentTokenId,\n      )) as Doc<\"RefreshToken\">[];\n      for (const child of children) {\n        if (visited.has(child._id)) continue;\n        visited.add(child._id);\n        tokensToInvalidate.push(child);\n        nextFrontier.push(child._id);\n      }\n    }\n    frontier = nextFrontier;\n  }\n  await Fx.run(\n    Fx.each(tokensToInvalidate, (token) =>\n      token.firstUsedTime === undefined ||\n      token.firstUsedTime > Date.now() - REFRESH_TOKEN_REUSE_WINDOW_MS\n        ? Fx.from({\n            ok: () =>\n              db.refreshTokens.patch(token._id, {\n                firstUsedTime: Date.now() - REFRESH_TOKEN_REUSE_WINDOW_MS,\n              }),\n            err: (e) => e as never,\n          })\n        : Fx.unit,\n    ),\n  );\n  return tokensToInvalidate;\n}\n\n// ---------------------------------------------------------------------------\n// Validation pipeline — the core of refresh token handling\n// ---------------------------------------------------------------------------\n\n/**\n * Validate a refresh token and its associated session.\n *\n * Returns `null` on any validation failure (matching original semantics).\n * Each validation step is a small composable function chained with `Fx.chain`.\n * On failure, the error message is logged and the pipeline folds to `null`.\n */\n/** @internal */\nexport const refreshTokenIfValid = (\n  ctx: MutationCtx,\n  refreshTokenId: string,\n  tokenSessionId: string,\n  config: ConvexAuthConfig,\n): Fx<\n  { session: Doc<\"Session\">; refreshTokenDoc: Doc<\"RefreshToken\"> } | null,\n  never\n> => {\n  const db = authDb(ctx, config);\n\n  const fetchDoc = <T>(\n    promise: () => Promise<T | null>,\n    failMsg: string,\n  ): Fx<T | null, never> =>\n    Fx.from({ ok: promise, err: () => failMsg }).pipe(\n      Fx.recover((msg) => {\n        logWithLevel(LOG_LEVELS.ERROR, msg);\n        return Fx.succeed(null as T | null);\n      }),\n    );\n\n  // The entire validation is a single pipeline:\n  // fetch token → not null → not expired → session matches → fetch session → not null → not expired → combine\n  return fetchDoc(\n    () =>\n      db.refreshTokens.getById(\n        refreshTokenId as GenericId<\"RefreshToken\">,\n      ) as Promise<Doc<\"RefreshToken\"> | null>,\n    \"Invalid refresh token format\",\n  )\n    .pipe(\n      Fx.chain((doc) =>\n        doc !== null ? Fx.succeed(doc) : Fx.fail(\"Invalid refresh token\"),\n      ),\n      Fx.chain((doc) =>\n        doc.expirationTime >= Date.now()\n          ? Fx.succeed(doc)\n          : Fx.fail(\"Expired refresh token\"),\n      ),\n      Fx.chain((doc) =>\n        doc.sessionId === tokenSessionId\n          ? Fx.succeed(doc)\n          : Fx.fail(\"Invalid refresh token session ID\"),\n      ),\n    )\n    .pipe(\n      Fx.chain((doc: Doc<\"RefreshToken\">) =>\n        fetchDoc(\n          () =>\n            db.sessions.getById(\n              doc.sessionId,\n            ) as Promise<Doc<\"Session\"> | null>,\n          \"Invalid refresh token session format\",\n        ).pipe(\n          Fx.chain((session) =>\n            session !== null\n              ? Fx.succeed(session)\n              : Fx.fail(\"Invalid refresh token session\"),\n          ),\n          Fx.chain((session) =>\n            session.expirationTime >= Date.now()\n              ? Fx.succeed(session)\n              : Fx.fail(\"Expired refresh token session\"),\n          ),\n          Fx.map((session) => ({\n            session,\n            refreshTokenDoc: doc,\n          })),\n        ),\n      ),\n      Fx.fold({\n        ok: (result) => result,\n        err: (msg) => {\n          logWithLevel(LOG_LEVELS.ERROR, msg);\n          return null;\n        },\n      }),\n    );\n};\n"],"mappings":";;;;;;AAcA,MAAM,uCAAuC,MAAO,KAAK,KAAK,KAAK;;AAEnE,MAAa,gCAAgC,KAAK;;;;;AAUlD,eAAsB,mBACpB,KACA,QACA,WACA,sBACoC;CACpC,MAAM,iBACJ,KAAK,KAAK,IACT,OAAO,SAAS,uBACd,QAAQ,IAAI,sCAAsC,SAC/C,OAAO,QAAQ,IAAI,kCAAkC,GACrD,WACJ;AAEJ,QAAO,OAAO,KAAK,OAAO,CAAC,cAAc,OAAO;EAC9C;EACA;EACA,sBAAsB,wBAAwB;EAC/C,CAAC;;;;;;AAOJ,MAAa,qBACX,iBAOG;CACH,MAAM,CAAC,gBAAgB,aAAa,aAAa,MAAM,sBAAsB;CAC7E,MAAM,MAAM,8BAA8B,YAAY,aAAa;AAMnE,SAJE,kBAAkB,OACd,GAAG,QAAQ,eAAe,GAC1B,GAAG,KAAK,IAAI,UAAU,yBAAyB,IAAI,CAAC,EAElC,KACtB,GAAG,OAAO,SAAS;AAKjB,UAHE,aAAa,OACT,GAAG,QAAQ,UAAU,GACrB,GAAG,KAAK,IAAI,UAAU,yBAAyB,IAAI,CAAC,EACvC,KACjB,GAAG,KAAK,SAAS;GACf,gBAAgB;GAChB,WAAW;GACZ,EAAE,CACJ;GACD,CACH;;;;;;;AAQH,eAAsB,iCACpB,KACA,cACA,QACA;CACA,MAAM,KAAK,OAAO,KAAK,OAAO;CAC9B,MAAM,qBAAqB,CAAC,aAAa;CACzC,MAAM,UAAU,IAAI,IAA+B,CAAC,aAAa,IAAI,CAAC;CACtE,IAAI,WAAwC,CAAC,aAAa,IAAI;AAC9D,QAAO,SAAS,SAAS,GAAG;EAC1B,MAAM,eAA4C,EAAE;AACpD,OAAK,MAAM,kBAAkB,UAAU;GACrC,MAAM,WAAY,MAAM,GAAG,cAAc,YACvC,aAAa,WACb,eACD;AACD,QAAK,MAAM,SAAS,UAAU;AAC5B,QAAI,QAAQ,IAAI,MAAM,IAAI,CAAE;AAC5B,YAAQ,IAAI,MAAM,IAAI;AACtB,uBAAmB,KAAK,MAAM;AAC9B,iBAAa,KAAK,MAAM,IAAI;;;AAGhC,aAAW;;AAEb,OAAM,GAAG,IACP,GAAG,KAAK,qBAAqB,UAC3B,MAAM,kBAAkB,UACxB,MAAM,gBAAgB,KAAK,KAAK,GAAG,gCAC/B,GAAG,KAAK;EACN,UACE,GAAG,cAAc,MAAM,MAAM,KAAK,EAChC,eAAe,KAAK,KAAK,GAAG,+BAC7B,CAAC;EACJ,MAAM,MAAM;EACb,CAAC,GACF,GAAG,KACR,CACF;AACD,QAAO;;;;;;;;;;AAeT,MAAa,uBACX,KACA,gBACA,gBACA,WAIG;CACH,MAAM,KAAK,OAAO,KAAK,OAAO;CAE9B,MAAM,YACJ,SACA,YAEA,GAAG,KAAK;EAAE,IAAI;EAAS,WAAW;EAAS,CAAC,CAAC,KAC3C,GAAG,SAAS,QAAQ;AAClB,eAAa,WAAW,OAAO,IAAI;AACnC,SAAO,GAAG,QAAQ,KAAiB;GACnC,CACH;AAIH,QAAO,eAEH,GAAG,cAAc,QACf,eACD,EACH,+BACD,CACE,KACC,GAAG,OAAO,QACR,QAAQ,OAAO,GAAG,QAAQ,IAAI,GAAG,GAAG,KAAK,wBAAwB,CAClE,EACD,GAAG,OAAO,QACR,IAAI,kBAAkB,KAAK,KAAK,GAC5B,GAAG,QAAQ,IAAI,GACf,GAAG,KAAK,wBAAwB,CACrC,EACD,GAAG,OAAO,QACR,IAAI,cAAc,iBACd,GAAG,QAAQ,IAAI,GACf,GAAG,KAAK,mCAAmC,CAChD,CACF,CACA,KACC,GAAG,OAAO,QACR,eAEI,GAAG,SAAS,QACV,IAAI,UACL,EACH,uCACD,CAAC,KACA,GAAG,OAAO,YACR,YAAY,OACR,GAAG,QAAQ,QAAQ,GACnB,GAAG,KAAK,gCAAgC,CAC7C,EACD,GAAG,OAAO,YACR,QAAQ,kBAAkB,KAAK,KAAK,GAChC,GAAG,QAAQ,QAAQ,GACnB,GAAG,KAAK,gCAAgC,CAC7C,EACD,GAAG,KAAK,aAAa;EACnB;EACA,iBAAiB;EAClB,EAAE,CACJ,CACF,EACD,GAAG,KAAK;EACN,KAAK,WAAW;EAChB,MAAM,QAAQ;AACZ,gBAAa,WAAW,OAAO,IAAI;AACnC,UAAO;;EAEV,CAAC,CACH"}