@robelest/convex-auth 0.0.4-preview.18 → 0.0.4-preview.19

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (541) hide show
  1. package/README.md +6 -3
  2. package/dist/authorization/index.d.ts +46 -0
  3. package/dist/authorization/index.d.ts.map +1 -1
  4. package/dist/authorization/index.js +46 -0
  5. package/dist/authorization/index.js.map +1 -1
  6. package/dist/bin.cjs +21 -13
  7. package/dist/client/core/types.d.ts +20 -0
  8. package/dist/client/core/types.d.ts.map +1 -0
  9. package/dist/client/index.d.ts +2 -16
  10. package/dist/client/index.d.ts.map +1 -1
  11. package/dist/client/index.js +67 -565
  12. package/dist/client/index.js.map +1 -1
  13. package/dist/component/_generated/api.d.ts +40 -12
  14. package/dist/component/_generated/api.d.ts.map +1 -1
  15. package/dist/component/_generated/api.js.map +1 -1
  16. package/dist/component/_generated/component.d.ts +1306 -1344
  17. package/dist/component/_generated/component.d.ts.map +1 -1
  18. package/dist/component/client/core/types.d.ts +2 -0
  19. package/dist/component/client/index.d.ts +2 -2
  20. package/dist/component/model.d.ts +80 -80
  21. package/dist/component/model.d.ts.map +1 -1
  22. package/dist/component/model.js +5 -1
  23. package/dist/component/model.js.map +1 -1
  24. package/dist/component/providers/credentials.d.ts +3 -2
  25. package/dist/component/providers/credentials.d.ts.map +1 -1
  26. package/dist/component/providers/email.d.ts +30 -0
  27. package/dist/component/providers/email.d.ts.map +1 -1
  28. package/dist/component/providers/phone.d.ts +28 -0
  29. package/dist/component/providers/phone.d.ts.map +1 -1
  30. package/dist/component/public/enterprise/audit.d.ts +73 -0
  31. package/dist/component/public/enterprise/audit.d.ts.map +1 -0
  32. package/dist/component/public/enterprise/audit.js +108 -0
  33. package/dist/component/public/enterprise/audit.js.map +1 -0
  34. package/dist/component/public/enterprise/core.d.ts +176 -0
  35. package/dist/component/public/enterprise/core.d.ts.map +1 -0
  36. package/dist/component/public/enterprise/core.js +292 -0
  37. package/dist/component/public/enterprise/core.js.map +1 -0
  38. package/dist/component/public/enterprise/domains.d.ts +174 -0
  39. package/dist/component/public/enterprise/domains.d.ts.map +1 -0
  40. package/dist/component/public/enterprise/domains.js +271 -0
  41. package/dist/component/public/enterprise/domains.js.map +1 -0
  42. package/dist/component/public/enterprise/scim.d.ts +245 -0
  43. package/dist/component/public/enterprise/scim.d.ts.map +1 -0
  44. package/dist/component/public/enterprise/scim.js +344 -0
  45. package/dist/component/public/enterprise/scim.js.map +1 -0
  46. package/dist/component/public/enterprise/secrets.d.ts +78 -0
  47. package/dist/component/public/enterprise/secrets.d.ts.map +1 -0
  48. package/dist/component/public/enterprise/secrets.js +118 -0
  49. package/dist/component/public/enterprise/secrets.js.map +1 -0
  50. package/dist/component/public/enterprise/webhooks.d.ts +211 -0
  51. package/dist/component/public/enterprise/webhooks.d.ts.map +1 -0
  52. package/dist/component/public/enterprise/webhooks.js +300 -0
  53. package/dist/component/public/enterprise/webhooks.js.map +1 -0
  54. package/dist/component/public/factors/devices.d.ts +157 -0
  55. package/dist/component/public/factors/devices.d.ts.map +1 -0
  56. package/dist/component/public/factors/devices.js +216 -0
  57. package/dist/component/public/factors/devices.js.map +1 -0
  58. package/dist/component/public/factors/passkeys.d.ts +175 -0
  59. package/dist/component/public/factors/passkeys.d.ts.map +1 -0
  60. package/dist/component/public/factors/passkeys.js +238 -0
  61. package/dist/component/public/factors/passkeys.js.map +1 -0
  62. package/dist/component/public/factors/totp.d.ts +189 -0
  63. package/dist/component/public/factors/totp.d.ts.map +1 -0
  64. package/dist/component/public/factors/totp.js +254 -0
  65. package/dist/component/public/factors/totp.js.map +1 -0
  66. package/dist/component/public/groups/core.d.ts +137 -0
  67. package/dist/component/public/groups/core.d.ts.map +1 -0
  68. package/dist/component/public/groups/core.js +321 -0
  69. package/dist/component/public/groups/core.js.map +1 -0
  70. package/dist/component/public/groups/invites.d.ts +217 -0
  71. package/dist/component/public/groups/invites.d.ts.map +1 -0
  72. package/dist/component/public/groups/invites.js +457 -0
  73. package/dist/component/public/groups/invites.js.map +1 -0
  74. package/dist/component/public/groups/members.d.ts +204 -0
  75. package/dist/component/public/groups/members.d.ts.map +1 -0
  76. package/dist/component/public/groups/members.js +355 -0
  77. package/dist/component/public/groups/members.js.map +1 -0
  78. package/dist/component/public/identity/accounts.d.ts +147 -0
  79. package/dist/component/public/identity/accounts.d.ts.map +1 -0
  80. package/dist/component/public/identity/accounts.js +200 -0
  81. package/dist/component/public/identity/accounts.js.map +1 -0
  82. package/dist/component/public/identity/codes.d.ts +104 -0
  83. package/dist/component/public/identity/codes.d.ts.map +1 -0
  84. package/dist/component/public/identity/codes.js +140 -0
  85. package/dist/component/public/identity/codes.js.map +1 -0
  86. package/dist/component/public/identity/sessions.d.ts +128 -0
  87. package/dist/component/public/identity/sessions.d.ts.map +1 -0
  88. package/dist/component/public/identity/sessions.js +192 -0
  89. package/dist/component/public/identity/sessions.js.map +1 -0
  90. package/dist/component/public/identity/tokens.d.ts +169 -0
  91. package/dist/component/public/identity/tokens.d.ts.map +1 -0
  92. package/dist/component/public/identity/tokens.js +227 -0
  93. package/dist/component/public/identity/tokens.js.map +1 -0
  94. package/dist/component/public/identity/users.d.ts +212 -0
  95. package/dist/component/public/identity/users.d.ts.map +1 -0
  96. package/dist/component/public/identity/users.js +311 -0
  97. package/dist/component/public/identity/users.js.map +1 -0
  98. package/dist/component/public/identity/verifiers.d.ts +116 -0
  99. package/dist/component/public/identity/verifiers.d.ts.map +1 -0
  100. package/dist/component/public/identity/verifiers.js +154 -0
  101. package/dist/component/public/identity/verifiers.js.map +1 -0
  102. package/dist/component/public/security/keys.d.ts +209 -0
  103. package/dist/component/public/security/keys.d.ts.map +1 -0
  104. package/dist/component/public/security/keys.js +319 -0
  105. package/dist/component/public/security/keys.js.map +1 -0
  106. package/dist/component/public/security/limits.d.ts +114 -0
  107. package/dist/component/public/security/limits.d.ts.map +1 -0
  108. package/dist/component/public/security/limits.js +169 -0
  109. package/dist/component/public/security/limits.js.map +1 -0
  110. package/dist/component/public.d.ts +22 -7
  111. package/dist/component/public.js +21 -6
  112. package/dist/component/schema.d.ts +288 -288
  113. package/dist/component/server/auth.d.ts +212 -25
  114. package/dist/component/server/auth.d.ts.map +1 -1
  115. package/dist/component/server/auth.js +68 -4
  116. package/dist/component/server/auth.js.map +1 -1
  117. package/dist/component/server/authError.js +34 -0
  118. package/dist/component/server/authError.js.map +1 -0
  119. package/dist/component/server/{providers.js → config.js} +2 -2
  120. package/dist/component/server/config.js.map +1 -0
  121. package/dist/component/server/{domains/core.js → core.js} +107 -88
  122. package/dist/component/server/core.js.map +1 -0
  123. package/dist/component/server/{provider.js → crypto.js} +3 -3
  124. package/dist/component/server/crypto.js.map +1 -0
  125. package/dist/component/server/device.js +1 -1
  126. package/dist/component/server/device.js.map +1 -1
  127. package/dist/component/server/enterprise/config.js +46 -0
  128. package/dist/component/server/enterprise/config.js.map +1 -0
  129. package/dist/component/server/{domains/sso.js → enterprise/domain.js} +6 -5
  130. package/dist/component/server/enterprise/domain.js.map +1 -0
  131. package/dist/component/server/enterprise/http.js +766 -0
  132. package/dist/component/server/enterprise/http.js.map +1 -0
  133. package/dist/component/server/enterprise/oidc.js +248 -0
  134. package/dist/component/server/enterprise/oidc.js.map +1 -0
  135. package/dist/component/server/enterprise/policy.js +85 -0
  136. package/dist/component/server/enterprise/policy.js.map +1 -0
  137. package/dist/component/server/enterprise/saml.js +338 -0
  138. package/dist/component/server/enterprise/saml.js.map +1 -0
  139. package/dist/component/server/enterprise/scim.js +97 -0
  140. package/dist/component/server/enterprise/scim.js.map +1 -0
  141. package/dist/component/server/enterprise/shared.js +51 -0
  142. package/dist/component/server/enterprise/shared.js.map +1 -0
  143. package/dist/component/server/errors.js.map +1 -1
  144. package/dist/component/server/http.js +2 -1
  145. package/dist/component/server/http.js.map +1 -1
  146. package/dist/component/server/identity.js +1 -1
  147. package/dist/component/server/identity.js.map +1 -1
  148. package/dist/component/server/{ratelimit.js → limits.js} +3 -3
  149. package/dist/component/server/limits.js.map +1 -0
  150. package/dist/component/server/mutations/account.js +3 -3
  151. package/dist/component/server/mutations/account.js.map +1 -1
  152. package/dist/component/server/mutations/code.js +2 -2
  153. package/dist/component/server/mutations/code.js.map +1 -1
  154. package/dist/component/server/mutations/invalidate.js +1 -1
  155. package/dist/component/server/mutations/invalidate.js.map +1 -1
  156. package/dist/component/server/mutations/oauth.js +5 -3
  157. package/dist/component/server/mutations/oauth.js.map +1 -1
  158. package/dist/component/server/mutations/refresh.js +1 -1
  159. package/dist/component/server/mutations/refresh.js.map +1 -1
  160. package/dist/component/server/mutations/register.js +3 -3
  161. package/dist/component/server/mutations/register.js.map +1 -1
  162. package/dist/component/server/mutations/retrieve.js +4 -4
  163. package/dist/component/server/mutations/retrieve.js.map +1 -1
  164. package/dist/component/server/mutations/signature.js +2 -2
  165. package/dist/component/server/mutations/signature.js.map +1 -1
  166. package/dist/component/server/mutations/signin.js +1 -1
  167. package/dist/component/server/mutations/signin.js.map +1 -1
  168. package/dist/component/server/mutations/signout.js +1 -1
  169. package/dist/component/server/mutations/signout.js.map +1 -1
  170. package/dist/component/server/mutations/store/refs.js +15 -0
  171. package/dist/component/server/mutations/store/refs.js.map +1 -0
  172. package/dist/component/server/mutations/store.js +80 -10
  173. package/dist/component/server/mutations/store.js.map +1 -1
  174. package/dist/component/server/mutations/verifier.js +1 -1
  175. package/dist/component/server/mutations/verifier.js.map +1 -1
  176. package/dist/component/server/mutations/verify.js +4 -3
  177. package/dist/component/server/mutations/verify.js.map +1 -1
  178. package/dist/component/server/oauth.js +1 -1
  179. package/dist/component/server/oauth.js.map +1 -1
  180. package/dist/component/server/passkey.js +2 -1
  181. package/dist/component/server/passkey.js.map +1 -1
  182. package/dist/component/server/redirects.js +1 -1
  183. package/dist/component/server/redirects.js.map +1 -1
  184. package/dist/component/server/refresh.js +1 -1
  185. package/dist/component/server/refresh.js.map +1 -1
  186. package/dist/component/server/{factory.d.ts → runtime.d.ts} +2 -2
  187. package/dist/component/server/runtime.d.ts.map +1 -0
  188. package/dist/component/server/runtime.js +413 -0
  189. package/dist/component/server/runtime.js.map +1 -0
  190. package/dist/component/server/signin.js +2 -1
  191. package/dist/component/server/signin.js.map +1 -1
  192. package/dist/component/server/totp.js +2 -1
  193. package/dist/component/server/totp.js.map +1 -1
  194. package/dist/component/server/types.d.ts +225 -41
  195. package/dist/component/server/types.d.ts.map +1 -1
  196. package/dist/component/server/types.js.map +1 -1
  197. package/dist/component/server/users.js +1 -1
  198. package/dist/component/server/users.js.map +1 -1
  199. package/dist/component/server/utils.js +1 -1
  200. package/dist/component/server/utils.js.map +1 -1
  201. package/dist/core/types.d.ts +369 -0
  202. package/dist/core/types.d.ts.map +1 -0
  203. package/dist/factors/device.js +105 -0
  204. package/dist/factors/device.js.map +1 -0
  205. package/dist/factors/passkey.js +181 -0
  206. package/dist/factors/passkey.js.map +1 -0
  207. package/dist/factors/totp.js +122 -0
  208. package/dist/factors/totp.js.map +1 -0
  209. package/dist/providers/credentials.d.ts +5 -2
  210. package/dist/providers/credentials.d.ts.map +1 -1
  211. package/dist/providers/credentials.js +2 -0
  212. package/dist/providers/credentials.js.map +1 -1
  213. package/dist/providers/email.d.ts +30 -0
  214. package/dist/providers/email.d.ts.map +1 -1
  215. package/dist/providers/email.js +24 -0
  216. package/dist/providers/email.js.map +1 -1
  217. package/dist/providers/phone.d.ts +28 -0
  218. package/dist/providers/phone.d.ts.map +1 -1
  219. package/dist/providers/phone.js +22 -0
  220. package/dist/providers/phone.js.map +1 -1
  221. package/dist/runtime/browser.js +68 -0
  222. package/dist/runtime/browser.js.map +1 -0
  223. package/dist/runtime/invite.js +51 -0
  224. package/dist/runtime/invite.js.map +1 -0
  225. package/dist/runtime/proxy.js +70 -0
  226. package/dist/runtime/proxy.js.map +1 -0
  227. package/dist/runtime/storage.js +37 -0
  228. package/dist/runtime/storage.js.map +1 -0
  229. package/dist/server/auth.d.ts +218 -28
  230. package/dist/server/auth.d.ts.map +1 -1
  231. package/dist/server/auth.js +68 -4
  232. package/dist/server/auth.js.map +1 -1
  233. package/dist/server/{fx.d.ts → authError.d.ts} +25 -15
  234. package/dist/server/authError.d.ts.map +1 -0
  235. package/dist/server/authError.js +34 -0
  236. package/dist/server/authError.js.map +1 -0
  237. package/dist/server/{providers.js → config.js} +2 -2
  238. package/dist/server/config.js.map +1 -0
  239. package/dist/server/core.d.ts +1436 -0
  240. package/dist/server/core.d.ts.map +1 -0
  241. package/dist/server/{domains/core.js → core.js} +107 -88
  242. package/dist/server/core.js.map +1 -0
  243. package/dist/server/{provider.d.ts → crypto.d.ts} +2 -2
  244. package/dist/server/crypto.d.ts.map +1 -0
  245. package/dist/server/{provider.js → crypto.js} +3 -3
  246. package/dist/{component/server/provider.js.map → server/crypto.js.map} +1 -1
  247. package/dist/server/device.js +1 -1
  248. package/dist/server/device.js.map +1 -1
  249. package/dist/server/enterprise/config.js +46 -0
  250. package/dist/server/enterprise/config.js.map +1 -0
  251. package/dist/server/{domains/sso.d.ts → enterprise/domain.d.ts} +4 -4
  252. package/dist/server/enterprise/domain.d.ts.map +1 -0
  253. package/dist/server/{domains/sso.js → enterprise/domain.js} +6 -5
  254. package/dist/server/enterprise/domain.js.map +1 -0
  255. package/dist/server/enterprise/http.d.ts +26 -0
  256. package/dist/server/enterprise/http.d.ts.map +1 -0
  257. package/dist/server/enterprise/http.js +766 -0
  258. package/dist/server/enterprise/http.js.map +1 -0
  259. package/dist/server/enterprise/oidc.js +248 -0
  260. package/dist/server/enterprise/oidc.js.map +1 -0
  261. package/dist/server/enterprise/policy.js +85 -0
  262. package/dist/server/enterprise/policy.js.map +1 -0
  263. package/dist/server/enterprise/saml.d.ts +1 -0
  264. package/dist/server/enterprise/saml.js +338 -0
  265. package/dist/server/enterprise/saml.js.map +1 -0
  266. package/dist/server/enterprise/scim.d.ts +1 -0
  267. package/dist/server/enterprise/scim.js +97 -0
  268. package/dist/server/enterprise/scim.js.map +1 -0
  269. package/dist/server/enterprise/shared.d.ts +5 -0
  270. package/dist/server/enterprise/shared.d.ts.map +1 -0
  271. package/dist/server/enterprise/shared.js +51 -0
  272. package/dist/server/enterprise/shared.js.map +1 -0
  273. package/dist/server/enterprise/validators.d.ts +1 -0
  274. package/dist/server/{enterpriseValidators.js → enterprise/validators.js} +2 -2
  275. package/dist/server/enterprise/validators.js.map +1 -0
  276. package/dist/server/errors.d.ts +2 -0
  277. package/dist/server/errors.d.ts.map +1 -1
  278. package/dist/server/errors.js +2 -0
  279. package/dist/server/errors.js.map +1 -1
  280. package/dist/server/http.d.ts +2 -2
  281. package/dist/server/http.d.ts.map +1 -1
  282. package/dist/server/http.js +2 -1
  283. package/dist/server/http.js.map +1 -1
  284. package/dist/server/identity.js +1 -1
  285. package/dist/server/identity.js.map +1 -1
  286. package/dist/server/index.d.ts +4 -705
  287. package/dist/server/index.js +4 -1367
  288. package/dist/server/limits.d.ts +1 -0
  289. package/dist/server/{ratelimit.js → limits.js} +3 -3
  290. package/dist/server/limits.js.map +1 -0
  291. package/dist/server/mounts.d.ts +647 -0
  292. package/dist/server/mounts.d.ts.map +1 -0
  293. package/dist/server/mounts.js +643 -0
  294. package/dist/server/mounts.js.map +1 -0
  295. package/dist/server/mutations/account.d.ts +8 -8
  296. package/dist/server/mutations/account.js +3 -3
  297. package/dist/server/mutations/account.js.map +1 -1
  298. package/dist/server/mutations/code.d.ts +13 -13
  299. package/dist/server/mutations/code.js +2 -2
  300. package/dist/server/mutations/code.js.map +1 -1
  301. package/dist/server/mutations/index.d.ts +8 -312
  302. package/dist/server/mutations/index.js +14 -84
  303. package/dist/server/mutations/invalidate.d.ts +5 -5
  304. package/dist/server/mutations/invalidate.d.ts.map +1 -1
  305. package/dist/server/mutations/invalidate.js +1 -1
  306. package/dist/server/mutations/invalidate.js.map +1 -1
  307. package/dist/server/mutations/oauth.d.ts +9 -9
  308. package/dist/server/mutations/oauth.d.ts.map +1 -1
  309. package/dist/server/mutations/oauth.js +5 -3
  310. package/dist/server/mutations/oauth.js.map +1 -1
  311. package/dist/server/mutations/refresh.d.ts +4 -4
  312. package/dist/server/mutations/refresh.js +1 -1
  313. package/dist/server/mutations/refresh.js.map +1 -1
  314. package/dist/server/mutations/register.d.ts +10 -10
  315. package/dist/server/mutations/register.d.ts.map +1 -1
  316. package/dist/server/mutations/register.js +3 -3
  317. package/dist/server/mutations/register.js.map +1 -1
  318. package/dist/server/mutations/retrieve.d.ts +8 -10
  319. package/dist/server/mutations/retrieve.d.ts.map +1 -1
  320. package/dist/server/mutations/retrieve.js +5 -7
  321. package/dist/server/mutations/retrieve.js.map +1 -1
  322. package/dist/server/mutations/signature.d.ts +6 -6
  323. package/dist/server/mutations/signature.d.ts.map +1 -1
  324. package/dist/server/mutations/signature.js +2 -2
  325. package/dist/server/mutations/signature.js.map +1 -1
  326. package/dist/server/mutations/signin.d.ts +1 -1
  327. package/dist/server/mutations/signin.js +1 -1
  328. package/dist/server/mutations/signin.js.map +1 -1
  329. package/dist/server/mutations/signout.d.ts +1 -1
  330. package/dist/server/mutations/signout.js +1 -1
  331. package/dist/server/mutations/signout.js.map +1 -1
  332. package/dist/server/mutations/store/refs.d.ts +12 -0
  333. package/dist/server/mutations/store/refs.d.ts.map +1 -0
  334. package/dist/server/mutations/store/refs.js +15 -0
  335. package/dist/server/mutations/store/refs.js.map +1 -0
  336. package/dist/server/mutations/store.d.ts +303 -9
  337. package/dist/server/mutations/store.d.ts.map +1 -1
  338. package/dist/server/mutations/store.js +80 -10
  339. package/dist/server/mutations/store.js.map +1 -1
  340. package/dist/server/mutations/verifier.d.ts +1 -1
  341. package/dist/server/mutations/verifier.js +1 -1
  342. package/dist/server/mutations/verifier.js.map +1 -1
  343. package/dist/server/mutations/verify.d.ts +8 -8
  344. package/dist/server/mutations/verify.d.ts.map +1 -1
  345. package/dist/server/mutations/verify.js +4 -3
  346. package/dist/server/mutations/verify.js.map +1 -1
  347. package/dist/server/oauth.js +1 -1
  348. package/dist/server/oauth.js.map +1 -1
  349. package/dist/server/passkey.d.ts +2 -2
  350. package/dist/server/passkey.d.ts.map +1 -1
  351. package/dist/server/passkey.js +3 -2
  352. package/dist/server/passkey.js.map +1 -1
  353. package/dist/server/redirects.js +1 -1
  354. package/dist/server/redirects.js.map +1 -1
  355. package/dist/server/refresh.js +1 -1
  356. package/dist/server/refresh.js.map +1 -1
  357. package/dist/server/{factory.d.ts → runtime.d.ts} +16 -16
  358. package/dist/server/runtime.d.ts.map +1 -0
  359. package/dist/server/runtime.js +413 -0
  360. package/dist/server/runtime.js.map +1 -0
  361. package/dist/server/signin.js +3 -2
  362. package/dist/server/signin.js.map +1 -1
  363. package/dist/server/ssr.d.ts +226 -0
  364. package/dist/server/ssr.d.ts.map +1 -0
  365. package/dist/server/ssr.js +786 -0
  366. package/dist/server/ssr.js.map +1 -0
  367. package/dist/server/totp.js +2 -1
  368. package/dist/server/totp.js.map +1 -1
  369. package/dist/server/types.d.ts +242 -42
  370. package/dist/server/types.d.ts.map +1 -1
  371. package/dist/server/types.js +12 -1
  372. package/dist/server/types.js.map +1 -1
  373. package/dist/server/users.js +1 -1
  374. package/dist/server/users.js.map +1 -1
  375. package/dist/server/utils.js +1 -1
  376. package/dist/server/utils.js.map +1 -1
  377. package/package.json +3 -4
  378. package/src/authorization/index.ts +46 -0
  379. package/src/cli/index.ts +38 -20
  380. package/src/client/core/types.ts +437 -0
  381. package/src/client/factors/device.ts +160 -0
  382. package/src/client/factors/passkey.ts +282 -0
  383. package/src/client/factors/totp.ts +150 -0
  384. package/src/client/index.ts +133 -1267
  385. package/src/client/runtime/browser.ts +112 -0
  386. package/src/client/runtime/invite.ts +65 -0
  387. package/src/client/runtime/proxy.ts +111 -0
  388. package/src/client/runtime/storage.ts +79 -0
  389. package/src/component/_generated/api.ts +40 -12
  390. package/src/component/_generated/component.ts +1772 -1798
  391. package/src/component/model.ts +6 -0
  392. package/src/component/public/enterprise/audit.ts +120 -0
  393. package/src/component/public/enterprise/core.ts +354 -0
  394. package/src/component/public/enterprise/domains.ts +323 -0
  395. package/src/component/public/enterprise/scim.ts +396 -0
  396. package/src/component/public/enterprise/secrets.ts +132 -0
  397. package/src/component/public/enterprise/webhooks.ts +306 -0
  398. package/src/component/public/factors/devices.ts +223 -0
  399. package/src/component/public/factors/passkeys.ts +242 -0
  400. package/src/component/public/factors/totp.ts +258 -0
  401. package/src/component/public/groups/core.ts +481 -0
  402. package/src/component/public/groups/invites.ts +602 -0
  403. package/src/component/public/groups/members.ts +409 -0
  404. package/src/component/public/identity/accounts.ts +206 -0
  405. package/src/component/public/identity/codes.ts +148 -0
  406. package/src/component/public/identity/sessions.ts +209 -0
  407. package/src/component/public/identity/tokens.ts +250 -0
  408. package/src/component/public/identity/users.ts +354 -0
  409. package/src/component/public/identity/verifiers.ts +157 -0
  410. package/src/component/public/security/keys.ts +365 -0
  411. package/src/component/public/security/limits.ts +173 -0
  412. package/src/component/public.ts +27 -5
  413. package/src/providers/credentials.ts +4 -5
  414. package/src/providers/email.ts +30 -0
  415. package/src/providers/phone.ts +28 -0
  416. package/src/server/auth.ts +282 -28
  417. package/src/server/authError.ts +44 -0
  418. package/src/server/core.ts +2095 -0
  419. package/src/server/{provider.ts → crypto.ts} +1 -1
  420. package/src/server/device.ts +1 -1
  421. package/src/server/enterprise/config.ts +51 -0
  422. package/src/server/{domains/sso.ts → enterprise/domain.ts} +4 -2
  423. package/src/server/enterprise/http.ts +1324 -0
  424. package/src/server/enterprise/oidc.ts +500 -0
  425. package/src/server/enterprise/policy.ts +128 -0
  426. package/src/server/enterprise/saml.ts +578 -0
  427. package/src/server/enterprise/scim.ts +135 -0
  428. package/src/server/enterprise/shared.ts +134 -0
  429. package/src/server/errors.ts +2 -0
  430. package/src/server/http.ts +3 -1
  431. package/src/server/identity.ts +1 -1
  432. package/src/server/index.ts +32 -2605
  433. package/src/server/{ratelimit.ts → limits.ts} +1 -1
  434. package/src/server/mounts.ts +948 -0
  435. package/src/server/mutations/account.ts +4 -4
  436. package/src/server/mutations/code.ts +3 -3
  437. package/src/server/mutations/index.ts +8 -148
  438. package/src/server/mutations/invalidate.ts +2 -2
  439. package/src/server/mutations/oauth.ts +8 -6
  440. package/src/server/mutations/refresh.ts +3 -3
  441. package/src/server/mutations/register.ts +3 -3
  442. package/src/server/mutations/retrieve.ts +4 -8
  443. package/src/server/mutations/signature.ts +3 -3
  444. package/src/server/mutations/signin.ts +2 -2
  445. package/src/server/mutations/signout.ts +2 -2
  446. package/src/server/mutations/store/refs.ts +10 -0
  447. package/src/server/mutations/store.ts +137 -9
  448. package/src/server/mutations/verifier.ts +2 -2
  449. package/src/server/mutations/verify.ts +5 -5
  450. package/src/server/oauth.ts +1 -1
  451. package/src/server/passkey.ts +3 -4
  452. package/src/server/redirects.ts +1 -1
  453. package/src/server/refresh.ts +1 -1
  454. package/src/server/runtime.ts +880 -0
  455. package/src/server/signin.ts +3 -1
  456. package/src/server/ssr.ts +1764 -0
  457. package/src/server/totp.ts +3 -1
  458. package/src/server/types.ts +254 -43
  459. package/src/server/users.ts +1 -1
  460. package/src/server/utils.ts +1 -1
  461. package/src/test.ts +25 -0
  462. package/dist/component/public/enterprise.d.ts +0 -54
  463. package/dist/component/public/enterprise.d.ts.map +0 -1
  464. package/dist/component/public/enterprise.js +0 -515
  465. package/dist/component/public/enterprise.js.map +0 -1
  466. package/dist/component/public/factors.d.ts +0 -52
  467. package/dist/component/public/factors.d.ts.map +0 -1
  468. package/dist/component/public/factors.js +0 -285
  469. package/dist/component/public/factors.js.map +0 -1
  470. package/dist/component/public/groups.d.ts +0 -124
  471. package/dist/component/public/groups.d.ts.map +0 -1
  472. package/dist/component/public/groups.js +0 -680
  473. package/dist/component/public/groups.js.map +0 -1
  474. package/dist/component/public/identity.d.ts +0 -93
  475. package/dist/component/public/identity.d.ts.map +0 -1
  476. package/dist/component/public/identity.js +0 -426
  477. package/dist/component/public/identity.js.map +0 -1
  478. package/dist/component/public/keys.d.ts +0 -41
  479. package/dist/component/public/keys.d.ts.map +0 -1
  480. package/dist/component/public/keys.js +0 -157
  481. package/dist/component/public/keys.js.map +0 -1
  482. package/dist/component/public/shared.d.ts +0 -26
  483. package/dist/component/public/shared.d.ts.map +0 -1
  484. package/dist/component/public/shared.js +0 -32
  485. package/dist/component/public/shared.js.map +0 -1
  486. package/dist/component/server/domains/core.js.map +0 -1
  487. package/dist/component/server/domains/sso.js.map +0 -1
  488. package/dist/component/server/factory.d.ts.map +0 -1
  489. package/dist/component/server/factory.js +0 -1134
  490. package/dist/component/server/factory.js.map +0 -1
  491. package/dist/component/server/fx.js +0 -66
  492. package/dist/component/server/fx.js.map +0 -1
  493. package/dist/component/server/mutations/index.js +0 -85
  494. package/dist/component/server/mutations/index.js.map +0 -1
  495. package/dist/component/server/providers.js.map +0 -1
  496. package/dist/component/server/ratelimit.js.map +0 -1
  497. package/dist/component/server/sso.js +0 -830
  498. package/dist/component/server/sso.js.map +0 -1
  499. package/dist/server/domains/core.d.ts +0 -449
  500. package/dist/server/domains/core.d.ts.map +0 -1
  501. package/dist/server/domains/core.js.map +0 -1
  502. package/dist/server/domains/sso.d.ts.map +0 -1
  503. package/dist/server/domains/sso.js.map +0 -1
  504. package/dist/server/enterpriseValidators.js.map +0 -1
  505. package/dist/server/factory.d.ts.map +0 -1
  506. package/dist/server/factory.js +0 -1134
  507. package/dist/server/factory.js.map +0 -1
  508. package/dist/server/fx.d.ts.map +0 -1
  509. package/dist/server/fx.js +0 -66
  510. package/dist/server/fx.js.map +0 -1
  511. package/dist/server/index.d.ts.map +0 -1
  512. package/dist/server/index.js.map +0 -1
  513. package/dist/server/mutations/index.d.ts.map +0 -1
  514. package/dist/server/mutations/index.js.map +0 -1
  515. package/dist/server/provider.d.ts.map +0 -1
  516. package/dist/server/provider.js.map +0 -1
  517. package/dist/server/providers.js.map +0 -1
  518. package/dist/server/ratelimit.js.map +0 -1
  519. package/dist/server/sso.js +0 -830
  520. package/dist/server/sso.js.map +0 -1
  521. package/dist/server/version.d.ts +0 -5
  522. package/dist/server/version.d.ts.map +0 -1
  523. package/dist/server/version.js +0 -6
  524. package/dist/server/version.js.map +0 -1
  525. package/src/component/public/enterprise.ts +0 -753
  526. package/src/component/public/factors.ts +0 -333
  527. package/src/component/public/groups.ts +0 -1066
  528. package/src/component/public/identity.ts +0 -569
  529. package/src/component/public/keys.ts +0 -209
  530. package/src/component/public/shared.ts +0 -119
  531. package/src/server/domains/core.ts +0 -1096
  532. package/src/server/factory.ts +0 -2181
  533. package/src/server/fx.ts +0 -152
  534. package/src/server/sso.ts +0 -1516
  535. package/src/server/version.ts +0 -2
  536. /package/dist/server/{enterpriseValidators.d.ts → config.d.ts} +0 -0
  537. /package/dist/server/{providers.d.ts → enterprise/config.d.ts} +0 -0
  538. /package/dist/server/{ratelimit.d.ts → enterprise/oidc.d.ts} +0 -0
  539. /package/dist/server/{sso.d.ts → enterprise/policy.d.ts} +0 -0
  540. /package/src/server/{providers.ts → config.ts} +0 -0
  541. /package/src/server/{enterpriseValidators.ts → enterprise/validators.ts} +0 -0
package/src/server/enterprise/saml.ts ADDED
@@ -0,0 +1,578 @@
1
+ import {
2
+ decodeBase64urlIgnorePadding,
3
+ encodeBase64urlNoPadding,
4
+ } from "@oslojs/encoding";
5
+ import {
6
+ Constants,
7
+ IdentityProvider,
8
+ ServiceProvider,
9
+ setSchemaValidator,
10
+ } from "@robelest/samlify";
11
+
12
+ import type { SAMLAttributeMapping } from "../types";
13
+ import { getSamlConfig } from "./config";
14
+ import type {
15
+ EnterpriseSamlHttpRequest,
16
+ EnterpriseSamlRelayState,
17
+ EnterpriseSamlSource,
18
+ ParsedSamlMetadata,
19
+ } from "./shared";
20
+ import { asRecord, getEnterpriseSamlUrls } from "./shared";
21
+
22
+ // Samlify requires a schema validator to be registered before parsing any SAML
23
+ // response. We use a permissive validator that always resolves because Convex's
24
+ // edge runtime has no file-system access for XML schema files, and structural
25
+ // correctness is already ensured by the XML parser. This is called directly
26
+ // before each parse operation since Convex can restart the V8 isolate between
27
+ // requests, resetting module-level state.
28
+ const _samlifyPermissiveValidator = {
29
+ validate: (_xml: string) => Promise.resolve("OK"),
30
+ };
31
+ function ensureSamlifyValidator() {
32
+ setSchemaValidator(_samlifyPermissiveValidator);
33
+ }
34
+
35
+ /** @internal */
36
+ export function createSamlPostBindingResponse(opts: {
37
+ endpoint: string;
38
+ parameter: "SAMLRequest" | "SAMLResponse";
39
+ value: string;
40
+ relayState?: string;
41
+ }) {
42
+ const fields = [
43
+ `<input type="hidden" name="${opts.parameter}" value="${opts.value.replace(/"/g, "&quot;")}" />`,
44
+ opts.relayState
45
+ ? `<input type="hidden" name="RelayState" value="${opts.relayState.replace(/"/g, "&quot;")}" />`
46
+ : "",
47
+ ].join("");
48
+ return new Response(
49
+ `<!doctype html><html><body><form method="POST" action="${opts.endpoint}">${fields}</form><script>document.forms[0].submit();</script></body></html>`,
50
+ { status: 200, headers: { "Content-Type": "text/html; charset=utf-8" } },
51
+ );
52
+ }
53
+
54
+ /** @internal */
55
+ export function decodeRelayState(
56
+ value: string | null,
57
+ ): Record<string, unknown> {
58
+ if (!value) {
59
+ return {};
60
+ }
61
+ try {
62
+ return JSON.parse(
63
+ new TextDecoder().decode(decodeBase64urlIgnorePadding(value)),
64
+ );
65
+ } catch {
66
+ return {};
67
+ }
68
+ }
69
+
70
+ /** @internal */
71
+ export function encodeEnterpriseSamlRelayState(
72
+ value: EnterpriseSamlRelayState,
73
+ ) {
74
+ return encodeBase64urlNoPadding(
75
+ new TextEncoder().encode(
76
+ JSON.stringify({
77
+ source: `${value.source.kind}:${value.source.id}`,
78
+ signature: value.signature,
79
+ requestId: value.requestId,
80
+ state: value.state,
81
+ redirectTo: value.redirectTo,
82
+ }),
83
+ ),
84
+ );
85
+ }
86
+
87
+ /** @internal */
88
+ export function decodeEnterpriseSamlRelayStateOrThrow(
89
+ value: string | null,
90
+ ): EnterpriseSamlRelayState {
91
+ if (!value) {
92
+ throw new Error("Missing SAML RelayState.");
93
+ }
94
+ const decoded = decodeRelayState(value);
95
+ if (
96
+ typeof decoded.source !== "string" ||
97
+ typeof decoded.signature !== "string" ||
98
+ typeof decoded.requestId !== "string" ||
99
+ typeof decoded.state !== "string"
100
+ ) {
101
+ throw new Error("Invalid SAML RelayState.");
102
+ }
103
+ const [kind, ...rest] = decoded.source.split(":");
104
+ const id = rest.join(":");
105
+ if (kind !== "enterprise" || id.length === 0) {
106
+ throw new Error("Invalid enterprise SAML source.");
107
+ }
108
+ return {
109
+ source: { kind, id } as EnterpriseSamlSource,
110
+ signature: decoded.signature,
111
+ requestId: decoded.requestId,
112
+ state: decoded.state,
113
+ redirectTo:
114
+ typeof decoded.redirectTo === "string" ? decoded.redirectTo : undefined,
115
+ };
116
+ }
117
+
118
+ /** @internal */
119
+ export async function readRequestBody(
120
+ request: Request,
121
+ ): Promise<Record<string, string>> {
122
+ const contentType = request.headers.get("Content-Type") ?? "";
123
+ if (
124
+ contentType.includes("application/x-www-form-urlencoded") ||
125
+ contentType.includes("multipart/form-data")
126
+ ) {
127
+ const form = await request.formData();
128
+ const body: Record<string, string> = {};
129
+ form.forEach((value, key) => {
130
+ body[key] = typeof value === "string" ? value : value.name;
131
+ });
132
+ return body;
133
+ }
134
+ return {};
135
+ }
136
+
137
+ /** @internal */
138
+ export async function readEnterpriseSamlHttpRequest(
139
+ request: Request,
140
+ ): Promise<EnterpriseSamlHttpRequest> {
141
+ const url = new URL(request.url);
142
+ const body = await readRequestBody(request);
143
+ const query = Object.fromEntries(url.searchParams);
144
+ const binding =
145
+ request.method === "GET"
146
+ ? "redirect"
147
+ : body.SAMLResponse || body.SAMLRequest
148
+ ? "post"
149
+ : "redirect";
150
+ return {
151
+ url,
152
+ body,
153
+ query,
154
+ binding,
155
+ relayState:
156
+ body.RelayState ?? url.searchParams.get("RelayState") ?? undefined,
157
+ hasSamlRequest: Boolean(
158
+ body.SAMLRequest ?? url.searchParams.get("SAMLRequest"),
159
+ ),
160
+ hasSamlResponse: Boolean(
161
+ body.SAMLResponse ?? url.searchParams.get("SAMLResponse"),
162
+ ),
163
+ };
164
+ }
165
+
166
+ /** @internal */
167
+ export function parseSamlIdpMetadata(metadata: string): ParsedSamlMetadata {
168
+ const idp = IdentityProvider({ metadata });
169
+ const entityMeta = idp.entityMeta;
170
+
171
+ const normalizeService = (value: unknown): string | undefined => {
172
+ return typeof value === "string" && value.length > 0 ? value : undefined;
173
+ };
174
+
175
+ return {
176
+ issuer: entityMeta.getEntityID(),
177
+ sso: {
178
+ redirect: normalizeService(entityMeta.getSingleSignOnService("redirect")),
179
+ post: normalizeService(entityMeta.getSingleSignOnService("post")),
180
+ },
181
+ slo: {
182
+ redirect: normalizeService(entityMeta.getSingleLogoutService("redirect")),
183
+ post: normalizeService(entityMeta.getSingleLogoutService("post")),
184
+ },
185
+ signingCert: entityMeta.getX509Certificate("signing"),
186
+ encryptionCert: entityMeta.getX509Certificate("encrypt"),
187
+ nameIdFormats: (() => {
188
+ const nameIdFormat = entityMeta.getNameIDFormat();
189
+ return Array.isArray(nameIdFormat) ? nameIdFormat : [];
190
+ })(),
191
+ wantsSignedAuthnRequests: entityMeta.isWantAuthnRequestsSigned(),
192
+ };
193
+ }
194
+
195
+ /** @internal */
196
+ export function createServiceProviderMetadata(opts: {
197
+ entityId: string;
198
+ acsUrl: string;
199
+ sloUrl?: string;
200
+ authnRequestsSigned?: boolean;
201
+ signingCert?: string | string[];
202
+ encryptCert?: string | string[];
203
+ privateKey?: string;
204
+ privateKeyPass?: string;
205
+ encPrivateKey?: string;
206
+ encPrivateKeyPass?: string;
207
+ }) {
208
+ const binding = Constants.namespace.binding;
209
+ const sp = ServiceProvider({
210
+ entityID: opts.entityId,
211
+ authnRequestsSigned: opts.authnRequestsSigned ?? false,
212
+ privateKey: opts.privateKey,
213
+ privateKeyPass: opts.privateKeyPass,
214
+ signingCert: opts.signingCert,
215
+ encryptCert: opts.encryptCert,
216
+ encPrivateKey: opts.encPrivateKey,
217
+ encPrivateKeyPass: opts.encPrivateKeyPass,
218
+ assertionConsumerService: [
219
+ {
220
+ Binding: binding.post,
221
+ Location: opts.acsUrl,
222
+ },
223
+ ],
224
+ singleLogoutService: opts.sloUrl
225
+ ? [
226
+ {
227
+ Binding: binding.redirect,
228
+ Location: opts.sloUrl,
229
+ },
230
+ {
231
+ Binding: binding.post,
232
+ Location: opts.sloUrl,
233
+ },
234
+ ]
235
+ : undefined,
236
+ });
237
+ return sp.getMetadata();
238
+ }
239
+
240
+ /** @internal */
241
+ export function createEnterpriseSamlMetadataXml(opts: {
242
+ rootUrl: string;
243
+ source: EnterpriseSamlSource;
244
+ config: unknown;
245
+ }) {
246
+ return createServiceProviderMetadata(
247
+ getSamlServiceProviderOptions({
248
+ rootUrl: opts.rootUrl,
249
+ source: opts.source,
250
+ config: opts.config,
251
+ }),
252
+ );
253
+ }
254
+
255
+ /** @internal */
256
+ export function getSamlServiceProviderOptions(opts: {
257
+ rootUrl: string;
258
+ source: EnterpriseSamlSource;
259
+ config: unknown;
260
+ overrides?: {
261
+ entityId?: string;
262
+ acsUrl?: string;
263
+ sloUrl?: string;
264
+ };
265
+ relayState?: string;
266
+ }) {
267
+ const saml = getSamlConfig(opts.config);
268
+ const sp = asRecord(saml.sp) ?? {};
269
+ const urls = getEnterpriseSamlUrls({
270
+ rootUrl: opts.rootUrl,
271
+ source: opts.source,
272
+ });
273
+ return {
274
+ entityId: opts.overrides?.entityId ?? sp.entityId ?? urls.metadataUrl,
275
+ acsUrl: opts.overrides?.acsUrl ?? sp.acsUrl ?? urls.acsUrl,
276
+ sloUrl: opts.overrides?.sloUrl ?? sp.sloUrl ?? urls.sloUrl,
277
+ relayState: opts.relayState,
278
+ authnRequestsSigned: saml.signAuthnRequests,
279
+ signingCert: sp.signingCert,
280
+ encryptCert: sp.encryptCert,
281
+ privateKey: sp.privateKey,
282
+ privateKeyPass: sp.privateKeyPass,
283
+ encPrivateKey: sp.encPrivateKey,
284
+ encPrivateKeyPass: sp.encPrivateKeyPass,
285
+ };
286
+ }
287
+
288
+ /** @internal */
289
+ export function createSamlServiceProvider(opts: {
290
+ entityId: string;
291
+ acsUrl: string;
292
+ sloUrl?: string;
293
+ relayState?: string;
294
+ authnRequestsSigned?: boolean;
295
+ signingCert?: string | string[];
296
+ encryptCert?: string | string[];
297
+ privateKey?: string;
298
+ privateKeyPass?: string;
299
+ encPrivateKey?: string;
300
+ encPrivateKeyPass?: string;
301
+ }) {
302
+ const binding = Constants.namespace.binding;
303
+ return ServiceProvider({
304
+ entityID: opts.entityId,
305
+ relayState: opts.relayState ?? "",
306
+ authnRequestsSigned: opts.authnRequestsSigned ?? false,
307
+ privateKey: opts.privateKey,
308
+ privateKeyPass: opts.privateKeyPass,
309
+ signingCert: opts.signingCert,
310
+ encryptCert: opts.encryptCert,
311
+ encPrivateKey: opts.encPrivateKey,
312
+ encPrivateKeyPass: opts.encPrivateKeyPass,
313
+ assertionConsumerService: [
314
+ {
315
+ Binding: binding.post,
316
+ Location: opts.acsUrl,
317
+ },
318
+ ],
319
+ singleLogoutService: opts.sloUrl
320
+ ? [
321
+ { Binding: binding.redirect, Location: opts.sloUrl },
322
+ { Binding: binding.post, Location: opts.sloUrl },
323
+ ]
324
+ : undefined,
325
+ });
326
+ }
327
+
328
+ /** @internal */
329
+ export function createEnterpriseSamlRuntime(opts: {
330
+ rootUrl: string;
331
+ source: EnterpriseSamlSource;
332
+ config: unknown;
333
+ relayState?: string;
334
+ overrides?: {
335
+ entityId?: string;
336
+ acsUrl?: string;
337
+ sloUrl?: string;
338
+ };
339
+ }) {
340
+ const saml = getSamlConfig(opts.config);
341
+ const spOptions = getSamlServiceProviderOptions({
342
+ rootUrl: opts.rootUrl,
343
+ source: opts.source,
344
+ config: opts.config,
345
+ relayState: opts.relayState,
346
+ overrides: opts.overrides,
347
+ });
348
+ if (typeof saml.idp?.metadataXml !== "string") {
349
+ throw new Error("SAML IdP metadata is missing.");
350
+ }
351
+ return {
352
+ saml,
353
+ sp: createSamlServiceProvider(spOptions),
354
+ idp: IdentityProvider({ metadata: saml.idp.metadataXml }),
355
+ urls: getEnterpriseSamlUrls({ rootUrl: opts.rootUrl, source: opts.source }),
356
+ };
357
+ }
358
+
359
+ /** @internal */
360
+ export function createEnterpriseSamlSignInRequest(opts: {
361
+ rootUrl: string;
362
+ source: EnterpriseSamlSource;
363
+ config: unknown;
364
+ state: string;
365
+ signature: string;
366
+ redirectTo?: string;
367
+ }) {
368
+ const runtime = createEnterpriseSamlRuntime({
369
+ rootUrl: opts.rootUrl,
370
+ source: opts.source,
371
+ config: opts.config,
372
+ });
373
+ const binding = runtime.saml.idp.sso?.redirect ? "redirect" : "post";
374
+ const loginRequest = runtime.sp.createLoginRequest(
375
+ runtime.idp,
376
+ binding as any,
377
+ ) as any;
378
+ const relayState = encodeEnterpriseSamlRelayState({
379
+ source: opts.source,
380
+ signature: opts.signature,
381
+ requestId: loginRequest.id,
382
+ state: opts.state,
383
+ redirectTo: opts.redirectTo,
384
+ });
385
+ return {
386
+ requestId: loginRequest.id as string,
387
+ binding,
388
+ relayState,
389
+ redirectUrl:
390
+ binding === "redirect"
391
+ ? (() => {
392
+ const redirectUrl = new URL(loginRequest.context);
393
+ redirectUrl.searchParams.set("RelayState", relayState);
394
+ return redirectUrl.toString();
395
+ })()
396
+ : undefined,
397
+ post:
398
+ binding === "post"
399
+ ? {
400
+ endpoint: loginRequest.entityEndpoint as string,
401
+ value: loginRequest.context as string,
402
+ }
403
+ : undefined,
404
+ };
405
+ }
406
+
407
+ /** @internal */
408
+ export async function parseEnterpriseSamlLoginResponse(opts: {
409
+ request: Request;
410
+ rootUrl: string;
411
+ source: EnterpriseSamlSource;
412
+ config: unknown;
413
+ }) {
414
+ ensureSamlifyValidator();
415
+ const httpRequest = await readEnterpriseSamlHttpRequest(opts.request);
416
+ const runtime = createEnterpriseSamlRuntime({
417
+ rootUrl: opts.rootUrl,
418
+ source: opts.source,
419
+ config: opts.config,
420
+ });
421
+ const parsed = (await runtime.sp.parseLoginResponse(
422
+ runtime.idp as any,
423
+ httpRequest.binding as any,
424
+ {
425
+ query: httpRequest.query,
426
+ body: httpRequest.body,
427
+ },
428
+ )) as any;
429
+ // Check for weak SAML algorithms and warn.
430
+ warnWeakSamlAlgorithms(parsed);
431
+
432
+ return {
433
+ ...httpRequest,
434
+ runtime,
435
+ parsed,
436
+ relayState: decodeEnterpriseSamlRelayStateOrThrow(
437
+ httpRequest.relayState ?? null,
438
+ ),
439
+ };
440
+ }
441
+
442
+ const WEAK_SAML_ALGORITHMS = new Set([
443
+ // Signature algorithms
444
+ "http://www.w3.org/2000/09/xmldsig#rsa-sha1",
445
+ "http://www.w3.org/2000/09/xmldsig#dsa-sha1",
446
+ // Digest algorithms
447
+ "http://www.w3.org/2000/09/xmldsig#sha1",
448
+ // Key encryption
449
+ "http://www.w3.org/2001/04/xmlenc#rsa-1_5",
450
+ // Data encryption
451
+ "http://www.w3.org/2001/04/xmlenc#tripledes-cbc",
452
+ ]);
453
+
454
+ /**
455
+ * Warn when the SAML response uses weak cryptographic algorithms
456
+ * such as SHA-1, RSA 1.5, or 3DES.
457
+ */
458
+ function warnWeakSamlAlgorithms(parsed: any) {
459
+ try {
460
+ const sigAlg =
461
+ parsed?.extract?.signature?.signatureAlgorithm ??
462
+ parsed?.extract?.response?.signatureAlgorithm;
463
+ const digestAlg = parsed?.extract?.signature?.digestAlgorithm;
464
+
465
+ if (sigAlg && WEAK_SAML_ALGORITHMS.has(sigAlg)) {
466
+ console.warn(
467
+ `[convex-auth] SAML response uses weak signature algorithm: ${sigAlg}. ` +
468
+ `Consider upgrading your IdP to use RSA-SHA256 or stronger.`,
469
+ );
470
+ }
471
+ if (digestAlg && WEAK_SAML_ALGORITHMS.has(digestAlg)) {
472
+ console.warn(
473
+ `[convex-auth] SAML response uses weak digest algorithm: ${digestAlg}. ` +
474
+ `Consider upgrading your IdP to use SHA-256 or stronger.`,
475
+ );
476
+ }
477
+ } catch {
478
+ // Non-critical — don't break auth flow for algorithm check failures
479
+ }
480
+ }
481
+
482
+ /** @internal */
483
+ export function validateEnterpriseSamlLoginRelayState(opts: {
484
+ relayState: EnterpriseSamlRelayState;
485
+ source: EnterpriseSamlSource;
486
+ inResponseTo?: string;
487
+ }) {
488
+ if (
489
+ opts.relayState.source.kind !== opts.source.kind ||
490
+ opts.relayState.source.id !== opts.source.id ||
491
+ opts.relayState.requestId !== opts.inResponseTo
492
+ ) {
493
+ throw new Error("SAML RelayState did not match the pending login request.");
494
+ }
495
+ }
496
+
497
+ /** @internal */
498
+ export async function parseEnterpriseSamlLogoutMessage(opts: {
499
+ request: Request;
500
+ rootUrl: string;
501
+ source: EnterpriseSamlSource;
502
+ config: unknown;
503
+ }) {
504
+ ensureSamlifyValidator();
505
+ const httpRequest = await readEnterpriseSamlHttpRequest(opts.request);
506
+ const runtime = createEnterpriseSamlRuntime({
507
+ rootUrl: opts.rootUrl,
508
+ source: opts.source,
509
+ config: opts.config,
510
+ relayState: httpRequest.relayState,
511
+ });
512
+ const parsedRequest = httpRequest.hasSamlRequest
513
+ ? ((await runtime.sp.parseLogoutRequest(
514
+ runtime.idp as any,
515
+ httpRequest.binding as any,
516
+ {
517
+ query: httpRequest.query,
518
+ body: httpRequest.body,
519
+ },
520
+ )) as any)
521
+ : undefined;
522
+ return {
523
+ ...httpRequest,
524
+ runtime,
525
+ parsedRequest,
526
+ };
527
+ }
528
+
529
+ /** @internal */
530
+ export function profileFromSamlExtract(
531
+ extract: any,
532
+ mapping?: SAMLAttributeMapping,
533
+ ) {
534
+ const attributes =
535
+ typeof extract?.attributes === "object" && extract.attributes !== null
536
+ ? (extract.attributes as Record<string, unknown>)
537
+ : {};
538
+ const resolveFirst = (...keys: Array<string | undefined>) => {
539
+ for (const key of keys) {
540
+ if (!key) {
541
+ continue;
542
+ }
543
+ const attribute = attributes[key];
544
+ const value = Array.isArray(attribute) ? attribute[0] : attribute;
545
+ if (value !== undefined) {
546
+ return value;
547
+ }
548
+ }
549
+ return undefined;
550
+ };
551
+ const fieldResolvers = {
552
+ email: () => resolveFirst(mapping?.email),
553
+ name: () =>
554
+ resolveFirst(mapping?.name) ??
555
+ ([resolveFirst(mapping?.firstName), resolveFirst(mapping?.lastName)]
556
+ .filter(Boolean)
557
+ .join(" ") ||
558
+ undefined),
559
+ subject: () =>
560
+ resolveFirst(mapping?.subject) ?? (extract?.nameID as string | undefined),
561
+ } as const;
562
+ const subject = fieldResolvers.subject() as string | undefined;
563
+ if (subject === undefined) {
564
+ throw new Error(
565
+ "SAML profile is missing a subject. Configure `attributeMapping.subject` or ensure the assertion includes a NameID.",
566
+ );
567
+ }
568
+ const email = fieldResolvers.email() as string | undefined;
569
+ const name = fieldResolvers.name() as string | undefined;
570
+ return {
571
+ id: subject,
572
+ email,
573
+ emailVerified: typeof email === "string" ? true : undefined,
574
+ name,
575
+ samlAttributes: attributes,
576
+ samlSessionIndex: extract?.sessionIndex?.SessionIndex as string | undefined,
577
+ };
578
+ }
package/src/server/enterprise/scim.ts ADDED
@@ -0,0 +1,135 @@
1
+ import type { ScimListRequest } from "./shared";
2
+ import { SCIM_GROUP_SCHEMA_ID, SCIM_USER_SCHEMA_ID } from "./shared";
3
+
4
+ /** @internal */
5
+ export function parseScimPath(pathname: string) {
6
+ const parts = pathname.split("/").filter(Boolean);
7
+ const [api, auth, sso, enterpriseId, protocol, version, ...rest] = parts;
8
+
9
+ if (
10
+ api !== "api" ||
11
+ auth !== "auth" ||
12
+ sso !== "sso" ||
13
+ !enterpriseId ||
14
+ enterpriseId === "setup" ||
15
+ protocol !== "scim" ||
16
+ version !== "v2"
17
+ ) {
18
+ return {
19
+ enterpriseId: "",
20
+ resource: "",
21
+ resourceId: undefined,
22
+ };
23
+ }
24
+
25
+ return {
26
+ enterpriseId,
27
+ resource: rest[0] ?? "",
28
+ resourceId: rest[1],
29
+ };
30
+ }
31
+
32
+ /** @internal */
33
+ export function parseScimListRequest(url: URL): ScimListRequest {
34
+ const startIndex = Math.max(
35
+ 1,
36
+ Number(url.searchParams.get("startIndex") ?? "1"),
37
+ );
38
+ const count = Math.min(
39
+ 100,
40
+ Math.max(1, Number(url.searchParams.get("count") ?? "100")),
41
+ );
42
+ const filterParam = url.searchParams.get("filter");
43
+ const filter = filterParam
44
+ ? (() => {
45
+ const match = filterParam.match(/^([A-Za-z0-9_.]+)\s+eq\s+"([^"]+)"$/);
46
+ if (!match) {
47
+ throw new Error("Unsupported SCIM filter.");
48
+ }
49
+ return { attribute: match[1]!, value: match[2]! };
50
+ })()
51
+ : undefined;
52
+ return { startIndex, count, filter };
53
+ }
54
+
55
+ /** @internal */
56
+ export function scimJson(data: unknown, status = 200, headers?: HeadersInit) {
57
+ const responseHeaders = new Headers({
58
+ "Content-Type": "application/scim+json",
59
+ });
60
+ if (headers) {
61
+ new Headers(headers).forEach((value, key) => {
62
+ responseHeaders.set(key, value);
63
+ });
64
+ }
65
+ return new Response(JSON.stringify(data), {
66
+ status,
67
+ headers: responseHeaders,
68
+ });
69
+ }
70
+
71
+ /** @internal */
72
+ export function scimError(status: number, scimType: string, detail: string) {
73
+ return scimJson(
74
+ {
75
+ schemas: ["urn:ietf:params:scim:api:messages:2.0:Error"],
76
+ status: String(status),
77
+ scimType,
78
+ detail,
79
+ },
80
+ status,
81
+ );
82
+ }
83
+
84
+ /** @internal */
85
+ export function serializeScimUser(args: {
86
+ id: string;
87
+ user: Record<string, any>;
88
+ externalId?: string;
89
+ active?: boolean;
90
+ location?: string;
91
+ }) {
92
+ return {
93
+ schemas: [SCIM_USER_SCHEMA_ID],
94
+ id: args.id,
95
+ externalId: args.externalId,
96
+ meta: {
97
+ resourceType: "User",
98
+ location: args.location,
99
+ },
100
+ userName: args.user.email ?? args.user.phone ?? args.user.name ?? args.id,
101
+ active: args.active ?? true,
102
+ name:
103
+ args.user.name !== undefined ? { formatted: args.user.name } : undefined,
104
+ emails:
105
+ typeof args.user.email === "string"
106
+ ? [{ value: args.user.email, primary: true }]
107
+ : undefined,
108
+ phoneNumbers:
109
+ typeof args.user.phone === "string"
110
+ ? [{ value: args.user.phone, primary: true }]
111
+ : undefined,
112
+ displayName: args.user.name,
113
+ };
114
+ }
115
+
116
+ /** @internal */
117
+ export function serializeScimGroup(args: {
118
+ id: string;
119
+ group: Record<string, any>;
120
+ externalId?: string;
121
+ members?: Array<{ value: string; display?: string }>;
122
+ location?: string;
123
+ }) {
124
+ return {
125
+ schemas: [SCIM_GROUP_SCHEMA_ID],
126
+ id: args.id,
127
+ externalId: args.externalId,
128
+ meta: {
129
+ resourceType: "Group",
130
+ location: args.location,
131
+ },
132
+ displayName: args.group.name ?? args.id,
133
+ members: args.members ?? [],
134
+ };
135
+ }