@robelest/convex-auth 0.0.4-preview.18 → 0.0.4-preview.19

package/src/server/enterprise/shared.ts

@@ -0,0 +1,134 @@
+/** @internal */
+export type ParsedSamlMetadata = {
+  issuer: string;
+  sso: {
+    redirect?: string;
+    post?: string;
+  };
+  slo: {
+    redirect?: string;
+    post?: string;
+  };
+  signingCert: string | string[] | null;
+  encryptionCert: string | string[] | null;
+  nameIdFormats: string[];
+  wantsSignedAuthnRequests: boolean;
+};
+
+/** @internal */
+export type EnterpriseSamlSource = { kind: "enterprise"; id: string };
+
+/** @internal */
+export type EnterpriseSamlRelayState = {
+  source: EnterpriseSamlSource;
+  signature: string;
+  requestId: string;
+  state: string;
+  redirectTo?: string;
+};
+
+/** @internal */
+export type EnterpriseSamlUrls = {
+  metadataUrl: string;
+  acsUrl: string;
+  sloUrl?: string;
+};
+
+/** @internal */
+export type EnterpriseSamlLoadedSource = {
+  source: EnterpriseSamlSource;
+  config: unknown;
+  status?: string;
+};
+
+/** @internal */
+export type EnterpriseSamlHttpRequest = {
+  url: URL;
+  body: Record<string, string>;
+  query: Record<string, string>;
+  binding: "redirect" | "post";
+  relayState?: string;
+  hasSamlRequest: boolean;
+  hasSamlResponse: boolean;
+};
+
+/** @internal */
+export type ScimListRequest = {
+  startIndex: number;
+  count: number;
+  filter?: { attribute: string; value: string };
+};
+
+/** @internal */
+export const SCIM_USER_SCHEMA_ID = "urn:ietf:params:scim:schemas:core:2.0:User";
+/** @internal */
+export const SCIM_GROUP_SCHEMA_ID =
+  "urn:ietf:params:scim:schemas:core:2.0:Group";
+
+/** @internal */
+export const ENTERPRISE_OIDC_PROVIDER_PREFIX = "enterprise:oidc:";
+/** @internal */
+export const ENTERPRISE_SAML_PROVIDER_PREFIX = "enterprise:saml:";
+
+/** @internal */
+export function normalizeDomain(domain: string): string {
+  return domain.trim().toLowerCase().replace(/^@+/, "");
+}
+
+/** @internal */
+export function enterpriseOidcProviderId(enterpriseId: string): string {
+  return `${ENTERPRISE_OIDC_PROVIDER_PREFIX}${enterpriseId}`;
+}
+
+/** @internal */
+export function enterpriseSamlProviderId(enterpriseId: string): string {
+  return `${ENTERPRISE_SAML_PROVIDER_PREFIX}${enterpriseId}`;
+}
+
+/** @internal */
+export function getEnterpriseSamlUrls(opts: {
+  rootUrl: string;
+  source: EnterpriseSamlSource;
+}): EnterpriseSamlUrls {
+  const root = opts.rootUrl.replace(/\/$/, "");
+  const metadataBase = `${root}/api/auth/sso/${opts.source.id}/saml/metadata`;
+  const acsBase = `${root}/api/auth/sso/${opts.source.id}/saml/acs`;
+  const sloBase = `${root}/api/auth/sso/${opts.source.id}/saml/slo`;
+  return {
+    metadataUrl: metadataBase,
+    acsUrl: acsBase,
+    sloUrl: sloBase,
+  };
+}
+
+/** @internal */
+export function getEnterpriseOidcUrls(opts: {
+  rootUrl: string;
+  enterpriseId: string;
+}) {
+  const root = opts.rootUrl.replace(/\/$/, "");
+  return {
+    signInUrl: `${root}/api/auth/sso/${opts.enterpriseId}/oidc/signin`,
+    callbackUrl: `${root}/api/auth/sso/${opts.enterpriseId}/oidc/callback`,
+  };
+}
+
+/** @internal */
+export function isEnterpriseSamlSourceActive(
+  source: EnterpriseSamlLoadedSource,
+) {
+  return source.status === "active";
+}
+
+/** @internal */
+export function isEnterpriseProviderId(providerId: string): boolean {
+  return (
+    providerId.startsWith(ENTERPRISE_OIDC_PROVIDER_PREFIX) ||
+    providerId.startsWith(ENTERPRISE_SAML_PROVIDER_PREFIX)
+  );
+}
+
+export const asRecord = (value: unknown) =>
+  typeof value === "object" && value !== null
+    ? (value as Record<string, any>)
+    : null;

package/src/server/errors.ts

@@ -191,6 +191,8 @@ export type AuthErrorCode = keyof typeof AUTH_ERRORS;
  *   throwAuthError("FORBIDDEN");
  * }
  * ```
+ *
+ * @throws {ConvexError} Always — throws a `ConvexError` with `{ code, message }` payload.
  */
 export function throwAuthError(
   code: AuthErrorCode,

package/src/server/http.ts

@@ -8,7 +8,9 @@ import { ConvexError } from "convex/values";
 import { parse as parseCookies } from "cookie";
 
 import { isAuthError } from "./errors";
-import { AuthError, Fx } from "./fx";
+import { Fx } from "@robelest/fx";
+
+import { AuthError } from "./authError";
 import type { CorsConfig, HttpKeyContext } from "./types";
 import { logError } from "./utils";
 

package/src/server/identity.ts

@@ -1,4 +1,4 @@
-import { AuthError } from "./fx";
+import { AuthError } from "./authError";
 
 /** @internal */
 export function userIdFromIdentitySubject(subject: string): string {