@robelest/convex-auth 0.0.4-preview.18 → 0.0.4-preview.19

package/src/server/mutations/account.ts

@@ -3,12 +3,12 @@ import type { GenericActionCtx, GenericDataModel } from "convex/server";
 import { Infer, v } from "convex/values";
 
 import { authDb } from "../db";
-import { AuthError } from "../fx";
-import { GetProviderOrThrowFunc, hash } from "../provider";
-import * as Provider from "../provider";
+import { AuthError } from "../authError";
+import { GetProviderOrThrowFunc, hash } from "../crypto";
+import * as Provider from "../crypto";
 import { MutationCtx } from "../types";
 import { LOG_LEVELS, logWithLevel, maybeRedact } from "../utils";
-import { AUTH_STORE_REF } from "./store";
+import { AUTH_STORE_REF } from "./store/refs";
 
 export const modifyAccountArgs = v.object({
   provider: v.string(),

package/src/server/mutations/code.ts

@@ -2,14 +2,14 @@ import type { GenericActionCtx, GenericDataModel } from "convex/server";
 import { GenericId, Infer, v } from "convex/values";
 
 import { authDb } from "../db";
-import { AuthError } from "../fx";
-import * as Provider from "../provider";
+import { AuthError } from "../authError";
+import * as Provider from "../crypto";
 import { getAuthSessionId } from "../sessions";
 import { MutationCtx } from "../types";
 import { EmailConfig, PhoneConfig } from "../types";
 import { upsertUserAndAccount } from "../users";
 import { LOG_LEVELS, logWithLevel, sha256 } from "../utils";
-import { AUTH_STORE_REF } from "./store";
+import { AUTH_STORE_REF } from "./store/refs";
 
 export const createVerificationCodeArgs = v.object({
   accountId: v.optional(v.string()),

package/src/server/mutations/index.ts

@@ -1,153 +1,13 @@
-import { Fx } from "@robelest/fx";
-import { Infer, v } from "convex/values";
-
-import * as Provider from "../provider";
-import { MutationCtx } from "../types";
-import { LOG_LEVELS, logWithLevel } from "../utils";
-import { modifyAccountArgs, modifyAccountImpl } from "./account";
-import { createVerificationCodeArgs, createVerificationCodeImpl } from "./code";
-import { invalidateSessionsArgs, invalidateSessionsImpl } from "./invalidate";
-import { userOAuthArgs, userOAuthImpl } from "./oauth";
-import { refreshSessionArgs, refreshSessionImpl } from "./refresh";
-import {
-  createAccountFromCredentialsArgs,
-  createAccountFromCredentialsImpl,
-} from "./register";
-import {
-  retrieveAccountWithCredentialsArgs,
-  retrieveAccountWithCredentialsImpl,
-} from "./retrieve";
-import { verifierSignatureArgs, verifierSignatureImpl } from "./signature";
-import { signInArgs, signInImpl } from "./signin";
-import { signOutImpl } from "./signout";
-import { verifierImpl } from "./verifier";
-import { verifyCodeAndSignInArgs, verifyCodeAndSignInImpl } from "./verify";
-export { callInvalidateSessions } from "./invalidate";
 export { callModifyAccount } from "./account";
-export {
-  callRetrieveAccountWithCredentials,
-  callRetreiveAccountWithCredentials,
-} from "./retrieve";
-export { callCreateAccountFromCredentials } from "./register";
 export { callCreateVerificationCode } from "./code";
+export { callInvalidateSessions } from "./invalidate";
 export { callUserOAuth } from "./oauth";
-export { callVerifierSignature } from "./signature";
-export { callVerifyCodeAndSignIn } from "./verify";
-export { callVerifier } from "./verifier";
 export { callRefreshSession } from "./refresh";
-export { callSignOut } from "./signout";
+export { callCreateAccountFromCredentials } from "./register";
+export { callRetrieveAccountWithCredentials } from "./retrieve";
+export { callVerifierSignature } from "./signature";
 export { callSignIn } from "./signin";
-
-export const storeArgs = v.object({
-  args: v.union(
-    v.object({
-      type: v.literal("signIn"),
-      ...signInArgs.fields,
-    }),
-    v.object({
-      type: v.literal("signOut"),
-    }),
-    v.object({
-      type: v.literal("refreshSession"),
-      ...refreshSessionArgs.fields,
-    }),
-    v.object({
-      type: v.literal("verifyCodeAndSignIn"),
-      ...verifyCodeAndSignInArgs.fields,
-    }),
-    v.object({
-      type: v.literal("verifier"),
-    }),
-    v.object({
-      type: v.literal("verifierSignature"),
-      ...verifierSignatureArgs.fields,
-    }),
-    v.object({
-      type: v.literal("userOAuth"),
-      ...userOAuthArgs.fields,
-    }),
-    v.object({
-      type: v.literal("createVerificationCode"),
-      ...createVerificationCodeArgs.fields,
-    }),
-    v.object({
-      type: v.literal("createAccountFromCredentials"),
-      ...createAccountFromCredentialsArgs.fields,
-    }),
-    v.object({
-      type: v.literal("retrieveAccountWithCredentials"),
-      ...retrieveAccountWithCredentialsArgs.fields,
-    }),
-    v.object({
-      type: v.literal("modifyAccount"),
-      ...modifyAccountArgs.fields,
-    }),
-    v.object({
-      type: v.literal("invalidateSessions"),
-      ...invalidateSessionsArgs.fields,
-    }),
-  ),
-});
-
-export const storeImpl = async (
-  ctx: MutationCtx,
-  fnArgs: Infer<typeof storeArgs>,
-  getProviderOrThrow: Provider.GetProviderOrThrowFunc,
-  config: Provider.Config,
-) => {
-  const args = fnArgs.args;
-  logWithLevel(LOG_LEVELS.INFO, `\`auth:store\` type: ${args.type}`);
-  return Fx.run(
-    Fx.match(args, args.type, {
-      signIn: (a) =>
-        Fx.from({
-          ok: () => signInImpl(ctx, a, config),
-          err: (e) => e as never,
-        }),
-      signOut: () => signOutImpl(ctx, config),
-      refreshSession: (a) =>
-        Fx.from({
-          ok: () => refreshSessionImpl(ctx, a, getProviderOrThrow, config),
-          err: (e) => e as never,
-        }),
-      verifyCodeAndSignIn: (a) =>
-        Fx.from({
-          ok: () => verifyCodeAndSignInImpl(ctx, a, getProviderOrThrow, config),
-          err: (e) => e as never,
-        }),
-      verifier: () => verifierImpl(ctx, config),
-      verifierSignature: (a) =>
-        verifierSignatureImpl(ctx, a, config).pipe(
-          Fx.recover((e) => Fx.fatal(e.toConvexError())),
-        ),
-      userOAuth: (a) =>
-        userOAuthImpl(ctx, a, getProviderOrThrow, config).pipe(
-          Fx.recover((e) => Fx.fatal(e.toConvexError())),
-        ),
-      createVerificationCode: (a) =>
-        Fx.from({
-          ok: () =>
-            createVerificationCodeImpl(ctx, a, getProviderOrThrow, config),
-          err: (e) => e as never,
-        }),
-      createAccountFromCredentials: (a) =>
-        Fx.from({
-          ok: () =>
-            createAccountFromCredentialsImpl(
-              ctx,
-              a,
-              getProviderOrThrow,
-              config,
-            ),
-          err: (e) => e as never,
-        }),
-      retrieveAccountWithCredentials: (a) =>
-        retrieveAccountWithCredentialsImpl(ctx, a, getProviderOrThrow, config),
-      modifyAccount: (a) =>
-        modifyAccountImpl(ctx, a, getProviderOrThrow, config).pipe(
-          Fx.recover((e) => Fx.fatal(e.toConvexError())),
-        ),
-      invalidateSessions: (a) => invalidateSessionsImpl(ctx, a, config),
-    }),
-  );
-};
+export { callSignOut } from "./signout";
+export { storeArgs, storeImpl } from "./store";
+export { callVerifier } from "./verifier";
+export { callVerifyCodeAndSignIn } from "./verify";

package/src/server/mutations/invalidate.ts

@@ -3,11 +3,11 @@ import type { GenericActionCtx, GenericDataModel } from "convex/server";
 import { GenericId, Infer, v } from "convex/values";
 
 import { authDb } from "../db";
-import * as Provider from "../provider";
+import * as Provider from "../crypto";
 import { deleteSession } from "../sessions";
 import { Doc, MutationCtx } from "../types";
 import { LOG_LEVELS, logWithLevel } from "../utils";
-import { AUTH_STORE_REF } from "./store";
+import { AUTH_STORE_REF } from "./store/refs";
 
 export const invalidateSessionsArgs = v.object({
   userId: v.string(),

package/src/server/mutations/oauth.ts

@@ -3,20 +3,22 @@ import type { GenericActionCtx, GenericDataModel } from "convex/server";
 import { Infer, v } from "convex/values";
 
 import { authDb } from "../db";
-import { AuthError } from "../fx";
-import * as Provider from "../provider";
+import { AuthError } from "../authError";
+import * as Provider from "../crypto";
+import {
+  createSyntheticOAuthMaterializedConfig,
+} from "../enterprise/oidc";
+import { normalizeEnterprisePolicy } from "../enterprise/policy";
 import {
   ENTERPRISE_OIDC_PROVIDER_PREFIX,
   ENTERPRISE_SAML_PROVIDER_PREFIX,
-  createSyntheticOAuthMaterializedConfig,
   isEnterpriseProviderId,
-  normalizeEnterprisePolicy,
-} from "../sso";
+} from "../enterprise/shared";
 import { MutationCtx } from "../types";
 import type { AuthProviderMaterializedConfig } from "../types";
 import { upsertUserAndAccount } from "../users";
 import { generateRandomString, logWithLevel, sha256 } from "../utils";
-import { AUTH_STORE_REF } from "./store";
+import { AUTH_STORE_REF } from "./store/refs";
 
 const OAUTH_SIGN_IN_EXPIRATION_MS = 1000 * 60 * 2; // 2 minutes
 

package/src/server/mutations/refresh.ts

@@ -3,8 +3,8 @@ import type { GenericActionCtx, GenericDataModel } from "convex/server";
 import { Infer, v } from "convex/values";
 
 import { authDb } from "../db";
-import { AuthError } from "../fx";
-import * as Provider from "../provider";
+import { AuthError } from "../authError";
+import * as Provider from "../crypto";
 import {
   invalidateRefreshTokensInSubtree,
   parseRefreshToken,
@@ -14,7 +14,7 @@ import {
 import { generateTokensForSession } from "../sessions";
 import { MutationCtx } from "../types";
 import { logWithLevel, maybeRedact } from "../utils";
-import { AUTH_STORE_REF } from "./store";
+import { AUTH_STORE_REF } from "./store/refs";
 
 export const refreshSessionArgs = v.object({
   refreshToken: v.string(),

package/src/server/mutations/register.ts

@@ -3,14 +3,14 @@ import type { GenericActionCtx, GenericDataModel } from "convex/server";
 import { Infer, v } from "convex/values";
 
 import { authDb } from "../db";
-import { AuthError } from "../fx";
-import * as Provider from "../provider";
+import { AuthError } from "../authError";
+import * as Provider from "../crypto";
 import { getAuthSessionId } from "../sessions";
 import { Doc, MutationCtx } from "../types";
 import { ConvexCredentialsConfig } from "../types";
 import { upsertUserAndAccount } from "../users";
 import { LOG_LEVELS, logWithLevel, maybeRedact } from "../utils";
-import { AUTH_STORE_REF } from "./store";
+import { AUTH_STORE_REF } from "./store/refs";
 
 export const createAccountFromCredentialsArgs = v.object({
   provider: v.string(),

package/src/server/mutations/retrieve.ts

@@ -3,16 +3,16 @@ import type { GenericActionCtx, GenericDataModel } from "convex/server";
 import { Infer, v } from "convex/values";
 
 import { authDb } from "../db";
-import { AuthError } from "../fx";
-import * as Provider from "../provider";
+import { AuthError } from "../authError";
+import * as Provider from "../crypto";
 import {
   isSignInRateLimited,
   recordFailedSignIn,
   resetSignInRateLimit,
-} from "../ratelimit";
+} from "../limits";
 import { Doc, MutationCtx } from "../types";
 import { LOG_LEVELS, logWithLevel, maybeRedact } from "../utils";
-import { AUTH_STORE_REF } from "./store";
+import { AUTH_STORE_REF } from "./store/refs";
 
 export const retrieveAccountWithCredentialsArgs = v.object({
   provider: v.string(),
@@ -107,7 +107,3 @@ export const callRetrieveAccountWithCredentials = async <
     },
   });
 };
-
-/** @deprecated Typo kept for backward compatibility. */
-export const callRetreiveAccountWithCredentials =
-  callRetrieveAccountWithCredentials;

package/src/server/mutations/signature.ts

@@ -3,10 +3,10 @@ import type { GenericActionCtx, GenericDataModel } from "convex/server";
 import { GenericId, Infer, v } from "convex/values";
 
 import { authDb } from "../db";
-import { AuthError } from "../fx";
-import * as Provider from "../provider";
+import { AuthError } from "../authError";
+import * as Provider from "../crypto";
 import { MutationCtx } from "../types";
-import { AUTH_STORE_REF } from "./store";
+import { AUTH_STORE_REF } from "./store/refs";
 
 export const verifierSignatureArgs = v.object({
   verifier: v.string(),

package/src/server/mutations/signin.ts

@@ -1,14 +1,14 @@
 import type { GenericActionCtx, GenericDataModel } from "convex/server";
 import { GenericId, Infer, v } from "convex/values";
 
-import * as Provider from "../provider";
+import * as Provider from "../crypto";
 import {
   createNewAndDeleteExistingSession,
   maybeGenerateTokensForSession,
 } from "../sessions";
 import { MutationCtx, SessionInfo } from "../types";
 import { LOG_LEVELS, logWithLevel } from "../utils";
-import { AUTH_STORE_REF } from "./store";
+import { AUTH_STORE_REF } from "./store/refs";
 
 export const signInArgs = v.object({
   userId: v.string(),

package/src/server/mutations/signout.ts

@@ -3,10 +3,10 @@ import type { GenericActionCtx, GenericDataModel } from "convex/server";
 import { GenericId } from "convex/values";
 
 import { authDb } from "../db";
-import * as Provider from "../provider";
+import * as Provider from "../crypto";
 import { deleteSession, getAuthSessionId } from "../sessions";
 import { MutationCtx } from "../types";
-import { AUTH_STORE_REF } from "./store";
+import { AUTH_STORE_REF } from "./store/refs";
 
 type ReturnType = {
   userId: GenericId<"User">;

package/src/server/mutations/store/refs.ts

@@ -0,0 +1,10 @@
+import { makeFunctionReference } from "convex/server";
+
+/**
+ * Internal function reference for the library's store dispatch mutation.
+ *
+ * The package cannot import the consumer app's generated `api` module,
+ * so it uses a canonical function reference name that matches the app-level
+ * `export const { store } = auth` surface.
+ */
+export const AUTH_STORE_REF = makeFunctionReference("auth:store") as any;

package/src/server/mutations/store.ts

@@ -1,10 +1,138 @@
-import { makeFunctionReference } from "convex/server";
+import { Fx } from "@robelest/fx";
+import { Infer, v } from "convex/values";
 
-/**
- * Internal function reference for the library's store dispatch mutation.
- *
- * The package cannot import the consumer app's generated `api` module,
- * so it uses a canonical function reference name that matches the app-level
- * `export const { store } = auth` surface.
- */
-export const AUTH_STORE_REF = makeFunctionReference("auth:store") as any;
+import * as Provider from "../crypto";
+import { MutationCtx } from "../types";
+import { LOG_LEVELS, logWithLevel } from "../utils";
+import { modifyAccountArgs, modifyAccountImpl } from "./account";
+import { createVerificationCodeArgs, createVerificationCodeImpl } from "./code";
+import { invalidateSessionsArgs, invalidateSessionsImpl } from "./invalidate";
+import { userOAuthArgs, userOAuthImpl } from "./oauth";
+import { refreshSessionArgs, refreshSessionImpl } from "./refresh";
+import {
+  createAccountFromCredentialsArgs,
+  createAccountFromCredentialsImpl,
+} from "./register";
+import {
+  retrieveAccountWithCredentialsArgs,
+  retrieveAccountWithCredentialsImpl,
+} from "./retrieve";
+import { verifierSignatureArgs, verifierSignatureImpl } from "./signature";
+import { signInArgs, signInImpl } from "./signin";
+import { signOutImpl } from "./signout";
+import { verifierImpl } from "./verifier";
+import { verifyCodeAndSignInArgs, verifyCodeAndSignInImpl } from "./verify";
+
+export const storeArgs = v.object({
+  args: v.union(
+    v.object({
+      type: v.literal("signIn"),
+      ...signInArgs.fields,
+    }),
+    v.object({
+      type: v.literal("signOut"),
+    }),
+    v.object({
+      type: v.literal("refreshSession"),
+      ...refreshSessionArgs.fields,
+    }),
+    v.object({
+      type: v.literal("verifyCodeAndSignIn"),
+      ...verifyCodeAndSignInArgs.fields,
+    }),
+    v.object({
+      type: v.literal("verifier"),
+    }),
+    v.object({
+      type: v.literal("verifierSignature"),
+      ...verifierSignatureArgs.fields,
+    }),
+    v.object({
+      type: v.literal("userOAuth"),
+      ...userOAuthArgs.fields,
+    }),
+    v.object({
+      type: v.literal("createVerificationCode"),
+      ...createVerificationCodeArgs.fields,
+    }),
+    v.object({
+      type: v.literal("createAccountFromCredentials"),
+      ...createAccountFromCredentialsArgs.fields,
+    }),
+    v.object({
+      type: v.literal("retrieveAccountWithCredentials"),
+      ...retrieveAccountWithCredentialsArgs.fields,
+    }),
+    v.object({
+      type: v.literal("modifyAccount"),
+      ...modifyAccountArgs.fields,
+    }),
+    v.object({
+      type: v.literal("invalidateSessions"),
+      ...invalidateSessionsArgs.fields,
+    }),
+  ),
+});
+
+export const storeImpl = async (
+  ctx: MutationCtx,
+  fnArgs: Infer<typeof storeArgs>,
+  getProviderOrThrow: Provider.GetProviderOrThrowFunc,
+  config: Provider.Config,
+) => {
+  const args = fnArgs.args;
+  logWithLevel(LOG_LEVELS.INFO, `\`auth:store\` type: ${args.type}`);
+  return Fx.run(
+    Fx.match(args, args.type, {
+      signIn: (a) =>
+        Fx.from({
+          ok: () => signInImpl(ctx, a, config),
+          err: (e) => e as never,
+        }),
+      signOut: () => signOutImpl(ctx, config),
+      refreshSession: (a) =>
+        Fx.from({
+          ok: () => refreshSessionImpl(ctx, a, getProviderOrThrow, config),
+          err: (e) => e as never,
+        }),
+      verifyCodeAndSignIn: (a) =>
+        Fx.from({
+          ok: () => verifyCodeAndSignInImpl(ctx, a, getProviderOrThrow, config),
+          err: (e) => e as never,
+        }),
+      verifier: () => verifierImpl(ctx, config),
+      verifierSignature: (a) =>
+        verifierSignatureImpl(ctx, a, config).pipe(
+          Fx.recover((e) => Fx.fatal(e.toConvexError())),
+        ),
+      userOAuth: (a) =>
+        userOAuthImpl(ctx, a, getProviderOrThrow, config).pipe(
+          Fx.recover((e) => Fx.fatal(e.toConvexError())),
+        ),
+      createVerificationCode: (a) =>
+        Fx.from({
+          ok: () =>
+            createVerificationCodeImpl(ctx, a, getProviderOrThrow, config),
+          err: (e) => e as never,
+        }),
+      createAccountFromCredentials: (a) =>
+        Fx.from({
+          ok: () =>
+            createAccountFromCredentialsImpl(
+              ctx,
+              a,
+              getProviderOrThrow,
+              config,
+            ),
+          err: (e) => e as never,
+        }),
+      retrieveAccountWithCredentials: (a) =>
+        retrieveAccountWithCredentialsImpl(ctx, a, getProviderOrThrow, config),
+      modifyAccount: (a) =>
+        modifyAccountImpl(ctx, a, getProviderOrThrow, config).pipe(
+          Fx.recover((e) => Fx.fatal(e.toConvexError())),
+        ),
+      invalidateSessions: (a) => invalidateSessionsImpl(ctx, a, config),
+    }),
+  );
+};

package/src/server/mutations/verifier.ts

@@ -3,10 +3,10 @@ import type { GenericActionCtx, GenericDataModel } from "convex/server";
 import { GenericId } from "convex/values";
 
 import { authDb } from "../db";
-import * as Provider from "../provider";
+import * as Provider from "../crypto";
 import { getAuthSessionId } from "../sessions";
 import { MutationCtx } from "../types";
-import { AUTH_STORE_REF } from "./store";
+import { AUTH_STORE_REF } from "./store/refs";
 
 type ReturnType = GenericId<"AuthVerifier">;
 

package/src/server/mutations/verify.ts

@@ -3,12 +3,12 @@ import type { GenericActionCtx, GenericDataModel } from "convex/server";
 import { Infer, v } from "convex/values";
 
 import { authDb } from "../db";
-import * as Provider from "../provider";
+import * as Provider from "../crypto";
 import {
   isSignInRateLimited,
   recordFailedSignIn,
   resetSignInRateLimit,
-} from "../ratelimit";
+} from "../limits";
 import {
   createNewAndDeleteExistingSession,
   getAuthSessionId,
@@ -16,13 +16,13 @@ import {
 } from "../sessions";
 import {
   createSyntheticOAuthMaterializedConfig,
-  isEnterpriseProviderId,
-} from "../sso";
+} from "../enterprise/oidc";
+import { isEnterpriseProviderId } from "../enterprise/shared";
 import { MutationCtx, SessionInfo } from "../types";
 import { upsertUserAndAccount } from "../users";
 import { LOG_LEVELS, logWithLevel, sha256 } from "../utils";
 import { requireEnv } from "../utils";
-import { AUTH_STORE_REF } from "./store";
+import { AUTH_STORE_REF } from "./store/refs";
 
 export const verifyCodeAndSignInArgs = v.object({
   params: v.any(),

package/src/server/oauth.ts

@@ -13,7 +13,7 @@ import { Fx } from "@robelest/fx";
 import * as arctic from "arctic";
 
 import { SHARED_COOKIE_OPTIONS } from "./cookies";
-import { AuthError } from "./fx";
+import { AuthError } from "./authError";
 import type { OAuthProfile } from "./types";
 import { logWithLevel } from "./utils";
 import { isLocalHost } from "./utils";

package/src/server/passkey.ts

@@ -45,7 +45,9 @@ import {
 import type { Fx as FxType } from "@robelest/fx";
 
 import { authDb } from "./db";
-import { AuthError, Fx } from "./fx";
+import { Fx } from "@robelest/fx";
+
+import { AuthError } from "./authError";
 import { userIdFromIdentitySubject } from "./identity";
 import { callSignIn, callVerifier } from "./mutations/index";
 import { callVerifierSignature } from "./mutations/signature";
@@ -780,6 +782,3 @@ export function handlePasskeyFx(
     }),
   );
 }
-
-// Keep backward-compatible export name — callers can migrate to handlePasskeyFx
-export { handlePasskeyFx as handlePasskey };

package/src/server/redirects.ts

@@ -1,4 +1,4 @@
-import { AuthError } from "./fx";
+import { AuthError } from "./authError";
 import { ConvexAuthMaterializedConfig } from "./types";
 import { requireEnv } from "./utils";
 

package/src/server/refresh.ts

@@ -2,7 +2,7 @@ import { Fx } from "@robelest/fx";
 import { GenericId } from "convex/values";
 
 import { authDb } from "./db";
-import { AuthError } from "./fx";
+import { AuthError } from "./authError";
 import { Doc, MutationCtx } from "./types";
 import { ConvexAuthConfig } from "./types";
 import {