@robelest/convex-auth 0.0.4-preview.18 → 0.0.4-preview.19

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (541) hide show
  1. package/README.md +6 -3
  2. package/dist/authorization/index.d.ts +46 -0
  3. package/dist/authorization/index.d.ts.map +1 -1
  4. package/dist/authorization/index.js +46 -0
  5. package/dist/authorization/index.js.map +1 -1
  6. package/dist/bin.cjs +21 -13
  7. package/dist/client/core/types.d.ts +20 -0
  8. package/dist/client/core/types.d.ts.map +1 -0
  9. package/dist/client/index.d.ts +2 -16
  10. package/dist/client/index.d.ts.map +1 -1
  11. package/dist/client/index.js +67 -565
  12. package/dist/client/index.js.map +1 -1
  13. package/dist/component/_generated/api.d.ts +40 -12
  14. package/dist/component/_generated/api.d.ts.map +1 -1
  15. package/dist/component/_generated/api.js.map +1 -1
  16. package/dist/component/_generated/component.d.ts +1306 -1344
  17. package/dist/component/_generated/component.d.ts.map +1 -1
  18. package/dist/component/client/core/types.d.ts +2 -0
  19. package/dist/component/client/index.d.ts +2 -2
  20. package/dist/component/model.d.ts +80 -80
  21. package/dist/component/model.d.ts.map +1 -1
  22. package/dist/component/model.js +5 -1
  23. package/dist/component/model.js.map +1 -1
  24. package/dist/component/providers/credentials.d.ts +3 -2
  25. package/dist/component/providers/credentials.d.ts.map +1 -1
  26. package/dist/component/providers/email.d.ts +30 -0
  27. package/dist/component/providers/email.d.ts.map +1 -1
  28. package/dist/component/providers/phone.d.ts +28 -0
  29. package/dist/component/providers/phone.d.ts.map +1 -1
  30. package/dist/component/public/enterprise/audit.d.ts +73 -0
  31. package/dist/component/public/enterprise/audit.d.ts.map +1 -0
  32. package/dist/component/public/enterprise/audit.js +108 -0
  33. package/dist/component/public/enterprise/audit.js.map +1 -0
  34. package/dist/component/public/enterprise/core.d.ts +176 -0
  35. package/dist/component/public/enterprise/core.d.ts.map +1 -0
  36. package/dist/component/public/enterprise/core.js +292 -0
  37. package/dist/component/public/enterprise/core.js.map +1 -0
  38. package/dist/component/public/enterprise/domains.d.ts +174 -0
  39. package/dist/component/public/enterprise/domains.d.ts.map +1 -0
  40. package/dist/component/public/enterprise/domains.js +271 -0
  41. package/dist/component/public/enterprise/domains.js.map +1 -0
  42. package/dist/component/public/enterprise/scim.d.ts +245 -0
  43. package/dist/component/public/enterprise/scim.d.ts.map +1 -0
  44. package/dist/component/public/enterprise/scim.js +344 -0
  45. package/dist/component/public/enterprise/scim.js.map +1 -0
  46. package/dist/component/public/enterprise/secrets.d.ts +78 -0
  47. package/dist/component/public/enterprise/secrets.d.ts.map +1 -0
  48. package/dist/component/public/enterprise/secrets.js +118 -0
  49. package/dist/component/public/enterprise/secrets.js.map +1 -0
  50. package/dist/component/public/enterprise/webhooks.d.ts +211 -0
  51. package/dist/component/public/enterprise/webhooks.d.ts.map +1 -0
  52. package/dist/component/public/enterprise/webhooks.js +300 -0
  53. package/dist/component/public/enterprise/webhooks.js.map +1 -0
  54. package/dist/component/public/factors/devices.d.ts +157 -0
  55. package/dist/component/public/factors/devices.d.ts.map +1 -0
  56. package/dist/component/public/factors/devices.js +216 -0
  57. package/dist/component/public/factors/devices.js.map +1 -0
  58. package/dist/component/public/factors/passkeys.d.ts +175 -0
  59. package/dist/component/public/factors/passkeys.d.ts.map +1 -0
  60. package/dist/component/public/factors/passkeys.js +238 -0
  61. package/dist/component/public/factors/passkeys.js.map +1 -0
  62. package/dist/component/public/factors/totp.d.ts +189 -0
  63. package/dist/component/public/factors/totp.d.ts.map +1 -0
  64. package/dist/component/public/factors/totp.js +254 -0
  65. package/dist/component/public/factors/totp.js.map +1 -0
  66. package/dist/component/public/groups/core.d.ts +137 -0
  67. package/dist/component/public/groups/core.d.ts.map +1 -0
  68. package/dist/component/public/groups/core.js +321 -0
  69. package/dist/component/public/groups/core.js.map +1 -0
  70. package/dist/component/public/groups/invites.d.ts +217 -0
  71. package/dist/component/public/groups/invites.d.ts.map +1 -0
  72. package/dist/component/public/groups/invites.js +457 -0
  73. package/dist/component/public/groups/invites.js.map +1 -0
  74. package/dist/component/public/groups/members.d.ts +204 -0
  75. package/dist/component/public/groups/members.d.ts.map +1 -0
  76. package/dist/component/public/groups/members.js +355 -0
  77. package/dist/component/public/groups/members.js.map +1 -0
  78. package/dist/component/public/identity/accounts.d.ts +147 -0
  79. package/dist/component/public/identity/accounts.d.ts.map +1 -0
  80. package/dist/component/public/identity/accounts.js +200 -0
  81. package/dist/component/public/identity/accounts.js.map +1 -0
  82. package/dist/component/public/identity/codes.d.ts +104 -0
  83. package/dist/component/public/identity/codes.d.ts.map +1 -0
  84. package/dist/component/public/identity/codes.js +140 -0
  85. package/dist/component/public/identity/codes.js.map +1 -0
  86. package/dist/component/public/identity/sessions.d.ts +128 -0
  87. package/dist/component/public/identity/sessions.d.ts.map +1 -0
  88. package/dist/component/public/identity/sessions.js +192 -0
  89. package/dist/component/public/identity/sessions.js.map +1 -0
  90. package/dist/component/public/identity/tokens.d.ts +169 -0
  91. package/dist/component/public/identity/tokens.d.ts.map +1 -0
  92. package/dist/component/public/identity/tokens.js +227 -0
  93. package/dist/component/public/identity/tokens.js.map +1 -0
  94. package/dist/component/public/identity/users.d.ts +212 -0
  95. package/dist/component/public/identity/users.d.ts.map +1 -0
  96. package/dist/component/public/identity/users.js +311 -0
  97. package/dist/component/public/identity/users.js.map +1 -0
  98. package/dist/component/public/identity/verifiers.d.ts +116 -0
  99. package/dist/component/public/identity/verifiers.d.ts.map +1 -0
  100. package/dist/component/public/identity/verifiers.js +154 -0
  101. package/dist/component/public/identity/verifiers.js.map +1 -0
  102. package/dist/component/public/security/keys.d.ts +209 -0
  103. package/dist/component/public/security/keys.d.ts.map +1 -0
  104. package/dist/component/public/security/keys.js +319 -0
  105. package/dist/component/public/security/keys.js.map +1 -0
  106. package/dist/component/public/security/limits.d.ts +114 -0
  107. package/dist/component/public/security/limits.d.ts.map +1 -0
  108. package/dist/component/public/security/limits.js +169 -0
  109. package/dist/component/public/security/limits.js.map +1 -0
  110. package/dist/component/public.d.ts +22 -7
  111. package/dist/component/public.js +21 -6
  112. package/dist/component/schema.d.ts +288 -288
  113. package/dist/component/server/auth.d.ts +212 -25
  114. package/dist/component/server/auth.d.ts.map +1 -1
  115. package/dist/component/server/auth.js +68 -4
  116. package/dist/component/server/auth.js.map +1 -1
  117. package/dist/component/server/authError.js +34 -0
  118. package/dist/component/server/authError.js.map +1 -0
  119. package/dist/component/server/{providers.js → config.js} +2 -2
  120. package/dist/component/server/config.js.map +1 -0
  121. package/dist/component/server/{domains/core.js → core.js} +107 -88
  122. package/dist/component/server/core.js.map +1 -0
  123. package/dist/component/server/{provider.js → crypto.js} +3 -3
  124. package/dist/component/server/crypto.js.map +1 -0
  125. package/dist/component/server/device.js +1 -1
  126. package/dist/component/server/device.js.map +1 -1
  127. package/dist/component/server/enterprise/config.js +46 -0
  128. package/dist/component/server/enterprise/config.js.map +1 -0
  129. package/dist/component/server/{domains/sso.js → enterprise/domain.js} +6 -5
  130. package/dist/component/server/enterprise/domain.js.map +1 -0
  131. package/dist/component/server/enterprise/http.js +766 -0
  132. package/dist/component/server/enterprise/http.js.map +1 -0
  133. package/dist/component/server/enterprise/oidc.js +248 -0
  134. package/dist/component/server/enterprise/oidc.js.map +1 -0
  135. package/dist/component/server/enterprise/policy.js +85 -0
  136. package/dist/component/server/enterprise/policy.js.map +1 -0
  137. package/dist/component/server/enterprise/saml.js +338 -0
  138. package/dist/component/server/enterprise/saml.js.map +1 -0
  139. package/dist/component/server/enterprise/scim.js +97 -0
  140. package/dist/component/server/enterprise/scim.js.map +1 -0
  141. package/dist/component/server/enterprise/shared.js +51 -0
  142. package/dist/component/server/enterprise/shared.js.map +1 -0
  143. package/dist/component/server/errors.js.map +1 -1
  144. package/dist/component/server/http.js +2 -1
  145. package/dist/component/server/http.js.map +1 -1
  146. package/dist/component/server/identity.js +1 -1
  147. package/dist/component/server/identity.js.map +1 -1
  148. package/dist/component/server/{ratelimit.js → limits.js} +3 -3
  149. package/dist/component/server/limits.js.map +1 -0
  150. package/dist/component/server/mutations/account.js +3 -3
  151. package/dist/component/server/mutations/account.js.map +1 -1
  152. package/dist/component/server/mutations/code.js +2 -2
  153. package/dist/component/server/mutations/code.js.map +1 -1
  154. package/dist/component/server/mutations/invalidate.js +1 -1
  155. package/dist/component/server/mutations/invalidate.js.map +1 -1
  156. package/dist/component/server/mutations/oauth.js +5 -3
  157. package/dist/component/server/mutations/oauth.js.map +1 -1
  158. package/dist/component/server/mutations/refresh.js +1 -1
  159. package/dist/component/server/mutations/refresh.js.map +1 -1
  160. package/dist/component/server/mutations/register.js +3 -3
  161. package/dist/component/server/mutations/register.js.map +1 -1
  162. package/dist/component/server/mutations/retrieve.js +4 -4
  163. package/dist/component/server/mutations/retrieve.js.map +1 -1
  164. package/dist/component/server/mutations/signature.js +2 -2
  165. package/dist/component/server/mutations/signature.js.map +1 -1
  166. package/dist/component/server/mutations/signin.js +1 -1
  167. package/dist/component/server/mutations/signin.js.map +1 -1
  168. package/dist/component/server/mutations/signout.js +1 -1
  169. package/dist/component/server/mutations/signout.js.map +1 -1
  170. package/dist/component/server/mutations/store/refs.js +15 -0
  171. package/dist/component/server/mutations/store/refs.js.map +1 -0
  172. package/dist/component/server/mutations/store.js +80 -10
  173. package/dist/component/server/mutations/store.js.map +1 -1
  174. package/dist/component/server/mutations/verifier.js +1 -1
  175. package/dist/component/server/mutations/verifier.js.map +1 -1
  176. package/dist/component/server/mutations/verify.js +4 -3
  177. package/dist/component/server/mutations/verify.js.map +1 -1
  178. package/dist/component/server/oauth.js +1 -1
  179. package/dist/component/server/oauth.js.map +1 -1
  180. package/dist/component/server/passkey.js +2 -1
  181. package/dist/component/server/passkey.js.map +1 -1
  182. package/dist/component/server/redirects.js +1 -1
  183. package/dist/component/server/redirects.js.map +1 -1
  184. package/dist/component/server/refresh.js +1 -1
  185. package/dist/component/server/refresh.js.map +1 -1
  186. package/dist/component/server/{factory.d.ts → runtime.d.ts} +2 -2
  187. package/dist/component/server/runtime.d.ts.map +1 -0
  188. package/dist/component/server/runtime.js +413 -0
  189. package/dist/component/server/runtime.js.map +1 -0
  190. package/dist/component/server/signin.js +2 -1
  191. package/dist/component/server/signin.js.map +1 -1
  192. package/dist/component/server/totp.js +2 -1
  193. package/dist/component/server/totp.js.map +1 -1
  194. package/dist/component/server/types.d.ts +225 -41
  195. package/dist/component/server/types.d.ts.map +1 -1
  196. package/dist/component/server/types.js.map +1 -1
  197. package/dist/component/server/users.js +1 -1
  198. package/dist/component/server/users.js.map +1 -1
  199. package/dist/component/server/utils.js +1 -1
  200. package/dist/component/server/utils.js.map +1 -1
  201. package/dist/core/types.d.ts +369 -0
  202. package/dist/core/types.d.ts.map +1 -0
  203. package/dist/factors/device.js +105 -0
  204. package/dist/factors/device.js.map +1 -0
  205. package/dist/factors/passkey.js +181 -0
  206. package/dist/factors/passkey.js.map +1 -0
  207. package/dist/factors/totp.js +122 -0
  208. package/dist/factors/totp.js.map +1 -0
  209. package/dist/providers/credentials.d.ts +5 -2
  210. package/dist/providers/credentials.d.ts.map +1 -1
  211. package/dist/providers/credentials.js +2 -0
  212. package/dist/providers/credentials.js.map +1 -1
  213. package/dist/providers/email.d.ts +30 -0
  214. package/dist/providers/email.d.ts.map +1 -1
  215. package/dist/providers/email.js +24 -0
  216. package/dist/providers/email.js.map +1 -1
  217. package/dist/providers/phone.d.ts +28 -0
  218. package/dist/providers/phone.d.ts.map +1 -1
  219. package/dist/providers/phone.js +22 -0
  220. package/dist/providers/phone.js.map +1 -1
  221. package/dist/runtime/browser.js +68 -0
  222. package/dist/runtime/browser.js.map +1 -0
  223. package/dist/runtime/invite.js +51 -0
  224. package/dist/runtime/invite.js.map +1 -0
  225. package/dist/runtime/proxy.js +70 -0
  226. package/dist/runtime/proxy.js.map +1 -0
  227. package/dist/runtime/storage.js +37 -0
  228. package/dist/runtime/storage.js.map +1 -0
  229. package/dist/server/auth.d.ts +218 -28
  230. package/dist/server/auth.d.ts.map +1 -1
  231. package/dist/server/auth.js +68 -4
  232. package/dist/server/auth.js.map +1 -1
  233. package/dist/server/{fx.d.ts → authError.d.ts} +25 -15
  234. package/dist/server/authError.d.ts.map +1 -0
  235. package/dist/server/authError.js +34 -0
  236. package/dist/server/authError.js.map +1 -0
  237. package/dist/server/{providers.js → config.js} +2 -2
  238. package/dist/server/config.js.map +1 -0
  239. package/dist/server/core.d.ts +1436 -0
  240. package/dist/server/core.d.ts.map +1 -0
  241. package/dist/server/{domains/core.js → core.js} +107 -88
  242. package/dist/server/core.js.map +1 -0
  243. package/dist/server/{provider.d.ts → crypto.d.ts} +2 -2
  244. package/dist/server/crypto.d.ts.map +1 -0
  245. package/dist/server/{provider.js → crypto.js} +3 -3
  246. package/dist/{component/server/provider.js.map → server/crypto.js.map} +1 -1
  247. package/dist/server/device.js +1 -1
  248. package/dist/server/device.js.map +1 -1
  249. package/dist/server/enterprise/config.js +46 -0
  250. package/dist/server/enterprise/config.js.map +1 -0
  251. package/dist/server/{domains/sso.d.ts → enterprise/domain.d.ts} +4 -4
  252. package/dist/server/enterprise/domain.d.ts.map +1 -0
  253. package/dist/server/{domains/sso.js → enterprise/domain.js} +6 -5
  254. package/dist/server/enterprise/domain.js.map +1 -0
  255. package/dist/server/enterprise/http.d.ts +26 -0
  256. package/dist/server/enterprise/http.d.ts.map +1 -0
  257. package/dist/server/enterprise/http.js +766 -0
  258. package/dist/server/enterprise/http.js.map +1 -0
  259. package/dist/server/enterprise/oidc.js +248 -0
  260. package/dist/server/enterprise/oidc.js.map +1 -0
  261. package/dist/server/enterprise/policy.js +85 -0
  262. package/dist/server/enterprise/policy.js.map +1 -0
  263. package/dist/server/enterprise/saml.d.ts +1 -0
  264. package/dist/server/enterprise/saml.js +338 -0
  265. package/dist/server/enterprise/saml.js.map +1 -0
  266. package/dist/server/enterprise/scim.d.ts +1 -0
  267. package/dist/server/enterprise/scim.js +97 -0
  268. package/dist/server/enterprise/scim.js.map +1 -0
  269. package/dist/server/enterprise/shared.d.ts +5 -0
  270. package/dist/server/enterprise/shared.d.ts.map +1 -0
  271. package/dist/server/enterprise/shared.js +51 -0
  272. package/dist/server/enterprise/shared.js.map +1 -0
  273. package/dist/server/enterprise/validators.d.ts +1 -0
  274. package/dist/server/{enterpriseValidators.js → enterprise/validators.js} +2 -2
  275. package/dist/server/enterprise/validators.js.map +1 -0
  276. package/dist/server/errors.d.ts +2 -0
  277. package/dist/server/errors.d.ts.map +1 -1
  278. package/dist/server/errors.js +2 -0
  279. package/dist/server/errors.js.map +1 -1
  280. package/dist/server/http.d.ts +2 -2
  281. package/dist/server/http.d.ts.map +1 -1
  282. package/dist/server/http.js +2 -1
  283. package/dist/server/http.js.map +1 -1
  284. package/dist/server/identity.js +1 -1
  285. package/dist/server/identity.js.map +1 -1
  286. package/dist/server/index.d.ts +4 -705
  287. package/dist/server/index.js +4 -1367
  288. package/dist/server/limits.d.ts +1 -0
  289. package/dist/server/{ratelimit.js → limits.js} +3 -3
  290. package/dist/server/limits.js.map +1 -0
  291. package/dist/server/mounts.d.ts +647 -0
  292. package/dist/server/mounts.d.ts.map +1 -0
  293. package/dist/server/mounts.js +643 -0
  294. package/dist/server/mounts.js.map +1 -0
  295. package/dist/server/mutations/account.d.ts +8 -8
  296. package/dist/server/mutations/account.js +3 -3
  297. package/dist/server/mutations/account.js.map +1 -1
  298. package/dist/server/mutations/code.d.ts +13 -13
  299. package/dist/server/mutations/code.js +2 -2
  300. package/dist/server/mutations/code.js.map +1 -1
  301. package/dist/server/mutations/index.d.ts +8 -312
  302. package/dist/server/mutations/index.js +14 -84
  303. package/dist/server/mutations/invalidate.d.ts +5 -5
  304. package/dist/server/mutations/invalidate.d.ts.map +1 -1
  305. package/dist/server/mutations/invalidate.js +1 -1
  306. package/dist/server/mutations/invalidate.js.map +1 -1
  307. package/dist/server/mutations/oauth.d.ts +9 -9
  308. package/dist/server/mutations/oauth.d.ts.map +1 -1
  309. package/dist/server/mutations/oauth.js +5 -3
  310. package/dist/server/mutations/oauth.js.map +1 -1
  311. package/dist/server/mutations/refresh.d.ts +4 -4
  312. package/dist/server/mutations/refresh.js +1 -1
  313. package/dist/server/mutations/refresh.js.map +1 -1
  314. package/dist/server/mutations/register.d.ts +10 -10
  315. package/dist/server/mutations/register.d.ts.map +1 -1
  316. package/dist/server/mutations/register.js +3 -3
  317. package/dist/server/mutations/register.js.map +1 -1
  318. package/dist/server/mutations/retrieve.d.ts +8 -10
  319. package/dist/server/mutations/retrieve.d.ts.map +1 -1
  320. package/dist/server/mutations/retrieve.js +5 -7
  321. package/dist/server/mutations/retrieve.js.map +1 -1
  322. package/dist/server/mutations/signature.d.ts +6 -6
  323. package/dist/server/mutations/signature.d.ts.map +1 -1
  324. package/dist/server/mutations/signature.js +2 -2
  325. package/dist/server/mutations/signature.js.map +1 -1
  326. package/dist/server/mutations/signin.d.ts +1 -1
  327. package/dist/server/mutations/signin.js +1 -1
  328. package/dist/server/mutations/signin.js.map +1 -1
  329. package/dist/server/mutations/signout.d.ts +1 -1
  330. package/dist/server/mutations/signout.js +1 -1
  331. package/dist/server/mutations/signout.js.map +1 -1
  332. package/dist/server/mutations/store/refs.d.ts +12 -0
  333. package/dist/server/mutations/store/refs.d.ts.map +1 -0
  334. package/dist/server/mutations/store/refs.js +15 -0
  335. package/dist/server/mutations/store/refs.js.map +1 -0
  336. package/dist/server/mutations/store.d.ts +303 -9
  337. package/dist/server/mutations/store.d.ts.map +1 -1
  338. package/dist/server/mutations/store.js +80 -10
  339. package/dist/server/mutations/store.js.map +1 -1
  340. package/dist/server/mutations/verifier.d.ts +1 -1
  341. package/dist/server/mutations/verifier.js +1 -1
  342. package/dist/server/mutations/verifier.js.map +1 -1
  343. package/dist/server/mutations/verify.d.ts +8 -8
  344. package/dist/server/mutations/verify.d.ts.map +1 -1
  345. package/dist/server/mutations/verify.js +4 -3
  346. package/dist/server/mutations/verify.js.map +1 -1
  347. package/dist/server/oauth.js +1 -1
  348. package/dist/server/oauth.js.map +1 -1
  349. package/dist/server/passkey.d.ts +2 -2
  350. package/dist/server/passkey.d.ts.map +1 -1
  351. package/dist/server/passkey.js +3 -2
  352. package/dist/server/passkey.js.map +1 -1
  353. package/dist/server/redirects.js +1 -1
  354. package/dist/server/redirects.js.map +1 -1
  355. package/dist/server/refresh.js +1 -1
  356. package/dist/server/refresh.js.map +1 -1
  357. package/dist/server/{factory.d.ts → runtime.d.ts} +16 -16
  358. package/dist/server/runtime.d.ts.map +1 -0
  359. package/dist/server/runtime.js +413 -0
  360. package/dist/server/runtime.js.map +1 -0
  361. package/dist/server/signin.js +3 -2
  362. package/dist/server/signin.js.map +1 -1
  363. package/dist/server/ssr.d.ts +226 -0
  364. package/dist/server/ssr.d.ts.map +1 -0
  365. package/dist/server/ssr.js +786 -0
  366. package/dist/server/ssr.js.map +1 -0
  367. package/dist/server/totp.js +2 -1
  368. package/dist/server/totp.js.map +1 -1
  369. package/dist/server/types.d.ts +242 -42
  370. package/dist/server/types.d.ts.map +1 -1
  371. package/dist/server/types.js +12 -1
  372. package/dist/server/types.js.map +1 -1
  373. package/dist/server/users.js +1 -1
  374. package/dist/server/users.js.map +1 -1
  375. package/dist/server/utils.js +1 -1
  376. package/dist/server/utils.js.map +1 -1
  377. package/package.json +3 -4
  378. package/src/authorization/index.ts +46 -0
  379. package/src/cli/index.ts +38 -20
  380. package/src/client/core/types.ts +437 -0
  381. package/src/client/factors/device.ts +160 -0
  382. package/src/client/factors/passkey.ts +282 -0
  383. package/src/client/factors/totp.ts +150 -0
  384. package/src/client/index.ts +133 -1267
  385. package/src/client/runtime/browser.ts +112 -0
  386. package/src/client/runtime/invite.ts +65 -0
  387. package/src/client/runtime/proxy.ts +111 -0
  388. package/src/client/runtime/storage.ts +79 -0
  389. package/src/component/_generated/api.ts +40 -12
  390. package/src/component/_generated/component.ts +1772 -1798
  391. package/src/component/model.ts +6 -0
  392. package/src/component/public/enterprise/audit.ts +120 -0
  393. package/src/component/public/enterprise/core.ts +354 -0
  394. package/src/component/public/enterprise/domains.ts +323 -0
  395. package/src/component/public/enterprise/scim.ts +396 -0
  396. package/src/component/public/enterprise/secrets.ts +132 -0
  397. package/src/component/public/enterprise/webhooks.ts +306 -0
  398. package/src/component/public/factors/devices.ts +223 -0
  399. package/src/component/public/factors/passkeys.ts +242 -0
  400. package/src/component/public/factors/totp.ts +258 -0
  401. package/src/component/public/groups/core.ts +481 -0
  402. package/src/component/public/groups/invites.ts +602 -0
  403. package/src/component/public/groups/members.ts +409 -0
  404. package/src/component/public/identity/accounts.ts +206 -0
  405. package/src/component/public/identity/codes.ts +148 -0
  406. package/src/component/public/identity/sessions.ts +209 -0
  407. package/src/component/public/identity/tokens.ts +250 -0
  408. package/src/component/public/identity/users.ts +354 -0
  409. package/src/component/public/identity/verifiers.ts +157 -0
  410. package/src/component/public/security/keys.ts +365 -0
  411. package/src/component/public/security/limits.ts +173 -0
  412. package/src/component/public.ts +27 -5
  413. package/src/providers/credentials.ts +4 -5
  414. package/src/providers/email.ts +30 -0
  415. package/src/providers/phone.ts +28 -0
  416. package/src/server/auth.ts +282 -28
  417. package/src/server/authError.ts +44 -0
  418. package/src/server/core.ts +2095 -0
  419. package/src/server/{provider.ts → crypto.ts} +1 -1
  420. package/src/server/device.ts +1 -1
  421. package/src/server/enterprise/config.ts +51 -0
  422. package/src/server/{domains/sso.ts → enterprise/domain.ts} +4 -2
  423. package/src/server/enterprise/http.ts +1324 -0
  424. package/src/server/enterprise/oidc.ts +500 -0
  425. package/src/server/enterprise/policy.ts +128 -0
  426. package/src/server/enterprise/saml.ts +578 -0
  427. package/src/server/enterprise/scim.ts +135 -0
  428. package/src/server/enterprise/shared.ts +134 -0
  429. package/src/server/errors.ts +2 -0
  430. package/src/server/http.ts +3 -1
  431. package/src/server/identity.ts +1 -1
  432. package/src/server/index.ts +32 -2605
  433. package/src/server/{ratelimit.ts → limits.ts} +1 -1
  434. package/src/server/mounts.ts +948 -0
  435. package/src/server/mutations/account.ts +4 -4
  436. package/src/server/mutations/code.ts +3 -3
  437. package/src/server/mutations/index.ts +8 -148
  438. package/src/server/mutations/invalidate.ts +2 -2
  439. package/src/server/mutations/oauth.ts +8 -6
  440. package/src/server/mutations/refresh.ts +3 -3
  441. package/src/server/mutations/register.ts +3 -3
  442. package/src/server/mutations/retrieve.ts +4 -8
  443. package/src/server/mutations/signature.ts +3 -3
  444. package/src/server/mutations/signin.ts +2 -2
  445. package/src/server/mutations/signout.ts +2 -2
  446. package/src/server/mutations/store/refs.ts +10 -0
  447. package/src/server/mutations/store.ts +137 -9
  448. package/src/server/mutations/verifier.ts +2 -2
  449. package/src/server/mutations/verify.ts +5 -5
  450. package/src/server/oauth.ts +1 -1
  451. package/src/server/passkey.ts +3 -4
  452. package/src/server/redirects.ts +1 -1
  453. package/src/server/refresh.ts +1 -1
  454. package/src/server/runtime.ts +880 -0
  455. package/src/server/signin.ts +3 -1
  456. package/src/server/ssr.ts +1764 -0
  457. package/src/server/totp.ts +3 -1
  458. package/src/server/types.ts +254 -43
  459. package/src/server/users.ts +1 -1
  460. package/src/server/utils.ts +1 -1
  461. package/src/test.ts +25 -0
  462. package/dist/component/public/enterprise.d.ts +0 -54
  463. package/dist/component/public/enterprise.d.ts.map +0 -1
  464. package/dist/component/public/enterprise.js +0 -515
  465. package/dist/component/public/enterprise.js.map +0 -1
  466. package/dist/component/public/factors.d.ts +0 -52
  467. package/dist/component/public/factors.d.ts.map +0 -1
  468. package/dist/component/public/factors.js +0 -285
  469. package/dist/component/public/factors.js.map +0 -1
  470. package/dist/component/public/groups.d.ts +0 -124
  471. package/dist/component/public/groups.d.ts.map +0 -1
  472. package/dist/component/public/groups.js +0 -680
  473. package/dist/component/public/groups.js.map +0 -1
  474. package/dist/component/public/identity.d.ts +0 -93
  475. package/dist/component/public/identity.d.ts.map +0 -1
  476. package/dist/component/public/identity.js +0 -426
  477. package/dist/component/public/identity.js.map +0 -1
  478. package/dist/component/public/keys.d.ts +0 -41
  479. package/dist/component/public/keys.d.ts.map +0 -1
  480. package/dist/component/public/keys.js +0 -157
  481. package/dist/component/public/keys.js.map +0 -1
  482. package/dist/component/public/shared.d.ts +0 -26
  483. package/dist/component/public/shared.d.ts.map +0 -1
  484. package/dist/component/public/shared.js +0 -32
  485. package/dist/component/public/shared.js.map +0 -1
  486. package/dist/component/server/domains/core.js.map +0 -1
  487. package/dist/component/server/domains/sso.js.map +0 -1
  488. package/dist/component/server/factory.d.ts.map +0 -1
  489. package/dist/component/server/factory.js +0 -1134
  490. package/dist/component/server/factory.js.map +0 -1
  491. package/dist/component/server/fx.js +0 -66
  492. package/dist/component/server/fx.js.map +0 -1
  493. package/dist/component/server/mutations/index.js +0 -85
  494. package/dist/component/server/mutations/index.js.map +0 -1
  495. package/dist/component/server/providers.js.map +0 -1
  496. package/dist/component/server/ratelimit.js.map +0 -1
  497. package/dist/component/server/sso.js +0 -830
  498. package/dist/component/server/sso.js.map +0 -1
  499. package/dist/server/domains/core.d.ts +0 -449
  500. package/dist/server/domains/core.d.ts.map +0 -1
  501. package/dist/server/domains/core.js.map +0 -1
  502. package/dist/server/domains/sso.d.ts.map +0 -1
  503. package/dist/server/domains/sso.js.map +0 -1
  504. package/dist/server/enterpriseValidators.js.map +0 -1
  505. package/dist/server/factory.d.ts.map +0 -1
  506. package/dist/server/factory.js +0 -1134
  507. package/dist/server/factory.js.map +0 -1
  508. package/dist/server/fx.d.ts.map +0 -1
  509. package/dist/server/fx.js +0 -66
  510. package/dist/server/fx.js.map +0 -1
  511. package/dist/server/index.d.ts.map +0 -1
  512. package/dist/server/index.js.map +0 -1
  513. package/dist/server/mutations/index.d.ts.map +0 -1
  514. package/dist/server/mutations/index.js.map +0 -1
  515. package/dist/server/provider.d.ts.map +0 -1
  516. package/dist/server/provider.js.map +0 -1
  517. package/dist/server/providers.js.map +0 -1
  518. package/dist/server/ratelimit.js.map +0 -1
  519. package/dist/server/sso.js +0 -830
  520. package/dist/server/sso.js.map +0 -1
  521. package/dist/server/version.d.ts +0 -5
  522. package/dist/server/version.d.ts.map +0 -1
  523. package/dist/server/version.js +0 -6
  524. package/dist/server/version.js.map +0 -1
  525. package/src/component/public/enterprise.ts +0 -753
  526. package/src/component/public/factors.ts +0 -333
  527. package/src/component/public/groups.ts +0 -1066
  528. package/src/component/public/identity.ts +0 -569
  529. package/src/component/public/keys.ts +0 -209
  530. package/src/component/public/shared.ts +0 -119
  531. package/src/server/domains/core.ts +0 -1096
  532. package/src/server/factory.ts +0 -2181
  533. package/src/server/fx.ts +0 -152
  534. package/src/server/sso.ts +0 -1516
  535. package/src/server/version.ts +0 -2
  536. /package/dist/server/{enterpriseValidators.d.ts → config.d.ts} +0 -0
  537. /package/dist/server/{providers.d.ts → enterprise/config.d.ts} +0 -0
  538. /package/dist/server/{ratelimit.d.ts → enterprise/oidc.d.ts} +0 -0
  539. /package/dist/server/{sso.d.ts → enterprise/policy.d.ts} +0 -0
  540. /package/src/server/{providers.ts → config.ts} +0 -0
  541. /package/src/server/{enterpriseValidators.ts → enterprise/validators.ts} +0 -0
@@ -11,7 +11,9 @@ import { encodeBase32LowerCaseNoPadding } from "@oslojs/encoding";
11
11
  import { verifyTOTPWithGracePeriod, createTOTPKeyURI } from "@oslojs/otp";
12
12
  import type { Fx as FxType } from "@robelest/fx";
13
13
 
14
- import { AuthError, Fx } from "./fx";
14
+ import { Fx } from "@robelest/fx";
15
+
16
+ import { AuthError } from "./authError";
15
17
  import { userIdFromIdentitySubject } from "./identity";
16
18
  import { callSignIn, callVerifier } from "./mutations/index";
17
19
  import { callVerifierSignature } from "./mutations/signature";
@@ -24,31 +24,74 @@ import {
24
24
  vUserDoc,
25
25
  } from "../component/model";
26
26
  import schema from "../component/schema";
27
- import { CredentialsUserConfig } from "../providers/credentials";
27
+ import type { CredentialsConfig } from "../providers/credentials";
28
28
 
29
29
  // ============================================================================
30
30
  // Utility types
31
31
  // ============================================================================
32
32
 
33
- /** A value that is either `T` or a `PromiseLike<T>`. */
33
+ /**
34
+ * A value that is either `T` or a `PromiseLike<T>`.
35
+ *
36
+ * @typeParam T - The underlying value type.
37
+ */
34
38
  export type Awaitable<T> = T | PromiseLike<T>;
35
39
 
40
+ /**
41
+ * A single role definition within the authorization config.
42
+ *
43
+ * Each role has an optional human-readable label and a list of grant strings
44
+ * that members with this role receive.
45
+ *
46
+ * @see {@link AuthAuthorizationConfig}
47
+ */
36
48
  export type AuthRoleDefinition = {
49
+ /** Optional stable identifier (defaults to the record key). */
37
50
  id?: string;
51
+ /** Human-readable label for admin UIs. */
38
52
  label?: string;
53
+ /** Permission grant strings conferred by this role. */
39
54
  grants: string[];
40
55
  };
41
56
 
57
+ /**
58
+ * Authorization configuration mapping role IDs to {@link AuthRoleDefinition}s.
59
+ *
60
+ * Passed as `authorization.roles` in {@link ConvexAuthConfig}.
61
+ *
62
+ * @see {@link AuthRoleDefinition}
63
+ * @see {@link ConvexAuthConfig}
64
+ */
42
65
  export type AuthAuthorizationConfig = {
43
66
  roles: Record<string, AuthRoleDefinition>;
44
67
  };
45
68
 
69
+ /**
70
+ * Extracts the union of role ID strings from an authorization config.
71
+ *
72
+ * When `TAuthorization` is defined, this resolves to the literal key union
73
+ * of the `roles` record. Otherwise falls back to `string`.
74
+ *
75
+ * @typeParam TAuthorization - The authorization config type, or `undefined`.
76
+ *
77
+ * @see {@link AuthGrant}
78
+ */
46
79
  export type AuthRoleId<
47
80
  TAuthorization extends AuthAuthorizationConfig | undefined,
48
81
  > = TAuthorization extends { roles: infer TRoles extends Record<string, any> }
49
82
  ? keyof TRoles & string
50
83
  : string;
51
84
 
85
+ /**
86
+ * Extracts the union of grant strings from all roles in an authorization config.
87
+ *
88
+ * When `TAuthorization` is defined, this resolves to the literal union
89
+ * of all `grants` array elements across every role. Otherwise falls back to `string`.
90
+ *
91
+ * @typeParam TAuthorization - The authorization config type, or `undefined`.
92
+ *
93
+ * @see {@link AuthRoleId}
94
+ */
52
95
  export type AuthGrant<
53
96
  TAuthorization extends AuthAuthorizationConfig | undefined,
54
97
  > = TAuthorization extends {
@@ -83,12 +126,16 @@ export type ConvexAuthConfig = {
83
126
  * How long can a user session last without the user reauthenticating.
84
127
  *
85
128
  * Defaults to 30 days.
129
+ *
130
+ * @defaultValue 2_592_000_000
86
131
  */
87
132
  totalDurationMs?: number;
88
133
  /**
89
134
  * How long can a user session last without the user being active.
90
135
  *
91
136
  * Defaults to 30 days.
137
+ *
138
+ * @defaultValue 2_592_000_000
92
139
  */
93
140
  inactiveDurationMs?: number;
94
141
  };
@@ -100,6 +147,8 @@ export type ConvexAuthConfig = {
100
147
  * How long is the JWT valid for after it is signed initially.
101
148
  *
102
149
  * Defaults to 1 hour.
150
+ *
151
+ * @defaultValue 3_600_000
103
152
  */
104
153
  durationMs?: number;
105
154
  };
@@ -113,6 +162,8 @@ export type ConvexAuthConfig = {
113
162
  *
114
163
  * Defaults to 10 times per hour (that is 10 failed attempts, and then
115
164
  * allow another one every 6 minutes).
165
+ *
166
+ * @defaultValue 10
116
167
  */
117
168
  maxFailedAttemptsPerHour?: number;
118
169
  };
@@ -327,17 +378,50 @@ export interface SSOProviderConfig {
327
378
  type: "sso";
328
379
  }
329
380
 
381
+ /**
382
+ * Account linking strategy for enterprise SSO sign-in.
383
+ *
384
+ * - `"verifiedEmail"` — link accounts when the IdP-provided email matches a verified email on an existing user.
385
+ * - `"none"` — never auto-link; always create a new account.
386
+ */
330
387
  export type EnterpriseAccountLinkingPolicy = "verifiedEmail" | "none";
331
388
 
389
+ /**
390
+ * Policy for reusing existing users during SCIM provisioning.
391
+ *
392
+ * - `"externalId"` — match by the SCIM `externalId` to reuse a previously provisioned user.
393
+ * - `"none"` — always create a new user for each SCIM provision request.
394
+ */
332
395
  export type EnterpriseScimReuseUserPolicy = "externalId" | "none";
333
396
 
397
+ /**
398
+ * Just-in-time provisioning mode for enterprise SSO.
399
+ *
400
+ * - `"off"` — no JIT provisioning; users must be pre-provisioned.
401
+ * - `"createUser"` — create a user record on first SSO sign-in.
402
+ * - `"createUserAndMembership"` — create a user and add them to the enterprise group on first SSO sign-in.
403
+ */
334
404
  export type EnterpriseJitProvisioningMode =
335
405
  | "off"
336
406
  | "createUser"
337
407
  | "createUserAndMembership";
338
408
 
409
+ /**
410
+ * Deprovisioning strategy when a SCIM user is deleted.
411
+ *
412
+ * - `"soft"` — mark the user as inactive but preserve the record.
413
+ * - `"hard"` — permanently delete the user and associated data.
414
+ */
339
415
  export type EnterpriseDeprovisionMode = "soft" | "hard";
340
416
 
417
+ /**
418
+ * Effective enterprise policy document stored for an SSO/SCIM tenant.
419
+ *
420
+ * Controls account linking, JIT provisioning, SCIM reuse behavior,
421
+ * deprovisioning, and any app-defined extension metadata.
422
+ *
423
+ * @see {@link EnterprisePolicyPatch}
424
+ */
341
425
  export interface EnterprisePolicy {
342
426
  version: 1;
343
427
  identity: {
@@ -361,6 +445,12 @@ export interface EnterprisePolicy {
361
445
  extend?: Record<string, unknown>;
362
446
  }
363
447
 
448
+ /**
449
+ * Partial update payload for {@link EnterprisePolicy}.
450
+ *
451
+ * Use this when patching only selected enterprise policy sections without
452
+ * replacing the entire stored policy document.
453
+ */
364
454
  export interface EnterprisePolicyPatch {
365
455
  identity?: {
366
456
  accountLinking?: {
@@ -385,6 +475,8 @@ export interface EnterprisePolicyPatch {
385
475
 
386
476
  /**
387
477
  * Email provider config for magic link / OTP sign-in.
478
+ *
479
+ * @typeParam DataModel - The Convex data model for typed action contexts.
388
480
  */
389
481
  export interface EmailConfig<
390
482
  DataModel extends GenericDataModel = GenericDataModel,
@@ -397,7 +489,11 @@ export interface EmailConfig<
397
489
  name?: string;
398
490
  /** Sender address (e.g. `"My App <noreply@example.com>"`). */
399
491
  from?: string;
400
- /** Token expiration in seconds. Defaults to 86 400 (24 hours). */
492
+ /**
493
+ * Token expiration in seconds. Defaults to 86 400 (24 hours).
494
+ *
495
+ * @defaultValue 86400
496
+ */
401
497
  maxAge?: number;
402
498
  /**
403
499
  * Send the verification token to the user.
@@ -446,7 +542,11 @@ export interface EmailConfig<
446
542
  }
447
543
 
448
544
  /**
449
- * Configurable options for an email provider config.
545
+ * User-facing configuration shape accepted by the email provider.
546
+ *
547
+ * Equivalent to `Partial<EmailConfig>` without internal runtime-only fields.
548
+ *
549
+ * @typeParam DataModel - The Convex data model.
450
550
  */
451
551
  export type EmailUserConfig<
452
552
  DataModel extends GenericDataModel = GenericDataModel,
@@ -455,6 +555,8 @@ export type EmailUserConfig<
455
555
  /**
456
556
  * Same as email provider config, but verifies
457
557
  * phone number instead of the email address.
558
+ *
559
+ * @typeParam DataModel - The Convex data model for typed action contexts.
458
560
  */
459
561
  export interface PhoneConfig<
460
562
  DataModel extends GenericDataModel = GenericDataModel,
@@ -515,7 +617,11 @@ export interface PhoneConfig<
515
617
  }
516
618
 
517
619
  /**
518
- * Configurable options for a phone provider config.
620
+ * User-facing configuration shape accepted by the phone provider.
621
+ *
622
+ * Equivalent to `Partial<PhoneConfig>` without internal runtime-only fields.
623
+ *
624
+ * @typeParam DataModel - The Convex data model.
519
625
  */
520
626
  export type PhoneUserConfig<
521
627
  DataModel extends GenericDataModel = GenericDataModel,
@@ -524,7 +630,7 @@ export type PhoneUserConfig<
524
630
  /**
525
631
  * Credentials provider config used by Convex Auth.
526
632
  */
527
- export type ConvexCredentialsConfig = CredentialsUserConfig<any> & {
633
+ export type ConvexCredentialsConfig = CredentialsConfig<any> & {
528
634
  type: "credentials";
529
635
  id: string;
530
636
  };
@@ -542,17 +648,37 @@ export interface PasskeyProviderConfig {
542
648
  rpId?: string;
543
649
  /** Allowed origins for credential verification. Defaults to SITE_URL. */
544
650
  origin?: string | string[];
545
- /** Attestation conveyance preference. Defaults to "none". */
651
+ /**
652
+ * Attestation conveyance preference. Defaults to "none".
653
+ *
654
+ * @defaultValue "none"
655
+ */
546
656
  attestation?: "none" | "direct";
547
- /** User verification requirement. Defaults to "required". */
657
+ /**
658
+ * User verification requirement. Defaults to "required".
659
+ *
660
+ * @defaultValue "required"
661
+ */
548
662
  userVerification?: "required" | "preferred" | "discouraged";
549
- /** Resident key (discoverable credential) preference. Defaults to "preferred". */
663
+ /**
664
+ * Resident key (discoverable credential) preference. Defaults to "preferred".
665
+ *
666
+ * @defaultValue "preferred"
667
+ */
550
668
  residentKey?: "required" | "preferred" | "discouraged";
551
669
  /** Restrict to platform or cross-platform authenticators. */
552
670
  authenticatorAttachment?: "platform" | "cross-platform";
553
- /** Supported COSE algorithms. Defaults to [-7 (ES256), -257 (RS256)]. */
671
+ /**
672
+ * Supported COSE algorithms. Defaults to [-7 (ES256), -257 (RS256)].
673
+ *
674
+ * @defaultValue [-7, -257]
675
+ */
554
676
  algorithms?: number[];
555
- /** Challenge expiration in ms. Defaults to 300_000 (5 minutes). */
677
+ /**
678
+ * Challenge expiration in ms. Defaults to 300_000 (5 minutes).
679
+ *
680
+ * @defaultValue 300_000
681
+ */
556
682
  challengeExpirationMs?: number;
557
683
  };
558
684
  }
@@ -566,9 +692,17 @@ export interface TotpProviderConfig {
566
692
  options: {
567
693
  /** Issuer name shown in authenticator apps (e.g. "My App"). */
568
694
  issuer: string;
569
- /** Number of digits in each code (default: 6). */
695
+ /**
696
+ * Number of digits in each code (default: 6).
697
+ *
698
+ * @defaultValue 6
699
+ */
570
700
  digits: number;
571
- /** Time period in seconds for code rotation (default: 30). */
701
+ /**
702
+ * Time period in seconds for code rotation (default: 30).
703
+ *
704
+ * @defaultValue 30
705
+ */
572
706
  period: number;
573
707
  };
574
708
  }
@@ -661,8 +795,52 @@ export type AuthProviderSignInResult = {
661
795
  sessionId: GenericId<"Session">;
662
796
  } | null;
663
797
 
664
- /** Server-side auth helpers available on enriched action contexts. */
798
+ /** Arguments for `auth.member.resolve()`. */
799
+ export type AuthMemberResolveArgs = {
800
+ userId: GenericId<"User">;
801
+ groupId: GenericId<"Group">;
802
+ ancestry?: boolean;
803
+ roleIds?: string[];
804
+ grants?: string[];
805
+ maxDepth?: number;
806
+ };
807
+
808
+ /** Result of `auth.member.resolve()` — membership check with role and grant details. */
809
+ export type AuthMemberResolveResult = {
810
+ ok: boolean;
811
+ membership: GenericDoc<GenericDataModel, "GroupMember"> | null;
812
+ matchedGroupId: GenericId<"Group"> | null;
813
+ roleIds: string[];
814
+ grants: string[];
815
+ missingGrants: string[];
816
+ depth: number | null;
817
+ isDirect: boolean;
818
+ isInherited: boolean;
819
+ traversedGroupIds: GenericId<"Group">[];
820
+ code?: "INVALID_ROLE_IDS";
821
+ invalidRoleIds?: string[];
822
+ };
823
+
824
+ /**
825
+ * Server-side auth helper methods injected into `ctx.auth` within provider actions.
826
+ *
827
+ * Provides programmatic access to account management, session lifecycle,
828
+ * membership resolution, and provider sign-in from within Convex actions
829
+ * that use {@link GenericActionCtxWithAuthConfig}.
830
+ *
831
+ * @see {@link GenericActionCtxWithAuthConfig}
832
+ *
833
+ * @example
834
+ * ```ts
835
+ * // Inside a credentials provider's authorize callback:
836
+ * const { account, user } = await ctx.auth.account.get(ctx, {
837
+ * provider: "password",
838
+ * account: { id: email },
839
+ * });
840
+ * ```
841
+ */
665
842
  export type AuthServerHelpers = {
843
+ /** Account management: create, retrieve, and update provider-linked accounts. */
666
844
  account: {
667
845
  create: (
668
846
  ctx: GenericActionCtx<any>,
@@ -697,26 +875,11 @@ export type AuthServerHelpers = {
697
875
  except: GenericId<"Session">[];
698
876
  }>;
699
877
  };
700
- access: {
701
- check: (
878
+ member: {
879
+ resolve: (
702
880
  ctx: GenericActionCtx<any>,
703
- args: {
704
- userId: GenericId<"User">;
705
- groupId: GenericId<"Group">;
706
- grants: string[];
707
- maxDepth?: number;
708
- },
709
- ) => Promise<{
710
- ok: boolean;
711
- grants: string[];
712
- missingGrants: string[];
713
- roleIds: string[];
714
- matchedGroupId: GenericId<"Group"> | null;
715
- membership: GenericDoc<GenericDataModel, "GroupMember"> | null;
716
- isDirect: boolean;
717
- isInherited: boolean;
718
- depth: number | null;
719
- }>;
881
+ args: AuthMemberResolveArgs,
882
+ ) => Promise<AuthMemberResolveResult>;
720
883
  };
721
884
  provider: {
722
885
  signIn: (
@@ -730,6 +893,8 @@ export type AuthServerHelpers = {
730
893
  /**
731
894
  * Your `ActionCtx` enriched with `ctx.auth.config` field with
732
895
  * the config passed to `createAuth`.
896
+ *
897
+ * @typeParam DataModel - The Convex data model.
733
898
  */
734
899
  export type GenericActionCtxWithAuthConfig<DataModel extends GenericDataModel> =
735
900
  GenericActionCtx<DataModel> & {
@@ -751,11 +916,22 @@ export type ConvexAuthMaterializedConfig = {
751
916
  "component" | "session" | "jwt" | "signIn" | "callbacks" | "authorization"
752
917
  >;
753
918
 
919
+ /**
920
+ * Maps SAML assertion attribute names to user profile fields.
921
+ *
922
+ * Use this to tell the SSO flow which SAML attributes correspond to
923
+ * the user's subject identifier, email, and display name fields.
924
+ */
754
925
  export interface SAMLAttributeMapping {
926
+ /** SAML attribute for the unique subject identifier (NameID). */
755
927
  subject?: string;
928
+ /** SAML attribute for the user's email address. */
756
929
  email?: string;
930
+ /** SAML attribute for the user's full display name. */
757
931
  name?: string;
932
+ /** SAML attribute for the user's first / given name. */
758
933
  firstName?: string;
934
+ /** SAML attribute for the user's last / family name. */
759
935
  lastName?: string;
760
936
  }
761
937
 
@@ -763,20 +939,40 @@ export interface SAMLAttributeMapping {
763
939
  * Materialized OAuth provider config (Arctic-based).
764
940
  *
765
941
  * Carries the Arctic provider instance along with scopes and profile config.
766
- * Produced by materializing an `OAuthProviderInstance` during `configDefaults`.
942
+ * Produced by materializing an `OAuthProviderInstance` during `configDefaults`.
767
943
  */
768
944
  export interface OAuthMaterializedConfig {
945
+ /**
946
+ * Provider identifier (e.g. `"google"`, `"github"`).
947
+ * @readonly
948
+ */
769
949
  readonly id: string;
950
+ /**
951
+ * Discriminant for provider type routing.
952
+ * @readonly
953
+ */
770
954
  readonly type: "oauth";
771
- /** The Arctic provider instance. */
955
+ /**
956
+ * The Arctic provider instance.
957
+ * @readonly
958
+ */
772
959
  readonly provider: any;
773
- /** OAuth scopes to request. */
960
+ /**
961
+ * OAuth scopes to request.
962
+ * @readonly
963
+ */
774
964
  readonly scopes: string[];
775
- /** User-provided profile extraction callback. */
965
+ /**
966
+ * User-provided profile extraction callback.
967
+ * @readonly
968
+ */
776
969
  readonly profile?: (
777
970
  tokens: import("arctic").OAuth2Tokens,
778
971
  ) => Promise<OAuthProfile>;
779
- /** Account-linking policy for OAuth identities. Defaults to verified email linking. */
972
+ /**
973
+ * Account-linking policy for OAuth identities. Defaults to verified email linking.
974
+ * @readonly
975
+ */
780
976
  readonly accountLinking?: "verifiedEmail" | "none";
781
977
  }
782
978
 
@@ -909,6 +1105,9 @@ export interface KeyRecord {
909
1105
  * Options for paginated list queries. Every entity list method uses this
910
1106
  * same shape with entity-specific `TWhere` and `TOrderBy` type parameters.
911
1107
  *
1108
+ * @typeParam TWhere - The type of the optional filter object.
1109
+ * @typeParam TOrderBy - The union of sortable field names.
1110
+ *
912
1111
  * ```ts
913
1112
  * const result = await auth.group.list(ctx, {
914
1113
  * where: { type: "team" },
@@ -936,6 +1135,8 @@ export type ListOptions<
936
1135
 
937
1136
  /**
938
1137
  * Paginated list result returned by every entity list method.
1138
+ *
1139
+ * @typeParam T - The type of items in the result array.
939
1140
  */
940
1141
  export type ListResult<T> = {
941
1142
  /** The page of items. */
@@ -1135,7 +1336,6 @@ export type AuthComponentApi = {
1135
1336
  memberAdd: FunctionReference<"mutation", "internal">;
1136
1337
  memberGet: FunctionReference<"query", "internal">;
1137
1338
  memberList: FunctionReference<"query", "internal">;
1138
- memberListByUser: FunctionReference<"query", "internal">;
1139
1339
  memberGetByGroupAndUser: FunctionReference<"query", "internal">;
1140
1340
  memberRemove: FunctionReference<"mutation", "internal">;
1141
1341
  memberUpdate: FunctionReference<"mutation", "internal">;
@@ -1150,7 +1350,6 @@ export type AuthComponentApi = {
1150
1350
  keyGetByHashedKey: FunctionReference<"query", "internal">;
1151
1351
  keyGetById: FunctionReference<"query", "internal">;
1152
1352
  keyList: FunctionReference<"query", "internal">;
1153
- keyListByUserId: FunctionReference<"query", "internal">;
1154
1353
  keyPatch: FunctionReference<"mutation", "internal">;
1155
1354
  keyDelete: FunctionReference<"mutation", "internal">;
1156
1355
  passkeyInsert: FunctionReference<"mutation", "internal">;
@@ -1627,9 +1826,21 @@ export async function queryKeysByUserId(
1627
1826
  ctx: ComponentCallCtx,
1628
1827
  userId: string,
1629
1828
  ): Promise<KeyDoc[]> {
1630
- return (await ctx.runQuery(ctx.auth.config.component.public.keyListByUserId, {
1631
- userId,
1632
- })) as KeyDoc[];
1829
+ const items: KeyDoc[] = [];
1830
+ let cursor: string | null = null;
1831
+ do {
1832
+ const page = (await ctx.runQuery(ctx.auth.config.component.public.keyList, {
1833
+ where: { userId },
1834
+ limit: 100,
1835
+ cursor,
1836
+ })) as {
1837
+ items: KeyDoc[];
1838
+ nextCursor: string | null;
1839
+ };
1840
+ items.push(...page.items);
1841
+ cursor = page.nextCursor;
1842
+ } while (cursor !== null);
1843
+ return items;
1633
1844
  }
1634
1845
 
1635
1846
  export async function queryKeyById(
@@ -2,7 +2,7 @@ import { Fx } from "@robelest/fx";
2
2
  import { GenericId } from "convex/values";
3
3
 
4
4
  import { authDb } from "./db";
5
- import { AuthError } from "./fx";
5
+ import { AuthError } from "./authError";
6
6
  import { Doc, MutationCtx } from "./types";
7
7
  import { AuthProviderMaterializedConfig, ConvexAuthConfig } from "./types";
8
8
  import { LOG_LEVELS, logWithLevel } from "./utils";
@@ -9,7 +9,7 @@ import {
9
9
  encodeHexLowerCase,
10
10
  } from "@oslojs/encoding";
11
11
 
12
- import { AuthError } from "./fx";
12
+ import { AuthError } from "./authError";
13
13
 
14
14
  /**
15
15
  * Require an environment variable to be set, throwing at config time if missing.
package/src/test.ts CHANGED
@@ -9,6 +9,25 @@ type ImportMetaWithGlob = ImportMeta & {
9
9
 
10
10
  const modules = (import.meta as ImportMetaWithGlob).glob("./component/**/*.ts");
11
11
 
12
+ /**
13
+ * Register the Convex Auth component in a `convex-test` environment.
14
+ *
15
+ * Use this in tests to mount the bundled auth component under a chosen
16
+ * component name before invoking its functions.
17
+ *
18
+ * @param t - The `convex-test` test harness.
19
+ * @param name - Component mount name. Defaults to `"auth"`.
20
+ * @returns Nothing.
21
+ *
22
+ * @example
23
+ * ```ts
24
+ * import { convexTest } from "convex-test";
25
+ * import { register } from "@robelest/convex-auth/test";
26
+ *
27
+ * const t = convexTest(schema);
28
+ * register(t);
29
+ * ```
30
+ */
12
31
  export function register(
13
32
  t: TestConvex<SchemaDefinition<GenericSchema, boolean>>,
14
33
  name: string = "auth",
@@ -16,6 +35,12 @@ export function register(
16
35
  t.registerComponent(name, schema, modules);
17
36
  }
18
37
 
38
+ /**
39
+ * Test helpers bundled for `convex-test` setups.
40
+ *
41
+ * Exposes the auth component `schema`, lazily discovered `modules`, and the
42
+ * `register()` helper as a convenience default export.
43
+ */
19
44
  export default {
20
45
  register,
21
46
  schema,
@@ -1,54 +0,0 @@
1
- declare namespace enterprise_d_exports {
2
- export { enterpriseAuditEventCreate, enterpriseAuditEventList, enterpriseCreate, enterpriseDelete, enterpriseDomainAdd, enterpriseDomainDelete, enterpriseDomainList, enterpriseDomainVerificationDelete, enterpriseDomainVerificationGet, enterpriseDomainVerificationUpsert, enterpriseDomainVerify, enterpriseGet, enterpriseGetByDomain, enterpriseGetByGroup, enterpriseList, enterpriseScimConfigGetByEnterprise, enterpriseScimConfigGetByTokenHash, enterpriseScimConfigUpsert, enterpriseScimIdentityDelete, enterpriseScimIdentityGet, enterpriseScimIdentityGetByEnterpriseAndUser, enterpriseScimIdentityGetByMappedGroup, enterpriseScimIdentityGetByUser, enterpriseScimIdentityListByEnterprise, enterpriseScimIdentityUpsert, enterpriseSecretDelete, enterpriseSecretGet, enterpriseSecretUpsert, enterpriseUpdate, enterpriseWebhookDeliveryEnqueue, enterpriseWebhookDeliveryList, enterpriseWebhookDeliveryListReady, enterpriseWebhookDeliveryPatch, enterpriseWebhookEndpointCreate, enterpriseWebhookEndpointGet, enterpriseWebhookEndpointList, enterpriseWebhookEndpointUpdate };
3
- }
4
- /** Create an enterprise record attached to a root group. */
5
- declare const enterpriseCreate: any;
6
- /** Retrieve an enterprise record by ID. */
7
- declare const enterpriseGet: any;
8
- /** Retrieve an enterprise record by group ID. */
9
- declare const enterpriseGetByGroup: any;
10
- /** Retrieve an enterprise record by a linked domain. */
11
- declare const enterpriseGetByDomain: any;
12
- /** List enterprises with lightweight filtering and cursor pagination. */
13
- declare const enterpriseList: any;
14
- /** Patch an enterprise record. */
15
- declare const enterpriseUpdate: any;
16
- /** Delete an enterprise record. */
17
- declare const enterpriseDelete: any;
18
- /** Link a domain to an enterprise record. */
19
- declare const enterpriseDomainAdd: any;
20
- /** List domains linked to an enterprise. */
21
- declare const enterpriseDomainList: any;
22
- /** Remove a linked enterprise domain. */
23
- declare const enterpriseDomainDelete: any;
24
- declare const enterpriseDomainVerificationGet: any;
25
- declare const enterpriseDomainVerificationUpsert: any;
26
- declare const enterpriseDomainVerificationDelete: any;
27
- declare const enterpriseDomainVerify: any;
28
- declare const enterpriseSecretUpsert: any;
29
- declare const enterpriseSecretGet: any;
30
- declare const enterpriseSecretDelete: any;
31
- /** Create or rotate SCIM configuration for an enterprise. */
32
- declare const enterpriseScimConfigUpsert: any;
33
- declare const enterpriseScimConfigGetByEnterprise: any;
34
- declare const enterpriseScimConfigGetByTokenHash: any;
35
- declare const enterpriseScimIdentityGet: any;
36
- declare const enterpriseScimIdentityGetByUser: any;
37
- declare const enterpriseScimIdentityGetByEnterpriseAndUser: any;
38
- declare const enterpriseScimIdentityGetByMappedGroup: any;
39
- declare const enterpriseScimIdentityListByEnterprise: any;
40
- declare const enterpriseScimIdentityUpsert: any;
41
- declare const enterpriseScimIdentityDelete: any;
42
- declare const enterpriseAuditEventCreate: any;
43
- declare const enterpriseAuditEventList: any;
44
- declare const enterpriseWebhookEndpointCreate: any;
45
- declare const enterpriseWebhookEndpointList: any;
46
- declare const enterpriseWebhookEndpointGet: any;
47
- declare const enterpriseWebhookEndpointUpdate: any;
48
- declare const enterpriseWebhookDeliveryEnqueue: any;
49
- declare const enterpriseWebhookDeliveryListReady: any;
50
- declare const enterpriseWebhookDeliveryList: any;
51
- declare const enterpriseWebhookDeliveryPatch: any;
52
- //#endregion
53
- export { enterpriseAuditEventCreate, enterpriseAuditEventList, enterpriseCreate, enterpriseDelete, enterpriseDomainAdd, enterpriseDomainDelete, enterpriseDomainList, enterpriseDomainVerificationDelete, enterpriseDomainVerificationGet, enterpriseDomainVerificationUpsert, enterpriseDomainVerify, enterpriseGet, enterpriseGetByDomain, enterpriseGetByGroup, enterpriseList, enterpriseScimConfigGetByEnterprise, enterpriseScimConfigGetByTokenHash, enterpriseScimConfigUpsert, enterpriseScimIdentityDelete, enterpriseScimIdentityGet, enterpriseScimIdentityGetByEnterpriseAndUser, enterpriseScimIdentityGetByMappedGroup, enterpriseScimIdentityGetByUser, enterpriseScimIdentityListByEnterprise, enterpriseScimIdentityUpsert, enterpriseSecretDelete, enterpriseSecretGet, enterpriseSecretUpsert, enterpriseUpdate, enterpriseWebhookDeliveryEnqueue, enterpriseWebhookDeliveryList, enterpriseWebhookDeliveryListReady, enterpriseWebhookDeliveryPatch, enterpriseWebhookEndpointCreate, enterpriseWebhookEndpointGet, enterpriseWebhookEndpointList, enterpriseWebhookEndpointUpdate, enterprise_d_exports };
54
- //# sourceMappingURL=enterprise.d.ts.map
@@ -1 +0,0 @@
1
- {"version":3,"file":"enterprise.d.ts","names":[],"sources":["../../../src/component/public/enterprise.ts"],"mappings":";;;;cA8Ba,gBAAA;;cA8BA,aAAA;;cASA,oBAAA;;cAYA,qBAAA;;cA0BA,cAAA;;cAuEA,gBAAA;;cAUA,gBAAA;;cA+BA,mBAAA;;cAuDA,oBAAA;;cAYA,sBAAA;AAAA,cAgBA,+BAAA;AAAA,cAWA,kCAAA;AAAA,cA0BA,kCAAA;AAAA,cAeA,sBAAA;AAAA,cA0BA,sBAAA;AAAA,cAwBA,mBAAA;AAAA,cAgBA,sBAAA;;cAqBA,0BAAA;AAAA,cA0BA,mCAAA;AAAA,cAWA,kCAAA;AAAA,cAWA,yBAAA;AAAA,cAoBA,+BAAA;AAAA,cAWA,4CAAA;AAAA,cAgBA,sCAAA;AAAA,cAaA,sCAAA;AAAA,cAWA,4BAAA;AAAA,cA+BA,4BAAA;AAAA,cASA,0BAAA;AAAA,cAqBA,wBAAA;AAAA,cA+BA,+BAAA;AAAA,cAqBA,6BAAA;AAAA,cAWA,4BAAA;AAAA,cAQA,+BAAA;AAAA,cASA,gCAAA;AAAA,cAmBA,kCAAA;AAAA,cAaA,6BAAA;AAAA,cAYA,8BAAA"}