@robelest/convex-auth 0.0.4-preview.18 → 0.0.4-preview.19
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/README.md +6 -3
- package/dist/authorization/index.d.ts +46 -0
- package/dist/authorization/index.d.ts.map +1 -1
- package/dist/authorization/index.js +46 -0
- package/dist/authorization/index.js.map +1 -1
- package/dist/bin.cjs +21 -13
- package/dist/client/core/types.d.ts +20 -0
- package/dist/client/core/types.d.ts.map +1 -0
- package/dist/client/index.d.ts +2 -16
- package/dist/client/index.d.ts.map +1 -1
- package/dist/client/index.js +67 -565
- package/dist/client/index.js.map +1 -1
- package/dist/component/_generated/api.d.ts +40 -12
- package/dist/component/_generated/api.d.ts.map +1 -1
- package/dist/component/_generated/api.js.map +1 -1
- package/dist/component/_generated/component.d.ts +1306 -1344
- package/dist/component/_generated/component.d.ts.map +1 -1
- package/dist/component/client/core/types.d.ts +2 -0
- package/dist/component/client/index.d.ts +2 -2
- package/dist/component/model.d.ts +80 -80
- package/dist/component/model.d.ts.map +1 -1
- package/dist/component/model.js +5 -1
- package/dist/component/model.js.map +1 -1
- package/dist/component/providers/credentials.d.ts +3 -2
- package/dist/component/providers/credentials.d.ts.map +1 -1
- package/dist/component/providers/email.d.ts +30 -0
- package/dist/component/providers/email.d.ts.map +1 -1
- package/dist/component/providers/phone.d.ts +28 -0
- package/dist/component/providers/phone.d.ts.map +1 -1
- package/dist/component/public/enterprise/audit.d.ts +73 -0
- package/dist/component/public/enterprise/audit.d.ts.map +1 -0
- package/dist/component/public/enterprise/audit.js +108 -0
- package/dist/component/public/enterprise/audit.js.map +1 -0
- package/dist/component/public/enterprise/core.d.ts +176 -0
- package/dist/component/public/enterprise/core.d.ts.map +1 -0
- package/dist/component/public/enterprise/core.js +292 -0
- package/dist/component/public/enterprise/core.js.map +1 -0
- package/dist/component/public/enterprise/domains.d.ts +174 -0
- package/dist/component/public/enterprise/domains.d.ts.map +1 -0
- package/dist/component/public/enterprise/domains.js +271 -0
- package/dist/component/public/enterprise/domains.js.map +1 -0
- package/dist/component/public/enterprise/scim.d.ts +245 -0
- package/dist/component/public/enterprise/scim.d.ts.map +1 -0
- package/dist/component/public/enterprise/scim.js +344 -0
- package/dist/component/public/enterprise/scim.js.map +1 -0
- package/dist/component/public/enterprise/secrets.d.ts +78 -0
- package/dist/component/public/enterprise/secrets.d.ts.map +1 -0
- package/dist/component/public/enterprise/secrets.js +118 -0
- package/dist/component/public/enterprise/secrets.js.map +1 -0
- package/dist/component/public/enterprise/webhooks.d.ts +211 -0
- package/dist/component/public/enterprise/webhooks.d.ts.map +1 -0
- package/dist/component/public/enterprise/webhooks.js +300 -0
- package/dist/component/public/enterprise/webhooks.js.map +1 -0
- package/dist/component/public/factors/devices.d.ts +157 -0
- package/dist/component/public/factors/devices.d.ts.map +1 -0
- package/dist/component/public/factors/devices.js +216 -0
- package/dist/component/public/factors/devices.js.map +1 -0
- package/dist/component/public/factors/passkeys.d.ts +175 -0
- package/dist/component/public/factors/passkeys.d.ts.map +1 -0
- package/dist/component/public/factors/passkeys.js +238 -0
- package/dist/component/public/factors/passkeys.js.map +1 -0
- package/dist/component/public/factors/totp.d.ts +189 -0
- package/dist/component/public/factors/totp.d.ts.map +1 -0
- package/dist/component/public/factors/totp.js +254 -0
- package/dist/component/public/factors/totp.js.map +1 -0
- package/dist/component/public/groups/core.d.ts +137 -0
- package/dist/component/public/groups/core.d.ts.map +1 -0
- package/dist/component/public/groups/core.js +321 -0
- package/dist/component/public/groups/core.js.map +1 -0
- package/dist/component/public/groups/invites.d.ts +217 -0
- package/dist/component/public/groups/invites.d.ts.map +1 -0
- package/dist/component/public/groups/invites.js +457 -0
- package/dist/component/public/groups/invites.js.map +1 -0
- package/dist/component/public/groups/members.d.ts +204 -0
- package/dist/component/public/groups/members.d.ts.map +1 -0
- package/dist/component/public/groups/members.js +355 -0
- package/dist/component/public/groups/members.js.map +1 -0
- package/dist/component/public/identity/accounts.d.ts +147 -0
- package/dist/component/public/identity/accounts.d.ts.map +1 -0
- package/dist/component/public/identity/accounts.js +200 -0
- package/dist/component/public/identity/accounts.js.map +1 -0
- package/dist/component/public/identity/codes.d.ts +104 -0
- package/dist/component/public/identity/codes.d.ts.map +1 -0
- package/dist/component/public/identity/codes.js +140 -0
- package/dist/component/public/identity/codes.js.map +1 -0
- package/dist/component/public/identity/sessions.d.ts +128 -0
- package/dist/component/public/identity/sessions.d.ts.map +1 -0
- package/dist/component/public/identity/sessions.js +192 -0
- package/dist/component/public/identity/sessions.js.map +1 -0
- package/dist/component/public/identity/tokens.d.ts +169 -0
- package/dist/component/public/identity/tokens.d.ts.map +1 -0
- package/dist/component/public/identity/tokens.js +227 -0
- package/dist/component/public/identity/tokens.js.map +1 -0
- package/dist/component/public/identity/users.d.ts +212 -0
- package/dist/component/public/identity/users.d.ts.map +1 -0
- package/dist/component/public/identity/users.js +311 -0
- package/dist/component/public/identity/users.js.map +1 -0
- package/dist/component/public/identity/verifiers.d.ts +116 -0
- package/dist/component/public/identity/verifiers.d.ts.map +1 -0
- package/dist/component/public/identity/verifiers.js +154 -0
- package/dist/component/public/identity/verifiers.js.map +1 -0
- package/dist/component/public/security/keys.d.ts +209 -0
- package/dist/component/public/security/keys.d.ts.map +1 -0
- package/dist/component/public/security/keys.js +319 -0
- package/dist/component/public/security/keys.js.map +1 -0
- package/dist/component/public/security/limits.d.ts +114 -0
- package/dist/component/public/security/limits.d.ts.map +1 -0
- package/dist/component/public/security/limits.js +169 -0
- package/dist/component/public/security/limits.js.map +1 -0
- package/dist/component/public.d.ts +22 -7
- package/dist/component/public.js +21 -6
- package/dist/component/schema.d.ts +288 -288
- package/dist/component/server/auth.d.ts +212 -25
- package/dist/component/server/auth.d.ts.map +1 -1
- package/dist/component/server/auth.js +68 -4
- package/dist/component/server/auth.js.map +1 -1
- package/dist/component/server/authError.js +34 -0
- package/dist/component/server/authError.js.map +1 -0
- package/dist/component/server/{providers.js → config.js} +2 -2
- package/dist/component/server/config.js.map +1 -0
- package/dist/component/server/{domains/core.js → core.js} +107 -88
- package/dist/component/server/core.js.map +1 -0
- package/dist/component/server/{provider.js → crypto.js} +3 -3
- package/dist/component/server/crypto.js.map +1 -0
- package/dist/component/server/device.js +1 -1
- package/dist/component/server/device.js.map +1 -1
- package/dist/component/server/enterprise/config.js +46 -0
- package/dist/component/server/enterprise/config.js.map +1 -0
- package/dist/component/server/{domains/sso.js → enterprise/domain.js} +6 -5
- package/dist/component/server/enterprise/domain.js.map +1 -0
- package/dist/component/server/enterprise/http.js +766 -0
- package/dist/component/server/enterprise/http.js.map +1 -0
- package/dist/component/server/enterprise/oidc.js +248 -0
- package/dist/component/server/enterprise/oidc.js.map +1 -0
- package/dist/component/server/enterprise/policy.js +85 -0
- package/dist/component/server/enterprise/policy.js.map +1 -0
- package/dist/component/server/enterprise/saml.js +338 -0
- package/dist/component/server/enterprise/saml.js.map +1 -0
- package/dist/component/server/enterprise/scim.js +97 -0
- package/dist/component/server/enterprise/scim.js.map +1 -0
- package/dist/component/server/enterprise/shared.js +51 -0
- package/dist/component/server/enterprise/shared.js.map +1 -0
- package/dist/component/server/errors.js.map +1 -1
- package/dist/component/server/http.js +2 -1
- package/dist/component/server/http.js.map +1 -1
- package/dist/component/server/identity.js +1 -1
- package/dist/component/server/identity.js.map +1 -1
- package/dist/component/server/{ratelimit.js → limits.js} +3 -3
- package/dist/component/server/limits.js.map +1 -0
- package/dist/component/server/mutations/account.js +3 -3
- package/dist/component/server/mutations/account.js.map +1 -1
- package/dist/component/server/mutations/code.js +2 -2
- package/dist/component/server/mutations/code.js.map +1 -1
- package/dist/component/server/mutations/invalidate.js +1 -1
- package/dist/component/server/mutations/invalidate.js.map +1 -1
- package/dist/component/server/mutations/oauth.js +5 -3
- package/dist/component/server/mutations/oauth.js.map +1 -1
- package/dist/component/server/mutations/refresh.js +1 -1
- package/dist/component/server/mutations/refresh.js.map +1 -1
- package/dist/component/server/mutations/register.js +3 -3
- package/dist/component/server/mutations/register.js.map +1 -1
- package/dist/component/server/mutations/retrieve.js +4 -4
- package/dist/component/server/mutations/retrieve.js.map +1 -1
- package/dist/component/server/mutations/signature.js +2 -2
- package/dist/component/server/mutations/signature.js.map +1 -1
- package/dist/component/server/mutations/signin.js +1 -1
- package/dist/component/server/mutations/signin.js.map +1 -1
- package/dist/component/server/mutations/signout.js +1 -1
- package/dist/component/server/mutations/signout.js.map +1 -1
- package/dist/component/server/mutations/store/refs.js +15 -0
- package/dist/component/server/mutations/store/refs.js.map +1 -0
- package/dist/component/server/mutations/store.js +80 -10
- package/dist/component/server/mutations/store.js.map +1 -1
- package/dist/component/server/mutations/verifier.js +1 -1
- package/dist/component/server/mutations/verifier.js.map +1 -1
- package/dist/component/server/mutations/verify.js +4 -3
- package/dist/component/server/mutations/verify.js.map +1 -1
- package/dist/component/server/oauth.js +1 -1
- package/dist/component/server/oauth.js.map +1 -1
- package/dist/component/server/passkey.js +2 -1
- package/dist/component/server/passkey.js.map +1 -1
- package/dist/component/server/redirects.js +1 -1
- package/dist/component/server/redirects.js.map +1 -1
- package/dist/component/server/refresh.js +1 -1
- package/dist/component/server/refresh.js.map +1 -1
- package/dist/component/server/{factory.d.ts → runtime.d.ts} +2 -2
- package/dist/component/server/runtime.d.ts.map +1 -0
- package/dist/component/server/runtime.js +413 -0
- package/dist/component/server/runtime.js.map +1 -0
- package/dist/component/server/signin.js +2 -1
- package/dist/component/server/signin.js.map +1 -1
- package/dist/component/server/totp.js +2 -1
- package/dist/component/server/totp.js.map +1 -1
- package/dist/component/server/types.d.ts +225 -41
- package/dist/component/server/types.d.ts.map +1 -1
- package/dist/component/server/types.js.map +1 -1
- package/dist/component/server/users.js +1 -1
- package/dist/component/server/users.js.map +1 -1
- package/dist/component/server/utils.js +1 -1
- package/dist/component/server/utils.js.map +1 -1
- package/dist/core/types.d.ts +369 -0
- package/dist/core/types.d.ts.map +1 -0
- package/dist/factors/device.js +105 -0
- package/dist/factors/device.js.map +1 -0
- package/dist/factors/passkey.js +181 -0
- package/dist/factors/passkey.js.map +1 -0
- package/dist/factors/totp.js +122 -0
- package/dist/factors/totp.js.map +1 -0
- package/dist/providers/credentials.d.ts +5 -2
- package/dist/providers/credentials.d.ts.map +1 -1
- package/dist/providers/credentials.js +2 -0
- package/dist/providers/credentials.js.map +1 -1
- package/dist/providers/email.d.ts +30 -0
- package/dist/providers/email.d.ts.map +1 -1
- package/dist/providers/email.js +24 -0
- package/dist/providers/email.js.map +1 -1
- package/dist/providers/phone.d.ts +28 -0
- package/dist/providers/phone.d.ts.map +1 -1
- package/dist/providers/phone.js +22 -0
- package/dist/providers/phone.js.map +1 -1
- package/dist/runtime/browser.js +68 -0
- package/dist/runtime/browser.js.map +1 -0
- package/dist/runtime/invite.js +51 -0
- package/dist/runtime/invite.js.map +1 -0
- package/dist/runtime/proxy.js +70 -0
- package/dist/runtime/proxy.js.map +1 -0
- package/dist/runtime/storage.js +37 -0
- package/dist/runtime/storage.js.map +1 -0
- package/dist/server/auth.d.ts +218 -28
- package/dist/server/auth.d.ts.map +1 -1
- package/dist/server/auth.js +68 -4
- package/dist/server/auth.js.map +1 -1
- package/dist/server/{fx.d.ts → authError.d.ts} +25 -15
- package/dist/server/authError.d.ts.map +1 -0
- package/dist/server/authError.js +34 -0
- package/dist/server/authError.js.map +1 -0
- package/dist/server/{providers.js → config.js} +2 -2
- package/dist/server/config.js.map +1 -0
- package/dist/server/core.d.ts +1436 -0
- package/dist/server/core.d.ts.map +1 -0
- package/dist/server/{domains/core.js → core.js} +107 -88
- package/dist/server/core.js.map +1 -0
- package/dist/server/{provider.d.ts → crypto.d.ts} +2 -2
- package/dist/server/crypto.d.ts.map +1 -0
- package/dist/server/{provider.js → crypto.js} +3 -3
- package/dist/{component/server/provider.js.map → server/crypto.js.map} +1 -1
- package/dist/server/device.js +1 -1
- package/dist/server/device.js.map +1 -1
- package/dist/server/enterprise/config.js +46 -0
- package/dist/server/enterprise/config.js.map +1 -0
- package/dist/server/{domains/sso.d.ts → enterprise/domain.d.ts} +4 -4
- package/dist/server/enterprise/domain.d.ts.map +1 -0
- package/dist/server/{domains/sso.js → enterprise/domain.js} +6 -5
- package/dist/server/enterprise/domain.js.map +1 -0
- package/dist/server/enterprise/http.d.ts +26 -0
- package/dist/server/enterprise/http.d.ts.map +1 -0
- package/dist/server/enterprise/http.js +766 -0
- package/dist/server/enterprise/http.js.map +1 -0
- package/dist/server/enterprise/oidc.js +248 -0
- package/dist/server/enterprise/oidc.js.map +1 -0
- package/dist/server/enterprise/policy.js +85 -0
- package/dist/server/enterprise/policy.js.map +1 -0
- package/dist/server/enterprise/saml.d.ts +1 -0
- package/dist/server/enterprise/saml.js +338 -0
- package/dist/server/enterprise/saml.js.map +1 -0
- package/dist/server/enterprise/scim.d.ts +1 -0
- package/dist/server/enterprise/scim.js +97 -0
- package/dist/server/enterprise/scim.js.map +1 -0
- package/dist/server/enterprise/shared.d.ts +5 -0
- package/dist/server/enterprise/shared.d.ts.map +1 -0
- package/dist/server/enterprise/shared.js +51 -0
- package/dist/server/enterprise/shared.js.map +1 -0
- package/dist/server/enterprise/validators.d.ts +1 -0
- package/dist/server/{enterpriseValidators.js → enterprise/validators.js} +2 -2
- package/dist/server/enterprise/validators.js.map +1 -0
- package/dist/server/errors.d.ts +2 -0
- package/dist/server/errors.d.ts.map +1 -1
- package/dist/server/errors.js +2 -0
- package/dist/server/errors.js.map +1 -1
- package/dist/server/http.d.ts +2 -2
- package/dist/server/http.d.ts.map +1 -1
- package/dist/server/http.js +2 -1
- package/dist/server/http.js.map +1 -1
- package/dist/server/identity.js +1 -1
- package/dist/server/identity.js.map +1 -1
- package/dist/server/index.d.ts +4 -705
- package/dist/server/index.js +4 -1367
- package/dist/server/limits.d.ts +1 -0
- package/dist/server/{ratelimit.js → limits.js} +3 -3
- package/dist/server/limits.js.map +1 -0
- package/dist/server/mounts.d.ts +647 -0
- package/dist/server/mounts.d.ts.map +1 -0
- package/dist/server/mounts.js +643 -0
- package/dist/server/mounts.js.map +1 -0
- package/dist/server/mutations/account.d.ts +8 -8
- package/dist/server/mutations/account.js +3 -3
- package/dist/server/mutations/account.js.map +1 -1
- package/dist/server/mutations/code.d.ts +13 -13
- package/dist/server/mutations/code.js +2 -2
- package/dist/server/mutations/code.js.map +1 -1
- package/dist/server/mutations/index.d.ts +8 -312
- package/dist/server/mutations/index.js +14 -84
- package/dist/server/mutations/invalidate.d.ts +5 -5
- package/dist/server/mutations/invalidate.d.ts.map +1 -1
- package/dist/server/mutations/invalidate.js +1 -1
- package/dist/server/mutations/invalidate.js.map +1 -1
- package/dist/server/mutations/oauth.d.ts +9 -9
- package/dist/server/mutations/oauth.d.ts.map +1 -1
- package/dist/server/mutations/oauth.js +5 -3
- package/dist/server/mutations/oauth.js.map +1 -1
- package/dist/server/mutations/refresh.d.ts +4 -4
- package/dist/server/mutations/refresh.js +1 -1
- package/dist/server/mutations/refresh.js.map +1 -1
- package/dist/server/mutations/register.d.ts +10 -10
- package/dist/server/mutations/register.d.ts.map +1 -1
- package/dist/server/mutations/register.js +3 -3
- package/dist/server/mutations/register.js.map +1 -1
- package/dist/server/mutations/retrieve.d.ts +8 -10
- package/dist/server/mutations/retrieve.d.ts.map +1 -1
- package/dist/server/mutations/retrieve.js +5 -7
- package/dist/server/mutations/retrieve.js.map +1 -1
- package/dist/server/mutations/signature.d.ts +6 -6
- package/dist/server/mutations/signature.d.ts.map +1 -1
- package/dist/server/mutations/signature.js +2 -2
- package/dist/server/mutations/signature.js.map +1 -1
- package/dist/server/mutations/signin.d.ts +1 -1
- package/dist/server/mutations/signin.js +1 -1
- package/dist/server/mutations/signin.js.map +1 -1
- package/dist/server/mutations/signout.d.ts +1 -1
- package/dist/server/mutations/signout.js +1 -1
- package/dist/server/mutations/signout.js.map +1 -1
- package/dist/server/mutations/store/refs.d.ts +12 -0
- package/dist/server/mutations/store/refs.d.ts.map +1 -0
- package/dist/server/mutations/store/refs.js +15 -0
- package/dist/server/mutations/store/refs.js.map +1 -0
- package/dist/server/mutations/store.d.ts +303 -9
- package/dist/server/mutations/store.d.ts.map +1 -1
- package/dist/server/mutations/store.js +80 -10
- package/dist/server/mutations/store.js.map +1 -1
- package/dist/server/mutations/verifier.d.ts +1 -1
- package/dist/server/mutations/verifier.js +1 -1
- package/dist/server/mutations/verifier.js.map +1 -1
- package/dist/server/mutations/verify.d.ts +8 -8
- package/dist/server/mutations/verify.d.ts.map +1 -1
- package/dist/server/mutations/verify.js +4 -3
- package/dist/server/mutations/verify.js.map +1 -1
- package/dist/server/oauth.js +1 -1
- package/dist/server/oauth.js.map +1 -1
- package/dist/server/passkey.d.ts +2 -2
- package/dist/server/passkey.d.ts.map +1 -1
- package/dist/server/passkey.js +3 -2
- package/dist/server/passkey.js.map +1 -1
- package/dist/server/redirects.js +1 -1
- package/dist/server/redirects.js.map +1 -1
- package/dist/server/refresh.js +1 -1
- package/dist/server/refresh.js.map +1 -1
- package/dist/server/{factory.d.ts → runtime.d.ts} +16 -16
- package/dist/server/runtime.d.ts.map +1 -0
- package/dist/server/runtime.js +413 -0
- package/dist/server/runtime.js.map +1 -0
- package/dist/server/signin.js +3 -2
- package/dist/server/signin.js.map +1 -1
- package/dist/server/ssr.d.ts +226 -0
- package/dist/server/ssr.d.ts.map +1 -0
- package/dist/server/ssr.js +786 -0
- package/dist/server/ssr.js.map +1 -0
- package/dist/server/totp.js +2 -1
- package/dist/server/totp.js.map +1 -1
- package/dist/server/types.d.ts +242 -42
- package/dist/server/types.d.ts.map +1 -1
- package/dist/server/types.js +12 -1
- package/dist/server/types.js.map +1 -1
- package/dist/server/users.js +1 -1
- package/dist/server/users.js.map +1 -1
- package/dist/server/utils.js +1 -1
- package/dist/server/utils.js.map +1 -1
- package/package.json +3 -4
- package/src/authorization/index.ts +46 -0
- package/src/cli/index.ts +38 -20
- package/src/client/core/types.ts +437 -0
- package/src/client/factors/device.ts +160 -0
- package/src/client/factors/passkey.ts +282 -0
- package/src/client/factors/totp.ts +150 -0
- package/src/client/index.ts +133 -1267
- package/src/client/runtime/browser.ts +112 -0
- package/src/client/runtime/invite.ts +65 -0
- package/src/client/runtime/proxy.ts +111 -0
- package/src/client/runtime/storage.ts +79 -0
- package/src/component/_generated/api.ts +40 -12
- package/src/component/_generated/component.ts +1772 -1798
- package/src/component/model.ts +6 -0
- package/src/component/public/enterprise/audit.ts +120 -0
- package/src/component/public/enterprise/core.ts +354 -0
- package/src/component/public/enterprise/domains.ts +323 -0
- package/src/component/public/enterprise/scim.ts +396 -0
- package/src/component/public/enterprise/secrets.ts +132 -0
- package/src/component/public/enterprise/webhooks.ts +306 -0
- package/src/component/public/factors/devices.ts +223 -0
- package/src/component/public/factors/passkeys.ts +242 -0
- package/src/component/public/factors/totp.ts +258 -0
- package/src/component/public/groups/core.ts +481 -0
- package/src/component/public/groups/invites.ts +602 -0
- package/src/component/public/groups/members.ts +409 -0
- package/src/component/public/identity/accounts.ts +206 -0
- package/src/component/public/identity/codes.ts +148 -0
- package/src/component/public/identity/sessions.ts +209 -0
- package/src/component/public/identity/tokens.ts +250 -0
- package/src/component/public/identity/users.ts +354 -0
- package/src/component/public/identity/verifiers.ts +157 -0
- package/src/component/public/security/keys.ts +365 -0
- package/src/component/public/security/limits.ts +173 -0
- package/src/component/public.ts +27 -5
- package/src/providers/credentials.ts +4 -5
- package/src/providers/email.ts +30 -0
- package/src/providers/phone.ts +28 -0
- package/src/server/auth.ts +282 -28
- package/src/server/authError.ts +44 -0
- package/src/server/core.ts +2095 -0
- package/src/server/{provider.ts → crypto.ts} +1 -1
- package/src/server/device.ts +1 -1
- package/src/server/enterprise/config.ts +51 -0
- package/src/server/{domains/sso.ts → enterprise/domain.ts} +4 -2
- package/src/server/enterprise/http.ts +1324 -0
- package/src/server/enterprise/oidc.ts +500 -0
- package/src/server/enterprise/policy.ts +128 -0
- package/src/server/enterprise/saml.ts +578 -0
- package/src/server/enterprise/scim.ts +135 -0
- package/src/server/enterprise/shared.ts +134 -0
- package/src/server/errors.ts +2 -0
- package/src/server/http.ts +3 -1
- package/src/server/identity.ts +1 -1
- package/src/server/index.ts +32 -2605
- package/src/server/{ratelimit.ts → limits.ts} +1 -1
- package/src/server/mounts.ts +948 -0
- package/src/server/mutations/account.ts +4 -4
- package/src/server/mutations/code.ts +3 -3
- package/src/server/mutations/index.ts +8 -148
- package/src/server/mutations/invalidate.ts +2 -2
- package/src/server/mutations/oauth.ts +8 -6
- package/src/server/mutations/refresh.ts +3 -3
- package/src/server/mutations/register.ts +3 -3
- package/src/server/mutations/retrieve.ts +4 -8
- package/src/server/mutations/signature.ts +3 -3
- package/src/server/mutations/signin.ts +2 -2
- package/src/server/mutations/signout.ts +2 -2
- package/src/server/mutations/store/refs.ts +10 -0
- package/src/server/mutations/store.ts +137 -9
- package/src/server/mutations/verifier.ts +2 -2
- package/src/server/mutations/verify.ts +5 -5
- package/src/server/oauth.ts +1 -1
- package/src/server/passkey.ts +3 -4
- package/src/server/redirects.ts +1 -1
- package/src/server/refresh.ts +1 -1
- package/src/server/runtime.ts +880 -0
- package/src/server/signin.ts +3 -1
- package/src/server/ssr.ts +1764 -0
- package/src/server/totp.ts +3 -1
- package/src/server/types.ts +254 -43
- package/src/server/users.ts +1 -1
- package/src/server/utils.ts +1 -1
- package/src/test.ts +25 -0
- package/dist/component/public/enterprise.d.ts +0 -54
- package/dist/component/public/enterprise.d.ts.map +0 -1
- package/dist/component/public/enterprise.js +0 -515
- package/dist/component/public/enterprise.js.map +0 -1
- package/dist/component/public/factors.d.ts +0 -52
- package/dist/component/public/factors.d.ts.map +0 -1
- package/dist/component/public/factors.js +0 -285
- package/dist/component/public/factors.js.map +0 -1
- package/dist/component/public/groups.d.ts +0 -124
- package/dist/component/public/groups.d.ts.map +0 -1
- package/dist/component/public/groups.js +0 -680
- package/dist/component/public/groups.js.map +0 -1
- package/dist/component/public/identity.d.ts +0 -93
- package/dist/component/public/identity.d.ts.map +0 -1
- package/dist/component/public/identity.js +0 -426
- package/dist/component/public/identity.js.map +0 -1
- package/dist/component/public/keys.d.ts +0 -41
- package/dist/component/public/keys.d.ts.map +0 -1
- package/dist/component/public/keys.js +0 -157
- package/dist/component/public/keys.js.map +0 -1
- package/dist/component/public/shared.d.ts +0 -26
- package/dist/component/public/shared.d.ts.map +0 -1
- package/dist/component/public/shared.js +0 -32
- package/dist/component/public/shared.js.map +0 -1
- package/dist/component/server/domains/core.js.map +0 -1
- package/dist/component/server/domains/sso.js.map +0 -1
- package/dist/component/server/factory.d.ts.map +0 -1
- package/dist/component/server/factory.js +0 -1134
- package/dist/component/server/factory.js.map +0 -1
- package/dist/component/server/fx.js +0 -66
- package/dist/component/server/fx.js.map +0 -1
- package/dist/component/server/mutations/index.js +0 -85
- package/dist/component/server/mutations/index.js.map +0 -1
- package/dist/component/server/providers.js.map +0 -1
- package/dist/component/server/ratelimit.js.map +0 -1
- package/dist/component/server/sso.js +0 -830
- package/dist/component/server/sso.js.map +0 -1
- package/dist/server/domains/core.d.ts +0 -449
- package/dist/server/domains/core.d.ts.map +0 -1
- package/dist/server/domains/core.js.map +0 -1
- package/dist/server/domains/sso.d.ts.map +0 -1
- package/dist/server/domains/sso.js.map +0 -1
- package/dist/server/enterpriseValidators.js.map +0 -1
- package/dist/server/factory.d.ts.map +0 -1
- package/dist/server/factory.js +0 -1134
- package/dist/server/factory.js.map +0 -1
- package/dist/server/fx.d.ts.map +0 -1
- package/dist/server/fx.js +0 -66
- package/dist/server/fx.js.map +0 -1
- package/dist/server/index.d.ts.map +0 -1
- package/dist/server/index.js.map +0 -1
- package/dist/server/mutations/index.d.ts.map +0 -1
- package/dist/server/mutations/index.js.map +0 -1
- package/dist/server/provider.d.ts.map +0 -1
- package/dist/server/provider.js.map +0 -1
- package/dist/server/providers.js.map +0 -1
- package/dist/server/ratelimit.js.map +0 -1
- package/dist/server/sso.js +0 -830
- package/dist/server/sso.js.map +0 -1
- package/dist/server/version.d.ts +0 -5
- package/dist/server/version.d.ts.map +0 -1
- package/dist/server/version.js +0 -6
- package/dist/server/version.js.map +0 -1
- package/src/component/public/enterprise.ts +0 -753
- package/src/component/public/factors.ts +0 -333
- package/src/component/public/groups.ts +0 -1066
- package/src/component/public/identity.ts +0 -569
- package/src/component/public/keys.ts +0 -209
- package/src/component/public/shared.ts +0 -119
- package/src/server/domains/core.ts +0 -1096
- package/src/server/factory.ts +0 -2181
- package/src/server/fx.ts +0 -152
- package/src/server/sso.ts +0 -1516
- package/src/server/version.ts +0 -2
- /package/dist/server/{enterpriseValidators.d.ts → config.d.ts} +0 -0
- /package/dist/server/{providers.d.ts → enterprise/config.d.ts} +0 -0
- /package/dist/server/{ratelimit.d.ts → enterprise/oidc.d.ts} +0 -0
- /package/dist/server/{sso.d.ts → enterprise/policy.d.ts} +0 -0
- /package/src/server/{providers.ts → config.ts} +0 -0
- /package/src/server/{enterpriseValidators.ts → enterprise/validators.ts} +0 -0
package/src/server/totp.ts
CHANGED
|
@@ -11,7 +11,9 @@ import { encodeBase32LowerCaseNoPadding } from "@oslojs/encoding";
|
|
|
11
11
|
import { verifyTOTPWithGracePeriod, createTOTPKeyURI } from "@oslojs/otp";
|
|
12
12
|
import type { Fx as FxType } from "@robelest/fx";
|
|
13
13
|
|
|
14
|
-
import {
|
|
14
|
+
import { Fx } from "@robelest/fx";
|
|
15
|
+
|
|
16
|
+
import { AuthError } from "./authError";
|
|
15
17
|
import { userIdFromIdentitySubject } from "./identity";
|
|
16
18
|
import { callSignIn, callVerifier } from "./mutations/index";
|
|
17
19
|
import { callVerifierSignature } from "./mutations/signature";
|
package/src/server/types.ts
CHANGED
|
@@ -24,31 +24,74 @@ import {
|
|
|
24
24
|
vUserDoc,
|
|
25
25
|
} from "../component/model";
|
|
26
26
|
import schema from "../component/schema";
|
|
27
|
-
import {
|
|
27
|
+
import type { CredentialsConfig } from "../providers/credentials";
|
|
28
28
|
|
|
29
29
|
// ============================================================================
|
|
30
30
|
// Utility types
|
|
31
31
|
// ============================================================================
|
|
32
32
|
|
|
33
|
-
/**
|
|
33
|
+
/**
|
|
34
|
+
* A value that is either `T` or a `PromiseLike<T>`.
|
|
35
|
+
*
|
|
36
|
+
* @typeParam T - The underlying value type.
|
|
37
|
+
*/
|
|
34
38
|
export type Awaitable<T> = T | PromiseLike<T>;
|
|
35
39
|
|
|
40
|
+
/**
|
|
41
|
+
* A single role definition within the authorization config.
|
|
42
|
+
*
|
|
43
|
+
* Each role has an optional human-readable label and a list of grant strings
|
|
44
|
+
* that members with this role receive.
|
|
45
|
+
*
|
|
46
|
+
* @see {@link AuthAuthorizationConfig}
|
|
47
|
+
*/
|
|
36
48
|
export type AuthRoleDefinition = {
|
|
49
|
+
/** Optional stable identifier (defaults to the record key). */
|
|
37
50
|
id?: string;
|
|
51
|
+
/** Human-readable label for admin UIs. */
|
|
38
52
|
label?: string;
|
|
53
|
+
/** Permission grant strings conferred by this role. */
|
|
39
54
|
grants: string[];
|
|
40
55
|
};
|
|
41
56
|
|
|
57
|
+
/**
|
|
58
|
+
* Authorization configuration mapping role IDs to {@link AuthRoleDefinition}s.
|
|
59
|
+
*
|
|
60
|
+
* Passed as `authorization.roles` in {@link ConvexAuthConfig}.
|
|
61
|
+
*
|
|
62
|
+
* @see {@link AuthRoleDefinition}
|
|
63
|
+
* @see {@link ConvexAuthConfig}
|
|
64
|
+
*/
|
|
42
65
|
export type AuthAuthorizationConfig = {
|
|
43
66
|
roles: Record<string, AuthRoleDefinition>;
|
|
44
67
|
};
|
|
45
68
|
|
|
69
|
+
/**
|
|
70
|
+
* Extracts the union of role ID strings from an authorization config.
|
|
71
|
+
*
|
|
72
|
+
* When `TAuthorization` is defined, this resolves to the literal key union
|
|
73
|
+
* of the `roles` record. Otherwise falls back to `string`.
|
|
74
|
+
*
|
|
75
|
+
* @typeParam TAuthorization - The authorization config type, or `undefined`.
|
|
76
|
+
*
|
|
77
|
+
* @see {@link AuthGrant}
|
|
78
|
+
*/
|
|
46
79
|
export type AuthRoleId<
|
|
47
80
|
TAuthorization extends AuthAuthorizationConfig | undefined,
|
|
48
81
|
> = TAuthorization extends { roles: infer TRoles extends Record<string, any> }
|
|
49
82
|
? keyof TRoles & string
|
|
50
83
|
: string;
|
|
51
84
|
|
|
85
|
+
/**
|
|
86
|
+
* Extracts the union of grant strings from all roles in an authorization config.
|
|
87
|
+
*
|
|
88
|
+
* When `TAuthorization` is defined, this resolves to the literal union
|
|
89
|
+
* of all `grants` array elements across every role. Otherwise falls back to `string`.
|
|
90
|
+
*
|
|
91
|
+
* @typeParam TAuthorization - The authorization config type, or `undefined`.
|
|
92
|
+
*
|
|
93
|
+
* @see {@link AuthRoleId}
|
|
94
|
+
*/
|
|
52
95
|
export type AuthGrant<
|
|
53
96
|
TAuthorization extends AuthAuthorizationConfig | undefined,
|
|
54
97
|
> = TAuthorization extends {
|
|
@@ -83,12 +126,16 @@ export type ConvexAuthConfig = {
|
|
|
83
126
|
* How long can a user session last without the user reauthenticating.
|
|
84
127
|
*
|
|
85
128
|
* Defaults to 30 days.
|
|
129
|
+
*
|
|
130
|
+
* @defaultValue 2_592_000_000
|
|
86
131
|
*/
|
|
87
132
|
totalDurationMs?: number;
|
|
88
133
|
/**
|
|
89
134
|
* How long can a user session last without the user being active.
|
|
90
135
|
*
|
|
91
136
|
* Defaults to 30 days.
|
|
137
|
+
*
|
|
138
|
+
* @defaultValue 2_592_000_000
|
|
92
139
|
*/
|
|
93
140
|
inactiveDurationMs?: number;
|
|
94
141
|
};
|
|
@@ -100,6 +147,8 @@ export type ConvexAuthConfig = {
|
|
|
100
147
|
* How long is the JWT valid for after it is signed initially.
|
|
101
148
|
*
|
|
102
149
|
* Defaults to 1 hour.
|
|
150
|
+
*
|
|
151
|
+
* @defaultValue 3_600_000
|
|
103
152
|
*/
|
|
104
153
|
durationMs?: number;
|
|
105
154
|
};
|
|
@@ -113,6 +162,8 @@ export type ConvexAuthConfig = {
|
|
|
113
162
|
*
|
|
114
163
|
* Defaults to 10 times per hour (that is 10 failed attempts, and then
|
|
115
164
|
* allow another one every 6 minutes).
|
|
165
|
+
*
|
|
166
|
+
* @defaultValue 10
|
|
116
167
|
*/
|
|
117
168
|
maxFailedAttemptsPerHour?: number;
|
|
118
169
|
};
|
|
@@ -327,17 +378,50 @@ export interface SSOProviderConfig {
|
|
|
327
378
|
type: "sso";
|
|
328
379
|
}
|
|
329
380
|
|
|
381
|
+
/**
|
|
382
|
+
* Account linking strategy for enterprise SSO sign-in.
|
|
383
|
+
*
|
|
384
|
+
* - `"verifiedEmail"` — link accounts when the IdP-provided email matches a verified email on an existing user.
|
|
385
|
+
* - `"none"` — never auto-link; always create a new account.
|
|
386
|
+
*/
|
|
330
387
|
export type EnterpriseAccountLinkingPolicy = "verifiedEmail" | "none";
|
|
331
388
|
|
|
389
|
+
/**
|
|
390
|
+
* Policy for reusing existing users during SCIM provisioning.
|
|
391
|
+
*
|
|
392
|
+
* - `"externalId"` — match by the SCIM `externalId` to reuse a previously provisioned user.
|
|
393
|
+
* - `"none"` — always create a new user for each SCIM provision request.
|
|
394
|
+
*/
|
|
332
395
|
export type EnterpriseScimReuseUserPolicy = "externalId" | "none";
|
|
333
396
|
|
|
397
|
+
/**
|
|
398
|
+
* Just-in-time provisioning mode for enterprise SSO.
|
|
399
|
+
*
|
|
400
|
+
* - `"off"` — no JIT provisioning; users must be pre-provisioned.
|
|
401
|
+
* - `"createUser"` — create a user record on first SSO sign-in.
|
|
402
|
+
* - `"createUserAndMembership"` — create a user and add them to the enterprise group on first SSO sign-in.
|
|
403
|
+
*/
|
|
334
404
|
export type EnterpriseJitProvisioningMode =
|
|
335
405
|
| "off"
|
|
336
406
|
| "createUser"
|
|
337
407
|
| "createUserAndMembership";
|
|
338
408
|
|
|
409
|
+
/**
|
|
410
|
+
* Deprovisioning strategy when a SCIM user is deleted.
|
|
411
|
+
*
|
|
412
|
+
* - `"soft"` — mark the user as inactive but preserve the record.
|
|
413
|
+
* - `"hard"` — permanently delete the user and associated data.
|
|
414
|
+
*/
|
|
339
415
|
export type EnterpriseDeprovisionMode = "soft" | "hard";
|
|
340
416
|
|
|
417
|
+
/**
|
|
418
|
+
* Effective enterprise policy document stored for an SSO/SCIM tenant.
|
|
419
|
+
*
|
|
420
|
+
* Controls account linking, JIT provisioning, SCIM reuse behavior,
|
|
421
|
+
* deprovisioning, and any app-defined extension metadata.
|
|
422
|
+
*
|
|
423
|
+
* @see {@link EnterprisePolicyPatch}
|
|
424
|
+
*/
|
|
341
425
|
export interface EnterprisePolicy {
|
|
342
426
|
version: 1;
|
|
343
427
|
identity: {
|
|
@@ -361,6 +445,12 @@ export interface EnterprisePolicy {
|
|
|
361
445
|
extend?: Record<string, unknown>;
|
|
362
446
|
}
|
|
363
447
|
|
|
448
|
+
/**
|
|
449
|
+
* Partial update payload for {@link EnterprisePolicy}.
|
|
450
|
+
*
|
|
451
|
+
* Use this when patching only selected enterprise policy sections without
|
|
452
|
+
* replacing the entire stored policy document.
|
|
453
|
+
*/
|
|
364
454
|
export interface EnterprisePolicyPatch {
|
|
365
455
|
identity?: {
|
|
366
456
|
accountLinking?: {
|
|
@@ -385,6 +475,8 @@ export interface EnterprisePolicyPatch {
|
|
|
385
475
|
|
|
386
476
|
/**
|
|
387
477
|
* Email provider config for magic link / OTP sign-in.
|
|
478
|
+
*
|
|
479
|
+
* @typeParam DataModel - The Convex data model for typed action contexts.
|
|
388
480
|
*/
|
|
389
481
|
export interface EmailConfig<
|
|
390
482
|
DataModel extends GenericDataModel = GenericDataModel,
|
|
@@ -397,7 +489,11 @@ export interface EmailConfig<
|
|
|
397
489
|
name?: string;
|
|
398
490
|
/** Sender address (e.g. `"My App <noreply@example.com>"`). */
|
|
399
491
|
from?: string;
|
|
400
|
-
/**
|
|
492
|
+
/**
|
|
493
|
+
* Token expiration in seconds. Defaults to 86 400 (24 hours).
|
|
494
|
+
*
|
|
495
|
+
* @defaultValue 86400
|
|
496
|
+
*/
|
|
401
497
|
maxAge?: number;
|
|
402
498
|
/**
|
|
403
499
|
* Send the verification token to the user.
|
|
@@ -446,7 +542,11 @@ export interface EmailConfig<
|
|
|
446
542
|
}
|
|
447
543
|
|
|
448
544
|
/**
|
|
449
|
-
*
|
|
545
|
+
* User-facing configuration shape accepted by the email provider.
|
|
546
|
+
*
|
|
547
|
+
* Equivalent to `Partial<EmailConfig>` without internal runtime-only fields.
|
|
548
|
+
*
|
|
549
|
+
* @typeParam DataModel - The Convex data model.
|
|
450
550
|
*/
|
|
451
551
|
export type EmailUserConfig<
|
|
452
552
|
DataModel extends GenericDataModel = GenericDataModel,
|
|
@@ -455,6 +555,8 @@ export type EmailUserConfig<
|
|
|
455
555
|
/**
|
|
456
556
|
* Same as email provider config, but verifies
|
|
457
557
|
* phone number instead of the email address.
|
|
558
|
+
*
|
|
559
|
+
* @typeParam DataModel - The Convex data model for typed action contexts.
|
|
458
560
|
*/
|
|
459
561
|
export interface PhoneConfig<
|
|
460
562
|
DataModel extends GenericDataModel = GenericDataModel,
|
|
@@ -515,7 +617,11 @@ export interface PhoneConfig<
|
|
|
515
617
|
}
|
|
516
618
|
|
|
517
619
|
/**
|
|
518
|
-
*
|
|
620
|
+
* User-facing configuration shape accepted by the phone provider.
|
|
621
|
+
*
|
|
622
|
+
* Equivalent to `Partial<PhoneConfig>` without internal runtime-only fields.
|
|
623
|
+
*
|
|
624
|
+
* @typeParam DataModel - The Convex data model.
|
|
519
625
|
*/
|
|
520
626
|
export type PhoneUserConfig<
|
|
521
627
|
DataModel extends GenericDataModel = GenericDataModel,
|
|
@@ -524,7 +630,7 @@ export type PhoneUserConfig<
|
|
|
524
630
|
/**
|
|
525
631
|
* Credentials provider config used by Convex Auth.
|
|
526
632
|
*/
|
|
527
|
-
export type ConvexCredentialsConfig =
|
|
633
|
+
export type ConvexCredentialsConfig = CredentialsConfig<any> & {
|
|
528
634
|
type: "credentials";
|
|
529
635
|
id: string;
|
|
530
636
|
};
|
|
@@ -542,17 +648,37 @@ export interface PasskeyProviderConfig {
|
|
|
542
648
|
rpId?: string;
|
|
543
649
|
/** Allowed origins for credential verification. Defaults to SITE_URL. */
|
|
544
650
|
origin?: string | string[];
|
|
545
|
-
/**
|
|
651
|
+
/**
|
|
652
|
+
* Attestation conveyance preference. Defaults to "none".
|
|
653
|
+
*
|
|
654
|
+
* @defaultValue "none"
|
|
655
|
+
*/
|
|
546
656
|
attestation?: "none" | "direct";
|
|
547
|
-
/**
|
|
657
|
+
/**
|
|
658
|
+
* User verification requirement. Defaults to "required".
|
|
659
|
+
*
|
|
660
|
+
* @defaultValue "required"
|
|
661
|
+
*/
|
|
548
662
|
userVerification?: "required" | "preferred" | "discouraged";
|
|
549
|
-
/**
|
|
663
|
+
/**
|
|
664
|
+
* Resident key (discoverable credential) preference. Defaults to "preferred".
|
|
665
|
+
*
|
|
666
|
+
* @defaultValue "preferred"
|
|
667
|
+
*/
|
|
550
668
|
residentKey?: "required" | "preferred" | "discouraged";
|
|
551
669
|
/** Restrict to platform or cross-platform authenticators. */
|
|
552
670
|
authenticatorAttachment?: "platform" | "cross-platform";
|
|
553
|
-
/**
|
|
671
|
+
/**
|
|
672
|
+
* Supported COSE algorithms. Defaults to [-7 (ES256), -257 (RS256)].
|
|
673
|
+
*
|
|
674
|
+
* @defaultValue [-7, -257]
|
|
675
|
+
*/
|
|
554
676
|
algorithms?: number[];
|
|
555
|
-
/**
|
|
677
|
+
/**
|
|
678
|
+
* Challenge expiration in ms. Defaults to 300_000 (5 minutes).
|
|
679
|
+
*
|
|
680
|
+
* @defaultValue 300_000
|
|
681
|
+
*/
|
|
556
682
|
challengeExpirationMs?: number;
|
|
557
683
|
};
|
|
558
684
|
}
|
|
@@ -566,9 +692,17 @@ export interface TotpProviderConfig {
|
|
|
566
692
|
options: {
|
|
567
693
|
/** Issuer name shown in authenticator apps (e.g. "My App"). */
|
|
568
694
|
issuer: string;
|
|
569
|
-
/**
|
|
695
|
+
/**
|
|
696
|
+
* Number of digits in each code (default: 6).
|
|
697
|
+
*
|
|
698
|
+
* @defaultValue 6
|
|
699
|
+
*/
|
|
570
700
|
digits: number;
|
|
571
|
-
/**
|
|
701
|
+
/**
|
|
702
|
+
* Time period in seconds for code rotation (default: 30).
|
|
703
|
+
*
|
|
704
|
+
* @defaultValue 30
|
|
705
|
+
*/
|
|
572
706
|
period: number;
|
|
573
707
|
};
|
|
574
708
|
}
|
|
@@ -661,8 +795,52 @@ export type AuthProviderSignInResult = {
|
|
|
661
795
|
sessionId: GenericId<"Session">;
|
|
662
796
|
} | null;
|
|
663
797
|
|
|
664
|
-
/**
|
|
798
|
+
/** Arguments for `auth.member.resolve()`. */
|
|
799
|
+
export type AuthMemberResolveArgs = {
|
|
800
|
+
userId: GenericId<"User">;
|
|
801
|
+
groupId: GenericId<"Group">;
|
|
802
|
+
ancestry?: boolean;
|
|
803
|
+
roleIds?: string[];
|
|
804
|
+
grants?: string[];
|
|
805
|
+
maxDepth?: number;
|
|
806
|
+
};
|
|
807
|
+
|
|
808
|
+
/** Result of `auth.member.resolve()` — membership check with role and grant details. */
|
|
809
|
+
export type AuthMemberResolveResult = {
|
|
810
|
+
ok: boolean;
|
|
811
|
+
membership: GenericDoc<GenericDataModel, "GroupMember"> | null;
|
|
812
|
+
matchedGroupId: GenericId<"Group"> | null;
|
|
813
|
+
roleIds: string[];
|
|
814
|
+
grants: string[];
|
|
815
|
+
missingGrants: string[];
|
|
816
|
+
depth: number | null;
|
|
817
|
+
isDirect: boolean;
|
|
818
|
+
isInherited: boolean;
|
|
819
|
+
traversedGroupIds: GenericId<"Group">[];
|
|
820
|
+
code?: "INVALID_ROLE_IDS";
|
|
821
|
+
invalidRoleIds?: string[];
|
|
822
|
+
};
|
|
823
|
+
|
|
824
|
+
/**
|
|
825
|
+
* Server-side auth helper methods injected into `ctx.auth` within provider actions.
|
|
826
|
+
*
|
|
827
|
+
* Provides programmatic access to account management, session lifecycle,
|
|
828
|
+
* membership resolution, and provider sign-in from within Convex actions
|
|
829
|
+
* that use {@link GenericActionCtxWithAuthConfig}.
|
|
830
|
+
*
|
|
831
|
+
* @see {@link GenericActionCtxWithAuthConfig}
|
|
832
|
+
*
|
|
833
|
+
* @example
|
|
834
|
+
* ```ts
|
|
835
|
+
* // Inside a credentials provider's authorize callback:
|
|
836
|
+
* const { account, user } = await ctx.auth.account.get(ctx, {
|
|
837
|
+
* provider: "password",
|
|
838
|
+
* account: { id: email },
|
|
839
|
+
* });
|
|
840
|
+
* ```
|
|
841
|
+
*/
|
|
665
842
|
export type AuthServerHelpers = {
|
|
843
|
+
/** Account management: create, retrieve, and update provider-linked accounts. */
|
|
666
844
|
account: {
|
|
667
845
|
create: (
|
|
668
846
|
ctx: GenericActionCtx<any>,
|
|
@@ -697,26 +875,11 @@ export type AuthServerHelpers = {
|
|
|
697
875
|
except: GenericId<"Session">[];
|
|
698
876
|
}>;
|
|
699
877
|
};
|
|
700
|
-
|
|
701
|
-
|
|
878
|
+
member: {
|
|
879
|
+
resolve: (
|
|
702
880
|
ctx: GenericActionCtx<any>,
|
|
703
|
-
args:
|
|
704
|
-
|
|
705
|
-
groupId: GenericId<"Group">;
|
|
706
|
-
grants: string[];
|
|
707
|
-
maxDepth?: number;
|
|
708
|
-
},
|
|
709
|
-
) => Promise<{
|
|
710
|
-
ok: boolean;
|
|
711
|
-
grants: string[];
|
|
712
|
-
missingGrants: string[];
|
|
713
|
-
roleIds: string[];
|
|
714
|
-
matchedGroupId: GenericId<"Group"> | null;
|
|
715
|
-
membership: GenericDoc<GenericDataModel, "GroupMember"> | null;
|
|
716
|
-
isDirect: boolean;
|
|
717
|
-
isInherited: boolean;
|
|
718
|
-
depth: number | null;
|
|
719
|
-
}>;
|
|
881
|
+
args: AuthMemberResolveArgs,
|
|
882
|
+
) => Promise<AuthMemberResolveResult>;
|
|
720
883
|
};
|
|
721
884
|
provider: {
|
|
722
885
|
signIn: (
|
|
@@ -730,6 +893,8 @@ export type AuthServerHelpers = {
|
|
|
730
893
|
/**
|
|
731
894
|
* Your `ActionCtx` enriched with `ctx.auth.config` field with
|
|
732
895
|
* the config passed to `createAuth`.
|
|
896
|
+
*
|
|
897
|
+
* @typeParam DataModel - The Convex data model.
|
|
733
898
|
*/
|
|
734
899
|
export type GenericActionCtxWithAuthConfig<DataModel extends GenericDataModel> =
|
|
735
900
|
GenericActionCtx<DataModel> & {
|
|
@@ -751,11 +916,22 @@ export type ConvexAuthMaterializedConfig = {
|
|
|
751
916
|
"component" | "session" | "jwt" | "signIn" | "callbacks" | "authorization"
|
|
752
917
|
>;
|
|
753
918
|
|
|
919
|
+
/**
|
|
920
|
+
* Maps SAML assertion attribute names to user profile fields.
|
|
921
|
+
*
|
|
922
|
+
* Use this to tell the SSO flow which SAML attributes correspond to
|
|
923
|
+
* the user's subject identifier, email, and display name fields.
|
|
924
|
+
*/
|
|
754
925
|
export interface SAMLAttributeMapping {
|
|
926
|
+
/** SAML attribute for the unique subject identifier (NameID). */
|
|
755
927
|
subject?: string;
|
|
928
|
+
/** SAML attribute for the user's email address. */
|
|
756
929
|
email?: string;
|
|
930
|
+
/** SAML attribute for the user's full display name. */
|
|
757
931
|
name?: string;
|
|
932
|
+
/** SAML attribute for the user's first / given name. */
|
|
758
933
|
firstName?: string;
|
|
934
|
+
/** SAML attribute for the user's last / family name. */
|
|
759
935
|
lastName?: string;
|
|
760
936
|
}
|
|
761
937
|
|
|
@@ -763,20 +939,40 @@ export interface SAMLAttributeMapping {
|
|
|
763
939
|
* Materialized OAuth provider config (Arctic-based).
|
|
764
940
|
*
|
|
765
941
|
* Carries the Arctic provider instance along with scopes and profile config.
|
|
766
|
-
|
|
942
|
+
* Produced by materializing an `OAuthProviderInstance` during `configDefaults`.
|
|
767
943
|
*/
|
|
768
944
|
export interface OAuthMaterializedConfig {
|
|
945
|
+
/**
|
|
946
|
+
* Provider identifier (e.g. `"google"`, `"github"`).
|
|
947
|
+
* @readonly
|
|
948
|
+
*/
|
|
769
949
|
readonly id: string;
|
|
950
|
+
/**
|
|
951
|
+
* Discriminant for provider type routing.
|
|
952
|
+
* @readonly
|
|
953
|
+
*/
|
|
770
954
|
readonly type: "oauth";
|
|
771
|
-
/**
|
|
955
|
+
/**
|
|
956
|
+
* The Arctic provider instance.
|
|
957
|
+
* @readonly
|
|
958
|
+
*/
|
|
772
959
|
readonly provider: any;
|
|
773
|
-
/**
|
|
960
|
+
/**
|
|
961
|
+
* OAuth scopes to request.
|
|
962
|
+
* @readonly
|
|
963
|
+
*/
|
|
774
964
|
readonly scopes: string[];
|
|
775
|
-
/**
|
|
965
|
+
/**
|
|
966
|
+
* User-provided profile extraction callback.
|
|
967
|
+
* @readonly
|
|
968
|
+
*/
|
|
776
969
|
readonly profile?: (
|
|
777
970
|
tokens: import("arctic").OAuth2Tokens,
|
|
778
971
|
) => Promise<OAuthProfile>;
|
|
779
|
-
/**
|
|
972
|
+
/**
|
|
973
|
+
* Account-linking policy for OAuth identities. Defaults to verified email linking.
|
|
974
|
+
* @readonly
|
|
975
|
+
*/
|
|
780
976
|
readonly accountLinking?: "verifiedEmail" | "none";
|
|
781
977
|
}
|
|
782
978
|
|
|
@@ -909,6 +1105,9 @@ export interface KeyRecord {
|
|
|
909
1105
|
* Options for paginated list queries. Every entity list method uses this
|
|
910
1106
|
* same shape with entity-specific `TWhere` and `TOrderBy` type parameters.
|
|
911
1107
|
*
|
|
1108
|
+
* @typeParam TWhere - The type of the optional filter object.
|
|
1109
|
+
* @typeParam TOrderBy - The union of sortable field names.
|
|
1110
|
+
*
|
|
912
1111
|
* ```ts
|
|
913
1112
|
* const result = await auth.group.list(ctx, {
|
|
914
1113
|
* where: { type: "team" },
|
|
@@ -936,6 +1135,8 @@ export type ListOptions<
|
|
|
936
1135
|
|
|
937
1136
|
/**
|
|
938
1137
|
* Paginated list result returned by every entity list method.
|
|
1138
|
+
*
|
|
1139
|
+
* @typeParam T - The type of items in the result array.
|
|
939
1140
|
*/
|
|
940
1141
|
export type ListResult<T> = {
|
|
941
1142
|
/** The page of items. */
|
|
@@ -1135,7 +1336,6 @@ export type AuthComponentApi = {
|
|
|
1135
1336
|
memberAdd: FunctionReference<"mutation", "internal">;
|
|
1136
1337
|
memberGet: FunctionReference<"query", "internal">;
|
|
1137
1338
|
memberList: FunctionReference<"query", "internal">;
|
|
1138
|
-
memberListByUser: FunctionReference<"query", "internal">;
|
|
1139
1339
|
memberGetByGroupAndUser: FunctionReference<"query", "internal">;
|
|
1140
1340
|
memberRemove: FunctionReference<"mutation", "internal">;
|
|
1141
1341
|
memberUpdate: FunctionReference<"mutation", "internal">;
|
|
@@ -1150,7 +1350,6 @@ export type AuthComponentApi = {
|
|
|
1150
1350
|
keyGetByHashedKey: FunctionReference<"query", "internal">;
|
|
1151
1351
|
keyGetById: FunctionReference<"query", "internal">;
|
|
1152
1352
|
keyList: FunctionReference<"query", "internal">;
|
|
1153
|
-
keyListByUserId: FunctionReference<"query", "internal">;
|
|
1154
1353
|
keyPatch: FunctionReference<"mutation", "internal">;
|
|
1155
1354
|
keyDelete: FunctionReference<"mutation", "internal">;
|
|
1156
1355
|
passkeyInsert: FunctionReference<"mutation", "internal">;
|
|
@@ -1627,9 +1826,21 @@ export async function queryKeysByUserId(
|
|
|
1627
1826
|
ctx: ComponentCallCtx,
|
|
1628
1827
|
userId: string,
|
|
1629
1828
|
): Promise<KeyDoc[]> {
|
|
1630
|
-
|
|
1631
|
-
|
|
1632
|
-
|
|
1829
|
+
const items: KeyDoc[] = [];
|
|
1830
|
+
let cursor: string | null = null;
|
|
1831
|
+
do {
|
|
1832
|
+
const page = (await ctx.runQuery(ctx.auth.config.component.public.keyList, {
|
|
1833
|
+
where: { userId },
|
|
1834
|
+
limit: 100,
|
|
1835
|
+
cursor,
|
|
1836
|
+
})) as {
|
|
1837
|
+
items: KeyDoc[];
|
|
1838
|
+
nextCursor: string | null;
|
|
1839
|
+
};
|
|
1840
|
+
items.push(...page.items);
|
|
1841
|
+
cursor = page.nextCursor;
|
|
1842
|
+
} while (cursor !== null);
|
|
1843
|
+
return items;
|
|
1633
1844
|
}
|
|
1634
1845
|
|
|
1635
1846
|
export async function queryKeyById(
|
package/src/server/users.ts
CHANGED
|
@@ -2,7 +2,7 @@ import { Fx } from "@robelest/fx";
|
|
|
2
2
|
import { GenericId } from "convex/values";
|
|
3
3
|
|
|
4
4
|
import { authDb } from "./db";
|
|
5
|
-
import { AuthError } from "./
|
|
5
|
+
import { AuthError } from "./authError";
|
|
6
6
|
import { Doc, MutationCtx } from "./types";
|
|
7
7
|
import { AuthProviderMaterializedConfig, ConvexAuthConfig } from "./types";
|
|
8
8
|
import { LOG_LEVELS, logWithLevel } from "./utils";
|
package/src/server/utils.ts
CHANGED
package/src/test.ts
CHANGED
|
@@ -9,6 +9,25 @@ type ImportMetaWithGlob = ImportMeta & {
|
|
|
9
9
|
|
|
10
10
|
const modules = (import.meta as ImportMetaWithGlob).glob("./component/**/*.ts");
|
|
11
11
|
|
|
12
|
+
/**
|
|
13
|
+
* Register the Convex Auth component in a `convex-test` environment.
|
|
14
|
+
*
|
|
15
|
+
* Use this in tests to mount the bundled auth component under a chosen
|
|
16
|
+
* component name before invoking its functions.
|
|
17
|
+
*
|
|
18
|
+
* @param t - The `convex-test` test harness.
|
|
19
|
+
* @param name - Component mount name. Defaults to `"auth"`.
|
|
20
|
+
* @returns Nothing.
|
|
21
|
+
*
|
|
22
|
+
* @example
|
|
23
|
+
* ```ts
|
|
24
|
+
* import { convexTest } from "convex-test";
|
|
25
|
+
* import { register } from "@robelest/convex-auth/test";
|
|
26
|
+
*
|
|
27
|
+
* const t = convexTest(schema);
|
|
28
|
+
* register(t);
|
|
29
|
+
* ```
|
|
30
|
+
*/
|
|
12
31
|
export function register(
|
|
13
32
|
t: TestConvex<SchemaDefinition<GenericSchema, boolean>>,
|
|
14
33
|
name: string = "auth",
|
|
@@ -16,6 +35,12 @@ export function register(
|
|
|
16
35
|
t.registerComponent(name, schema, modules);
|
|
17
36
|
}
|
|
18
37
|
|
|
38
|
+
/**
|
|
39
|
+
* Test helpers bundled for `convex-test` setups.
|
|
40
|
+
*
|
|
41
|
+
* Exposes the auth component `schema`, lazily discovered `modules`, and the
|
|
42
|
+
* `register()` helper as a convenience default export.
|
|
43
|
+
*/
|
|
19
44
|
export default {
|
|
20
45
|
register,
|
|
21
46
|
schema,
|
|
@@ -1,54 +0,0 @@
|
|
|
1
|
-
declare namespace enterprise_d_exports {
|
|
2
|
-
export { enterpriseAuditEventCreate, enterpriseAuditEventList, enterpriseCreate, enterpriseDelete, enterpriseDomainAdd, enterpriseDomainDelete, enterpriseDomainList, enterpriseDomainVerificationDelete, enterpriseDomainVerificationGet, enterpriseDomainVerificationUpsert, enterpriseDomainVerify, enterpriseGet, enterpriseGetByDomain, enterpriseGetByGroup, enterpriseList, enterpriseScimConfigGetByEnterprise, enterpriseScimConfigGetByTokenHash, enterpriseScimConfigUpsert, enterpriseScimIdentityDelete, enterpriseScimIdentityGet, enterpriseScimIdentityGetByEnterpriseAndUser, enterpriseScimIdentityGetByMappedGroup, enterpriseScimIdentityGetByUser, enterpriseScimIdentityListByEnterprise, enterpriseScimIdentityUpsert, enterpriseSecretDelete, enterpriseSecretGet, enterpriseSecretUpsert, enterpriseUpdate, enterpriseWebhookDeliveryEnqueue, enterpriseWebhookDeliveryList, enterpriseWebhookDeliveryListReady, enterpriseWebhookDeliveryPatch, enterpriseWebhookEndpointCreate, enterpriseWebhookEndpointGet, enterpriseWebhookEndpointList, enterpriseWebhookEndpointUpdate };
|
|
3
|
-
}
|
|
4
|
-
/** Create an enterprise record attached to a root group. */
|
|
5
|
-
declare const enterpriseCreate: any;
|
|
6
|
-
/** Retrieve an enterprise record by ID. */
|
|
7
|
-
declare const enterpriseGet: any;
|
|
8
|
-
/** Retrieve an enterprise record by group ID. */
|
|
9
|
-
declare const enterpriseGetByGroup: any;
|
|
10
|
-
/** Retrieve an enterprise record by a linked domain. */
|
|
11
|
-
declare const enterpriseGetByDomain: any;
|
|
12
|
-
/** List enterprises with lightweight filtering and cursor pagination. */
|
|
13
|
-
declare const enterpriseList: any;
|
|
14
|
-
/** Patch an enterprise record. */
|
|
15
|
-
declare const enterpriseUpdate: any;
|
|
16
|
-
/** Delete an enterprise record. */
|
|
17
|
-
declare const enterpriseDelete: any;
|
|
18
|
-
/** Link a domain to an enterprise record. */
|
|
19
|
-
declare const enterpriseDomainAdd: any;
|
|
20
|
-
/** List domains linked to an enterprise. */
|
|
21
|
-
declare const enterpriseDomainList: any;
|
|
22
|
-
/** Remove a linked enterprise domain. */
|
|
23
|
-
declare const enterpriseDomainDelete: any;
|
|
24
|
-
declare const enterpriseDomainVerificationGet: any;
|
|
25
|
-
declare const enterpriseDomainVerificationUpsert: any;
|
|
26
|
-
declare const enterpriseDomainVerificationDelete: any;
|
|
27
|
-
declare const enterpriseDomainVerify: any;
|
|
28
|
-
declare const enterpriseSecretUpsert: any;
|
|
29
|
-
declare const enterpriseSecretGet: any;
|
|
30
|
-
declare const enterpriseSecretDelete: any;
|
|
31
|
-
/** Create or rotate SCIM configuration for an enterprise. */
|
|
32
|
-
declare const enterpriseScimConfigUpsert: any;
|
|
33
|
-
declare const enterpriseScimConfigGetByEnterprise: any;
|
|
34
|
-
declare const enterpriseScimConfigGetByTokenHash: any;
|
|
35
|
-
declare const enterpriseScimIdentityGet: any;
|
|
36
|
-
declare const enterpriseScimIdentityGetByUser: any;
|
|
37
|
-
declare const enterpriseScimIdentityGetByEnterpriseAndUser: any;
|
|
38
|
-
declare const enterpriseScimIdentityGetByMappedGroup: any;
|
|
39
|
-
declare const enterpriseScimIdentityListByEnterprise: any;
|
|
40
|
-
declare const enterpriseScimIdentityUpsert: any;
|
|
41
|
-
declare const enterpriseScimIdentityDelete: any;
|
|
42
|
-
declare const enterpriseAuditEventCreate: any;
|
|
43
|
-
declare const enterpriseAuditEventList: any;
|
|
44
|
-
declare const enterpriseWebhookEndpointCreate: any;
|
|
45
|
-
declare const enterpriseWebhookEndpointList: any;
|
|
46
|
-
declare const enterpriseWebhookEndpointGet: any;
|
|
47
|
-
declare const enterpriseWebhookEndpointUpdate: any;
|
|
48
|
-
declare const enterpriseWebhookDeliveryEnqueue: any;
|
|
49
|
-
declare const enterpriseWebhookDeliveryListReady: any;
|
|
50
|
-
declare const enterpriseWebhookDeliveryList: any;
|
|
51
|
-
declare const enterpriseWebhookDeliveryPatch: any;
|
|
52
|
-
//#endregion
|
|
53
|
-
export { enterpriseAuditEventCreate, enterpriseAuditEventList, enterpriseCreate, enterpriseDelete, enterpriseDomainAdd, enterpriseDomainDelete, enterpriseDomainList, enterpriseDomainVerificationDelete, enterpriseDomainVerificationGet, enterpriseDomainVerificationUpsert, enterpriseDomainVerify, enterpriseGet, enterpriseGetByDomain, enterpriseGetByGroup, enterpriseList, enterpriseScimConfigGetByEnterprise, enterpriseScimConfigGetByTokenHash, enterpriseScimConfigUpsert, enterpriseScimIdentityDelete, enterpriseScimIdentityGet, enterpriseScimIdentityGetByEnterpriseAndUser, enterpriseScimIdentityGetByMappedGroup, enterpriseScimIdentityGetByUser, enterpriseScimIdentityListByEnterprise, enterpriseScimIdentityUpsert, enterpriseSecretDelete, enterpriseSecretGet, enterpriseSecretUpsert, enterpriseUpdate, enterpriseWebhookDeliveryEnqueue, enterpriseWebhookDeliveryList, enterpriseWebhookDeliveryListReady, enterpriseWebhookDeliveryPatch, enterpriseWebhookEndpointCreate, enterpriseWebhookEndpointGet, enterpriseWebhookEndpointList, enterpriseWebhookEndpointUpdate, enterprise_d_exports };
|
|
54
|
-
//# sourceMappingURL=enterprise.d.ts.map
|
|
@@ -1 +0,0 @@
|
|
|
1
|
-
{"version":3,"file":"enterprise.d.ts","names":[],"sources":["../../../src/component/public/enterprise.ts"],"mappings":";;;;cA8Ba,gBAAA;;cA8BA,aAAA;;cASA,oBAAA;;cAYA,qBAAA;;cA0BA,cAAA;;cAuEA,gBAAA;;cAUA,gBAAA;;cA+BA,mBAAA;;cAuDA,oBAAA;;cAYA,sBAAA;AAAA,cAgBA,+BAAA;AAAA,cAWA,kCAAA;AAAA,cA0BA,kCAAA;AAAA,cAeA,sBAAA;AAAA,cA0BA,sBAAA;AAAA,cAwBA,mBAAA;AAAA,cAgBA,sBAAA;;cAqBA,0BAAA;AAAA,cA0BA,mCAAA;AAAA,cAWA,kCAAA;AAAA,cAWA,yBAAA;AAAA,cAoBA,+BAAA;AAAA,cAWA,4CAAA;AAAA,cAgBA,sCAAA;AAAA,cAaA,sCAAA;AAAA,cAWA,4BAAA;AAAA,cA+BA,4BAAA;AAAA,cASA,0BAAA;AAAA,cAqBA,wBAAA;AAAA,cA+BA,+BAAA;AAAA,cAqBA,6BAAA;AAAA,cAWA,4BAAA;AAAA,cAQA,+BAAA;AAAA,cASA,gCAAA;AAAA,cAmBA,kCAAA;AAAA,cAaA,6BAAA;AAAA,cAYA,8BAAA"}
|