@robelest/convex-auth 0.0.4-preview.2 → 0.0.4-preview.20

package/src/server/{implementation/keys.ts → keys.ts}

@@ -8,22 +8,21 @@
  * @module
  */
 
+import type { KeyScope, ScopeChecker } from "./types";
 import { sha256, generateRandomString } from "./utils";
-import type { KeyScope, ScopeChecker } from "../types";
-import { throwAuthError } from "../errors";
 
 // ============================================================================
 // Constants
 // ============================================================================
 
-const DEFAULT_KEY_PREFIX = "sk_live_";
+const DEFAULT_KEY_PREFIX = "sk_";
 const KEY_RANDOM_LENGTH = 32;
 const KEY_RANDOM_ALPHABET =
   "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789";
 
 /**
  * How many characters of the full key to store as the visible prefix.
- * Includes the prefix string (e.g. "sk_live_") plus a few random chars.
+ * Includes the prefix string (e.g. "sk_") plus a few random chars.
  */
 const VISIBLE_PREFIX_EXTRA_CHARS = 4;
 
@@ -37,18 +36,24 @@ const VISIBLE_PREFIX_EXTRA_CHARS = 4;
  * Returns the raw key (to be shown once to the user) and metadata for storage.
  * The raw key is `{prefix}{32 random alphanumeric chars}`.
  *
- * @param prefix - Key prefix, defaults to "sk_live_"
+ * @param prefix - Key prefix, defaults to "sk_"
  * @returns `{ raw, hashedKey, displayPrefix }`
  */
-export async function generateApiKey(prefix: string = DEFAULT_KEY_PREFIX): Promise<{
+/** @internal */
+export async function generateApiKey(
+  prefix: string = DEFAULT_KEY_PREFIX,
+): Promise<{
   /** The full raw key — show to user once, never store. */
   raw: string;
   /** SHA-256 hex hash of the raw key — store this. */
   hashedKey: string;
-  /** Truncated prefix for display (e.g. "sk_live_aBc1..."). */
+  /** Truncated prefix for display (e.g. "sk_aBc1..."). */
   displayPrefix: string;
 }> {
-  const randomPart = generateRandomString(KEY_RANDOM_LENGTH, KEY_RANDOM_ALPHABET);
+  const randomPart = generateRandomString(
+    KEY_RANDOM_LENGTH,
+    KEY_RANDOM_ALPHABET,
+  );
   const raw = `${prefix}${randomPart}`;
   const hashedKey = await sha256(raw);
   const displayPrefix = `${raw.substring(0, prefix.length + VISIBLE_PREFIX_EXTRA_CHARS)}...`;
@@ -61,6 +66,7 @@ export async function generateApiKey(prefix: string = DEFAULT_KEY_PREFIX): Promi
  *
  * Used during Bearer token verification to find the stored key record.
  */
+/** @internal */
 export async function hashApiKey(rawKey: string): Promise<string> {
   return sha256(rawKey);
 }
@@ -78,6 +84,7 @@ export async function hashApiKey(rawKey: string): Promise<string> {
  * A wildcard action `"*"` grants all actions on that resource.
  * A wildcard resource `"*"` grants the action on all resources.
  */
+/** @internal */
 export function buildScopeChecker(scopes: KeyScope[]): ScopeChecker {
   return {
     scopes,
@@ -91,42 +98,6 @@ export function buildScopeChecker(scopes: KeyScope[]): ScopeChecker {
   };
 }
 
-/**
- * Validate that requested scopes are a subset of the allowed scopes
- * defined in the API key config.
- *
- * @param requested - Scopes the user wants on the new key.
- * @param allowed - The scope definition from `apiKeys.scopes` config.
- * @throws Error if any requested scope is not in the allowed set.
- */
-export function validateScopes(
-  requested: KeyScope[],
-  allowed: Record<string, string[]> | undefined,
-): void {
-  if (!allowed) {
-    // No scope restrictions configured — allow anything.
-    return;
-  }
-
-  for (const scope of requested) {
-    const allowedActions = allowed[scope.resource];
-    if (!allowedActions) {
-      throwAuthError(
-        "API_KEY_INVALID_SCOPE",
-        `Unknown resource "${scope.resource}" in API key scopes. Allowed resources: ${Object.keys(allowed).join(", ")}`,
-      );
-    }
-    for (const action of scope.actions) {
-      if (action !== "*" && !allowedActions.includes(action)) {
-        throwAuthError(
-          "API_KEY_INVALID_SCOPE",
-          `Unknown action "${action}" for resource "${scope.resource}". Allowed actions: ${allowedActions.join(", ")}`,
-        );
-      }
-    }
-  }
-}
-
 // ============================================================================
 // Per-key rate limiting (token-bucket)
 // ============================================================================
@@ -139,6 +110,7 @@ export function validateScopes(
  *
  * @returns `{ limited: boolean; newState: { attemptsLeft, lastAttemptTime } }`
  */
+/** @internal */
 export function checkKeyRateLimit(
   rateLimit: { maxRequests: number; windowMs: number },
   state: { attemptsLeft: number; lastAttemptTime: number } | undefined,

package/src/server/limits.ts

@@ -0,0 +1,134 @@
+import { Fx } from "@robelest/fx";
+
+import { authDb } from "./db";
+import { AuthError } from "./authError";
+import { Doc, MutationCtx } from "./types";
+import { ConvexAuthConfig } from "./types";
+import { errorMessage } from "./utils";
+
+const DEFAULT_MAX_SIGN_IN_ATTEMPTS_PER_HOUR = 10;
+
+/**
+ * Check whether the given identifier is currently rate-limited.
+ */
+/** @internal */
+export const isSignInRateLimited = (
+  ctx: MutationCtx,
+  identifier: string,
+  config: ConvexAuthConfig,
+): Fx<boolean, AuthError> =>
+  getRateLimitState(ctx, identifier, config).pipe(
+    Fx.map((state) => state !== null && state.attemptsLeft < 1),
+  );
+
+/**
+ * Record a failed sign-in attempt for the given identifier.
+ *
+ * If a record exists, decrement; otherwise create.
+ */
+/** @internal */
+export const recordFailedSignIn = (
+  ctx: MutationCtx,
+  identifier: string,
+  config: ConvexAuthConfig,
+): Fx<void, AuthError> =>
+  getRateLimitState(ctx, identifier, config).pipe(
+    Fx.chain((state) =>
+      state !== null
+        ? Fx.from({
+            ok: () =>
+              authDb(ctx, config).rateLimits.patch(state.limit._id, {
+                attemptsLeft: state.attemptsLeft - 1,
+                lastAttemptTime: Date.now(),
+              }),
+            err: (e) =>
+              new AuthError(
+                "INTERNAL_ERROR",
+                `Failed to patch rate limit: ${errorMessage(e)}`,
+              ),
+          })
+        : Fx.from({
+            ok: () =>
+              authDb(ctx, config).rateLimits.create({
+                identifier,
+                attemptsLeft:
+                  (config.signIn?.maxFailedAttemptsPerHour ??
+                    DEFAULT_MAX_SIGN_IN_ATTEMPTS_PER_HOUR) - 1,
+                lastAttemptTime: Date.now(),
+              }),
+            err: (e) =>
+              new AuthError(
+                "INTERNAL_ERROR",
+                `Failed to create rate limit: ${errorMessage(e)}`,
+              ),
+          }),
+    ),
+    Fx.map(() => undefined),
+  );
+
+/**
+ * Reset the rate limit for the given identifier (e.g. after successful sign-in).
+ */
+/** @internal */
+export const resetSignInRateLimit = (
+  ctx: MutationCtx,
+  identifier: string,
+  config: ConvexAuthConfig,
+): Fx<void, AuthError> =>
+  getRateLimitState(ctx, identifier, config).pipe(
+    Fx.chain((state) =>
+      state !== null
+        ? Fx.from({
+            ok: () => authDb(ctx, config).rateLimits.delete(state.limit._id),
+            err: (e) =>
+              new AuthError(
+                "INTERNAL_ERROR",
+                `Failed to delete rate limit: ${errorMessage(e)}`,
+              ),
+          })
+        : Fx.unit,
+    ),
+  );
+
+// ---------------------------------------------------------------------------
+// Internal
+// ---------------------------------------------------------------------------
+
+type RateLimitState = {
+  limit: Doc<"RateLimit"> & { attemptsLeft: number; lastAttemptTime: number };
+  attemptsLeft: number;
+} | null;
+
+const getRateLimitState = (
+  ctx: MutationCtx,
+  identifier: string,
+  config: ConvexAuthConfig,
+): Fx<RateLimitState, AuthError> => {
+  const now = Date.now();
+  const maxAttemptsPerHour =
+    config.signIn?.maxFailedAttemptsPerHour ??
+    DEFAULT_MAX_SIGN_IN_ATTEMPTS_PER_HOUR;
+
+  return Fx.from({
+    ok: () => authDb(ctx, config).rateLimits.get(identifier),
+    err: (e) =>
+      new AuthError(
+        "INTERNAL_ERROR",
+        `Failed to get rate limit: ${errorMessage(e)}`,
+      ),
+  }).pipe(
+    Fx.map((raw) => {
+      const limit = raw as
+        | (Doc<"RateLimit"> & { attemptsLeft: number; lastAttemptTime: number })
+        | null;
+      if (limit === null) return null;
+      const elapsed = now - limit.lastAttemptTime;
+      const maxAttemptsPerMs = maxAttemptsPerHour / (60 * 60 * 1000);
+      const attemptsLeft = Math.min(
+        maxAttemptsPerHour,
+        limit.attemptsLeft + elapsed * maxAttemptsPerMs,
+      );
+      return { limit, attemptsLeft };
+    }),
+  );
+};