@robelest/convex-auth 0.0.4-preview.2 → 0.0.4-preview.21

package/src/providers/password.ts

@@ -20,7 +20,16 @@
  * @module
  */
 
-import { Credentials, type CredentialsConfig } from "./credentials";
+import { scryptAsync } from "@noble/hashes/scrypt.js";
+import { bytesToHex } from "@noble/hashes/utils.js";
+import { Fx } from "@robelest/fx";
+import {
+  DocumentByName,
+  GenericDataModel,
+  WithoutSystemFields,
+} from "convex/server";
+import { Value } from "convex/values";
+
 import type {
   EmailConfig,
   GenericActionCtxWithAuthConfig,
@@ -28,13 +37,7 @@ import type {
   AuthProviderConfig,
   ConvexCredentialsConfig,
 } from "../server/types";
-import {
-  DocumentByName,
-  GenericDataModel,
-  WithoutSystemFields,
-} from "convex/server";
-import { Value } from "convex/values";
-import { Scrypt } from "lucia";
+import { Credentials, type CredentialsConfig } from "./credentials";
 
 /**
  * The available options to a {@link Password} provider for Convex Auth.
@@ -62,7 +65,7 @@ export interface PasswordConfig<DataModel extends GenericDataModel> {
      * the database.
      */
     ctx: GenericActionCtxWithAuthConfig<DataModel>,
-  ) => WithoutSystemFields<DocumentByName<DataModel, "user">> & {
+  ) => WithoutSystemFields<DocumentByName<DataModel, "User">> & {
     email: string;
   };
   /**
@@ -83,21 +86,48 @@ export interface PasswordConfig<DataModel extends GenericDataModel> {
    */
   crypto?: CredentialsConfig["crypto"];
   /**
-   * An Auth.js email provider used to require verification
+   * An email provider used to require verification
    * before password reset.
    */
   reset?: EmailConfig | ((...args: any) => EmailConfig);
   /**
-   * An Auth.js email provider used to require verification
+   * An email provider used to require verification
    * before sign up / sign in.
    */
   verify?: EmailConfig | ((...args: any) => EmailConfig);
 }
 
+type PasswordFlowDispatch =
+  | { tag: "signUp" }
+  | { tag: "signIn" }
+  | { tag: "reset" }
+  | { tag: "resetVerification" }
+  | { tag: "emailVerification" }
+  | { tag: "invalid"; flow: unknown };
+
+const PASSWORD_FLOW_TAG = {
+  signUp: "signUp",
+  signIn: "signIn",
+  reset: "reset",
+  "reset-verification": "resetVerification",
+  "email-verification": "emailVerification",
+} as const;
+
+type PasswordFlowInput = keyof typeof PASSWORD_FLOW_TAG;
+
+function decodePasswordFlow(flow: unknown): PasswordFlowDispatch {
+  if (typeof flow !== "string") {
+    return { tag: "invalid", flow };
+  }
+
+  const tag = PASSWORD_FLOW_TAG[flow as PasswordFlowInput];
+  return tag === undefined ? { tag: "invalid", flow } : { tag };
+}
+
 /**
  * Email and password authentication provider.
  *
- * Passwords are by default hashed using Scrypt from Lucia.
+ * Passwords are by default hashed using scrypt.
  * You can customize the hashing via the `crypto` option.
  *
  * Email verification is not required unless you pass
@@ -116,7 +146,9 @@ export class Password<DataModel extends GenericDataModel = GenericDataModel> {
   readonly type = "credentials" as const;
   readonly config: PasswordConfig<DataModel>;
 
-  constructor(config: PasswordConfig<DataModel> = {} as PasswordConfig<DataModel>) {
+  constructor(
+    config: PasswordConfig<DataModel> = {} as PasswordConfig<DataModel>,
+  ) {
     this.id = config.id ?? "password";
     this.config = config;
   }
@@ -129,121 +161,204 @@ export class Password<DataModel extends GenericDataModel = GenericDataModel> {
     return new Credentials<DataModel>({
       id: "password",
       authorize: async (params, ctx) => {
-        const flow = params.flow as string;
-        const passwordToValidate =
-          flow === "signUp"
-            ? (params.password as string)
-            : flow === "reset-verification"
-              ? (params.newPassword as string)
-              : null;
-        if (passwordToValidate !== null) {
+        const flowDispatch = decodePasswordFlow(params.flow);
+
+        const validatePasswordRequirements = (password: string) => {
           if (config.validatePasswordRequirements !== undefined) {
-            config.validatePasswordRequirements(passwordToValidate);
-          } else {
-            validateDefaultPasswordRequirements(passwordToValidate);
+            config.validatePasswordRequirements(password);
+            return;
           }
-        }
+          validateDefaultPasswordRequirements(password);
+        };
+
+        await Fx.run(
+          Fx.match(flowDispatch, flowDispatch.tag, {
+            signUp: () =>
+              Fx.sync(() => {
+                validatePasswordRequirements(params.password as string);
+              }),
+            resetVerification: () =>
+              Fx.sync(() => {
+                validatePasswordRequirements(params.newPassword as string);
+              }),
+            signIn: () => Fx.succeed(undefined),
+            reset: () => Fx.succeed(undefined),
+            emailVerification: () => Fx.succeed(undefined),
+            invalid: () => Fx.succeed(undefined),
+          }),
+        );
+
         const profile = config.profile?.(params, ctx) ?? defaultProfile(params);
         const { email } = profile;
-        const secret = params.password as string;
-        let account: GenericDoc<DataModel, "account">;
-        let user: GenericDoc<DataModel, "user">;
-        if (flow === "signUp") {
-          if (secret === undefined) {
-            throw new Error("Missing `password` param for `signUp` flow");
-          }
-          const created = await ctx.auth.account.create(ctx, {
-            provider,
-            account: { id: email, secret },
-            profile: profile as any,
-            shouldLinkViaEmail: config.verify !== undefined,
-            shouldLinkViaPhone: false,
-          });
-          ({ account, user } = created);
-        } else if (flow === "signIn") {
-          if (secret === undefined) {
-            throw new Error("Missing `password` param for `signIn` flow");
-          }
-          const retrieved = await ctx.auth.account.get(ctx, {
-            provider,
-            account: { id: email, secret },
-          });
-          if (retrieved === null) {
-            throw new Error("Invalid credentials");
-          }
-          ({ account, user } = retrieved);
-        } else if (flow === "reset") {
-          if (!config.reset) {
-            throw new Error(`Password reset is not enabled for ${provider}`);
-          }
-          const { account } = await ctx.auth.account.get(ctx, {
-            provider,
-            account: { id: email },
-          });
-          return await ctx.auth.provider.signIn(ctx, config.reset as AuthProviderConfig, {
-            accountId: account._id,
-            params,
-          });
-        } else if (flow === "reset-verification") {
-          if (!config.reset) {
-            throw new Error(`Password reset is not enabled for ${provider}`);
-          }
-          if (params.newPassword === undefined) {
-            throw new Error(
-              "Missing `newPassword` param for `reset-verification` flow",
-            );
+        const requirePasswordParam = (
+          value: unknown,
+          flow: "signUp" | "signIn",
+        ) => {
+          if (typeof value !== "string" || value.length === 0) {
+            throw new Error(`Missing \`password\` param for \`${flow}\` flow`);
           }
-          const result = await ctx.auth.provider.signIn(
-            ctx,
-            config.reset as AuthProviderConfig,
-            { params },
-          );
-          if (result === null) {
-            throw new Error("Invalid code");
-          }
-          const { userId, sessionId } = result;
-          const secret = params.newPassword as string;
-          await ctx.auth.account.update(ctx, {
-            provider,
-            account: { id: email, secret },
-          });
-          await ctx.auth.session.invalidate(ctx, { userId, except: [sessionId] });
-          return { userId, sessionId };
-        } else if (flow === "email-verification") {
-          if (!config.verify) {
-            throw new Error(
-              `Email verification is not enabled for ${provider}`,
+          return value;
+        };
+
+        const finalizeCredentialsResult = async (
+          account: GenericDoc<DataModel, "Account">,
+          user: GenericDoc<DataModel, "User">,
+        ) => {
+          if (config.verify && !account.emailVerified) {
+            return await ctx.auth.provider.signIn(
+              ctx,
+              config.verify as AuthProviderConfig,
+              {
+                accountId: account._id,
+                params,
+              },
             );
           }
-          const { account } = await ctx.auth.account.get(ctx, {
-            provider,
-            account: { id: email },
-          });
-          return await ctx.auth.provider.signIn(ctx, config.verify as AuthProviderConfig, {
-            accountId: account._id,
-            params,
-          });
-        } else {
-          throw new Error(
-            "Missing `flow` param, it must be one of " +
-              '"signUp", "signIn", "reset", "reset-verification" or ' +
-              '"email-verification"!',
-          );
-        }
-        if (config.verify && !account.emailVerified) {
-          return await ctx.auth.provider.signIn(ctx, config.verify as AuthProviderConfig, {
-            accountId: account._id,
-            params,
-          });
-        }
-        return { userId: user._id };
+          return { userId: user._id };
+        };
+
+        return await Fx.run(
+          Fx.match(flowDispatch, flowDispatch.tag, {
+            signUp: () =>
+              Fx.from({
+                ok: async () => {
+                  const secret = requirePasswordParam(
+                    params.password,
+                    "signUp",
+                  );
+                  const created = await ctx.auth.account.create(ctx, {
+                    provider,
+                    account: { id: email, secret },
+                    profile: profile as any,
+                    shouldLinkViaEmail: config.verify !== undefined,
+                    shouldLinkViaPhone: false,
+                  });
+                  return await finalizeCredentialsResult(
+                    created.account,
+                    created.user,
+                  );
+                },
+                err: (e) => e as never,
+              }),
+            signIn: () =>
+              Fx.from({
+                ok: async () => {
+                  const secret = requirePasswordParam(
+                    params.password,
+                    "signIn",
+                  );
+                  const retrieved = await ctx.auth.account.get(ctx, {
+                    provider,
+                    account: { id: email, secret },
+                  });
+                  if (retrieved === null) {
+                    throw new Error("Invalid credentials");
+                  }
+                  return await finalizeCredentialsResult(
+                    retrieved.account,
+                    retrieved.user,
+                  );
+                },
+                err: (e) => e as never,
+              }),
+            reset: () =>
+              Fx.from({
+                ok: async () => {
+                  if (!config.reset) {
+                    throw new Error(
+                      `Password reset is not enabled for ${provider}`,
+                    );
+                  }
+                  const { account } = await ctx.auth.account.get(ctx, {
+                    provider,
+                    account: { id: email },
+                  });
+                  return await ctx.auth.provider.signIn(
+                    ctx,
+                    config.reset as AuthProviderConfig,
+                    {
+                      accountId: account._id,
+                      params,
+                    },
+                  );
+                },
+                err: (e) => e as never,
+              }),
+            resetVerification: () =>
+              Fx.from({
+                ok: async () => {
+                  if (!config.reset) {
+                    throw new Error(
+                      `Password reset is not enabled for ${provider}`,
+                    );
+                  }
+                  if (params.newPassword === undefined) {
+                    throw new Error(
+                      "Missing `newPassword` param for `reset-verification` flow",
+                    );
+                  }
+                  const result = await ctx.auth.provider.signIn(
+                    ctx,
+                    config.reset as AuthProviderConfig,
+                    { params },
+                  );
+                  if (result === null) {
+                    throw new Error("Invalid code");
+                  }
+                  const { userId, sessionId } = result;
+                  const secret = params.newPassword as string;
+                  await ctx.auth.account.update(ctx, {
+                    provider,
+                    account: { id: email, secret },
+                  });
+                  await ctx.auth.session.invalidate(ctx, {
+                    userId,
+                    except: [sessionId],
+                  });
+                  return { userId, sessionId };
+                },
+                err: (e) => e as never,
+              }),
+            emailVerification: () =>
+              Fx.from({
+                ok: async () => {
+                  if (!config.verify) {
+                    throw new Error(
+                      `Email verification is not enabled for ${provider}`,
+                    );
+                  }
+                  const { account } = await ctx.auth.account.get(ctx, {
+                    provider,
+                    account: { id: email },
+                  });
+                  return await ctx.auth.provider.signIn(
+                    ctx,
+                    config.verify as AuthProviderConfig,
+                    {
+                      accountId: account._id,
+                      params,
+                    },
+                  );
+                },
+                err: (e) => e as never,
+              }),
+            invalid: () =>
+              Fx.fatal(
+                new Error(
+                  "Missing `flow` param, it must be one of " +
+                    '"signUp", "signIn", "reset", "reset-verification" or ' +
+                    '"email-verification"!',
+                ),
+              ),
+          }),
+        );
       },
       crypto: config.crypto ?? {
         async hashSecret(password: string) {
-          return await new Scrypt().hash(password);
+          return await hashPassword(password);
         },
         async verifySecret(password: string, hash: string) {
-          return await new Scrypt().verify(hash, password);
+          return await verifyPassword(password, hash);
         },
       },
       extraProviders: [
@@ -255,19 +370,6 @@ export class Password<DataModel extends GenericDataModel = GenericDataModel> {
   }
 }
 
-// ============================================================================
-// Backward-compatible default export
-// ============================================================================
-
-/**
- * @deprecated Use `new Password(config)` instead.
- */
-export default function password<DataModel extends GenericDataModel>(
-  config: PasswordConfig<DataModel> = {} as PasswordConfig<DataModel>,
-): ConvexCredentialsConfig {
-  return new Password(config)._toMaterialized();
-}
-
 // ============================================================================
 // Helpers
 // ============================================================================
@@ -279,7 +381,82 @@ function validateDefaultPasswordRequirements(password: string) {
 }
 
 function defaultProfile(params: Record<string, unknown>) {
+  const email = params.email;
+  if (typeof email !== "string" || email.trim().length === 0) {
+    throw new Error("Missing `email` param");
+  }
   return {
-    email: params.email as string,
+    email,
   };
 }
+
+const PASSWORD_HASH_PARAMS = {
+  N: 16384,
+  r: 16,
+  p: 1,
+  dkLen: 64,
+} as const;
+
+const PASSWORD_HASH_PREFIX = `scrypt:N=${PASSWORD_HASH_PARAMS.N},r=${PASSWORD_HASH_PARAMS.r},p=${PASSWORD_HASH_PARAMS.p},dkLen=${PASSWORD_HASH_PARAMS.dkLen}`;
+
+async function hashPassword(password: string) {
+  const salt = crypto.getRandomValues(new Uint8Array(32));
+  const hash = await scryptAsync(password, salt, PASSWORD_HASH_PARAMS);
+  return `${PASSWORD_HASH_PREFIX}$${bytesToHex(salt)}$${bytesToHex(hash)}`;
+}
+
+async function verifyPassword(password: string, storedHash: string) {
+  const [prefix, saltHex, hashHex] = storedHash.split("$");
+  if (
+    prefix !== PASSWORD_HASH_PREFIX ||
+    saltHex === undefined ||
+    hashHex === undefined
+  ) {
+    return false;
+  }
+
+  let salt: Uint8Array;
+  let expectedHash: Uint8Array;
+  try {
+    salt = hexToBytes(saltHex);
+    expectedHash = hexToBytes(hashHex);
+  } catch {
+    return false;
+  }
+  if (
+    salt.length !== 32 ||
+    expectedHash.length !== PASSWORD_HASH_PARAMS.dkLen
+  ) {
+    return false;
+  }
+
+  const actualHash = await scryptAsync(password, salt, PASSWORD_HASH_PARAMS);
+  return constantTimeEqual(actualHash, expectedHash);
+}
+
+function hexToBytes(hex: string) {
+  if (hex.length % 2 !== 0) {
+    throw new Error("Invalid password hash");
+  }
+  const bytes = new Uint8Array(hex.length / 2);
+  for (let i = 0; i < bytes.length; i++) {
+    const start = i * 2;
+    const value = Number.parseInt(hex.slice(start, start + 2), 16);
+    if (Number.isNaN(value)) {
+      throw new Error("Invalid password hash");
+    }
+    bytes[i] = value;
+  }
+  return bytes;
+}
+
+function constantTimeEqual(left: Uint8Array, right: Uint8Array) {
+  if (left.length !== right.length) {
+    return false;
+  }
+  let diff = 0;
+  for (let i = 0; i < left.length; i++) {
+    diff |= left[i] ^ right[i];
+  }
+  return diff === 0;
+}

package/src/providers/phone.ts

@@ -1,49 +1,93 @@
 /**
- * Configure {@link phone} provider given a {@link PhoneUserConfig}.
- *
- * Simplifies creating phone providers.
- *
- * By default checks that there is a `phone` field during token verification
- * that matches the `phone` used during the initial `signIn` call.
+ * Phone / SMS authentication provider.
  *
  * @module
  */
 
-import { GenericDataModel } from "convex/server";
-import { PhoneConfig, PhoneUserConfig } from "../server/types";
+import { Fx } from "@robelest/fx";
+
+import type { PhoneConfig } from "../server/types";
 
 /**
- * Phone providers send a token to the user's phone number
- * for sign-in.
+ * User-facing configuration for the {@link Phone} provider.
  *
- * When you use this function to create your config, it
- * checks that there is a `phone` field during token verification
- * that matches the `phone` used during the initial `signIn` call.
+ * Use this to send SMS or other phone-based verification messages during
+ * sign-in.
+ */
+export interface PhoneProviderConfig {
+  /** Send the verification code to the user's phone. */
+  send: PhoneConfig["sendVerificationRequest"];
+  /** Provider ID override. Defaults to "phone". */
+  id?: string;
+  /** Token expiration in seconds. Defaults to 1200 (20 minutes). */
+  maxAge?: number;
+}
+
+/**
+ * Phone provider for SMS or phone-number verification flows.
  *
- * @param config - Phone provider options including `sendVerificationRequest`.
- * @returns A `PhoneConfig` to include in your `providers` array.
+ * Wraps your `send()` implementation and materializes the runtime behavior
+ * Convex Auth needs for short-code or magic-link-style phone verification.
+ *
+ * @example
+ * ```ts
+ * import { Phone } from "@robelest/convex-auth/providers";
+ *
+ * const phone = new Phone({
+ *   send: async ({ identifier, token }) => {
+ *     await sms.send({ to: identifier, body: `Your sign-in code is ${token}` });
+ *   },
+ * });
+ * ```
  */
-export default function phone<DataModel extends GenericDataModel>(
-  config: PhoneUserConfig & Pick<PhoneConfig, "sendVerificationRequest">,
-): PhoneConfig<DataModel> {
-  return {
-    id: "phone",
-    type: "phone",
-    maxAge: 60 * 20, // 20 minutes
-    authorize: async (params, account) => {
-      if (typeof params.phone !== "string") {
-        throw new Error(
-          "Token verification requires an `phone` in params of `signIn`.",
-        );
-      }
-      if (account.providerAccountId !== params.phone) {
-        throw new Error(
-          "Short verification code requires a matching `phone` " +
-            "in params of `signIn`.",
+export class Phone {
+  readonly id: string;
+  readonly type = "phone" as const;
+
+  /**
+   * Create a phone provider instance.
+   *
+   * @param config - Phone delivery and provider settings.
+   */
+  constructor(public readonly config: PhoneProviderConfig) {
+    this.id = config.id ?? "phone";
+  }
+
+  /** @internal */
+  _toMaterialized(): PhoneConfig {
+    return {
+      id: this.id,
+      type: "phone",
+      maxAge: this.config.maxAge ?? 60 * 20,
+      authorize: async (params, account) => {
+        const dispatch =
+          typeof params.phone !== "string"
+            ? ({ tag: "missingPhone" } as const)
+            : account.providerAccountId !== params.phone
+              ? ({ tag: "mismatch" } as const)
+              : ({ tag: "ok" } as const);
+
+        return await Fx.run(
+          Fx.match(dispatch, dispatch.tag, {
+            missingPhone: () =>
+              Fx.fatal(
+                new Error(
+                  "Token verification requires a `phone` in params of `signIn`.",
+                ),
+              ),
+            mismatch: () =>
+              Fx.fatal(
+                new Error(
+                  "Short verification code requires a matching `phone` " +
+                    "in params of `signIn`.",
+                ),
+              ),
+            ok: () => Fx.succeed(undefined),
+          }),
         );
-      }
-    },
-    sendVerificationRequest: config.sendVerificationRequest,
-    options: config,
-  };
+      },
+      sendVerificationRequest: this.config.send,
+      options: {} as any,
+    };
+  }
 }