@robelest/convex-auth 0.0.4-preview.2 → 0.0.4-preview.21

package/src/server/authError.ts

@@ -0,0 +1,44 @@
+import { Cv } from "@robelest/fx/convex";
+import type { ConvexError } from "convex/values";
+
+import { AUTH_ERRORS } from "./errors";
+import type { AuthErrorCode } from "./errors";
+
+/**
+ * Typed error for the Fx error channel.
+ *
+ * Use with `Fx.fail(new AuthError("CODE"))` in pipelines.
+ * At Convex boundaries, {@link toConvexError} converts these to `ConvexError`.
+ */
+export class AuthError extends Error {
+  /**
+   * Discriminant tag for error channel matching.
+   * @readonly
+   */
+  readonly _tag = "AuthError" as const;
+
+  constructor(
+    /**
+     * Machine-readable error code.
+     * @readonly
+     */
+    readonly code: AuthErrorCode,
+    message?: string,
+    /**
+     * Optional structured context for diagnostics.
+     * @readonly
+     */
+    readonly context?: Record<string, unknown>,
+  ) {
+    super(message ?? AUTH_ERRORS[code]);
+  }
+
+  /** Convert to the `ConvexError` shape the Convex runtime expects. */
+  toConvexError(): ConvexError<{ code: AuthErrorCode; message: string }> {
+    return Cv.error({
+      code: this.code,
+      message: this.message,
+      ...this.context,
+    });
+  }
+}

package/src/server/{providers.ts → config.ts}

@@ -1,10 +1,14 @@
 import {
+  isOAuthProvider,
+  type OAuthProviderInstance,
+} from "../providers/oauth";
+import {
+  AuthAuthorizationConfig,
   AuthProviderConfig,
   AuthProviderMaterializedConfig,
   ConvexAuthConfig,
   OAuthMaterializedConfig,
 } from "./types";
-import { isOAuthProvider, type OAuthProviderInstance } from "../providers/oauth";
 
 // ============================================================================
 // Provider class detection
@@ -30,6 +34,7 @@ function isClassProvider(
  *
  * @internal
  */
+/** @internal */
 export function configDefaults(config_: ConvexAuthConfig) {
   const config = materializeAndDefaultProviders(config_);
   // Collect extra providers from credentials providers
@@ -40,6 +45,7 @@ export function configDefaults(config_: ConvexAuthConfig) {
     .filter((p) => p !== undefined);
   return {
     ...config,
+    authorization: normalizeAuthorizationConfig(config.authorization),
     extraProviders: materializeProviders(extraProviders),
   };
 }
@@ -49,6 +55,7 @@ export function configDefaults(config_: ConvexAuthConfig) {
  *
  * @internal
  */
+/** @internal */
 export function materializeProvider(provider: AuthProviderConfig) {
   const config = { providers: [provider], component: {} as any };
   materializeAndDefaultProviders(config);
@@ -60,6 +67,7 @@ export function materializeProvider(provider: AuthProviderConfig) {
  *
  * @internal
  */
+/** @internal */
 export function listAvailableProviders(
   config: ReturnType<typeof configDefaults>,
   allowExtraProviders: boolean,
@@ -82,24 +90,70 @@ function materializeProviders(providers: AuthProviderConfig[]) {
   return config.providers as AuthProviderMaterializedConfig[];
 }
 
-function materializeAndDefaultProviders(config_: ConvexAuthConfig) {
-  const allProviders: AuthProviderMaterializedConfig[] = [];
+type ProviderMaterializationDispatch =
+  | { tag: "oauth"; raw: OAuthProviderInstance }
+  | {
+      tag: "class";
+      raw: { _toMaterialized(): AuthProviderMaterializedConfig };
+    }
+  | { tag: "factoryOrObject"; raw: AuthProviderConfig };
 
-  for (const raw of config_.providers) {
-    if (isOAuthProvider(raw)) {
-      allProviders.push(materializeOAuthProvider(raw));
-    } else if (isClassProvider(raw)) {
-      allProviders.push(raw._toMaterialized());
-    } else {
-      // Factory function or plain config object
-      const resolved = typeof raw === "function" ? raw() : (raw as any);
-      // Merge `options` into the provider (backward compat with factory-style
-      // providers that store user overrides in an `options` field).
+type ProviderMaterializationHandlers<T> = {
+  oauth: (
+    dispatch: Extract<ProviderMaterializationDispatch, { tag: "oauth" }>,
+  ) => T;
+  class: (
+    dispatch: Extract<ProviderMaterializationDispatch, { tag: "class" }>,
+  ) => T;
+  factoryOrObject: (
+    dispatch: Extract<
+      ProviderMaterializationDispatch,
+      { tag: "factoryOrObject" }
+    >,
+  ) => T;
+};
+
+function decodeProviderMaterializationDispatch(
+  raw: AuthProviderConfig,
+): ProviderMaterializationDispatch {
+  if (isOAuthProvider(raw)) {
+    return { tag: "oauth", raw };
+  }
+  if (isClassProvider(raw)) {
+    return { tag: "class", raw };
+  }
+  return { tag: "factoryOrObject", raw };
+}
+
+function matchProviderMaterializationDispatch<T>(
+  dispatch: ProviderMaterializationDispatch,
+  handlers: ProviderMaterializationHandlers<T>,
+): T {
+  return (
+    handlers[dispatch.tag] as (dispatch: ProviderMaterializationDispatch) => T
+  )(dispatch);
+}
+
+function materializeProviderConfig(raw: AuthProviderConfig) {
+  const dispatch = decodeProviderMaterializationDispatch(raw);
+  return matchProviderMaterializationDispatch(dispatch, {
+    oauth: (d) => materializeOAuthProvider(d.raw),
+    class: (d) => d.raw._toMaterialized(),
+    factoryOrObject: (d) => {
+      const resolved = typeof d.raw === "function" ? d.raw() : (d.raw as any);
       const merged = resolved.options
         ? { ...resolved, ...resolved.options }
         : resolved;
-      allProviders.push(merged as AuthProviderMaterializedConfig);
-    }
+      return merged as AuthProviderMaterializedConfig;
+    },
+  });
+}
+
+function materializeAndDefaultProviders(config_: ConvexAuthConfig) {
+  const allProviders: AuthProviderMaterializedConfig[] = [];
+
+  for (const raw of config_.providers) {
+    allProviders.push(materializeProviderConfig(raw));
   }
 
   const config = { ...config_, providers: allProviders };
@@ -115,6 +169,21 @@ function materializeAndDefaultProviders(config_: ConvexAuthConfig) {
   return config;
 }
 
+function normalizeAuthorizationConfig(
+  authorization: ConvexAuthConfig["authorization"],
+): AuthAuthorizationConfig {
+  const roles = Object.fromEntries(
+    Object.entries(authorization?.roles ?? {}).map(([roleId, role]) => [
+      roleId,
+      {
+        ...(role.label ? { label: role.label } : {}),
+        grants: Array.from(new Set(role.grants)).sort(),
+      },
+    ]),
+  );
+  return { roles };
+}
+
 /**
  * Materialize an Arctic-based `OAuthProviderInstance` into the runtime config.
  */

package/src/server/cookies.ts

@@ -1,5 +1,6 @@
 import { isLocalHost } from "./utils";
 
+/** @internal */
 export const SHARED_COOKIE_OPTIONS = {
   httpOnly: true,
   sameSite: "none" as const,
@@ -9,6 +10,7 @@ export const SHARED_COOKIE_OPTIONS = {
 };
 
 const REDIRECT_MAX_AGE = 60 * 15; // 15 minutes in seconds
+/** @internal */
 export function redirectToParamCookie(providerId: string, redirectTo: string) {
   return {
     name: redirectToParamCookieName(providerId),
@@ -17,6 +19,7 @@ export function redirectToParamCookie(providerId: string, redirectTo: string) {
   };
 }
 
+/** @internal */
 export function useRedirectToParam(
   providerId: string,
   cookies: Record<string, string | undefined>,
@@ -38,5 +41,9 @@ export function useRedirectToParam(
 }
 
 function redirectToParamCookieName(providerId: string) {
-  return (!isLocalHost(process.env.CONVEX_SITE_URL) ? "__Host-" : "") + providerId + "RedirectTo";
+  return (
+    (!isLocalHost(process.env.CONVEX_SITE_URL) ? "__Host-" : "") +
+    providerId +
+    "RedirectTo"
+  );
 }