@robelest/convex-auth 0.0.4-preview.2 → 0.0.4-preview.21

package/src/server/crypto.ts

@@ -0,0 +1,88 @@
+import { Fx } from "@robelest/fx";
+
+import { AuthError } from "./authError";
+import { AuthProviderMaterializedConfig } from "./types";
+import { ConvexAuthMaterializedConfig } from "./types";
+import { errorMessage } from "./utils";
+
+/**
+ * Hash a secret using the provider's `crypto.hashSecret` function.
+ *
+ * Validates that the provider is a credentials provider and has the
+ * required crypto function, returning typed errors through the Fx channel.
+ */
+/** @internal */
+export const hash = (provider: any, secret: string): Fx<string, AuthError> =>
+  Fx.gen(function* () {
+    if (provider.type !== "credentials") {
+      return yield* Fx.fail(
+        new AuthError(
+          "INVALID_CREDENTIALS_PROVIDER",
+          `Provider ${provider.id} is not a credentials provider`,
+        ),
+      );
+    }
+
+    const hashSecretFn = provider.crypto?.hashSecret as
+      | ((s: string) => Promise<string>)
+      | undefined;
+    if (!hashSecretFn) {
+      return yield* Fx.fail(
+        new AuthError(
+          "MISSING_CRYPTO_FUNCTION",
+          `Provider ${provider.id} does not have a \`crypto.hashSecret\` function`,
+        ),
+      );
+    }
+
+    return yield* Fx.from({
+      ok: () => hashSecretFn(secret),
+      err: (e) =>
+        new AuthError("INTERNAL_ERROR", `Hash failed: ${errorMessage(e)}`),
+    });
+  });
+
+/**
+ * Verify a secret against a hash using the provider's `crypto.verifySecret` function.
+ */
+/** @internal */
+export const verify = (
+  provider: AuthProviderMaterializedConfig,
+  secret: string,
+  hashValue: string,
+): Fx<boolean, AuthError> =>
+  Fx.gen(function* () {
+    if (provider.type !== "credentials") {
+      return yield* Fx.fail(
+        new AuthError(
+          "INVALID_CREDENTIALS_PROVIDER",
+          `Provider ${provider.id} is not a credentials provider`,
+        ),
+      );
+    }
+
+    const verifySecretFn = (provider as any).crypto?.verifySecret as
+      | ((s: string, h: string) => Promise<boolean>)
+      | undefined;
+    if (!verifySecretFn) {
+      return yield* Fx.fail(
+        new AuthError(
+          "MISSING_CRYPTO_FUNCTION",
+          `Provider ${provider.id} does not have a \`crypto.verifySecret\` function`,
+        ),
+      );
+    }
+
+    return yield* Fx.from({
+      ok: () => verifySecretFn(secret, hashValue),
+      err: (e) =>
+        new AuthError("INTERNAL_ERROR", `Verify failed: ${errorMessage(e)}`),
+    });
+  });
+
+export type GetProviderOrThrowFunc = (
+  provider: string,
+  allowExtraProviders?: boolean,
+) => AuthProviderMaterializedConfig;
+
+export type Config = ConvexAuthMaterializedConfig;

package/src/server/{implementation/db.ts → db.ts}

@@ -1,7 +1,14 @@
-import { GenericActionCtx, GenericDataModel, GenericMutationCtx } from "convex/server";
-import { AuthComponentApi } from "../types";
+import {
+  GenericActionCtx,
+  GenericDataModel,
+  GenericMutationCtx,
+  FunctionReference,
+} from "convex/server";
 
-type MutationCtxLike = Pick<GenericMutationCtx<GenericDataModel>, "runQuery" | "runMutation">;
+type MutationCtxLike = Pick<
+  GenericMutationCtx<GenericDataModel>,
+  "runQuery" | "runMutation"
+>;
 type ActionCtxLike = Pick<
   GenericActionCtx<GenericDataModel>,
   "runQuery" | "runMutation" | "runAction"
@@ -9,10 +16,53 @@ type ActionCtxLike = Pick<
 
 type CtxLike = MutationCtxLike | ActionCtxLike;
 
-export type AuthDbConfig = { component: AuthComponentApi };
+type AuthComponentApiLike = {
+  public: {
+    userGetById: FunctionReference<"query", "internal">;
+    userFindByVerifiedEmail: FunctionReference<"query", "internal">;
+    userFindByVerifiedPhone: FunctionReference<"query", "internal">;
+    userInsert: FunctionReference<"mutation", "internal">;
+    userPatch: FunctionReference<"mutation", "internal">;
+    userUpsert: FunctionReference<"mutation", "internal">;
+    accountGet: FunctionReference<"query", "internal">;
+    accountGetById: FunctionReference<"query", "internal">;
+    accountInsert: FunctionReference<"mutation", "internal">;
+    accountPatch: FunctionReference<"mutation", "internal">;
+    accountDelete: FunctionReference<"mutation", "internal">;
+    sessionCreate: FunctionReference<"mutation", "internal">;
+    sessionGetById: FunctionReference<"query", "internal">;
+    sessionDelete: FunctionReference<"mutation", "internal">;
+    sessionListByUser: FunctionReference<"query", "internal">;
+    verifierCreate: FunctionReference<"mutation", "internal">;
+    verifierGetById: FunctionReference<"query", "internal">;
+    verifierGetBySignature: FunctionReference<"query", "internal">;
+    verifierPatch: FunctionReference<"mutation", "internal">;
+    verifierDelete: FunctionReference<"mutation", "internal">;
+    verificationCodeGetByAccountId: FunctionReference<"query", "internal">;
+    verificationCodeGetByCode: FunctionReference<"query", "internal">;
+    verificationCodeCreate: FunctionReference<"mutation", "internal">;
+    verificationCodeDelete: FunctionReference<"mutation", "internal">;
+    refreshTokenCreate: FunctionReference<"mutation", "internal">;
+    refreshTokenGetById: FunctionReference<"query", "internal">;
+    refreshTokenPatch: FunctionReference<"mutation", "internal">;
+    refreshTokenGetChildren: FunctionReference<"query", "internal">;
+    refreshTokenListBySession: FunctionReference<"query", "internal">;
+    refreshTokenDeleteAll: FunctionReference<"mutation", "internal">;
+    refreshTokenGetActive: FunctionReference<"query", "internal">;
+    rateLimitGet: FunctionReference<"query", "internal">;
+    rateLimitCreate: FunctionReference<"mutation", "internal">;
+    rateLimitPatch: FunctionReference<"mutation", "internal">;
+    rateLimitDelete: FunctionReference<"mutation", "internal">;
+  };
+};
+
+/** @internal */
+export type AuthDbConfig = { component: AuthComponentApiLike };
 
+/** @internal */
 export type AuthDb = ReturnType<typeof authDb>;
 
+/** @internal */
 export function authDb(ctx: CtxLike, config: AuthDbConfig) {
   const component = config.component;
   return {
@@ -24,15 +74,23 @@ export function authDb(ctx: CtxLike, config: AuthDbConfig) {
       findByVerifiedPhone: (phone: string) =>
         ctx.runQuery(component.public.userFindByVerifiedPhone, { phone }),
       insert: (data: Record<string, unknown>) =>
-        ctx.runMutation(component.public.userInsert, { data }) as Promise<string>,
+        ctx.runMutation(component.public.userInsert, {
+          data,
+        }) as Promise<string>,
       patch: (userId: string, data: Record<string, unknown>) =>
         ctx.runMutation(component.public.userPatch, { userId, data }),
       upsert: (userId: string | undefined, data: Record<string, unknown>) =>
-        ctx.runMutation(component.public.userUpsert, { userId, data }) as Promise<string>,
+        ctx.runMutation(component.public.userUpsert, {
+          userId,
+          data,
+        }) as Promise<string>,
     },
     accounts: {
       get: (provider: string, providerAccountId: string) =>
-        ctx.runQuery(component.public.accountGet, { provider, providerAccountId }),
+        ctx.runQuery(component.public.accountGet, {
+          provider,
+          providerAccountId,
+        }),
       getById: (accountId: string) =>
         ctx.runQuery(component.public.accountGetById, { accountId }),
       create: (args: {
@@ -40,7 +98,12 @@ export function authDb(ctx: CtxLike, config: AuthDbConfig) {
         provider: string;
         providerAccountId: string;
         secret?: string;
-      }) => ctx.runMutation(component.public.accountInsert, args) as Promise<string>,
+        extend?: Record<string, unknown>;
+      }) =>
+        ctx.runMutation(
+          component.public.accountInsert,
+          args,
+        ) as Promise<string>,
       patch: (accountId: string, data: Record<string, unknown>) =>
         ctx.runMutation(component.public.accountPatch, { accountId, data }),
       delete: (accountId: string) =>
@@ -48,7 +111,10 @@ export function authDb(ctx: CtxLike, config: AuthDbConfig) {
     },
     sessions: {
       create: (userId: string, expirationTime: number) =>
-        ctx.runMutation(component.public.sessionCreate, { userId, expirationTime }) as Promise<string>,
+        ctx.runMutation(component.public.sessionCreate, {
+          userId,
+          expirationTime,
+        }) as Promise<string>,
       getById: (sessionId: string) =>
         ctx.runQuery(component.public.sessionGetById, { sessionId }),
       delete: (sessionId: string) =>
@@ -58,7 +124,9 @@ export function authDb(ctx: CtxLike, config: AuthDbConfig) {
     },
     verifiers: {
       create: (sessionId?: string) =>
-        ctx.runMutation(component.public.verifierCreate, { sessionId }) as Promise<string>,
+        ctx.runMutation(component.public.verifierCreate, {
+          sessionId,
+        }) as Promise<string>,
       getById: (verifierId: string) =>
         ctx.runQuery(component.public.verifierGetById, { verifierId }),
       getBySignature: (signature: string) =>
@@ -70,7 +138,9 @@ export function authDb(ctx: CtxLike, config: AuthDbConfig) {
     },
     verificationCodes: {
       getByAccountId: (accountId: string) =>
-        ctx.runQuery(component.public.verificationCodeGetByAccountId, { accountId }),
+        ctx.runQuery(component.public.verificationCodeGetByAccountId, {
+          accountId,
+        }),
       getByCode: (code: string) =>
         ctx.runQuery(component.public.verificationCodeGetByCode, { code }),
       create: (args: {
@@ -81,8 +151,7 @@ export function authDb(ctx: CtxLike, config: AuthDbConfig) {
         verifier?: string;
         emailVerified?: string;
         phoneVerified?: string;
-      }) =>
-        ctx.runMutation(component.public.verificationCodeCreate, args),
+      }) => ctx.runMutation(component.public.verificationCodeCreate, args),
       delete: (verificationCodeId: string) =>
         ctx.runMutation(component.public.verificationCodeDelete, {
           verificationCodeId,
@@ -94,11 +163,17 @@ export function authDb(ctx: CtxLike, config: AuthDbConfig) {
         expirationTime: number;
         parentRefreshTokenId?: string;
       }) =>
-        ctx.runMutation(component.public.refreshTokenCreate, args) as Promise<string>,
+        ctx.runMutation(
+          component.public.refreshTokenCreate,
+          args,
+        ) as Promise<string>,
       getById: (refreshTokenId: string) =>
         ctx.runQuery(component.public.refreshTokenGetById, { refreshTokenId }),
       patch: (refreshTokenId: string, data: Record<string, unknown>) =>
-        ctx.runMutation(component.public.refreshTokenPatch, { refreshTokenId, data }),
+        ctx.runMutation(component.public.refreshTokenPatch, {
+          refreshTokenId,
+          data,
+        }),
       getChildren: (sessionId: string, parentRefreshTokenId: string) =>
         ctx.runQuery(component.public.refreshTokenGetChildren, {
           sessionId,

package/src/server/device.ts

@@ -0,0 +1,221 @@
+/**
+ * Server-side device authorization flow logic (RFC 8628).
+ *
+ * Handles the three phases of the device flow:
+ * 1. (default) — Generate a device code + user code pair
+ * 2. poll      — Device checks whether the user has authorized yet
+ * 3. verify    — Authenticated user links a user code to their session
+ *
+ * Uses `@oslojs/crypto/random` for code generation and
+ * `@oslojs/crypto/sha2` for hashing device codes before storage.
+ */
+
+import { Fx } from "@robelest/fx";
+
+import { AuthError } from "./authError";
+import { userIdFromIdentitySubject } from "./identity";
+import { callSignIn } from "./mutations/index";
+import { DeviceProviderConfig, GenericActionCtxWithAuthConfig } from "./types";
+import {
+  AuthDataModel,
+  SessionInfo,
+  mutateDeviceInsert,
+  queryDeviceByCodeHash,
+  queryDeviceByUserCode,
+  mutateDeviceAuthorize,
+  mutateDeviceUpdateLastPolled,
+  mutateDeviceDelete,
+} from "./types";
+import { generateRandomString, sha256 } from "./utils";
+import { requireEnv } from "./utils";
+
+type EnrichedActionCtx = GenericActionCtxWithAuthConfig<AuthDataModel>;
+
+// ============================================================================
+// Constants
+// ============================================================================
+
+const DEVICE_CODE_ALPHABET =
+  "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789";
+const DEVICE_CODE_LENGTH = 40;
+const DEVICE_FLOWS = ["create", "poll", "verify"] as const;
+
+// ============================================================================
+// Create flow
+// ============================================================================
+
+// ============================================================================
+// Poll flow — pipeline of validations + status dispatch
+// ============================================================================
+
+// ============================================================================
+// Main dispatch
+// ============================================================================
+
+type DeviceResult =
+  | {
+      kind: "deviceCode";
+      deviceCode: string;
+      userCode: string;
+      verificationUri: string;
+      verificationUriComplete: string;
+      expiresIn: number;
+      interval: number;
+    }
+  | { kind: "signedIn"; signedIn: SessionInfo | null };
+
+/** @internal */
+export const handleDevice = (
+  ctx: EnrichedActionCtx,
+  provider: DeviceProviderConfig,
+  args: { params?: Record<string, any> },
+): Fx<DeviceResult, AuthError> =>
+  Fx.from({
+    ok: async () => {
+      const params = (args.params ?? {}) as Record<string, unknown>;
+      const flow = (typeof params.flow === "string" ? params.flow : "create") as
+        | "create"
+        | "poll"
+        | "verify";
+
+      if (!DEVICE_FLOWS.some((candidate) => candidate === flow)) {
+        throw new AuthError(
+          "DEVICE_MISSING_FLOW",
+          "Missing `flow` parameter. Expected one of: create, poll, verify",
+        );
+      }
+
+      if (flow === "create") {
+        const deviceCode = generateRandomString(
+          DEVICE_CODE_LENGTH,
+          DEVICE_CODE_ALPHABET,
+        );
+        const deviceCodeHash = await sha256(deviceCode);
+
+        const rawUserCode = generateRandomString(
+          provider.userCodeLength,
+          provider.charset,
+        );
+        const mid = Math.floor(rawUserCode.length / 2);
+        const userCode =
+          rawUserCode.slice(0, mid) + "-" + rawUserCode.slice(mid);
+
+        const expiresAt = Date.now() + provider.expiresIn * 1000;
+        await mutateDeviceInsert(ctx, {
+          deviceCodeHash,
+          userCode,
+          expiresAt,
+          interval: provider.interval,
+          status: "pending",
+        });
+
+        const verificationUri =
+          provider.verificationUri ??
+          `${process.env.SITE_URL ?? requireEnv("SITE_URL")}/device`;
+
+        return {
+          kind: "deviceCode" as const,
+          deviceCode,
+          userCode,
+          verificationUri,
+          verificationUriComplete: `${verificationUri}?user_code=${encodeURIComponent(userCode)}`,
+          expiresIn: provider.expiresIn,
+          interval: provider.interval,
+        };
+      }
+
+      if (flow === "poll") {
+        if (typeof params.deviceCode !== "string") {
+          throw new AuthError(
+            "DEVICE_MISSING_FLOW",
+            "Missing `deviceCode` parameter for poll flow.",
+          );
+        }
+
+        const hash = await sha256(params.deviceCode);
+        const doc = await queryDeviceByCodeHash(ctx, hash);
+        if (doc === null) {
+          throw new AuthError("DEVICE_CODE_EXPIRED");
+        }
+        if (Date.now() > doc.expiresAt) {
+          await mutateDeviceDelete(ctx, doc._id);
+          throw new AuthError("DEVICE_CODE_EXPIRED");
+        }
+        if (
+          doc.lastPolledAt !== undefined &&
+          (Date.now() - doc.lastPolledAt) / 1000 < doc.interval
+        ) {
+          throw new AuthError("DEVICE_SLOW_DOWN");
+        }
+
+        await mutateDeviceUpdateLastPolled(ctx, doc._id, Date.now());
+
+        if (doc.status === "pending") {
+          throw new AuthError("DEVICE_AUTHORIZATION_PENDING");
+        }
+        if (doc.status === "denied") {
+          await mutateDeviceDelete(ctx, doc._id);
+          throw new AuthError("DEVICE_CODE_DENIED");
+        }
+
+        if (!doc.userId || !doc.sessionId) {
+          throw new AuthError(
+            "INTERNAL_ERROR",
+            "Authorized device code missing userId or sessionId",
+          );
+        }
+
+        await mutateDeviceDelete(ctx, doc._id);
+        const signInResult = await callSignIn(ctx, {
+          userId: doc.userId,
+          sessionId: doc.sessionId,
+          generateTokens: true,
+        });
+        return { kind: "signedIn" as const, signedIn: signInResult };
+      }
+
+      if (typeof params.userCode !== "string") {
+        throw new AuthError(
+          "DEVICE_INVALID_USER_CODE",
+          "Missing `userCode` parameter for verify flow.",
+        );
+      }
+
+      const identity = await ctx.auth.getUserIdentity();
+      if (identity === null) {
+        throw new AuthError(
+          "NOT_SIGNED_IN",
+          "You must be signed in to authorize a device.",
+        );
+      }
+
+      const userId = userIdFromIdentitySubject(identity.subject);
+      const doc = await queryDeviceByUserCode(ctx, params.userCode);
+      if (doc === null) {
+        throw new AuthError("DEVICE_INVALID_USER_CODE");
+      }
+      if (Date.now() > doc.expiresAt) {
+        await mutateDeviceDelete(ctx, doc._id);
+        throw new AuthError("DEVICE_CODE_EXPIRED");
+      }
+      if (doc.status !== "pending") {
+        throw new AuthError("DEVICE_ALREADY_AUTHORIZED");
+      }
+
+      const signInResult = await callSignIn(ctx, {
+        userId,
+        generateTokens: false,
+      });
+      await mutateDeviceAuthorize(
+        ctx,
+        doc._id,
+        signInResult.userId,
+        signInResult.sessionId,
+      );
+      return { kind: "signedIn" as const, signedIn: null };
+    },
+    err: (e) =>
+      e instanceof AuthError
+        ? e
+        : new AuthError("INTERNAL_ERROR", `Device flow failed: ${String(e)}`),
+  });

package/src/server/enterprise/config.ts

@@ -0,0 +1,51 @@
+import { asRecord } from "./shared";
+
+const getProtocolConfig = (config: unknown, protocol: "oidc" | "saml") => {
+  const base = asRecord(config);
+  const direct = base?.[protocol];
+  const viaProtocols = asRecord(base?.protocols)?.[protocol];
+  return asRecord(direct) ?? asRecord(viaProtocols) ?? {};
+};
+
+/** @internal */
+export function getOidcConfig(config: unknown): Record<string, any> {
+  return getProtocolConfig(config, "oidc");
+}
+
+/** @internal */
+export function getPublicOidcConfig(config: unknown): Record<string, any> {
+  const oidc = getOidcConfig(config);
+  const { clientSecret: _clientSecret, ...publicOidc } = oidc;
+  return publicOidc;
+}
+
+/** @internal */
+export function withOidcSecretState(
+  config: Record<string, any>,
+  hasClientSecret: boolean,
+) {
+  return {
+    ...config,
+    hasClientSecret,
+  };
+}
+
+/** @internal */
+export function getSamlConfig(config: unknown): Record<string, any> {
+  return getProtocolConfig(config, "saml");
+}
+
+/** @internal */
+export function upsertProtocolConfig(
+  config: unknown,
+  protocol: "oidc" | "saml",
+  protocolConfig: Record<string, unknown>,
+) {
+  const base = asRecord(config) ?? {};
+  const protocols = asRecord(base.protocols) ?? {};
+  protocols[protocol] = {
+    ...asRecord(protocols[protocol]),
+    ...protocolConfig,
+  };
+  return { ...base, protocols };
+}