@robelest/convex-auth 0.0.4-preview.2 → 0.0.4-preview.21

package/src/server/mutations/refresh.ts

@@ -0,0 +1,298 @@
+import { Fx } from "@robelest/fx";
+import type { GenericActionCtx, GenericDataModel } from "convex/server";
+import { Infer, v } from "convex/values";
+
+import { authDb } from "../db";
+import { AuthError } from "../authError";
+import * as Provider from "../crypto";
+import {
+  invalidateRefreshTokensInSubtree,
+  parseRefreshToken,
+  REFRESH_TOKEN_REUSE_WINDOW_MS,
+  refreshTokenIfValid,
+} from "../refresh";
+import { generateTokensForSession } from "../sessions";
+import { MutationCtx } from "../types";
+import { logWithLevel, maybeRedact } from "../utils";
+import { AUTH_STORE_REF } from "./store/refs";
+
+export const refreshSessionArgs = v.object({
+  refreshToken: v.string(),
+});
+
+type RefreshResult = null | {
+  token: string;
+  refreshToken: string;
+};
+
+// ============================================================================
+// Small helpers for the refresh pipeline
+// ============================================================================
+
+/** A soft refresh failure — logged and collapsed to null at the boundary. */
+class RefreshFailure {
+  readonly _tag = "RefreshFailure" as const;
+  constructor(readonly reason: string) {}
+}
+
+// ============================================================================
+// Main exported function
+// ============================================================================
+
+export async function refreshSessionImpl(
+  ctx: MutationCtx,
+  args: Infer<typeof refreshSessionArgs>,
+  _getProviderOrThrow: Provider.GetProviderOrThrowFunc,
+  config: Provider.Config,
+): Promise<RefreshResult> {
+  const db = authDb(ctx, config);
+  const { refreshToken } = args;
+
+  return Fx.run(
+    parseRefreshToken(refreshToken).pipe(
+      Fx.recover((err: AuthError) => Fx.fail(new RefreshFailure(err.message))),
+      Fx.tap(({ refreshTokenId, sessionId: tokenSessionId }) =>
+        Fx.sync(() =>
+          logWithLevel(
+            "DEBUG",
+            `refreshSessionImpl args: Token ID: ${maybeRedact(refreshTokenId)} Session ID: ${maybeRedact(tokenSessionId)}`,
+          ),
+        ),
+      ),
+      Fx.chain(({ refreshTokenId, sessionId: tokenSessionId }) =>
+        refreshTokenIfValid(ctx, refreshTokenId, tokenSessionId, config).pipe(
+          Fx.chain((validationResult) =>
+            validationResult === null
+              ? Fx.gen(function* () {
+                  yield* Fx.from({
+                    ok: async () => {
+                      const session = await (db as any).sessions.getById(
+                        tokenSessionId,
+                      );
+                      if (session !== null) {
+                        await (db as any).sessions.delete(session._id);
+                      }
+                    },
+                    err: () =>
+                      new RefreshFailure(
+                        "Skipping invalid session id during refresh cleanup",
+                      ),
+                  }).pipe(
+                    Fx.recover((f) => {
+                      logWithLevel("DEBUG", f.reason);
+                      return Fx.succeed(undefined as void);
+                    }),
+                  );
+
+                  yield* Fx.from({
+                    ok: () =>
+                      authDb(ctx, config).refreshTokens.deleteAll(
+                        tokenSessionId as any,
+                      ),
+                    err: () =>
+                      new RefreshFailure(
+                        "Skipping invalid token session id during refresh token cleanup",
+                      ),
+                  }).pipe(
+                    Fx.recover((f) => {
+                      logWithLevel("DEBUG", f.reason);
+                      return Fx.succeed(undefined as void);
+                    }),
+                  );
+
+                  return null;
+                })
+              : (() => {
+                  const { session } = validationResult;
+                  const sessionId = session._id;
+                  const userId = session.userId;
+                  const tokenFirstUsed =
+                    validationResult.refreshTokenDoc.firstUsedTime;
+                  return tokenFirstUsed === undefined
+                    ? Fx.from({
+                        ok: async () => {
+                          await (db as any).refreshTokens.patch(
+                            refreshTokenId,
+                            {
+                              firstUsedTime: Date.now(),
+                            },
+                          );
+                          const result = await generateTokensForSession(
+                            ctx,
+                            config,
+                            {
+                              userId,
+                              sessionId,
+                              issuedRefreshTokenId: null,
+                              parentRefreshTokenId: refreshTokenId as any,
+                            },
+                          );
+                          const { refreshTokenId: newRefreshTokenId } =
+                            await Fx.run(
+                              parseRefreshToken(result.refreshToken),
+                            );
+                          logWithLevel(
+                            "DEBUG",
+                            `Exchanged ${maybeRedact(validationResult.refreshTokenDoc._id)} (first use) for new refresh token ${maybeRedact(newRefreshTokenId)}`,
+                          );
+                          return result;
+                        },
+                        err: () =>
+                          new RefreshFailure(
+                            "Failed during first-use token exchange",
+                          ),
+                      })
+                    : Fx.from({
+                        ok: () =>
+                          authDb(ctx, config).refreshTokens.getActive(
+                            tokenSessionId as any,
+                          ),
+                        err: () =>
+                          new RefreshFailure(
+                            "Failed to load active refresh token",
+                          ),
+                      }).pipe(
+                        Fx.chain((activeRefreshToken) => {
+                          logWithLevel(
+                            "DEBUG",
+                            `Active refresh token: ${maybeRedact(activeRefreshToken?._id ?? "(none)")}, parent ${maybeRedact(activeRefreshToken?.parentRefreshTokenId ?? "(none)")}`,
+                          );
+
+                          const reuseDispatch =
+                            activeRefreshToken !== null &&
+                            activeRefreshToken.parentRefreshTokenId ===
+                              refreshTokenId
+                              ? ({
+                                  tag: "parentOfActive",
+                                  activeRefreshToken,
+                                } as const)
+                              : tokenFirstUsed + REFRESH_TOKEN_REUSE_WINDOW_MS >
+                                  Date.now()
+                                ? ({ tag: "withinReuseWindow" } as const)
+                                : ({ tag: "outsideReuseWindow" } as const);
+
+                          if (reuseDispatch.tag === "parentOfActive") {
+                            return Fx.from({
+                              ok: () =>
+                                generateTokensForSession(ctx, config, {
+                                  userId,
+                                  sessionId,
+                                  issuedRefreshTokenId:
+                                    reuseDispatch.activeRefreshToken._id,
+                                  parentRefreshTokenId: refreshTokenId as any,
+                                }),
+                              err: () =>
+                                new RefreshFailure(
+                                  "Failed to generate tokens for parent reuse",
+                                ),
+                            }).pipe(
+                              Fx.tap(() =>
+                                Fx.sync(() =>
+                                  logWithLevel(
+                                    "DEBUG",
+                                    `Token ${maybeRedact(validationResult.refreshTokenDoc._id)} is parent of active refresh token ${maybeRedact(reuseDispatch.activeRefreshToken._id)}, so returning that token`,
+                                  ),
+                                ),
+                              ),
+                            );
+                          }
+
+                          if (reuseDispatch.tag === "withinReuseWindow") {
+                            return Fx.from({
+                              ok: async () => {
+                                const result = await generateTokensForSession(
+                                  ctx,
+                                  config,
+                                  {
+                                    userId,
+                                    sessionId,
+                                    issuedRefreshTokenId: null,
+                                    parentRefreshTokenId: refreshTokenId as any,
+                                  },
+                                );
+                                const { refreshTokenId: newRefreshTokenId } =
+                                  await Fx.run(
+                                    parseRefreshToken(result.refreshToken),
+                                  );
+                                logWithLevel(
+                                  "DEBUG",
+                                  `Exchanged ${maybeRedact(validationResult.refreshTokenDoc._id)} (reuse) for new refresh token ${maybeRedact(newRefreshTokenId)}`,
+                                );
+                                return result;
+                              },
+                              err: () =>
+                                new RefreshFailure(
+                                  "Failed to generate tokens for reuse window",
+                                ),
+                            });
+                          }
+
+                          logWithLevel(
+                            "ERROR",
+                            "Refresh token used outside of reuse window",
+                          );
+                          logWithLevel(
+                            "DEBUG",
+                            `Token ${maybeRedact(validationResult.refreshTokenDoc._id)} being used outside of reuse window, so invalidating all refresh tokens in subtree`,
+                          );
+                          return Fx.from({
+                            ok: async () => {
+                              const tokensToInvalidate =
+                                await invalidateRefreshTokensInSubtree(
+                                  ctx,
+                                  validationResult.refreshTokenDoc,
+                                  config,
+                                );
+                              logWithLevel(
+                                "DEBUG",
+                                `Invalidated ${tokensToInvalidate.length} refresh tokens in subtree: ${tokensToInvalidate
+                                  .map((token) => maybeRedact(token._id))
+                                  .join(", ")}`,
+                              );
+                              return null;
+                            },
+                            err: () =>
+                              new RefreshFailure(
+                                "Failed to invalidate refresh tokens in subtree",
+                              ),
+                          });
+                        }),
+                      );
+                })(),
+          ),
+        ),
+      ),
+      Fx.fold({
+        ok: (result) => result,
+        err: (failure) => {
+          logWithLevel("DEBUG", failure.reason);
+          return null;
+        },
+      }),
+    ),
+  );
+}
+
+// ============================================================================
+// Invalid token path — cleanup session and refresh tokens
+// ============================================================================
+
+// ============================================================================
+// Valid token path — dispatch on first-use / parent / reuse-window / stale
+// ============================================================================
+
+// ============================================================================
+// Action-level caller (unchanged — just forwards to mutation)
+// ============================================================================
+
+export const callRefreshSession = async <DataModel extends GenericDataModel>(
+  ctx: GenericActionCtx<DataModel>,
+  args: Infer<typeof refreshSessionArgs>,
+): Promise<RefreshResult> => {
+  return ctx.runMutation(AUTH_STORE_REF, {
+    args: {
+      type: "refreshSession",
+      ...args,
+    },
+  });
+};

package/src/server/mutations/register.ts

@@ -0,0 +1,200 @@
+import { Fx } from "@robelest/fx";
+import type { GenericActionCtx, GenericDataModel } from "convex/server";
+import { Infer, v } from "convex/values";
+
+import { authDb } from "../db";
+import { AuthError } from "../authError";
+import * as Provider from "../crypto";
+import { getAuthSessionId } from "../sessions";
+import { Doc, MutationCtx } from "../types";
+import { ConvexCredentialsConfig } from "../types";
+import { upsertUserAndAccount } from "../users";
+import { LOG_LEVELS, logWithLevel, maybeRedact } from "../utils";
+import { AUTH_STORE_REF } from "./store/refs";
+
+export const createAccountFromCredentialsArgs = v.object({
+  provider: v.string(),
+  account: v.object({ id: v.string(), secret: v.optional(v.string()) }),
+  profile: v.any(),
+  shouldLinkViaEmail: v.optional(v.boolean()),
+  shouldLinkViaPhone: v.optional(v.boolean()),
+});
+
+type ReturnType = { account: Doc<"Account">; user: Doc<"User"> };
+
+export async function createAccountFromCredentialsImpl(
+  ctx: MutationCtx,
+  args: Infer<typeof createAccountFromCredentialsArgs>,
+  getProviderOrThrow: Provider.GetProviderOrThrowFunc,
+  config: Provider.Config,
+): Promise<ReturnType> {
+  logWithLevel(LOG_LEVELS.DEBUG, "createAccountFromCredentialsImpl args:", {
+    provider: args.provider,
+    account: {
+      id: args.account.id,
+      secret: maybeRedact(args.account.secret ?? ""),
+    },
+  });
+
+  const {
+    provider: providerId,
+    account,
+    profile,
+    shouldLinkViaEmail,
+    shouldLinkViaPhone,
+  } = args;
+  const db = authDb(ctx, config);
+  const provider = getProviderOrThrow(providerId) as ConvexCredentialsConfig;
+
+  return Fx.run(
+    Fx.from({
+      ok: () =>
+        db.accounts.get(
+          provider.id,
+          account.id,
+        ) as Promise<Doc<"Account"> | null>,
+      err: () => new AuthError("INTERNAL_ERROR", "Failed to look up account"),
+    }).pipe(
+      Fx.chain((existingAccount) => {
+        if (existingAccount !== null) {
+          const verifyExistingAccountFx =
+            account.secret !== undefined
+              ? Provider.verify(
+                  provider,
+                  account.secret,
+                  existingAccount.secret ?? "",
+                ).pipe(
+                  Fx.chain((valid) =>
+                    valid
+                      ? Fx.succeed(undefined)
+                      : Fx.fail(
+                          new AuthError(
+                            "ACCOUNT_ALREADY_EXISTS",
+                            `Account ${account.id} already exists`,
+                          ),
+                        ),
+                  ),
+                )
+              : Fx.succeed(undefined);
+
+          return verifyExistingAccountFx.pipe(
+            Fx.chain(() =>
+              Fx.from({
+                ok: () =>
+                  db.users.getById(
+                    existingAccount.userId,
+                  ) as Promise<Doc<"User"> | null>,
+                err: () =>
+                  new AuthError(
+                    "ACCOUNT_NOT_FOUND",
+                    `Linked user for account ${account.id} was not found.`,
+                  ),
+              }).pipe(
+                Fx.chain((doc) =>
+                  doc === null
+                    ? Fx.fail(
+                        new AuthError(
+                          "ACCOUNT_NOT_FOUND",
+                          `Linked user for account ${account.id} was not found.`,
+                        ),
+                      )
+                    : Fx.succeed(doc),
+                ),
+              ),
+            ),
+            Fx.map((user) => ({
+              account: existingAccount,
+              user,
+            })),
+          );
+        }
+
+        const secretFx: Fx<string | undefined, AuthError> =
+          account.secret !== undefined
+            ? Provider.hash(provider, account.secret)
+            : Fx.succeed<string | undefined>(undefined);
+
+        return secretFx.pipe(
+          Fx.chain((secret) =>
+            Fx.from({
+              ok: async () =>
+                upsertUserAndAccount(
+                  ctx,
+                  await getAuthSessionId(ctx),
+                  { providerAccountId: account.id, secret },
+                  {
+                    type: "credentials",
+                    provider,
+                    profile,
+                    shouldLinkViaEmail,
+                    shouldLinkViaPhone,
+                  },
+                  config,
+                ),
+              err: () => new AuthError("INTERNAL_ERROR"),
+            }),
+          ),
+          Fx.chain((result) => {
+            const { userId, accountId } = result as {
+              userId: string;
+              accountId: string;
+            };
+            return Fx.zip(
+              Fx.from({
+                ok: () =>
+                  db.accounts.getById(
+                    accountId,
+                  ) as Promise<Doc<"Account"> | null>,
+                err: () => new AuthError("INTERNAL_ERROR"),
+              }),
+              Fx.from({
+                ok: () =>
+                  db.users.getById(userId) as Promise<Doc<"User"> | null>,
+                err: () => new AuthError("INTERNAL_ERROR"),
+              }),
+            );
+          }),
+          Fx.chain((pair) => {
+            const [createdAccount, createdUser] = pair as [
+              Doc<"Account"> | null,
+              Doc<"User"> | null,
+            ];
+            return createdAccount === null
+              ? Fx.fail(
+                  new AuthError(
+                    "ACCOUNT_NOT_FOUND",
+                    `Created account was not found.`,
+                  ),
+                )
+              : createdUser === null
+                ? Fx.fail(
+                    new AuthError(
+                      "USER_UPDATE_FAILED",
+                      `Created user was not found.`,
+                    ),
+                  )
+                : Fx.succeed({
+                    account: createdAccount,
+                    user: createdUser,
+                  });
+          }),
+        );
+      }),
+      Fx.recover((e) => Fx.fatal((e as AuthError).toConvexError())),
+    ),
+  ) as Promise<ReturnType>;
+}
+
+export const callCreateAccountFromCredentials = async <
+  DataModel extends GenericDataModel,
+>(
+  ctx: GenericActionCtx<DataModel>,
+  args: Infer<typeof createAccountFromCredentialsArgs>,
+): Promise<ReturnType> => {
+  return ctx.runMutation(AUTH_STORE_REF, {
+    args: {
+      type: "createAccountFromCredentials",
+      ...args,
+    },
+  });
+};

package/src/server/mutations/retrieve.ts

@@ -0,0 +1,109 @@
+import { Fx } from "@robelest/fx";
+import type { GenericActionCtx, GenericDataModel } from "convex/server";
+import { Infer, v } from "convex/values";
+
+import { authDb } from "../db";
+import { AuthError } from "../authError";
+import * as Provider from "../crypto";
+import {
+  isSignInRateLimited,
+  recordFailedSignIn,
+  resetSignInRateLimit,
+} from "../limits";
+import { Doc, MutationCtx } from "../types";
+import { LOG_LEVELS, logWithLevel, maybeRedact } from "../utils";
+import { AUTH_STORE_REF } from "./store/refs";
+
+export const retrieveAccountWithCredentialsArgs = v.object({
+  provider: v.string(),
+  account: v.object({ id: v.string(), secret: v.optional(v.string()) }),
+});
+
+type ReturnType =
+  | "InvalidAccountId"
+  | "TooManyFailedAttempts"
+  | "InvalidSecret"
+  | { account: Doc<"Account">; user: Doc<"User"> };
+
+export function retrieveAccountWithCredentialsImpl(
+  ctx: MutationCtx,
+  args: Infer<typeof retrieveAccountWithCredentialsArgs>,
+  getProviderOrThrow: Provider.GetProviderOrThrowFunc,
+  config: Provider.Config,
+): Fx<ReturnType> {
+  const { provider: providerId, account } = args;
+  const db = authDb(ctx, config);
+
+  logWithLevel(LOG_LEVELS.DEBUG, "retrieveAccountWithCredentialsImpl args:", {
+    provider: providerId,
+    account: { id: account.id, secret: maybeRedact(account.secret ?? "") },
+  });
+
+  return Fx.from({
+    ok: async () => {
+      const existingAccount = (await db.accounts.get(
+        providerId,
+        account.id,
+      )) as Doc<"Account"> | null;
+      if (existingAccount === null) {
+        return "InvalidAccountId" as const;
+      }
+
+      if (account.secret !== undefined) {
+        const limited = await Fx.run(
+          isSignInRateLimited(ctx, existingAccount._id, config),
+        );
+        if (limited) {
+          return "TooManyFailedAttempts" as const;
+        }
+
+        const valid = await Fx.run(
+          Provider.verify(
+            getProviderOrThrow(providerId),
+            account.secret,
+            existingAccount.secret ?? "",
+          ),
+        );
+        if (!valid) {
+          await Fx.run(recordFailedSignIn(ctx, existingAccount._id, config));
+          return "InvalidSecret" as const;
+        }
+
+        await Fx.run(resetSignInRateLimit(ctx, existingAccount._id, config));
+      }
+
+      const user = (await db.users.getById(
+        existingAccount.userId,
+      )) as Doc<"User"> | null;
+      if (user === null) {
+        logWithLevel(
+          LOG_LEVELS.ERROR,
+          `Account ${existingAccount._id} is linked to missing user ${existingAccount.userId}`,
+        );
+        return "InvalidAccountId" as const;
+      }
+
+      return { account: existingAccount, user } as const;
+    },
+    err: () => new AuthError("INTERNAL_ERROR", "Failed to look up account"),
+  }).pipe(
+    Fx.fold({
+      ok: (v) => v as ReturnType,
+      err: () => "InvalidAccountId" as ReturnType,
+    }),
+  );
+}
+
+export const callRetrieveAccountWithCredentials = async <
+  DataModel extends GenericDataModel,
+>(
+  ctx: GenericActionCtx<DataModel>,
+  args: Infer<typeof retrieveAccountWithCredentialsArgs>,
+): Promise<ReturnType> => {
+  return ctx.runMutation(AUTH_STORE_REF, {
+    args: {
+      type: "retrieveAccountWithCredentials",
+      ...args,
+    },
+  });
+};

package/src/server/mutations/signature.ts

@@ -0,0 +1,50 @@
+import { Fx } from "@robelest/fx";
+import type { GenericActionCtx, GenericDataModel } from "convex/server";
+import { GenericId, Infer, v } from "convex/values";
+
+import { authDb } from "../db";
+import { AuthError } from "../authError";
+import * as Provider from "../crypto";
+import { MutationCtx } from "../types";
+import { AUTH_STORE_REF } from "./store/refs";
+
+export const verifierSignatureArgs = v.object({
+  verifier: v.string(),
+  signature: v.string(),
+});
+
+type ReturnType = void;
+
+export function verifierSignatureImpl(
+  ctx: MutationCtx,
+  args: Infer<typeof verifierSignatureArgs>,
+  config: Provider.Config,
+): Fx<ReturnType, AuthError> {
+  return Fx.gen(function* () {
+    const { verifier, signature } = args;
+    const db = authDb(ctx, config);
+    const verifierDoc = yield* Fx.from({
+      ok: () => db.verifiers.getById(verifier as GenericId<"AuthVerifier">),
+      err: () => new AuthError("INVALID_VERIFIER"),
+    }).pipe(
+      Fx.chain((doc) =>
+        doc === null
+          ? Fx.fail(new AuthError("INVALID_VERIFIER"))
+          : Fx.succeed(doc),
+      ),
+    );
+    yield* Fx.promise(() => db.verifiers.patch(verifierDoc._id, { signature }));
+  });
+}
+
+export const callVerifierSignature = async <DataModel extends GenericDataModel>(
+  ctx: GenericActionCtx<DataModel>,
+  args: Infer<typeof verifierSignatureArgs>,
+): Promise<void> => {
+  return ctx.runMutation(AUTH_STORE_REF, {
+    args: {
+      type: "verifierSignature",
+      ...args,
+    },
+  });
+};

package/src/server/{implementation/mutations → mutations}/signin.ts

@@ -1,12 +1,14 @@
+import type { GenericActionCtx, GenericDataModel } from "convex/server";
 import { GenericId, Infer, v } from "convex/values";
-import { ActionCtx, MutationCtx, SessionInfo } from "../types";
-import * as Provider from "../provider";
+
+import * as Provider from "../crypto";
 import {
   createNewAndDeleteExistingSession,
   maybeGenerateTokensForSession,
 } from "../sessions";
+import { MutationCtx, SessionInfo } from "../types";
 import { LOG_LEVELS, logWithLevel } from "../utils";
-import { AUTH_STORE_REF } from "./store";
+import { AUTH_STORE_REF } from "./store/refs";
 
 export const signInArgs = v.object({
   userId: v.string(),
@@ -23,9 +25,9 @@ export async function signInImpl(
 ): Promise<ReturnType> {
   logWithLevel(LOG_LEVELS.DEBUG, "signInImpl args:", args);
   const { userId, sessionId: existingSessionId, generateTokens } = args;
-  const typedUserId = userId as GenericId<"user">;
+  const typedUserId = userId as GenericId<"User">;
   const typedExistingSessionId = existingSessionId as
-    | GenericId<"session">
+    | GenericId<"Session">
     | undefined;
   const sessionId =
     typedExistingSessionId ??
@@ -39,8 +41,8 @@ export async function signInImpl(
   );
 }
 
-export const callSignIn = async (
-  ctx: ActionCtx,
+export const callSignIn = async <DataModel extends GenericDataModel>(
+  ctx: GenericActionCtx<DataModel>,
   args: Infer<typeof signInArgs>,
 ): Promise<ReturnType> => {
   return ctx.runMutation(AUTH_STORE_REF, {