@robelest/convex-auth 0.0.4-preview.2 → 0.0.4-preview.21

package/src/server/mutations/signout.ts

@@ -0,0 +1,43 @@
+import { Fx } from "@robelest/fx";
+import type { GenericActionCtx, GenericDataModel } from "convex/server";
+import { GenericId } from "convex/values";
+
+import { authDb } from "../db";
+import * as Provider from "../crypto";
+import { deleteSession, getAuthSessionId } from "../sessions";
+import { MutationCtx } from "../types";
+import { AUTH_STORE_REF } from "./store/refs";
+
+type ReturnType = {
+  userId: GenericId<"User">;
+  sessionId: GenericId<"Session">;
+} | null;
+
+export function signOutImpl(
+  ctx: MutationCtx,
+  config: Provider.Config,
+): Fx<ReturnType, never> {
+  return Fx.gen(function* () {
+    const db = authDb(ctx, config);
+    const sessionId = yield* Fx.promise(() => getAuthSessionId(ctx));
+    if (sessionId === null) {
+      return null;
+    }
+    const session = yield* Fx.promise(() => db.sessions.getById(sessionId));
+    if (session === null) {
+      return null;
+    }
+    yield* Fx.promise(() => deleteSession(ctx, session, config));
+    return { userId: session.userId, sessionId: session._id };
+  });
+}
+
+export const callSignOut = async <DataModel extends GenericDataModel>(
+  ctx: GenericActionCtx<DataModel>,
+): Promise<void> => {
+  return ctx.runMutation(AUTH_STORE_REF, {
+    args: {
+      type: "signOut",
+    },
+  });
+};

package/src/server/mutations/store/refs.ts

@@ -0,0 +1,10 @@
+import { makeFunctionReference } from "convex/server";
+
+/**
+ * Internal function reference for the library's store dispatch mutation.
+ *
+ * The package cannot import the consumer app's generated `api` module,
+ * so it uses a canonical function reference name that matches the app-level
+ * `export const { store } = auth` surface.
+ */
+export const AUTH_STORE_REF = makeFunctionReference("auth:store") as any;

package/src/server/mutations/store.ts

@@ -0,0 +1,138 @@
+import { Fx } from "@robelest/fx";
+import { Infer, v } from "convex/values";
+
+import * as Provider from "../crypto";
+import { MutationCtx } from "../types";
+import { LOG_LEVELS, logWithLevel } from "../utils";
+import { modifyAccountArgs, modifyAccountImpl } from "./account";
+import { createVerificationCodeArgs, createVerificationCodeImpl } from "./code";
+import { invalidateSessionsArgs, invalidateSessionsImpl } from "./invalidate";
+import { userOAuthArgs, userOAuthImpl } from "./oauth";
+import { refreshSessionArgs, refreshSessionImpl } from "./refresh";
+import {
+  createAccountFromCredentialsArgs,
+  createAccountFromCredentialsImpl,
+} from "./register";
+import {
+  retrieveAccountWithCredentialsArgs,
+  retrieveAccountWithCredentialsImpl,
+} from "./retrieve";
+import { verifierSignatureArgs, verifierSignatureImpl } from "./signature";
+import { signInArgs, signInImpl } from "./signin";
+import { signOutImpl } from "./signout";
+import { verifierImpl } from "./verifier";
+import { verifyCodeAndSignInArgs, verifyCodeAndSignInImpl } from "./verify";
+
+export const storeArgs = v.object({
+  args: v.union(
+    v.object({
+      type: v.literal("signIn"),
+      ...signInArgs.fields,
+    }),
+    v.object({
+      type: v.literal("signOut"),
+    }),
+    v.object({
+      type: v.literal("refreshSession"),
+      ...refreshSessionArgs.fields,
+    }),
+    v.object({
+      type: v.literal("verifyCodeAndSignIn"),
+      ...verifyCodeAndSignInArgs.fields,
+    }),
+    v.object({
+      type: v.literal("verifier"),
+    }),
+    v.object({
+      type: v.literal("verifierSignature"),
+      ...verifierSignatureArgs.fields,
+    }),
+    v.object({
+      type: v.literal("userOAuth"),
+      ...userOAuthArgs.fields,
+    }),
+    v.object({
+      type: v.literal("createVerificationCode"),
+      ...createVerificationCodeArgs.fields,
+    }),
+    v.object({
+      type: v.literal("createAccountFromCredentials"),
+      ...createAccountFromCredentialsArgs.fields,
+    }),
+    v.object({
+      type: v.literal("retrieveAccountWithCredentials"),
+      ...retrieveAccountWithCredentialsArgs.fields,
+    }),
+    v.object({
+      type: v.literal("modifyAccount"),
+      ...modifyAccountArgs.fields,
+    }),
+    v.object({
+      type: v.literal("invalidateSessions"),
+      ...invalidateSessionsArgs.fields,
+    }),
+  ),
+});
+
+export const storeImpl = async (
+  ctx: MutationCtx,
+  fnArgs: Infer<typeof storeArgs>,
+  getProviderOrThrow: Provider.GetProviderOrThrowFunc,
+  config: Provider.Config,
+) => {
+  const args = fnArgs.args;
+  logWithLevel(LOG_LEVELS.INFO, `\`auth:store\` type: ${args.type}`);
+  return Fx.run(
+    Fx.match(args, args.type, {
+      signIn: (a) =>
+        Fx.from({
+          ok: () => signInImpl(ctx, a, config),
+          err: (e) => e as never,
+        }),
+      signOut: () => signOutImpl(ctx, config),
+      refreshSession: (a) =>
+        Fx.from({
+          ok: () => refreshSessionImpl(ctx, a, getProviderOrThrow, config),
+          err: (e) => e as never,
+        }),
+      verifyCodeAndSignIn: (a) =>
+        Fx.from({
+          ok: () => verifyCodeAndSignInImpl(ctx, a, getProviderOrThrow, config),
+          err: (e) => e as never,
+        }),
+      verifier: () => verifierImpl(ctx, config),
+      verifierSignature: (a) =>
+        verifierSignatureImpl(ctx, a, config).pipe(
+          Fx.recover((e) => Fx.fatal(e.toConvexError())),
+        ),
+      userOAuth: (a) =>
+        userOAuthImpl(ctx, a, getProviderOrThrow, config).pipe(
+          Fx.recover((e) => Fx.fatal(e.toConvexError())),
+        ),
+      createVerificationCode: (a) =>
+        Fx.from({
+          ok: () =>
+            createVerificationCodeImpl(ctx, a, getProviderOrThrow, config),
+          err: (e) => e as never,
+        }),
+      createAccountFromCredentials: (a) =>
+        Fx.from({
+          ok: () =>
+            createAccountFromCredentialsImpl(
+              ctx,
+              a,
+              getProviderOrThrow,
+              config,
+            ),
+          err: (e) => e as never,
+        }),
+      retrieveAccountWithCredentials: (a) =>
+        retrieveAccountWithCredentialsImpl(ctx, a, getProviderOrThrow, config),
+      modifyAccount: (a) =>
+        modifyAccountImpl(ctx, a, getProviderOrThrow, config).pipe(
+          Fx.recover((e) => Fx.fatal(e.toConvexError())),
+        ),
+      invalidateSessions: (a) => invalidateSessionsImpl(ctx, a, config),
+    }),
+  );
+};

package/src/server/mutations/verifier.ts

@@ -0,0 +1,34 @@
+import { Fx } from "@robelest/fx";
+import type { GenericActionCtx, GenericDataModel } from "convex/server";
+import { GenericId } from "convex/values";
+
+import { authDb } from "../db";
+import * as Provider from "../crypto";
+import { getAuthSessionId } from "../sessions";
+import { MutationCtx } from "../types";
+import { AUTH_STORE_REF } from "./store/refs";
+
+type ReturnType = GenericId<"AuthVerifier">;
+
+export function verifierImpl(
+  ctx: MutationCtx,
+  config: Provider.Config,
+): Fx<ReturnType, never> {
+  return Fx.gen(function* () {
+    return (yield* Fx.promise(async () =>
+      authDb(ctx, config).verifiers.create(
+        (await getAuthSessionId(ctx)) ?? undefined,
+      ),
+    )) as ReturnType;
+  });
+}
+
+export const callVerifier = async <DataModel extends GenericDataModel>(
+  ctx: GenericActionCtx<DataModel>,
+): Promise<ReturnType> => {
+  return ctx.runMutation(AUTH_STORE_REF, {
+    args: {
+      type: "verifier",
+    },
+  });
+};

package/src/server/mutations/verify.ts

@@ -0,0 +1,202 @@
+import { Fx } from "@robelest/fx";
+import type { GenericActionCtx, GenericDataModel } from "convex/server";
+import { Infer, v } from "convex/values";
+
+import { authDb } from "../db";
+import * as Provider from "../crypto";
+import {
+  isSignInRateLimited,
+  recordFailedSignIn,
+  resetSignInRateLimit,
+} from "../limits";
+import {
+  createNewAndDeleteExistingSession,
+  getAuthSessionId,
+  maybeGenerateTokensForSession,
+} from "../sessions";
+import {
+  createSyntheticOAuthMaterializedConfig,
+} from "../enterprise/oidc";
+import { isEnterpriseProviderId } from "../enterprise/shared";
+import { MutationCtx, SessionInfo } from "../types";
+import { upsertUserAndAccount } from "../users";
+import { LOG_LEVELS, logWithLevel, sha256 } from "../utils";
+import { requireEnv } from "../utils";
+import { AUTH_STORE_REF } from "./store/refs";
+
+export const verifyCodeAndSignInArgs = v.object({
+  params: v.any(),
+  provider: v.optional(v.string()),
+  verifier: v.optional(v.string()),
+  generateTokens: v.boolean(),
+  allowExtraProviders: v.boolean(),
+});
+
+type ReturnType = null | SessionInfo;
+
+// ============================================================================
+// Small validators for the verification pipeline
+// ============================================================================
+
+/** A soft verification failure — logged and collapsed to null at the boundary. */
+class VerifyFailure {
+  readonly _tag = "VerifyFailure" as const;
+  constructor(readonly reason: string) {}
+}
+
+// ============================================================================
+// Main exported function
+// ============================================================================
+
+export async function verifyCodeAndSignInImpl(
+  ctx: MutationCtx,
+  args: Infer<typeof verifyCodeAndSignInArgs>,
+  getProviderOrThrow: Provider.GetProviderOrThrowFunc,
+  config: Provider.Config,
+): Promise<ReturnType> {
+  logWithLevel(LOG_LEVELS.DEBUG, "verifyCodeAndSignInImpl args:", {
+    params: { email: args.params.email, phone: args.params.phone },
+    provider: args.provider,
+    verifier: args.verifier,
+    generateTokens: args.generateTokens,
+    allowExtraProviders: args.allowExtraProviders,
+  });
+
+  const { generateTokens, provider, allowExtraProviders } = args;
+  if (generateTokens) {
+    requireEnv("JWT_PRIVATE_KEY");
+    requireEnv("JWKS");
+    requireEnv("CONVEX_SITE_URL");
+  }
+  const identifier: string | undefined = args.params.email ?? args.params.phone;
+
+  try {
+    if (identifier !== undefined) {
+      const limited = await Fx.run(
+        isSignInRateLimited(ctx, identifier, config),
+      );
+      if (limited) {
+        throw new VerifyFailure(
+          "Too many failed attempts to verify code for this email",
+        );
+      }
+    }
+
+    const db = authDb(ctx, config);
+    const { params, verifier } = args;
+    const hash = await sha256(params.code);
+    const code = await db.verificationCodes.getByCode(hash);
+    if (code === null) {
+      throw new VerifyFailure("Invalid verification code");
+    }
+
+    await db.verificationCodes.delete(code._id);
+
+    if (code.verifier !== verifier) {
+      throw new VerifyFailure("Invalid verifier");
+    }
+    if (code.expirationTime < Date.now()) {
+      throw new VerifyFailure("Expired verification code");
+    }
+    if (provider !== undefined && code.provider !== provider) {
+      throw new VerifyFailure(
+        `Invalid provider "${provider}" for given \`code\``,
+      );
+    }
+
+    const account = await db.accounts.getById(code.accountId);
+    if (account === null) {
+      throw new VerifyFailure(
+        "Account associated with this email has been deleted",
+      );
+    }
+
+    const codeProvider = isEnterpriseProviderId(code.provider)
+      ? createSyntheticOAuthMaterializedConfig(code.provider)
+      : getProviderOrThrow(code.provider, allowExtraProviders);
+
+    if (
+      codeProvider !== null &&
+      (codeProvider.type === "email" || codeProvider.type === "phone") &&
+      codeProvider.authorize !== undefined
+    ) {
+      await codeProvider.authorize(args.params, account);
+    }
+
+    const methodProvider = isEnterpriseProviderId(account.provider)
+      ? createSyntheticOAuthMaterializedConfig(account.provider)
+      : getProviderOrThrow(account.provider);
+
+    const userId =
+      methodProvider.type === "oauth"
+        ? account.userId
+        : (
+            await upsertUserAndAccount(
+              ctx,
+              await getAuthSessionId(ctx),
+              { existingAccount: account },
+              {
+                type: "verification",
+                provider: methodProvider,
+                profile: {
+                  ...(code.emailVerified !== undefined
+                    ? { email: code.emailVerified, emailVerified: true }
+                    : {}),
+                  ...(code.phoneVerified !== undefined
+                    ? { phone: code.phoneVerified, phoneVerified: true }
+                    : {}),
+                },
+              },
+              config,
+            )
+          ).userId;
+
+    if (identifier !== undefined) {
+      await Fx.run(resetSignInRateLimit(ctx, identifier, config));
+    }
+
+    const sessionId = await createNewAndDeleteExistingSession(
+      ctx,
+      config,
+      userId,
+    );
+    return await maybeGenerateTokensForSession(
+      ctx,
+      config,
+      userId,
+      sessionId,
+      generateTokens,
+    );
+  } catch (error) {
+    if (error instanceof VerifyFailure) {
+      logWithLevel(LOG_LEVELS.ERROR, error.reason);
+      if (identifier !== undefined) {
+        await Fx.run(recordFailedSignIn(ctx, identifier, config));
+      }
+      return null;
+    }
+    logWithLevel(
+      LOG_LEVELS.ERROR,
+      `verifyCodeAndSignInImpl failed: ${String(error)}`,
+    );
+    return null;
+  }
+}
+
+// ============================================================================
+// Action-level caller (unchanged — just forwards to mutation)
+// ============================================================================
+
+export const callVerifyCodeAndSignIn = async <
+  DataModel extends GenericDataModel,
+>(
+  ctx: GenericActionCtx<DataModel>,
+  args: Infer<typeof verifyCodeAndSignInArgs>,
+): Promise<ReturnType> => {
+  return ctx.runMutation(AUTH_STORE_REF, {
+    args: {
+      type: "verifyCodeAndSignIn",
+      ...args,
+    },
+  });
+};