@robelest/convex-auth 0.0.4-preview.2 → 0.0.4-preview.21

package/src/server/{implementation/sessions.ts → sessions.ts}

@@ -1,29 +1,27 @@
+import { Auth } from "convex/server";
 import { GenericId } from "convex/values";
-import { ConvexAuthConfig } from "../types";
+
+import { authDb } from "./db";
+import { createRefreshToken } from "./refresh";
+import { generateToken } from "./tokens";
 import { Doc, MutationCtx, SessionInfo } from "./types";
-import { Auth } from "convex/server";
+import { ConvexAuthConfig } from "./types";
 import {
   LOG_LEVELS,
   TOKEN_SUB_CLAIM_DIVIDER,
+  REFRESH_TOKEN_DIVIDER,
   logWithLevel,
   maybeRedact,
-  stringToNumber,
 } from "./utils";
-import { generateToken } from "./tokens";
-import {
-  createRefreshToken,
-  formatRefreshToken,
-  deleteAllRefreshTokens,
-} from "./refresh";
-import { authDb } from "./db";
 
 const DEFAULT_SESSION_TOTAL_DURATION_MS = 1000 * 60 * 60 * 24 * 30; // 30 days
 
+/** @internal */
 export async function maybeGenerateTokensForSession(
   ctx: MutationCtx,
   config: ConvexAuthConfig,
-  userId: GenericId<"user">,
-  sessionId: GenericId<"session">,
+  userId: GenericId<"User">,
+  sessionId: GenericId<"Session">,
   generateTokens: boolean,
 ): Promise<SessionInfo> {
   return {
@@ -40,10 +38,11 @@ export async function maybeGenerateTokensForSession(
   };
 }
 
+/** @internal */
 export async function createNewAndDeleteExistingSession(
   ctx: MutationCtx,
   config: ConvexAuthConfig,
-  userId: GenericId<"user">,
+  userId: GenericId<"User">,
 ) {
   const db = authDb(ctx, config);
   const existingSessionId = await getAuthSessionId(ctx);
@@ -56,14 +55,15 @@ export async function createNewAndDeleteExistingSession(
   return await createSession(ctx, userId, config);
 }
 
+/** @internal */
 export async function generateTokensForSession(
   ctx: MutationCtx,
   config: ConvexAuthConfig,
   args: {
-    userId: GenericId<"user">;
-    sessionId: GenericId<"session">;
-    issuedRefreshTokenId: GenericId<"token"> | null;
-    parentRefreshTokenId: GenericId<"token"> | null;
+    userId: GenericId<"User">;
+    sessionId: GenericId<"Session">;
+    issuedRefreshTokenId: GenericId<"RefreshToken"> | null;
+    parentRefreshTokenId: GenericId<"RefreshToken"> | null;
   },
 ) {
   const ids = { userId: args.userId, sessionId: args.sessionId };
@@ -77,7 +77,7 @@ export async function generateTokensForSession(
     ));
   const result = {
     token: await generateToken(ids, config),
-    refreshToken: formatRefreshToken(refreshTokenId, args.sessionId),
+    refreshToken: `${refreshTokenId}${REFRESH_TOKEN_DIVIDER}${args.sessionId}`,
   };
   logWithLevel(
     LOG_LEVELS.DEBUG,
@@ -88,25 +88,32 @@ export async function generateTokensForSession(
 
 async function createSession(
   ctx: MutationCtx,
-  userId: GenericId<"user">,
+  userId: GenericId<"User">,
   config: ConvexAuthConfig,
 ) {
   const db = authDb(ctx, config);
   const expirationTime =
     Date.now() +
     (config.session?.totalDurationMs ??
-      stringToNumber(process.env.AUTH_SESSION_TOTAL_DURATION_MS) ??
+      (process.env.AUTH_SESSION_TOTAL_DURATION_MS !== undefined
+        ? Number(process.env.AUTH_SESSION_TOTAL_DURATION_MS)
+        : undefined) ??
       DEFAULT_SESSION_TOTAL_DURATION_MS);
-  return (await db.sessions.create(userId, expirationTime)) as GenericId<"session">;
+  return (await db.sessions.create(
+    userId,
+    expirationTime,
+  )) as GenericId<"Session">;
 }
 
+/** @internal */
 export async function deleteSession(
   ctx: MutationCtx,
-  session: Doc<"session">,
+  session: Doc<"Session">,
   config: ConvexAuthConfig,
 ) {
-  await authDb(ctx, config).sessions.delete(session._id);
-  await deleteAllRefreshTokens(ctx, session._id, config);
+  const db = authDb(ctx, config);
+  await db.sessions.delete(session._id);
+  await db.refreshTokens.deleteAll(session._id);
 }
 
 /**
@@ -114,11 +121,12 @@ export async function deleteSession(
  *
  * Internal helper used by auth runtime internals and `auth.session.current`.
  */
+/** @internal */
 export async function getAuthSessionId(ctx: { auth: Auth }) {
   const identity = await ctx.auth.getUserIdentity();
   if (identity === null) {
     return null;
   }
   const [, sessionId] = identity.subject.split(TOKEN_SUB_CLAIM_DIVIDER);
-  return sessionId as GenericId<"session">;
+  return sessionId as GenericId<"Session">;
 }

package/src/server/signin.ts

@@ -0,0 +1,438 @@
+import type { Fx as FxType } from "@robelest/fx";
+import { GenericId } from "convex/values";
+
+import { handleDevice } from "./device";
+import { Fx } from "@robelest/fx";
+
+import { AuthError } from "./authError";
+import {
+  callCreateVerificationCode,
+  callRefreshSession,
+  callSignIn,
+  callVerifier,
+  callVerifierSignature,
+  callVerifyCodeAndSignIn,
+} from "./mutations/index";
+import { handlePasskeyFx } from "./passkey";
+import { redirectAbsoluteUrl, setURLSearchParam } from "./redirects";
+import { handleTotp } from "./totp";
+import {
+  AuthProviderMaterializedConfig,
+  ConvexCredentialsConfig,
+  EmailConfig,
+  GenericActionCtxWithAuthConfig,
+  PhoneConfig,
+} from "./types";
+import {
+  AuthDataModel,
+  SessionInfo,
+  SessionInfoWithTokens,
+  Tokens,
+  queryTotpVerifiedByUserId,
+} from "./types";
+import type { OAuthMaterializedConfig } from "./types";
+import { generateRandomString } from "./utils";
+import { requireEnv } from "./utils";
+
+const DEFAULT_EMAIL_VERIFICATION_CODE_DURATION_S = 60 * 60 * 24; // 24 hours
+
+type EnrichedActionCtx = GenericActionCtxWithAuthConfig<AuthDataModel>;
+
+type SignInResult =
+  | { kind: "signedIn"; signedIn: SessionInfo | null }
+  | { kind: "refreshTokens"; signedIn: { tokens: Tokens } }
+  | { kind: "started"; started: true }
+  | { kind: "redirect"; redirect: string; verifier: string }
+  | { kind: "passkeyOptions"; options: Record<string, any>; verifier: string }
+  | { kind: "totpRequired"; verifier: string }
+  | {
+      kind: "totpSetup";
+      uri: string;
+      secret: string;
+      verifier: string;
+      totpId: string;
+    }
+  | {
+      kind: "deviceCode";
+      deviceCode: string;
+      userCode: string;
+      verificationUri: string;
+      verificationUriComplete: string;
+      expiresIn: number;
+      interval: number;
+    };
+
+/** @internal */
+export async function signInImpl(
+  ctx: EnrichedActionCtx,
+  provider: AuthProviderMaterializedConfig | null,
+  args: {
+    accountId?: GenericId<"Account">;
+    params?: Record<string, any>;
+    verifier?: string;
+    refreshToken?: string;
+    calledBy?: string;
+  },
+  options: {
+    generateTokens: boolean;
+    allowExtraProviders: boolean;
+  },
+): Promise<SignInResult> {
+  const fx = signInFx(ctx, provider, args, options);
+  return Fx.run(
+    fx.pipe(Fx.recover((e) => Fx.fatal((e as AuthError).toConvexError()))),
+  );
+}
+
+/**
+ * Core sign-in pipeline as an Fx generator.
+ *
+ * Handles: refresh tokens, verification codes, then dispatches by
+ * provider type using a dispatch map (no if-chain).
+ */
+function signInFx(
+  ctx: EnrichedActionCtx,
+  provider: AuthProviderMaterializedConfig | null,
+  args: {
+    accountId?: GenericId<"Account">;
+    params?: Record<string, any>;
+    verifier?: string;
+    refreshToken?: string;
+    calledBy?: string;
+  },
+  options: {
+    generateTokens: boolean;
+    allowExtraProviders: boolean;
+  },
+): FxType<SignInResult, AuthError> {
+  return Fx.gen(function* () {
+    // --- Refresh token (no provider) ---
+    if (provider === null && args.refreshToken) {
+      const tokens = yield* Fx.promise(() =>
+        callRefreshSession(ctx, { refreshToken: args.refreshToken! }),
+      );
+      if (tokens === null) {
+        return { kind: "signedIn" as const, signedIn: null };
+      }
+      return { kind: "refreshTokens" as const, signedIn: { tokens } };
+    }
+
+    // --- Verify code (no provider, code present) ---
+    if (provider === null && args.params?.code !== undefined) {
+      const result = yield* Fx.promise(() =>
+        callVerifyCodeAndSignIn(ctx, {
+          params: args.params,
+          verifier: args.verifier,
+          generateTokens: true,
+          allowExtraProviders: options.allowExtraProviders,
+        }),
+      );
+      return { kind: "signedIn" as const, signedIn: result };
+    }
+
+    // --- Provider is required past this point ---
+    const resolvedProvider = yield* provider != null
+      ? Fx.succeed(provider)
+      : Fx.fail(new AuthError("SIGN_IN_MISSING_PARAMS"));
+
+    // --- Dispatch by provider type ---
+    return yield* Fx.match(resolvedProvider).on("type", {
+      email: (p) => handleEmailAndPhoneProviderFx(ctx, p, args, options),
+      phone: (p) => handleEmailAndPhoneProviderFx(ctx, p, args, options),
+      credentials: (p) => handleCredentialsFx(ctx, p, args, options),
+      oauth: (p) => handleOAuthProviderFx(ctx, p, args, options),
+      passkey: (p) => handlePasskeyFx(ctx, p, args),
+      totp: (p) => handleTotp(ctx, p, args),
+      device: (p) => handleDevice(ctx, p, args),
+      sso: (_p) => handleSsoProviderFx(ctx, args),
+    });
+  });
+}
+
+// ============================================================================
+// Email / Phone
+// ============================================================================
+
+function handleEmailAndPhoneProviderFx(
+  ctx: EnrichedActionCtx,
+  provider: EmailConfig | PhoneConfig,
+  args: {
+    params?: Record<string, any>;
+    accountId?: GenericId<"Account">;
+  },
+  options: {
+    generateTokens: boolean;
+    allowExtraProviders: boolean;
+  },
+): FxType<
+  | { kind: "started"; started: true }
+  | { kind: "signedIn"; signedIn: SessionInfoWithTokens },
+  AuthError
+> {
+  return Fx.gen(function* () {
+    // --- Code verification path ---
+    if (args.params?.code !== undefined) {
+      const result = yield* Fx.promise(() =>
+        callVerifyCodeAndSignIn(ctx, {
+          params: args.params,
+          provider: provider.id,
+          generateTokens: options.generateTokens,
+          allowExtraProviders: options.allowExtraProviders,
+        }),
+      );
+      const verified = yield* result != null
+        ? Fx.succeed(result)
+        : Fx.fail(new AuthError("INVALID_VERIFICATION_CODE"));
+      return {
+        kind: "signedIn" as const,
+        signedIn: verified as SessionInfoWithTokens,
+      };
+    }
+
+    // --- Send verification code path ---
+    const alphabet =
+      "0123456789ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz";
+    const code = provider.generateVerificationToken
+      ? yield* Fx.from({
+          ok: async () => provider.generateVerificationToken!(),
+          err: () =>
+            new AuthError(
+              "INTERNAL_ERROR",
+              "Failed to generate verification token",
+            ),
+        })
+      : generateRandomString(32, alphabet);
+    const expirationTime =
+      Date.now() +
+      (provider.maxAge ?? DEFAULT_EMAIL_VERIFICATION_CODE_DURATION_S) * 1000;
+
+    const identifier = yield* Fx.promise(() =>
+      callCreateVerificationCode(ctx, {
+        provider: provider.id,
+        accountId: args.accountId,
+        email: args.params?.email,
+        phone: args.params?.phone,
+        code,
+        expirationTime,
+        allowExtraProviders: options.allowExtraProviders,
+      }),
+    );
+    const destination = yield* Fx.promise(() =>
+      redirectAbsoluteUrl(
+        ctx.auth.config,
+        (args.params ?? {}) as { redirectTo: unknown },
+      ),
+    );
+    const verificationArgs = {
+      identifier,
+      url: setURLSearchParam(destination, "code", code),
+      token: code,
+      expires: new Date(expirationTime),
+    };
+    yield* Fx.match(provider).on("type", {
+      email: (p) =>
+        Fx.from({
+          ok: async () =>
+            p.sendVerificationRequest(
+              {
+                ...verificationArgs,
+                provider: p,
+                request: new Request("http://localhost"),
+              },
+              ctx,
+            ),
+          err: () =>
+            new AuthError("INTERNAL_ERROR", "Failed to send email code"),
+        }),
+      phone: (p) =>
+        Fx.from({
+          ok: async () =>
+            p.sendVerificationRequest(
+              { ...verificationArgs, provider: p },
+              ctx,
+            ),
+          err: () =>
+            new AuthError("INTERNAL_ERROR", "Failed to send phone code"),
+        }),
+    });
+    return { kind: "started" as const, started: true as const };
+  });
+}
+
+// ============================================================================
+// Credentials
+// ============================================================================
+
+function handleCredentialsFx(
+  ctx: EnrichedActionCtx,
+  provider: ConvexCredentialsConfig,
+  args: {
+    params?: Record<string, any>;
+  },
+  options: {
+    generateTokens: boolean;
+  },
+): FxType<
+  | { kind: "signedIn"; signedIn: SessionInfo | null }
+  | { kind: "totpRequired"; verifier: string },
+  AuthError
+> {
+  return Fx.gen(function* () {
+    const result = yield* Fx.promise(() =>
+      provider.authorize(args.params ?? {}, ctx),
+    );
+    if (result === null) {
+      return { kind: "signedIn" as const, signedIn: null };
+    }
+
+    // Check if user has TOTP 2FA enrolled before issuing tokens
+    const hasTotpEnrolled = yield* Fx.promise(async () => {
+      const totpDoc = await queryTotpVerifiedByUserId(ctx, result.userId);
+      return totpDoc !== null;
+    });
+    if (hasTotpEnrolled) {
+      // Create session but withhold tokens — TOTP verification needed
+      yield* Fx.promise(() =>
+        callSignIn(ctx, {
+          userId: result.userId,
+          sessionId: result.sessionId,
+          generateTokens: false,
+        }),
+      );
+      // Store userId in verifier so the TOTP verify flow can complete sign-in
+      const verifier = yield* Fx.promise(() => callVerifier(ctx));
+      yield* Fx.promise(() =>
+        callVerifierSignature(ctx, {
+          verifier,
+          signature: JSON.stringify({ userId: result.userId }),
+        }),
+      );
+      return { kind: "totpRequired" as const, verifier };
+    }
+
+    const idsAndTokens = yield* Fx.promise(() =>
+      callSignIn(ctx, {
+        userId: result.userId,
+        sessionId: result.sessionId,
+        generateTokens: options.generateTokens,
+      }),
+    );
+    return { kind: "signedIn" as const, signedIn: idsAndTokens };
+  });
+}
+
+// ============================================================================
+// OAuth
+// ============================================================================
+
+function handleOAuthProviderFx(
+  ctx: EnrichedActionCtx,
+  provider: OAuthMaterializedConfig,
+  args: {
+    params?: Record<string, any>;
+    verifier?: string;
+  },
+  options: {
+    allowExtraProviders: boolean;
+  },
+): FxType<
+  | { kind: "signedIn"; signedIn: SessionInfoWithTokens | null }
+  | { kind: "redirect"; redirect: string; verifier: string },
+  AuthError
+> {
+  return Fx.gen(function* () {
+    // --- Code verification path ---
+    if (args.params?.code !== undefined) {
+      const result = yield* Fx.promise(() =>
+        callVerifyCodeAndSignIn(ctx, {
+          params: args.params,
+          verifier: args.verifier,
+          generateTokens: true,
+          allowExtraProviders: options.allowExtraProviders,
+        }),
+      );
+      return {
+        kind: "signedIn" as const,
+        signedIn: result as SessionInfoWithTokens | null,
+      };
+    }
+
+    // --- Build redirect URL ---
+    const redirect = new URL(
+      (process.env.CUSTOM_AUTH_SITE_URL ?? requireEnv("CONVEX_SITE_URL")) +
+        `/api/auth/signin/${provider.id}`,
+    );
+    const verifier = yield* Fx.promise(() => callVerifier(ctx));
+    redirect.searchParams.set("code", verifier);
+
+    if (args.params?.redirectTo !== undefined) {
+      yield* Fx.guard(
+        typeof args.params.redirectTo !== "string",
+        Fx.fail(
+          new AuthError(
+            "INVALID_REDIRECT",
+            `Expected \`redirectTo\` to be a string, got ${args.params.redirectTo}`,
+          ),
+        ),
+      );
+      redirect.searchParams.set("redirectTo", args.params.redirectTo);
+    }
+
+    return {
+      kind: "redirect" as const,
+      redirect: redirect.toString(),
+      verifier,
+    };
+  });
+}
+
+// ============================================================================
+// SSO (Enterprise OIDC / SAML)
+// ============================================================================
+
+function handleSsoProviderFx(
+  ctx: EnrichedActionCtx,
+  args: {
+    params?: Record<string, any>;
+  },
+): FxType<{ kind: "redirect"; redirect: string; verifier: string }, AuthError> {
+  return Fx.gen(function* () {
+    const enterpriseId = args.params?.enterpriseId;
+    if (!enterpriseId || typeof enterpriseId !== "string") {
+      return yield* Fx.fail(
+        new AuthError(
+          "SIGN_IN_MISSING_PARAMS",
+          "enterpriseId is required for SSO sign-in.",
+        ),
+      );
+    }
+
+    const protocol: "oidc" | "saml" = args.params?.protocol ?? "oidc";
+    if (protocol !== "oidc" && protocol !== "saml") {
+      return yield* Fx.fail(
+        new AuthError(
+          "SIGN_IN_MISSING_PARAMS",
+          `Invalid SSO protocol: ${protocol as string}. Expected "oidc" or "saml".`,
+        ),
+      );
+    }
+
+    const verifier = yield* Fx.promise(() => callVerifier(ctx));
+    const siteUrl =
+      process.env.CUSTOM_AUTH_SITE_URL ?? requireEnv("CONVEX_SITE_URL");
+    const redirect = new URL(
+      `${siteUrl}/api/auth/sso/${enterpriseId}/${protocol}/signin`,
+    );
+    redirect.searchParams.set("code", verifier);
+
+    if (typeof args.params?.redirectTo === "string") {
+      redirect.searchParams.set("redirectTo", args.params.redirectTo);
+    }
+
+    return {
+      kind: "redirect" as const,
+      redirect: redirect.toString(),
+      verifier,
+    };
+  });
+}