@robelest/convex-auth 0.0.4-preview.2 → 0.0.4-preview.21

package/dist/server/implementation/device.js

@@ -1,135 +0,0 @@
-import { throwAuthError } from "../errors.js";
-import { requireEnv } from "../utils.js";
-import { generateRandomString, sha256 } from "./utils.js";
-import { callSignIn } from "./mutations/signin.js";
-import { mutateDeviceAuthorize, mutateDeviceDelete, mutateDeviceInsert, mutateDeviceUpdateLastPolled, queryDeviceByCodeHash, queryDeviceByUserCode } from "./types.js";
-
-//#region src/server/implementation/device.ts
-/** High-entropy device code alphabet (alphanumeric). */
-const DEVICE_CODE_ALPHABET = "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789";
-/** Device code length (40 chars ≈ 238 bits of entropy). */
-const DEVICE_CODE_LENGTH = 40;
-/**
-* Phase 1: Generate a device code + user code pair.
-*
-* Called by the input-constrained device. Returns the codes and
-* verification URIs so the device can display them to the user.
-*/
-async function handleCreate(ctx, provider) {
-	const deviceCode = generateRandomString(DEVICE_CODE_LENGTH, DEVICE_CODE_ALPHABET);
-	const deviceCodeHash = await sha256(deviceCode);
-	const rawUserCode = generateRandomString(provider.userCodeLength, provider.charset);
-	const mid = Math.floor(rawUserCode.length / 2);
-	const userCode = rawUserCode.slice(0, mid) + "-" + rawUserCode.slice(mid);
-	await mutateDeviceInsert(ctx, {
-		deviceCodeHash,
-		userCode,
-		expiresAt: Date.now() + provider.expiresIn * 1e3,
-		interval: provider.interval,
-		status: "pending"
-	});
-	const verificationUri = provider.verificationUri ?? `${process.env.SITE_URL ?? requireEnv("SITE_URL")}/device`;
-	return {
-		kind: "deviceCode",
-		deviceCode,
-		userCode,
-		verificationUri,
-		verificationUriComplete: `${verificationUri}?user_code=${encodeURIComponent(userCode)}`,
-		expiresIn: provider.expiresIn,
-		interval: provider.interval
-	};
-}
-/**
-* Phase 2: Device polls for authorization status.
-*
-* Returns tokens when authorized, or throws a structured error
-* for pending / slow_down / expired / denied states.
-*/
-async function handlePoll(ctx, _provider, params) {
-	const rawDeviceCode = params.deviceCode;
-	if (!rawDeviceCode) throwAuthError("DEVICE_MISSING_FLOW", "Missing `deviceCode` parameter for poll flow.");
-	const doc = await queryDeviceByCodeHash(ctx, await sha256(rawDeviceCode));
-	if (!doc) throwAuthError("DEVICE_CODE_EXPIRED");
-	if (Date.now() > doc.expiresAt) {
-		await mutateDeviceDelete(ctx, doc._id);
-		throwAuthError("DEVICE_CODE_EXPIRED");
-	}
-	if (doc.lastPolledAt !== void 0) {
-		if ((Date.now() - doc.lastPolledAt) / 1e3 < doc.interval) throwAuthError("DEVICE_SLOW_DOWN");
-	}
-	await mutateDeviceUpdateLastPolled(ctx, doc._id, Date.now());
-	switch (doc.status) {
-		case "pending":
-			throwAuthError("DEVICE_AUTHORIZATION_PENDING");
-			break;
-		case "denied":
-			await mutateDeviceDelete(ctx, doc._id);
-			throwAuthError("DEVICE_CODE_DENIED");
-			break;
-		case "authorized":
-			if (!doc.userId || !doc.sessionId) throwAuthError("INTERNAL_ERROR", "Authorized device code missing userId or sessionId.");
-			await mutateDeviceDelete(ctx, doc._id);
-			return {
-				kind: "signedIn",
-				signedIn: await callSignIn(ctx, {
-					userId: doc.userId,
-					sessionId: doc.sessionId,
-					generateTokens: true
-				})
-			};
-		default:
-			doc.status;
-			throwAuthError("INTERNAL_ERROR", `Unknown device status: ${doc.status}`);
-	}
-}
-/**
-* Phase 3: Authenticated user authorizes a device code.
-*
-* The user enters the user code on a verification page while signed in.
-* This links the device code to the user's identity so the device can
-* obtain tokens on the next poll.
-*/
-async function handleVerify(ctx, _provider, params) {
-	const userCode = params.userCode;
-	if (!userCode) throwAuthError("DEVICE_INVALID_USER_CODE", "Missing `userCode` parameter for verify flow.");
-	const identity = await ctx.auth.getUserIdentity();
-	if (identity === null) throwAuthError("NOT_SIGNED_IN", "You must be signed in to authorize a device.");
-	const [userId] = identity.subject.split("|");
-	const doc = await queryDeviceByUserCode(ctx, userCode);
-	if (!doc) throwAuthError("DEVICE_INVALID_USER_CODE");
-	if (Date.now() > doc.expiresAt) {
-		await mutateDeviceDelete(ctx, doc._id);
-		throwAuthError("DEVICE_CODE_EXPIRED");
-	}
-	if (doc.status !== "pending") throwAuthError("DEVICE_ALREADY_AUTHORIZED");
-	const signInResult = await callSignIn(ctx, {
-		userId,
-		generateTokens: false
-	});
-	await mutateDeviceAuthorize(ctx, doc._id, signInResult.userId, signInResult.sessionId);
-	return {
-		kind: "signedIn",
-		signedIn: null
-	};
-}
-/**
-* Main device authorization handler dispatched from signIn.ts.
-*
-* Routes to the appropriate phase based on `params.flow`:
-* - (no flow / default) → create device + user codes
-* - "poll" → check authorization status
-* - "verify" → user authorizes a device code
-*/
-async function handleDevice(ctx, provider, args) {
-	const flow = args.params?.flow;
-	if (!flow) return handleCreate(ctx, provider);
-	switch (flow) {
-		case "poll": return handlePoll(ctx, provider, args.params ?? {});
-		case "verify": return handleVerify(ctx, provider, args.params ?? {});
-		default: throwAuthError("DEVICE_UNKNOWN_FLOW", `Unknown device flow: ${flow}. Expected one of: poll, verify`);
-	}
-}
-
-//#endregion
-export { handleDevice };
-//# sourceMappingURL=device.js.map

package/dist/server/implementation/device.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"device.js","names":[],"sources":["../../../src/server/implementation/device.ts"],"sourcesContent":["/**\n * Server-side device authorization flow logic (RFC 8628).\n *\n * Handles the three phases of the device flow:\n * 1. (default) — Generate a device code + user code pair\n * 2. poll      — Device checks whether the user has authorized yet\n * 3. verify    — Authenticated user links a user code to their session\n *\n * Uses `@oslojs/crypto/random` for code generation and\n * `@oslojs/crypto/sha2` for hashing device codes before storage.\n */\n\nimport {\n  DeviceProviderConfig,\n  GenericActionCtxWithAuthConfig,\n} from \"../types\";\nimport {\n  AuthDataModel,\n  SessionInfo,\n  mutateDeviceInsert,\n  queryDeviceByCodeHash,\n  queryDeviceByUserCode,\n  mutateDeviceAuthorize,\n  mutateDeviceUpdateLastPolled,\n  mutateDeviceDelete,\n} from \"./types\";\nimport { callSignIn } from \"./mutations/index\";\nimport { generateRandomString, sha256 } from \"./utils\";\nimport { throwAuthError } from \"../errors\";\nimport { requireEnv } from \"../utils\";\n\ntype EnrichedActionCtx = GenericActionCtxWithAuthConfig<AuthDataModel>;\n\n// ============================================================================\n// Constants\n// ============================================================================\n\n/** High-entropy device code alphabet (alphanumeric). */\nconst DEVICE_CODE_ALPHABET =\n  \"ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789\";\n\n/** Device code length (40 chars ≈ 238 bits of entropy). */\nconst DEVICE_CODE_LENGTH = 40;\n\n// ============================================================================\n// Create flow (default — no flow param)\n// ============================================================================\n\n/**\n * Phase 1: Generate a device code + user code pair.\n *\n * Called by the input-constrained device. Returns the codes and\n * verification URIs so the device can display them to the user.\n */\nasync function handleCreate(\n  ctx: EnrichedActionCtx,\n  provider: DeviceProviderConfig,\n): Promise<{\n  kind: \"deviceCode\";\n  deviceCode: string;\n  userCode: string;\n  verificationUri: string;\n  verificationUriComplete: string;\n  expiresIn: number;\n  interval: number;\n}> {\n  // Generate the raw device code (high entropy, never stored raw)\n  const deviceCode = generateRandomString(\n    DEVICE_CODE_LENGTH,\n    DEVICE_CODE_ALPHABET,\n  );\n  const deviceCodeHash = await sha256(deviceCode);\n\n  // Generate the user code (short, no vowels per RFC 8628 §6.1)\n  const rawUserCode = generateRandomString(\n    provider.userCodeLength,\n    provider.charset,\n  );\n  // Format as XXXX-XXXX for display\n  const mid = Math.floor(rawUserCode.length / 2);\n  const userCode = rawUserCode.slice(0, mid) + \"-\" + rawUserCode.slice(mid);\n\n  const expiresAt = Date.now() + provider.expiresIn * 1000;\n\n  // Store in the component DB\n  await mutateDeviceInsert(ctx, {\n    deviceCodeHash,\n    userCode,\n    expiresAt,\n    interval: provider.interval,\n    status: \"pending\",\n  });\n\n  // Build verification URIs\n  // Prefer explicit config; fall back to SITE_URL (Convex HTTP actions URL).\n  const verificationUri =\n    provider.verificationUri ??\n    `${process.env.SITE_URL ?? requireEnv(\"SITE_URL\")}/device`;\n  // Use `user_code` param to avoid collision with OAuth `?code=` on SSR frameworks.\n  const verificationUriComplete = `${verificationUri}?user_code=${encodeURIComponent(userCode)}`;\n\n  return {\n    kind: \"deviceCode\",\n    deviceCode,\n    userCode,\n    verificationUri,\n    verificationUriComplete,\n    expiresIn: provider.expiresIn,\n    interval: provider.interval,\n  };\n}\n\n// ============================================================================\n// Poll flow\n// ============================================================================\n\n/**\n * Phase 2: Device polls for authorization status.\n *\n * Returns tokens when authorized, or throws a structured error\n * for pending / slow_down / expired / denied states.\n */\nasync function handlePoll(\n  ctx: EnrichedActionCtx,\n  _provider: DeviceProviderConfig,\n  params: Record<string, any>,\n): Promise<{ kind: \"signedIn\"; signedIn: SessionInfo | null }> {\n  const rawDeviceCode = params.deviceCode as string | undefined;\n  if (!rawDeviceCode) {\n    throwAuthError(\"DEVICE_MISSING_FLOW\", \"Missing `deviceCode` parameter for poll flow.\");\n  }\n\n  const deviceCodeHash = await sha256(rawDeviceCode);\n  const doc = await queryDeviceByCodeHash(ctx, deviceCodeHash);\n\n  // Unknown or already-consumed code\n  if (!doc) {\n    throwAuthError(\"DEVICE_CODE_EXPIRED\");\n  }\n\n  // Check expiry\n  if (Date.now() > doc.expiresAt) {\n    // Lazy cleanup\n    await mutateDeviceDelete(ctx, doc._id);\n    throwAuthError(\"DEVICE_CODE_EXPIRED\");\n  }\n\n  // Enforce polling interval (slow_down)\n  if (doc.lastPolledAt !== undefined) {\n    const elapsed = (Date.now() - doc.lastPolledAt) / 1000;\n    if (elapsed < doc.interval) {\n      throwAuthError(\"DEVICE_SLOW_DOWN\");\n    }\n  }\n\n  // Update last polled timestamp\n  await mutateDeviceUpdateLastPolled(ctx, doc._id, Date.now());\n\n  // Check status\n  switch (doc.status) {\n    case \"pending\":\n      throwAuthError(\"DEVICE_AUTHORIZATION_PENDING\");\n      break; // unreachable but satisfies control flow\n\n    case \"denied\":\n      await mutateDeviceDelete(ctx, doc._id);\n      throwAuthError(\"DEVICE_CODE_DENIED\");\n      break;\n\n    case \"authorized\": {\n      // Device is authorized — issue tokens for the linked user/session\n      if (!doc.userId || !doc.sessionId) {\n        throwAuthError(\"INTERNAL_ERROR\", \"Authorized device code missing userId or sessionId.\");\n      }\n\n      // Clean up the device code record\n      await mutateDeviceDelete(ctx, doc._id);\n\n      // Generate tokens for the authorized session\n      const signInResult = await callSignIn(ctx, {\n        userId: doc.userId,\n        sessionId: doc.sessionId,\n        generateTokens: true,\n      });\n\n      return { kind: \"signedIn\", signedIn: signInResult };\n    }\n\n    default: {\n      const _exhaustive: never = doc.status;\n      throwAuthError(\"INTERNAL_ERROR\", `Unknown device status: ${doc.status}`);\n    }\n  }\n}\n\n// ============================================================================\n// Verify flow\n// ============================================================================\n\n/**\n * Phase 3: Authenticated user authorizes a device code.\n *\n * The user enters the user code on a verification page while signed in.\n * This links the device code to the user's identity so the device can\n * obtain tokens on the next poll.\n */\nasync function handleVerify(\n  ctx: EnrichedActionCtx,\n  _provider: DeviceProviderConfig,\n  params: Record<string, any>,\n): Promise<{ kind: \"signedIn\"; signedIn: SessionInfo | null }> {\n  const userCode = params.userCode as string | undefined;\n  if (!userCode) {\n    throwAuthError(\"DEVICE_INVALID_USER_CODE\", \"Missing `userCode` parameter for verify flow.\");\n  }\n\n  // Require an authenticated user\n  const identity = await ctx.auth.getUserIdentity();\n  if (identity === null) {\n    throwAuthError(\"NOT_SIGNED_IN\", \"You must be signed in to authorize a device.\");\n  }\n  const [userId] = identity.subject.split(\"|\");\n\n  // Look up the pending device code by user code\n  const doc = await queryDeviceByUserCode(ctx, userCode);\n  if (!doc) {\n    throwAuthError(\"DEVICE_INVALID_USER_CODE\");\n  }\n\n  // Check expiry\n  if (Date.now() > doc.expiresAt) {\n    await mutateDeviceDelete(ctx, doc._id);\n    throwAuthError(\"DEVICE_CODE_EXPIRED\");\n  }\n\n  // Already authorized (shouldn't happen with the index filter, but be safe)\n  if (doc.status !== \"pending\") {\n    throwAuthError(\"DEVICE_ALREADY_AUTHORIZED\");\n  }\n\n  // Create a new session for the device\n  const signInResult = await callSignIn(ctx, {\n    userId: userId!,\n    generateTokens: false, // Device gets tokens via poll, not here\n  });\n\n  // Authorize the device code with the new session\n  await mutateDeviceAuthorize(\n    ctx,\n    doc._id,\n    signInResult.userId,\n    signInResult.sessionId,\n  );\n\n  // Return success (no tokens — the verification page doesn't need them)\n  return { kind: \"signedIn\", signedIn: null };\n}\n\n// ============================================================================\n// Main dispatch\n// ============================================================================\n\n/**\n * Main device authorization handler dispatched from signIn.ts.\n *\n * Routes to the appropriate phase based on `params.flow`:\n * - (no flow / default) → create device + user codes\n * - \"poll\" → check authorization status\n * - \"verify\" → user authorizes a device code\n */\nexport async function handleDevice(\n  ctx: EnrichedActionCtx,\n  provider: DeviceProviderConfig,\n  args: {\n    params?: Record<string, any>;\n  },\n): Promise<\n  | {\n      kind: \"deviceCode\";\n      deviceCode: string;\n      userCode: string;\n      verificationUri: string;\n      verificationUriComplete: string;\n      expiresIn: number;\n      interval: number;\n    }\n  | { kind: \"signedIn\"; signedIn: SessionInfo | null }\n> {\n  const flow = args.params?.flow;\n\n  // Default flow: create device + user codes\n  if (!flow) {\n    return handleCreate(ctx, provider);\n  }\n\n  switch (flow) {\n    case \"poll\":\n      return handlePoll(ctx, provider, args.params ?? {});\n    case \"verify\":\n      return handleVerify(ctx, provider, args.params ?? {});\n    default:\n      throwAuthError(\n        \"DEVICE_UNKNOWN_FLOW\",\n        `Unknown device flow: ${flow}. Expected one of: poll, verify`,\n      );\n  }\n}\n"],"mappings":";;;;;;;;AAsCA,MAAM,uBACJ;;AAGF,MAAM,qBAAqB;;;;;;;AAY3B,eAAe,aACb,KACA,UASC;CAED,MAAM,aAAa,qBACjB,oBACA,qBACD;CACD,MAAM,iBAAiB,MAAM,OAAO,WAAW;CAG/C,MAAM,cAAc,qBAClB,SAAS,gBACT,SAAS,QACV;CAED,MAAM,MAAM,KAAK,MAAM,YAAY,SAAS,EAAE;CAC9C,MAAM,WAAW,YAAY,MAAM,GAAG,IAAI,GAAG,MAAM,YAAY,MAAM,IAAI;AAKzE,OAAM,mBAAmB,KAAK;EAC5B;EACA;EACA,WANgB,KAAK,KAAK,GAAG,SAAS,YAAY;EAOlD,UAAU,SAAS;EACnB,QAAQ;EACT,CAAC;CAIF,MAAM,kBACJ,SAAS,mBACT,GAAG,QAAQ,IAAI,YAAY,WAAW,WAAW,CAAC;AAIpD,QAAO;EACL,MAAM;EACN;EACA;EACA;EACA,yBAP8B,GAAG,gBAAgB,aAAa,mBAAmB,SAAS;EAQ1F,WAAW,SAAS;EACpB,UAAU,SAAS;EACpB;;;;;;;;AAaH,eAAe,WACb,KACA,WACA,QAC6D;CAC7D,MAAM,gBAAgB,OAAO;AAC7B,KAAI,CAAC,cACH,gBAAe,uBAAuB,gDAAgD;CAIxF,MAAM,MAAM,MAAM,sBAAsB,KADjB,MAAM,OAAO,cAAc,CACU;AAG5D,KAAI,CAAC,IACH,gBAAe,sBAAsB;AAIvC,KAAI,KAAK,KAAK,GAAG,IAAI,WAAW;AAE9B,QAAM,mBAAmB,KAAK,IAAI,IAAI;AACtC,iBAAe,sBAAsB;;AAIvC,KAAI,IAAI,iBAAiB,QAEvB;OADiB,KAAK,KAAK,GAAG,IAAI,gBAAgB,MACpC,IAAI,SAChB,gBAAe,mBAAmB;;AAKtC,OAAM,6BAA6B,KAAK,IAAI,KAAK,KAAK,KAAK,CAAC;AAG5D,SAAQ,IAAI,QAAZ;EACE,KAAK;AACH,kBAAe,+BAA+B;AAC9C;EAEF,KAAK;AACH,SAAM,mBAAmB,KAAK,IAAI,IAAI;AACtC,kBAAe,qBAAqB;AACpC;EAEF,KAAK;AAEH,OAAI,CAAC,IAAI,UAAU,CAAC,IAAI,UACtB,gBAAe,kBAAkB,sDAAsD;AAIzF,SAAM,mBAAmB,KAAK,IAAI,IAAI;AAStC,UAAO;IAAE,MAAM;IAAY,UANN,MAAM,WAAW,KAAK;KACzC,QAAQ,IAAI;KACZ,WAAW,IAAI;KACf,gBAAgB;KACjB,CAAC;IAEiD;EAGrD;AAC6B,OAAI;AAC/B,kBAAe,kBAAkB,0BAA0B,IAAI,SAAS;;;;;;;;;;AAgB9E,eAAe,aACb,KACA,WACA,QAC6D;CAC7D,MAAM,WAAW,OAAO;AACxB,KAAI,CAAC,SACH,gBAAe,4BAA4B,gDAAgD;CAI7F,MAAM,WAAW,MAAM,IAAI,KAAK,iBAAiB;AACjD,KAAI,aAAa,KACf,gBAAe,iBAAiB,+CAA+C;CAEjF,MAAM,CAAC,UAAU,SAAS,QAAQ,MAAM,IAAI;CAG5C,MAAM,MAAM,MAAM,sBAAsB,KAAK,SAAS;AACtD,KAAI,CAAC,IACH,gBAAe,2BAA2B;AAI5C,KAAI,KAAK,KAAK,GAAG,IAAI,WAAW;AAC9B,QAAM,mBAAmB,KAAK,IAAI,IAAI;AACtC,iBAAe,sBAAsB;;AAIvC,KAAI,IAAI,WAAW,UACjB,gBAAe,4BAA4B;CAI7C,MAAM,eAAe,MAAM,WAAW,KAAK;EACjC;EACR,gBAAgB;EACjB,CAAC;AAGF,OAAM,sBACJ,KACA,IAAI,KACJ,aAAa,QACb,aAAa,UACd;AAGD,QAAO;EAAE,MAAM;EAAY,UAAU;EAAM;;;;;;;;;;AAe7C,eAAsB,aACpB,KACA,UACA,MAcA;CACA,MAAM,OAAO,KAAK,QAAQ;AAG1B,KAAI,CAAC,KACH,QAAO,aAAa,KAAK,SAAS;AAGpC,SAAQ,MAAR;EACE,KAAK,OACH,QAAO,WAAW,KAAK,UAAU,KAAK,UAAU,EAAE,CAAC;EACrD,KAAK,SACH,QAAO,aAAa,KAAK,UAAU,KAAK,UAAU,EAAE,CAAC;EACvD,QACE,gBACE,uBACA,wBAAwB,KAAK,iCAC9B"}