@robelest/convex-auth 0.0.4-preview.2 → 0.0.4-preview.21

package/dist/component/public/factors/devices.d.ts

@@ -0,0 +1,157 @@
+declare namespace devices_d_exports {
+  export { deviceAuthorize, deviceDelete, deviceGetByCodeHash, deviceGetByUserCode, deviceInsert, deviceUpdateLastPolled };
+}
+/**
+ * Insert a new device authorization record into the `DeviceCode` table.
+ *
+ * Creates a pending device authorization entry as part of the OAuth 2.0
+ * Device Authorization Grant (RFC 8628). The record tracks the hashed device
+ * code, the human-readable user code, expiry, and polling interval.
+ *
+ * @param deviceCodeHash - SHA-256 hash of the device code issued to the client.
+ *   Only the hash is stored; the raw code is never persisted.
+ * @param userCode - Short, human-readable code displayed to the end-user
+ *   so they can authorize the device on a separate screen.
+ * @param expiresAt - Unix timestamp (in milliseconds) after which the device
+ *   authorization request is no longer valid.
+ * @param interval - Minimum polling interval in seconds that the device client
+ *   must wait between token requests.
+ * @param status - Initial status of the device authorization (e.g. `"pending"`).
+ * @returns The `_id` of the newly created `DeviceCode` document.
+ *
+ * @example
+ * ```ts
+ * const deviceCodeId = await ctx.runMutation(
+ *   components.auth.factors.devices.deviceInsert,
+ *   {
+ *     deviceCodeHash: "a1b2c3d4e5f6...",
+ *     userCode: "ABCD-1234",
+ *     expiresAt: Date.now() + 10 * 60 * 1000,
+ *     interval: 5,
+ *     status: "pending",
+ *   },
+ * );
+ * ```
+ */
+declare const deviceInsert: any;
+/**
+ * Look up a device authorization record by its hashed device code.
+ *
+ * Queries the `DeviceCode` table using the `device_code_hash` index.
+ * This is the primary lookup used by the token endpoint when a device
+ * client polls for authorization status.
+ *
+ * @param deviceCodeHash - SHA-256 hash of the device code to look up.
+ * @returns The matching `DeviceCode` document, or `null` if no record
+ *   exists for the given hash.
+ *
+ * @example
+ * ```ts
+ * const deviceCode = await ctx.runQuery(
+ *   components.auth.factors.devices.deviceGetByCodeHash,
+ *   { deviceCodeHash: "a1b2c3d4e5f6..." },
+ * );
+ * if (deviceCode && deviceCode.status === "authorized") {
+ *   // Exchange for tokens
+ * }
+ * ```
+ */
+declare const deviceGetByCodeHash: any;
+/**
+ * Look up a pending device authorization by its user-facing code.
+ *
+ * Queries the `DeviceCode` table using the `user_code_status` compound index,
+ * filtering to only `"pending"` records. This is called when an authenticated
+ * user enters the code shown on the device to approve the authorization.
+ *
+ * @param userCode - The short, human-readable code the user typed in
+ *   (e.g. `"ABCD-1234"`).
+ * @returns The matching pending `DeviceCode` document, or `null` if no
+ *   pending authorization exists for the given user code.
+ *
+ * @example
+ * ```ts
+ * const pending = await ctx.runQuery(
+ *   components.auth.factors.devices.deviceGetByUserCode,
+ *   { userCode: "ABCD-1234" },
+ * );
+ * if (pending === null) {
+ *   throw new Error("Invalid or expired user code");
+ * }
+ * ```
+ */
+declare const deviceGetByUserCode: any;
+/**
+ * Authorize a device code by linking it to a user and session.
+ *
+ * Transitions the device authorization status from `"pending"` to
+ * `"authorized"` and associates it with the approving user and their
+ * active session. After this mutation, the next poll from the device
+ * client will succeed and tokens can be issued.
+ *
+ * @param deviceId - The `_id` of the `DeviceCode` document to authorize.
+ * @param userId - The `_id` of the `User` who approved the device request.
+ * @param sessionId - The `_id` of the `Session` associated with the
+ *   approving user's current login.
+ * @returns `null` on success.
+ *
+ * @example
+ * ```ts
+ * await ctx.runMutation(
+ *   components.auth.factors.devices.deviceAuthorize,
+ *   {
+ *     deviceId: pending._id,
+ *     userId: currentUser._id,
+ *     sessionId: currentSession._id,
+ *   },
+ * );
+ * ```
+ */
+declare const deviceAuthorize: any;
+/**
+ * Update the last-polled timestamp on a device authorization record.
+ *
+ * Called each time the device client polls the token endpoint. The
+ * timestamp is used to enforce the minimum polling interval and to
+ * detect slow-polling violations per RFC 8628.
+ *
+ * @param deviceId - The `_id` of the `DeviceCode` document to update.
+ * @param lastPolledAt - Unix timestamp (in milliseconds) of the most
+ *   recent poll request from the device client.
+ * @returns `null` on success.
+ *
+ * @example
+ * ```ts
+ * await ctx.runMutation(
+ *   components.auth.factors.devices.deviceUpdateLastPolled,
+ *   {
+ *     deviceId: deviceCode._id,
+ *     lastPolledAt: Date.now(),
+ *   },
+ * );
+ * ```
+ */
+declare const deviceUpdateLastPolled: any;
+/**
+ * Delete a device authorization record from the `DeviceCode` table.
+ *
+ * Permanently removes the device code entry. This should be called after
+ * the device authorization has been successfully exchanged for tokens, or
+ * when the authorization has expired and needs to be cleaned up.
+ *
+ * @param deviceId - The `_id` of the `DeviceCode` document to delete.
+ * @returns `null` on success.
+ *
+ * @example
+ * ```ts
+ * // Clean up after successful token exchange
+ * await ctx.runMutation(
+ *   components.auth.factors.devices.deviceDelete,
+ *   { deviceId: deviceCode._id },
+ * );
+ * ```
+ */
+declare const deviceDelete: any;
+//#endregion
+export { deviceAuthorize, deviceDelete, deviceGetByCodeHash, deviceGetByUserCode, deviceInsert, deviceUpdateLastPolled, devices_d_exports };
+//# sourceMappingURL=devices.d.ts.map

package/dist/component/public/factors/devices.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"devices.d.ts","names":[],"sources":["../../../../src/component/public/factors/devices.ts"],"mappings":";;;;;;;;;;;;;;AAoCA;;;;;AAoCA;;;;;AAoCA;;;;;AAuCA;;;;;AAwCA;cAvJa,YAAA;;;;AAmLb;;;;;;;;;;;;;;;;;;;cA/Ia,mBAAA;;;;;;;;;;;;;;;;;;;;;;;;cAoCA,mBAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;cAuCA,eAAA;;;;;;;;;;;;;;;;;;;;;;;;cAwCA,sBAAA;;;;;;;;;;;;;;;;;;;;cA4BA,YAAA"}

package/dist/component/public/factors/devices.js

@@ -0,0 +1,216 @@
+import { mutation, query } from "../../functions.js";
+import { vDeviceCodeDoc, vDeviceStatus } from "../../model.js";
+import { v } from "convex/values";
+
+//#region src/component/public/factors/devices.ts
+/**
+* Insert a new device authorization record into the `DeviceCode` table.
+*
+* Creates a pending device authorization entry as part of the OAuth 2.0
+* Device Authorization Grant (RFC 8628). The record tracks the hashed device
+* code, the human-readable user code, expiry, and polling interval.
+*
+* @param deviceCodeHash - SHA-256 hash of the device code issued to the client.
+*   Only the hash is stored; the raw code is never persisted.
+* @param userCode - Short, human-readable code displayed to the end-user
+*   so they can authorize the device on a separate screen.
+* @param expiresAt - Unix timestamp (in milliseconds) after which the device
+*   authorization request is no longer valid.
+* @param interval - Minimum polling interval in seconds that the device client
+*   must wait between token requests.
+* @param status - Initial status of the device authorization (e.g. `"pending"`).
+* @returns The `_id` of the newly created `DeviceCode` document.
+*
+* @example
+* ```ts
+* const deviceCodeId = await ctx.runMutation(
+*   components.auth.factors.devices.deviceInsert,
+*   {
+*     deviceCodeHash: "a1b2c3d4e5f6...",
+*     userCode: "ABCD-1234",
+*     expiresAt: Date.now() + 10 * 60 * 1000,
+*     interval: 5,
+*     status: "pending",
+*   },
+* );
+* ```
+*/
+const deviceInsert = mutation({
+	args: {
+		deviceCodeHash: v.string(),
+		userCode: v.string(),
+		expiresAt: v.number(),
+		interval: v.number(),
+		status: vDeviceStatus
+	},
+	returns: v.id("DeviceCode"),
+	handler: async (ctx, args) => {
+		return await ctx.db.insert("DeviceCode", args);
+	}
+});
+/**
+* Look up a device authorization record by its hashed device code.
+*
+* Queries the `DeviceCode` table using the `device_code_hash` index.
+* This is the primary lookup used by the token endpoint when a device
+* client polls for authorization status.
+*
+* @param deviceCodeHash - SHA-256 hash of the device code to look up.
+* @returns The matching `DeviceCode` document, or `null` if no record
+*   exists for the given hash.
+*
+* @example
+* ```ts
+* const deviceCode = await ctx.runQuery(
+*   components.auth.factors.devices.deviceGetByCodeHash,
+*   { deviceCodeHash: "a1b2c3d4e5f6..." },
+* );
+* if (deviceCode && deviceCode.status === "authorized") {
+*   // Exchange for tokens
+* }
+* ```
+*/
+const deviceGetByCodeHash = query({
+	args: { deviceCodeHash: v.string() },
+	returns: v.union(vDeviceCodeDoc, v.null()),
+	handler: async (ctx, { deviceCodeHash }) => {
+		return await ctx.db.query("DeviceCode").withIndex("device_code_hash", (q) => q.eq("deviceCodeHash", deviceCodeHash)).first();
+	}
+});
+/**
+* Look up a pending device authorization by its user-facing code.
+*
+* Queries the `DeviceCode` table using the `user_code_status` compound index,
+* filtering to only `"pending"` records. This is called when an authenticated
+* user enters the code shown on the device to approve the authorization.
+*
+* @param userCode - The short, human-readable code the user typed in
+*   (e.g. `"ABCD-1234"`).
+* @returns The matching pending `DeviceCode` document, or `null` if no
+*   pending authorization exists for the given user code.
+*
+* @example
+* ```ts
+* const pending = await ctx.runQuery(
+*   components.auth.factors.devices.deviceGetByUserCode,
+*   { userCode: "ABCD-1234" },
+* );
+* if (pending === null) {
+*   throw new Error("Invalid or expired user code");
+* }
+* ```
+*/
+const deviceGetByUserCode = query({
+	args: { userCode: v.string() },
+	returns: v.union(vDeviceCodeDoc, v.null()),
+	handler: async (ctx, { userCode }) => {
+		return await ctx.db.query("DeviceCode").withIndex("user_code_status", (q) => q.eq("userCode", userCode).eq("status", "pending")).first();
+	}
+});
+/**
+* Authorize a device code by linking it to a user and session.
+*
+* Transitions the device authorization status from `"pending"` to
+* `"authorized"` and associates it with the approving user and their
+* active session. After this mutation, the next poll from the device
+* client will succeed and tokens can be issued.
+*
+* @param deviceId - The `_id` of the `DeviceCode` document to authorize.
+* @param userId - The `_id` of the `User` who approved the device request.
+* @param sessionId - The `_id` of the `Session` associated with the
+*   approving user's current login.
+* @returns `null` on success.
+*
+* @example
+* ```ts
+* await ctx.runMutation(
+*   components.auth.factors.devices.deviceAuthorize,
+*   {
+*     deviceId: pending._id,
+*     userId: currentUser._id,
+*     sessionId: currentSession._id,
+*   },
+* );
+* ```
+*/
+const deviceAuthorize = mutation({
+	args: {
+		deviceId: v.id("DeviceCode"),
+		userId: v.id("User"),
+		sessionId: v.id("Session")
+	},
+	returns: v.null(),
+	handler: async (ctx, { deviceId, userId, sessionId }) => {
+		await ctx.db.patch("DeviceCode", deviceId, {
+			status: "authorized",
+			userId,
+			sessionId
+		});
+		return null;
+	}
+});
+/**
+* Update the last-polled timestamp on a device authorization record.
+*
+* Called each time the device client polls the token endpoint. The
+* timestamp is used to enforce the minimum polling interval and to
+* detect slow-polling violations per RFC 8628.
+*
+* @param deviceId - The `_id` of the `DeviceCode` document to update.
+* @param lastPolledAt - Unix timestamp (in milliseconds) of the most
+*   recent poll request from the device client.
+* @returns `null` on success.
+*
+* @example
+* ```ts
+* await ctx.runMutation(
+*   components.auth.factors.devices.deviceUpdateLastPolled,
+*   {
+*     deviceId: deviceCode._id,
+*     lastPolledAt: Date.now(),
+*   },
+* );
+* ```
+*/
+const deviceUpdateLastPolled = mutation({
+	args: {
+		deviceId: v.id("DeviceCode"),
+		lastPolledAt: v.number()
+	},
+	returns: v.null(),
+	handler: async (ctx, { deviceId, lastPolledAt }) => {
+		await ctx.db.patch("DeviceCode", deviceId, { lastPolledAt });
+		return null;
+	}
+});
+/**
+* Delete a device authorization record from the `DeviceCode` table.
+*
+* Permanently removes the device code entry. This should be called after
+* the device authorization has been successfully exchanged for tokens, or
+* when the authorization has expired and needs to be cleaned up.
+*
+* @param deviceId - The `_id` of the `DeviceCode` document to delete.
+* @returns `null` on success.
+*
+* @example
+* ```ts
+* // Clean up after successful token exchange
+* await ctx.runMutation(
+*   components.auth.factors.devices.deviceDelete,
+*   { deviceId: deviceCode._id },
+* );
+* ```
+*/
+const deviceDelete = mutation({
+	args: { deviceId: v.id("DeviceCode") },
+	returns: v.null(),
+	handler: async (ctx, { deviceId }) => {
+		await ctx.db.delete("DeviceCode", deviceId);
+		return null;
+	}
+});
+
+//#endregion
+export { deviceAuthorize, deviceDelete, deviceGetByCodeHash, deviceGetByUserCode, deviceInsert, deviceUpdateLastPolled };
+//# sourceMappingURL=devices.js.map

package/dist/component/public/factors/devices.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"devices.js","names":[],"sources":["../../../../src/component/public/factors/devices.ts"],"sourcesContent":["import { v } from \"convex/values\";\nimport { mutation, query } from \"../../functions\";\nimport { vDeviceCodeDoc, vDeviceStatus } from \"../../model\";\n\n/**\n * Insert a new device authorization record into the `DeviceCode` table.\n *\n * Creates a pending device authorization entry as part of the OAuth 2.0\n * Device Authorization Grant (RFC 8628). The record tracks the hashed device\n * code, the human-readable user code, expiry, and polling interval.\n *\n * @param deviceCodeHash - SHA-256 hash of the device code issued to the client.\n *   Only the hash is stored; the raw code is never persisted.\n * @param userCode - Short, human-readable code displayed to the end-user\n *   so they can authorize the device on a separate screen.\n * @param expiresAt - Unix timestamp (in milliseconds) after which the device\n *   authorization request is no longer valid.\n * @param interval - Minimum polling interval in seconds that the device client\n *   must wait between token requests.\n * @param status - Initial status of the device authorization (e.g. `\"pending\"`).\n * @returns The `_id` of the newly created `DeviceCode` document.\n *\n * @example\n * ```ts\n * const deviceCodeId = await ctx.runMutation(\n *   components.auth.factors.devices.deviceInsert,\n *   {\n *     deviceCodeHash: \"a1b2c3d4e5f6...\",\n *     userCode: \"ABCD-1234\",\n *     expiresAt: Date.now() + 10 * 60 * 1000,\n *     interval: 5,\n *     status: \"pending\",\n *   },\n * );\n * ```\n */\nexport const deviceInsert = mutation({\n  args: {\n    deviceCodeHash: v.string(),\n    userCode: v.string(),\n    expiresAt: v.number(),\n    interval: v.number(),\n    status: vDeviceStatus,\n  },\n  returns: v.id(\"DeviceCode\"),\n  handler: async (ctx, args) => {\n    return await ctx.db.insert(\"DeviceCode\", args);\n  },\n});\n\n/**\n * Look up a device authorization record by its hashed device code.\n *\n * Queries the `DeviceCode` table using the `device_code_hash` index.\n * This is the primary lookup used by the token endpoint when a device\n * client polls for authorization status.\n *\n * @param deviceCodeHash - SHA-256 hash of the device code to look up.\n * @returns The matching `DeviceCode` document, or `null` if no record\n *   exists for the given hash.\n *\n * @example\n * ```ts\n * const deviceCode = await ctx.runQuery(\n *   components.auth.factors.devices.deviceGetByCodeHash,\n *   { deviceCodeHash: \"a1b2c3d4e5f6...\" },\n * );\n * if (deviceCode && deviceCode.status === \"authorized\") {\n *   // Exchange for tokens\n * }\n * ```\n */\nexport const deviceGetByCodeHash = query({\n  args: { deviceCodeHash: v.string() },\n  returns: v.union(vDeviceCodeDoc, v.null()),\n  handler: async (ctx, { deviceCodeHash }) => {\n    return await ctx.db\n      .query(\"DeviceCode\")\n      .withIndex(\"device_code_hash\", (q) =>\n        q.eq(\"deviceCodeHash\", deviceCodeHash),\n      )\n      .first();\n  },\n});\n\n/**\n * Look up a pending device authorization by its user-facing code.\n *\n * Queries the `DeviceCode` table using the `user_code_status` compound index,\n * filtering to only `\"pending\"` records. This is called when an authenticated\n * user enters the code shown on the device to approve the authorization.\n *\n * @param userCode - The short, human-readable code the user typed in\n *   (e.g. `\"ABCD-1234\"`).\n * @returns The matching pending `DeviceCode` document, or `null` if no\n *   pending authorization exists for the given user code.\n *\n * @example\n * ```ts\n * const pending = await ctx.runQuery(\n *   components.auth.factors.devices.deviceGetByUserCode,\n *   { userCode: \"ABCD-1234\" },\n * );\n * if (pending === null) {\n *   throw new Error(\"Invalid or expired user code\");\n * }\n * ```\n */\nexport const deviceGetByUserCode = query({\n  args: { userCode: v.string() },\n  returns: v.union(vDeviceCodeDoc, v.null()),\n  handler: async (ctx, { userCode }) => {\n    return await ctx.db\n      .query(\"DeviceCode\")\n      .withIndex(\"user_code_status\", (q) =>\n        q.eq(\"userCode\", userCode).eq(\"status\", \"pending\"),\n      )\n      .first();\n  },\n});\n\n/**\n * Authorize a device code by linking it to a user and session.\n *\n * Transitions the device authorization status from `\"pending\"` to\n * `\"authorized\"` and associates it with the approving user and their\n * active session. After this mutation, the next poll from the device\n * client will succeed and tokens can be issued.\n *\n * @param deviceId - The `_id` of the `DeviceCode` document to authorize.\n * @param userId - The `_id` of the `User` who approved the device request.\n * @param sessionId - The `_id` of the `Session` associated with the\n *   approving user's current login.\n * @returns `null` on success.\n *\n * @example\n * ```ts\n * await ctx.runMutation(\n *   components.auth.factors.devices.deviceAuthorize,\n *   {\n *     deviceId: pending._id,\n *     userId: currentUser._id,\n *     sessionId: currentSession._id,\n *   },\n * );\n * ```\n */\nexport const deviceAuthorize = mutation({\n  args: {\n    deviceId: v.id(\"DeviceCode\"),\n    userId: v.id(\"User\"),\n    sessionId: v.id(\"Session\"),\n  },\n  returns: v.null(),\n  handler: async (ctx, { deviceId, userId, sessionId }) => {\n    await ctx.db.patch(\"DeviceCode\", deviceId, {\n      status: \"authorized\",\n      userId,\n      sessionId,\n    });\n    return null;\n  },\n});\n\n/**\n * Update the last-polled timestamp on a device authorization record.\n *\n * Called each time the device client polls the token endpoint. The\n * timestamp is used to enforce the minimum polling interval and to\n * detect slow-polling violations per RFC 8628.\n *\n * @param deviceId - The `_id` of the `DeviceCode` document to update.\n * @param lastPolledAt - Unix timestamp (in milliseconds) of the most\n *   recent poll request from the device client.\n * @returns `null` on success.\n *\n * @example\n * ```ts\n * await ctx.runMutation(\n *   components.auth.factors.devices.deviceUpdateLastPolled,\n *   {\n *     deviceId: deviceCode._id,\n *     lastPolledAt: Date.now(),\n *   },\n * );\n * ```\n */\nexport const deviceUpdateLastPolled = mutation({\n  args: { deviceId: v.id(\"DeviceCode\"), lastPolledAt: v.number() },\n  returns: v.null(),\n  handler: async (ctx, { deviceId, lastPolledAt }) => {\n    await ctx.db.patch(\"DeviceCode\", deviceId, { lastPolledAt });\n    return null;\n  },\n});\n\n/**\n * Delete a device authorization record from the `DeviceCode` table.\n *\n * Permanently removes the device code entry. This should be called after\n * the device authorization has been successfully exchanged for tokens, or\n * when the authorization has expired and needs to be cleaned up.\n *\n * @param deviceId - The `_id` of the `DeviceCode` document to delete.\n * @returns `null` on success.\n *\n * @example\n * ```ts\n * // Clean up after successful token exchange\n * await ctx.runMutation(\n *   components.auth.factors.devices.deviceDelete,\n *   { deviceId: deviceCode._id },\n * );\n * ```\n */\nexport const deviceDelete = mutation({\n  args: { deviceId: v.id(\"DeviceCode\") },\n  returns: v.null(),\n  handler: async (ctx, { deviceId }) => {\n    await ctx.db.delete(\"DeviceCode\", deviceId);\n    return null;\n  },\n});\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAoCA,MAAa,eAAe,SAAS;CACnC,MAAM;EACJ,gBAAgB,EAAE,QAAQ;EAC1B,UAAU,EAAE,QAAQ;EACpB,WAAW,EAAE,QAAQ;EACrB,UAAU,EAAE,QAAQ;EACpB,QAAQ;EACT;CACD,SAAS,EAAE,GAAG,aAAa;CAC3B,SAAS,OAAO,KAAK,SAAS;AAC5B,SAAO,MAAM,IAAI,GAAG,OAAO,cAAc,KAAK;;CAEjD,CAAC;;;;;;;;;;;;;;;;;;;;;;;AAwBF,MAAa,sBAAsB,MAAM;CACvC,MAAM,EAAE,gBAAgB,EAAE,QAAQ,EAAE;CACpC,SAAS,EAAE,MAAM,gBAAgB,EAAE,MAAM,CAAC;CAC1C,SAAS,OAAO,KAAK,EAAE,qBAAqB;AAC1C,SAAO,MAAM,IAAI,GACd,MAAM,aAAa,CACnB,UAAU,qBAAqB,MAC9B,EAAE,GAAG,kBAAkB,eAAe,CACvC,CACA,OAAO;;CAEb,CAAC;;;;;;;;;;;;;;;;;;;;;;;;AAyBF,MAAa,sBAAsB,MAAM;CACvC,MAAM,EAAE,UAAU,EAAE,QAAQ,EAAE;CAC9B,SAAS,EAAE,MAAM,gBAAgB,EAAE,MAAM,CAAC;CAC1C,SAAS,OAAO,KAAK,EAAE,eAAe;AACpC,SAAO,MAAM,IAAI,GACd,MAAM,aAAa,CACnB,UAAU,qBAAqB,MAC9B,EAAE,GAAG,YAAY,SAAS,CAAC,GAAG,UAAU,UAAU,CACnD,CACA,OAAO;;CAEb,CAAC;;;;;;;;;;;;;;;;;;;;;;;;;;;AA4BF,MAAa,kBAAkB,SAAS;CACtC,MAAM;EACJ,UAAU,EAAE,GAAG,aAAa;EAC5B,QAAQ,EAAE,GAAG,OAAO;EACpB,WAAW,EAAE,GAAG,UAAU;EAC3B;CACD,SAAS,EAAE,MAAM;CACjB,SAAS,OAAO,KAAK,EAAE,UAAU,QAAQ,gBAAgB;AACvD,QAAM,IAAI,GAAG,MAAM,cAAc,UAAU;GACzC,QAAQ;GACR;GACA;GACD,CAAC;AACF,SAAO;;CAEV,CAAC;;;;;;;;;;;;;;;;;;;;;;;;AAyBF,MAAa,yBAAyB,SAAS;CAC7C,MAAM;EAAE,UAAU,EAAE,GAAG,aAAa;EAAE,cAAc,EAAE,QAAQ;EAAE;CAChE,SAAS,EAAE,MAAM;CACjB,SAAS,OAAO,KAAK,EAAE,UAAU,mBAAmB;AAClD,QAAM,IAAI,GAAG,MAAM,cAAc,UAAU,EAAE,cAAc,CAAC;AAC5D,SAAO;;CAEV,CAAC;;;;;;;;;;;;;;;;;;;;AAqBF,MAAa,eAAe,SAAS;CACnC,MAAM,EAAE,UAAU,EAAE,GAAG,aAAa,EAAE;CACtC,SAAS,EAAE,MAAM;CACjB,SAAS,OAAO,KAAK,EAAE,eAAe;AACpC,QAAM,IAAI,GAAG,OAAO,cAAc,SAAS;AAC3C,SAAO;;CAEV,CAAC"}

package/dist/component/public/factors/passkeys.d.ts

@@ -0,0 +1,175 @@
+declare namespace passkeys_d_exports {
+  export { passkeyDelete, passkeyGetByCredentialId, passkeyInsert, passkeyListByUserId, passkeyUpdateCounter, passkeyUpdateMeta };
+}
+/**
+ * Store a new WebAuthn passkey credential for a user.
+ *
+ * Persists the public key material and metadata returned by the browser's
+ * `navigator.credentials.create()` call after a successful registration
+ * ceremony. Each passkey is tied to a single user.
+ *
+ * @param userId - The `_id` of the `User` who owns this passkey.
+ * @param credentialId - Base64url-encoded credential identifier assigned
+ *   by the authenticator; used to look up the key during authentication.
+ * @param publicKey - Raw public key bytes (COSE format) for signature
+ *   verification.
+ * @param algorithm - COSE algorithm identifier (e.g. `-7` for ES256,
+ *   `-257` for RS256).
+ * @param counter - Signature counter reported by the authenticator at
+ *   registration time; used to detect cloned credentials.
+ * @param transports - Optional list of transport hints (e.g.
+ *   `["usb", "ble", "nfc", "internal"]`) to help the browser select
+ *   the correct authenticator.
+ * @param deviceType - Authenticator attachment type (e.g.
+ *   `"singleDevice"` or `"multiDevice"`).
+ * @param backedUp - Whether the credential is backed up (synced) by the
+ *   authenticator platform.
+ * @param name - Optional human-readable label for the passkey
+ *   (e.g. `"MacBook Pro Touch ID"`).
+ * @param createdAt - Unix timestamp (in milliseconds) when the passkey
+ *   was registered.
+ * @returns The `_id` of the newly created `Passkey` document.
+ *
+ * @example
+ * ```ts
+ * const passkeyId = await ctx.runMutation(
+ *   components.auth.factors.passkeys.passkeyInsert,
+ *   {
+ *     userId: user._id,
+ *     credentialId: "dGVzdC1jcmVkZW50aWFs",
+ *     publicKey: publicKeyBytes,
+ *     algorithm: -7,
+ *     counter: 0,
+ *     transports: ["internal"],
+ *     deviceType: "multiDevice",
+ *     backedUp: true,
+ *     name: "MacBook Pro Touch ID",
+ *     createdAt: Date.now(),
+ *   },
+ * );
+ * ```
+ */
+declare const passkeyInsert: any;
+/**
+ * Look up a passkey by its credential ID.
+ *
+ * Queries the `Passkey` table using the `credential_id` unique index.
+ * This is the primary lookup during a WebAuthn authentication ceremony:
+ * the authenticator provides a credential ID, and this function retrieves
+ * the corresponding public key and counter for signature verification.
+ *
+ * @param credentialId - Base64url-encoded credential identifier to search for.
+ * @returns The matching `Passkey` document, or `null` if no passkey exists
+ *   with the given credential ID.
+ *
+ * @example
+ * ```ts
+ * const passkey = await ctx.runQuery(
+ *   components.auth.factors.passkeys.passkeyGetByCredentialId,
+ *   { credentialId: "dGVzdC1jcmVkZW50aWFs" },
+ * );
+ * if (passkey === null) {
+ *   throw new Error("Unknown credential");
+ * }
+ * ```
+ */
+declare const passkeyGetByCredentialId: any;
+/**
+ * List all passkeys registered to a user.
+ *
+ * Retrieves every `Passkey` document associated with the given user via
+ * the `user_id` index. Useful for displaying a user's registered
+ * authenticators in a settings page, or for building the
+ * `allowCredentials` list during a WebAuthn authentication ceremony.
+ *
+ * @param userId - The `_id` of the `User` whose passkeys to retrieve.
+ * @returns An array of `Passkey` documents. Returns an empty array if the
+ *   user has no registered passkeys.
+ *
+ * @example
+ * ```ts
+ * const passkeys = await ctx.runQuery(
+ *   components.auth.factors.passkeys.passkeyListByUserId,
+ *   { userId: user._id },
+ * );
+ * // Display each passkey's name and creation date
+ * for (const pk of passkeys) {
+ *   console.log(pk.name, new Date(pk.createdAt));
+ * }
+ * ```
+ */
+declare const passkeyListByUserId: any;
+/**
+ * Update a passkey's signature counter and last-used timestamp after
+ * a successful authentication.
+ *
+ * After verifying a WebAuthn assertion, the relying party must persist
+ * the new counter value reported by the authenticator. A counter that
+ * does not increase may indicate a cloned credential.
+ *
+ * @param passkeyId - The `_id` of the `Passkey` document to update.
+ * @param counter - The new signature counter value returned by the
+ *   authenticator in the assertion response.
+ * @param lastUsedAt - Unix timestamp (in milliseconds) recording when
+ *   this passkey was most recently used to authenticate.
+ * @returns `null` on success.
+ *
+ * @example
+ * ```ts
+ * await ctx.runMutation(
+ *   components.auth.factors.passkeys.passkeyUpdateCounter,
+ *   {
+ *     passkeyId: passkey._id,
+ *     counter: assertionResponse.counter,
+ *     lastUsedAt: Date.now(),
+ *   },
+ * );
+ * ```
+ */
+declare const passkeyUpdateCounter: any;
+/**
+ * Update a passkey's metadata fields.
+ *
+ * Performs a partial patch on the `Passkey` document. Typically used to
+ * rename a passkey (e.g. from `"Security Key"` to `"YubiKey 5C"`), but
+ * can update any mutable fields via the `data` argument.
+ *
+ * @param passkeyId - The `_id` of the `Passkey` document to update.
+ * @param data - An object containing the fields to patch. Commonly
+ *   includes `{ name: "New Label" }`, but accepts any valid passkey fields.
+ * @returns `null` on success.
+ *
+ * @example
+ * ```ts
+ * await ctx.runMutation(
+ *   components.auth.factors.passkeys.passkeyUpdateMeta,
+ *   {
+ *     passkeyId: passkey._id,
+ *     data: { name: "YubiKey 5C NFC" },
+ *   },
+ * );
+ * ```
+ */
+declare const passkeyUpdateMeta: any;
+/**
+ * Delete a passkey credential from the `Passkey` table.
+ *
+ * Permanently removes the passkey record. After deletion the credential
+ * can no longer be used for authentication. Typically called from a
+ * user's security settings when they want to unregister an authenticator.
+ *
+ * @param passkeyId - The `_id` of the `Passkey` document to delete.
+ * @returns `null` on success.
+ *
+ * @example
+ * ```ts
+ * await ctx.runMutation(
+ *   components.auth.factors.passkeys.passkeyDelete,
+ *   { passkeyId: passkey._id },
+ * );
+ * ```
+ */
+declare const passkeyDelete: any;
+//#endregion
+export { passkeyDelete, passkeyGetByCredentialId, passkeyInsert, passkeyListByUserId, passkeyUpdateCounter, passkeyUpdateMeta, passkeys_d_exports };
+//# sourceMappingURL=passkeys.d.ts.map

package/dist/component/public/factors/passkeys.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"passkeys.d.ts","names":[],"sources":["../../../../src/component/public/factors/passkeys.ts"],"mappings":";;;;;;;;;;;;;;AAoDA;;;;;AA0CA;;;;;AAmCA;;;;;AAsCA;;;;;AAoCA;;;;;AA2BA;;;;;;;;;;;;cAlLa,aAAA;;;;;;;;;;;;;;;;;;;;;;;;cA0CA,wBAAA;;;;;;;;;;;;;;;;;;;;;;;;;cAmCA,mBAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;cAsCA,oBAAA;;;;;;;;;;;;;;;;;;;;;;;;cAoCA,iBAAA;;;;;;;;;;;;;;;;;;;cA2BA,aAAA"}