@robelest/convex-auth 0.0.4-preview.2 → 0.0.4-preview.21

package/src/server/implementation/mutations/account.ts

@@ -1,50 +0,0 @@
-import { Infer, v } from "convex/values";
-import { ActionCtx, MutationCtx } from "../types";
-import { GetProviderOrThrowFunc, hash } from "../provider";
-import { LOG_LEVELS, logWithLevel, maybeRedact } from "../utils";
-import * as Provider from "../provider";
-import { authDb } from "../db";
-import { AUTH_STORE_REF } from "./store";
-import { throwAuthError } from "../../errors";
-
-export const modifyAccountArgs = v.object({
-  provider: v.string(),
-  account: v.object({ id: v.string(), secret: v.string() }),
-});
-
-export async function modifyAccountImpl(
-  ctx: MutationCtx,
-  args: Infer<typeof modifyAccountArgs>,
-  getProviderOrThrow: GetProviderOrThrowFunc,
-  config: Provider.Config,
-): Promise<void> {
-  const { provider, account } = args;
-  const db = authDb(ctx, config);
-  logWithLevel(LOG_LEVELS.DEBUG, "retrieveAccountWithCredentialsImpl args:", {
-    provider: provider,
-    account: {
-      id: account.id,
-      secret: maybeRedact(account.secret ?? ""),
-    },
-  });
-  const existingAccount = await db.accounts.get(provider, account.id);
-  if (existingAccount === null) {
-    throwAuthError("ACCOUNT_NOT_FOUND", `Cannot modify account with ID ${account.id} because it does not exist`);
-  }
-  await db.accounts.patch(existingAccount._id, {
-    secret: await hash(getProviderOrThrow(provider), account.secret),
-  });
-  return;
-}
-
-export const callModifyAccount = async (
-  ctx: ActionCtx,
-  args: Infer<typeof modifyAccountArgs>,
-): Promise<void> => {
-  return ctx.runMutation(AUTH_STORE_REF, {
-    args: {
-      type: "modifyAccount",
-      ...args,
-    },
-  });
-};

package/src/server/implementation/mutations/index.ts

@@ -1,157 +0,0 @@
-import { Infer, v } from "convex/values";
-import { MutationCtx } from "../types";
-import { signInArgs, signInImpl } from "./signin";
-import { signOutImpl } from "./signout";
-import { refreshSessionArgs, refreshSessionImpl } from "./refresh";
-import {
-  verifyCodeAndSignInArgs,
-  verifyCodeAndSignInImpl,
-} from "./verify";
-import {
-  verifierSignatureArgs,
-  verifierSignatureImpl,
-} from "./signature";
-import { userOAuthArgs, userOAuthImpl } from "./oauth";
-import {
-  createVerificationCodeArgs,
-  createVerificationCodeImpl,
-} from "./code";
-import {
-  createAccountFromCredentialsArgs,
-  createAccountFromCredentialsImpl,
-} from "./register";
-import {
-  retrieveAccountWithCredentialsArgs,
-  retrieveAccountWithCredentialsImpl,
-} from "./retrieve";
-import { modifyAccountArgs, modifyAccountImpl } from "./account";
-import {
-  invalidateSessionsArgs,
-  invalidateSessionsImpl,
-} from "./invalidate";
-import * as Provider from "../provider";
-import { verifierImpl } from "./verifier";
-import { LOG_LEVELS, logWithLevel } from "../utils";
-export { callInvalidateSessions } from "./invalidate";
-export { callModifyAccount } from "./account";
-export { callRetreiveAccountWithCredentials } from "./retrieve";
-export { callCreateAccountFromCredentials } from "./register";
-export { callCreateVerificationCode } from "./code";
-export { callUserOAuth } from "./oauth";
-export { callVerifierSignature } from "./signature";
-export { callVerifyCodeAndSignIn } from "./verify";
-export { callVerifier } from "./verifier";
-export { callRefreshSession } from "./refresh";
-export { callSignOut } from "./signout";
-export { callSignIn } from "./signin";
-
-export const storeArgs = v.object({
-  args: v.union(
-    v.object({
-      type: v.literal("signIn"),
-      ...signInArgs.fields,
-    }),
-    v.object({
-      type: v.literal("signOut"),
-    }),
-    v.object({
-      type: v.literal("refreshSession"),
-      ...refreshSessionArgs.fields,
-    }),
-    v.object({
-      type: v.literal("verifyCodeAndSignIn"),
-      ...verifyCodeAndSignInArgs.fields,
-    }),
-    v.object({
-      type: v.literal("verifier"),
-    }),
-    v.object({
-      type: v.literal("verifierSignature"),
-      ...verifierSignatureArgs.fields,
-    }),
-    v.object({
-      type: v.literal("userOAuth"),
-      ...userOAuthArgs.fields,
-    }),
-    v.object({
-      type: v.literal("createVerificationCode"),
-      ...createVerificationCodeArgs.fields,
-    }),
-    v.object({
-      type: v.literal("createAccountFromCredentials"),
-      ...createAccountFromCredentialsArgs.fields,
-    }),
-    v.object({
-      type: v.literal("retrieveAccountWithCredentials"),
-      ...retrieveAccountWithCredentialsArgs.fields,
-    }),
-    v.object({
-      type: v.literal("modifyAccount"),
-      ...modifyAccountArgs.fields,
-    }),
-    v.object({
-      type: v.literal("invalidateSessions"),
-      ...invalidateSessionsArgs.fields,
-    }),
-  ),
-});
-
-export const storeImpl = async (
-  ctx: MutationCtx,
-  fnArgs: Infer<typeof storeArgs>,
-  getProviderOrThrow: Provider.GetProviderOrThrowFunc,
-  config: Provider.Config,
-) => {
-  const args = fnArgs.args;
-  logWithLevel(LOG_LEVELS.INFO, `\`auth:store\` type: ${args.type}`);
-  switch (args.type) {
-    case "signIn": {
-      return signInImpl(ctx, args, config);
-    }
-    case "signOut": {
-      return signOutImpl(ctx, config);
-    }
-    case "refreshSession": {
-      return refreshSessionImpl(ctx, args, getProviderOrThrow, config);
-    }
-    case "verifyCodeAndSignIn": {
-      return verifyCodeAndSignInImpl(ctx, args, getProviderOrThrow, config);
-    }
-    case "verifier": {
-      return verifierImpl(ctx, config);
-    }
-    case "verifierSignature": {
-      return verifierSignatureImpl(ctx, args, config);
-    }
-    case "userOAuth": {
-      return userOAuthImpl(ctx, args, getProviderOrThrow, config);
-    }
-    case "createVerificationCode": {
-      return createVerificationCodeImpl(ctx, args, getProviderOrThrow, config);
-    }
-    case "createAccountFromCredentials": {
-      return createAccountFromCredentialsImpl(
-        ctx,
-        args,
-        getProviderOrThrow,
-        config,
-      );
-    }
-    case "retrieveAccountWithCredentials": {
-      return retrieveAccountWithCredentialsImpl(
-        ctx,
-        args,
-        getProviderOrThrow,
-        config,
-      );
-    }
-    case "modifyAccount": {
-      return modifyAccountImpl(ctx, args, getProviderOrThrow, config);
-    }
-    case "invalidateSessions": {
-      return invalidateSessionsImpl(ctx, args, config);
-    }
-    default:
-      args satisfies never;
-  }
-};

package/src/server/implementation/mutations/invalidate.ts

@@ -1,42 +0,0 @@
-import { GenericId, Infer, v } from "convex/values";
-import { deleteSession } from "../sessions";
-import { ActionCtx, MutationCtx } from "../types";
-import { LOG_LEVELS, logWithLevel } from "../utils";
-import * as Provider from "../provider";
-import { authDb } from "../db";
-import { AUTH_STORE_REF } from "./store";
-
-export const invalidateSessionsArgs = v.object({
-  userId: v.string(),
-  except: v.optional(v.array(v.string())),
-});
-
-export const callInvalidateSessions = async (
-  ctx: ActionCtx,
-  args: Infer<typeof invalidateSessionsArgs>,
-): Promise<void> => {
-  return ctx.runMutation(AUTH_STORE_REF, {
-    args: {
-      type: "invalidateSessions",
-      ...args,
-    },
-  });
-};
-
-export const invalidateSessionsImpl = async (
-  ctx: MutationCtx,
-  args: Infer<typeof invalidateSessionsArgs>,
-  config: Provider.Config,
-): Promise<void> => {
-  logWithLevel(LOG_LEVELS.DEBUG, "invalidateSessionsImpl args:", args);
-  const { userId, except } = args;
-  const exceptSet = new Set(except ?? []);
-  const typedUserId = userId as GenericId<"user">;
-  const sessions = await authDb(ctx, config).sessions.listByUser(typedUserId);
-  for (const session of sessions) {
-    if (!exceptSet.has(session._id)) {
-      await deleteSession(ctx, session, config);
-    }
-  }
-  return;
-};

package/src/server/implementation/mutations/oauth.ts

@@ -1,73 +0,0 @@
-import { Infer, v } from "convex/values";
-import { ActionCtx, MutationCtx } from "../types";
-import * as Provider from "../provider";
-import type { AuthProviderMaterializedConfig } from "../../types";
-import { upsertUserAndAccount } from "../users";
-import { generateRandomString, logWithLevel, sha256 } from "../utils";
-import { authDb } from "../db";
-import { AUTH_STORE_REF } from "./store";
-import { throwAuthError } from "../../errors";
-
-const OAUTH_SIGN_IN_EXPIRATION_MS = 1000 * 60 * 2; // 2 minutes
-
-export const userOAuthArgs = v.object({
-  provider: v.string(),
-  providerAccountId: v.string(),
-  profile: v.any(),
-  signature: v.string(),
-});
-
-type ReturnType = string;
-
-export async function userOAuthImpl(
-  ctx: MutationCtx,
-  args: Infer<typeof userOAuthArgs>,
-  getProviderOrThrow: Provider.GetProviderOrThrowFunc,
-  config: Provider.Config,
-): Promise<ReturnType> {
-  logWithLevel("DEBUG", "userOAuthImpl args:", args);
-  const { profile, provider, providerAccountId, signature } = args;
-  const db = authDb(ctx, config);
-  const providerConfig = getProviderOrThrow(provider) as AuthProviderMaterializedConfig;
-  const existingAccount = await db.accounts.get(provider, providerAccountId);
-
-  const verifier = await db.verifiers.getBySignature(signature);
-  if (verifier === null) {
-    throwAuthError("OAUTH_INVALID_STATE");
-  }
-
-  const { accountId } = await upsertUserAndAccount(
-    ctx,
-    verifier.sessionId ?? null,
-    existingAccount !== null ? { existingAccount } : { providerAccountId },
-    { type: "oauth", provider: providerConfig, profile },
-    config,
-  );
-
-  const code = generateRandomString(8, "0123456789");
-  await db.verifiers.delete(verifier._id);
-  const existingVerificationCode = await db.verificationCodes.getByAccountId(accountId);
-  if (existingVerificationCode !== null) {
-    await db.verificationCodes.delete(existingVerificationCode._id);
-  }
-  await db.verificationCodes.create({
-      code: await sha256(code),
-      accountId,
-      provider,
-      expirationTime: Date.now() + OAUTH_SIGN_IN_EXPIRATION_MS,
-      verifier: verifier._id,
-    });
-  return code;
-}
-
-export const callUserOAuth = async (
-  ctx: ActionCtx,
-  args: Infer<typeof userOAuthArgs>,
-): Promise<ReturnType> => {
-  return ctx.runMutation(AUTH_STORE_REF, {
-    args: {
-      type: "userOAuth",
-      ...args,
-    },
-  });
-};

package/src/server/implementation/mutations/refresh.ts

@@ -1,175 +0,0 @@
-import { Infer, v } from "convex/values";
-import { ActionCtx, Doc, MutationCtx } from "../types";
-import * as Provider from "../provider";
-import { logWithLevel, maybeRedact } from "../utils";
-import {
-  deleteAllRefreshTokens,
-  invalidateRefreshTokensInSubtree,
-  loadActiveRefreshToken,
-  parseRefreshToken,
-  REFRESH_TOKEN_REUSE_WINDOW_MS,
-  refreshTokenIfValid,
-} from "../refresh";
-import { generateTokensForSession } from "../sessions";
-import { authDb } from "../db";
-import { AUTH_STORE_REF } from "./store";
-
-export const refreshSessionArgs = v.object({
-  refreshToken: v.string(),
-});
-
-type ReturnType = null | {
-  token: string;
-  refreshToken: string;
-};
-
-export async function refreshSessionImpl(
-  ctx: MutationCtx,
-  args: Infer<typeof refreshSessionArgs>,
-  getProviderOrThrow: Provider.GetProviderOrThrowFunc,
-  config: Provider.Config,
-): Promise<ReturnType> {
-  const db = authDb(ctx, config);
-  const { refreshToken } = args;
-  const { refreshTokenId, sessionId: tokenSessionId } =
-    parseRefreshToken(refreshToken);
-  logWithLevel(
-    "DEBUG",
-    `refreshSessionImpl args: Token ID: ${maybeRedact(refreshTokenId)} Session ID: ${maybeRedact(
-      tokenSessionId,
-    )}`,
-  );
-  const validationResult = await refreshTokenIfValid(
-    ctx,
-    refreshTokenId,
-    tokenSessionId,
-    config,
-  );
-
-  if (validationResult === null) {
-    // Replicating `deleteSession` but ensuring that we delete both the session
-    // and the refresh token, even if one of them is missing.
-    let session: Doc<"session"> | null = null;
-    try {
-      session = await db.sessions.getById(tokenSessionId);
-    } catch {
-      logWithLevel("DEBUG", "Skipping invalid session id during refresh cleanup");
-    }
-    if (session !== null) {
-      await db.sessions.delete(session._id);
-    }
-    try {
-      await deleteAllRefreshTokens(ctx, tokenSessionId, config);
-    } catch {
-      logWithLevel(
-        "DEBUG",
-        "Skipping invalid token session id during refresh token cleanup",
-      );
-    }
-    return null;
-  }
-  const { session } = validationResult;
-  const sessionId = session._id;
-  const userId = session.userId;
-
-  const tokenFirstUsed = validationResult.refreshTokenDoc.firstUsedTime;
-
-  // First use -- mark as used and generate new refresh token
-  if (tokenFirstUsed === undefined) {
-    await db.refreshTokens.patch(refreshTokenId, {
-      firstUsedTime: Date.now(),
-    });
-    const result = await generateTokensForSession(ctx, config, {
-      userId,
-      sessionId,
-      issuedRefreshTokenId: null,
-      parentRefreshTokenId: refreshTokenId,
-    });
-    const { refreshTokenId: newRefreshTokenId } = parseRefreshToken(
-      result.refreshToken,
-    );
-    logWithLevel(
-      "DEBUG",
-      `Exchanged ${maybeRedact(validationResult.refreshTokenDoc._id)} (first use) for new refresh token ${maybeRedact(newRefreshTokenId)}`,
-    );
-    return result;
-  }
-
-  // Token has been used before
-  // Check if parent of active refresh token
-  const activeRefreshToken = await loadActiveRefreshToken(
-    ctx,
-    tokenSessionId,
-    config,
-  );
-  logWithLevel(
-    "DEBUG",
-    `Active refresh token: ${maybeRedact(activeRefreshToken?._id ?? "(none)")}, parent ${maybeRedact(activeRefreshToken?.parentRefreshTokenId ?? "(none)")}`,
-  );
-  if (
-    activeRefreshToken !== null &&
-    activeRefreshToken.parentRefreshTokenId === refreshTokenId
-  ) {
-    logWithLevel(
-      "DEBUG",
-      `Token ${maybeRedact(validationResult.refreshTokenDoc._id)} is parent of active refresh token ${maybeRedact(activeRefreshToken._id)}, so returning that token`,
-    );
-
-    const result = await generateTokensForSession(ctx, config, {
-      userId,
-      sessionId,
-      issuedRefreshTokenId: activeRefreshToken._id,
-      parentRefreshTokenId: refreshTokenId,
-    });
-    return result;
-  }
-
-  // Check if within reuse window
-  if (tokenFirstUsed + REFRESH_TOKEN_REUSE_WINDOW_MS > Date.now()) {
-    const result = await generateTokensForSession(ctx, config, {
-      userId,
-      sessionId,
-      issuedRefreshTokenId: null,
-      parentRefreshTokenId: refreshTokenId,
-    });
-    const { refreshTokenId: newRefreshTokenId } = parseRefreshToken(
-      result.refreshToken,
-    );
-    logWithLevel(
-      "DEBUG",
-      `Exchanged ${maybeRedact(validationResult.refreshTokenDoc._id)} (reuse) for new refresh token ${maybeRedact(newRefreshTokenId)}`,
-    );
-    return result;
-  } else {
-    // Outside of reuse window -- invalidate all refresh tokens in subtree
-    logWithLevel("ERROR", "Refresh token used outside of reuse window");
-    logWithLevel(
-      "DEBUG",
-      `Token ${maybeRedact(validationResult.refreshTokenDoc._id)} being used outside of reuse window, so invalidating all refresh tokens in subtree`,
-    );
-    const tokensToInvalidate = await invalidateRefreshTokensInSubtree(
-      ctx,
-      validationResult.refreshTokenDoc,
-      config,
-    );
-    logWithLevel(
-      "DEBUG",
-      `Invalidated ${tokensToInvalidate.length} refresh tokens in subtree: ${tokensToInvalidate
-        .map((token) => maybeRedact(token._id))
-        .join(", ")}`,
-    );
-    return null;
-  }
-}
-
-export const callRefreshSession = async (
-  ctx: ActionCtx,
-  args: Infer<typeof refreshSessionArgs>,
-): Promise<ReturnType> => {
-  return ctx.runMutation(AUTH_STORE_REF, {
-    args: {
-      type: "refreshSession",
-      ...args,
-    },
-  });
-};

package/src/server/implementation/mutations/register.ts

@@ -1,100 +0,0 @@
-import { Infer, v } from "convex/values";
-import { ActionCtx, Doc, MutationCtx } from "../types";
-import * as Provider from "../provider";
-import { ConvexCredentialsConfig } from "../../types";
-import { upsertUserAndAccount } from "../users";
-import { getAuthSessionId } from "../sessions";
-import { LOG_LEVELS, logWithLevel, maybeRedact } from "../utils";
-import { authDb } from "../db";
-import { AUTH_STORE_REF } from "./store";
-import { throwAuthError } from "../../errors";
-
-export const createAccountFromCredentialsArgs = v.object({
-  provider: v.string(),
-  account: v.object({ id: v.string(), secret: v.optional(v.string()) }),
-  profile: v.any(),
-  shouldLinkViaEmail: v.optional(v.boolean()),
-  shouldLinkViaPhone: v.optional(v.boolean()),
-});
-
-type ReturnType = { account: Doc<"account">; user: Doc<"user"> };
-
-export async function createAccountFromCredentialsImpl(
-  ctx: MutationCtx,
-  args: Infer<typeof createAccountFromCredentialsArgs>,
-  getProviderOrThrow: Provider.GetProviderOrThrowFunc,
-  config: Provider.Config,
-): Promise<ReturnType> {
-  logWithLevel(LOG_LEVELS.DEBUG, "createAccountFromCredentialsImpl args:", {
-    provider: args.provider,
-    account: {
-      id: args.account.id,
-      secret: maybeRedact(args.account.secret ?? ""),
-    },
-  });
-  const {
-    provider: providerId,
-    account,
-    profile,
-    shouldLinkViaEmail,
-    shouldLinkViaPhone,
-  } = args;
-  const db = authDb(ctx, config);
-  const provider = getProviderOrThrow(providerId) as ConvexCredentialsConfig;
-  const existingAccount = (await db.accounts.get(
-    provider.id,
-    account.id,
-  )) as Doc<"account"> | null;
-  if (existingAccount !== null) {
-    if (
-      account.secret !== undefined &&
-      !(await Provider.verify(
-        provider,
-        account.secret,
-        existingAccount.secret ?? "",
-      ))
-    ) {
-      throwAuthError("ACCOUNT_ALREADY_EXISTS", `Account ${account.id} already exists`);
-    }
-    return {
-      account: existingAccount,
-      // TODO: Ian removed this,
-      user: (await db.users.getById(existingAccount.userId)) as unknown as Doc<"user">,
-    };
-  }
-
-  const secret =
-    account.secret !== undefined
-      ? await Provider.hash(provider, account.secret)
-      : undefined;
-  const { userId, accountId } = await upsertUserAndAccount(
-    ctx,
-    await getAuthSessionId(ctx),
-    { providerAccountId: account.id, secret },
-    {
-      type: "credentials",
-      provider,
-      profile,
-      shouldLinkViaEmail,
-      shouldLinkViaPhone,
-    },
-    config,
-  );
-
-  return {
-    account: (await db.accounts.getById(accountId)) as Doc<"account">,
-    user: (await db.users.getById(userId)) as unknown as Doc<"user">,
-  };
-}
-
-export const callCreateAccountFromCredentials = async (
-  ctx: ActionCtx,
-  args: Infer<typeof createAccountFromCredentialsArgs>,
-): Promise<ReturnType> => {
-  return ctx.runMutation(AUTH_STORE_REF, {
-    args: {
-      type: "createAccountFromCredentials",
-      ...args,
-    },
-  });
-};

package/src/server/implementation/mutations/retrieve.ts

@@ -1,79 +0,0 @@
-import { Infer, v } from "convex/values";
-import { ActionCtx, Doc, MutationCtx } from "../types";
-import {
-  isSignInRateLimited,
-  recordFailedSignIn,
-  resetSignInRateLimit,
-} from "../ratelimit";
-import * as Provider from "../provider";
-import { LOG_LEVELS, logWithLevel, maybeRedact } from "../utils";
-import { authDb } from "../db";
-import { AUTH_STORE_REF } from "./store";
-
-export const retrieveAccountWithCredentialsArgs = v.object({
-  provider: v.string(),
-  account: v.object({ id: v.string(), secret: v.optional(v.string()) }),
-});
-
-type ReturnType =
-  | "InvalidAccountId"
-  | "TooManyFailedAttempts"
-  | "InvalidSecret"
-  | { account: Doc<"account">; user: Doc<"user"> };
-
-export async function retrieveAccountWithCredentialsImpl(
-  ctx: MutationCtx,
-  args: Infer<typeof retrieveAccountWithCredentialsArgs>,
-  getProviderOrThrow: Provider.GetProviderOrThrowFunc,
-  config: Provider.Config,
-): Promise<ReturnType> {
-  const { provider: providerId, account } = args;
-  const db = authDb(ctx, config);
-  logWithLevel(LOG_LEVELS.DEBUG, "retrieveAccountWithCredentialsImpl args:", {
-    provider: providerId,
-    account: {
-      id: account.id,
-      secret: maybeRedact(account.secret ?? ""),
-    },
-  });
-  const existingAccount = (await db.accounts.get(
-    providerId,
-    account.id,
-  )) as Doc<"account"> | null;
-  if (existingAccount === null) {
-    return "InvalidAccountId";
-  }
-  if (account.secret !== undefined) {
-    if (await isSignInRateLimited(ctx, existingAccount._id, config)) {
-      return "TooManyFailedAttempts";
-    }
-    if (
-      !(await Provider.verify(
-        getProviderOrThrow(providerId),
-        account.secret,
-        existingAccount.secret ?? "",
-      ))
-    ) {
-      await recordFailedSignIn(ctx, existingAccount._id, config);
-      return "InvalidSecret";
-    }
-    await resetSignInRateLimit(ctx, existingAccount._id, config);
-  }
-  return {
-    account: existingAccount,
-    // TODO: Ian removed this
-    user: (await db.users.getById(existingAccount.userId)) as unknown as Doc<"user">,
-  };
-}
-
-export const callRetreiveAccountWithCredentials = async (
-  ctx: ActionCtx,
-  args: Infer<typeof retrieveAccountWithCredentialsArgs>,
-): Promise<ReturnType> => {
-  return ctx.runMutation(AUTH_STORE_REF, {
-    args: {
-      type: "retrieveAccountWithCredentials",
-      ...args,
-    },
-  });
-};