@robelest/convex-auth 0.0.4-preview.2 → 0.0.4-preview.21

package/src/server/implementation/ratelimit.ts

@@ -1,79 +0,0 @@
-import { ConvexAuthConfig } from "../types";
-import { Doc, MutationCtx } from "./types";
-import { authDb } from "./db";
-
-const DEFAULT_MAX_SIGN_IN_ATTEMPTS_PER_HOUR = 10;
-
-export async function isSignInRateLimited(
-  ctx: MutationCtx,
-  identifier: string,
-  config: ConvexAuthConfig,
-) {
-  const state = await getRateLimitState(ctx, identifier, config);
-  if (state === null) {
-    return false;
-  }
-  return state.attempsLeft < 1;
-}
-
-export async function recordFailedSignIn(
-  ctx: MutationCtx,
-  identifier: string,
-  config: ConvexAuthConfig,
-) {
-  const db = authDb(ctx, config);
-  const state = await getRateLimitState(ctx, identifier, config);
-  if (state !== null) {
-    await db.rateLimits.patch(state.limit._id, {
-      attemptsLeft: state.attempsLeft - 1,
-      lastAttemptTime: Date.now(),
-    });
-  } else {
-    const maxAttempsPerHour = configuredMaxAttempsPerHour(config);
-    await db.rateLimits.create({
-      identifier,
-      attemptsLeft: maxAttempsPerHour - 1,
-      lastAttemptTime: Date.now(),
-    });
-  }
-}
-
-export async function resetSignInRateLimit(
-  ctx: MutationCtx,
-  identifier: string,
-  config: ConvexAuthConfig,
-) {
-  const existingState = await getRateLimitState(ctx, identifier, config);
-  if (existingState !== null) {
-    await authDb(ctx, config).rateLimits.delete(existingState.limit._id);
-  }
-}
-
-async function getRateLimitState(
-  ctx: MutationCtx,
-  identifier: string,
-  config: ConvexAuthConfig,
-) {
-  const now = Date.now();
-  const maxAttempsPerHour = configuredMaxAttempsPerHour(config);
-  const limit = (await authDb(ctx, config).rateLimits.get(identifier)) as
-    | Doc<"limit">
-    | null;
-  if (limit === null) {
-    return null;
-  }
-  const elapsed = now - limit.lastAttemptTime;
-  const maxAttempsPerMs = maxAttempsPerHour / (60 * 60 * 1000);
-  const attempsLeft = Math.min(
-    maxAttempsPerHour,
-    limit.attemptsLeft + elapsed * maxAttempsPerMs,
-  );
-  return { limit, attempsLeft };
-}
-
-function configuredMaxAttempsPerHour(config: ConvexAuthConfig) {
-  return (
-    config.signIn?.maxFailedAttempsPerHour ??
-    DEFAULT_MAX_SIGN_IN_ATTEMPTS_PER_HOUR
-  );
-}

package/src/server/implementation/refresh.ts

@@ -1,172 +0,0 @@
-import { GenericId } from "convex/values";
-import { ConvexAuthConfig } from "../types";
-import { throwAuthError } from "../errors";
-import { Doc, MutationCtx } from "./types";
-import {
-  LOG_LEVELS,
-  REFRESH_TOKEN_DIVIDER,
-  logWithLevel,
-  maybeRedact,
-  stringToNumber,
-} from "./utils";
-import { authDb } from "./db";
-
-const DEFAULT_SESSION_INACTIVE_DURATION_MS = 1000 * 60 * 60 * 24 * 30; // 30 days
-export const REFRESH_TOKEN_REUSE_WINDOW_MS = 10 * 1000; // 10 seconds
-export async function createRefreshToken(
-  ctx: MutationCtx,
-  config: ConvexAuthConfig,
-  sessionId: GenericId<"session">,
-  parentRefreshTokenId: GenericId<"token"> | null,
-): Promise<GenericId<"token">> {
-  const db = authDb(ctx, config);
-  const expirationTime =
-    Date.now() +
-    (config.session?.inactiveDurationMs ??
-      stringToNumber(process.env.AUTH_SESSION_INACTIVE_DURATION_MS) ??
-      DEFAULT_SESSION_INACTIVE_DURATION_MS);
-  const newRefreshTokenId = (await db.refreshTokens.create({
-    sessionId,
-    expirationTime,
-    parentRefreshTokenId: parentRefreshTokenId ?? undefined,
-  })) as GenericId<"token">;
-  return newRefreshTokenId;
-}
-
-export const formatRefreshToken = (
-  refreshTokenId: GenericId<"token">,
-  sessionId: GenericId<"session">,
-) => {
-  return `${refreshTokenId}${REFRESH_TOKEN_DIVIDER}${sessionId}`;
-};
-
-export const parseRefreshToken = (
-  refreshToken: string,
-): {
-  refreshTokenId: GenericId<"token">;
-  sessionId: GenericId<"session">;
-} => {
-  const [refreshTokenId, sessionId] = refreshToken.split(REFRESH_TOKEN_DIVIDER);
-  if (!refreshTokenId || !sessionId) {
-    throwAuthError("INVALID_REFRESH_TOKEN", `Can't parse refresh token: ${maybeRedact(refreshToken)}`);
-  }
-  return {
-    refreshTokenId: refreshTokenId as GenericId<"token">,
-    sessionId: sessionId as GenericId<"session">,
-  };
-};
-
-/**
- * Mark all refresh tokens descending from the given refresh token as invalid immediately.
- * This is used when we detect an invalid use of a refresh token, and want to revoke
- * the entire tree.
- *
- * @param ctx
- * @param refreshToken
- */
-export async function invalidateRefreshTokensInSubtree(
-  ctx: MutationCtx,
-  refreshToken: Doc<"token">,
-  config: ConvexAuthConfig,
-) {
-  const db = authDb(ctx, config);
-  const tokensToInvalidate = [refreshToken];
-  let frontier: GenericId<"token">[] = [refreshToken._id];
-  while (frontier.length > 0) {
-    const nextFrontier: GenericId<"token">[] = [];
-    for (const currentTokenId of frontier) {
-      const children = (await db.refreshTokens.getChildren(
-        refreshToken.sessionId,
-        currentTokenId,
-      )) as Doc<"token">[];
-      tokensToInvalidate.push(...children);
-      nextFrontier.push(...children.map((child) => child._id));
-    }
-    frontier = nextFrontier;
-  }
-  for (const token of tokensToInvalidate) {
-    // Mark these as used so they can't be used again (even within the reuse window)
-    if (
-      token.firstUsedTime === undefined ||
-      token.firstUsedTime > Date.now() - REFRESH_TOKEN_REUSE_WINDOW_MS
-    ) {
-      await db.refreshTokens.patch(token._id, {
-        firstUsedTime: Date.now() - REFRESH_TOKEN_REUSE_WINDOW_MS,
-      });
-    }
-  }
-  return tokensToInvalidate;
-}
-
-export async function deleteAllRefreshTokens(
-  ctx: MutationCtx,
-  sessionId: GenericId<"session">,
-  config: ConvexAuthConfig,
-) {
-  await authDb(ctx, config).refreshTokens.deleteAll(sessionId);
-}
-
-export async function refreshTokenIfValid(
-  ctx: MutationCtx,
-  refreshTokenId: string,
-  tokenSessionId: string,
-  config: ConvexAuthConfig,
-) {
-  const db = authDb(ctx, config);
-  let refreshTokenDoc: Doc<"token"> | null;
-  try {
-    refreshTokenDoc = (await db.refreshTokens.getById(
-      refreshTokenId as GenericId<"token">,
-    )) as Doc<"token"> | null;
-  } catch {
-    logWithLevel(LOG_LEVELS.ERROR, "Invalid refresh token format");
-    return null;
-  }
-
-  if (refreshTokenDoc === null) {
-    logWithLevel(LOG_LEVELS.ERROR, "Invalid refresh token");
-    return null;
-  }
-  if (refreshTokenDoc.expirationTime < Date.now()) {
-    logWithLevel(LOG_LEVELS.ERROR, "Expired refresh token");
-    return null;
-  }
-  if (refreshTokenDoc.sessionId !== tokenSessionId) {
-    logWithLevel(LOG_LEVELS.ERROR, "Invalid refresh token session ID");
-    return null;
-  }
-  let session: Doc<"session"> | null;
-  try {
-    session = (await db.sessions.getById(refreshTokenDoc.sessionId)) as
-      | Doc<"session">
-      | null;
-  } catch {
-    logWithLevel(LOG_LEVELS.ERROR, "Invalid refresh token session format");
-    return null;
-  }
-  if (session === null) {
-    logWithLevel(LOG_LEVELS.ERROR, "Invalid refresh token session");
-    return null;
-  }
-  if (session.expirationTime < Date.now()) {
-    logWithLevel(LOG_LEVELS.ERROR, "Expired refresh token session");
-    return null;
-  }
-  return { session, refreshTokenDoc };
-}
-/**
- * The active refresh token is the most recently created refresh token that has
- * never been used.
- *
- * @param ctx
- * @param sessionId
- */
-export async function loadActiveRefreshToken(
-  ctx: MutationCtx,
-  sessionId: GenericId<"session">,
-  config: ConvexAuthConfig,
-) {
-  return (await authDb(ctx, config).refreshTokens.getActive(sessionId)) as
-    | Doc<"token">
-    | null;
-}

package/src/server/implementation/signin.ts

@@ -1,296 +0,0 @@
-import { GenericId } from "convex/values";
-import {
-  AuthProviderMaterializedConfig,
-  ConvexCredentialsConfig,
-  EmailConfig,
-  GenericActionCtxWithAuthConfig,
-  PhoneConfig,
-} from "../types";
-import {
-  AuthDataModel,
-  SessionInfo,
-  SessionInfoWithTokens,
-  Tokens,
-} from "./types";
-import {
-  callCreateVerificationCode,
-  callRefreshSession,
-  callSignIn,
-  callVerifier,
-  callVerifierSignature,
-  callVerifyCodeAndSignIn,
-} from "./mutations/index";
-import { redirectAbsoluteUrl, setURLSearchParam } from "./redirects";
-import { requireEnv } from "../utils";
-import type { OAuthMaterializedConfig } from "../types";
-import { generateRandomString } from "./utils";
-import { handlePasskey } from "./passkey";
-import { handleTotp, checkTotpRequired } from "./totp";
-import { handleDevice } from "./device";
-import { throwAuthError } from "../errors";
-
-const DEFAULT_EMAIL_VERIFICATION_CODE_DURATION_S = 60 * 60 * 24; // 24 hours
-
-type EnrichedActionCtx = GenericActionCtxWithAuthConfig<AuthDataModel>;
-
-export async function signInImpl(
-  ctx: EnrichedActionCtx,
-  provider: AuthProviderMaterializedConfig | null,
-  args: {
-    accountId?: GenericId<"account">;
-    params?: Record<string, any>;
-    verifier?: string;
-    refreshToken?: string;
-    calledBy?: string;
-  },
-  options: {
-    generateTokens: boolean;
-    allowExtraProviders: boolean;
-  },
-): Promise<
-  | { kind: "signedIn"; signedIn: SessionInfo | null }
-  // refresh tokens
-  | { kind: "refreshTokens"; signedIn: { tokens: Tokens } }
-  // Multi-step flows like magic link + OTP
-  | { kind: "started"; started: true }
-  // OAuth flows
-  | { kind: "redirect"; redirect: string; verifier: string }
-  // Passkey options (challenge + credential options)
-  | { kind: "passkeyOptions"; options: Record<string, any>; verifier: string }
-  // TOTP 2FA required after credentials sign-in
-  | { kind: "totpRequired"; verifier: string }
-  // TOTP setup response (enrollment)
-  | { kind: "totpSetup"; uri: string; secret: string; verifier: string; totpId: string }
-  // Device authorization (RFC 8628) — codes for the device to display
-  | {
-      kind: "deviceCode";
-      deviceCode: string;
-      userCode: string;
-      verificationUri: string;
-      verificationUriComplete: string;
-      expiresIn: number;
-      interval: number;
-    }
-> {
-  if (provider === null && args.refreshToken) {
-    const tokens = await callRefreshSession(ctx, {
-      refreshToken: args.refreshToken,
-    });
-    if (tokens === null) {
-      return { kind: "signedIn", signedIn: null };
-    }
-    return { kind: "refreshTokens", signedIn: { tokens } };
-  }
-  if (provider === null && args.params?.code !== undefined) {
-    const result = await callVerifyCodeAndSignIn(ctx, {
-      params: args.params,
-      verifier: args.verifier,
-      generateTokens: true,
-      allowExtraProviders: options.allowExtraProviders,
-    });
-    return {
-      kind: "signedIn",
-      signedIn: result,
-    };
-  }
-
-  if (provider === null) {
-    throwAuthError("SIGN_IN_MISSING_PARAMS");
-  }
-  if (provider.type === "email" || provider.type === "phone") {
-    return handleEmailAndPhoneProvider(ctx, provider, args, options);
-  }
-  if (provider.type === "credentials") {
-    return handleCredentials(ctx, provider, args, options);
-  }
-  if (provider.type === "oauth") {
-    return handleOAuthProvider(ctx, provider, args, options);
-  }
-  if (provider.type === "passkey") {
-    return handlePasskey(ctx, provider, args);
-  }
-  if (provider.type === "totp") {
-    return handleTotp(ctx, provider, args);
-  }
-  if (provider.type === "device") {
-    return handleDevice(ctx, provider, args);
-  }
-  const _typecheck: never = provider;
-  throwAuthError(
-    "UNSUPPORTED_PROVIDER_TYPE",
-    `Provider type ${(provider as any).type} is not supported yet`,
-  );
-}
-
-async function handleEmailAndPhoneProvider(
-  ctx: EnrichedActionCtx,
-  provider: EmailConfig | PhoneConfig,
-  args: {
-    params?: Record<string, any>;
-    accountId?: GenericId<"account">;
-  },
-  options: {
-    generateTokens: boolean;
-    allowExtraProviders: boolean;
-  },
-): Promise<
-  | { kind: "started"; started: true }
-  | { kind: "signedIn"; signedIn: SessionInfoWithTokens }
-> {
-  if (args.params?.code !== undefined) {
-    const result = await callVerifyCodeAndSignIn(ctx, {
-      params: args.params,
-      provider: provider.id,
-      generateTokens: options.generateTokens,
-      allowExtraProviders: options.allowExtraProviders,
-    });
-    if (result === null) {
-      throwAuthError("INVALID_VERIFICATION_CODE");
-    }
-    return {
-      kind: "signedIn",
-      signedIn: result as SessionInfoWithTokens,
-    };
-  }
-
-  const alphabet =
-    "0123456789ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz";
-  const code = provider.generateVerificationToken
-    ? await provider.generateVerificationToken()
-    : generateRandomString(32, alphabet);
-  const expirationTime =
-    Date.now() +
-    (provider.maxAge ?? DEFAULT_EMAIL_VERIFICATION_CODE_DURATION_S) * 1000;
-
-  const identifier = await callCreateVerificationCode(ctx, {
-    provider: provider.id,
-    accountId: args.accountId,
-    email: args.params?.email,
-    phone: args.params?.phone,
-    code,
-    expirationTime,
-    allowExtraProviders: options.allowExtraProviders,
-  });
-  const destination = await redirectAbsoluteUrl(
-    ctx.auth.config,
-    (args.params ?? {}) as { redirectTo: unknown },
-  );
-  const verificationArgs = {
-    identifier,
-    url: setURLSearchParam(destination, "code", code),
-    token: code,
-    expires: new Date(expirationTime),
-  };
-  if (provider.type === "email") {
-    await provider.sendVerificationRequest(
-      {
-        ...verificationArgs,
-        provider,
-        request: new Request("http://localhost"),
-      },
-      ctx,
-    );
-  } else if (provider.type === "phone") {
-    await provider.sendVerificationRequest(
-      { ...verificationArgs, provider },
-      ctx,
-    );
-  }
-  return { kind: "started", started: true };
-}
-
-async function handleCredentials(
-  ctx: EnrichedActionCtx,
-  provider: ConvexCredentialsConfig,
-  args: {
-    params?: Record<string, any>;
-  },
-  options: {
-    generateTokens: boolean;
-  },
-): Promise<
-  | { kind: "signedIn"; signedIn: SessionInfo | null }
-  | { kind: "totpRequired"; verifier: string }
-> {
-  const result = await provider.authorize(args.params ?? {}, ctx);
-  if (result === null) {
-    return { kind: "signedIn", signedIn: null };
-  }
-  // Check if user has TOTP 2FA enrolled before issuing tokens
-  const hasTotpEnrolled = await checkTotpRequired(ctx, result.userId);
-  if (hasTotpEnrolled) {
-    // Create session but withhold tokens — TOTP verification needed
-    await callSignIn(ctx, {
-      userId: result.userId,
-      sessionId: result.sessionId,
-      generateTokens: false,
-    });
-    // Store userId in verifier so the TOTP verify flow can complete sign-in
-    const verifier = await callVerifier(ctx);
-    await callVerifierSignature(ctx, {
-      verifier,
-      signature: JSON.stringify({ userId: result.userId }),
-    });
-    return { kind: "totpRequired", verifier };
-  }
-
-  const idsAndTokens = await callSignIn(ctx, {
-    userId: result.userId,
-    sessionId: result.sessionId,
-    generateTokens: options.generateTokens,
-  });
-  return {
-    kind: "signedIn",
-    signedIn: idsAndTokens,
-  };
-}
-
-async function handleOAuthProvider(
-  ctx: EnrichedActionCtx,
-  provider: OAuthMaterializedConfig,
-  args: {
-    params?: Record<string, any>;
-    verifier?: string;
-  },
-  options: {
-    allowExtraProviders: boolean;
-  },
-): Promise<
-  | { kind: "signedIn"; signedIn: SessionInfoWithTokens | null }
-  | { kind: "redirect"; redirect: string; verifier: string }
-> {
-  // We have this action because:
-  // 1. We remember the current sessionId if any, so we can link accounts
-  // 2. The client doesn't need to know the HTTP Actions URL
-  //    of the backend (this simplifies using local backend)
-  // 3. The client doesn't need to know which provider is of which type,
-  //    and hence which provider requires client-side redirect
-  // 4. On mobile the client can complete the flow manually
-  if (args.params?.code !== undefined) {
-    const result = await callVerifyCodeAndSignIn(ctx, {
-      params: args.params,
-      verifier: args.verifier,
-      generateTokens: true,
-      allowExtraProviders: options.allowExtraProviders,
-    });
-    return {
-      kind: "signedIn",
-      signedIn: result as SessionInfoWithTokens | null,
-    };
-  }
-  const redirect = new URL(
-    (process.env.CUSTOM_AUTH_SITE_URL ?? requireEnv("CONVEX_SITE_URL")) + `/api/auth/signin/${provider.id}`,
-  );
-  const verifier = await callVerifier(ctx);
-  redirect.searchParams.set("code", verifier);
-  if (args.params?.redirectTo !== undefined) {
-    if (typeof args.params.redirectTo !== "string") {
-      throwAuthError(
-        "INVALID_REDIRECT",
-        `Expected \`redirectTo\` to be a string, got ${args.params.redirectTo}`,
-      );
-    }
-    redirect.searchParams.set("redirectTo", args.params.redirectTo);
-  }
-  return { kind: "redirect", redirect: redirect.toString(), verifier };
-}