@robelest/convex-auth 0.0.4-preview.2 → 0.0.4-preview.21

package/dist/providers/password.js

@@ -1,5 +1,7 @@
 import { Credentials } from "./credentials.js";
-import { Scrypt } from "lucia";
+import { scryptAsync } from "@noble/hashes/scrypt.js";
+import { bytesToHex } from "@noble/hashes/utils.js";
+import { Fx } from "@robelest/fx";
 
 //#region src/providers/password.ts
 /**
@@ -23,10 +25,28 @@ import { Scrypt } from "lucia";
 *
 * @module
 */
+const PASSWORD_FLOW_TAG = {
+	signUp: "signUp",
+	signIn: "signIn",
+	reset: "reset",
+	"reset-verification": "resetVerification",
+	"email-verification": "emailVerification"
+};
+function decodePasswordFlow(flow) {
+	if (typeof flow !== "string") return {
+		tag: "invalid",
+		flow
+	};
+	const tag = PASSWORD_FLOW_TAG[flow];
+	return tag === void 0 ? {
+		tag: "invalid",
+		flow
+	} : { tag };
+}
 /**
 * Email and password authentication provider.
 *
-* Passwords are by default hashed using Scrypt from Lucia.
+* Passwords are by default hashed using scrypt.
 * You can customize the hashing via the `crypto` option.
 *
 * Email verification is not required unless you pass
@@ -55,94 +75,135 @@ var Password = class {
 		return new Credentials({
 			id: "password",
 			authorize: async (params, ctx) => {
-				const flow = params.flow;
-				const passwordToValidate = flow === "signUp" ? params.password : flow === "reset-verification" ? params.newPassword : null;
-				if (passwordToValidate !== null) if (config.validatePasswordRequirements !== void 0) config.validatePasswordRequirements(passwordToValidate);
-				else validateDefaultPasswordRequirements(passwordToValidate);
+				const flowDispatch = decodePasswordFlow(params.flow);
+				const validatePasswordRequirements = (password) => {
+					if (config.validatePasswordRequirements !== void 0) {
+						config.validatePasswordRequirements(password);
+						return;
+					}
+					validateDefaultPasswordRequirements(password);
+				};
+				await Fx.run(Fx.match(flowDispatch, flowDispatch.tag, {
+					signUp: () => Fx.sync(() => {
+						validatePasswordRequirements(params.password);
+					}),
+					resetVerification: () => Fx.sync(() => {
+						validatePasswordRequirements(params.newPassword);
+					}),
+					signIn: () => Fx.succeed(void 0),
+					reset: () => Fx.succeed(void 0),
+					emailVerification: () => Fx.succeed(void 0),
+					invalid: () => Fx.succeed(void 0)
+				}));
 				const profile = config.profile?.(params, ctx) ?? defaultProfile(params);
 				const { email } = profile;
-				const secret = params.password;
-				let account;
-				let user;
-				if (flow === "signUp") {
-					if (secret === void 0) throw new Error("Missing `password` param for `signUp` flow");
-					const created = await ctx.auth.account.create(ctx, {
-						provider,
-						account: {
-							id: email,
-							secret
-						},
-						profile,
-						shouldLinkViaEmail: config.verify !== void 0,
-						shouldLinkViaPhone: false
-					});
-					({account, user} = created);
-				} else if (flow === "signIn") {
-					if (secret === void 0) throw new Error("Missing `password` param for `signIn` flow");
-					const retrieved = await ctx.auth.account.get(ctx, {
-						provider,
-						account: {
-							id: email,
-							secret
-						}
-					});
-					if (retrieved === null) throw new Error("Invalid credentials");
-					({account, user} = retrieved);
-				} else if (flow === "reset") {
-					if (!config.reset) throw new Error(`Password reset is not enabled for ${provider}`);
-					const { account: account$1 } = await ctx.auth.account.get(ctx, {
-						provider,
-						account: { id: email }
-					});
-					return await ctx.auth.provider.signIn(ctx, config.reset, {
-						accountId: account$1._id,
+				const requirePasswordParam = (value, flow) => {
+					if (typeof value !== "string" || value.length === 0) throw new Error(`Missing \`password\` param for \`${flow}\` flow`);
+					return value;
+				};
+				const finalizeCredentialsResult = async (account, user) => {
+					if (config.verify && !account.emailVerified) return await ctx.auth.provider.signIn(ctx, config.verify, {
+						accountId: account._id,
 						params
 					});
-				} else if (flow === "reset-verification") {
-					if (!config.reset) throw new Error(`Password reset is not enabled for ${provider}`);
-					if (params.newPassword === void 0) throw new Error("Missing `newPassword` param for `reset-verification` flow");
-					const result = await ctx.auth.provider.signIn(ctx, config.reset, { params });
-					if (result === null) throw new Error("Invalid code");
-					const { userId, sessionId } = result;
-					const secret$1 = params.newPassword;
-					await ctx.auth.account.update(ctx, {
-						provider,
-						account: {
-							id: email,
-							secret: secret$1
-						}
-					});
-					await ctx.auth.session.invalidate(ctx, {
-						userId,
-						except: [sessionId]
-					});
-					return {
-						userId,
-						sessionId
-					};
-				} else if (flow === "email-verification") {
-					if (!config.verify) throw new Error(`Email verification is not enabled for ${provider}`);
-					const { account: account$1 } = await ctx.auth.account.get(ctx, {
-						provider,
-						account: { id: email }
-					});
-					return await ctx.auth.provider.signIn(ctx, config.verify, {
-						accountId: account$1._id,
-						params
-					});
-				} else throw new Error("Missing `flow` param, it must be one of \"signUp\", \"signIn\", \"reset\", \"reset-verification\" or \"email-verification\"!");
-				if (config.verify && !account.emailVerified) return await ctx.auth.provider.signIn(ctx, config.verify, {
-					accountId: account._id,
-					params
-				});
-				return { userId: user._id };
+					return { userId: user._id };
+				};
+				return await Fx.run(Fx.match(flowDispatch, flowDispatch.tag, {
+					signUp: () => Fx.from({
+						ok: async () => {
+							const secret = requirePasswordParam(params.password, "signUp");
+							const created = await ctx.auth.account.create(ctx, {
+								provider,
+								account: {
+									id: email,
+									secret
+								},
+								profile,
+								shouldLinkViaEmail: config.verify !== void 0,
+								shouldLinkViaPhone: false
+							});
+							return await finalizeCredentialsResult(created.account, created.user);
+						},
+						err: (e) => e
+					}),
+					signIn: () => Fx.from({
+						ok: async () => {
+							const secret = requirePasswordParam(params.password, "signIn");
+							const retrieved = await ctx.auth.account.get(ctx, {
+								provider,
+								account: {
+									id: email,
+									secret
+								}
+							});
+							if (retrieved === null) throw new Error("Invalid credentials");
+							return await finalizeCredentialsResult(retrieved.account, retrieved.user);
+						},
+						err: (e) => e
+					}),
+					reset: () => Fx.from({
+						ok: async () => {
+							if (!config.reset) throw new Error(`Password reset is not enabled for ${provider}`);
+							const { account } = await ctx.auth.account.get(ctx, {
+								provider,
+								account: { id: email }
+							});
+							return await ctx.auth.provider.signIn(ctx, config.reset, {
+								accountId: account._id,
+								params
+							});
+						},
+						err: (e) => e
+					}),
+					resetVerification: () => Fx.from({
+						ok: async () => {
+							if (!config.reset) throw new Error(`Password reset is not enabled for ${provider}`);
+							if (params.newPassword === void 0) throw new Error("Missing `newPassword` param for `reset-verification` flow");
+							const result = await ctx.auth.provider.signIn(ctx, config.reset, { params });
+							if (result === null) throw new Error("Invalid code");
+							const { userId, sessionId } = result;
+							const secret = params.newPassword;
+							await ctx.auth.account.update(ctx, {
+								provider,
+								account: {
+									id: email,
+									secret
+								}
+							});
+							await ctx.auth.session.invalidate(ctx, {
+								userId,
+								except: [sessionId]
+							});
+							return {
+								userId,
+								sessionId
+							};
+						},
+						err: (e) => e
+					}),
+					emailVerification: () => Fx.from({
+						ok: async () => {
+							if (!config.verify) throw new Error(`Email verification is not enabled for ${provider}`);
+							const { account } = await ctx.auth.account.get(ctx, {
+								provider,
+								account: { id: email }
+							});
+							return await ctx.auth.provider.signIn(ctx, config.verify, {
+								accountId: account._id,
+								params
+							});
+						},
+						err: (e) => e
+					}),
+					invalid: () => Fx.fatal(/* @__PURE__ */ new Error("Missing `flow` param, it must be one of \"signUp\", \"signIn\", \"reset\", \"reset-verification\" or \"email-verification\"!"))
+				}));
 			},
 			crypto: config.crypto ?? {
 				async hashSecret(password) {
-					return await new Scrypt().hash(password);
+					return await hashPassword(password);
 				},
 				async verifySecret(password, hash) {
-					return await new Scrypt().verify(hash, password);
+					return await verifyPassword(password, hash);
 				}
 			},
 			extraProviders: [config.reset, config.verify],
@@ -150,19 +211,58 @@ var Password = class {
 		})._toMaterialized();
 	}
 };
-/**
-* @deprecated Use `new Password(config)` instead.
-*/
-function password(config = {}) {
-	return new Password(config)._toMaterialized();
-}
 function validateDefaultPasswordRequirements(password) {
 	if (!password || password.length < 8) throw new Error("Invalid password");
 }
 function defaultProfile(params) {
-	return { email: params.email };
+	const email = params.email;
+	if (typeof email !== "string" || email.trim().length === 0) throw new Error("Missing `email` param");
+	return { email };
+}
+const PASSWORD_HASH_PARAMS = {
+	N: 16384,
+	r: 16,
+	p: 1,
+	dkLen: 64
+};
+const PASSWORD_HASH_PREFIX = `scrypt:N=${PASSWORD_HASH_PARAMS.N},r=${PASSWORD_HASH_PARAMS.r},p=${PASSWORD_HASH_PARAMS.p},dkLen=${PASSWORD_HASH_PARAMS.dkLen}`;
+async function hashPassword(password) {
+	const salt = crypto.getRandomValues(new Uint8Array(32));
+	const hash = await scryptAsync(password, salt, PASSWORD_HASH_PARAMS);
+	return `${PASSWORD_HASH_PREFIX}$${bytesToHex(salt)}$${bytesToHex(hash)}`;
+}
+async function verifyPassword(password, storedHash) {
+	const [prefix, saltHex, hashHex] = storedHash.split("$");
+	if (prefix !== PASSWORD_HASH_PREFIX || saltHex === void 0 || hashHex === void 0) return false;
+	let salt;
+	let expectedHash;
+	try {
+		salt = hexToBytes(saltHex);
+		expectedHash = hexToBytes(hashHex);
+	} catch {
+		return false;
+	}
+	if (salt.length !== 32 || expectedHash.length !== PASSWORD_HASH_PARAMS.dkLen) return false;
+	return constantTimeEqual(await scryptAsync(password, salt, PASSWORD_HASH_PARAMS), expectedHash);
+}
+function hexToBytes(hex) {
+	if (hex.length % 2 !== 0) throw new Error("Invalid password hash");
+	const bytes = new Uint8Array(hex.length / 2);
+	for (let i = 0; i < bytes.length; i++) {
+		const start = i * 2;
+		const value = Number.parseInt(hex.slice(start, start + 2), 16);
+		if (Number.isNaN(value)) throw new Error("Invalid password hash");
+		bytes[i] = value;
+	}
+	return bytes;
+}
+function constantTimeEqual(left, right) {
+	if (left.length !== right.length) return false;
+	let diff = 0;
+	for (let i = 0; i < left.length; i++) diff |= left[i] ^ right[i];
+	return diff === 0;
 }
 
 //#endregion
-export { Password, password as default };
+export { Password };
 //# sourceMappingURL=password.js.map

package/dist/providers/password.js.map

@@ -1 +1 @@
-{"version":3,"file":"password.js","names":["account","secret"],"sources":["../../src/providers/password.ts"],"sourcesContent":["/**\n * Configure {@link Password} provider for email/password authentication.\n *\n * The `Password` provider supports the following flows, determined\n * by the `flow` parameter:\n *\n * - `\"signUp\"`: Create a new account with a password.\n * - `\"signIn\"`: Sign in with an existing account and password.\n * - `\"reset\"`: Request a password reset.\n * - `\"reset-verification\"`: Verify a password reset code and change password.\n * - `\"email-verification\"`: If email verification is enabled and `code` is\n *    included in params, verify an OTP.\n *\n * ```ts\n * import { Password } from \"@robelest/convex-auth/providers\";\n *\n * new Password()\n * ```\n *\n * @module\n */\n\nimport { Credentials, type CredentialsConfig } from \"./credentials\";\nimport type {\n  EmailConfig,\n  GenericActionCtxWithAuthConfig,\n  GenericDoc,\n  AuthProviderConfig,\n  ConvexCredentialsConfig,\n} from \"../server/types\";\nimport {\n  DocumentByName,\n  GenericDataModel,\n  WithoutSystemFields,\n} from \"convex/server\";\nimport { Value } from \"convex/values\";\nimport { Scrypt } from \"lucia\";\n\n/**\n * The available options to a {@link Password} provider for Convex Auth.\n */\nexport interface PasswordConfig<DataModel extends GenericDataModel> {\n  /**\n   * Uniquely identifies the provider, allowing to use\n   * multiple different {@link Password} providers.\n   */\n  id?: string;\n  /**\n   * Perform checks on provided params and customize the user\n   * information stored after sign up, including email normalization.\n   *\n   * Called for every flow (\"signUp\", \"signIn\", \"reset\",\n   * \"reset-verification\" and \"email-verification\").\n   */\n  profile?: (\n    /**\n     * The values passed to the `signIn` function.\n     */\n    params: Record<string, Value | undefined>,\n    /**\n     * Convex ActionCtx in case you want to read from or write to\n     * the database.\n     */\n    ctx: GenericActionCtxWithAuthConfig<DataModel>,\n  ) => WithoutSystemFields<DocumentByName<DataModel, \"user\">> & {\n    email: string;\n  };\n  /**\n   * Performs custom validation on password provided during sign up or reset.\n   *\n   * Otherwise the default validation is used (password is not empty and\n   * at least 8 characters in length).\n   *\n   * If the provided password is invalid, implementations must throw an Error.\n   *\n   * @param password the password supplied during \"signUp\" or\n   *                 \"reset-verification\" flows.\n   */\n  validatePasswordRequirements?: (password: string) => void;\n  /**\n   * Provide hashing and verification functions if you want to control\n   * how passwords are hashed.\n   */\n  crypto?: CredentialsConfig[\"crypto\"];\n  /**\n   * An Auth.js email provider used to require verification\n   * before password reset.\n   */\n  reset?: EmailConfig | ((...args: any) => EmailConfig);\n  /**\n   * An Auth.js email provider used to require verification\n   * before sign up / sign in.\n   */\n  verify?: EmailConfig | ((...args: any) => EmailConfig);\n}\n\n/**\n * Email and password authentication provider.\n *\n * Passwords are by default hashed using Scrypt from Lucia.\n * You can customize the hashing via the `crypto` option.\n *\n * Email verification is not required unless you pass\n * an email provider to the `verify` option.\n *\n * @example\n * ```ts\n * import { Password } from \"@robelest/convex-auth/providers\";\n *\n * new Password()\n * new Password({ verify: myEmailProvider })\n * ```\n */\nexport class Password<DataModel extends GenericDataModel = GenericDataModel> {\n  readonly id: string;\n  readonly type = \"credentials\" as const;\n  readonly config: PasswordConfig<DataModel>;\n\n  constructor(config: PasswordConfig<DataModel> = {} as PasswordConfig<DataModel>) {\n    this.id = config.id ?? \"password\";\n    this.config = config;\n  }\n\n  /** @internal Convert to the internal materialized config shape. */\n  _toMaterialized(): ConvexCredentialsConfig {\n    const config = this.config;\n    const provider = this.id;\n\n    return new Credentials<DataModel>({\n      id: \"password\",\n      authorize: async (params, ctx) => {\n        const flow = params.flow as string;\n        const passwordToValidate =\n          flow === \"signUp\"\n            ? (params.password as string)\n            : flow === \"reset-verification\"\n              ? (params.newPassword as string)\n              : null;\n        if (passwordToValidate !== null) {\n          if (config.validatePasswordRequirements !== undefined) {\n            config.validatePasswordRequirements(passwordToValidate);\n          } else {\n            validateDefaultPasswordRequirements(passwordToValidate);\n          }\n        }\n        const profile = config.profile?.(params, ctx) ?? defaultProfile(params);\n        const { email } = profile;\n        const secret = params.password as string;\n        let account: GenericDoc<DataModel, \"account\">;\n        let user: GenericDoc<DataModel, \"user\">;\n        if (flow === \"signUp\") {\n          if (secret === undefined) {\n            throw new Error(\"Missing `password` param for `signUp` flow\");\n          }\n          const created = await ctx.auth.account.create(ctx, {\n            provider,\n            account: { id: email, secret },\n            profile: profile as any,\n            shouldLinkViaEmail: config.verify !== undefined,\n            shouldLinkViaPhone: false,\n          });\n          ({ account, user } = created);\n        } else if (flow === \"signIn\") {\n          if (secret === undefined) {\n            throw new Error(\"Missing `password` param for `signIn` flow\");\n          }\n          const retrieved = await ctx.auth.account.get(ctx, {\n            provider,\n            account: { id: email, secret },\n          });\n          if (retrieved === null) {\n            throw new Error(\"Invalid credentials\");\n          }\n          ({ account, user } = retrieved);\n        } else if (flow === \"reset\") {\n          if (!config.reset) {\n            throw new Error(`Password reset is not enabled for ${provider}`);\n          }\n          const { account } = await ctx.auth.account.get(ctx, {\n            provider,\n            account: { id: email },\n          });\n          return await ctx.auth.provider.signIn(ctx, config.reset as AuthProviderConfig, {\n            accountId: account._id,\n            params,\n          });\n        } else if (flow === \"reset-verification\") {\n          if (!config.reset) {\n            throw new Error(`Password reset is not enabled for ${provider}`);\n          }\n          if (params.newPassword === undefined) {\n            throw new Error(\n              \"Missing `newPassword` param for `reset-verification` flow\",\n            );\n          }\n          const result = await ctx.auth.provider.signIn(\n            ctx,\n            config.reset as AuthProviderConfig,\n            { params },\n          );\n          if (result === null) {\n            throw new Error(\"Invalid code\");\n          }\n          const { userId, sessionId } = result;\n          const secret = params.newPassword as string;\n          await ctx.auth.account.update(ctx, {\n            provider,\n            account: { id: email, secret },\n          });\n          await ctx.auth.session.invalidate(ctx, { userId, except: [sessionId] });\n          return { userId, sessionId };\n        } else if (flow === \"email-verification\") {\n          if (!config.verify) {\n            throw new Error(\n              `Email verification is not enabled for ${provider}`,\n            );\n          }\n          const { account } = await ctx.auth.account.get(ctx, {\n            provider,\n            account: { id: email },\n          });\n          return await ctx.auth.provider.signIn(ctx, config.verify as AuthProviderConfig, {\n            accountId: account._id,\n            params,\n          });\n        } else {\n          throw new Error(\n            \"Missing `flow` param, it must be one of \" +\n              '\"signUp\", \"signIn\", \"reset\", \"reset-verification\" or ' +\n              '\"email-verification\"!',\n          );\n        }\n        if (config.verify && !account.emailVerified) {\n          return await ctx.auth.provider.signIn(ctx, config.verify as AuthProviderConfig, {\n            accountId: account._id,\n            params,\n          });\n        }\n        return { userId: user._id };\n      },\n      crypto: config.crypto ?? {\n        async hashSecret(password: string) {\n          return await new Scrypt().hash(password);\n        },\n        async verifySecret(password: string, hash: string) {\n          return await new Scrypt().verify(hash, password);\n        },\n      },\n      extraProviders: [\n        config.reset as AuthProviderConfig | undefined,\n        config.verify as AuthProviderConfig | undefined,\n      ],\n      ...config,\n    })._toMaterialized();\n  }\n}\n\n// ============================================================================\n// Backward-compatible default export\n// ============================================================================\n\n/**\n * @deprecated Use `new Password(config)` instead.\n */\nexport default function password<DataModel extends GenericDataModel>(\n  config: PasswordConfig<DataModel> = {} as PasswordConfig<DataModel>,\n): ConvexCredentialsConfig {\n  return new Password(config)._toMaterialized();\n}\n\n// ============================================================================\n// Helpers\n// ============================================================================\n\nfunction validateDefaultPasswordRequirements(password: string) {\n  if (!password || password.length < 8) {\n    throw new Error(\"Invalid password\");\n  }\n}\n\nfunction defaultProfile(params: Record<string, unknown>) {\n  return {\n    email: params.email as string,\n  };\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAiHA,IAAa,WAAb,MAA6E;CAC3E,AAAS;CACT,AAAS,OAAO;CAChB,AAAS;CAET,YAAY,SAAoC,EAAE,EAA+B;AAC/E,OAAK,KAAK,OAAO,MAAM;AACvB,OAAK,SAAS;;;CAIhB,kBAA2C;EACzC,MAAM,SAAS,KAAK;EACpB,MAAM,WAAW,KAAK;AAEtB,SAAO,IAAI,YAAuB;GAChC,IAAI;GACJ,WAAW,OAAO,QAAQ,QAAQ;IAChC,MAAM,OAAO,OAAO;IACpB,MAAM,qBACJ,SAAS,WACJ,OAAO,WACR,SAAS,uBACN,OAAO,cACR;AACR,QAAI,uBAAuB,KACzB,KAAI,OAAO,iCAAiC,OAC1C,QAAO,6BAA6B,mBAAmB;QAEvD,qCAAoC,mBAAmB;IAG3D,MAAM,UAAU,OAAO,UAAU,QAAQ,IAAI,IAAI,eAAe,OAAO;IACvE,MAAM,EAAE,UAAU;IAClB,MAAM,SAAS,OAAO;IACtB,IAAI;IACJ,IAAI;AACJ,QAAI,SAAS,UAAU;AACrB,SAAI,WAAW,OACb,OAAM,IAAI,MAAM,6CAA6C;KAE/D,MAAM,UAAU,MAAM,IAAI,KAAK,QAAQ,OAAO,KAAK;MACjD;MACA,SAAS;OAAE,IAAI;OAAO;OAAQ;MACrB;MACT,oBAAoB,OAAO,WAAW;MACtC,oBAAoB;MACrB,CAAC;AACF,MAAC,CAAE,SAAS,QAAS;eACZ,SAAS,UAAU;AAC5B,SAAI,WAAW,OACb,OAAM,IAAI,MAAM,6CAA6C;KAE/D,MAAM,YAAY,MAAM,IAAI,KAAK,QAAQ,IAAI,KAAK;MAChD;MACA,SAAS;OAAE,IAAI;OAAO;OAAQ;MAC/B,CAAC;AACF,SAAI,cAAc,KAChB,OAAM,IAAI,MAAM,sBAAsB;AAExC,MAAC,CAAE,SAAS,QAAS;eACZ,SAAS,SAAS;AAC3B,SAAI,CAAC,OAAO,MACV,OAAM,IAAI,MAAM,qCAAqC,WAAW;KAElE,MAAM,EAAE,uBAAY,MAAM,IAAI,KAAK,QAAQ,IAAI,KAAK;MAClD;MACA,SAAS,EAAE,IAAI,OAAO;MACvB,CAAC;AACF,YAAO,MAAM,IAAI,KAAK,SAAS,OAAO,KAAK,OAAO,OAA6B;MAC7E,WAAWA,UAAQ;MACnB;MACD,CAAC;eACO,SAAS,sBAAsB;AACxC,SAAI,CAAC,OAAO,MACV,OAAM,IAAI,MAAM,qCAAqC,WAAW;AAElE,SAAI,OAAO,gBAAgB,OACzB,OAAM,IAAI,MACR,4DACD;KAEH,MAAM,SAAS,MAAM,IAAI,KAAK,SAAS,OACrC,KACA,OAAO,OACP,EAAE,QAAQ,CACX;AACD,SAAI,WAAW,KACb,OAAM,IAAI,MAAM,eAAe;KAEjC,MAAM,EAAE,QAAQ,cAAc;KAC9B,MAAMC,WAAS,OAAO;AACtB,WAAM,IAAI,KAAK,QAAQ,OAAO,KAAK;MACjC;MACA,SAAS;OAAE,IAAI;OAAO;OAAQ;MAC/B,CAAC;AACF,WAAM,IAAI,KAAK,QAAQ,WAAW,KAAK;MAAE;MAAQ,QAAQ,CAAC,UAAU;MAAE,CAAC;AACvE,YAAO;MAAE;MAAQ;MAAW;eACnB,SAAS,sBAAsB;AACxC,SAAI,CAAC,OAAO,OACV,OAAM,IAAI,MACR,yCAAyC,WAC1C;KAEH,MAAM,EAAE,uBAAY,MAAM,IAAI,KAAK,QAAQ,IAAI,KAAK;MAClD;MACA,SAAS,EAAE,IAAI,OAAO;MACvB,CAAC;AACF,YAAO,MAAM,IAAI,KAAK,SAAS,OAAO,KAAK,OAAO,QAA8B;MAC9E,WAAWD,UAAQ;MACnB;MACD,CAAC;UAEF,OAAM,IAAI,MACR,+HAGD;AAEH,QAAI,OAAO,UAAU,CAAC,QAAQ,cAC5B,QAAO,MAAM,IAAI,KAAK,SAAS,OAAO,KAAK,OAAO,QAA8B;KAC9E,WAAW,QAAQ;KACnB;KACD,CAAC;AAEJ,WAAO,EAAE,QAAQ,KAAK,KAAK;;GAE7B,QAAQ,OAAO,UAAU;IACvB,MAAM,WAAW,UAAkB;AACjC,YAAO,MAAM,IAAI,QAAQ,CAAC,KAAK,SAAS;;IAE1C,MAAM,aAAa,UAAkB,MAAc;AACjD,YAAO,MAAM,IAAI,QAAQ,CAAC,OAAO,MAAM,SAAS;;IAEnD;GACD,gBAAgB,CACd,OAAO,OACP,OAAO,OACR;GACD,GAAG;GACJ,CAAC,CAAC,iBAAiB;;;;;;AAWxB,SAAwB,SACtB,SAAoC,EAAE,EACb;AACzB,QAAO,IAAI,SAAS,OAAO,CAAC,iBAAiB;;AAO/C,SAAS,oCAAoC,UAAkB;AAC7D,KAAI,CAAC,YAAY,SAAS,SAAS,EACjC,OAAM,IAAI,MAAM,mBAAmB;;AAIvC,SAAS,eAAe,QAAiC;AACvD,QAAO,EACL,OAAO,OAAO,OACf"}
+{"version":3,"file":"password.js","names":[],"sources":["../../src/providers/password.ts"],"sourcesContent":["/**\n * Configure {@link Password} provider for email/password authentication.\n *\n * The `Password` provider supports the following flows, determined\n * by the `flow` parameter:\n *\n * - `\"signUp\"`: Create a new account with a password.\n * - `\"signIn\"`: Sign in with an existing account and password.\n * - `\"reset\"`: Request a password reset.\n * - `\"reset-verification\"`: Verify a password reset code and change password.\n * - `\"email-verification\"`: If email verification is enabled and `code` is\n *    included in params, verify an OTP.\n *\n * ```ts\n * import { Password } from \"@robelest/convex-auth/providers\";\n *\n * new Password()\n * ```\n *\n * @module\n */\n\nimport { scryptAsync } from \"@noble/hashes/scrypt.js\";\nimport { bytesToHex } from \"@noble/hashes/utils.js\";\nimport { Fx } from \"@robelest/fx\";\nimport {\n  DocumentByName,\n  GenericDataModel,\n  WithoutSystemFields,\n} from \"convex/server\";\nimport { Value } from \"convex/values\";\n\nimport type {\n  EmailConfig,\n  GenericActionCtxWithAuthConfig,\n  GenericDoc,\n  AuthProviderConfig,\n  ConvexCredentialsConfig,\n} from \"../server/types\";\nimport { Credentials, type CredentialsConfig } from \"./credentials\";\n\n/**\n * The available options to a {@link Password} provider for Convex Auth.\n */\nexport interface PasswordConfig<DataModel extends GenericDataModel> {\n  /**\n   * Uniquely identifies the provider, allowing to use\n   * multiple different {@link Password} providers.\n   */\n  id?: string;\n  /**\n   * Perform checks on provided params and customize the user\n   * information stored after sign up, including email normalization.\n   *\n   * Called for every flow (\"signUp\", \"signIn\", \"reset\",\n   * \"reset-verification\" and \"email-verification\").\n   */\n  profile?: (\n    /**\n     * The values passed to the `signIn` function.\n     */\n    params: Record<string, Value | undefined>,\n    /**\n     * Convex ActionCtx in case you want to read from or write to\n     * the database.\n     */\n    ctx: GenericActionCtxWithAuthConfig<DataModel>,\n  ) => WithoutSystemFields<DocumentByName<DataModel, \"User\">> & {\n    email: string;\n  };\n  /**\n   * Performs custom validation on password provided during sign up or reset.\n   *\n   * Otherwise the default validation is used (password is not empty and\n   * at least 8 characters in length).\n   *\n   * If the provided password is invalid, implementations must throw an Error.\n   *\n   * @param password the password supplied during \"signUp\" or\n   *                 \"reset-verification\" flows.\n   */\n  validatePasswordRequirements?: (password: string) => void;\n  /**\n   * Provide hashing and verification functions if you want to control\n   * how passwords are hashed.\n   */\n  crypto?: CredentialsConfig[\"crypto\"];\n  /**\n   * An email provider used to require verification\n   * before password reset.\n   */\n  reset?: EmailConfig | ((...args: any) => EmailConfig);\n  /**\n   * An email provider used to require verification\n   * before sign up / sign in.\n   */\n  verify?: EmailConfig | ((...args: any) => EmailConfig);\n}\n\ntype PasswordFlowDispatch =\n  | { tag: \"signUp\" }\n  | { tag: \"signIn\" }\n  | { tag: \"reset\" }\n  | { tag: \"resetVerification\" }\n  | { tag: \"emailVerification\" }\n  | { tag: \"invalid\"; flow: unknown };\n\nconst PASSWORD_FLOW_TAG = {\n  signUp: \"signUp\",\n  signIn: \"signIn\",\n  reset: \"reset\",\n  \"reset-verification\": \"resetVerification\",\n  \"email-verification\": \"emailVerification\",\n} as const;\n\ntype PasswordFlowInput = keyof typeof PASSWORD_FLOW_TAG;\n\nfunction decodePasswordFlow(flow: unknown): PasswordFlowDispatch {\n  if (typeof flow !== \"string\") {\n    return { tag: \"invalid\", flow };\n  }\n\n  const tag = PASSWORD_FLOW_TAG[flow as PasswordFlowInput];\n  return tag === undefined ? { tag: \"invalid\", flow } : { tag };\n}\n\n/**\n * Email and password authentication provider.\n *\n * Passwords are by default hashed using scrypt.\n * You can customize the hashing via the `crypto` option.\n *\n * Email verification is not required unless you pass\n * an email provider to the `verify` option.\n *\n * @example\n * ```ts\n * import { Password } from \"@robelest/convex-auth/providers\";\n *\n * new Password()\n * new Password({ verify: myEmailProvider })\n * ```\n */\nexport class Password<DataModel extends GenericDataModel = GenericDataModel> {\n  readonly id: string;\n  readonly type = \"credentials\" as const;\n  readonly config: PasswordConfig<DataModel>;\n\n  constructor(\n    config: PasswordConfig<DataModel> = {} as PasswordConfig<DataModel>,\n  ) {\n    this.id = config.id ?? \"password\";\n    this.config = config;\n  }\n\n  /** @internal Convert to the internal materialized config shape. */\n  _toMaterialized(): ConvexCredentialsConfig {\n    const config = this.config;\n    const provider = this.id;\n\n    return new Credentials<DataModel>({\n      id: \"password\",\n      authorize: async (params, ctx) => {\n        const flowDispatch = decodePasswordFlow(params.flow);\n\n        const validatePasswordRequirements = (password: string) => {\n          if (config.validatePasswordRequirements !== undefined) {\n            config.validatePasswordRequirements(password);\n            return;\n          }\n          validateDefaultPasswordRequirements(password);\n        };\n\n        await Fx.run(\n          Fx.match(flowDispatch, flowDispatch.tag, {\n            signUp: () =>\n              Fx.sync(() => {\n                validatePasswordRequirements(params.password as string);\n              }),\n            resetVerification: () =>\n              Fx.sync(() => {\n                validatePasswordRequirements(params.newPassword as string);\n              }),\n            signIn: () => Fx.succeed(undefined),\n            reset: () => Fx.succeed(undefined),\n            emailVerification: () => Fx.succeed(undefined),\n            invalid: () => Fx.succeed(undefined),\n          }),\n        );\n\n        const profile = config.profile?.(params, ctx) ?? defaultProfile(params);\n        const { email } = profile;\n        const requirePasswordParam = (\n          value: unknown,\n          flow: \"signUp\" | \"signIn\",\n        ) => {\n          if (typeof value !== \"string\" || value.length === 0) {\n            throw new Error(`Missing \\`password\\` param for \\`${flow}\\` flow`);\n          }\n          return value;\n        };\n\n        const finalizeCredentialsResult = async (\n          account: GenericDoc<DataModel, \"Account\">,\n          user: GenericDoc<DataModel, \"User\">,\n        ) => {\n          if (config.verify && !account.emailVerified) {\n            return await ctx.auth.provider.signIn(\n              ctx,\n              config.verify as AuthProviderConfig,\n              {\n                accountId: account._id,\n                params,\n              },\n            );\n          }\n          return { userId: user._id };\n        };\n\n        return await Fx.run(\n          Fx.match(flowDispatch, flowDispatch.tag, {\n            signUp: () =>\n              Fx.from({\n                ok: async () => {\n                  const secret = requirePasswordParam(\n                    params.password,\n                    \"signUp\",\n                  );\n                  const created = await ctx.auth.account.create(ctx, {\n                    provider,\n                    account: { id: email, secret },\n                    profile: profile as any,\n                    shouldLinkViaEmail: config.verify !== undefined,\n                    shouldLinkViaPhone: false,\n                  });\n                  return await finalizeCredentialsResult(\n                    created.account,\n                    created.user,\n                  );\n                },\n                err: (e) => e as never,\n              }),\n            signIn: () =>\n              Fx.from({\n                ok: async () => {\n                  const secret = requirePasswordParam(\n                    params.password,\n                    \"signIn\",\n                  );\n                  const retrieved = await ctx.auth.account.get(ctx, {\n                    provider,\n                    account: { id: email, secret },\n                  });\n                  if (retrieved === null) {\n                    throw new Error(\"Invalid credentials\");\n                  }\n                  return await finalizeCredentialsResult(\n                    retrieved.account,\n                    retrieved.user,\n                  );\n                },\n                err: (e) => e as never,\n              }),\n            reset: () =>\n              Fx.from({\n                ok: async () => {\n                  if (!config.reset) {\n                    throw new Error(\n                      `Password reset is not enabled for ${provider}`,\n                    );\n                  }\n                  const { account } = await ctx.auth.account.get(ctx, {\n                    provider,\n                    account: { id: email },\n                  });\n                  return await ctx.auth.provider.signIn(\n                    ctx,\n                    config.reset as AuthProviderConfig,\n                    {\n                      accountId: account._id,\n                      params,\n                    },\n                  );\n                },\n                err: (e) => e as never,\n              }),\n            resetVerification: () =>\n              Fx.from({\n                ok: async () => {\n                  if (!config.reset) {\n                    throw new Error(\n                      `Password reset is not enabled for ${provider}`,\n                    );\n                  }\n                  if (params.newPassword === undefined) {\n                    throw new Error(\n                      \"Missing `newPassword` param for `reset-verification` flow\",\n                    );\n                  }\n                  const result = await ctx.auth.provider.signIn(\n                    ctx,\n                    config.reset as AuthProviderConfig,\n                    { params },\n                  );\n                  if (result === null) {\n                    throw new Error(\"Invalid code\");\n                  }\n                  const { userId, sessionId } = result;\n                  const secret = params.newPassword as string;\n                  await ctx.auth.account.update(ctx, {\n                    provider,\n                    account: { id: email, secret },\n                  });\n                  await ctx.auth.session.invalidate(ctx, {\n                    userId,\n                    except: [sessionId],\n                  });\n                  return { userId, sessionId };\n                },\n                err: (e) => e as never,\n              }),\n            emailVerification: () =>\n              Fx.from({\n                ok: async () => {\n                  if (!config.verify) {\n                    throw new Error(\n                      `Email verification is not enabled for ${provider}`,\n                    );\n                  }\n                  const { account } = await ctx.auth.account.get(ctx, {\n                    provider,\n                    account: { id: email },\n                  });\n                  return await ctx.auth.provider.signIn(\n                    ctx,\n                    config.verify as AuthProviderConfig,\n                    {\n                      accountId: account._id,\n                      params,\n                    },\n                  );\n                },\n                err: (e) => e as never,\n              }),\n            invalid: () =>\n              Fx.fatal(\n                new Error(\n                  \"Missing `flow` param, it must be one of \" +\n                    '\"signUp\", \"signIn\", \"reset\", \"reset-verification\" or ' +\n                    '\"email-verification\"!',\n                ),\n              ),\n          }),\n        );\n      },\n      crypto: config.crypto ?? {\n        async hashSecret(password: string) {\n          return await hashPassword(password);\n        },\n        async verifySecret(password: string, hash: string) {\n          return await verifyPassword(password, hash);\n        },\n      },\n      extraProviders: [\n        config.reset as AuthProviderConfig | undefined,\n        config.verify as AuthProviderConfig | undefined,\n      ],\n      ...config,\n    })._toMaterialized();\n  }\n}\n\n// ============================================================================\n// Helpers\n// ============================================================================\n\nfunction validateDefaultPasswordRequirements(password: string) {\n  if (!password || password.length < 8) {\n    throw new Error(\"Invalid password\");\n  }\n}\n\nfunction defaultProfile(params: Record<string, unknown>) {\n  const email = params.email;\n  if (typeof email !== \"string\" || email.trim().length === 0) {\n    throw new Error(\"Missing `email` param\");\n  }\n  return {\n    email,\n  };\n}\n\nconst PASSWORD_HASH_PARAMS = {\n  N: 16384,\n  r: 16,\n  p: 1,\n  dkLen: 64,\n} as const;\n\nconst PASSWORD_HASH_PREFIX = `scrypt:N=${PASSWORD_HASH_PARAMS.N},r=${PASSWORD_HASH_PARAMS.r},p=${PASSWORD_HASH_PARAMS.p},dkLen=${PASSWORD_HASH_PARAMS.dkLen}`;\n\nasync function hashPassword(password: string) {\n  const salt = crypto.getRandomValues(new Uint8Array(32));\n  const hash = await scryptAsync(password, salt, PASSWORD_HASH_PARAMS);\n  return `${PASSWORD_HASH_PREFIX}$${bytesToHex(salt)}$${bytesToHex(hash)}`;\n}\n\nasync function verifyPassword(password: string, storedHash: string) {\n  const [prefix, saltHex, hashHex] = storedHash.split(\"$\");\n  if (\n    prefix !== PASSWORD_HASH_PREFIX ||\n    saltHex === undefined ||\n    hashHex === undefined\n  ) {\n    return false;\n  }\n\n  let salt: Uint8Array;\n  let expectedHash: Uint8Array;\n  try {\n    salt = hexToBytes(saltHex);\n    expectedHash = hexToBytes(hashHex);\n  } catch {\n    return false;\n  }\n  if (\n    salt.length !== 32 ||\n    expectedHash.length !== PASSWORD_HASH_PARAMS.dkLen\n  ) {\n    return false;\n  }\n\n  const actualHash = await scryptAsync(password, salt, PASSWORD_HASH_PARAMS);\n  return constantTimeEqual(actualHash, expectedHash);\n}\n\nfunction hexToBytes(hex: string) {\n  if (hex.length % 2 !== 0) {\n    throw new Error(\"Invalid password hash\");\n  }\n  const bytes = new Uint8Array(hex.length / 2);\n  for (let i = 0; i < bytes.length; i++) {\n    const start = i * 2;\n    const value = Number.parseInt(hex.slice(start, start + 2), 16);\n    if (Number.isNaN(value)) {\n      throw new Error(\"Invalid password hash\");\n    }\n    bytes[i] = value;\n  }\n  return bytes;\n}\n\nfunction constantTimeEqual(left: Uint8Array, right: Uint8Array) {\n  if (left.length !== right.length) {\n    return false;\n  }\n  let diff = 0;\n  for (let i = 0; i < left.length; i++) {\n    diff |= left[i] ^ right[i];\n  }\n  return diff === 0;\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;AA2GA,MAAM,oBAAoB;CACxB,QAAQ;CACR,QAAQ;CACR,OAAO;CACP,sBAAsB;CACtB,sBAAsB;CACvB;AAID,SAAS,mBAAmB,MAAqC;AAC/D,KAAI,OAAO,SAAS,SAClB,QAAO;EAAE,KAAK;EAAW;EAAM;CAGjC,MAAM,MAAM,kBAAkB;AAC9B,QAAO,QAAQ,SAAY;EAAE,KAAK;EAAW;EAAM,GAAG,EAAE,KAAK;;;;;;;;;;;;;;;;;;;AAoB/D,IAAa,WAAb,MAA6E;CAC3E,AAAS;CACT,AAAS,OAAO;CAChB,AAAS;CAET,YACE,SAAoC,EAAE,EACtC;AACA,OAAK,KAAK,OAAO,MAAM;AACvB,OAAK,SAAS;;;CAIhB,kBAA2C;EACzC,MAAM,SAAS,KAAK;EACpB,MAAM,WAAW,KAAK;AAEtB,SAAO,IAAI,YAAuB;GAChC,IAAI;GACJ,WAAW,OAAO,QAAQ,QAAQ;IAChC,MAAM,eAAe,mBAAmB,OAAO,KAAK;IAEpD,MAAM,gCAAgC,aAAqB;AACzD,SAAI,OAAO,iCAAiC,QAAW;AACrD,aAAO,6BAA6B,SAAS;AAC7C;;AAEF,yCAAoC,SAAS;;AAG/C,UAAM,GAAG,IACP,GAAG,MAAM,cAAc,aAAa,KAAK;KACvC,cACE,GAAG,WAAW;AACZ,mCAA6B,OAAO,SAAmB;OACvD;KACJ,yBACE,GAAG,WAAW;AACZ,mCAA6B,OAAO,YAAsB;OAC1D;KACJ,cAAc,GAAG,QAAQ,OAAU;KACnC,aAAa,GAAG,QAAQ,OAAU;KAClC,yBAAyB,GAAG,QAAQ,OAAU;KAC9C,eAAe,GAAG,QAAQ,OAAU;KACrC,CAAC,CACH;IAED,MAAM,UAAU,OAAO,UAAU,QAAQ,IAAI,IAAI,eAAe,OAAO;IACvE,MAAM,EAAE,UAAU;IAClB,MAAM,wBACJ,OACA,SACG;AACH,SAAI,OAAO,UAAU,YAAY,MAAM,WAAW,EAChD,OAAM,IAAI,MAAM,oCAAoC,KAAK,SAAS;AAEpE,YAAO;;IAGT,MAAM,4BAA4B,OAChC,SACA,SACG;AACH,SAAI,OAAO,UAAU,CAAC,QAAQ,cAC5B,QAAO,MAAM,IAAI,KAAK,SAAS,OAC7B,KACA,OAAO,QACP;MACE,WAAW,QAAQ;MACnB;MACD,CACF;AAEH,YAAO,EAAE,QAAQ,KAAK,KAAK;;AAG7B,WAAO,MAAM,GAAG,IACd,GAAG,MAAM,cAAc,aAAa,KAAK;KACvC,cACE,GAAG,KAAK;MACN,IAAI,YAAY;OACd,MAAM,SAAS,qBACb,OAAO,UACP,SACD;OACD,MAAM,UAAU,MAAM,IAAI,KAAK,QAAQ,OAAO,KAAK;QACjD;QACA,SAAS;SAAE,IAAI;SAAO;SAAQ;QACrB;QACT,oBAAoB,OAAO,WAAW;QACtC,oBAAoB;QACrB,CAAC;AACF,cAAO,MAAM,0BACX,QAAQ,SACR,QAAQ,KACT;;MAEH,MAAM,MAAM;MACb,CAAC;KACJ,cACE,GAAG,KAAK;MACN,IAAI,YAAY;OACd,MAAM,SAAS,qBACb,OAAO,UACP,SACD;OACD,MAAM,YAAY,MAAM,IAAI,KAAK,QAAQ,IAAI,KAAK;QAChD;QACA,SAAS;SAAE,IAAI;SAAO;SAAQ;QAC/B,CAAC;AACF,WAAI,cAAc,KAChB,OAAM,IAAI,MAAM,sBAAsB;AAExC,cAAO,MAAM,0BACX,UAAU,SACV,UAAU,KACX;;MAEH,MAAM,MAAM;MACb,CAAC;KACJ,aACE,GAAG,KAAK;MACN,IAAI,YAAY;AACd,WAAI,CAAC,OAAO,MACV,OAAM,IAAI,MACR,qCAAqC,WACtC;OAEH,MAAM,EAAE,YAAY,MAAM,IAAI,KAAK,QAAQ,IAAI,KAAK;QAClD;QACA,SAAS,EAAE,IAAI,OAAO;QACvB,CAAC;AACF,cAAO,MAAM,IAAI,KAAK,SAAS,OAC7B,KACA,OAAO,OACP;QACE,WAAW,QAAQ;QACnB;QACD,CACF;;MAEH,MAAM,MAAM;MACb,CAAC;KACJ,yBACE,GAAG,KAAK;MACN,IAAI,YAAY;AACd,WAAI,CAAC,OAAO,MACV,OAAM,IAAI,MACR,qCAAqC,WACtC;AAEH,WAAI,OAAO,gBAAgB,OACzB,OAAM,IAAI,MACR,4DACD;OAEH,MAAM,SAAS,MAAM,IAAI,KAAK,SAAS,OACrC,KACA,OAAO,OACP,EAAE,QAAQ,CACX;AACD,WAAI,WAAW,KACb,OAAM,IAAI,MAAM,eAAe;OAEjC,MAAM,EAAE,QAAQ,cAAc;OAC9B,MAAM,SAAS,OAAO;AACtB,aAAM,IAAI,KAAK,QAAQ,OAAO,KAAK;QACjC;QACA,SAAS;SAAE,IAAI;SAAO;SAAQ;QAC/B,CAAC;AACF,aAAM,IAAI,KAAK,QAAQ,WAAW,KAAK;QACrC;QACA,QAAQ,CAAC,UAAU;QACpB,CAAC;AACF,cAAO;QAAE;QAAQ;QAAW;;MAE9B,MAAM,MAAM;MACb,CAAC;KACJ,yBACE,GAAG,KAAK;MACN,IAAI,YAAY;AACd,WAAI,CAAC,OAAO,OACV,OAAM,IAAI,MACR,yCAAyC,WAC1C;OAEH,MAAM,EAAE,YAAY,MAAM,IAAI,KAAK,QAAQ,IAAI,KAAK;QAClD;QACA,SAAS,EAAE,IAAI,OAAO;QACvB,CAAC;AACF,cAAO,MAAM,IAAI,KAAK,SAAS,OAC7B,KACA,OAAO,QACP;QACE,WAAW,QAAQ;QACnB;QACD,CACF;;MAEH,MAAM,MAAM;MACb,CAAC;KACJ,eACE,GAAG,sBACD,IAAI,MACF,+HAGD,CACF;KACJ,CAAC,CACH;;GAEH,QAAQ,OAAO,UAAU;IACvB,MAAM,WAAW,UAAkB;AACjC,YAAO,MAAM,aAAa,SAAS;;IAErC,MAAM,aAAa,UAAkB,MAAc;AACjD,YAAO,MAAM,eAAe,UAAU,KAAK;;IAE9C;GACD,gBAAgB,CACd,OAAO,OACP,OAAO,OACR;GACD,GAAG;GACJ,CAAC,CAAC,iBAAiB;;;AAQxB,SAAS,oCAAoC,UAAkB;AAC7D,KAAI,CAAC,YAAY,SAAS,SAAS,EACjC,OAAM,IAAI,MAAM,mBAAmB;;AAIvC,SAAS,eAAe,QAAiC;CACvD,MAAM,QAAQ,OAAO;AACrB,KAAI,OAAO,UAAU,YAAY,MAAM,MAAM,CAAC,WAAW,EACvD,OAAM,IAAI,MAAM,wBAAwB;AAE1C,QAAO,EACL,OACD;;AAGH,MAAM,uBAAuB;CAC3B,GAAG;CACH,GAAG;CACH,GAAG;CACH,OAAO;CACR;AAED,MAAM,uBAAuB,YAAY,qBAAqB,EAAE,KAAK,qBAAqB,EAAE,KAAK,qBAAqB,EAAE,SAAS,qBAAqB;AAEtJ,eAAe,aAAa,UAAkB;CAC5C,MAAM,OAAO,OAAO,gBAAgB,IAAI,WAAW,GAAG,CAAC;CACvD,MAAM,OAAO,MAAM,YAAY,UAAU,MAAM,qBAAqB;AACpE,QAAO,GAAG,qBAAqB,GAAG,WAAW,KAAK,CAAC,GAAG,WAAW,KAAK;;AAGxE,eAAe,eAAe,UAAkB,YAAoB;CAClE,MAAM,CAAC,QAAQ,SAAS,WAAW,WAAW,MAAM,IAAI;AACxD,KACE,WAAW,wBACX,YAAY,UACZ,YAAY,OAEZ,QAAO;CAGT,IAAI;CACJ,IAAI;AACJ,KAAI;AACF,SAAO,WAAW,QAAQ;AAC1B,iBAAe,WAAW,QAAQ;SAC5B;AACN,SAAO;;AAET,KACE,KAAK,WAAW,MAChB,aAAa,WAAW,qBAAqB,MAE7C,QAAO;AAIT,QAAO,kBADY,MAAM,YAAY,UAAU,MAAM,qBAAqB,EACrC,aAAa;;AAGpD,SAAS,WAAW,KAAa;AAC/B,KAAI,IAAI,SAAS,MAAM,EACrB,OAAM,IAAI,MAAM,wBAAwB;CAE1C,MAAM,QAAQ,IAAI,WAAW,IAAI,SAAS,EAAE;AAC5C,MAAK,IAAI,IAAI,GAAG,IAAI,MAAM,QAAQ,KAAK;EACrC,MAAM,QAAQ,IAAI;EAClB,MAAM,QAAQ,OAAO,SAAS,IAAI,MAAM,OAAO,QAAQ,EAAE,EAAE,GAAG;AAC9D,MAAI,OAAO,MAAM,MAAM,CACrB,OAAM,IAAI,MAAM,wBAAwB;AAE1C,QAAM,KAAK;;AAEb,QAAO;;AAGT,SAAS,kBAAkB,MAAkB,OAAmB;AAC9D,KAAI,KAAK,WAAW,MAAM,OACxB,QAAO;CAET,IAAI,OAAO;AACX,MAAK,IAAI,IAAI,GAAG,IAAI,KAAK,QAAQ,IAC/B,SAAQ,KAAK,KAAK,MAAM;AAE1B,QAAO,SAAS"}

package/dist/providers/phone.d.ts

@@ -1,19 +1,48 @@
-import { PhoneConfig, PhoneUserConfig } from "../server/types.js";
-import { GenericDataModel } from "convex/server";
+import { PhoneConfig } from "../server/types.js";
 
 //#region src/providers/phone.d.ts
 /**
- * Phone providers send a token to the user's phone number
- * for sign-in.
+ * User-facing configuration for the {@link Phone} provider.
  *
- * When you use this function to create your config, it
- * checks that there is a `phone` field during token verification
- * that matches the `phone` used during the initial `signIn` call.
+ * Use this to send SMS or other phone-based verification messages during
+ * sign-in.
+ */
+interface PhoneProviderConfig {
+  /** Send the verification code to the user's phone. */
+  send: PhoneConfig["sendVerificationRequest"];
+  /** Provider ID override. Defaults to "phone". */
+  id?: string;
+  /** Token expiration in seconds. Defaults to 1200 (20 minutes). */
+  maxAge?: number;
+}
+/**
+ * Phone provider for SMS or phone-number verification flows.
+ *
+ * Wraps your `send()` implementation and materializes the runtime behavior
+ * Convex Auth needs for short-code or magic-link-style phone verification.
+ *
+ * @example
+ * ```ts
+ * import { Phone } from "@robelest/convex-auth/providers";
  *
- * @param config - Phone provider options including `sendVerificationRequest`.
- * @returns A `PhoneConfig` to include in your `providers` array.
+ * const phone = new Phone({
+ *   send: async ({ identifier, token }) => {
+ *     await sms.send({ to: identifier, body: `Your sign-in code is ${token}` });
+ *   },
+ * });
+ * ```
  */
-declare function phone<DataModel extends GenericDataModel>(config: PhoneUserConfig & Pick<PhoneConfig, "sendVerificationRequest">): PhoneConfig<DataModel>;
+declare class Phone {
+  readonly config: PhoneProviderConfig;
+  readonly id: string;
+  readonly type: "phone";
+  /**
+   * Create a phone provider instance.
+   *
+   * @param config - Phone delivery and provider settings.
+   */
+  constructor(config: PhoneProviderConfig);
+}
 //#endregion
-export { phone as default };
+export { Phone, PhoneProviderConfig };
 //# sourceMappingURL=phone.d.ts.map

package/dist/providers/phone.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"phone.d.ts","names":[],"sources":["../../src/providers/phone.ts"],"mappings":";;;;;;;;;;;;;;;iBAyBwB,KAAA,mBAAwB,gBAAA,CAAA,CAC9C,MAAA,EAAQ,eAAA,GAAkB,IAAA,CAAK,WAAA,+BAC9B,WAAA,CAAY,SAAA"}
+{"version":3,"file":"phone.d.ts","names":[],"sources":["../../src/providers/phone.ts"],"mappings":";;;;;;;;;UAgBiB,mBAAA;EA0BJ;EAxBX,IAAA,EAAM,WAAA;;EAEN,EAAA;EA+B4B;EA7B5B,MAAA;AAAA;;;;;;;;;;;;;;;;;;cAoBW,KAAA;EAAA,SASiB,MAAA,EAAQ,mBAAA;EAAA,SAR3B,EAAA;EAAA,SACA,IAAA;;;;;;cAOmB,MAAA,EAAQ,mBAAA;AAAA"}

package/dist/providers/phone.js

@@ -1,29 +1,60 @@
+import { Fx } from "@robelest/fx";
+
 //#region src/providers/phone.ts
 /**
-* Phone providers send a token to the user's phone number
-* for sign-in.
+* Phone / SMS authentication provider.
+*
+* @module
+*/
+/**
+* Phone provider for SMS or phone-number verification flows.
+*
+* Wraps your `send()` implementation and materializes the runtime behavior
+* Convex Auth needs for short-code or magic-link-style phone verification.
 *
-* When you use this function to create your config, it
-* checks that there is a `phone` field during token verification
-* that matches the `phone` used during the initial `signIn` call.
+* @example
+* ```ts
+* import { Phone } from "@robelest/convex-auth/providers";
 *
-* @param config - Phone provider options including `sendVerificationRequest`.
-* @returns A `PhoneConfig` to include in your `providers` array.
+* const phone = new Phone({
+*   send: async ({ identifier, token }) => {
+*     await sms.send({ to: identifier, body: `Your sign-in code is ${token}` });
+*   },
+* });
+* ```
 */
-function phone(config) {
-	return {
-		id: "phone",
-		type: "phone",
-		maxAge: 1200,
-		authorize: async (params, account) => {
-			if (typeof params.phone !== "string") throw new Error("Token verification requires an `phone` in params of `signIn`.");
-			if (account.providerAccountId !== params.phone) throw new Error("Short verification code requires a matching `phone` in params of `signIn`.");
-		},
-		sendVerificationRequest: config.sendVerificationRequest,
-		options: config
-	};
-}
+var Phone = class {
+	id;
+	type = "phone";
+	/**
+	* Create a phone provider instance.
+	*
+	* @param config - Phone delivery and provider settings.
+	*/
+	constructor(config) {
+		this.config = config;
+		this.id = config.id ?? "phone";
+	}
+	/** @internal */
+	_toMaterialized() {
+		return {
+			id: this.id,
+			type: "phone",
+			maxAge: this.config.maxAge ?? 1200,
+			authorize: async (params, account) => {
+				const dispatch = typeof params.phone !== "string" ? { tag: "missingPhone" } : account.providerAccountId !== params.phone ? { tag: "mismatch" } : { tag: "ok" };
+				return await Fx.run(Fx.match(dispatch, dispatch.tag, {
+					missingPhone: () => Fx.fatal(/* @__PURE__ */ new Error("Token verification requires a `phone` in params of `signIn`.")),
+					mismatch: () => Fx.fatal(/* @__PURE__ */ new Error("Short verification code requires a matching `phone` in params of `signIn`.")),
+					ok: () => Fx.succeed(void 0)
+				}));
+			},
+			sendVerificationRequest: this.config.send,
+			options: {}
+		};
+	}
+};
 
 //#endregion
-export { phone as default };
+export { Phone };
 //# sourceMappingURL=phone.js.map

package/dist/providers/phone.js.map

@@ -1 +1 @@
-{"version":3,"file":"phone.js","names":[],"sources":["../../src/providers/phone.ts"],"sourcesContent":["/**\n * Configure {@link phone} provider given a {@link PhoneUserConfig}.\n *\n * Simplifies creating phone providers.\n *\n * By default checks that there is a `phone` field during token verification\n * that matches the `phone` used during the initial `signIn` call.\n *\n * @module\n */\n\nimport { GenericDataModel } from \"convex/server\";\nimport { PhoneConfig, PhoneUserConfig } from \"../server/types\";\n\n/**\n * Phone providers send a token to the user's phone number\n * for sign-in.\n *\n * When you use this function to create your config, it\n * checks that there is a `phone` field during token verification\n * that matches the `phone` used during the initial `signIn` call.\n *\n * @param config - Phone provider options including `sendVerificationRequest`.\n * @returns A `PhoneConfig` to include in your `providers` array.\n */\nexport default function phone<DataModel extends GenericDataModel>(\n  config: PhoneUserConfig & Pick<PhoneConfig, \"sendVerificationRequest\">,\n): PhoneConfig<DataModel> {\n  return {\n    id: \"phone\",\n    type: \"phone\",\n    maxAge: 60 * 20, // 20 minutes\n    authorize: async (params, account) => {\n      if (typeof params.phone !== \"string\") {\n        throw new Error(\n          \"Token verification requires an `phone` in params of `signIn`.\",\n        );\n      }\n      if (account.providerAccountId !== params.phone) {\n        throw new Error(\n          \"Short verification code requires a matching `phone` \" +\n            \"in params of `signIn`.\",\n        );\n      }\n    },\n    sendVerificationRequest: config.sendVerificationRequest,\n    options: config,\n  };\n}\n"],"mappings":";;;;;;;;;;;;AAyBA,SAAwB,MACtB,QACwB;AACxB,QAAO;EACL,IAAI;EACJ,MAAM;EACN,QAAQ;EACR,WAAW,OAAO,QAAQ,YAAY;AACpC,OAAI,OAAO,OAAO,UAAU,SAC1B,OAAM,IAAI,MACR,gEACD;AAEH,OAAI,QAAQ,sBAAsB,OAAO,MACvC,OAAM,IAAI,MACR,6EAED;;EAGL,yBAAyB,OAAO;EAChC,SAAS;EACV"}
+{"version":3,"file":"phone.js","names":[],"sources":["../../src/providers/phone.ts"],"sourcesContent":["/**\n * Phone / SMS authentication provider.\n *\n * @module\n */\n\nimport { Fx } from \"@robelest/fx\";\n\nimport type { PhoneConfig } from \"../server/types\";\n\n/**\n * User-facing configuration for the {@link Phone} provider.\n *\n * Use this to send SMS or other phone-based verification messages during\n * sign-in.\n */\nexport interface PhoneProviderConfig {\n  /** Send the verification code to the user's phone. */\n  send: PhoneConfig[\"sendVerificationRequest\"];\n  /** Provider ID override. Defaults to \"phone\". */\n  id?: string;\n  /** Token expiration in seconds. Defaults to 1200 (20 minutes). */\n  maxAge?: number;\n}\n\n/**\n * Phone provider for SMS or phone-number verification flows.\n *\n * Wraps your `send()` implementation and materializes the runtime behavior\n * Convex Auth needs for short-code or magic-link-style phone verification.\n *\n * @example\n * ```ts\n * import { Phone } from \"@robelest/convex-auth/providers\";\n *\n * const phone = new Phone({\n *   send: async ({ identifier, token }) => {\n *     await sms.send({ to: identifier, body: `Your sign-in code is ${token}` });\n *   },\n * });\n * ```\n */\nexport class Phone {\n  readonly id: string;\n  readonly type = \"phone\" as const;\n\n  /**\n   * Create a phone provider instance.\n   *\n   * @param config - Phone delivery and provider settings.\n   */\n  constructor(public readonly config: PhoneProviderConfig) {\n    this.id = config.id ?? \"phone\";\n  }\n\n  /** @internal */\n  _toMaterialized(): PhoneConfig {\n    return {\n      id: this.id,\n      type: \"phone\",\n      maxAge: this.config.maxAge ?? 60 * 20,\n      authorize: async (params, account) => {\n        const dispatch =\n          typeof params.phone !== \"string\"\n            ? ({ tag: \"missingPhone\" } as const)\n            : account.providerAccountId !== params.phone\n              ? ({ tag: \"mismatch\" } as const)\n              : ({ tag: \"ok\" } as const);\n\n        return await Fx.run(\n          Fx.match(dispatch, dispatch.tag, {\n            missingPhone: () =>\n              Fx.fatal(\n                new Error(\n                  \"Token verification requires a `phone` in params of `signIn`.\",\n                ),\n              ),\n            mismatch: () =>\n              Fx.fatal(\n                new Error(\n                  \"Short verification code requires a matching `phone` \" +\n                    \"in params of `signIn`.\",\n                ),\n              ),\n            ok: () => Fx.succeed(undefined),\n          }),\n        );\n      },\n      sendVerificationRequest: this.config.send,\n      options: {} as any,\n    };\n  }\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;AA0CA,IAAa,QAAb,MAAmB;CACjB,AAAS;CACT,AAAS,OAAO;;;;;;CAOhB,YAAY,AAAgB,QAA6B;EAA7B;AAC1B,OAAK,KAAK,OAAO,MAAM;;;CAIzB,kBAA+B;AAC7B,SAAO;GACL,IAAI,KAAK;GACT,MAAM;GACN,QAAQ,KAAK,OAAO,UAAU;GAC9B,WAAW,OAAO,QAAQ,YAAY;IACpC,MAAM,WACJ,OAAO,OAAO,UAAU,WACnB,EAAE,KAAK,gBAAgB,GACxB,QAAQ,sBAAsB,OAAO,QAClC,EAAE,KAAK,YAAY,GACnB,EAAE,KAAK,MAAM;AAEtB,WAAO,MAAM,GAAG,IACd,GAAG,MAAM,UAAU,SAAS,KAAK;KAC/B,oBACE,GAAG,sBACD,IAAI,MACF,+DACD,CACF;KACH,gBACE,GAAG,sBACD,IAAI,MACF,6EAED,CACF;KACH,UAAU,GAAG,QAAQ,OAAU;KAChC,CAAC,CACH;;GAEH,yBAAyB,KAAK,OAAO;GACrC,SAAS,EAAE;GACZ"}

package/dist/providers/sso.d.ts

@@ -0,0 +1,50 @@
+//#region src/providers/sso.d.ts
+/**
+ * Enterprise SSO provider (OIDC + SAML + SCIM).
+ *
+ * Adding `new SSO()` to your providers list enables enterprise SSO
+ * sign-in flows and registers the OIDC, SAML, and SCIM runtime HTTP
+ * routes. It also makes `auth.sso.*` available on the auth
+ * object returned by `createAuth`.
+ *
+ * ```ts
+ * import { SSO } from "@robelest/convex-auth/providers";
+ *
+ * const auth = createAuth(components.auth, {
+ *   providers: [new SSO(), new Password()],
+ * });
+ *
+ * // auth.sso is now available
+ * await auth.sso.admin.oidc.configure(ctx, { enterpriseId, clientId, ... });
+ * ```
+ *
+ * Without `new SSO()` in the providers list, `auth.sso` is not
+ * present on the returned object and accessing it is a TypeScript error.
+ *
+ * @module
+ */
+/**
+ * Enterprise SSO provider.
+ *
+ * Zero-configuration — sensible defaults are applied for all enterprise
+ * protocols (OIDC, SAML, SCIM). Per-tenant configuration is done at
+ * runtime via `auth.sso.*` helpers.
+ *
+ * @example
+ * ```ts
+ * import { createAuth } from "@robelest/convex-auth/component";
+ * import { SSO, Password } from "@robelest/convex-auth/providers";
+ * import { components } from "./_generated/api";
+ *
+ * export const auth = createAuth(components.auth, {
+ *   providers: [new SSO(), new Password()],
+ * });
+ * ```
+ */
+declare class SSO {
+  readonly id = "enterprise-sso";
+  readonly type: "sso";
+}
+//#endregion
+export { SSO };
+//# sourceMappingURL=sso.d.ts.map

package/dist/providers/sso.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sso.d.ts","names":[],"sources":["../../src/providers/sso.ts"],"mappings":";;AA6CA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;cAAa,GAAA;EAAA,SACF,EAAA;EAAA,SACA,IAAA;AAAA"}