@robelest/convex-auth 0.0.4-preview.2 → 0.0.4-preview.21

package/dist/server/core.js

@@ -0,0 +1,713 @@
+import { TOKEN_SUB_CLAIM_DIVIDER, generateRandomString, sha256 } from "./utils.js";
+import { buildScopeChecker, checkKeyRateLimit, generateApiKey, hashApiKey } from "./keys.js";
+import { materializeProvider } from "./config.js";
+import { signInImpl } from "./signin.js";
+
+//#region src/server/core.ts
+/**
+* Build the core auth domains that back the canonical app API surface.
+*
+* Creates the grouped `user`, `session`, `account`, `provider`, `group`,
+* `member`, `invite`, and `key` APIs used by the higher-level auth
+* factory. Each namespace wraps the underlying Convex component functions with
+* application-friendly helpers, result shaping, and documentation-friendly
+* method names.
+*
+* @param deps - Internal component wiring, provider config, and helper
+*   functions needed to construct the domain API surface.
+* @returns The core domain namespaces consumed by the auth factory.
+*/
+function createCoreDomains(deps) {
+	const { config, getAuth, callInvalidateSessions, callCreateAccountFromCredentials, callRetrieveAccountWithCredentials, callModifyAccount, getEnrichCtx, inviteTokenAlphabet, inviteTokenLength } = deps;
+	const roleDefinitions = config.authorization.roles;
+	const getRoleDefinition = (roleId) => {
+		return roleDefinitions[roleId] ?? null;
+	};
+	const normalizeRoleIds = (roleIds) => {
+		const normalized = Array.from(new Set(roleIds ?? []));
+		const invalid = normalized.filter((id) => getRoleDefinition(id) === null);
+		if (invalid.length > 0) return {
+			ok: false,
+			invalidRoleIds: invalid
+		};
+		return {
+			ok: true,
+			roleIds: normalized
+		};
+	};
+	const listAllKeysByUser = async (ctx, userId) => {
+		const items = [];
+		let cursor = null;
+		do {
+			const page = await ctx.runQuery(config.component.public.keyList, {
+				where: { userId },
+				limit: 100,
+				cursor
+			});
+			items.push(...page.items);
+			cursor = page.nextCursor;
+		} while (cursor !== null);
+		return items;
+	};
+	const listAllMembersByUser = async (ctx, userId) => {
+		const items = [];
+		let cursor = null;
+		do {
+			const page = await ctx.runQuery(config.component.public.memberList, {
+				where: { userId },
+				limit: 100,
+				cursor
+			});
+			items.push(...page.items);
+			cursor = page.nextCursor;
+		} while (cursor !== null);
+		return items;
+	};
+	const resolveGrantedPermissions = (roleIds) => {
+		const grants = /* @__PURE__ */ new Set();
+		for (const roleId of roleIds ?? []) {
+			const role = getRoleDefinition(roleId);
+			if (role === null) continue;
+			for (const grant of role.grants) grants.add(grant);
+		}
+		return Array.from(grants).sort();
+	};
+	const AUTH_CACHE = Symbol("__convexAuthCache");
+	function cache(ctx) {
+		if (!ctx[AUTH_CACHE]) ctx[AUTH_CACHE] = {
+			users: /* @__PURE__ */ new Map(),
+			groups: /* @__PURE__ */ new Map()
+		};
+		return ctx[AUTH_CACHE];
+	}
+	const user = {
+		id: async (ctx, request) => {
+			const identity = await ctx.auth.getUserIdentity();
+			if (identity !== null) {
+				const [userId] = identity.subject.split(TOKEN_SUB_CLAIM_DIVIDER);
+				return userId;
+			}
+			if (request !== void 0 && "runMutation" in ctx && ctx.runMutation) {
+				const authHeader = request.headers.get("Authorization");
+				if (authHeader?.startsWith("Bearer sk_")) {
+					const rawKey = authHeader.slice(7);
+					const result = await getAuth().key.verify(ctx, rawKey);
+					if (result.ok) return result.userId;
+					return null;
+				}
+			}
+			return null;
+		},
+		get: async (ctx, userId) => {
+			const c = cache(ctx);
+			if (c.users.has(userId)) return c.users.get(userId);
+			const result = await ctx.runQuery(config.component.public.userGetById, { userId });
+			c.users.set(userId, result);
+			return result;
+		},
+		list: async (ctx, opts = {}) => {
+			return await ctx.runQuery(config.component.public.userList, opts);
+		},
+		viewer: async (ctx) => {
+			const userId = await user.id(ctx);
+			if (userId === null) return null;
+			return await user.get(ctx, userId);
+		},
+		update: async (ctx, userId, data) => {
+			await ctx.runMutation(config.component.public.userPatch, {
+				userId,
+				data
+			});
+			return {
+				ok: true,
+				userId
+			};
+		},
+		setActiveGroup: async (ctx, opts) => {
+			const doc = await user.get(ctx, opts.userId);
+			const existingExtend = doc !== null && doc.extend !== null && typeof doc.extend === "object" && !Array.isArray(doc.extend) ? { ...doc.extend } : {};
+			if (opts.groupId === null) {
+				const { lastActiveGroup: _omit, ...rest } = existingExtend;
+				await user.update(ctx, opts.userId, { extend: rest });
+				return {
+					ok: true,
+					userId: opts.userId,
+					groupId: null
+				};
+			}
+			await user.update(ctx, opts.userId, { extend: {
+				...existingExtend,
+				lastActiveGroup: opts.groupId
+			} });
+			return {
+				ok: true,
+				userId: opts.userId,
+				groupId: opts.groupId
+			};
+		},
+		getActiveGroup: async (ctx, opts) => {
+			const doc = await user.get(ctx, opts.userId);
+			if (doc !== null && doc.extend !== null && typeof doc.extend === "object" && !Array.isArray(doc.extend)) {
+				const val = doc.extend.lastActiveGroup;
+				if (typeof val === "string") return val;
+			}
+			return null;
+		},
+		delete: async (ctx, userId, opts) => {
+			const cascade = opts?.cascade !== false;
+			const [sessions, accounts, keys, members, passkeys, totps] = await Promise.all([
+				ctx.runQuery(config.component.public.sessionListByUser, { userId }),
+				ctx.runQuery(config.component.public.accountListByUser, { userId }),
+				listAllKeysByUser(ctx, userId),
+				listAllMembersByUser(ctx, userId),
+				ctx.runQuery(config.component.public.passkeyListByUserId, { userId }),
+				ctx.runQuery(config.component.public.totpListByUserId, { userId })
+			]);
+			const totalLinked = sessions.length + accounts.length + keys.length + members.length + passkeys.length + totps.length;
+			if (!cascade && totalLinked > 0) return {
+				ok: false,
+				code: "INVALID_PARAMETERS"
+			};
+			const deletions = [];
+			for (const s of sessions) deletions.push(ctx.runMutation(config.component.public.sessionDelete, { sessionId: s._id }));
+			for (const a of accounts) deletions.push(ctx.runMutation(config.component.public.accountDelete, { accountId: a._id }));
+			for (const k of keys) deletions.push(ctx.runMutation(config.component.public.keyDelete, { keyId: k._id }));
+			for (const m of members) deletions.push(ctx.runMutation(config.component.public.memberRemove, { memberId: m._id }));
+			for (const p of passkeys) deletions.push(ctx.runMutation(config.component.public.passkeyDelete, { passkeyId: p._id }));
+			for (const t of totps) deletions.push(ctx.runMutation(config.component.public.totpDelete, { totpId: t._id }));
+			await Promise.all(deletions);
+			await ctx.runMutation(config.component.public.userDelete, { userId });
+			return {
+				ok: true,
+				userId
+			};
+		}
+	};
+	const session = {
+		current: async (ctx) => {
+			const identity = await ctx.auth.getUserIdentity();
+			if (identity === null) return null;
+			const [, sessionId] = identity.subject.split(TOKEN_SUB_CLAIM_DIVIDER);
+			return sessionId;
+		},
+		invalidate: async (ctx, args) => {
+			await callInvalidateSessions(ctx, args);
+			return {
+				ok: true,
+				userId: args.userId,
+				except: args.except ?? []
+			};
+		},
+		get: async (ctx, sessionId) => {
+			return await ctx.runQuery(config.component.public.sessionGetById, { sessionId });
+		},
+		list: async (ctx, opts) => {
+			return await ctx.runQuery(config.component.public.sessionListByUser, { userId: opts.userId });
+		}
+	};
+	const account = {
+		create: async (ctx, args) => {
+			return {
+				ok: true,
+				...await callCreateAccountFromCredentials(ctx, args)
+			};
+		},
+		get: async (ctx, args) => {
+			const result = await callRetrieveAccountWithCredentials(ctx, args);
+			if (typeof result === "string") return null;
+			return result;
+		},
+		update: async (ctx, args) => {
+			await callModifyAccount(ctx, args);
+			return {
+				ok: true,
+				accountId: args.account.id
+			};
+		},
+		delete: async (ctx, accountId) => {
+			const doc = await ctx.runQuery(config.component.public.accountGetById, { accountId });
+			if (doc === null) return {
+				ok: false,
+				code: "ACCOUNT_NOT_FOUND"
+			};
+			if ((await ctx.runQuery(config.component.public.accountListByUser, { userId: doc.userId })).length <= 1) return {
+				ok: false,
+				code: "INVALID_PARAMETERS"
+			};
+			await ctx.runMutation(config.component.public.accountDelete, { accountId });
+			return {
+				ok: true,
+				accountId
+			};
+		},
+		listPasskeys: async (ctx, opts) => {
+			return await ctx.runQuery(config.component.public.passkeyListByUserId, opts);
+		},
+		renamePasskey: async (ctx, passkeyId, name) => {
+			await ctx.runMutation(config.component.public.passkeyUpdateMeta, {
+				passkeyId,
+				data: { name }
+			});
+			return {
+				ok: true,
+				passkeyId
+			};
+		},
+		deletePasskey: async (ctx, passkeyId) => {
+			await ctx.runMutation(config.component.public.passkeyDelete, { passkeyId });
+			return {
+				ok: true,
+				passkeyId
+			};
+		},
+		listTotps: async (ctx, opts) => {
+			return await ctx.runQuery(config.component.public.totpListByUserId, opts);
+		},
+		deleteTotp: async (ctx, totpId) => {
+			await ctx.runMutation(config.component.public.totpDelete, { totpId });
+			return {
+				ok: true,
+				totpId
+			};
+		}
+	};
+	const provider = { signIn: async (ctx, providerConfig, args) => {
+		const result = await signInImpl(getEnrichCtx()(ctx), materializeProvider(providerConfig), args, {
+			generateTokens: false,
+			allowExtraProviders: true
+		});
+		return result.kind === "signedIn" ? result.signedIn !== null ? {
+			userId: result.signedIn.userId,
+			sessionId: result.signedIn.sessionId
+		} : null : null;
+	} };
+	const group = {
+		create: async (ctx, data) => {
+			return {
+				ok: true,
+				groupId: await ctx.runMutation(config.component.public.groupCreate, data)
+			};
+		},
+		get: async (ctx, groupId) => {
+			const c = cache(ctx);
+			if (c.groups.has(groupId)) return c.groups.get(groupId);
+			const result = await ctx.runQuery(config.component.public.groupGet, { groupId });
+			c.groups.set(groupId, result);
+			return result;
+		},
+		list: async (ctx, opts) => {
+			return await ctx.runQuery(config.component.public.groupList, {
+				where: opts?.where,
+				limit: opts?.limit,
+				cursor: opts?.cursor,
+				orderBy: opts?.orderBy,
+				order: opts?.order
+			});
+		},
+		update: async (ctx, groupId, data) => {
+			await ctx.runMutation(config.component.public.groupUpdate, {
+				groupId,
+				data
+			});
+			return {
+				ok: true,
+				groupId
+			};
+		},
+		delete: async (ctx, groupId) => {
+			await ctx.runMutation(config.component.public.groupDelete, { groupId });
+			return {
+				ok: true,
+				groupId
+			};
+		},
+		ancestors: async (ctx, opts) => {
+			const maxDepth = Math.max(0, Math.floor(opts.maxDepth ?? 32));
+			const visited = /* @__PURE__ */ new Set();
+			const ancestors = [];
+			let cycleDetected = false;
+			let maxDepthReached = false;
+			let currentGroupId = opts.groupId;
+			let depth = 0;
+			let isFirst = true;
+			while (currentGroupId !== void 0) {
+				if (depth > maxDepth) {
+					maxDepthReached = true;
+					break;
+				}
+				if (visited.has(currentGroupId)) {
+					cycleDetected = true;
+					break;
+				}
+				visited.add(currentGroupId);
+				const doc = await group.get(ctx, currentGroupId);
+				if (doc === null) break;
+				if (isFirst) {
+					isFirst = false;
+					if (opts.includeSelf) ancestors.push(doc);
+					currentGroupId = doc.parentGroupId;
+					depth += 1;
+					continue;
+				}
+				ancestors.push(doc);
+				currentGroupId = doc.parentGroupId;
+				depth += 1;
+			}
+			return {
+				ancestors,
+				cycleDetected,
+				maxDepthReached
+			};
+		}
+	};
+	const member = {
+		create: async (ctx, data) => {
+			const normalized = normalizeRoleIds(data.roleIds);
+			if (!normalized.ok) return {
+				ok: false,
+				code: "INVALID_ROLE_IDS",
+				invalidRoleIds: normalized.invalidRoleIds
+			};
+			return {
+				ok: true,
+				memberId: await ctx.runMutation(config.component.public.memberAdd, {
+					...data,
+					roleIds: normalized.roleIds
+				})
+			};
+		},
+		get: async (ctx, memberId) => {
+			return await ctx.runQuery(config.component.public.memberGet, { memberId });
+		},
+		list: async (ctx, opts) => {
+			return await ctx.runQuery(config.component.public.memberList, {
+				where: opts?.where,
+				limit: opts?.limit,
+				cursor: opts?.cursor,
+				orderBy: opts?.orderBy,
+				order: opts?.order
+			});
+		},
+		delete: async (ctx, memberId) => {
+			await ctx.runMutation(config.component.public.memberRemove, { memberId });
+			return {
+				ok: true,
+				memberId
+			};
+		},
+		update: async (ctx, memberId, data) => {
+			const nextData = { ...data };
+			if ("roleIds" in nextData) {
+				const normalized = normalizeRoleIds(Array.isArray(nextData.roleIds) ? nextData.roleIds : void 0);
+				if (!normalized.ok) return {
+					ok: false,
+					code: "INVALID_ROLE_IDS",
+					invalidRoleIds: normalized.invalidRoleIds
+				};
+				nextData.roleIds = normalized.roleIds;
+			}
+			await ctx.runMutation(config.component.public.memberUpdate, {
+				memberId,
+				data: nextData
+			});
+			return {
+				ok: true,
+				memberId
+			};
+		},
+		resolve: async (ctx, opts) => {
+			const normalized = normalizeRoleIds(opts.roleIds);
+			if (!normalized.ok) return {
+				ok: false,
+				membership: null,
+				matchedGroupId: null,
+				roleIds: [],
+				grants: [],
+				missingGrants: Array.from(new Set(opts.grants ?? [])),
+				depth: null,
+				isDirect: false,
+				isInherited: false,
+				traversedGroupIds: [],
+				code: "INVALID_ROLE_IDS",
+				invalidRoleIds: normalized.invalidRoleIds
+			};
+			const requestedRoleIds = normalized.roleIds;
+			const roleFilter = requestedRoleIds.length > 0 ? new Set(requestedRoleIds) : null;
+			const requiredGrants = Array.from(new Set(opts.grants ?? []));
+			const useAncestry = opts.ancestry === true;
+			let membership = null;
+			let matchedGroupId = null;
+			let depth = null;
+			let isDirect = false;
+			let isInherited = false;
+			let traversedGroupIds = [];
+			if (useAncestry) {
+				const maxDepth = Math.max(0, Math.floor(opts.maxDepth ?? 32));
+				const result = await ctx.runQuery(config.component.public.memberResolve, {
+					userId: opts.userId,
+					groupId: opts.groupId,
+					maxDepth,
+					ancestry: true
+				});
+				membership = result.membership;
+				matchedGroupId = result.matchedGroupId;
+				depth = result.depth;
+				isDirect = result.isDirect;
+				isInherited = result.isInherited;
+				traversedGroupIds = result.traversedGroupIds ?? [];
+			} else {
+				const doc = await ctx.runQuery(config.component.public.memberGetByGroupAndUser, {
+					userId: opts.userId,
+					groupId: opts.groupId
+				});
+				membership = doc;
+				matchedGroupId = doc ? opts.groupId : null;
+				depth = doc ? 0 : null;
+				isDirect = doc !== null;
+			}
+			if (membership === null) return {
+				ok: false,
+				membership: null,
+				matchedGroupId: null,
+				roleIds: [],
+				grants: [],
+				missingGrants: requiredGrants,
+				depth: null,
+				isDirect: false,
+				isInherited: false,
+				traversedGroupIds
+			};
+			const membershipRoleIds = membership.roleIds ?? [];
+			const membershipGrants = resolveGrantedPermissions(membershipRoleIds);
+			if (roleFilter !== null && !membershipRoleIds.some((roleId) => roleFilter.has(roleId))) return {
+				ok: false,
+				membership: null,
+				matchedGroupId: null,
+				roleIds: [],
+				grants: [],
+				missingGrants: requiredGrants,
+				depth: null,
+				isDirect: false,
+				isInherited: false,
+				traversedGroupIds
+			};
+			const missingGrants = requiredGrants.filter((grant) => !membershipGrants.includes(grant));
+			return {
+				ok: missingGrants.length === 0,
+				membership,
+				matchedGroupId,
+				roleIds: membershipRoleIds,
+				grants: membershipGrants,
+				missingGrants,
+				depth,
+				isDirect,
+				isInherited,
+				traversedGroupIds
+			};
+		}
+	};
+	const invite = {
+		create: async (ctx, data) => {
+			const normalized = normalizeRoleIds(data.roleIds);
+			if (!normalized.ok) return {
+				ok: false,
+				code: "INVALID_ROLE_IDS",
+				invalidRoleIds: normalized.invalidRoleIds
+			};
+			const token = generateRandomString(inviteTokenLength, inviteTokenAlphabet);
+			const tokenHash = await sha256(token);
+			return {
+				ok: true,
+				inviteId: await ctx.runMutation(config.component.public.inviteCreate, {
+					...data,
+					roleIds: normalized.roleIds,
+					tokenHash,
+					status: "pending"
+				}),
+				token
+			};
+		},
+		get: async (ctx, inviteId) => {
+			return await ctx.runQuery(config.component.public.inviteGet, { inviteId });
+		},
+		token: {
+			get: async (ctx, token) => {
+				const tokenHash = await sha256(token);
+				return await ctx.runQuery(config.component.public.inviteGetByTokenHash, { tokenHash });
+			},
+			accept: async (ctx, args) => {
+				const tokenHash = await sha256(args.token);
+				return {
+					ok: true,
+					...await ctx.runMutation(config.component.public.inviteAcceptByToken, {
+						tokenHash,
+						acceptedByUserId: args.acceptedByUserId
+					})
+				};
+			}
+		},
+		list: async (ctx, opts) => {
+			return await ctx.runQuery(config.component.public.inviteList, {
+				where: opts?.where,
+				limit: opts?.limit,
+				cursor: opts?.cursor,
+				orderBy: opts?.orderBy,
+				order: opts?.order
+			});
+		},
+		accept: async (ctx, inviteId, acceptedByUserId) => {
+			await ctx.runMutation(config.component.public.inviteAccept, {
+				inviteId,
+				...acceptedByUserId ? { acceptedByUserId } : {}
+			});
+			return {
+				ok: true,
+				inviteId,
+				acceptedByUserId: acceptedByUserId ?? null
+			};
+		},
+		revoke: async (ctx, inviteId) => {
+			await ctx.runMutation(config.component.public.inviteRevoke, { inviteId });
+			return {
+				ok: true,
+				inviteId
+			};
+		}
+	};
+	const key = {
+		create: async (ctx, opts) => {
+			const { raw, hashedKey, displayPrefix } = await generateApiKey("sk_");
+			return {
+				ok: true,
+				keyId: await ctx.runMutation(config.component.public.keyInsert, {
+					userId: opts.userId,
+					prefix: displayPrefix,
+					hashedKey,
+					name: opts.name,
+					scopes: opts.scopes,
+					rateLimit: opts.rateLimit,
+					expiresAt: opts.expiresAt,
+					metadata: opts.metadata
+				}),
+				secret: raw
+			};
+		},
+		verify: async (ctx, rawKey) => {
+			const hashedKey = await hashApiKey(rawKey);
+			const doc = await ctx.runQuery(config.component.public.keyGetByHashedKey, { hashedKey });
+			if (!doc) return {
+				ok: false,
+				code: "INVALID_API_KEY"
+			};
+			const k = doc;
+			if (k.revoked) return {
+				ok: false,
+				code: "API_KEY_REVOKED"
+			};
+			if (k.expiresAt && k.expiresAt < Date.now()) return {
+				ok: false,
+				code: "API_KEY_EXPIRED"
+			};
+			const patchData = { lastUsedAt: Date.now() };
+			if (k.rateLimit) {
+				const { limited, newState } = checkKeyRateLimit(k.rateLimit, k.rateLimitState ?? void 0);
+				if (limited) return {
+					ok: false,
+					code: "API_KEY_RATE_LIMITED"
+				};
+				patchData.rateLimitState = newState;
+			}
+			await ctx.runMutation(config.component.public.keyPatch, {
+				keyId: k._id,
+				data: patchData
+			});
+			return {
+				ok: true,
+				userId: k.userId,
+				keyId: k._id,
+				scopes: buildScopeChecker(k.scopes)
+			};
+		},
+		list: async (ctx, opts) => {
+			return await ctx.runQuery(config.component.public.keyList, {
+				where: opts?.where,
+				limit: opts?.limit,
+				cursor: opts?.cursor,
+				orderBy: opts?.orderBy,
+				order: opts?.order
+			});
+		},
+		get: async (ctx, keyId) => {
+			const doc = await ctx.runQuery(config.component.public.keyGetById, { keyId });
+			if (!doc) return { ok: false };
+			return {
+				ok: true,
+				key: doc
+			};
+		},
+		update: async (ctx, keyId, data) => {
+			await ctx.runMutation(config.component.public.keyPatch, {
+				keyId,
+				data
+			});
+			return {
+				ok: true,
+				keyId
+			};
+		},
+		revoke: async (ctx, keyId) => {
+			await ctx.runMutation(config.component.public.keyPatch, {
+				keyId,
+				data: { revoked: true }
+			});
+			return {
+				ok: true,
+				keyId
+			};
+		},
+		delete: async (ctx, keyId) => {
+			await ctx.runMutation(config.component.public.keyDelete, { keyId });
+			return {
+				ok: true,
+				keyId
+			};
+		},
+		rotate: async (ctx, keyId, opts) => {
+			const existing = await ctx.runQuery(config.component.public.keyGetById, { keyId });
+			if (!existing) return {
+				ok: false,
+				code: "INVALID_PARAMETERS"
+			};
+			if (existing.revoked === true) return {
+				ok: false,
+				code: "API_KEY_REVOKED"
+			};
+			await ctx.runMutation(config.component.public.keyPatch, {
+				keyId,
+				data: { revoked: true }
+			});
+			return await key.create(ctx, {
+				userId: existing.userId,
+				name: opts?.name ?? existing.name,
+				scopes: existing.scopes ?? [],
+				rateLimit: existing.rateLimit,
+				expiresAt: opts?.expiresAt,
+				metadata: existing.metadata
+			});
+		}
+	};
+	return {
+		user,
+		session,
+		account,
+		provider,
+		group,
+		member,
+		invite,
+		key
+	};
+}
+
+//#endregion
+export { createCoreDomains };
+//# sourceMappingURL=core.js.map