@robelest/convex-auth 0.0.4-preview.2 → 0.0.4-preview.21

package/dist/server/identity.js

@@ -0,0 +1,13 @@
+import { AuthError } from "./authError.js";
+
+//#region src/server/identity.ts
+/** @internal */
+function userIdFromIdentitySubject(subject) {
+	const [userId, ...rest] = subject.split("|");
+	if (typeof userId !== "string" || userId.length === 0 || rest.length === 0 || rest.some((segment) => segment.length === 0)) throw new AuthError("INTERNAL_ERROR", "Authenticated identity subject is malformed.");
+	return userId;
+}
+
+//#endregion
+export { userIdFromIdentitySubject };
+//# sourceMappingURL=identity.js.map

package/dist/server/identity.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"identity.js","names":[],"sources":["../../src/server/identity.ts"],"sourcesContent":["import { AuthError } from \"./authError\";\n\n/** @internal */\nexport function userIdFromIdentitySubject(subject: string): string {\n  const [userId, ...rest] = subject.split(\"|\");\n  if (\n    typeof userId !== \"string\" ||\n    userId.length === 0 ||\n    rest.length === 0 ||\n    rest.some((segment) => segment.length === 0)\n  ) {\n    throw new AuthError(\n      \"INTERNAL_ERROR\",\n      \"Authenticated identity subject is malformed.\",\n    );\n  }\n  return userId;\n}\n"],"mappings":";;;;AAGA,SAAgB,0BAA0B,SAAyB;CACjE,MAAM,CAAC,QAAQ,GAAG,QAAQ,QAAQ,MAAM,IAAI;AAC5C,KACE,OAAO,WAAW,YAClB,OAAO,WAAW,KAClB,KAAK,WAAW,KAChB,KAAK,MAAM,YAAY,QAAQ,WAAW,EAAE,CAE5C,OAAM,IAAI,UACR,kBACA,+CACD;AAEH,QAAO"}

package/dist/server/index.d.ts

@@ -1,182 +1,4 @@
-//#region src/server/index.d.ts
-/** Cookie lifetime configuration for auth tokens. */
-type AuthCookieConfig = {
-  /** Maximum age in seconds, or `null` for session cookies. */maxAge: number | null;
-};
-/** Raw cookie values extracted from a request. */
-type AuthCookies = {
-  /** The JWT access token, or `null` when absent. */token: string | null; /** The refresh token, or `null` when absent. */
-  refreshToken: string | null; /** The OAuth PKCE verifier, or `null` when absent. */
-  verifier: string | null;
-};
-/** A structured cookie ready to be set via any framework's cookie API. */
-type AuthCookie = {
-  name: string;
-  value: string;
-  options: {
-    path: string;
-    httpOnly: boolean;
-    secure: boolean;
-    sameSite: "lax" | "strict" | "none";
-    maxAge?: number;
-    expires?: Date;
-  };
-};
-/**
- * Options for the SSR auth helper returned by {@link server}.
- */
-type ServerOptions = {
-  /** Convex deployment URL (e.g. `https://your-app.convex.cloud`). */url: string;
-  /**
-   * Path the client POSTs auth actions to. Defaults to `"/api/auth"`.
-   * Must match the `proxy` option on the client.
-   */
-  apiRoute?: string; /** Cookie `maxAge` in seconds, or `null` for session cookies. */
-  cookieMaxAge?: number | null; /** Enable verbose debug logging for token refresh and cookie operations. */
-  verbose?: boolean;
-  /**
-   * Control whether `refresh()` handles OAuth `?code=` query parameters.
-   *
-   * - `true` (default): always exchange the code on GET requests with `text/html` accept.
-   * - `false`: never exchange — useful when only the client handles codes.
-   * - A function: called with the `Request` for per-request decisions.
-   */
-  shouldHandleCode?: ((request: Request) => boolean | Promise<boolean>) | boolean;
-};
-type RefreshResult = {
-  /** Structured cookies to set on the response. */cookies: AuthCookie[]; /** URL to redirect to (set after OAuth code exchange). */
-  redirect?: string; /** JWT for SSR hydration, or `null` if not authenticated. */
-  token: string | null;
-};
-/**
- * Derive the cookie names used for auth tokens.
- *
- * On localhost the names are unprefixed; on production hosts they
- * use the `__Host-` prefix for tighter security.
- *
- * @param host - The `Host` header value. Omit to use unprefixed names.
- * @returns An object with `token`, `refreshToken`, and `verifier` cookie names.
- */
-declare function authCookieNames(host?: string): {
-  token: string;
-  refreshToken: string;
-  verifier: string;
-};
-/**
- * Parse auth cookie values from a raw `Cookie` header string.
- *
- * @param cookieHeader - The raw `Cookie` header, or `null`/`undefined`.
- * @param host - The `Host` header, used to determine cookie name prefixes.
- * @returns Parsed {@link AuthCookies} with `token`, `refreshToken`, and `verifier`.
- */
-declare function parseAuthCookies(cookieHeader: string | null | undefined, host?: string): AuthCookies;
-/**
- * Serialize auth cookies into `Set-Cookie` header strings.
- *
- * Nulled-out values produce deletion cookies (maxAge 0, expired date).
- *
- * @param cookies - The auth cookie values to serialize.
- * @param host - The `Host` header, used for cookie name prefixes and `Secure` flag.
- * @param config - Cookie lifetime config. Defaults to session cookies.
- * @returns An array of three `Set-Cookie` header strings.
- */
-declare function serializeAuthCookies(cookies: AuthCookies, host?: string, config?: AuthCookieConfig): string[];
-/**
- * Build structured cookie objects for any SSR framework.
- *
- * Use with SvelteKit's `event.cookies.set()`, TanStack Start's `setCookie()`,
- * Next.js's `cookies().set()`, or any other framework cookie API.
- */
-declare function structuredAuthCookies(cookies: AuthCookies, host?: string, config?: AuthCookieConfig): AuthCookie[];
-/**
- * Check whether a request pathname matches the auth proxy route.
- *
- * Handles trailing-slash ambiguity: both `/api/auth` and `/api/auth/`
- * match regardless of how `apiRoute` is configured.
- *
- * @param pathname - The request URL pathname.
- * @param apiRoute - The configured proxy route (e.g. `"/api/auth"`).
- * @returns `true` when the pathname matches the proxy route.
- */
-declare function shouldProxyAuthAction(pathname: string, apiRoute: string): boolean;
-/**
- * Create an SSR auth helper for server-side frameworks.
- *
- * Handles cookie-based token management, OAuth code exchange,
- * and automatic JWT refresh on page loads. Works with any
- * framework that gives you a `Request` object — SvelteKit,
- * TanStack Start, Remix, Next.js, etc.
- *
- * @param options - SSR configuration (Convex URL, proxy route, cookie lifetime).
- * @returns An object with `token`, `verify`, `proxy`, and `refresh` methods.
- *
- * @example SvelteKit hooks
- * ```ts
- * // src/hooks.server.ts
- * import { server } from '@robelest/convex-auth/server';
- *
- * const auth = server({ url: CONVEX_URL });
- *
- * export const handle = async ({ event, resolve }) => {
- *   const { cookies, token } = await auth.refresh(event.request);
- *   for (const c of cookies) event.cookies.set(c.name, c.value, c.options);
- *   event.locals.token = token;
- *   return resolve(event);
- * };
- * ```
- *
- * @example Generic proxy endpoint
- * ```ts
- * if (shouldProxyAuthAction(url.pathname, '/api/auth')) {
- *   return auth.proxy(request);
- * }
- * ```
- */
-declare function server(options: ServerOptions): {
-  /**
-   * Read the JWT from the request cookies without any validation.
-   *
-   * @param request - The incoming HTTP request.
-   * @returns The raw JWT string, or `null` when no token cookie exists.
-   */
-  token(request: Request): string | null;
-  /**
-   * Check whether the request carries a non-expired JWT.
-   *
-   * Performs local expiration checking only (no network call).
-   * Use for lightweight auth guards in middleware.
-   *
-   * @param request - The incoming HTTP request.
-   * @returns `true` when a valid, non-expired JWT exists in the cookies.
-   */
-  verify(request: Request): Promise<boolean>;
-  /**
-   * Handle a proxied `signIn` or `signOut` POST from the client.
-   *
-   * Validates the route, method, and origin, then forwards the
-   * action to Convex and returns a `Response` with updated
-   * `Set-Cookie` headers. The client never sees the real
-   * refresh token — it stays in httpOnly cookies.
-   *
-   * @param request - The incoming POST request from the client.
-   * @returns A JSON `Response` with auth result and cookie headers.
-   */
-  proxy(request: Request): Promise<Response>;
-  /**
-   * Refresh auth tokens on page load.
-   *
-   * Call this in your server hooks/middleware on every request.
-   * It handles three scenarios:
-   *
-   * 1. **OAuth code exchange** — exchanges a `?code=` query param for tokens and returns a redirect URL.
-   * 2. **Token refresh** — refreshes the JWT if it's close to expiry.
-   * 3. **No-op** — returns the existing token when no refresh is needed.
-   *
-   * @param request - The incoming HTTP request.
-   * @returns Structured cookies to set on the response, an optional redirect URL, and the current JWT.
-   */
-  refresh(request: Request): Promise<RefreshResult>;
-};
-//#endregion
-export { AuthCookie, AuthCookieConfig, AuthCookies, RefreshResult, ServerOptions, authCookieNames, parseAuthCookies, serializeAuthCookies, server, shouldProxyAuthAction, structuredAuthCookies };
-//# sourceMappingURL=index.d.ts.map
+import { AuthApi, AuthApiBase, AuthConfig, AuthCtx, ConvexAuthResult, InferAuth, InferClientApi, UserDoc, createAuth } from "./auth.js";
+import { EnterpriseAdminAuthorizationInput, EnterpriseAdminPermission, EnterpriseAuthorizer, EnterpriseMountOptions, enterprise, scim, sso } from "./mounts.js";
+import { AuthCookie, AuthCookieConfig, AuthCookies, RefreshResult, ServerOptions, authCookieNames, parseAuthCookies, serializeAuthCookies, server, shouldProxyAuthAction, structuredAuthCookies } from "./ssr.js";
+export { type AuthApi, type AuthApiBase, type AuthConfig, type AuthCookie, type AuthCookieConfig, type AuthCookies, AuthCtx, type ConvexAuthResult, type EnterpriseAdminAuthorizationInput, type EnterpriseAdminPermission, type EnterpriseAuthorizer, type EnterpriseMountOptions, type InferAuth, type InferClientApi, type RefreshResult, type ServerOptions, type UserDoc, authCookieNames, createAuth, enterprise, parseAuthCookies, scim, serializeAuthCookies, server, shouldProxyAuthAction, sso, structuredAuthCookies };

package/dist/server/index.js

@@ -1,377 +1,5 @@
-import { isLocalHost } from "./utils.js";
-import { ConvexError } from "convex/values";
-import { parse, serialize } from "cookie";
-import { ConvexHttpClient } from "convex/browser";
-import { jwtDecode } from "jwt-decode";
+import { AuthCtx, createAuth } from "./auth.js";
+import { enterprise, scim, sso } from "./mounts.js";
+import { authCookieNames, parseAuthCookies, serializeAuthCookies, server, shouldProxyAuthAction, structuredAuthCookies } from "./ssr.js";
 
-//#region src/server/index.ts
-/**
-* Derive the cookie names used for auth tokens.
-*
-* On localhost the names are unprefixed; on production hosts they
-* use the `__Host-` prefix for tighter security.
-*
-* @param host - The `Host` header value. Omit to use unprefixed names.
-* @returns An object with `token`, `refreshToken`, and `verifier` cookie names.
-*/
-function authCookieNames(host) {
-	const prefix = isLocalHost(host) ? "" : "__Host-";
-	return {
-		token: `${prefix}__convexAuthJWT`,
-		refreshToken: `${prefix}__convexAuthRefreshToken`,
-		verifier: `${prefix}__convexAuthOAuthVerifier`
-	};
-}
-/**
-* Parse auth cookie values from a raw `Cookie` header string.
-*
-* @param cookieHeader - The raw `Cookie` header, or `null`/`undefined`.
-* @param host - The `Host` header, used to determine cookie name prefixes.
-* @returns Parsed {@link AuthCookies} with `token`, `refreshToken`, and `verifier`.
-*/
-function parseAuthCookies(cookieHeader, host) {
-	const names = authCookieNames(host);
-	const parsed = parse(cookieHeader ?? "");
-	return {
-		token: parsed[names.token] ?? null,
-		refreshToken: parsed[names.refreshToken] ?? null,
-		verifier: parsed[names.verifier] ?? null
-	};
-}
-/**
-* Serialize auth cookies into `Set-Cookie` header strings.
-*
-* Nulled-out values produce deletion cookies (maxAge 0, expired date).
-*
-* @param cookies - The auth cookie values to serialize.
-* @param host - The `Host` header, used for cookie name prefixes and `Secure` flag.
-* @param config - Cookie lifetime config. Defaults to session cookies.
-* @returns An array of three `Set-Cookie` header strings.
-*/
-function serializeAuthCookies(cookies, host, config = { maxAge: null }) {
-	const names = authCookieNames(host);
-	const base = {
-		path: "/",
-		httpOnly: true,
-		sameSite: "lax",
-		secure: !isLocalHost(host)
-	};
-	const maxAge = config.maxAge ?? void 0;
-	return [
-		serialize(names.token, cookies.token ?? "", {
-			...base,
-			maxAge: cookies.token === null ? 0 : maxAge,
-			expires: cookies.token === null ? /* @__PURE__ */ new Date(0) : void 0
-		}),
-		serialize(names.refreshToken, cookies.refreshToken ?? "", {
-			...base,
-			maxAge: cookies.refreshToken === null ? 0 : maxAge,
-			expires: cookies.refreshToken === null ? /* @__PURE__ */ new Date(0) : void 0
-		}),
-		serialize(names.verifier, cookies.verifier ?? "", {
-			...base,
-			maxAge: cookies.verifier === null ? 0 : maxAge,
-			expires: cookies.verifier === null ? /* @__PURE__ */ new Date(0) : void 0
-		})
-	];
-}
-/**
-* Build structured cookie objects for any SSR framework.
-*
-* Use with SvelteKit's `event.cookies.set()`, TanStack Start's `setCookie()`,
-* Next.js's `cookies().set()`, or any other framework cookie API.
-*/
-function structuredAuthCookies(cookies, host, config = { maxAge: null }) {
-	const names = authCookieNames(host);
-	const base = {
-		path: "/",
-		httpOnly: true,
-		secure: !isLocalHost(host),
-		sameSite: "lax"
-	};
-	const maxAge = config.maxAge ?? void 0;
-	return [
-		{
-			name: names.token,
-			value: cookies.token ?? "",
-			options: {
-				...base,
-				maxAge: cookies.token === null ? 0 : maxAge,
-				expires: cookies.token === null ? /* @__PURE__ */ new Date(0) : void 0
-			}
-		},
-		{
-			name: names.refreshToken,
-			value: cookies.refreshToken ?? "",
-			options: {
-				...base,
-				maxAge: cookies.refreshToken === null ? 0 : maxAge,
-				expires: cookies.refreshToken === null ? /* @__PURE__ */ new Date(0) : void 0
-			}
-		},
-		{
-			name: names.verifier,
-			value: cookies.verifier ?? "",
-			options: {
-				...base,
-				maxAge: cookies.verifier === null ? 0 : maxAge,
-				expires: cookies.verifier === null ? /* @__PURE__ */ new Date(0) : void 0
-			}
-		}
-	];
-}
-/**
-* Check whether a request pathname matches the auth proxy route.
-*
-* Handles trailing-slash ambiguity: both `/api/auth` and `/api/auth/`
-* match regardless of how `apiRoute` is configured.
-*
-* @param pathname - The request URL pathname.
-* @param apiRoute - The configured proxy route (e.g. `"/api/auth"`).
-* @returns `true` when the pathname matches the proxy route.
-*/
-function shouldProxyAuthAction(pathname, apiRoute) {
-	if (apiRoute.endsWith("/")) return pathname === apiRoute || pathname === apiRoute.slice(0, -1);
-	return pathname === apiRoute || pathname === `${apiRoute}/`;
-}
-const REQUIRED_TOKEN_LIFETIME_MS = 6e4;
-const MINIMUM_REQUIRED_TOKEN_LIFETIME_MS = 1e4;
-/**
-* Create an SSR auth helper for server-side frameworks.
-*
-* Handles cookie-based token management, OAuth code exchange,
-* and automatic JWT refresh on page loads. Works with any
-* framework that gives you a `Request` object — SvelteKit,
-* TanStack Start, Remix, Next.js, etc.
-*
-* @param options - SSR configuration (Convex URL, proxy route, cookie lifetime).
-* @returns An object with `token`, `verify`, `proxy`, and `refresh` methods.
-*
-* @example SvelteKit hooks
-* ```ts
-* // src/hooks.server.ts
-* import { server } from '@robelest/convex-auth/server';
-*
-* const auth = server({ url: CONVEX_URL });
-*
-* export const handle = async ({ event, resolve }) => {
-*   const { cookies, token } = await auth.refresh(event.request);
-*   for (const c of cookies) event.cookies.set(c.name, c.value, c.options);
-*   event.locals.token = token;
-*   return resolve(event);
-* };
-* ```
-*
-* @example Generic proxy endpoint
-* ```ts
-* if (shouldProxyAuthAction(url.pathname, '/api/auth')) {
-*   return auth.proxy(request);
-* }
-* ```
-*/
-function server(options) {
-	const convexUrl = options.url;
-	const apiRoute = options.apiRoute ?? "/api/auth";
-	const cookieConfig = { maxAge: options.cookieMaxAge ?? null };
-	const verbose = options.verbose ?? false;
-	const logVerbose = (message) => {
-		if (!verbose) return;
-		console.debug(`${(/* @__PURE__ */ new Date()).toISOString()} [convex-auth/server] ${message}`);
-	};
-	const cookieHost = (request) => {
-		return request.headers.get("host") ?? new URL(request.url).host;
-	};
-	const parseRequestCookies = (request) => {
-		return parseAuthCookies(request.headers.get("cookie"), cookieHost(request));
-	};
-	const attachCookies = (response, cookies) => {
-		for (const value of cookies) response.headers.append("Set-Cookie", value);
-		return response;
-	};
-	const jsonResponse = (body, status = 200) => {
-		return new Response(JSON.stringify(body), {
-			status,
-			headers: { "Content-Type": "application/json" }
-		});
-	};
-	const isCorsRequest = (request) => {
-		const originHeader = request.headers.get("origin");
-		if (originHeader === null) return false;
-		const requestUrl = new URL(request.url);
-		const originUrl = new URL(originHeader);
-		return originUrl.host !== requestUrl.host || originUrl.protocol !== requestUrl.protocol;
-	};
-	const decodeToken = (token) => {
-		try {
-			return jwtDecode(token);
-		} catch {
-			return null;
-		}
-	};
-	const convexClient = (token) => {
-		const client = new ConvexHttpClient(convexUrl);
-		if (token !== void 0 && token !== null) client.setAuth(token);
-		return client;
-	};
-	const refreshTokens = async (request) => {
-		const { token, refreshToken } = parseRequestCookies(request);
-		if (refreshToken === null && token === null) {
-			logVerbose("No auth cookies found, skipping refresh");
-			return;
-		}
-		if (refreshToken === null || token === null) {
-			logVerbose("Only one auth cookie present, clearing auth cookies");
-			return null;
-		}
-		const decodedToken = decodeToken(token);
-		if (decodedToken?.exp === void 0 || decodedToken.iat === void 0) {
-			logVerbose("Failed to decode token, clearing auth cookies");
-			return null;
-		}
-		const totalTokenLifetimeMs = decodedToken.exp * 1e3 - decodedToken.iat * 1e3;
-		const minimumExpiration = Date.now() + Math.min(REQUIRED_TOKEN_LIFETIME_MS, Math.max(MINIMUM_REQUIRED_TOKEN_LIFETIME_MS, totalTokenLifetimeMs / 10));
-		if (decodedToken.exp * 1e3 > minimumExpiration) {
-			logVerbose("Token valid long enough, skipping refresh");
-			return;
-		}
-		try {
-			const result = await convexClient().action("auth:signIn", { refreshToken });
-			if (result.tokens === void 0) throw new Error("Invalid `auth:signIn` result for token refresh");
-			logVerbose(`Refreshed tokens, null=${result.tokens === null}`);
-			return result.tokens;
-		} catch (error) {
-			console.error(error);
-			logVerbose("Token refresh failed, clearing auth cookies");
-			return null;
-		}
-	};
-	return {
-		token(request) {
-			return parseRequestCookies(request).token;
-		},
-		async verify(request) {
-			const token = parseRequestCookies(request).token;
-			if (token === null) return false;
-			const decodedToken = decodeToken(token);
-			if (decodedToken?.exp === void 0) return false;
-			return decodedToken.exp * 1e3 > Date.now();
-		},
-		async proxy(request) {
-			if (!shouldProxyAuthAction(new URL(request.url).pathname, apiRoute)) return new Response("Invalid route", { status: 404 });
-			if (request.method !== "POST") return new Response("Invalid method", { status: 405 });
-			if (isCorsRequest(request)) return new Response("Invalid origin", { status: 403 });
-			const body = await request.json();
-			const action = body.action;
-			const args = body.args ?? {};
-			if (action !== "auth:signIn" && action !== "auth:signOut") return new Response("Invalid action", { status: 400 });
-			const currentCookies = parseRequestCookies(request);
-			const host = cookieHost(request);
-			if (action === "auth:signIn") {
-				if (args.refreshToken !== void 0) {
-					if (currentCookies.refreshToken === null) return jsonResponse({ tokens: null });
-					args.refreshToken = currentCookies.refreshToken;
-				}
-				const client = convexClient(args.refreshToken !== void 0 || args.params?.code !== void 0 ? null : currentCookies.token);
-				try {
-					const result = await client.action("auth:signIn", args);
-					if (result.redirect !== void 0) return attachCookies(jsonResponse({ redirect: result.redirect }), serializeAuthCookies({
-						...currentCookies,
-						verifier: result.verifier ?? null
-					}, host, cookieConfig));
-					if (result.tokens !== void 0) return attachCookies(jsonResponse({ tokens: result.tokens === null ? null : {
-						token: result.tokens.token,
-						refreshToken: "dummy"
-					} }), serializeAuthCookies({
-						token: result.tokens?.token ?? null,
-						refreshToken: result.tokens?.refreshToken ?? null,
-						verifier: null
-					}, host, cookieConfig));
-					return jsonResponse(result);
-				} catch (error) {
-					return attachCookies(jsonResponse(error instanceof ConvexError && typeof error.data === "object" && error.data !== null && "code" in error.data ? {
-						error: error.data.message ?? String(error),
-						authError: error.data
-					} : { error: error instanceof Error ? error.message : String(error) }, 400), serializeAuthCookies({
-						token: null,
-						refreshToken: null,
-						verifier: null
-					}, host, cookieConfig));
-				}
-			}
-			try {
-				await convexClient(currentCookies.token).action("auth:signOut");
-			} catch (error) {
-				console.error(error);
-			}
-			return attachCookies(jsonResponse(null), serializeAuthCookies({
-				token: null,
-				refreshToken: null,
-				verifier: null
-			}, host, cookieConfig));
-		},
-		async refresh(request) {
-			const host = cookieHost(request);
-			const currentToken = parseRequestCookies(request).token;
-			if (isCorsRequest(request)) return {
-				cookies: structuredAuthCookies({
-					token: null,
-					refreshToken: null,
-					verifier: null
-				}, host, cookieConfig),
-				token: null
-			};
-			const requestUrl = new URL(request.url);
-			const code = requestUrl.searchParams.get("code");
-			const shouldHandleCode = options.shouldHandleCode === void 0 ? true : typeof options.shouldHandleCode === "function" ? await options.shouldHandleCode(request) : options.shouldHandleCode;
-			if (code !== null && request.method === "GET" && request.headers.get("accept")?.includes("text/html") && shouldHandleCode) {
-				const requestCookies = parseRequestCookies(request);
-				const redirectUrl = new URL(requestUrl);
-				redirectUrl.searchParams.delete("code");
-				try {
-					const result = await convexClient().action("auth:signIn", {
-						params: { code },
-						verifier: requestCookies.verifier ?? void 0
-					});
-					if (result.tokens === void 0) throw new Error("Invalid `auth:signIn` result for code exchange");
-					return {
-						cookies: structuredAuthCookies({
-							token: result.tokens?.token ?? null,
-							refreshToken: result.tokens?.refreshToken ?? null,
-							verifier: null
-						}, host, cookieConfig),
-						redirect: redirectUrl.toString(),
-						token: result.tokens?.token ?? null
-					};
-				} catch (error) {
-					console.error(error);
-					return {
-						cookies: structuredAuthCookies({
-							token: null,
-							refreshToken: null,
-							verifier: null
-						}, host, cookieConfig),
-						redirect: redirectUrl.toString(),
-						token: null
-					};
-				}
-			}
-			const tokens = await refreshTokens(request);
-			if (tokens === void 0) return {
-				cookies: [],
-				token: currentToken
-			};
-			return {
-				cookies: structuredAuthCookies({
-					token: tokens?.token ?? null,
-					refreshToken: tokens?.refreshToken ?? null,
-					verifier: null
-				}, host, cookieConfig),
-				token: tokens?.token ?? null
-			};
-		}
-	};
-}
-
-//#endregion
-export { authCookieNames, parseAuthCookies, serializeAuthCookies, server, shouldProxyAuthAction, structuredAuthCookies };
-//# sourceMappingURL=index.js.map
+export { AuthCtx, authCookieNames, createAuth, enterprise, parseAuthCookies, scim, serializeAuthCookies, server, shouldProxyAuthAction, sso, structuredAuthCookies };

package/dist/server/keys.d.ts

@@ -0,0 +1 @@
+export { };

package/dist/{component/server/implementation → server}/keys.js

@@ -1,22 +1,12 @@
-import { throwAuthError } from "../errors.js";
 import { generateRandomString, sha256 } from "./utils.js";
 
-//#region src/server/implementation/keys.ts
-/**
-* API Key crypto utilities.
-*
-* Uses `@oslojs/crypto` primitives for key generation and hashing:
-* - SHA-256 for hashing keys (API keys have high entropy, no need for bcrypt)
-* - Cryptographically secure random generation for key material
-*
-* @module
-*/
-const DEFAULT_KEY_PREFIX = "sk_live_";
+//#region src/server/keys.ts
+const DEFAULT_KEY_PREFIX = "sk_";
 const KEY_RANDOM_LENGTH = 32;
 const KEY_RANDOM_ALPHABET = "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789";
 /**
 * How many characters of the full key to store as the visible prefix.
-* Includes the prefix string (e.g. "sk_live_") plus a few random chars.
+* Includes the prefix string (e.g. "sk_") plus a few random chars.
 */
 const VISIBLE_PREFIX_EXTRA_CHARS = 4;
 /**
@@ -25,9 +15,10 @@ const VISIBLE_PREFIX_EXTRA_CHARS = 4;
 * Returns the raw key (to be shown once to the user) and metadata for storage.
 * The raw key is `{prefix}{32 random alphanumeric chars}`.
 *
-* @param prefix - Key prefix, defaults to "sk_live_"
+* @param prefix - Key prefix, defaults to "sk_"
 * @returns `{ raw, hashedKey, displayPrefix }`
 */
+/** @internal */
 async function generateApiKey(prefix = DEFAULT_KEY_PREFIX) {
 	const raw = `${prefix}${generateRandomString(KEY_RANDOM_LENGTH, KEY_RANDOM_ALPHABET)}`;
 	return {
@@ -41,6 +32,7 @@ async function generateApiKey(prefix = DEFAULT_KEY_PREFIX) {
 *
 * Used during Bearer token verification to find the stored key record.
 */
+/** @internal */
 async function hashApiKey(rawKey) {
 	return sha256(rawKey);
 }
@@ -53,6 +45,7 @@ async function hashApiKey(rawKey) {
 * A wildcard action `"*"` grants all actions on that resource.
 * A wildcard resource `"*"` grants the action on all resources.
 */
+/** @internal */
 function buildScopeChecker(scopes) {
 	return {
 		scopes,
@@ -62,22 +55,6 @@ function buildScopeChecker(scopes) {
 	};
 }
 /**
-* Validate that requested scopes are a subset of the allowed scopes
-* defined in the API key config.
-*
-* @param requested - Scopes the user wants on the new key.
-* @param allowed - The scope definition from `apiKeys.scopes` config.
-* @throws Error if any requested scope is not in the allowed set.
-*/
-function validateScopes(requested, allowed) {
-	if (!allowed) return;
-	for (const scope of requested) {
-		const allowedActions = allowed[scope.resource];
-		if (!allowedActions) throwAuthError("API_KEY_INVALID_SCOPE", `Unknown resource "${scope.resource}" in API key scopes. Allowed resources: ${Object.keys(allowed).join(", ")}`);
-		for (const action of scope.actions) if (action !== "*" && !allowedActions.includes(action)) throwAuthError("API_KEY_INVALID_SCOPE", `Unknown action "${action}" for resource "${scope.resource}". Allowed actions: ${allowedActions.join(", ")}`);
-	}
-}
-/**
 * Check whether a key is rate-limited based on its stored state.
 *
 * Uses the same token-bucket algorithm as sign-in rate limiting:
@@ -85,6 +62,7 @@ function validateScopes(requested, allowed) {
 *
 * @returns `{ limited: boolean; newState: { attemptsLeft, lastAttemptTime } }`
 */
+/** @internal */
 function checkKeyRateLimit(rateLimit, state) {
 	const now = Date.now();
 	if (!state) return {
@@ -114,5 +92,5 @@ function checkKeyRateLimit(rateLimit, state) {
 }
 
 //#endregion
-export { buildScopeChecker, checkKeyRateLimit, generateApiKey, hashApiKey, validateScopes };
+export { buildScopeChecker, checkKeyRateLimit, generateApiKey, hashApiKey };
 //# sourceMappingURL=keys.js.map