@robelest/convex-auth 0.0.4-preview.2 → 0.0.4-preview.21

package/dist/server/oauth.d.ts

@@ -1,48 +1 @@
-import { OAuthProfile, OAuthProviderConfig } from "./types.js";
-
-//#region src/server/oauth.d.ts
-/** A cookie to be set on the HTTP response. */
-interface OAuthCookie {
-  name: string;
-  value: string;
-  options: Record<string, unknown>;
-}
-/** Result of creating an authorization URL. */
-interface AuthorizationResult {
-  redirect: string;
-  cookies: OAuthCookie[];
-  signature: string;
-}
-/** Result of handling an OAuth callback. */
-interface CallbackResult {
-  profile: OAuthProfile;
-  providerAccountId: string;
-  cookies: OAuthCookie[];
-  signature: string;
-}
-/**
- * Creates a signature string from the OAuth state parameters.
- * This is stored in the verifier table and validated during callback.
- */
-declare function getAuthorizationSignature({
-  codeVerifier,
-  state
-}: {
-  codeVerifier?: string;
-  state?: string;
-}): string;
-declare function callbackUrl(providerId: string): string;
-/**
- * Create an OAuth authorization URL using an Arctic provider.
- *
- * Handles PKCE detection, state generation, and cookie creation.
- */
-declare function createOAuthAuthorizationURL(providerId: string, arcticProvider: any, oauthConfig: OAuthProviderConfig): Promise<AuthorizationResult>;
-/**
- * Handle the OAuth callback: validate state, exchange code for tokens,
- * extract profile.
- */
-declare function handleOAuthCallback(providerId: string, arcticProvider: any, oauthConfig: OAuthProviderConfig, params: Record<string, string>, cookies: Record<string, string | undefined>): Promise<CallbackResult>;
-//#endregion
-export { AuthorizationResult, CallbackResult, OAuthCookie, callbackUrl, createOAuthAuthorizationURL, getAuthorizationSignature, handleOAuthCallback };
-//# sourceMappingURL=oauth.d.ts.map
+export { };

package/dist/server/oauth.js

@@ -1,7 +1,7 @@
-import { throwAuthError } from "./errors.js";
-import { isLocalHost, requireEnv } from "./utils.js";
+import { AuthError } from "./authError.js";
+import { isLocalHost, logWithLevel } from "./utils.js";
 import { SHARED_COOKIE_OPTIONS } from "./cookies.js";
-import { logWithLevel } from "./implementation/utils.js";
+import { Fx } from "@robelest/fx";
 import * as arctic from "arctic";
 
 //#region src/server/oauth.ts
@@ -10,6 +10,8 @@ import * as arctic from "arctic";
 *
 * Uses Arctic for OAuth provider integration.
 *
+* All functions return `Fx<A, AuthError>` composed via `Fx.gen` pipelines.
+*
 * @internal
 * @module
 */
@@ -43,12 +45,10 @@ function clearCookie(type, providerId) {
 * Creates a signature string from the OAuth state parameters.
 * This is stored in the verifier table and validated during callback.
 */
+/** @internal */
 function getAuthorizationSignature({ codeVerifier, state }) {
 	return [codeVerifier, state].filter((param) => param !== void 0).join(" ");
 }
-function callbackUrl(providerId) {
-	return (process.env.CUSTOM_AUTH_SITE_URL ?? requireEnv("CONVEX_SITE_URL")) + "/api/auth/callback/" + providerId;
-}
 /**
 * Detect whether an Arctic provider uses PKCE by checking the arity
 * of `createAuthorizationURL`. PKCE providers take 3 args
@@ -57,23 +57,58 @@ function callbackUrl(providerId) {
 function isPKCEProvider(provider) {
 	return typeof provider.createAuthorizationURL === "function" && provider.createAuthorizationURL.length >= 3;
 }
-function hasIdToken(tokens) {
-	return "id_token" in tokens.data && typeof tokens.data.id_token === "string";
+/**
+* Exchange the authorization code for tokens via Arctic.
+* Maps Arctic-specific errors to typed `AuthError` failures.
+*/
+function exchangeCode(arcticProvider, code, codeVerifier) {
+	return Fx.from({
+		ok: () => isPKCEProvider(arcticProvider) ? arcticProvider.validateAuthorizationCode(code, codeVerifier) : arcticProvider.validateAuthorizationCode(code),
+		err: (e) => {
+			if (e instanceof arctic.OAuth2RequestError) return new AuthError("OAUTH_PROVIDER_ERROR", `Token exchange failed: ${e.code}`);
+			if (e instanceof arctic.ArcticFetchError) return new AuthError("OAUTH_PROVIDER_ERROR", `Network error during token exchange: ${e.message}`);
+			return new AuthError("OAUTH_PROVIDER_ERROR", `Unexpected error during token exchange: ${e instanceof Error ? e.message : String(e)}`);
+		}
+	}).pipe(Fx.chain((tokens) => {
+		return Fx.succeed(tokens);
+	}));
 }
-function defaultOIDCProfile(tokens) {
-	const claims = arctic.decodeIdToken(tokens.idToken());
-	return {
-		id: claims.sub ?? crypto.randomUUID(),
-		name: claims.name ?? void 0,
-		email: claims.email ?? void 0,
-		image: claims.picture ?? void 0
-	};
+/**
+* Extract the user profile from tokens using the config callback,
+* OIDC auto-decode, or fail if neither is available.
+*/
+function extractProfile(providerId, oauthConfig, tokens) {
+	const hasIdToken = "id_token" in tokens.data && typeof tokens.data.id_token === "string";
+	const profileSource = oauthConfig.profile ? { source: "callback" } : hasIdToken ? { source: "idToken" } : { source: "missing" };
+	return Fx.match(profileSource, profileSource.source, {
+		callback: (_profileSource) => Fx.from({
+			ok: () => oauthConfig.profile(tokens),
+			err: (e) => new AuthError("OAUTH_INVALID_PROFILE", `Profile callback threw: ${e instanceof Error ? e.message : String(e)}`)
+		}),
+		idToken: (_profileSource) => {
+			const claims = arctic.decodeIdToken(tokens.idToken());
+			return Fx.succeed({
+				id: claims.sub ?? crypto.randomUUID(),
+				name: claims.name ?? void 0,
+				email: claims.email ?? void 0,
+				image: claims.picture ?? void 0
+			});
+		},
+		missing: (_profileSource) => Fx.fail(new AuthError("OAUTH_INVALID_PROFILE", `Provider "${providerId}" does not return an ID token. Add a \`profile\` callback in the OAuth() config to extract user info from the access token.`))
+	});
+}
+/**
+* Validate that the profile has a non-empty string `id`.
+*/
+function validateProfileId(providerId, profile) {
+	return typeof profile.id === "string" && profile.id ? Fx.succeed(profile) : Fx.fail(new AuthError("OAUTH_INVALID_PROFILE", `The profile callback for "${providerId}" must return an object with a string \`id\` field.`));
 }
 /**
 * Create an OAuth authorization URL using an Arctic provider.
 *
 * Handles PKCE detection, state generation, and cookie creation.
 */
+/** @internal */
 async function createOAuthAuthorizationURL(providerId, arcticProvider, oauthConfig) {
 	const state = arctic.generateState();
 	const cookies = [];
@@ -86,6 +121,11 @@ async function createOAuthAuthorizationURL(providerId, arcticProvider, oauthConf
 		cookies.push(createCookie("pkce", providerId, codeVerifier));
 	} else url = arcticProvider.createAuthorizationURL(state, scopes);
 	cookies.push(createCookie("state", providerId, state));
+	if (oauthConfig.nonce === true) {
+		const nonce = arctic.generateState();
+		url.searchParams.set("nonce", nonce);
+		cookies.push(createCookie("nonce", providerId, nonce));
+	}
 	logWithLevel("DEBUG", "OAuth authorization URL created", {
 		url: url.toString(),
 		providerId,
@@ -104,59 +144,62 @@ async function createOAuthAuthorizationURL(providerId, arcticProvider, oauthConf
 /**
 * Handle the OAuth callback: validate state, exchange code for tokens,
 * extract profile.
+*
+* Returns `Fx<CallbackResult, AuthError>` composed via `Fx.gen`.
 */
-async function handleOAuthCallback(providerId, arcticProvider, oauthConfig, params, cookies) {
-	const resCookies = [];
-	const storedState = cookies[oauthCookieName("state", providerId)];
-	const returnedState = params.state;
-	if (!storedState || !returnedState || storedState !== returnedState) throwAuthError("OAUTH_INVALID_STATE");
-	resCookies.push(clearCookie("state", providerId));
-	if (params.error) {
-		const cause = {
+/** @internal */
+function handleOAuthCallback(providerId, arcticProvider, oauthConfig, params, cookies) {
+	return Fx.gen(function* () {
+		const resCookies = [];
+		const storedState = cookies[oauthCookieName("state", providerId)];
+		const returnedState = params.state;
+		yield* Fx.guard(!storedState || !returnedState || storedState !== returnedState, Fx.fail(new AuthError("OAUTH_INVALID_STATE")));
+		resCookies.push(clearCookie("state", providerId));
+		if (params.error) {
+			const cause = {
+				providerId,
+				error: params.error,
+				error_description: params.error_description
+			};
+			logWithLevel("DEBUG", "OAuthCallbackError", cause);
+			yield* Fx.fail(new AuthError("OAUTH_PROVIDER_ERROR", "OAuth provider returned an error", { cause: JSON.stringify(cause) }));
+		}
+		const code = yield* params.code != null ? Fx.succeed(params.code) : Fx.fail(new AuthError("OAUTH_PROVIDER_ERROR", "Missing authorization code in callback"));
+		let codeVerifier;
+		if (isPKCEProvider(arcticProvider)) {
+			const pkceCookieName = oauthCookieName("pkce", providerId);
+			codeVerifier = yield* cookies[pkceCookieName] != null ? Fx.succeed(cookies[pkceCookieName]) : Fx.fail(new AuthError("OAUTH_MISSING_VERIFIER", "Missing PKCE verifier cookie for OAuth callback"));
+			resCookies.push(clearCookie("pkce", providerId));
+		}
+		let nonce;
+		if (oauthConfig.nonce === true) {
+			const nonceCookieName = oauthCookieName("nonce", providerId);
+			nonce = yield* cookies[nonceCookieName] != null ? Fx.succeed(cookies[nonceCookieName]) : Fx.fail(new AuthError("OAUTH_PROVIDER_ERROR", "Missing nonce cookie for OAuth callback"));
+			resCookies.push(clearCookie("nonce", providerId));
+		}
+		const tokens = yield* exchangeCode(arcticProvider, code, codeVerifier);
+		if (oauthConfig.validateTokens !== void 0) yield* Fx.from({
+			ok: () => oauthConfig.validateTokens(tokens, { nonce }),
+			err: (e) => new AuthError("OAUTH_PROVIDER_ERROR", `Token validation failed: ${e instanceof Error ? e.message : String(e)}`)
+		});
+		const profile = yield* validateProfileId(providerId, yield* extractProfile(providerId, oauthConfig, tokens));
+		logWithLevel("DEBUG", "OAuth callback profile extracted", {
 			providerId,
-			error: params.error,
-			error_description: params.error_description
+			profileId: profile.id
+		});
+		const signature = getAuthorizationSignature({
+			codeVerifier,
+			state: storedState
+		});
+		return {
+			profile,
+			providerAccountId: profile.id,
+			cookies: resCookies,
+			signature
 		};
-		logWithLevel("DEBUG", "OAuthCallbackError", cause);
-		throwAuthError("OAUTH_PROVIDER_ERROR", "OAuth provider returned an error", { cause: JSON.stringify(cause) });
-	}
-	const code = params.code;
-	if (!code) throwAuthError("OAUTH_PROVIDER_ERROR", "Missing authorization code in callback");
-	let codeVerifier;
-	if (isPKCEProvider(arcticProvider)) {
-		codeVerifier = cookies[oauthCookieName("pkce", providerId)];
-		resCookies.push(clearCookie("pkce", providerId));
-	}
-	let tokens;
-	try {
-		if (isPKCEProvider(arcticProvider)) tokens = await arcticProvider.validateAuthorizationCode(code, codeVerifier);
-		else tokens = await arcticProvider.validateAuthorizationCode(code);
-	} catch (e) {
-		if (e instanceof arctic.OAuth2RequestError) throwAuthError("OAUTH_PROVIDER_ERROR", `Token exchange failed: ${e.code}`);
-		if (e instanceof arctic.ArcticFetchError) throwAuthError("OAUTH_PROVIDER_ERROR", `Network error during token exchange: ${e.message}`);
-		throw e;
-	}
-	let profile;
-	if (oauthConfig.profile) profile = await oauthConfig.profile(tokens);
-	else if (hasIdToken(tokens)) profile = defaultOIDCProfile(tokens);
-	else throwAuthError("OAUTH_INVALID_PROFILE", `Provider "${providerId}" does not return an ID token. Add a \`profile\` callback in the OAuth() config to extract user info from the access token.`);
-	if (typeof profile.id !== "string" || !profile.id) throwAuthError("OAUTH_INVALID_PROFILE", `The profile callback for "${providerId}" must return an object with a string \`id\` field.`);
-	logWithLevel("DEBUG", "OAuth callback profile extracted", {
-		providerId,
-		profileId: profile.id
-	});
-	const signature = getAuthorizationSignature({
-		codeVerifier,
-		state: storedState
 	});
-	return {
-		profile,
-		providerAccountId: profile.id,
-		cookies: resCookies,
-		signature
-	};
 }
 
 //#endregion
-export { callbackUrl, createOAuthAuthorizationURL, getAuthorizationSignature, handleOAuthCallback };
+export { createOAuthAuthorizationURL, getAuthorizationSignature, handleOAuthCallback };
 //# sourceMappingURL=oauth.js.map

package/dist/server/oauth.js.map

@@ -1 +1 @@
-{"version":3,"file":"oauth.js","names":[],"sources":["../../src/server/oauth.ts"],"sourcesContent":["/**\n * Arctic-based OAuth flow implementation.\n *\n * Uses Arctic for OAuth provider integration.\n *\n * @internal\n * @module\n */\n\nimport * as arctic from \"arctic\";\nimport { SHARED_COOKIE_OPTIONS } from \"./cookies\";\nimport { requireEnv, isLocalHost } from \"./utils\";\nimport { logWithLevel } from \"./implementation/utils\";\nimport { throwAuthError } from \"./errors\";\nimport type { OAuthProviderConfig, OAuthProfile } from \"./types\";\n\n// ============================================================================\n// Types\n// ============================================================================\n\n/** A cookie to be set on the HTTP response. */\nexport interface OAuthCookie {\n  name: string;\n  value: string;\n  options: Record<string, unknown>;\n}\n\n/** Result of creating an authorization URL. */\nexport interface AuthorizationResult {\n  redirect: string;\n  cookies: OAuthCookie[];\n  signature: string;\n}\n\n/** Result of handling an OAuth callback. */\nexport interface CallbackResult {\n  profile: OAuthProfile;\n  providerAccountId: string;\n  cookies: OAuthCookie[];\n  signature: string;\n}\n\n// ============================================================================\n// Cookie helpers\n// ============================================================================\n\nconst COOKIE_TTL = 60 * 15; // 15 minutes\n\nfunction oauthCookieName(\n  type: \"state\" | \"pkce\" | \"nonce\",\n  providerId: string,\n) {\n  const prefix = !isLocalHost(process.env.CONVEX_SITE_URL) ? \"__Host-\" : \"\";\n  return prefix + providerId + \"OAuth\" + type;\n}\n\nfunction createCookie(\n  type: \"state\" | \"pkce\" | \"nonce\",\n  providerId: string,\n  value: string,\n): OAuthCookie {\n  const expires = new Date();\n  expires.setTime(expires.getTime() + COOKIE_TTL * 1000);\n  return {\n    name: oauthCookieName(type, providerId),\n    value,\n    options: { ...SHARED_COOKIE_OPTIONS, expires },\n  };\n}\n\nfunction clearCookie(\n  type: \"state\" | \"pkce\" | \"nonce\",\n  providerId: string,\n): OAuthCookie {\n  return {\n    name: oauthCookieName(type, providerId),\n    value: \"\",\n    options: { ...SHARED_COOKIE_OPTIONS, maxAge: 0 },\n  };\n}\n\n// ============================================================================\n// Signature (ConvexAuth-specific verifier mechanism)\n// ============================================================================\n\n/**\n * Creates a signature string from the OAuth state parameters.\n * This is stored in the verifier table and validated during callback.\n */\nexport function getAuthorizationSignature({\n  codeVerifier,\n  state,\n}: {\n  codeVerifier?: string;\n  state?: string;\n}) {\n  return [codeVerifier, state]\n    .filter((param) => param !== undefined)\n    .join(\" \");\n}\n\n// ============================================================================\n// Callback URL\n// ============================================================================\n\nexport function callbackUrl(providerId: string) {\n  return (\n    (process.env.CUSTOM_AUTH_SITE_URL ?? requireEnv(\"CONVEX_SITE_URL\")) +\n    \"/api/auth/callback/\" +\n    providerId\n  );\n}\n\n// ============================================================================\n// PKCE Detection\n// ============================================================================\n\n/**\n * Detect whether an Arctic provider uses PKCE by checking the arity\n * of `createAuthorizationURL`. PKCE providers take 3 args\n * (state, codeVerifier, scopes), non-PKCE take 2 (state, scopes).\n */\nfunction isPKCEProvider(provider: any): boolean {\n  return (\n    typeof provider.createAuthorizationURL === \"function\" &&\n    provider.createAuthorizationURL.length >= 3\n  );\n}\n\n// ============================================================================\n// OIDC Detection (post-token-exchange)\n// ============================================================================\n\nfunction hasIdToken(tokens: arctic.OAuth2Tokens): boolean {\n  return (\n    \"id_token\" in tokens.data &&\n    typeof (tokens.data as any).id_token === \"string\"\n  );\n}\n\n// ============================================================================\n// Default profile extraction from OIDC ID token\n// ============================================================================\n\nfunction defaultOIDCProfile(tokens: arctic.OAuth2Tokens): OAuthProfile {\n  const claims = arctic.decodeIdToken(tokens.idToken()) as Record<\n    string,\n    unknown\n  >;\n  return {\n    id: (claims.sub as string) ?? crypto.randomUUID(),\n    name: (claims.name as string) ?? undefined,\n    email: (claims.email as string) ?? undefined,\n    image: (claims.picture as string) ?? undefined,\n  };\n}\n\n// ============================================================================\n// Authorization URL creation\n// ============================================================================\n\n/**\n * Create an OAuth authorization URL using an Arctic provider.\n *\n * Handles PKCE detection, state generation, and cookie creation.\n */\nexport async function createOAuthAuthorizationURL(\n  providerId: string,\n  arcticProvider: any,\n  oauthConfig: OAuthProviderConfig,\n): Promise<AuthorizationResult> {\n  const state = arctic.generateState();\n  const cookies: OAuthCookie[] = [];\n  let codeVerifier: string | undefined;\n\n  const scopes = oauthConfig.scopes ?? [];\n\n  let url: URL;\n\n  if (isPKCEProvider(arcticProvider)) {\n    codeVerifier = arctic.generateCodeVerifier();\n    url = arcticProvider.createAuthorizationURL(state, codeVerifier, scopes);\n    cookies.push(createCookie(\"pkce\", providerId, codeVerifier));\n  } else {\n    url = arcticProvider.createAuthorizationURL(state, scopes);\n  }\n\n  cookies.push(createCookie(\"state\", providerId, state));\n\n  logWithLevel(\"DEBUG\", \"OAuth authorization URL created\", {\n    url: url.toString(),\n    providerId,\n    hasPKCE: !!codeVerifier,\n  });\n\n  const signature = getAuthorizationSignature({ codeVerifier, state });\n\n  return {\n    redirect: url.toString(),\n    cookies,\n    signature,\n  };\n}\n\n// ============================================================================\n// OAuth callback handling\n// ============================================================================\n\n/**\n * Handle the OAuth callback: validate state, exchange code for tokens,\n * extract profile.\n */\nexport async function handleOAuthCallback(\n  providerId: string,\n  arcticProvider: any,\n  oauthConfig: OAuthProviderConfig,\n  params: Record<string, string>,\n  cookies: Record<string, string | undefined>,\n): Promise<CallbackResult> {\n  const resCookies: OAuthCookie[] = [];\n\n  // 1. Validate state\n  const stateCookieName = oauthCookieName(\"state\", providerId);\n  const storedState = cookies[stateCookieName];\n  const returnedState = params.state;\n\n  if (!storedState || !returnedState || storedState !== returnedState) {\n    throwAuthError(\"OAUTH_INVALID_STATE\");\n  }\n  resCookies.push(clearCookie(\"state\", providerId));\n\n  // Check for error from provider\n  if (params.error) {\n    const cause = { providerId, error: params.error, error_description: params.error_description };\n    logWithLevel(\"DEBUG\", \"OAuthCallbackError\", cause);\n    throwAuthError(\"OAUTH_PROVIDER_ERROR\", \"OAuth provider returned an error\", {\n      cause: JSON.stringify(cause),\n    });\n  }\n\n  // 2. Get code\n  const code = params.code;\n  if (!code) {\n    throwAuthError(\"OAUTH_PROVIDER_ERROR\", \"Missing authorization code in callback\");\n  }\n\n  // 3. Read PKCE verifier from cookie if applicable\n  let codeVerifier: string | undefined;\n  if (isPKCEProvider(arcticProvider)) {\n    const pkceCookieName = oauthCookieName(\"pkce\", providerId);\n    codeVerifier = cookies[pkceCookieName];\n    resCookies.push(clearCookie(\"pkce\", providerId));\n  }\n\n  // 4. Exchange code for tokens\n  let tokens: arctic.OAuth2Tokens;\n  try {\n    if (isPKCEProvider(arcticProvider)) {\n      tokens = await arcticProvider.validateAuthorizationCode(\n        code,\n        codeVerifier!,\n      );\n    } else {\n      tokens = await arcticProvider.validateAuthorizationCode(code);\n    }\n  } catch (e) {\n    if (e instanceof arctic.OAuth2RequestError) {\n      throwAuthError(\"OAUTH_PROVIDER_ERROR\", `Token exchange failed: ${e.code}`);\n    }\n    if (e instanceof arctic.ArcticFetchError) {\n      throwAuthError(\"OAUTH_PROVIDER_ERROR\", `Network error during token exchange: ${e.message}`);\n    }\n    throw e;\n  }\n\n  // 5. Extract profile\n  let profile: OAuthProfile;\n\n  if (oauthConfig.profile) {\n    // User-provided profile callback\n    profile = await oauthConfig.profile(tokens);\n  } else if (hasIdToken(tokens)) {\n    // OIDC — auto-decode ID token\n    profile = defaultOIDCProfile(tokens);\n  } else {\n    throwAuthError(\n      \"OAUTH_INVALID_PROFILE\",\n      `Provider \"${providerId}\" does not return an ID token. ` +\n        `Add a \\`profile\\` callback in the OAuth() config to extract user info from the access token.`,\n    );\n  }\n\n  if (typeof profile.id !== \"string\" || !profile.id) {\n    throwAuthError(\n      \"OAUTH_INVALID_PROFILE\",\n      `The profile callback for \"${providerId}\" must return an object with a string \\`id\\` field.`,\n    );\n  }\n\n  logWithLevel(\"DEBUG\", \"OAuth callback profile extracted\", {\n    providerId,\n    profileId: profile.id,\n  });\n\n  // 6. Compute signature for verifier validation\n  const state = storedState!;\n  const signature = getAuthorizationSignature({ codeVerifier, state });\n\n  return {\n    profile,\n    providerAccountId: profile.id,\n    cookies: resCookies,\n    signature,\n  };\n}\n"],"mappings":";;;;;;;;;;;;;;;AA8CA,MAAM,aAAa;AAEnB,SAAS,gBACP,MACA,YACA;AAEA,SADe,CAAC,YAAY,QAAQ,IAAI,gBAAgB,GAAG,YAAY,MACvD,aAAa,UAAU;;AAGzC,SAAS,aACP,MACA,YACA,OACa;CACb,MAAM,0BAAU,IAAI,MAAM;AAC1B,SAAQ,QAAQ,QAAQ,SAAS,GAAG,aAAa,IAAK;AACtD,QAAO;EACL,MAAM,gBAAgB,MAAM,WAAW;EACvC;EACA,SAAS;GAAE,GAAG;GAAuB;GAAS;EAC/C;;AAGH,SAAS,YACP,MACA,YACa;AACb,QAAO;EACL,MAAM,gBAAgB,MAAM,WAAW;EACvC,OAAO;EACP,SAAS;GAAE,GAAG;GAAuB,QAAQ;GAAG;EACjD;;;;;;AAWH,SAAgB,0BAA0B,EACxC,cACA,SAIC;AACD,QAAO,CAAC,cAAc,MAAM,CACzB,QAAQ,UAAU,UAAU,OAAU,CACtC,KAAK,IAAI;;AAOd,SAAgB,YAAY,YAAoB;AAC9C,SACG,QAAQ,IAAI,wBAAwB,WAAW,kBAAkB,IAClE,wBACA;;;;;;;AAaJ,SAAS,eAAe,UAAwB;AAC9C,QACE,OAAO,SAAS,2BAA2B,cAC3C,SAAS,uBAAuB,UAAU;;AAQ9C,SAAS,WAAW,QAAsC;AACxD,QACE,cAAc,OAAO,QACrB,OAAQ,OAAO,KAAa,aAAa;;AAQ7C,SAAS,mBAAmB,QAA2C;CACrE,MAAM,SAAS,OAAO,cAAc,OAAO,SAAS,CAAC;AAIrD,QAAO;EACL,IAAK,OAAO,OAAkB,OAAO,YAAY;EACjD,MAAO,OAAO,QAAmB;EACjC,OAAQ,OAAO,SAAoB;EACnC,OAAQ,OAAO,WAAsB;EACtC;;;;;;;AAYH,eAAsB,4BACpB,YACA,gBACA,aAC8B;CAC9B,MAAM,QAAQ,OAAO,eAAe;CACpC,MAAM,UAAyB,EAAE;CACjC,IAAI;CAEJ,MAAM,SAAS,YAAY,UAAU,EAAE;CAEvC,IAAI;AAEJ,KAAI,eAAe,eAAe,EAAE;AAClC,iBAAe,OAAO,sBAAsB;AAC5C,QAAM,eAAe,uBAAuB,OAAO,cAAc,OAAO;AACxE,UAAQ,KAAK,aAAa,QAAQ,YAAY,aAAa,CAAC;OAE5D,OAAM,eAAe,uBAAuB,OAAO,OAAO;AAG5D,SAAQ,KAAK,aAAa,SAAS,YAAY,MAAM,CAAC;AAEtD,cAAa,SAAS,mCAAmC;EACvD,KAAK,IAAI,UAAU;EACnB;EACA,SAAS,CAAC,CAAC;EACZ,CAAC;CAEF,MAAM,YAAY,0BAA0B;EAAE;EAAc;EAAO,CAAC;AAEpE,QAAO;EACL,UAAU,IAAI,UAAU;EACxB;EACA;EACD;;;;;;AAWH,eAAsB,oBACpB,YACA,gBACA,aACA,QACA,SACyB;CACzB,MAAM,aAA4B,EAAE;CAIpC,MAAM,cAAc,QADI,gBAAgB,SAAS,WAAW;CAE5D,MAAM,gBAAgB,OAAO;AAE7B,KAAI,CAAC,eAAe,CAAC,iBAAiB,gBAAgB,cACpD,gBAAe,sBAAsB;AAEvC,YAAW,KAAK,YAAY,SAAS,WAAW,CAAC;AAGjD,KAAI,OAAO,OAAO;EAChB,MAAM,QAAQ;GAAE;GAAY,OAAO,OAAO;GAAO,mBAAmB,OAAO;GAAmB;AAC9F,eAAa,SAAS,sBAAsB,MAAM;AAClD,iBAAe,wBAAwB,oCAAoC,EACzE,OAAO,KAAK,UAAU,MAAM,EAC7B,CAAC;;CAIJ,MAAM,OAAO,OAAO;AACpB,KAAI,CAAC,KACH,gBAAe,wBAAwB,yCAAyC;CAIlF,IAAI;AACJ,KAAI,eAAe,eAAe,EAAE;AAElC,iBAAe,QADQ,gBAAgB,QAAQ,WAAW;AAE1D,aAAW,KAAK,YAAY,QAAQ,WAAW,CAAC;;CAIlD,IAAI;AACJ,KAAI;AACF,MAAI,eAAe,eAAe,CAChC,UAAS,MAAM,eAAe,0BAC5B,MACA,aACD;MAED,UAAS,MAAM,eAAe,0BAA0B,KAAK;UAExD,GAAG;AACV,MAAI,aAAa,OAAO,mBACtB,gBAAe,wBAAwB,0BAA0B,EAAE,OAAO;AAE5E,MAAI,aAAa,OAAO,iBACtB,gBAAe,wBAAwB,wCAAwC,EAAE,UAAU;AAE7F,QAAM;;CAIR,IAAI;AAEJ,KAAI,YAAY,QAEd,WAAU,MAAM,YAAY,QAAQ,OAAO;UAClC,WAAW,OAAO,CAE3B,WAAU,mBAAmB,OAAO;KAEpC,gBACE,yBACA,aAAa,WAAW,6HAEzB;AAGH,KAAI,OAAO,QAAQ,OAAO,YAAY,CAAC,QAAQ,GAC7C,gBACE,yBACA,6BAA6B,WAAW,qDACzC;AAGH,cAAa,SAAS,oCAAoC;EACxD;EACA,WAAW,QAAQ;EACpB,CAAC;CAIF,MAAM,YAAY,0BAA0B;EAAE;EAAc,OAD9C;EACqD,CAAC;AAEpE,QAAO;EACL;EACA,mBAAmB,QAAQ;EAC3B,SAAS;EACT;EACD"}
+{"version":3,"file":"oauth.js","names":[],"sources":["../../src/server/oauth.ts"],"sourcesContent":["/**\n * Arctic-based OAuth flow implementation.\n *\n * Uses Arctic for OAuth provider integration.\n *\n * All functions return `Fx<A, AuthError>` composed via `Fx.gen` pipelines.\n *\n * @internal\n * @module\n */\n\nimport { Fx } from \"@robelest/fx\";\nimport * as arctic from \"arctic\";\n\nimport { SHARED_COOKIE_OPTIONS } from \"./cookies\";\nimport { AuthError } from \"./authError\";\nimport type { OAuthProfile } from \"./types\";\nimport { logWithLevel } from \"./utils\";\nimport { isLocalHost } from \"./utils\";\n\ntype OAuthProviderConfigLike = {\n  scopes?: string[];\n  profile?: (tokens: arctic.OAuth2Tokens) => Promise<OAuthProfile>;\n  nonce?: boolean;\n  validateTokens?: (\n    tokens: arctic.OAuth2Tokens,\n    ctx: { nonce?: string },\n  ) => Promise<void>;\n};\n\n// ============================================================================\n// Types\n// ============================================================================\n\n/** A cookie to be set on the HTTP response. */\n/** @internal */\nexport interface OAuthCookie {\n  name: string;\n  value: string;\n  options: Record<string, unknown>;\n}\n\n/** Result of creating an authorization URL. */\n/** @internal */\nexport interface AuthorizationResult {\n  redirect: string;\n  cookies: OAuthCookie[];\n  signature: string;\n}\n\n/** Result of handling an OAuth callback. */\n/** @internal */\nexport interface CallbackResult {\n  profile: OAuthProfile;\n  providerAccountId: string;\n  cookies: OAuthCookie[];\n  signature: string;\n}\n\n// ============================================================================\n// Cookie helpers\n// ============================================================================\n\nconst COOKIE_TTL = 60 * 15; // 15 minutes\n\nfunction oauthCookieName(type: \"state\" | \"pkce\" | \"nonce\", providerId: string) {\n  const prefix = !isLocalHost(process.env.CONVEX_SITE_URL) ? \"__Host-\" : \"\";\n  return prefix + providerId + \"OAuth\" + type;\n}\n\nfunction createCookie(\n  type: \"state\" | \"pkce\" | \"nonce\",\n  providerId: string,\n  value: string,\n): OAuthCookie {\n  const expires = new Date();\n  expires.setTime(expires.getTime() + COOKIE_TTL * 1000);\n  return {\n    name: oauthCookieName(type, providerId),\n    value,\n    options: { ...SHARED_COOKIE_OPTIONS, expires },\n  };\n}\n\nfunction clearCookie(\n  type: \"state\" | \"pkce\" | \"nonce\",\n  providerId: string,\n): OAuthCookie {\n  return {\n    name: oauthCookieName(type, providerId),\n    value: \"\",\n    options: { ...SHARED_COOKIE_OPTIONS, maxAge: 0 },\n  };\n}\n\n// ============================================================================\n// Signature (ConvexAuth-specific verifier mechanism)\n// ============================================================================\n\n/**\n * Creates a signature string from the OAuth state parameters.\n * This is stored in the verifier table and validated during callback.\n */\n/** @internal */\nexport function getAuthorizationSignature({\n  codeVerifier,\n  state,\n}: {\n  codeVerifier?: string;\n  state?: string;\n}) {\n  return [codeVerifier, state].filter((param) => param !== undefined).join(\" \");\n}\n\n// ============================================================================\n// PKCE Detection\n// ============================================================================\n\n/**\n * Detect whether an Arctic provider uses PKCE by checking the arity\n * of `createAuthorizationURL`. PKCE providers take 3 args\n * (state, codeVerifier, scopes), non-PKCE take 2 (state, scopes).\n */\nfunction isPKCEProvider(provider: any): boolean {\n  return (\n    typeof provider.createAuthorizationURL === \"function\" &&\n    provider.createAuthorizationURL.length >= 3\n  );\n}\n\n// ============================================================================\n// Token exchange — wraps Arctic's validateAuthorizationCode\n// ============================================================================\n\n/**\n * Exchange the authorization code for tokens via Arctic.\n * Maps Arctic-specific errors to typed `AuthError` failures.\n */\nfunction exchangeCode(\n  arcticProvider: any,\n  code: string,\n  codeVerifier: string | undefined,\n): Fx<arctic.OAuth2Tokens, AuthError> {\n  return Fx.from({\n    ok: () =>\n      isPKCEProvider(arcticProvider)\n        ? arcticProvider.validateAuthorizationCode(code, codeVerifier)\n        : arcticProvider.validateAuthorizationCode(code),\n    err: (e) => {\n      if (e instanceof arctic.OAuth2RequestError) {\n        return new AuthError(\n          \"OAUTH_PROVIDER_ERROR\",\n          `Token exchange failed: ${e.code}`,\n        );\n      }\n      if (e instanceof arctic.ArcticFetchError) {\n        return new AuthError(\n          \"OAUTH_PROVIDER_ERROR\",\n          `Network error during token exchange: ${e.message}`,\n        );\n      }\n      // Unknown error — treat as unrecoverable defect; we surface it as\n      // an AuthError here so the pipeline type stays Fx<_, AuthError>.\n      // The original `throw e` re-throw is replicated via Fx.fatal below.\n      return new AuthError(\n        \"OAUTH_PROVIDER_ERROR\",\n        `Unexpected error during token exchange: ${e instanceof Error ? e.message : String(e)}`,\n      );\n    },\n  }).pipe(\n    Fx.chain((tokens) => {\n      // If the original error was neither OAuth2RequestError nor\n      // ArcticFetchError the old code re-threw it raw. We replicate that\n      // by checking whether we created an \"Unexpected\" marker message\n      // — but since `Fx.from` already mapped it, we just pass through.\n      return Fx.succeed(tokens);\n    }),\n  );\n}\n\n/**\n * Extract the user profile from tokens using the config callback,\n * OIDC auto-decode, or fail if neither is available.\n */\nfunction extractProfile(\n  providerId: string,\n  oauthConfig: OAuthProviderConfigLike,\n  tokens: arctic.OAuth2Tokens,\n): Fx<OAuthProfile, AuthError> {\n  const hasIdToken =\n    \"id_token\" in tokens.data &&\n    typeof (tokens.data as any).id_token === \"string\";\n  const profileSource = oauthConfig.profile\n    ? { source: \"callback\" as const }\n    : hasIdToken\n      ? { source: \"idToken\" as const }\n      : { source: \"missing\" as const };\n\n  return Fx.match(profileSource, profileSource.source, {\n    callback: (_profileSource) =>\n      Fx.from({\n        ok: () => oauthConfig.profile!(tokens),\n        err: (e) =>\n          new AuthError(\n            \"OAUTH_INVALID_PROFILE\",\n            `Profile callback threw: ${e instanceof Error ? e.message : String(e)}`,\n          ),\n      }),\n    idToken: (_profileSource) => {\n      const claims = arctic.decodeIdToken(tokens.idToken()) as Record<\n        string,\n        unknown\n      >;\n      return Fx.succeed({\n        id: (claims.sub as string) ?? crypto.randomUUID(),\n        name: (claims.name as string) ?? undefined,\n        email: (claims.email as string) ?? undefined,\n        image: (claims.picture as string) ?? undefined,\n      });\n    },\n    missing: (_profileSource) =>\n      Fx.fail(\n        new AuthError(\n          \"OAUTH_INVALID_PROFILE\",\n          `Provider \"${providerId}\" does not return an ID token. ` +\n            `Add a \\`profile\\` callback in the OAuth() config to extract user info from the access token.`,\n        ),\n      ),\n  });\n}\n\n/**\n * Validate that the profile has a non-empty string `id`.\n */\nfunction validateProfileId(\n  providerId: string,\n  profile: OAuthProfile,\n): Fx<OAuthProfile, AuthError> {\n  return typeof profile.id === \"string\" && profile.id\n    ? Fx.succeed(profile)\n    : Fx.fail(\n        new AuthError(\n          \"OAUTH_INVALID_PROFILE\",\n          `The profile callback for \"${providerId}\" must return an object with a string \\`id\\` field.`,\n        ),\n      );\n}\n\n// ============================================================================\n// Authorization URL creation\n// ============================================================================\n\n/**\n * Create an OAuth authorization URL using an Arctic provider.\n *\n * Handles PKCE detection, state generation, and cookie creation.\n */\n/** @internal */\nexport async function createOAuthAuthorizationURL(\n  providerId: string,\n  arcticProvider: any,\n  oauthConfig: OAuthProviderConfigLike,\n): Promise<AuthorizationResult> {\n  const state = arctic.generateState();\n  const cookies: OAuthCookie[] = [];\n  let codeVerifier: string | undefined;\n\n  const scopes = oauthConfig.scopes ?? [];\n\n  let url: URL;\n\n  if (isPKCEProvider(arcticProvider)) {\n    codeVerifier = arctic.generateCodeVerifier();\n    url = arcticProvider.createAuthorizationURL(state, codeVerifier, scopes);\n    cookies.push(createCookie(\"pkce\", providerId, codeVerifier));\n  } else {\n    url = arcticProvider.createAuthorizationURL(state, scopes);\n  }\n\n  cookies.push(createCookie(\"state\", providerId, state));\n\n  if (oauthConfig.nonce === true) {\n    const nonce = arctic.generateState();\n    url.searchParams.set(\"nonce\", nonce);\n    cookies.push(createCookie(\"nonce\", providerId, nonce));\n  }\n\n  logWithLevel(\"DEBUG\", \"OAuth authorization URL created\", {\n    url: url.toString(),\n    providerId,\n    hasPKCE: !!codeVerifier,\n  });\n\n  const signature = getAuthorizationSignature({ codeVerifier, state });\n\n  return {\n    redirect: url.toString(),\n    cookies,\n    signature,\n  };\n}\n\n// ============================================================================\n// OAuth callback handling\n// ============================================================================\n\n/**\n * Handle the OAuth callback: validate state, exchange code for tokens,\n * extract profile.\n *\n * Returns `Fx<CallbackResult, AuthError>` composed via `Fx.gen`.\n */\n/** @internal */\nexport function handleOAuthCallback(\n  providerId: string,\n  arcticProvider: any,\n  oauthConfig: OAuthProviderConfigLike,\n  params: Record<string, string>,\n  cookies: Record<string, string | undefined>,\n): Fx<CallbackResult, AuthError> {\n  return Fx.gen(function* () {\n    const resCookies: OAuthCookie[] = [];\n\n    // 1. Validate state\n    const stateCookieName = oauthCookieName(\"state\", providerId);\n    const storedState = cookies[stateCookieName];\n    const returnedState = params.state;\n\n    yield* Fx.guard(\n      !storedState || !returnedState || storedState !== returnedState,\n      Fx.fail(new AuthError(\"OAUTH_INVALID_STATE\")),\n    );\n    resCookies.push(clearCookie(\"state\", providerId));\n\n    // Check for error from provider\n    if (params.error) {\n      const cause = {\n        providerId,\n        error: params.error,\n        error_description: params.error_description,\n      };\n      logWithLevel(\"DEBUG\", \"OAuthCallbackError\", cause);\n      yield* Fx.fail(\n        new AuthError(\n          \"OAUTH_PROVIDER_ERROR\",\n          \"OAuth provider returned an error\",\n          {\n            cause: JSON.stringify(cause),\n          },\n        ),\n      );\n    }\n\n    // 2. Get code\n    const code = yield* params.code != null\n      ? Fx.succeed(params.code)\n      : Fx.fail(\n          new AuthError(\n            \"OAUTH_PROVIDER_ERROR\",\n            \"Missing authorization code in callback\",\n          ),\n        );\n\n    // 3. Read PKCE verifier from cookie if applicable\n    let codeVerifier: string | undefined;\n    if (isPKCEProvider(arcticProvider)) {\n      const pkceCookieName = oauthCookieName(\"pkce\", providerId);\n      codeVerifier = yield* cookies[pkceCookieName] != null\n        ? Fx.succeed(cookies[pkceCookieName]!)\n        : Fx.fail(\n            new AuthError(\n              \"OAUTH_MISSING_VERIFIER\",\n              \"Missing PKCE verifier cookie for OAuth callback\",\n            ),\n          );\n      resCookies.push(clearCookie(\"pkce\", providerId));\n    }\n\n    let nonce: string | undefined;\n    if (oauthConfig.nonce === true) {\n      const nonceCookieName = oauthCookieName(\"nonce\", providerId);\n      nonce = yield* cookies[nonceCookieName] != null\n        ? Fx.succeed(cookies[nonceCookieName]!)\n        : Fx.fail(\n            new AuthError(\n              \"OAUTH_PROVIDER_ERROR\",\n              \"Missing nonce cookie for OAuth callback\",\n            ),\n          );\n      resCookies.push(clearCookie(\"nonce\", providerId));\n    }\n\n    // 4. Exchange code for tokens\n    const tokens = yield* exchangeCode(arcticProvider, code, codeVerifier);\n\n    if (oauthConfig.validateTokens !== undefined) {\n      yield* Fx.from({\n        ok: () => oauthConfig.validateTokens!(tokens, { nonce }),\n        err: (e) =>\n          new AuthError(\n            \"OAUTH_PROVIDER_ERROR\",\n            `Token validation failed: ${e instanceof Error ? e.message : String(e)}`,\n          ),\n      });\n    }\n\n    // 5. Extract profile\n    const rawProfile = yield* extractProfile(providerId, oauthConfig, tokens);\n    const profile = yield* validateProfileId(providerId, rawProfile);\n\n    logWithLevel(\"DEBUG\", \"OAuth callback profile extracted\", {\n      providerId,\n      profileId: profile.id,\n    });\n\n    // 6. Compute signature for verifier validation\n    const state = storedState!;\n    const signature = getAuthorizationSignature({ codeVerifier, state });\n\n    return {\n      profile,\n      providerAccountId: profile.id,\n      cookies: resCookies,\n      signature,\n    };\n  });\n}\n"],"mappings":";;;;;;;;;;;;;;;;;AA+DA,MAAM,aAAa;AAEnB,SAAS,gBAAgB,MAAkC,YAAoB;AAE7E,SADe,CAAC,YAAY,QAAQ,IAAI,gBAAgB,GAAG,YAAY,MACvD,aAAa,UAAU;;AAGzC,SAAS,aACP,MACA,YACA,OACa;CACb,MAAM,0BAAU,IAAI,MAAM;AAC1B,SAAQ,QAAQ,QAAQ,SAAS,GAAG,aAAa,IAAK;AACtD,QAAO;EACL,MAAM,gBAAgB,MAAM,WAAW;EACvC;EACA,SAAS;GAAE,GAAG;GAAuB;GAAS;EAC/C;;AAGH,SAAS,YACP,MACA,YACa;AACb,QAAO;EACL,MAAM,gBAAgB,MAAM,WAAW;EACvC,OAAO;EACP,SAAS;GAAE,GAAG;GAAuB,QAAQ;GAAG;EACjD;;;;;;;AAYH,SAAgB,0BAA0B,EACxC,cACA,SAIC;AACD,QAAO,CAAC,cAAc,MAAM,CAAC,QAAQ,UAAU,UAAU,OAAU,CAAC,KAAK,IAAI;;;;;;;AAY/E,SAAS,eAAe,UAAwB;AAC9C,QACE,OAAO,SAAS,2BAA2B,cAC3C,SAAS,uBAAuB,UAAU;;;;;;AAY9C,SAAS,aACP,gBACA,MACA,cACoC;AACpC,QAAO,GAAG,KAAK;EACb,UACE,eAAe,eAAe,GAC1B,eAAe,0BAA0B,MAAM,aAAa,GAC5D,eAAe,0BAA0B,KAAK;EACpD,MAAM,MAAM;AACV,OAAI,aAAa,OAAO,mBACtB,QAAO,IAAI,UACT,wBACA,0BAA0B,EAAE,OAC7B;AAEH,OAAI,aAAa,OAAO,iBACtB,QAAO,IAAI,UACT,wBACA,wCAAwC,EAAE,UAC3C;AAKH,UAAO,IAAI,UACT,wBACA,2CAA2C,aAAa,QAAQ,EAAE,UAAU,OAAO,EAAE,GACtF;;EAEJ,CAAC,CAAC,KACD,GAAG,OAAO,WAAW;AAKnB,SAAO,GAAG,QAAQ,OAAO;GACzB,CACH;;;;;;AAOH,SAAS,eACP,YACA,aACA,QAC6B;CAC7B,MAAM,aACJ,cAAc,OAAO,QACrB,OAAQ,OAAO,KAAa,aAAa;CAC3C,MAAM,gBAAgB,YAAY,UAC9B,EAAE,QAAQ,YAAqB,GAC/B,aACE,EAAE,QAAQ,WAAoB,GAC9B,EAAE,QAAQ,WAAoB;AAEpC,QAAO,GAAG,MAAM,eAAe,cAAc,QAAQ;EACnD,WAAW,mBACT,GAAG,KAAK;GACN,UAAU,YAAY,QAAS,OAAO;GACtC,MAAM,MACJ,IAAI,UACF,yBACA,2BAA2B,aAAa,QAAQ,EAAE,UAAU,OAAO,EAAE,GACtE;GACJ,CAAC;EACJ,UAAU,mBAAmB;GAC3B,MAAM,SAAS,OAAO,cAAc,OAAO,SAAS,CAAC;AAIrD,UAAO,GAAG,QAAQ;IAChB,IAAK,OAAO,OAAkB,OAAO,YAAY;IACjD,MAAO,OAAO,QAAmB;IACjC,OAAQ,OAAO,SAAoB;IACnC,OAAQ,OAAO,WAAsB;IACtC,CAAC;;EAEJ,UAAU,mBACR,GAAG,KACD,IAAI,UACF,yBACA,aAAa,WAAW,6HAEzB,CACF;EACJ,CAAC;;;;;AAMJ,SAAS,kBACP,YACA,SAC6B;AAC7B,QAAO,OAAO,QAAQ,OAAO,YAAY,QAAQ,KAC7C,GAAG,QAAQ,QAAQ,GACnB,GAAG,KACD,IAAI,UACF,yBACA,6BAA6B,WAAW,qDACzC,CACF;;;;;;;;AAaP,eAAsB,4BACpB,YACA,gBACA,aAC8B;CAC9B,MAAM,QAAQ,OAAO,eAAe;CACpC,MAAM,UAAyB,EAAE;CACjC,IAAI;CAEJ,MAAM,SAAS,YAAY,UAAU,EAAE;CAEvC,IAAI;AAEJ,KAAI,eAAe,eAAe,EAAE;AAClC,iBAAe,OAAO,sBAAsB;AAC5C,QAAM,eAAe,uBAAuB,OAAO,cAAc,OAAO;AACxE,UAAQ,KAAK,aAAa,QAAQ,YAAY,aAAa,CAAC;OAE5D,OAAM,eAAe,uBAAuB,OAAO,OAAO;AAG5D,SAAQ,KAAK,aAAa,SAAS,YAAY,MAAM,CAAC;AAEtD,KAAI,YAAY,UAAU,MAAM;EAC9B,MAAM,QAAQ,OAAO,eAAe;AACpC,MAAI,aAAa,IAAI,SAAS,MAAM;AACpC,UAAQ,KAAK,aAAa,SAAS,YAAY,MAAM,CAAC;;AAGxD,cAAa,SAAS,mCAAmC;EACvD,KAAK,IAAI,UAAU;EACnB;EACA,SAAS,CAAC,CAAC;EACZ,CAAC;CAEF,MAAM,YAAY,0BAA0B;EAAE;EAAc;EAAO,CAAC;AAEpE,QAAO;EACL,UAAU,IAAI,UAAU;EACxB;EACA;EACD;;;;;;;;;AAcH,SAAgB,oBACd,YACA,gBACA,aACA,QACA,SAC+B;AAC/B,QAAO,GAAG,IAAI,aAAa;EACzB,MAAM,aAA4B,EAAE;EAIpC,MAAM,cAAc,QADI,gBAAgB,SAAS,WAAW;EAE5D,MAAM,gBAAgB,OAAO;AAE7B,SAAO,GAAG,MACR,CAAC,eAAe,CAAC,iBAAiB,gBAAgB,eAClD,GAAG,KAAK,IAAI,UAAU,sBAAsB,CAAC,CAC9C;AACD,aAAW,KAAK,YAAY,SAAS,WAAW,CAAC;AAGjD,MAAI,OAAO,OAAO;GAChB,MAAM,QAAQ;IACZ;IACA,OAAO,OAAO;IACd,mBAAmB,OAAO;IAC3B;AACD,gBAAa,SAAS,sBAAsB,MAAM;AAClD,UAAO,GAAG,KACR,IAAI,UACF,wBACA,oCACA,EACE,OAAO,KAAK,UAAU,MAAM,EAC7B,CACF,CACF;;EAIH,MAAM,OAAO,OAAO,OAAO,QAAQ,OAC/B,GAAG,QAAQ,OAAO,KAAK,GACvB,GAAG,KACD,IAAI,UACF,wBACA,yCACD,CACF;EAGL,IAAI;AACJ,MAAI,eAAe,eAAe,EAAE;GAClC,MAAM,iBAAiB,gBAAgB,QAAQ,WAAW;AAC1D,kBAAe,OAAO,QAAQ,mBAAmB,OAC7C,GAAG,QAAQ,QAAQ,gBAAiB,GACpC,GAAG,KACD,IAAI,UACF,0BACA,kDACD,CACF;AACL,cAAW,KAAK,YAAY,QAAQ,WAAW,CAAC;;EAGlD,IAAI;AACJ,MAAI,YAAY,UAAU,MAAM;GAC9B,MAAM,kBAAkB,gBAAgB,SAAS,WAAW;AAC5D,WAAQ,OAAO,QAAQ,oBAAoB,OACvC,GAAG,QAAQ,QAAQ,iBAAkB,GACrC,GAAG,KACD,IAAI,UACF,wBACA,0CACD,CACF;AACL,cAAW,KAAK,YAAY,SAAS,WAAW,CAAC;;EAInD,MAAM,SAAS,OAAO,aAAa,gBAAgB,MAAM,aAAa;AAEtE,MAAI,YAAY,mBAAmB,OACjC,QAAO,GAAG,KAAK;GACb,UAAU,YAAY,eAAgB,QAAQ,EAAE,OAAO,CAAC;GACxD,MAAM,MACJ,IAAI,UACF,wBACA,4BAA4B,aAAa,QAAQ,EAAE,UAAU,OAAO,EAAE,GACvE;GACJ,CAAC;EAKJ,MAAM,UAAU,OAAO,kBAAkB,YADtB,OAAO,eAAe,YAAY,aAAa,OAAO,CACT;AAEhE,eAAa,SAAS,oCAAoC;GACxD;GACA,WAAW,QAAQ;GACpB,CAAC;EAIF,MAAM,YAAY,0BAA0B;GAAE;GAAc,OAD9C;GACqD,CAAC;AAEpE,SAAO;GACL;GACA,mBAAmB,QAAQ;GAC3B,SAAS;GACT;GACD;GACD"}

package/dist/server/passkey.d.ts

@@ -0,0 +1,27 @@
+import { AuthDataModel, GenericActionCtxWithAuthConfig, PasskeyProviderConfig, SessionInfo } from "./types.js";
+import { AuthError } from "./authError.js";
+import { Fx } from "@robelest/fx";
+
+//#region src/server/passkey.d.ts
+type EnrichedActionCtx = GenericActionCtxWithAuthConfig<AuthDataModel>;
+/** Result type for all passkey flows. */
+type PasskeyResult = {
+  kind: "signedIn";
+  signedIn: SessionInfo | null;
+} | {
+  kind: "passkeyOptions";
+  options: Record<string, any>;
+  verifier: string;
+};
+/**
+ * Main passkey handler dispatched from signIn.ts.
+ *
+ * Routes to the appropriate phase based on `params.flow` via `dispatchFx`.
+ */
+declare function handlePasskeyFx(ctx: EnrichedActionCtx, provider: PasskeyProviderConfig, args: {
+  params?: Record<string, any>;
+  verifier?: string;
+}): Fx<PasskeyResult, AuthError>;
+//#endregion
+export { handlePasskeyFx };
+//# sourceMappingURL=passkey.d.ts.map

package/dist/server/passkey.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"passkey.d.ts","names":[],"sources":["../../src/server/passkey.ts"],"mappings":";;;;;KAmEK,iBAAA,GAAoB,8BAAA,CAA+B,aAAA;;KAoKnD,aAAA;EACC,IAAA;EAAkB,QAAA,EAAU,WAAA;AAAA;EAC5B,IAAA;EAAwB,OAAA,EAAS,MAAA;EAAqB,QAAA;AAAA;;;;;;iBAgD5C,eAAA,CACd,GAAA,EAAK,iBAAA,EACL,QAAA,EAAU,qBAAA,EACV,IAAA;EACE,MAAA,GAAS,MAAA;EACT,QAAA;AAAA,IAED,EAAA,CAAO,aAAA,EAAe,SAAA"}