@robelest/convex-auth 0.0.4-preview.2 → 0.0.4-preview.21

package/dist/server/utils.js.map

@@ -1 +1 @@
-{"version":3,"file":"utils.js","names":[],"sources":["../../src/server/utils.ts"],"sourcesContent":["import { throwAuthError } from \"./errors\";\n\nexport function requireEnv(name: string) {\n  const value = process.env[name];\n  if (value === undefined) {\n    throwAuthError(\"MISSING_ENV_VAR\", `Missing environment variable \\`${name}\\``, { variable: name });\n  }\n  return value;\n}\n\nexport function isLocalHost(host?: string) {\n  return /(localhost|127\\.0\\.0\\.1):\\d+/.test(\n  host ?? \"\");\n}"],"mappings":";;;AAEA,SAAgB,WAAW,MAAc;CACvC,MAAM,QAAQ,QAAQ,IAAI;AAC1B,KAAI,UAAU,OACZ,gBAAe,mBAAmB,kCAAkC,KAAK,KAAK,EAAE,UAAU,MAAM,CAAC;AAEnG,QAAO;;AAGT,SAAgB,YAAY,MAAe;AACzC,QAAO,+BAA+B,KACtC,QAAQ,GAAG"}
+{"version":3,"file":"utils.js","names":["rawSha256","osloGenerateRandomString"],"sources":["../../src/server/utils.ts"],"sourcesContent":["import {\n  RandomReader,\n  generateRandomString as osloGenerateRandomString,\n} from \"@oslojs/crypto/random\";\nimport { sha256 as rawSha256 } from \"@oslojs/crypto/sha2\";\nimport {\n  decodeBase64urlIgnorePadding,\n  encodeBase64urlNoPadding,\n  encodeHexLowerCase,\n} from \"@oslojs/encoding\";\n\nimport { AuthError } from \"./authError\";\n\n/**\n * Require an environment variable to be set, throwing at config time if missing.\n *\n * Uses `AuthError.toConvexError()` directly since this is a synchronous guard\n * called inline in many expressions — not suitable for Fx pipeline wrapping.\n */\n/** @internal */\nexport function requireEnv(name: string) {\n  const value = process.env[name];\n  if (value === undefined) {\n    throw new AuthError(\n      \"MISSING_ENV_VAR\",\n      `Missing environment variable \\`${name}\\``,\n      { variable: name },\n    ).toConvexError();\n  }\n  return value;\n}\n\n/** @internal */\nexport function isLocalHost(host?: string) {\n  if (host === undefined) {\n    return false;\n  }\n  const raw = host.includes(\"://\") ? host : `http://${host}`;\n  let url: URL;\n  try {\n    url = new URL(raw);\n  } catch {\n    return false;\n  }\n  return (\n    url.hostname === \"localhost\" ||\n    url.hostname === \"127.0.0.1\" ||\n    url.hostname === \"::1\"\n  );\n}\n\n// Internal server utilities (merged from former internalUtils.ts)\n\n/** @internal */\nexport const TOKEN_SUB_CLAIM_DIVIDER = \"|\";\n/** @internal */\nexport const REFRESH_TOKEN_DIVIDER = \"|\";\n\n/** @internal */\nexport async function sha256(input: string) {\n  return encodeHexLowerCase(rawSha256(new TextEncoder().encode(input)));\n}\n\n/** @internal */\nexport function generateRandomString(length: number, alphabet: string) {\n  const random: RandomReader = {\n    read(bytes) {\n      crypto.getRandomValues(bytes as Uint8Array<ArrayBuffer>);\n    },\n  };\n\n  return osloGenerateRandomString(random, alphabet, length);\n}\n\n/** @internal */\nexport function errorMessage(error: unknown) {\n  return error instanceof Error ? error.message : String(error);\n}\n\n/** @internal */\nexport function logError(error: unknown) {\n  logWithLevel(\n    LOG_LEVELS.ERROR,\n    error instanceof Error\n      ? error.message + \"\\n\" + error.stack?.replace(\"\\\\n\", \"\\n\")\n      : error,\n  );\n}\n\n/** @internal */\nexport const LOG_LEVELS = {\n  ERROR: \"ERROR\",\n  WARN: \"WARN\",\n  INFO: \"INFO\",\n  DEBUG: \"DEBUG\",\n} as const;\ntype LogLevel = keyof typeof LOG_LEVELS;\n\n/** @internal */\nexport function logWithLevel(level: LogLevel, ...args: unknown[]) {\n  const configuredLogLevel =\n    LOG_LEVELS[\n      (process.env.AUTH_LOG_LEVEL as LogLevel | undefined) ?? \"INFO\"\n    ] ?? \"INFO\";\n  switch (level) {\n    case \"ERROR\":\n      console.error(...args);\n      break;\n    case \"WARN\":\n      if (configuredLogLevel !== \"ERROR\") {\n        console.warn(...args);\n      }\n      break;\n    case \"INFO\":\n      if (configuredLogLevel === \"INFO\" || configuredLogLevel === \"DEBUG\") {\n        console.info(...args);\n      }\n      break;\n    case \"DEBUG\":\n      if (configuredLogLevel === \"DEBUG\") {\n        console.debug(...args);\n      }\n      break;\n  }\n}\n\nconst UNREDACTED_LENGTH = 5;\n/** @internal */\nexport function maybeRedact(value: string) {\n  if (value === \"\") {\n    return \"\";\n  }\n  const shouldRedact = process.env.AUTH_LOG_SECRETS !== \"true\";\n  if (shouldRedact) {\n    if (value.length < UNREDACTED_LENGTH * 2) {\n      return \"<redacted>\";\n    }\n    return (\n      value.substring(0, UNREDACTED_LENGTH) +\n      \"<redacted>\" +\n      value.substring(value.length - UNREDACTED_LENGTH)\n    );\n  } else {\n    return value;\n  }\n}\n\nconst SECRET_KEY_ENV = \"AUTH_SECRET_ENCRYPTION_KEY\";\nconst SECRET_IV_LENGTH = 12;\n\nfunction toArrayBuffer(bytes: Uint8Array) {\n  return bytes.buffer.slice(\n    bytes.byteOffset,\n    bytes.byteOffset + bytes.byteLength,\n  ) as ArrayBuffer;\n}\n\nasync function getSecretCryptoKey() {\n  const material = requireEnv(SECRET_KEY_ENV);\n  const rawKey = rawSha256(new TextEncoder().encode(material));\n  return await crypto.subtle.importKey(\n    \"raw\",\n    toArrayBuffer(rawKey),\n    { name: \"AES-GCM\" },\n    false,\n    [\"encrypt\", \"decrypt\"],\n  );\n}\n\n/** @internal */\nexport async function encryptSecret(value: string) {\n  const key = await getSecretCryptoKey();\n  const iv = crypto.getRandomValues(new Uint8Array(SECRET_IV_LENGTH));\n  const encrypted = await crypto.subtle.encrypt(\n    { name: \"AES-GCM\", iv: toArrayBuffer(iv) },\n    key,\n    toArrayBuffer(new TextEncoder().encode(value)),\n  );\n  return `${encodeBase64urlNoPadding(iv)}.${encodeBase64urlNoPadding(new Uint8Array(encrypted))}`;\n}\n\n/** @internal */\nexport async function decryptSecret(ciphertext: string) {\n  const [ivEncoded, payloadEncoded] = ciphertext.split(\".\");\n  if (!ivEncoded || !payloadEncoded) {\n    throw new AuthError(\n      \"INVALID_PARAMETERS\",\n      \"Stored enterprise secret is malformed.\",\n    ).toConvexError();\n  }\n  const key = await getSecretCryptoKey();\n  const decrypted = await crypto.subtle.decrypt(\n    {\n      name: \"AES-GCM\",\n      iv: toArrayBuffer(decodeBase64urlIgnorePadding(ivEncoded)),\n    },\n    key,\n    toArrayBuffer(decodeBase64urlIgnorePadding(payloadEncoded)),\n  );\n  return new TextDecoder().decode(decrypted);\n}\n"],"mappings":";;;;;;;;;;;;;AAoBA,SAAgB,WAAW,MAAc;CACvC,MAAM,QAAQ,QAAQ,IAAI;AAC1B,KAAI,UAAU,OACZ,OAAM,IAAI,UACR,mBACA,kCAAkC,KAAK,KACvC,EAAE,UAAU,MAAM,CACnB,CAAC,eAAe;AAEnB,QAAO;;;AAIT,SAAgB,YAAY,MAAe;AACzC,KAAI,SAAS,OACX,QAAO;CAET,MAAM,MAAM,KAAK,SAAS,MAAM,GAAG,OAAO,UAAU;CACpD,IAAI;AACJ,KAAI;AACF,QAAM,IAAI,IAAI,IAAI;SACZ;AACN,SAAO;;AAET,QACE,IAAI,aAAa,eACjB,IAAI,aAAa,eACjB,IAAI,aAAa;;;AAOrB,MAAa,0BAA0B;;AAEvC,MAAa,wBAAwB;;AAGrC,eAAsB,OAAO,OAAe;AAC1C,QAAO,mBAAmBA,SAAU,IAAI,aAAa,CAAC,OAAO,MAAM,CAAC,CAAC;;;AAIvE,SAAgB,qBAAqB,QAAgB,UAAkB;AAOrE,QAAOC,uBANsB,EAC3B,KAAK,OAAO;AACV,SAAO,gBAAgB,MAAiC;IAE3D,EAEuC,UAAU,OAAO;;;AAI3D,SAAgB,aAAa,OAAgB;AAC3C,QAAO,iBAAiB,QAAQ,MAAM,UAAU,OAAO,MAAM;;;AAI/D,SAAgB,SAAS,OAAgB;AACvC,cACE,WAAW,OACX,iBAAiB,QACb,MAAM,UAAU,OAAO,MAAM,OAAO,QAAQ,OAAO,KAAK,GACxD,MACL;;;AAIH,MAAa,aAAa;CACxB,OAAO;CACP,MAAM;CACN,MAAM;CACN,OAAO;CACR;;AAID,SAAgB,aAAa,OAAiB,GAAG,MAAiB;CAChE,MAAM,qBACJ,WACG,QAAQ,IAAI,kBAA2C,WACrD;AACP,SAAQ,OAAR;EACE,KAAK;AACH,WAAQ,MAAM,GAAG,KAAK;AACtB;EACF,KAAK;AACH,OAAI,uBAAuB,QACzB,SAAQ,KAAK,GAAG,KAAK;AAEvB;EACF,KAAK;AACH,OAAI,uBAAuB,UAAU,uBAAuB,QAC1D,SAAQ,KAAK,GAAG,KAAK;AAEvB;EACF,KAAK;AACH,OAAI,uBAAuB,QACzB,SAAQ,MAAM,GAAG,KAAK;AAExB;;;AAIN,MAAM,oBAAoB;;AAE1B,SAAgB,YAAY,OAAe;AACzC,KAAI,UAAU,GACZ,QAAO;AAGT,KADqB,QAAQ,IAAI,qBAAqB,QACpC;AAChB,MAAI,MAAM,SAAS,oBAAoB,EACrC,QAAO;AAET,SACE,MAAM,UAAU,GAAG,kBAAkB,GACrC,eACA,MAAM,UAAU,MAAM,SAAS,kBAAkB;OAGnD,QAAO;;AAIX,MAAM,iBAAiB;AACvB,MAAM,mBAAmB;AAEzB,SAAS,cAAc,OAAmB;AACxC,QAAO,MAAM,OAAO,MAClB,MAAM,YACN,MAAM,aAAa,MAAM,WAC1B;;AAGH,eAAe,qBAAqB;CAClC,MAAM,WAAW,WAAW,eAAe;CAC3C,MAAM,SAASD,SAAU,IAAI,aAAa,CAAC,OAAO,SAAS,CAAC;AAC5D,QAAO,MAAM,OAAO,OAAO,UACzB,OACA,cAAc,OAAO,EACrB,EAAE,MAAM,WAAW,EACnB,OACA,CAAC,WAAW,UAAU,CACvB;;;AAIH,eAAsB,cAAc,OAAe;CACjD,MAAM,MAAM,MAAM,oBAAoB;CACtC,MAAM,KAAK,OAAO,gBAAgB,IAAI,WAAW,iBAAiB,CAAC;CACnE,MAAM,YAAY,MAAM,OAAO,OAAO,QACpC;EAAE,MAAM;EAAW,IAAI,cAAc,GAAG;EAAE,EAC1C,KACA,cAAc,IAAI,aAAa,CAAC,OAAO,MAAM,CAAC,CAC/C;AACD,QAAO,GAAG,yBAAyB,GAAG,CAAC,GAAG,yBAAyB,IAAI,WAAW,UAAU,CAAC;;;AAI/F,eAAsB,cAAc,YAAoB;CACtD,MAAM,CAAC,WAAW,kBAAkB,WAAW,MAAM,IAAI;AACzD,KAAI,CAAC,aAAa,CAAC,eACjB,OAAM,IAAI,UACR,sBACA,yCACD,CAAC,eAAe;CAEnB,MAAM,MAAM,MAAM,oBAAoB;CACtC,MAAM,YAAY,MAAM,OAAO,OAAO,QACpC;EACE,MAAM;EACN,IAAI,cAAc,6BAA6B,UAAU,CAAC;EAC3D,EACD,KACA,cAAc,6BAA6B,eAAe,CAAC,CAC5D;AACD,QAAO,IAAI,aAAa,CAAC,OAAO,UAAU"}

package/package.json

@@ -1,53 +1,30 @@
 {
   "name": "@robelest/convex-auth",
-  "version": "0.0.4-preview.2",
+  "version": "0.0.4-preview.21",
   "description": "Authentication for Convex",
   "keywords": [
+    "auth",
     "authentication",
     "authorization",
-    "auth",
+    "convex",
     "login",
-    "sign",
-    "convex"
+    "sign"
   ],
-  "homepage": "https://labs.convex.dev/auth",
+  "homepage": "https://auth.estifanos.com/",
   "bugs": "https://github.com/robelest/convex-auth/issues",
+  "license": "Apache-2.0",
+  "author": "robelest",
   "repository": {
     "type": "git",
     "url": "git+https://github.com/robelest/convex-auth.git"
   },
-  "license": "Apache-2.0",
-  "author": "xixixao",
+  "bin": "./dist/bin.js",
   "files": [
     "dist",
     "src"
   ],
   "type": "module",
-  "bin": "./dist/bin.cjs",
   "sideEffects": false,
-  "scripts": {
-    "build:version": "node ../../scripts/generate-version.js",
-    "build:lib": "tsdown",
-    "build:component:dts": "node ../../scripts/fix-component-entrypoint-dts.js",
-    "build:bin": "esbuild src/cli/index.ts --bundle --platform=node --format=cjs --outfile=dist/bin.cjs",
-    "build": "rm -rf dist && bun run build:version && bun run build:lib && bun run build:component:dts && bun run build:bin",
-    "typecheck:consumer": "tsc --project tsconfig.consumer.json --noEmit",
-    "check:attw": "attw --pack . --profile esm-only --exclude-entrypoints ./test ./_generated/component.js",
-    "check:publint": "publint --strict",
-    "check:packaging": "bun run check:attw && bun run check:publint",
-    "docs": "bun run --cwd ../../docs dev",
-    "lint": "tsc --project tsconfig.server.json --noEmit && tsc --project tsconfig.client.json --noEmit && tsc --project tsconfig.component.json --noEmit && bun run --cwd ../.. lint",
-    "spellcheck": "cspell \"docs/pages/**/*.md*\"",
-    "prepare": "bun run build",
-    "prepublishOnly": "bun run lint && bun run build && bun run typecheck:consumer && bun run check:packaging && bun run test:once",
-    "test": "bun run --cwd ../../packages/test test",
-    "test:once": "bun run --cwd ../../packages/test test:once",
-    "convex:dev": "bun run --cwd ../.. dev:convex",
-    "convex:codegen": "bun run --cwd ../.. codegen:convex",
-    "convex:codegen:component": "bun run --cwd ../.. codegen:convex:component",
-    "convex:dashboard": "bunx convex dashboard",
-    "convex:run": "bunx convex run"
-  },
   "exports": {
     "./_generated/component.js": {
       "types": "./dist/component/_generated/component.d.ts"
@@ -65,6 +42,10 @@
       "types": "./dist/component/index.d.ts",
       "import": "./dist/component/index.js"
     },
+    "./authorization": {
+      "types": "./dist/authorization/index.d.ts",
+      "import": "./dist/authorization/index.js"
+    },
     "./convex.config": {
       "types": "./dist/component/convex.config.d.ts",
       "default": "./dist/component/convex.config.js"
@@ -87,40 +68,62 @@
     }
   },
   "dependencies": {
+    "@noble/hashes": "^2.0.1",
     "@oslojs/crypto": "^1.0.1",
     "@oslojs/encoding": "^1.1.0",
     "@oslojs/otp": "^1.1.0",
     "@oslojs/webauthn": "^1.0.0",
+    "@robelest/fx": "^0.0.1-preview.4",
     "arctic": "^3.7.0",
     "cookie": "^1.1.1",
     "fluent-convex": "^0.12.3",
     "jose": "^6.1.3",
     "jwt-decode": "^4.0.0",
-    "lucia": "^3.2.2"
-  },
-  "peerDependencies": {
-    "convex": "^1.32.0"
+    "@robelest/samlify": "0.0.1-preview.2"
   },
-  "@comment devDependencies": [
-    "The dependencies of the CLI are also in devDependencies, built into",
-    "a bundle."
-  ],
   "devDependencies": {
     "@arethetypeswrong/cli": "^0.18.2",
+    "@clack/prompts": "^1.1.0",
     "@commander-js/extra-typings": "^14.0.0",
-    "@types/inquirer": "^9.0.9",
     "@types/node": "25.2.2",
-    "chalk": "^5.6.2",
-    "convex": "^1.32.0",
+    "convex": "^1.34.0",
     "convex-test": "^0.0.41",
     "cspell": "^9.6.4",
     "dotenv": "^17.2.4",
     "esbuild": "^0.27.3",
-    "inquirer": "^13.2.2",
     "publint": "^0.3.17",
     "shelljs": "^0.10.0",
     "tsdown": "0.20.0-beta.3",
-    "typescript": "^5.9.3",
-    "valibot": "^1.2.0"
+    "typescript": "^6.0.2",
+    "valibot": "^1.2.0",
+    "vite-plus": "^0.1.13"
+  },
+  "peerDependencies": {
+    "convex": "^1.33.1"
+  },
+  "@comment devDependencies": [
+    "The CLI deps (@clack/prompts, @commander-js/extra-typings, dotenv,",
+    "valibot) are devDependencies because they are bundled into dist/bin.cjs",
+    "via esbuild."
+  ],
+  "scripts": {
+    "build:lib": "vp exec tsdown",
+    "build:component:dts": "vp exec node ../../scripts/fix-component-entrypoint-dts.js",
+    "build": "rm -rf dist && vp run build:lib && vp run build:component:dts",
+    "typecheck": "vp exec tsc --project tsconfig.server.json --noEmit && vp exec tsc --project tsconfig.client.json --noEmit && vp exec tsc --project tsconfig.component.json --noEmit",
+    "typecheck:consumer": "vp exec tsc --project tsconfig.consumer.json --noEmit",
+    "check:attw": "vp exec attw --pack . --profile esm-only --exclude-entrypoints ./test ./_generated/component.js",
+    "check:publint": "vp exec publint --strict",
+    "check:packaging": "vp run check:attw && vp run check:publint",
+    "docs": "vp run --cwd ../../docs dev",
+    "lint": "vp run typecheck",
+    "spellcheck": "cspell \"docs/pages/**/*.md*\"",
+    "test": "vp test --config ../../vite.config.ts --project convex --project node --project interop",
+    "test:once": "vp test --config ../../vite.config.ts --run --project convex --project node --project interop",
+    "convex:dev": "vp exec convex dev",
+    "convex:codegen": "vp exec convex codegen",
+    "convex:codegen:component": "vp exec convex codegen --component-dir ./src/component",
+    "convex:dashboard": "vp exec convex dashboard",
+    "convex:run": "vp exec convex run"
   }
-}
+}

package/src/authorization/index.ts

@@ -0,0 +1,83 @@
+/**
+ * Lightweight authorization helpers.
+ *
+ * @module
+ */
+
+/**
+ * Define typed role definitions for authorization.
+ *
+ * Transforms a declarative roles configuration object into a normalized
+ * map where each role has an `id` (matching its key), an optional `label`,
+ * and a typed `grants` array. The returned object is fully type-safe:
+ * role IDs and grant strings are narrowed to their literal types, so
+ * `member.resolve()` and `member.create()` calls are checked at compile time.
+ * This is the canonical way to define role metadata for the auth library.
+ *
+ * @param roles - An object mapping role IDs to their configuration.
+ *   Each entry must include a `grants` array of permission strings and
+ *   may include an optional human-readable `label`.
+ * @typeParam TRoles - The object literal shape of your role definitions.
+ * @returns An object with the same keys as `roles`, where each value
+ *   is `{ id, label?, grants }` — `id` is the role key as a string,
+ *   and `grants` is a mutable array of the declared grant strings.
+ *
+ * @example
+ * ```ts
+ * import { defineRoles } from "@robelest/convex-auth/authorization";
+ *
+ * const roles = defineRoles({
+ *   admin: { label: "Administrator", grants: ["issues:write", "members:manage"] },
+ *   member: { label: "Member", grants: ["issues:write"] },
+ *   viewer: { grants: ["issues:read"] },
+ * });
+ *
+ * // roles.admin.id   === "admin"
+ * // roles.admin.grants === ["issues:write", "members:manage"]
+ *
+ * // Pass to createAuth:
+ * const auth = createAuth(components.auth, {
+ *   providers: [...],
+ *   authorization: { roles },
+ * });
+ * ```
+ *
+ * @example
+ * ```ts
+ * type RoleId = keyof typeof roles;
+ * // RoleId = "admin" | "member" | "viewer"
+ * ```
+ *
+ * @see {@link ConvexAuthConfig}
+ */
+export function defineRoles<
+  const TRoles extends Record<
+    string,
+    { label?: string; grants: readonly string[] }
+  >,
+>(
+  roles: TRoles,
+): {
+  [K in keyof TRoles]: {
+    id: K & string;
+    label?: TRoles[K]["label"];
+    grants: Array<TRoles[K]["grants"][number] & string>;
+  };
+} {
+  return Object.fromEntries(
+    Object.entries(roles).map(([id, role]) => [
+      id,
+      {
+        id,
+        ...(role.label ? { label: role.label } : {}),
+        grants: [...role.grants],
+      },
+    ]),
+  ) as {
+    [K in keyof TRoles]: {
+      id: K & string;
+      label?: TRoles[K]["label"];
+      grants: Array<TRoles[K]["grants"][number] & string>;
+    };
+  };
+}

package/src/cli/bin.ts

@@ -0,0 +1,5 @@
+#!/usr/bin/env node
+
+import { program } from "./index";
+
+program.parse(process.argv);

package/src/cli/command.ts

@@ -1,10 +1,11 @@
-import { Command, Option } from "@commander-js/extra-typings";
+import {
+  Command,
+  Option,
+  type OptionValues,
+} from "@commander-js/extra-typings";
 
 declare module "@commander-js/extra-typings" {
-  interface Command<
-    Args extends any[] = [],
-    Opts extends OptionValues = {},
-  > {
+  interface Command<Args extends any[] = [], Opts extends OptionValues = {}> {
     /**
      * For a command that talks to the configured dev deployment by default,
      * add flags for talking to prod, preview, or other deployment in the same