@robelest/convex-auth 0.0.4-preview.21 → 0.0.4-preview.23

package/dist/component/server/mutations/retrieve.js

@@ -1,11 +1,10 @@
-import { AuthError } from "../authError.js";
 import { LOG_LEVELS, logWithLevel, maybeRedact } from "../utils.js";
-import { authDb } from "../db.js";
 import { verify } from "../crypto.js";
+import { authDb } from "../db.js";
 import { AUTH_STORE_REF } from "./store/refs.js";
 import { isSignInRateLimited, recordFailedSignIn, resetSignInRateLimit } from "../limits.js";
-import { v } from "convex/values";
 import { Fx } from "@robelest/fx";
+import { v } from "convex/values";
 
 //#region src/server/mutations/retrieve.ts
 const retrieveAccountWithCredentialsArgs = v.object({
@@ -25,29 +24,26 @@ function retrieveAccountWithCredentialsImpl(ctx, args, getProviderOrThrow, confi
 			secret: maybeRedact(account.secret ?? "")
 		}
 	});
-	return Fx.from({
-		ok: async () => {
-			const existingAccount = await db.accounts.get(providerId, account.id);
-			if (existingAccount === null) return "InvalidAccountId";
-			if (account.secret !== void 0) {
-				if (await Fx.run(isSignInRateLimited(ctx, existingAccount._id, config))) return "TooManyFailedAttempts";
-				if (!await Fx.run(verify(getProviderOrThrow(providerId), account.secret, existingAccount.secret ?? ""))) {
-					await Fx.run(recordFailedSignIn(ctx, existingAccount._id, config));
-					return "InvalidSecret";
-				}
-				await Fx.run(resetSignInRateLimit(ctx, existingAccount._id, config));
+	return Fx.gen(function* () {
+		const existingAccount = yield* Fx.promise(() => db.accounts.get(providerId, account.id));
+		if (existingAccount === null) return "InvalidAccountId";
+		if (account.secret !== void 0) {
+			if (yield* isSignInRateLimited(ctx, existingAccount._id, config)) return "TooManyFailedAttempts";
+			if (!(yield* verify(getProviderOrThrow(providerId), account.secret, existingAccount.secret ?? ""))) {
+				yield* recordFailedSignIn(ctx, existingAccount._id, config);
+				return "InvalidSecret";
 			}
-			const user = await db.users.getById(existingAccount.userId);
-			if (user === null) {
-				logWithLevel(LOG_LEVELS.ERROR, `Account ${existingAccount._id} is linked to missing user ${existingAccount.userId}`);
-				return "InvalidAccountId";
-			}
-			return {
-				account: existingAccount,
-				user
-			};
-		},
-		err: () => new AuthError("INTERNAL_ERROR", "Failed to look up account")
+			yield* resetSignInRateLimit(ctx, existingAccount._id, config);
+		}
+		const user = yield* Fx.promise(() => db.users.getById(existingAccount.userId));
+		if (user === null) {
+			logWithLevel(LOG_LEVELS.ERROR, `Account ${existingAccount._id} is linked to missing user ${existingAccount.userId}`);
+			return "InvalidAccountId";
+		}
+		return {
+			account: existingAccount,
+			user
+		};
 	}).pipe(Fx.fold({
 		ok: (v$1) => v$1,
 		err: () => "InvalidAccountId"

package/dist/component/server/mutations/retrieve.js.map

@@ -1 +1 @@
-{"version":3,"file":"retrieve.js","names":["Provider.verify","v"],"sources":["../../../../src/server/mutations/retrieve.ts"],"sourcesContent":["import { Fx } from \"@robelest/fx\";\nimport type { GenericActionCtx, GenericDataModel } from \"convex/server\";\nimport { Infer, v } from \"convex/values\";\n\nimport { authDb } from \"../db\";\nimport { AuthError } from \"../authError\";\nimport * as Provider from \"../crypto\";\nimport {\n  isSignInRateLimited,\n  recordFailedSignIn,\n  resetSignInRateLimit,\n} from \"../limits\";\nimport { Doc, MutationCtx } from \"../types\";\nimport { LOG_LEVELS, logWithLevel, maybeRedact } from \"../utils\";\nimport { AUTH_STORE_REF } from \"./store/refs\";\n\nexport const retrieveAccountWithCredentialsArgs = v.object({\n  provider: v.string(),\n  account: v.object({ id: v.string(), secret: v.optional(v.string()) }),\n});\n\ntype ReturnType =\n  | \"InvalidAccountId\"\n  | \"TooManyFailedAttempts\"\n  | \"InvalidSecret\"\n  | { account: Doc<\"Account\">; user: Doc<\"User\"> };\n\nexport function retrieveAccountWithCredentialsImpl(\n  ctx: MutationCtx,\n  args: Infer<typeof retrieveAccountWithCredentialsArgs>,\n  getProviderOrThrow: Provider.GetProviderOrThrowFunc,\n  config: Provider.Config,\n): Fx<ReturnType> {\n  const { provider: providerId, account } = args;\n  const db = authDb(ctx, config);\n\n  logWithLevel(LOG_LEVELS.DEBUG, \"retrieveAccountWithCredentialsImpl args:\", {\n    provider: providerId,\n    account: { id: account.id, secret: maybeRedact(account.secret ?? \"\") },\n  });\n\n  return Fx.from({\n    ok: async () => {\n      const existingAccount = (await db.accounts.get(\n        providerId,\n        account.id,\n      )) as Doc<\"Account\"> | null;\n      if (existingAccount === null) {\n        return \"InvalidAccountId\" as const;\n      }\n\n      if (account.secret !== undefined) {\n        const limited = await Fx.run(\n          isSignInRateLimited(ctx, existingAccount._id, config),\n        );\n        if (limited) {\n          return \"TooManyFailedAttempts\" as const;\n        }\n\n        const valid = await Fx.run(\n          Provider.verify(\n            getProviderOrThrow(providerId),\n            account.secret,\n            existingAccount.secret ?? \"\",\n          ),\n        );\n        if (!valid) {\n          await Fx.run(recordFailedSignIn(ctx, existingAccount._id, config));\n          return \"InvalidSecret\" as const;\n        }\n\n        await Fx.run(resetSignInRateLimit(ctx, existingAccount._id, config));\n      }\n\n      const user = (await db.users.getById(\n        existingAccount.userId,\n      )) as Doc<\"User\"> | null;\n      if (user === null) {\n        logWithLevel(\n          LOG_LEVELS.ERROR,\n          `Account ${existingAccount._id} is linked to missing user ${existingAccount.userId}`,\n        );\n        return \"InvalidAccountId\" as const;\n      }\n\n      return { account: existingAccount, user } as const;\n    },\n    err: () => new AuthError(\"INTERNAL_ERROR\", \"Failed to look up account\"),\n  }).pipe(\n    Fx.fold({\n      ok: (v) => v as ReturnType,\n      err: () => \"InvalidAccountId\" as ReturnType,\n    }),\n  );\n}\n\nexport const callRetrieveAccountWithCredentials = async <\n  DataModel extends GenericDataModel,\n>(\n  ctx: GenericActionCtx<DataModel>,\n  args: Infer<typeof retrieveAccountWithCredentialsArgs>,\n): Promise<ReturnType> => {\n  return ctx.runMutation(AUTH_STORE_REF, {\n    args: {\n      type: \"retrieveAccountWithCredentials\",\n      ...args,\n    },\n  });\n};\n"],"mappings":";;;;;;;;;;AAgBA,MAAa,qCAAqC,EAAE,OAAO;CACzD,UAAU,EAAE,QAAQ;CACpB,SAAS,EAAE,OAAO;EAAE,IAAI,EAAE,QAAQ;EAAE,QAAQ,EAAE,SAAS,EAAE,QAAQ,CAAC;EAAE,CAAC;CACtE,CAAC;AAQF,SAAgB,mCACd,KACA,MACA,oBACA,QACgB;CAChB,MAAM,EAAE,UAAU,YAAY,YAAY;CAC1C,MAAM,KAAK,OAAO,KAAK,OAAO;AAE9B,cAAa,WAAW,OAAO,4CAA4C;EACzE,UAAU;EACV,SAAS;GAAE,IAAI,QAAQ;GAAI,QAAQ,YAAY,QAAQ,UAAU,GAAG;GAAE;EACvE,CAAC;AAEF,QAAO,GAAG,KAAK;EACb,IAAI,YAAY;GACd,MAAM,kBAAmB,MAAM,GAAG,SAAS,IACzC,YACA,QAAQ,GACT;AACD,OAAI,oBAAoB,KACtB,QAAO;AAGT,OAAI,QAAQ,WAAW,QAAW;AAIhC,QAHgB,MAAM,GAAG,IACvB,oBAAoB,KAAK,gBAAgB,KAAK,OAAO,CACtD,CAEC,QAAO;AAUT,QAAI,CAPU,MAAM,GAAG,IACrBA,OACE,mBAAmB,WAAW,EAC9B,QAAQ,QACR,gBAAgB,UAAU,GAC3B,CACF,EACW;AACV,WAAM,GAAG,IAAI,mBAAmB,KAAK,gBAAgB,KAAK,OAAO,CAAC;AAClE,YAAO;;AAGT,UAAM,GAAG,IAAI,qBAAqB,KAAK,gBAAgB,KAAK,OAAO,CAAC;;GAGtE,MAAM,OAAQ,MAAM,GAAG,MAAM,QAC3B,gBAAgB,OACjB;AACD,OAAI,SAAS,MAAM;AACjB,iBACE,WAAW,OACX,WAAW,gBAAgB,IAAI,6BAA6B,gBAAgB,SAC7E;AACD,WAAO;;AAGT,UAAO;IAAE,SAAS;IAAiB;IAAM;;EAE3C,WAAW,IAAI,UAAU,kBAAkB,4BAA4B;EACxE,CAAC,CAAC,KACD,GAAG,KAAK;EACN,KAAK,QAAMC;EACX,WAAW;EACZ,CAAC,CACH;;AAGH,MAAa,qCAAqC,OAGhD,KACA,SACwB;AACxB,QAAO,IAAI,YAAY,gBAAgB,EACrC,MAAM;EACJ,MAAM;EACN,GAAG;EACJ,EACF,CAAC"}
+{"version":3,"file":"retrieve.js","names":["Provider.verify","v"],"sources":["../../../../src/server/mutations/retrieve.ts"],"sourcesContent":["import { Fx } from \"@robelest/fx\";\nimport type { GenericActionCtx, GenericDataModel } from \"convex/server\";\nimport { Infer, v } from \"convex/values\";\n\nimport * as Provider from \"../crypto\";\nimport { authDb } from \"../db\";\nimport {\n  isSignInRateLimited,\n  recordFailedSignIn,\n  resetSignInRateLimit,\n} from \"../limits\";\nimport { Doc, MutationCtx } from \"../types\";\nimport { LOG_LEVELS, logWithLevel, maybeRedact } from \"../utils\";\nimport { AUTH_STORE_REF } from \"./store/refs\";\n\nexport const retrieveAccountWithCredentialsArgs = v.object({\n  provider: v.string(),\n  account: v.object({ id: v.string(), secret: v.optional(v.string()) }),\n});\n\ntype ReturnType =\n  | \"InvalidAccountId\"\n  | \"TooManyFailedAttempts\"\n  | \"InvalidSecret\"\n  | { account: Doc<\"Account\">; user: Doc<\"User\"> };\n\nexport function retrieveAccountWithCredentialsImpl(\n  ctx: MutationCtx,\n  args: Infer<typeof retrieveAccountWithCredentialsArgs>,\n  getProviderOrThrow: Provider.GetProviderOrThrowFunc,\n  config: Provider.Config,\n): Fx<ReturnType> {\n  const { provider: providerId, account } = args;\n  const db = authDb(ctx, config);\n\n  logWithLevel(LOG_LEVELS.DEBUG, \"retrieveAccountWithCredentialsImpl args:\", {\n    provider: providerId,\n    account: { id: account.id, secret: maybeRedact(account.secret ?? \"\") },\n  });\n\n  return Fx.gen(function* () {\n    const existingAccount = yield* Fx.promise(\n      () =>\n        db.accounts.get(\n          providerId,\n          account.id,\n        ) as Promise<Doc<\"Account\"> | null>,\n    );\n    if (existingAccount === null) {\n      return \"InvalidAccountId\" as const;\n    }\n\n    if (account.secret !== undefined) {\n      const limited = yield* isSignInRateLimited(\n        ctx,\n        existingAccount._id,\n        config,\n      );\n      if (limited) {\n        return \"TooManyFailedAttempts\" as const;\n      }\n\n      const valid = yield* Provider.verify(\n        getProviderOrThrow(providerId),\n        account.secret,\n        existingAccount.secret ?? \"\",\n      );\n      if (!valid) {\n        yield* recordFailedSignIn(ctx, existingAccount._id, config);\n        return \"InvalidSecret\" as const;\n      }\n\n      yield* resetSignInRateLimit(ctx, existingAccount._id, config);\n    }\n\n    const user = yield* Fx.promise(\n      () =>\n        db.users.getById(existingAccount.userId) as Promise<Doc<\"User\"> | null>,\n    );\n    if (user === null) {\n      logWithLevel(\n        LOG_LEVELS.ERROR,\n        `Account ${existingAccount._id} is linked to missing user ${existingAccount.userId}`,\n      );\n      return \"InvalidAccountId\" as const;\n    }\n\n    return { account: existingAccount, user } as ReturnType;\n  }).pipe(\n    Fx.fold({\n      ok: (v) => v as ReturnType,\n      err: () => \"InvalidAccountId\" as ReturnType,\n    }),\n  );\n}\n\nexport const callRetrieveAccountWithCredentials = async <\n  DataModel extends GenericDataModel,\n>(\n  ctx: GenericActionCtx<DataModel>,\n  args: Infer<typeof retrieveAccountWithCredentialsArgs>,\n): Promise<ReturnType> => {\n  return ctx.runMutation(AUTH_STORE_REF, {\n    args: {\n      type: \"retrieveAccountWithCredentials\",\n      ...args,\n    },\n  });\n};\n"],"mappings":";;;;;;;;;AAeA,MAAa,qCAAqC,EAAE,OAAO;CACzD,UAAU,EAAE,QAAQ;CACpB,SAAS,EAAE,OAAO;EAAE,IAAI,EAAE,QAAQ;EAAE,QAAQ,EAAE,SAAS,EAAE,QAAQ,CAAC;EAAE,CAAC;CACtE,CAAC;AAQF,SAAgB,mCACd,KACA,MACA,oBACA,QACgB;CAChB,MAAM,EAAE,UAAU,YAAY,YAAY;CAC1C,MAAM,KAAK,OAAO,KAAK,OAAO;AAE9B,cAAa,WAAW,OAAO,4CAA4C;EACzE,UAAU;EACV,SAAS;GAAE,IAAI,QAAQ;GAAI,QAAQ,YAAY,QAAQ,UAAU,GAAG;GAAE;EACvE,CAAC;AAEF,QAAO,GAAG,IAAI,aAAa;EACzB,MAAM,kBAAkB,OAAO,GAAG,cAE9B,GAAG,SAAS,IACV,YACA,QAAQ,GACT,CACJ;AACD,MAAI,oBAAoB,KACtB,QAAO;AAGT,MAAI,QAAQ,WAAW,QAAW;AAMhC,OALgB,OAAO,oBACrB,KACA,gBAAgB,KAChB,OACD,CAEC,QAAO;AAQT,OAAI,EALU,OAAOA,OACnB,mBAAmB,WAAW,EAC9B,QAAQ,QACR,gBAAgB,UAAU,GAC3B,GACW;AACV,WAAO,mBAAmB,KAAK,gBAAgB,KAAK,OAAO;AAC3D,WAAO;;AAGT,UAAO,qBAAqB,KAAK,gBAAgB,KAAK,OAAO;;EAG/D,MAAM,OAAO,OAAO,GAAG,cAEnB,GAAG,MAAM,QAAQ,gBAAgB,OAAO,CAC3C;AACD,MAAI,SAAS,MAAM;AACjB,gBACE,WAAW,OACX,WAAW,gBAAgB,IAAI,6BAA6B,gBAAgB,SAC7E;AACD,UAAO;;AAGT,SAAO;GAAE,SAAS;GAAiB;GAAM;GACzC,CAAC,KACD,GAAG,KAAK;EACN,KAAK,QAAMC;EACX,WAAW;EACZ,CAAC,CACH;;AAGH,MAAa,qCAAqC,OAGhD,KACA,SACwB;AACxB,QAAO,IAAI,YAAY,gBAAgB,EACrC,MAAM;EACJ,MAAM;EACN,GAAG;EACJ,EACF,CAAC"}

package/dist/component/server/mutations/signature.js

@@ -1,8 +1,8 @@
-import { AuthError } from "../authError.js";
 import { authDb } from "../db.js";
 import { AUTH_STORE_REF } from "./store/refs.js";
-import { v } from "convex/values";
+import { Cv } from "@robelest/fx/convex";
 import { Fx } from "@robelest/fx";
+import { v } from "convex/values";
 
 //#region src/server/mutations/signature.ts
 const verifierSignatureArgs = v.object({
@@ -15,8 +15,14 @@ function verifierSignatureImpl(ctx, args, config) {
 		const db = authDb(ctx, config);
 		const verifierDoc = yield* Fx.from({
 			ok: () => db.verifiers.getById(verifier),
-			err: () => new AuthError("INVALID_VERIFIER")
-		}).pipe(Fx.chain((doc) => doc === null ? Fx.fail(new AuthError("INVALID_VERIFIER")) : Fx.succeed(doc)));
+			err: () => Cv.error({
+				code: "INVALID_VERIFIER",
+				message: "Invalid or expired verifier."
+			})
+		}).pipe(Fx.chain((doc) => doc === null ? Cv.fail({
+			code: "INVALID_VERIFIER",
+			message: "Invalid or expired verifier."
+		}) : Fx.succeed(doc)));
 		yield* Fx.promise(() => db.verifiers.patch(verifierDoc._id, { signature }));
 	});
 }

package/dist/component/server/mutations/signature.js.map

@@ -1 +1 @@
-{"version":3,"file":"signature.js","names":[],"sources":["../../../../src/server/mutations/signature.ts"],"sourcesContent":["import { Fx } from \"@robelest/fx\";\nimport type { GenericActionCtx, GenericDataModel } from \"convex/server\";\nimport { GenericId, Infer, v } from \"convex/values\";\n\nimport { authDb } from \"../db\";\nimport { AuthError } from \"../authError\";\nimport * as Provider from \"../crypto\";\nimport { MutationCtx } from \"../types\";\nimport { AUTH_STORE_REF } from \"./store/refs\";\n\nexport const verifierSignatureArgs = v.object({\n  verifier: v.string(),\n  signature: v.string(),\n});\n\ntype ReturnType = void;\n\nexport function verifierSignatureImpl(\n  ctx: MutationCtx,\n  args: Infer<typeof verifierSignatureArgs>,\n  config: Provider.Config,\n): Fx<ReturnType, AuthError> {\n  return Fx.gen(function* () {\n    const { verifier, signature } = args;\n    const db = authDb(ctx, config);\n    const verifierDoc = yield* Fx.from({\n      ok: () => db.verifiers.getById(verifier as GenericId<\"AuthVerifier\">),\n      err: () => new AuthError(\"INVALID_VERIFIER\"),\n    }).pipe(\n      Fx.chain((doc) =>\n        doc === null\n          ? Fx.fail(new AuthError(\"INVALID_VERIFIER\"))\n          : Fx.succeed(doc),\n      ),\n    );\n    yield* Fx.promise(() => db.verifiers.patch(verifierDoc._id, { signature }));\n  });\n}\n\nexport const callVerifierSignature = async <DataModel extends GenericDataModel>(\n  ctx: GenericActionCtx<DataModel>,\n  args: Infer<typeof verifierSignatureArgs>,\n): Promise<void> => {\n  return ctx.runMutation(AUTH_STORE_REF, {\n    args: {\n      type: \"verifierSignature\",\n      ...args,\n    },\n  });\n};\n"],"mappings":";;;;;;;AAUA,MAAa,wBAAwB,EAAE,OAAO;CAC5C,UAAU,EAAE,QAAQ;CACpB,WAAW,EAAE,QAAQ;CACtB,CAAC;AAIF,SAAgB,sBACd,KACA,MACA,QAC2B;AAC3B,QAAO,GAAG,IAAI,aAAa;EACzB,MAAM,EAAE,UAAU,cAAc;EAChC,MAAM,KAAK,OAAO,KAAK,OAAO;EAC9B,MAAM,cAAc,OAAO,GAAG,KAAK;GACjC,UAAU,GAAG,UAAU,QAAQ,SAAsC;GACrE,WAAW,IAAI,UAAU,mBAAmB;GAC7C,CAAC,CAAC,KACD,GAAG,OAAO,QACR,QAAQ,OACJ,GAAG,KAAK,IAAI,UAAU,mBAAmB,CAAC,GAC1C,GAAG,QAAQ,IAAI,CACpB,CACF;AACD,SAAO,GAAG,cAAc,GAAG,UAAU,MAAM,YAAY,KAAK,EAAE,WAAW,CAAC,CAAC;GAC3E;;AAGJ,MAAa,wBAAwB,OACnC,KACA,SACkB;AAClB,QAAO,IAAI,YAAY,gBAAgB,EACrC,MAAM;EACJ,MAAM;EACN,GAAG;EACJ,EACF,CAAC"}
+{"version":3,"file":"signature.js","names":[],"sources":["../../../../src/server/mutations/signature.ts"],"sourcesContent":["import { Fx } from \"@robelest/fx\";\nimport { Cv } from \"@robelest/fx/convex\";\nimport type { GenericActionCtx, GenericDataModel } from \"convex/server\";\nimport { ConvexError, GenericId, Infer, v } from \"convex/values\";\n\nimport * as Provider from \"../crypto\";\nimport { authDb } from \"../db\";\nimport { MutationCtx } from \"../types\";\nimport { AUTH_STORE_REF } from \"./store/refs\";\n\nexport const verifierSignatureArgs = v.object({\n  verifier: v.string(),\n  signature: v.string(),\n});\n\ntype ReturnType = void;\n\nexport function verifierSignatureImpl(\n  ctx: MutationCtx,\n  args: Infer<typeof verifierSignatureArgs>,\n  config: Provider.Config,\n): Fx<ReturnType, ConvexError<any>> {\n  return Fx.gen(function* () {\n    const { verifier, signature } = args;\n    const db = authDb(ctx, config);\n    const verifierDoc = yield* Fx.from({\n      ok: () => db.verifiers.getById(verifier as GenericId<\"AuthVerifier\">),\n      err: () =>\n        Cv.error({\n          code: \"INVALID_VERIFIER\",\n          message: \"Invalid or expired verifier.\",\n        }),\n    }).pipe(\n      Fx.chain((doc) =>\n        doc === null\n          ? Cv.fail({\n              code: \"INVALID_VERIFIER\",\n              message: \"Invalid or expired verifier.\",\n            })\n          : Fx.succeed(doc),\n      ),\n    );\n    yield* Fx.promise(() => db.verifiers.patch(verifierDoc._id, { signature }));\n  });\n}\n\nexport const callVerifierSignature = async <DataModel extends GenericDataModel>(\n  ctx: GenericActionCtx<DataModel>,\n  args: Infer<typeof verifierSignatureArgs>,\n): Promise<void> => {\n  return ctx.runMutation(AUTH_STORE_REF, {\n    args: {\n      type: \"verifierSignature\",\n      ...args,\n    },\n  });\n};\n"],"mappings":";;;;;;;AAUA,MAAa,wBAAwB,EAAE,OAAO;CAC5C,UAAU,EAAE,QAAQ;CACpB,WAAW,EAAE,QAAQ;CACtB,CAAC;AAIF,SAAgB,sBACd,KACA,MACA,QACkC;AAClC,QAAO,GAAG,IAAI,aAAa;EACzB,MAAM,EAAE,UAAU,cAAc;EAChC,MAAM,KAAK,OAAO,KAAK,OAAO;EAC9B,MAAM,cAAc,OAAO,GAAG,KAAK;GACjC,UAAU,GAAG,UAAU,QAAQ,SAAsC;GACrE,WACE,GAAG,MAAM;IACP,MAAM;IACN,SAAS;IACV,CAAC;GACL,CAAC,CAAC,KACD,GAAG,OAAO,QACR,QAAQ,OACJ,GAAG,KAAK;GACN,MAAM;GACN,SAAS;GACV,CAAC,GACF,GAAG,QAAQ,IAAI,CACpB,CACF;AACD,SAAO,GAAG,cAAc,GAAG,UAAU,MAAM,YAAY,KAAK,EAAE,WAAW,CAAC,CAAC;GAC3E;;AAGJ,MAAa,wBAAwB,OACnC,KACA,SACkB;AAClB,QAAO,IAAI,YAAY,gBAAgB,EACrC,MAAM;EACJ,MAAM;EACN,GAAG;EACJ,EACF,CAAC"}

package/dist/component/server/mutations/signout.js.map

@@ -1 +1 @@
-{"version":3,"file":"signout.js","names":[],"sources":["../../../../src/server/mutations/signout.ts"],"sourcesContent":["import { Fx } from \"@robelest/fx\";\nimport type { GenericActionCtx, GenericDataModel } from \"convex/server\";\nimport { GenericId } from \"convex/values\";\n\nimport { authDb } from \"../db\";\nimport * as Provider from \"../crypto\";\nimport { deleteSession, getAuthSessionId } from \"../sessions\";\nimport { MutationCtx } from \"../types\";\nimport { AUTH_STORE_REF } from \"./store/refs\";\n\ntype ReturnType = {\n  userId: GenericId<\"User\">;\n  sessionId: GenericId<\"Session\">;\n} | null;\n\nexport function signOutImpl(\n  ctx: MutationCtx,\n  config: Provider.Config,\n): Fx<ReturnType, never> {\n  return Fx.gen(function* () {\n    const db = authDb(ctx, config);\n    const sessionId = yield* Fx.promise(() => getAuthSessionId(ctx));\n    if (sessionId === null) {\n      return null;\n    }\n    const session = yield* Fx.promise(() => db.sessions.getById(sessionId));\n    if (session === null) {\n      return null;\n    }\n    yield* Fx.promise(() => deleteSession(ctx, session, config));\n    return { userId: session.userId, sessionId: session._id };\n  });\n}\n\nexport const callSignOut = async <DataModel extends GenericDataModel>(\n  ctx: GenericActionCtx<DataModel>,\n): Promise<void> => {\n  return ctx.runMutation(AUTH_STORE_REF, {\n    args: {\n      type: \"signOut\",\n    },\n  });\n};\n"],"mappings":";;;;;;AAeA,SAAgB,YACd,KACA,QACuB;AACvB,QAAO,GAAG,IAAI,aAAa;EACzB,MAAM,KAAK,OAAO,KAAK,OAAO;EAC9B,MAAM,YAAY,OAAO,GAAG,cAAc,iBAAiB,IAAI,CAAC;AAChE,MAAI,cAAc,KAChB,QAAO;EAET,MAAM,UAAU,OAAO,GAAG,cAAc,GAAG,SAAS,QAAQ,UAAU,CAAC;AACvE,MAAI,YAAY,KACd,QAAO;AAET,SAAO,GAAG,cAAc,cAAc,KAAK,SAAS,OAAO,CAAC;AAC5D,SAAO;GAAE,QAAQ,QAAQ;GAAQ,WAAW,QAAQ;GAAK;GACzD;;AAGJ,MAAa,cAAc,OACzB,QACkB;AAClB,QAAO,IAAI,YAAY,gBAAgB,EACrC,MAAM,EACJ,MAAM,WACP,EACF,CAAC"}
+{"version":3,"file":"signout.js","names":[],"sources":["../../../../src/server/mutations/signout.ts"],"sourcesContent":["import { Fx } from \"@robelest/fx\";\nimport type { GenericActionCtx, GenericDataModel } from \"convex/server\";\nimport { GenericId } from \"convex/values\";\n\nimport * as Provider from \"../crypto\";\nimport { authDb } from \"../db\";\nimport { deleteSession, getAuthSessionId } from \"../sessions\";\nimport { MutationCtx } from \"../types\";\nimport { AUTH_STORE_REF } from \"./store/refs\";\n\ntype ReturnType = {\n  userId: GenericId<\"User\">;\n  sessionId: GenericId<\"Session\">;\n} | null;\n\nexport function signOutImpl(\n  ctx: MutationCtx,\n  config: Provider.Config,\n): Fx<ReturnType, never> {\n  return Fx.gen(function* () {\n    const db = authDb(ctx, config);\n    const sessionId = yield* Fx.promise(() => getAuthSessionId(ctx));\n    if (sessionId === null) {\n      return null;\n    }\n    const session = yield* Fx.promise(() => db.sessions.getById(sessionId));\n    if (session === null) {\n      return null;\n    }\n    yield* Fx.promise(() => deleteSession(ctx, session, config));\n    return { userId: session.userId, sessionId: session._id };\n  });\n}\n\nexport const callSignOut = async <DataModel extends GenericDataModel>(\n  ctx: GenericActionCtx<DataModel>,\n): Promise<void> => {\n  return ctx.runMutation(AUTH_STORE_REF, {\n    args: {\n      type: \"signOut\",\n    },\n  });\n};\n"],"mappings":";;;;;;AAeA,SAAgB,YACd,KACA,QACuB;AACvB,QAAO,GAAG,IAAI,aAAa;EACzB,MAAM,KAAK,OAAO,KAAK,OAAO;EAC9B,MAAM,YAAY,OAAO,GAAG,cAAc,iBAAiB,IAAI,CAAC;AAChE,MAAI,cAAc,KAChB,QAAO;EAET,MAAM,UAAU,OAAO,GAAG,cAAc,GAAG,SAAS,QAAQ,UAAU,CAAC;AACvE,MAAI,YAAY,KACd,QAAO;AAET,SAAO,GAAG,cAAc,cAAc,KAAK,SAAS,OAAO,CAAC;AAC5D,SAAO;GAAE,QAAQ,QAAQ;GAAQ,WAAW,QAAQ;GAAK;GACzD;;AAGJ,MAAa,cAAc,OACzB,QACkB;AAClB,QAAO,IAAI,YAAY,gBAAgB,EACrC,MAAM,EACJ,MAAM,WACP,EACF,CAAC"}

package/dist/component/server/mutations/store.js

@@ -11,8 +11,8 @@ import { signInArgs, signInImpl } from "./signin.js";
 import { signOutImpl } from "./signout.js";
 import { verifierImpl } from "./verifier.js";
 import { verifyCodeAndSignInArgs, verifyCodeAndSignInImpl } from "./verify.js";
-import { v } from "convex/values";
 import { Fx } from "@robelest/fx";
+import { v } from "convex/values";
 
 //#region src/server/mutations/store.ts
 const storeArgs = v.object({ args: v.union(v.object({
@@ -50,32 +50,17 @@ const storeImpl = async (ctx, fnArgs, getProviderOrThrow, config) => {
 	const args = fnArgs.args;
 	logWithLevel(LOG_LEVELS.INFO, `\`auth:store\` type: ${args.type}`);
 	return Fx.run(Fx.match(args, args.type, {
-		signIn: (a) => Fx.from({
-			ok: () => signInImpl(ctx, a, config),
-			err: (e) => e
-		}),
+		signIn: (a) => Fx.promise(() => signInImpl(ctx, a, config)),
 		signOut: () => signOutImpl(ctx, config),
-		refreshSession: (a) => Fx.from({
-			ok: () => refreshSessionImpl(ctx, a, getProviderOrThrow, config),
-			err: (e) => e
-		}),
-		verifyCodeAndSignIn: (a) => Fx.from({
-			ok: () => verifyCodeAndSignInImpl(ctx, a, getProviderOrThrow, config),
-			err: (e) => e
-		}),
+		refreshSession: (a) => Fx.promise(() => refreshSessionImpl(ctx, a, getProviderOrThrow, config)),
+		verifyCodeAndSignIn: (a) => Fx.promise(() => verifyCodeAndSignInImpl(ctx, a, getProviderOrThrow, config)),
 		verifier: () => verifierImpl(ctx, config),
-		verifierSignature: (a) => verifierSignatureImpl(ctx, a, config).pipe(Fx.recover((e) => Fx.fatal(e.toConvexError()))),
-		userOAuth: (a) => userOAuthImpl(ctx, a, getProviderOrThrow, config).pipe(Fx.recover((e) => Fx.fatal(e.toConvexError()))),
-		createVerificationCode: (a) => Fx.from({
-			ok: () => createVerificationCodeImpl(ctx, a, getProviderOrThrow, config),
-			err: (e) => e
-		}),
-		createAccountFromCredentials: (a) => Fx.from({
-			ok: () => createAccountFromCredentialsImpl(ctx, a, getProviderOrThrow, config),
-			err: (e) => e
-		}),
+		verifierSignature: (a) => verifierSignatureImpl(ctx, a, config).pipe(Fx.recover((e) => Fx.fatal(e))),
+		userOAuth: (a) => userOAuthImpl(ctx, a, getProviderOrThrow, config).pipe(Fx.recover((e) => Fx.fatal(e))),
+		createVerificationCode: (a) => Fx.promise(() => createVerificationCodeImpl(ctx, a, getProviderOrThrow, config)),
+		createAccountFromCredentials: (a) => Fx.promise(() => createAccountFromCredentialsImpl(ctx, a, getProviderOrThrow, config)),
 		retrieveAccountWithCredentials: (a) => retrieveAccountWithCredentialsImpl(ctx, a, getProviderOrThrow, config),
-		modifyAccount: (a) => modifyAccountImpl(ctx, a, getProviderOrThrow, config).pipe(Fx.recover((e) => Fx.fatal(e.toConvexError()))),
+		modifyAccount: (a) => modifyAccountImpl(ctx, a, getProviderOrThrow, config).pipe(Fx.recover((e) => Fx.fatal(e))),
 		invalidateSessions: (a) => invalidateSessionsImpl(ctx, a, config)
 	}));
 };

package/dist/component/server/mutations/store.js.map

@@ -1 +1 @@
-{"version":3,"file":"store.js","names":[],"sources":["../../../../src/server/mutations/store.ts"],"sourcesContent":["import { Fx } from \"@robelest/fx\";\nimport { Infer, v } from \"convex/values\";\n\nimport * as Provider from \"../crypto\";\nimport { MutationCtx } from \"../types\";\nimport { LOG_LEVELS, logWithLevel } from \"../utils\";\nimport { modifyAccountArgs, modifyAccountImpl } from \"./account\";\nimport { createVerificationCodeArgs, createVerificationCodeImpl } from \"./code\";\nimport { invalidateSessionsArgs, invalidateSessionsImpl } from \"./invalidate\";\nimport { userOAuthArgs, userOAuthImpl } from \"./oauth\";\nimport { refreshSessionArgs, refreshSessionImpl } from \"./refresh\";\nimport {\n  createAccountFromCredentialsArgs,\n  createAccountFromCredentialsImpl,\n} from \"./register\";\nimport {\n  retrieveAccountWithCredentialsArgs,\n  retrieveAccountWithCredentialsImpl,\n} from \"./retrieve\";\nimport { verifierSignatureArgs, verifierSignatureImpl } from \"./signature\";\nimport { signInArgs, signInImpl } from \"./signin\";\nimport { signOutImpl } from \"./signout\";\nimport { verifierImpl } from \"./verifier\";\nimport { verifyCodeAndSignInArgs, verifyCodeAndSignInImpl } from \"./verify\";\n\nexport const storeArgs = v.object({\n  args: v.union(\n    v.object({\n      type: v.literal(\"signIn\"),\n      ...signInArgs.fields,\n    }),\n    v.object({\n      type: v.literal(\"signOut\"),\n    }),\n    v.object({\n      type: v.literal(\"refreshSession\"),\n      ...refreshSessionArgs.fields,\n    }),\n    v.object({\n      type: v.literal(\"verifyCodeAndSignIn\"),\n      ...verifyCodeAndSignInArgs.fields,\n    }),\n    v.object({\n      type: v.literal(\"verifier\"),\n    }),\n    v.object({\n      type: v.literal(\"verifierSignature\"),\n      ...verifierSignatureArgs.fields,\n    }),\n    v.object({\n      type: v.literal(\"userOAuth\"),\n      ...userOAuthArgs.fields,\n    }),\n    v.object({\n      type: v.literal(\"createVerificationCode\"),\n      ...createVerificationCodeArgs.fields,\n    }),\n    v.object({\n      type: v.literal(\"createAccountFromCredentials\"),\n      ...createAccountFromCredentialsArgs.fields,\n    }),\n    v.object({\n      type: v.literal(\"retrieveAccountWithCredentials\"),\n      ...retrieveAccountWithCredentialsArgs.fields,\n    }),\n    v.object({\n      type: v.literal(\"modifyAccount\"),\n      ...modifyAccountArgs.fields,\n    }),\n    v.object({\n      type: v.literal(\"invalidateSessions\"),\n      ...invalidateSessionsArgs.fields,\n    }),\n  ),\n});\n\nexport const storeImpl = async (\n  ctx: MutationCtx,\n  fnArgs: Infer<typeof storeArgs>,\n  getProviderOrThrow: Provider.GetProviderOrThrowFunc,\n  config: Provider.Config,\n) => {\n  const args = fnArgs.args;\n  logWithLevel(LOG_LEVELS.INFO, `\\`auth:store\\` type: ${args.type}`);\n  return Fx.run(\n    Fx.match(args, args.type, {\n      signIn: (a) =>\n        Fx.from({\n          ok: () => signInImpl(ctx, a, config),\n          err: (e) => e as never,\n        }),\n      signOut: () => signOutImpl(ctx, config),\n      refreshSession: (a) =>\n        Fx.from({\n          ok: () => refreshSessionImpl(ctx, a, getProviderOrThrow, config),\n          err: (e) => e as never,\n        }),\n      verifyCodeAndSignIn: (a) =>\n        Fx.from({\n          ok: () => verifyCodeAndSignInImpl(ctx, a, getProviderOrThrow, config),\n          err: (e) => e as never,\n        }),\n      verifier: () => verifierImpl(ctx, config),\n      verifierSignature: (a) =>\n        verifierSignatureImpl(ctx, a, config).pipe(\n          Fx.recover((e) => Fx.fatal(e.toConvexError())),\n        ),\n      userOAuth: (a) =>\n        userOAuthImpl(ctx, a, getProviderOrThrow, config).pipe(\n          Fx.recover((e) => Fx.fatal(e.toConvexError())),\n        ),\n      createVerificationCode: (a) =>\n        Fx.from({\n          ok: () =>\n            createVerificationCodeImpl(ctx, a, getProviderOrThrow, config),\n          err: (e) => e as never,\n        }),\n      createAccountFromCredentials: (a) =>\n        Fx.from({\n          ok: () =>\n            createAccountFromCredentialsImpl(\n              ctx,\n              a,\n              getProviderOrThrow,\n              config,\n            ),\n          err: (e) => e as never,\n        }),\n      retrieveAccountWithCredentials: (a) =>\n        retrieveAccountWithCredentialsImpl(ctx, a, getProviderOrThrow, config),\n      modifyAccount: (a) =>\n        modifyAccountImpl(ctx, a, getProviderOrThrow, config).pipe(\n          Fx.recover((e) => Fx.fatal(e.toConvexError())),\n        ),\n      invalidateSessions: (a) => invalidateSessionsImpl(ctx, a, config),\n    }),\n  );\n};\n"],"mappings":";;;;;;;;;;;;;;;;;AAyBA,MAAa,YAAY,EAAE,OAAO,EAChC,MAAM,EAAE,MACN,EAAE,OAAO;CACP,MAAM,EAAE,QAAQ,SAAS;CACzB,GAAG,WAAW;CACf,CAAC,EACF,EAAE,OAAO,EACP,MAAM,EAAE,QAAQ,UAAU,EAC3B,CAAC,EACF,EAAE,OAAO;CACP,MAAM,EAAE,QAAQ,iBAAiB;CACjC,GAAG,mBAAmB;CACvB,CAAC,EACF,EAAE,OAAO;CACP,MAAM,EAAE,QAAQ,sBAAsB;CACtC,GAAG,wBAAwB;CAC5B,CAAC,EACF,EAAE,OAAO,EACP,MAAM,EAAE,QAAQ,WAAW,EAC5B,CAAC,EACF,EAAE,OAAO;CACP,MAAM,EAAE,QAAQ,oBAAoB;CACpC,GAAG,sBAAsB;CAC1B,CAAC,EACF,EAAE,OAAO;CACP,MAAM,EAAE,QAAQ,YAAY;CAC5B,GAAG,cAAc;CAClB,CAAC,EACF,EAAE,OAAO;CACP,MAAM,EAAE,QAAQ,yBAAyB;CACzC,GAAG,2BAA2B;CAC/B,CAAC,EACF,EAAE,OAAO;CACP,MAAM,EAAE,QAAQ,+BAA+B;CAC/C,GAAG,iCAAiC;CACrC,CAAC,EACF,EAAE,OAAO;CACP,MAAM,EAAE,QAAQ,iCAAiC;CACjD,GAAG,mCAAmC;CACvC,CAAC,EACF,EAAE,OAAO;CACP,MAAM,EAAE,QAAQ,gBAAgB;CAChC,GAAG,kBAAkB;CACtB,CAAC,EACF,EAAE,OAAO;CACP,MAAM,EAAE,QAAQ,qBAAqB;CACrC,GAAG,uBAAuB;CAC3B,CAAC,CACH,EACF,CAAC;AAEF,MAAa,YAAY,OACvB,KACA,QACA,oBACA,WACG;CACH,MAAM,OAAO,OAAO;AACpB,cAAa,WAAW,MAAM,wBAAwB,KAAK,OAAO;AAClE,QAAO,GAAG,IACR,GAAG,MAAM,MAAM,KAAK,MAAM;EACxB,SAAS,MACP,GAAG,KAAK;GACN,UAAU,WAAW,KAAK,GAAG,OAAO;GACpC,MAAM,MAAM;GACb,CAAC;EACJ,eAAe,YAAY,KAAK,OAAO;EACvC,iBAAiB,MACf,GAAG,KAAK;GACN,UAAU,mBAAmB,KAAK,GAAG,oBAAoB,OAAO;GAChE,MAAM,MAAM;GACb,CAAC;EACJ,sBAAsB,MACpB,GAAG,KAAK;GACN,UAAU,wBAAwB,KAAK,GAAG,oBAAoB,OAAO;GACrE,MAAM,MAAM;GACb,CAAC;EACJ,gBAAgB,aAAa,KAAK,OAAO;EACzC,oBAAoB,MAClB,sBAAsB,KAAK,GAAG,OAAO,CAAC,KACpC,GAAG,SAAS,MAAM,GAAG,MAAM,EAAE,eAAe,CAAC,CAAC,CAC/C;EACH,YAAY,MACV,cAAc,KAAK,GAAG,oBAAoB,OAAO,CAAC,KAChD,GAAG,SAAS,MAAM,GAAG,MAAM,EAAE,eAAe,CAAC,CAAC,CAC/C;EACH,yBAAyB,MACvB,GAAG,KAAK;GACN,UACE,2BAA2B,KAAK,GAAG,oBAAoB,OAAO;GAChE,MAAM,MAAM;GACb,CAAC;EACJ,+BAA+B,MAC7B,GAAG,KAAK;GACN,UACE,iCACE,KACA,GACA,oBACA,OACD;GACH,MAAM,MAAM;GACb,CAAC;EACJ,iCAAiC,MAC/B,mCAAmC,KAAK,GAAG,oBAAoB,OAAO;EACxE,gBAAgB,MACd,kBAAkB,KAAK,GAAG,oBAAoB,OAAO,CAAC,KACpD,GAAG,SAAS,MAAM,GAAG,MAAM,EAAE,eAAe,CAAC,CAAC,CAC/C;EACH,qBAAqB,MAAM,uBAAuB,KAAK,GAAG,OAAO;EAClE,CAAC,CACH"}
+{"version":3,"file":"store.js","names":[],"sources":["../../../../src/server/mutations/store.ts"],"sourcesContent":["import { Fx } from \"@robelest/fx\";\nimport { Infer, v } from \"convex/values\";\n\nimport * as Provider from \"../crypto\";\nimport { MutationCtx } from \"../types\";\nimport { LOG_LEVELS, logWithLevel } from \"../utils\";\nimport { modifyAccountArgs, modifyAccountImpl } from \"./account\";\nimport { createVerificationCodeArgs, createVerificationCodeImpl } from \"./code\";\nimport { invalidateSessionsArgs, invalidateSessionsImpl } from \"./invalidate\";\nimport { userOAuthArgs, userOAuthImpl } from \"./oauth\";\nimport { refreshSessionArgs, refreshSessionImpl } from \"./refresh\";\nimport {\n  createAccountFromCredentialsArgs,\n  createAccountFromCredentialsImpl,\n} from \"./register\";\nimport {\n  retrieveAccountWithCredentialsArgs,\n  retrieveAccountWithCredentialsImpl,\n} from \"./retrieve\";\nimport { verifierSignatureArgs, verifierSignatureImpl } from \"./signature\";\nimport { signInArgs, signInImpl } from \"./signin\";\nimport { signOutImpl } from \"./signout\";\nimport { verifierImpl } from \"./verifier\";\nimport { verifyCodeAndSignInArgs, verifyCodeAndSignInImpl } from \"./verify\";\n\nexport const storeArgs = v.object({\n  args: v.union(\n    v.object({\n      type: v.literal(\"signIn\"),\n      ...signInArgs.fields,\n    }),\n    v.object({\n      type: v.literal(\"signOut\"),\n    }),\n    v.object({\n      type: v.literal(\"refreshSession\"),\n      ...refreshSessionArgs.fields,\n    }),\n    v.object({\n      type: v.literal(\"verifyCodeAndSignIn\"),\n      ...verifyCodeAndSignInArgs.fields,\n    }),\n    v.object({\n      type: v.literal(\"verifier\"),\n    }),\n    v.object({\n      type: v.literal(\"verifierSignature\"),\n      ...verifierSignatureArgs.fields,\n    }),\n    v.object({\n      type: v.literal(\"userOAuth\"),\n      ...userOAuthArgs.fields,\n    }),\n    v.object({\n      type: v.literal(\"createVerificationCode\"),\n      ...createVerificationCodeArgs.fields,\n    }),\n    v.object({\n      type: v.literal(\"createAccountFromCredentials\"),\n      ...createAccountFromCredentialsArgs.fields,\n    }),\n    v.object({\n      type: v.literal(\"retrieveAccountWithCredentials\"),\n      ...retrieveAccountWithCredentialsArgs.fields,\n    }),\n    v.object({\n      type: v.literal(\"modifyAccount\"),\n      ...modifyAccountArgs.fields,\n    }),\n    v.object({\n      type: v.literal(\"invalidateSessions\"),\n      ...invalidateSessionsArgs.fields,\n    }),\n  ),\n});\n\nexport const storeImpl = async (\n  ctx: MutationCtx,\n  fnArgs: Infer<typeof storeArgs>,\n  getProviderOrThrow: Provider.GetProviderOrThrowFunc,\n  config: Provider.Config,\n) => {\n  const args = fnArgs.args;\n  logWithLevel(LOG_LEVELS.INFO, `\\`auth:store\\` type: ${args.type}`);\n  return Fx.run(\n    Fx.match(args, args.type, {\n      signIn: (a) => Fx.promise(() => signInImpl(ctx, a, config)),\n      signOut: () => signOutImpl(ctx, config),\n      refreshSession: (a) =>\n        Fx.promise(() =>\n          refreshSessionImpl(ctx, a, getProviderOrThrow, config),\n        ),\n      verifyCodeAndSignIn: (a) =>\n        Fx.promise(() =>\n          verifyCodeAndSignInImpl(ctx, a, getProviderOrThrow, config),\n        ),\n      verifier: () => verifierImpl(ctx, config),\n      verifierSignature: (a) =>\n        verifierSignatureImpl(ctx, a, config).pipe(\n          Fx.recover((e) => Fx.fatal(e)),\n        ),\n      userOAuth: (a) =>\n        userOAuthImpl(ctx, a, getProviderOrThrow, config).pipe(\n          Fx.recover((e) => Fx.fatal(e)),\n        ),\n      createVerificationCode: (a) =>\n        Fx.promise(() =>\n          createVerificationCodeImpl(ctx, a, getProviderOrThrow, config),\n        ),\n      createAccountFromCredentials: (a) =>\n        Fx.promise(() =>\n          createAccountFromCredentialsImpl(ctx, a, getProviderOrThrow, config),\n        ),\n      retrieveAccountWithCredentials: (a) =>\n        retrieveAccountWithCredentialsImpl(ctx, a, getProviderOrThrow, config),\n      modifyAccount: (a) =>\n        modifyAccountImpl(ctx, a, getProviderOrThrow, config).pipe(\n          Fx.recover((e) => Fx.fatal(e)),\n        ),\n      invalidateSessions: (a) => invalidateSessionsImpl(ctx, a, config),\n    }),\n  );\n};\n"],"mappings":";;;;;;;;;;;;;;;;;AAyBA,MAAa,YAAY,EAAE,OAAO,EAChC,MAAM,EAAE,MACN,EAAE,OAAO;CACP,MAAM,EAAE,QAAQ,SAAS;CACzB,GAAG,WAAW;CACf,CAAC,EACF,EAAE,OAAO,EACP,MAAM,EAAE,QAAQ,UAAU,EAC3B,CAAC,EACF,EAAE,OAAO;CACP,MAAM,EAAE,QAAQ,iBAAiB;CACjC,GAAG,mBAAmB;CACvB,CAAC,EACF,EAAE,OAAO;CACP,MAAM,EAAE,QAAQ,sBAAsB;CACtC,GAAG,wBAAwB;CAC5B,CAAC,EACF,EAAE,OAAO,EACP,MAAM,EAAE,QAAQ,WAAW,EAC5B,CAAC,EACF,EAAE,OAAO;CACP,MAAM,EAAE,QAAQ,oBAAoB;CACpC,GAAG,sBAAsB;CAC1B,CAAC,EACF,EAAE,OAAO;CACP,MAAM,EAAE,QAAQ,YAAY;CAC5B,GAAG,cAAc;CAClB,CAAC,EACF,EAAE,OAAO;CACP,MAAM,EAAE,QAAQ,yBAAyB;CACzC,GAAG,2BAA2B;CAC/B,CAAC,EACF,EAAE,OAAO;CACP,MAAM,EAAE,QAAQ,+BAA+B;CAC/C,GAAG,iCAAiC;CACrC,CAAC,EACF,EAAE,OAAO;CACP,MAAM,EAAE,QAAQ,iCAAiC;CACjD,GAAG,mCAAmC;CACvC,CAAC,EACF,EAAE,OAAO;CACP,MAAM,EAAE,QAAQ,gBAAgB;CAChC,GAAG,kBAAkB;CACtB,CAAC,EACF,EAAE,OAAO;CACP,MAAM,EAAE,QAAQ,qBAAqB;CACrC,GAAG,uBAAuB;CAC3B,CAAC,CACH,EACF,CAAC;AAEF,MAAa,YAAY,OACvB,KACA,QACA,oBACA,WACG;CACH,MAAM,OAAO,OAAO;AACpB,cAAa,WAAW,MAAM,wBAAwB,KAAK,OAAO;AAClE,QAAO,GAAG,IACR,GAAG,MAAM,MAAM,KAAK,MAAM;EACxB,SAAS,MAAM,GAAG,cAAc,WAAW,KAAK,GAAG,OAAO,CAAC;EAC3D,eAAe,YAAY,KAAK,OAAO;EACvC,iBAAiB,MACf,GAAG,cACD,mBAAmB,KAAK,GAAG,oBAAoB,OAAO,CACvD;EACH,sBAAsB,MACpB,GAAG,cACD,wBAAwB,KAAK,GAAG,oBAAoB,OAAO,CAC5D;EACH,gBAAgB,aAAa,KAAK,OAAO;EACzC,oBAAoB,MAClB,sBAAsB,KAAK,GAAG,OAAO,CAAC,KACpC,GAAG,SAAS,MAAM,GAAG,MAAM,EAAE,CAAC,CAC/B;EACH,YAAY,MACV,cAAc,KAAK,GAAG,oBAAoB,OAAO,CAAC,KAChD,GAAG,SAAS,MAAM,GAAG,MAAM,EAAE,CAAC,CAC/B;EACH,yBAAyB,MACvB,GAAG,cACD,2BAA2B,KAAK,GAAG,oBAAoB,OAAO,CAC/D;EACH,+BAA+B,MAC7B,GAAG,cACD,iCAAiC,KAAK,GAAG,oBAAoB,OAAO,CACrE;EACH,iCAAiC,MAC/B,mCAAmC,KAAK,GAAG,oBAAoB,OAAO;EACxE,gBAAgB,MACd,kBAAkB,KAAK,GAAG,oBAAoB,OAAO,CAAC,KACpD,GAAG,SAAS,MAAM,GAAG,MAAM,EAAE,CAAC,CAC/B;EACH,qBAAqB,MAAM,uBAAuB,KAAK,GAAG,OAAO;EAClE,CAAC,CACH"}

package/dist/component/server/mutations/verifier.js.map

@@ -1 +1 @@
-{"version":3,"file":"verifier.js","names":[],"sources":["../../../../src/server/mutations/verifier.ts"],"sourcesContent":["import { Fx } from \"@robelest/fx\";\nimport type { GenericActionCtx, GenericDataModel } from \"convex/server\";\nimport { GenericId } from \"convex/values\";\n\nimport { authDb } from \"../db\";\nimport * as Provider from \"../crypto\";\nimport { getAuthSessionId } from \"../sessions\";\nimport { MutationCtx } from \"../types\";\nimport { AUTH_STORE_REF } from \"./store/refs\";\n\ntype ReturnType = GenericId<\"AuthVerifier\">;\n\nexport function verifierImpl(\n  ctx: MutationCtx,\n  config: Provider.Config,\n): Fx<ReturnType, never> {\n  return Fx.gen(function* () {\n    return (yield* Fx.promise(async () =>\n      authDb(ctx, config).verifiers.create(\n        (await getAuthSessionId(ctx)) ?? undefined,\n      ),\n    )) as ReturnType;\n  });\n}\n\nexport const callVerifier = async <DataModel extends GenericDataModel>(\n  ctx: GenericActionCtx<DataModel>,\n): Promise<ReturnType> => {\n  return ctx.runMutation(AUTH_STORE_REF, {\n    args: {\n      type: \"verifier\",\n    },\n  });\n};\n"],"mappings":";;;;;;AAYA,SAAgB,aACd,KACA,QACuB;AACvB,QAAO,GAAG,IAAI,aAAa;AACzB,SAAQ,OAAO,GAAG,QAAQ,YACxB,OAAO,KAAK,OAAO,CAAC,UAAU,OAC3B,MAAM,iBAAiB,IAAI,IAAK,OAClC,CACF;GACD;;AAGJ,MAAa,eAAe,OAC1B,QACwB;AACxB,QAAO,IAAI,YAAY,gBAAgB,EACrC,MAAM,EACJ,MAAM,YACP,EACF,CAAC"}
+{"version":3,"file":"verifier.js","names":[],"sources":["../../../../src/server/mutations/verifier.ts"],"sourcesContent":["import { Fx } from \"@robelest/fx\";\nimport type { GenericActionCtx, GenericDataModel } from \"convex/server\";\nimport { GenericId } from \"convex/values\";\n\nimport * as Provider from \"../crypto\";\nimport { authDb } from \"../db\";\nimport { getAuthSessionId } from \"../sessions\";\nimport { MutationCtx } from \"../types\";\nimport { AUTH_STORE_REF } from \"./store/refs\";\n\ntype ReturnType = GenericId<\"AuthVerifier\">;\n\nexport function verifierImpl(\n  ctx: MutationCtx,\n  config: Provider.Config,\n): Fx<ReturnType, never> {\n  return Fx.gen(function* () {\n    return (yield* Fx.promise(async () =>\n      authDb(ctx, config).verifiers.create(\n        (await getAuthSessionId(ctx)) ?? undefined,\n      ),\n    )) as ReturnType;\n  });\n}\n\nexport const callVerifier = async <DataModel extends GenericDataModel>(\n  ctx: GenericActionCtx<DataModel>,\n): Promise<ReturnType> => {\n  return ctx.runMutation(AUTH_STORE_REF, {\n    args: {\n      type: \"verifier\",\n    },\n  });\n};\n"],"mappings":";;;;;;AAYA,SAAgB,aACd,KACA,QACuB;AACvB,QAAO,GAAG,IAAI,aAAa;AACzB,SAAQ,OAAO,GAAG,QAAQ,YACxB,OAAO,KAAK,OAAO,CAAC,UAAU,OAC3B,MAAM,iBAAiB,IAAI,IAAK,OAClC,CACF;GACD;;AAGJ,MAAa,eAAe,OAC1B,QACwB;AACxB,QAAO,IAAI,YAAY,gBAAgB,EACrC,MAAM,EACJ,MAAM,YACP,EACF,CAAC"}

package/dist/component/server/mutations/verify.js

@@ -6,8 +6,8 @@ import { upsertUserAndAccount } from "../users.js";
 import { isEnterpriseProviderId } from "../enterprise/shared.js";
 import { createSyntheticOAuthMaterializedConfig } from "../enterprise/oidc.js";
 import { isSignInRateLimited, recordFailedSignIn, resetSignInRateLimit } from "../limits.js";
-import { v } from "convex/values";
 import { Fx } from "@robelest/fx";
+import { v } from "convex/values";
 
 //#region src/server/mutations/verify.ts
 const verifyCodeAndSignInArgs = v.object({

package/dist/component/server/mutations/verify.js.map

@@ -1 +1 @@
-{"version":3,"file":"verify.js","names":[],"sources":["../../../../src/server/mutations/verify.ts"],"sourcesContent":["import { Fx } from \"@robelest/fx\";\nimport type { GenericActionCtx, GenericDataModel } from \"convex/server\";\nimport { Infer, v } from \"convex/values\";\n\nimport { authDb } from \"../db\";\nimport * as Provider from \"../crypto\";\nimport {\n  isSignInRateLimited,\n  recordFailedSignIn,\n  resetSignInRateLimit,\n} from \"../limits\";\nimport {\n  createNewAndDeleteExistingSession,\n  getAuthSessionId,\n  maybeGenerateTokensForSession,\n} from \"../sessions\";\nimport {\n  createSyntheticOAuthMaterializedConfig,\n} from \"../enterprise/oidc\";\nimport { isEnterpriseProviderId } from \"../enterprise/shared\";\nimport { MutationCtx, SessionInfo } from \"../types\";\nimport { upsertUserAndAccount } from \"../users\";\nimport { LOG_LEVELS, logWithLevel, sha256 } from \"../utils\";\nimport { requireEnv } from \"../utils\";\nimport { AUTH_STORE_REF } from \"./store/refs\";\n\nexport const verifyCodeAndSignInArgs = v.object({\n  params: v.any(),\n  provider: v.optional(v.string()),\n  verifier: v.optional(v.string()),\n  generateTokens: v.boolean(),\n  allowExtraProviders: v.boolean(),\n});\n\ntype ReturnType = null | SessionInfo;\n\n// ============================================================================\n// Small validators for the verification pipeline\n// ============================================================================\n\n/** A soft verification failure — logged and collapsed to null at the boundary. */\nclass VerifyFailure {\n  readonly _tag = \"VerifyFailure\" as const;\n  constructor(readonly reason: string) {}\n}\n\n// ============================================================================\n// Main exported function\n// ============================================================================\n\nexport async function verifyCodeAndSignInImpl(\n  ctx: MutationCtx,\n  args: Infer<typeof verifyCodeAndSignInArgs>,\n  getProviderOrThrow: Provider.GetProviderOrThrowFunc,\n  config: Provider.Config,\n): Promise<ReturnType> {\n  logWithLevel(LOG_LEVELS.DEBUG, \"verifyCodeAndSignInImpl args:\", {\n    params: { email: args.params.email, phone: args.params.phone },\n    provider: args.provider,\n    verifier: args.verifier,\n    generateTokens: args.generateTokens,\n    allowExtraProviders: args.allowExtraProviders,\n  });\n\n  const { generateTokens, provider, allowExtraProviders } = args;\n  if (generateTokens) {\n    requireEnv(\"JWT_PRIVATE_KEY\");\n    requireEnv(\"JWKS\");\n    requireEnv(\"CONVEX_SITE_URL\");\n  }\n  const identifier: string | undefined = args.params.email ?? args.params.phone;\n\n  try {\n    if (identifier !== undefined) {\n      const limited = await Fx.run(\n        isSignInRateLimited(ctx, identifier, config),\n      );\n      if (limited) {\n        throw new VerifyFailure(\n          \"Too many failed attempts to verify code for this email\",\n        );\n      }\n    }\n\n    const db = authDb(ctx, config);\n    const { params, verifier } = args;\n    const hash = await sha256(params.code);\n    const code = await db.verificationCodes.getByCode(hash);\n    if (code === null) {\n      throw new VerifyFailure(\"Invalid verification code\");\n    }\n\n    await db.verificationCodes.delete(code._id);\n\n    if (code.verifier !== verifier) {\n      throw new VerifyFailure(\"Invalid verifier\");\n    }\n    if (code.expirationTime < Date.now()) {\n      throw new VerifyFailure(\"Expired verification code\");\n    }\n    if (provider !== undefined && code.provider !== provider) {\n      throw new VerifyFailure(\n        `Invalid provider \"${provider}\" for given \\`code\\``,\n      );\n    }\n\n    const account = await db.accounts.getById(code.accountId);\n    if (account === null) {\n      throw new VerifyFailure(\n        \"Account associated with this email has been deleted\",\n      );\n    }\n\n    const codeProvider = isEnterpriseProviderId(code.provider)\n      ? createSyntheticOAuthMaterializedConfig(code.provider)\n      : getProviderOrThrow(code.provider, allowExtraProviders);\n\n    if (\n      codeProvider !== null &&\n      (codeProvider.type === \"email\" || codeProvider.type === \"phone\") &&\n      codeProvider.authorize !== undefined\n    ) {\n      await codeProvider.authorize(args.params, account);\n    }\n\n    const methodProvider = isEnterpriseProviderId(account.provider)\n      ? createSyntheticOAuthMaterializedConfig(account.provider)\n      : getProviderOrThrow(account.provider);\n\n    const userId =\n      methodProvider.type === \"oauth\"\n        ? account.userId\n        : (\n            await upsertUserAndAccount(\n              ctx,\n              await getAuthSessionId(ctx),\n              { existingAccount: account },\n              {\n                type: \"verification\",\n                provider: methodProvider,\n                profile: {\n                  ...(code.emailVerified !== undefined\n                    ? { email: code.emailVerified, emailVerified: true }\n                    : {}),\n                  ...(code.phoneVerified !== undefined\n                    ? { phone: code.phoneVerified, phoneVerified: true }\n                    : {}),\n                },\n              },\n              config,\n            )\n          ).userId;\n\n    if (identifier !== undefined) {\n      await Fx.run(resetSignInRateLimit(ctx, identifier, config));\n    }\n\n    const sessionId = await createNewAndDeleteExistingSession(\n      ctx,\n      config,\n      userId,\n    );\n    return await maybeGenerateTokensForSession(\n      ctx,\n      config,\n      userId,\n      sessionId,\n      generateTokens,\n    );\n  } catch (error) {\n    if (error instanceof VerifyFailure) {\n      logWithLevel(LOG_LEVELS.ERROR, error.reason);\n      if (identifier !== undefined) {\n        await Fx.run(recordFailedSignIn(ctx, identifier, config));\n      }\n      return null;\n    }\n    logWithLevel(\n      LOG_LEVELS.ERROR,\n      `verifyCodeAndSignInImpl failed: ${String(error)}`,\n    );\n    return null;\n  }\n}\n\n// ============================================================================\n// Action-level caller (unchanged — just forwards to mutation)\n// ============================================================================\n\nexport const callVerifyCodeAndSignIn = async <\n  DataModel extends GenericDataModel,\n>(\n  ctx: GenericActionCtx<DataModel>,\n  args: Infer<typeof verifyCodeAndSignInArgs>,\n): Promise<ReturnType> => {\n  return ctx.runMutation(AUTH_STORE_REF, {\n    args: {\n      type: \"verifyCodeAndSignIn\",\n      ...args,\n    },\n  });\n};\n"],"mappings":";;;;;;;;;;;;AA0BA,MAAa,0BAA0B,EAAE,OAAO;CAC9C,QAAQ,EAAE,KAAK;CACf,UAAU,EAAE,SAAS,EAAE,QAAQ,CAAC;CAChC,UAAU,EAAE,SAAS,EAAE,QAAQ,CAAC;CAChC,gBAAgB,EAAE,SAAS;CAC3B,qBAAqB,EAAE,SAAS;CACjC,CAAC;;AASF,IAAM,gBAAN,MAAoB;CAClB,AAAS,OAAO;CAChB,YAAY,AAAS,QAAgB;EAAhB;;;AAOvB,eAAsB,wBACpB,KACA,MACA,oBACA,QACqB;AACrB,cAAa,WAAW,OAAO,iCAAiC;EAC9D,QAAQ;GAAE,OAAO,KAAK,OAAO;GAAO,OAAO,KAAK,OAAO;GAAO;EAC9D,UAAU,KAAK;EACf,UAAU,KAAK;EACf,gBAAgB,KAAK;EACrB,qBAAqB,KAAK;EAC3B,CAAC;CAEF,MAAM,EAAE,gBAAgB,UAAU,wBAAwB;AAC1D,KAAI,gBAAgB;AAClB,aAAW,kBAAkB;AAC7B,aAAW,OAAO;AAClB,aAAW,kBAAkB;;CAE/B,MAAM,aAAiC,KAAK,OAAO,SAAS,KAAK,OAAO;AAExE,KAAI;AACF,MAAI,eAAe,QAIjB;OAHgB,MAAM,GAAG,IACvB,oBAAoB,KAAK,YAAY,OAAO,CAC7C,CAEC,OAAM,IAAI,cACR,yDACD;;EAIL,MAAM,KAAK,OAAO,KAAK,OAAO;EAC9B,MAAM,EAAE,QAAQ,aAAa;EAC7B,MAAM,OAAO,MAAM,OAAO,OAAO,KAAK;EACtC,MAAM,OAAO,MAAM,GAAG,kBAAkB,UAAU,KAAK;AACvD,MAAI,SAAS,KACX,OAAM,IAAI,cAAc,4BAA4B;AAGtD,QAAM,GAAG,kBAAkB,OAAO,KAAK,IAAI;AAE3C,MAAI,KAAK,aAAa,SACpB,OAAM,IAAI,cAAc,mBAAmB;AAE7C,MAAI,KAAK,iBAAiB,KAAK,KAAK,CAClC,OAAM,IAAI,cAAc,4BAA4B;AAEtD,MAAI,aAAa,UAAa,KAAK,aAAa,SAC9C,OAAM,IAAI,cACR,qBAAqB,SAAS,sBAC/B;EAGH,MAAM,UAAU,MAAM,GAAG,SAAS,QAAQ,KAAK,UAAU;AACzD,MAAI,YAAY,KACd,OAAM,IAAI,cACR,sDACD;EAGH,MAAM,eAAe,uBAAuB,KAAK,SAAS,GACtD,uCAAuC,KAAK,SAAS,GACrD,mBAAmB,KAAK,UAAU,oBAAoB;AAE1D,MACE,iBAAiB,SAChB,aAAa,SAAS,WAAW,aAAa,SAAS,YACxD,aAAa,cAAc,OAE3B,OAAM,aAAa,UAAU,KAAK,QAAQ,QAAQ;EAGpD,MAAM,iBAAiB,uBAAuB,QAAQ,SAAS,GAC3D,uCAAuC,QAAQ,SAAS,GACxD,mBAAmB,QAAQ,SAAS;EAExC,MAAM,SACJ,eAAe,SAAS,UACpB,QAAQ,UAEN,MAAM,qBACJ,KACA,MAAM,iBAAiB,IAAI,EAC3B,EAAE,iBAAiB,SAAS,EAC5B;GACE,MAAM;GACN,UAAU;GACV,SAAS;IACP,GAAI,KAAK,kBAAkB,SACvB;KAAE,OAAO,KAAK;KAAe,eAAe;KAAM,GAClD,EAAE;IACN,GAAI,KAAK,kBAAkB,SACvB;KAAE,OAAO,KAAK;KAAe,eAAe;KAAM,GAClD,EAAE;IACP;GACF,EACD,OACD,EACD;AAER,MAAI,eAAe,OACjB,OAAM,GAAG,IAAI,qBAAqB,KAAK,YAAY,OAAO,CAAC;AAQ7D,SAAO,MAAM,8BACX,KACA,QACA,QARgB,MAAM,kCACtB,KACA,QACA,OACD,EAMC,eACD;UACM,OAAO;AACd,MAAI,iBAAiB,eAAe;AAClC,gBAAa,WAAW,OAAO,MAAM,OAAO;AAC5C,OAAI,eAAe,OACjB,OAAM,GAAG,IAAI,mBAAmB,KAAK,YAAY,OAAO,CAAC;AAE3D,UAAO;;AAET,eACE,WAAW,OACX,mCAAmC,OAAO,MAAM,GACjD;AACD,SAAO;;;AAQX,MAAa,0BAA0B,OAGrC,KACA,SACwB;AACxB,QAAO,IAAI,YAAY,gBAAgB,EACrC,MAAM;EACJ,MAAM;EACN,GAAG;EACJ,EACF,CAAC"}
+{"version":3,"file":"verify.js","names":[],"sources":["../../../../src/server/mutations/verify.ts"],"sourcesContent":["import { Fx } from \"@robelest/fx\";\nimport type { GenericActionCtx, GenericDataModel } from \"convex/server\";\nimport { Infer, v } from \"convex/values\";\n\nimport * as Provider from \"../crypto\";\nimport { authDb } from \"../db\";\nimport { createSyntheticOAuthMaterializedConfig } from \"../enterprise/oidc\";\nimport { isEnterpriseProviderId } from \"../enterprise/shared\";\nimport {\n  isSignInRateLimited,\n  recordFailedSignIn,\n  resetSignInRateLimit,\n} from \"../limits\";\nimport {\n  createNewAndDeleteExistingSession,\n  getAuthSessionId,\n  maybeGenerateTokensForSession,\n} from \"../sessions\";\nimport { MutationCtx, SessionInfo } from \"../types\";\nimport { upsertUserAndAccount } from \"../users\";\nimport { LOG_LEVELS, logWithLevel, sha256 } from \"../utils\";\nimport { requireEnv } from \"../utils\";\nimport { AUTH_STORE_REF } from \"./store/refs\";\n\nexport const verifyCodeAndSignInArgs = v.object({\n  params: v.any(),\n  provider: v.optional(v.string()),\n  verifier: v.optional(v.string()),\n  generateTokens: v.boolean(),\n  allowExtraProviders: v.boolean(),\n});\n\ntype ReturnType = null | SessionInfo;\n\n// ============================================================================\n// Small validators for the verification pipeline\n// ============================================================================\n\n/** A soft verification failure — logged and collapsed to null at the boundary. */\nclass VerifyFailure {\n  readonly _tag = \"VerifyFailure\" as const;\n  constructor(readonly reason: string) {}\n}\n\n// ============================================================================\n// Main exported function\n// ============================================================================\n\nexport async function verifyCodeAndSignInImpl(\n  ctx: MutationCtx,\n  args: Infer<typeof verifyCodeAndSignInArgs>,\n  getProviderOrThrow: Provider.GetProviderOrThrowFunc,\n  config: Provider.Config,\n): Promise<ReturnType> {\n  logWithLevel(LOG_LEVELS.DEBUG, \"verifyCodeAndSignInImpl args:\", {\n    params: { email: args.params.email, phone: args.params.phone },\n    provider: args.provider,\n    verifier: args.verifier,\n    generateTokens: args.generateTokens,\n    allowExtraProviders: args.allowExtraProviders,\n  });\n\n  const { generateTokens, provider, allowExtraProviders } = args;\n  if (generateTokens) {\n    requireEnv(\"JWT_PRIVATE_KEY\");\n    requireEnv(\"JWKS\");\n    requireEnv(\"CONVEX_SITE_URL\");\n  }\n  const identifier: string | undefined = args.params.email ?? args.params.phone;\n\n  try {\n    if (identifier !== undefined) {\n      const limited = await Fx.run(\n        isSignInRateLimited(ctx, identifier, config),\n      );\n      if (limited) {\n        throw new VerifyFailure(\n          \"Too many failed attempts to verify code for this email\",\n        );\n      }\n    }\n\n    const db = authDb(ctx, config);\n    const { params, verifier } = args;\n    const hash = await sha256(params.code);\n    const code = await db.verificationCodes.getByCode(hash);\n    if (code === null) {\n      throw new VerifyFailure(\"Invalid verification code\");\n    }\n\n    await db.verificationCodes.delete(code._id);\n\n    if (code.verifier !== verifier) {\n      throw new VerifyFailure(\"Invalid verifier\");\n    }\n    if (code.expirationTime < Date.now()) {\n      throw new VerifyFailure(\"Expired verification code\");\n    }\n    if (provider !== undefined && code.provider !== provider) {\n      throw new VerifyFailure(\n        `Invalid provider \"${provider}\" for given \\`code\\``,\n      );\n    }\n\n    const account = await db.accounts.getById(code.accountId);\n    if (account === null) {\n      throw new VerifyFailure(\n        \"Account associated with this email has been deleted\",\n      );\n    }\n\n    const codeProvider = isEnterpriseProviderId(code.provider)\n      ? createSyntheticOAuthMaterializedConfig(code.provider)\n      : getProviderOrThrow(code.provider, allowExtraProviders);\n\n    if (\n      codeProvider !== null &&\n      (codeProvider.type === \"email\" || codeProvider.type === \"phone\") &&\n      codeProvider.authorize !== undefined\n    ) {\n      await codeProvider.authorize(args.params, account);\n    }\n\n    const methodProvider = isEnterpriseProviderId(account.provider)\n      ? createSyntheticOAuthMaterializedConfig(account.provider)\n      : getProviderOrThrow(account.provider);\n\n    const userId =\n      methodProvider.type === \"oauth\"\n        ? account.userId\n        : (\n            await upsertUserAndAccount(\n              ctx,\n              await getAuthSessionId(ctx),\n              { existingAccount: account },\n              {\n                type: \"verification\",\n                provider: methodProvider,\n                profile: {\n                  ...(code.emailVerified !== undefined\n                    ? { email: code.emailVerified, emailVerified: true }\n                    : {}),\n                  ...(code.phoneVerified !== undefined\n                    ? { phone: code.phoneVerified, phoneVerified: true }\n                    : {}),\n                },\n              },\n              config,\n            )\n          ).userId;\n\n    if (identifier !== undefined) {\n      await Fx.run(resetSignInRateLimit(ctx, identifier, config));\n    }\n\n    const sessionId = await createNewAndDeleteExistingSession(\n      ctx,\n      config,\n      userId,\n    );\n    return await maybeGenerateTokensForSession(\n      ctx,\n      config,\n      userId,\n      sessionId,\n      generateTokens,\n    );\n  } catch (error) {\n    if (error instanceof VerifyFailure) {\n      logWithLevel(LOG_LEVELS.ERROR, error.reason);\n      if (identifier !== undefined) {\n        await Fx.run(recordFailedSignIn(ctx, identifier, config));\n      }\n      return null;\n    }\n    logWithLevel(\n      LOG_LEVELS.ERROR,\n      `verifyCodeAndSignInImpl failed: ${String(error)}`,\n    );\n    return null;\n  }\n}\n\n// ============================================================================\n// Action-level caller (unchanged — just forwards to mutation)\n// ============================================================================\n\nexport const callVerifyCodeAndSignIn = async <\n  DataModel extends GenericDataModel,\n>(\n  ctx: GenericActionCtx<DataModel>,\n  args: Infer<typeof verifyCodeAndSignInArgs>,\n): Promise<ReturnType> => {\n  return ctx.runMutation(AUTH_STORE_REF, {\n    args: {\n      type: \"verifyCodeAndSignIn\",\n      ...args,\n    },\n  });\n};\n"],"mappings":";;;;;;;;;;;;AAwBA,MAAa,0BAA0B,EAAE,OAAO;CAC9C,QAAQ,EAAE,KAAK;CACf,UAAU,EAAE,SAAS,EAAE,QAAQ,CAAC;CAChC,UAAU,EAAE,SAAS,EAAE,QAAQ,CAAC;CAChC,gBAAgB,EAAE,SAAS;CAC3B,qBAAqB,EAAE,SAAS;CACjC,CAAC;;AASF,IAAM,gBAAN,MAAoB;CAClB,AAAS,OAAO;CAChB,YAAY,AAAS,QAAgB;EAAhB;;;AAOvB,eAAsB,wBACpB,KACA,MACA,oBACA,QACqB;AACrB,cAAa,WAAW,OAAO,iCAAiC;EAC9D,QAAQ;GAAE,OAAO,KAAK,OAAO;GAAO,OAAO,KAAK,OAAO;GAAO;EAC9D,UAAU,KAAK;EACf,UAAU,KAAK;EACf,gBAAgB,KAAK;EACrB,qBAAqB,KAAK;EAC3B,CAAC;CAEF,MAAM,EAAE,gBAAgB,UAAU,wBAAwB;AAC1D,KAAI,gBAAgB;AAClB,aAAW,kBAAkB;AAC7B,aAAW,OAAO;AAClB,aAAW,kBAAkB;;CAE/B,MAAM,aAAiC,KAAK,OAAO,SAAS,KAAK,OAAO;AAExE,KAAI;AACF,MAAI,eAAe,QAIjB;OAHgB,MAAM,GAAG,IACvB,oBAAoB,KAAK,YAAY,OAAO,CAC7C,CAEC,OAAM,IAAI,cACR,yDACD;;EAIL,MAAM,KAAK,OAAO,KAAK,OAAO;EAC9B,MAAM,EAAE,QAAQ,aAAa;EAC7B,MAAM,OAAO,MAAM,OAAO,OAAO,KAAK;EACtC,MAAM,OAAO,MAAM,GAAG,kBAAkB,UAAU,KAAK;AACvD,MAAI,SAAS,KACX,OAAM,IAAI,cAAc,4BAA4B;AAGtD,QAAM,GAAG,kBAAkB,OAAO,KAAK,IAAI;AAE3C,MAAI,KAAK,aAAa,SACpB,OAAM,IAAI,cAAc,mBAAmB;AAE7C,MAAI,KAAK,iBAAiB,KAAK,KAAK,CAClC,OAAM,IAAI,cAAc,4BAA4B;AAEtD,MAAI,aAAa,UAAa,KAAK,aAAa,SAC9C,OAAM,IAAI,cACR,qBAAqB,SAAS,sBAC/B;EAGH,MAAM,UAAU,MAAM,GAAG,SAAS,QAAQ,KAAK,UAAU;AACzD,MAAI,YAAY,KACd,OAAM,IAAI,cACR,sDACD;EAGH,MAAM,eAAe,uBAAuB,KAAK,SAAS,GACtD,uCAAuC,KAAK,SAAS,GACrD,mBAAmB,KAAK,UAAU,oBAAoB;AAE1D,MACE,iBAAiB,SAChB,aAAa,SAAS,WAAW,aAAa,SAAS,YACxD,aAAa,cAAc,OAE3B,OAAM,aAAa,UAAU,KAAK,QAAQ,QAAQ;EAGpD,MAAM,iBAAiB,uBAAuB,QAAQ,SAAS,GAC3D,uCAAuC,QAAQ,SAAS,GACxD,mBAAmB,QAAQ,SAAS;EAExC,MAAM,SACJ,eAAe,SAAS,UACpB,QAAQ,UAEN,MAAM,qBACJ,KACA,MAAM,iBAAiB,IAAI,EAC3B,EAAE,iBAAiB,SAAS,EAC5B;GACE,MAAM;GACN,UAAU;GACV,SAAS;IACP,GAAI,KAAK,kBAAkB,SACvB;KAAE,OAAO,KAAK;KAAe,eAAe;KAAM,GAClD,EAAE;IACN,GAAI,KAAK,kBAAkB,SACvB;KAAE,OAAO,KAAK;KAAe,eAAe;KAAM,GAClD,EAAE;IACP;GACF,EACD,OACD,EACD;AAER,MAAI,eAAe,OACjB,OAAM,GAAG,IAAI,qBAAqB,KAAK,YAAY,OAAO,CAAC;AAQ7D,SAAO,MAAM,8BACX,KACA,QACA,QARgB,MAAM,kCACtB,KACA,QACA,OACD,EAMC,eACD;UACM,OAAO;AACd,MAAI,iBAAiB,eAAe;AAClC,gBAAa,WAAW,OAAO,MAAM,OAAO;AAC5C,OAAI,eAAe,OACjB,OAAM,GAAG,IAAI,mBAAmB,KAAK,YAAY,OAAO,CAAC;AAE3D,UAAO;;AAET,eACE,WAAW,OACX,mCAAmC,OAAO,MAAM,GACjD;AACD,SAAO;;;AAQX,MAAa,0BAA0B,OAGrC,KACA,SACwB;AACxB,QAAO,IAAI,YAAY,gBAAgB,EACrC,MAAM;EACJ,MAAM;EACN,GAAG;EACJ,EACF,CAAC"}

package/dist/component/server/oauth.js

@@ -1,6 +1,6 @@
-import { AuthError } from "./authError.js";
 import { isLocalHost, logWithLevel } from "./utils.js";
 import { SHARED_COOKIE_OPTIONS } from "./cookies.js";
+import { Cv } from "@robelest/fx/convex";
 import { Fx } from "@robelest/fx";
 import * as arctic from "arctic";
 
@@ -10,7 +10,7 @@ import * as arctic from "arctic";
 *
 * Uses Arctic for OAuth provider integration.
 *
-* All functions return `Fx<A, AuthError>` composed via `Fx.gen` pipelines.
+* All functions return `Fx<A, ConvexError<any>>` composed via `Fx.gen` pipelines.
 *
 * @internal
 * @module
@@ -59,15 +59,24 @@ function isPKCEProvider(provider) {
 }
 /**
 * Exchange the authorization code for tokens via Arctic.
-* Maps Arctic-specific errors to typed `AuthError` failures.
+* Maps Arctic-specific errors to typed `ConvexError<any>` failures.
 */
 function exchangeCode(arcticProvider, code, codeVerifier) {
 	return Fx.from({
 		ok: () => isPKCEProvider(arcticProvider) ? arcticProvider.validateAuthorizationCode(code, codeVerifier) : arcticProvider.validateAuthorizationCode(code),
 		err: (e) => {
-			if (e instanceof arctic.OAuth2RequestError) return new AuthError("OAUTH_PROVIDER_ERROR", `Token exchange failed: ${e.code}`);
-			if (e instanceof arctic.ArcticFetchError) return new AuthError("OAUTH_PROVIDER_ERROR", `Network error during token exchange: ${e.message}`);
-			return new AuthError("OAUTH_PROVIDER_ERROR", `Unexpected error during token exchange: ${e instanceof Error ? e.message : String(e)}`);
+			if (e instanceof arctic.OAuth2RequestError) return Cv.error({
+				code: "OAUTH_PROVIDER_ERROR",
+				message: `Token exchange failed: ${e.code}`
+			});
+			if (e instanceof arctic.ArcticFetchError) return Cv.error({
+				code: "OAUTH_PROVIDER_ERROR",
+				message: `Network error during token exchange: ${e.message}`
+			});
+			return Cv.error({
+				code: "OAUTH_PROVIDER_ERROR",
+				message: `Unexpected error during token exchange: ${e instanceof Error ? e.message : String(e)}`
+			});
 		}
 	}).pipe(Fx.chain((tokens) => {
 		return Fx.succeed(tokens);
@@ -83,7 +92,10 @@ function extractProfile(providerId, oauthConfig, tokens) {
 	return Fx.match(profileSource, profileSource.source, {
 		callback: (_profileSource) => Fx.from({
 			ok: () => oauthConfig.profile(tokens),
-			err: (e) => new AuthError("OAUTH_INVALID_PROFILE", `Profile callback threw: ${e instanceof Error ? e.message : String(e)}`)
+			err: (e) => Cv.error({
+				code: "OAUTH_INVALID_PROFILE",
+				message: `Profile callback threw: ${e instanceof Error ? e.message : String(e)}`
+			})
 		}),
 		idToken: (_profileSource) => {
 			const claims = arctic.decodeIdToken(tokens.idToken());
@@ -94,14 +106,20 @@ function extractProfile(providerId, oauthConfig, tokens) {
 				image: claims.picture ?? void 0
 			});
 		},
-		missing: (_profileSource) => Fx.fail(new AuthError("OAUTH_INVALID_PROFILE", `Provider "${providerId}" does not return an ID token. Add a \`profile\` callback in the OAuth() config to extract user info from the access token.`))
+		missing: (_profileSource) => Cv.fail({
+			code: "OAUTH_INVALID_PROFILE",
+			message: `Provider "${providerId}" does not return an ID token. Add a \`profile\` callback in the OAuth() config to extract user info from the access token.`
+		})
 	});
 }
 /**
 * Validate that the profile has a non-empty string `id`.
 */
 function validateProfileId(providerId, profile) {
-	return typeof profile.id === "string" && profile.id ? Fx.succeed(profile) : Fx.fail(new AuthError("OAUTH_INVALID_PROFILE", `The profile callback for "${providerId}" must return an object with a string \`id\` field.`));
+	return typeof profile.id === "string" && profile.id ? Fx.succeed(profile) : Cv.fail({
+		code: "OAUTH_INVALID_PROFILE",
+		message: `The profile callback for "${providerId}" must return an object with a string \`id\` field.`
+	});
 }
 /**
 * Create an OAuth authorization URL using an Arctic provider.
@@ -145,7 +163,7 @@ async function createOAuthAuthorizationURL(providerId, arcticProvider, oauthConf
 * Handle the OAuth callback: validate state, exchange code for tokens,
 * extract profile.
 *
-* Returns `Fx<CallbackResult, AuthError>` composed via `Fx.gen`.
+* Returns `Fx<CallbackResult, ConvexError<any>>` composed via `Fx.gen`.
 */
 /** @internal */
 function handleOAuthCallback(providerId, arcticProvider, oauthConfig, params, cookies) {
@@ -153,7 +171,10 @@ function handleOAuthCallback(providerId, arcticProvider, oauthConfig, params, co
 		const resCookies = [];
 		const storedState = cookies[oauthCookieName("state", providerId)];
 		const returnedState = params.state;
-		yield* Fx.guard(!storedState || !returnedState || storedState !== returnedState, Fx.fail(new AuthError("OAUTH_INVALID_STATE")));
+		yield* Fx.guard(!storedState || !returnedState || storedState !== returnedState, Cv.fail({
+			code: "OAUTH_INVALID_STATE",
+			message: "Invalid OAuth state. Please try signing in again."
+		}));
 		resCookies.push(clearCookie("state", providerId));
 		if (params.error) {
 			const cause = {
@@ -162,25 +183,41 @@ function handleOAuthCallback(providerId, arcticProvider, oauthConfig, params, co
 				error_description: params.error_description
 			};
 			logWithLevel("DEBUG", "OAuthCallbackError", cause);
-			yield* Fx.fail(new AuthError("OAUTH_PROVIDER_ERROR", "OAuth provider returned an error", { cause: JSON.stringify(cause) }));
+			yield* Cv.fail({
+				code: "OAUTH_PROVIDER_ERROR",
+				message: "OAuth provider returned an error",
+				cause: JSON.stringify(cause)
+			});
 		}
-		const code = yield* params.code != null ? Fx.succeed(params.code) : Fx.fail(new AuthError("OAUTH_PROVIDER_ERROR", "Missing authorization code in callback"));
+		const code = yield* params.code != null ? Fx.succeed(params.code) : Cv.fail({
+			code: "OAUTH_PROVIDER_ERROR",
+			message: "Missing authorization code in callback"
+		});
 		let codeVerifier;
 		if (isPKCEProvider(arcticProvider)) {
 			const pkceCookieName = oauthCookieName("pkce", providerId);
-			codeVerifier = yield* cookies[pkceCookieName] != null ? Fx.succeed(cookies[pkceCookieName]) : Fx.fail(new AuthError("OAUTH_MISSING_VERIFIER", "Missing PKCE verifier cookie for OAuth callback"));
+			codeVerifier = yield* cookies[pkceCookieName] != null ? Fx.succeed(cookies[pkceCookieName]) : Cv.fail({
+				code: "OAUTH_MISSING_VERIFIER",
+				message: "Missing PKCE verifier cookie for OAuth callback"
+			});
 			resCookies.push(clearCookie("pkce", providerId));
 		}
 		let nonce;
 		if (oauthConfig.nonce === true) {
 			const nonceCookieName = oauthCookieName("nonce", providerId);
-			nonce = yield* cookies[nonceCookieName] != null ? Fx.succeed(cookies[nonceCookieName]) : Fx.fail(new AuthError("OAUTH_PROVIDER_ERROR", "Missing nonce cookie for OAuth callback"));
+			nonce = yield* cookies[nonceCookieName] != null ? Fx.succeed(cookies[nonceCookieName]) : Cv.fail({
+				code: "OAUTH_PROVIDER_ERROR",
+				message: "Missing nonce cookie for OAuth callback"
+			});
 			resCookies.push(clearCookie("nonce", providerId));
 		}
 		const tokens = yield* exchangeCode(arcticProvider, code, codeVerifier);
 		if (oauthConfig.validateTokens !== void 0) yield* Fx.from({
 			ok: () => oauthConfig.validateTokens(tokens, { nonce }),
-			err: (e) => new AuthError("OAUTH_PROVIDER_ERROR", `Token validation failed: ${e instanceof Error ? e.message : String(e)}`)
+			err: (e) => Cv.error({
+				code: "OAUTH_PROVIDER_ERROR",
+				message: `Token validation failed: ${e instanceof Error ? e.message : String(e)}`
+			})
 		});
 		const profile = yield* validateProfileId(providerId, yield* extractProfile(providerId, oauthConfig, tokens));
 		logWithLevel("DEBUG", "OAuth callback profile extracted", {

package/dist/component/server/oauth.js.map

@@ -1 +1 @@
-{"version":3,"file":"oauth.js","names":[],"sources":["../../../src/server/oauth.ts"],"sourcesContent":["/**\n * Arctic-based OAuth flow implementation.\n *\n * Uses Arctic for OAuth provider integration.\n *\n * All functions return `Fx<A, AuthError>` composed via `Fx.gen` pipelines.\n *\n * @internal\n * @module\n */\n\nimport { Fx } from \"@robelest/fx\";\nimport * as arctic from \"arctic\";\n\nimport { SHARED_COOKIE_OPTIONS } from \"./cookies\";\nimport { AuthError } from \"./authError\";\nimport type { OAuthProfile } from \"./types\";\nimport { logWithLevel } from \"./utils\";\nimport { isLocalHost } from \"./utils\";\n\ntype OAuthProviderConfigLike = {\n  scopes?: string[];\n  profile?: (tokens: arctic.OAuth2Tokens) => Promise<OAuthProfile>;\n  nonce?: boolean;\n  validateTokens?: (\n    tokens: arctic.OAuth2Tokens,\n    ctx: { nonce?: string },\n  ) => Promise<void>;\n};\n\n// ============================================================================\n// Types\n// ============================================================================\n\n/** A cookie to be set on the HTTP response. */\n/** @internal */\nexport interface OAuthCookie {\n  name: string;\n  value: string;\n  options: Record<string, unknown>;\n}\n\n/** Result of creating an authorization URL. */\n/** @internal */\nexport interface AuthorizationResult {\n  redirect: string;\n  cookies: OAuthCookie[];\n  signature: string;\n}\n\n/** Result of handling an OAuth callback. */\n/** @internal */\nexport interface CallbackResult {\n  profile: OAuthProfile;\n  providerAccountId: string;\n  cookies: OAuthCookie[];\n  signature: string;\n}\n\n// ============================================================================\n// Cookie helpers\n// ============================================================================\n\nconst COOKIE_TTL = 60 * 15; // 15 minutes\n\nfunction oauthCookieName(type: \"state\" | \"pkce\" | \"nonce\", providerId: string) {\n  const prefix = !isLocalHost(process.env.CONVEX_SITE_URL) ? \"__Host-\" : \"\";\n  return prefix + providerId + \"OAuth\" + type;\n}\n\nfunction createCookie(\n  type: \"state\" | \"pkce\" | \"nonce\",\n  providerId: string,\n  value: string,\n): OAuthCookie {\n  const expires = new Date();\n  expires.setTime(expires.getTime() + COOKIE_TTL * 1000);\n  return {\n    name: oauthCookieName(type, providerId),\n    value,\n    options: { ...SHARED_COOKIE_OPTIONS, expires },\n  };\n}\n\nfunction clearCookie(\n  type: \"state\" | \"pkce\" | \"nonce\",\n  providerId: string,\n): OAuthCookie {\n  return {\n    name: oauthCookieName(type, providerId),\n    value: \"\",\n    options: { ...SHARED_COOKIE_OPTIONS, maxAge: 0 },\n  };\n}\n\n// ============================================================================\n// Signature (ConvexAuth-specific verifier mechanism)\n// ============================================================================\n\n/**\n * Creates a signature string from the OAuth state parameters.\n * This is stored in the verifier table and validated during callback.\n */\n/** @internal */\nexport function getAuthorizationSignature({\n  codeVerifier,\n  state,\n}: {\n  codeVerifier?: string;\n  state?: string;\n}) {\n  return [codeVerifier, state].filter((param) => param !== undefined).join(\" \");\n}\n\n// ============================================================================\n// PKCE Detection\n// ============================================================================\n\n/**\n * Detect whether an Arctic provider uses PKCE by checking the arity\n * of `createAuthorizationURL`. PKCE providers take 3 args\n * (state, codeVerifier, scopes), non-PKCE take 2 (state, scopes).\n */\nfunction isPKCEProvider(provider: any): boolean {\n  return (\n    typeof provider.createAuthorizationURL === \"function\" &&\n    provider.createAuthorizationURL.length >= 3\n  );\n}\n\n// ============================================================================\n// Token exchange — wraps Arctic's validateAuthorizationCode\n// ============================================================================\n\n/**\n * Exchange the authorization code for tokens via Arctic.\n * Maps Arctic-specific errors to typed `AuthError` failures.\n */\nfunction exchangeCode(\n  arcticProvider: any,\n  code: string,\n  codeVerifier: string | undefined,\n): Fx<arctic.OAuth2Tokens, AuthError> {\n  return Fx.from({\n    ok: () =>\n      isPKCEProvider(arcticProvider)\n        ? arcticProvider.validateAuthorizationCode(code, codeVerifier)\n        : arcticProvider.validateAuthorizationCode(code),\n    err: (e) => {\n      if (e instanceof arctic.OAuth2RequestError) {\n        return new AuthError(\n          \"OAUTH_PROVIDER_ERROR\",\n          `Token exchange failed: ${e.code}`,\n        );\n      }\n      if (e instanceof arctic.ArcticFetchError) {\n        return new AuthError(\n          \"OAUTH_PROVIDER_ERROR\",\n          `Network error during token exchange: ${e.message}`,\n        );\n      }\n      // Unknown error — treat as unrecoverable defect; we surface it as\n      // an AuthError here so the pipeline type stays Fx<_, AuthError>.\n      // The original `throw e` re-throw is replicated via Fx.fatal below.\n      return new AuthError(\n        \"OAUTH_PROVIDER_ERROR\",\n        `Unexpected error during token exchange: ${e instanceof Error ? e.message : String(e)}`,\n      );\n    },\n  }).pipe(\n    Fx.chain((tokens) => {\n      // If the original error was neither OAuth2RequestError nor\n      // ArcticFetchError the old code re-threw it raw. We replicate that\n      // by checking whether we created an \"Unexpected\" marker message\n      // — but since `Fx.from` already mapped it, we just pass through.\n      return Fx.succeed(tokens);\n    }),\n  );\n}\n\n/**\n * Extract the user profile from tokens using the config callback,\n * OIDC auto-decode, or fail if neither is available.\n */\nfunction extractProfile(\n  providerId: string,\n  oauthConfig: OAuthProviderConfigLike,\n  tokens: arctic.OAuth2Tokens,\n): Fx<OAuthProfile, AuthError> {\n  const hasIdToken =\n    \"id_token\" in tokens.data &&\n    typeof (tokens.data as any).id_token === \"string\";\n  const profileSource = oauthConfig.profile\n    ? { source: \"callback\" as const }\n    : hasIdToken\n      ? { source: \"idToken\" as const }\n      : { source: \"missing\" as const };\n\n  return Fx.match(profileSource, profileSource.source, {\n    callback: (_profileSource) =>\n      Fx.from({\n        ok: () => oauthConfig.profile!(tokens),\n        err: (e) =>\n          new AuthError(\n            \"OAUTH_INVALID_PROFILE\",\n            `Profile callback threw: ${e instanceof Error ? e.message : String(e)}`,\n          ),\n      }),\n    idToken: (_profileSource) => {\n      const claims = arctic.decodeIdToken(tokens.idToken()) as Record<\n        string,\n        unknown\n      >;\n      return Fx.succeed({\n        id: (claims.sub as string) ?? crypto.randomUUID(),\n        name: (claims.name as string) ?? undefined,\n        email: (claims.email as string) ?? undefined,\n        image: (claims.picture as string) ?? undefined,\n      });\n    },\n    missing: (_profileSource) =>\n      Fx.fail(\n        new AuthError(\n          \"OAUTH_INVALID_PROFILE\",\n          `Provider \"${providerId}\" does not return an ID token. ` +\n            `Add a \\`profile\\` callback in the OAuth() config to extract user info from the access token.`,\n        ),\n      ),\n  });\n}\n\n/**\n * Validate that the profile has a non-empty string `id`.\n */\nfunction validateProfileId(\n  providerId: string,\n  profile: OAuthProfile,\n): Fx<OAuthProfile, AuthError> {\n  return typeof profile.id === \"string\" && profile.id\n    ? Fx.succeed(profile)\n    : Fx.fail(\n        new AuthError(\n          \"OAUTH_INVALID_PROFILE\",\n          `The profile callback for \"${providerId}\" must return an object with a string \\`id\\` field.`,\n        ),\n      );\n}\n\n// ============================================================================\n// Authorization URL creation\n// ============================================================================\n\n/**\n * Create an OAuth authorization URL using an Arctic provider.\n *\n * Handles PKCE detection, state generation, and cookie creation.\n */\n/** @internal */\nexport async function createOAuthAuthorizationURL(\n  providerId: string,\n  arcticProvider: any,\n  oauthConfig: OAuthProviderConfigLike,\n): Promise<AuthorizationResult> {\n  const state = arctic.generateState();\n  const cookies: OAuthCookie[] = [];\n  let codeVerifier: string | undefined;\n\n  const scopes = oauthConfig.scopes ?? [];\n\n  let url: URL;\n\n  if (isPKCEProvider(arcticProvider)) {\n    codeVerifier = arctic.generateCodeVerifier();\n    url = arcticProvider.createAuthorizationURL(state, codeVerifier, scopes);\n    cookies.push(createCookie(\"pkce\", providerId, codeVerifier));\n  } else {\n    url = arcticProvider.createAuthorizationURL(state, scopes);\n  }\n\n  cookies.push(createCookie(\"state\", providerId, state));\n\n  if (oauthConfig.nonce === true) {\n    const nonce = arctic.generateState();\n    url.searchParams.set(\"nonce\", nonce);\n    cookies.push(createCookie(\"nonce\", providerId, nonce));\n  }\n\n  logWithLevel(\"DEBUG\", \"OAuth authorization URL created\", {\n    url: url.toString(),\n    providerId,\n    hasPKCE: !!codeVerifier,\n  });\n\n  const signature = getAuthorizationSignature({ codeVerifier, state });\n\n  return {\n    redirect: url.toString(),\n    cookies,\n    signature,\n  };\n}\n\n// ============================================================================\n// OAuth callback handling\n// ============================================================================\n\n/**\n * Handle the OAuth callback: validate state, exchange code for tokens,\n * extract profile.\n *\n * Returns `Fx<CallbackResult, AuthError>` composed via `Fx.gen`.\n */\n/** @internal */\nexport function handleOAuthCallback(\n  providerId: string,\n  arcticProvider: any,\n  oauthConfig: OAuthProviderConfigLike,\n  params: Record<string, string>,\n  cookies: Record<string, string | undefined>,\n): Fx<CallbackResult, AuthError> {\n  return Fx.gen(function* () {\n    const resCookies: OAuthCookie[] = [];\n\n    // 1. Validate state\n    const stateCookieName = oauthCookieName(\"state\", providerId);\n    const storedState = cookies[stateCookieName];\n    const returnedState = params.state;\n\n    yield* Fx.guard(\n      !storedState || !returnedState || storedState !== returnedState,\n      Fx.fail(new AuthError(\"OAUTH_INVALID_STATE\")),\n    );\n    resCookies.push(clearCookie(\"state\", providerId));\n\n    // Check for error from provider\n    if (params.error) {\n      const cause = {\n        providerId,\n        error: params.error,\n        error_description: params.error_description,\n      };\n      logWithLevel(\"DEBUG\", \"OAuthCallbackError\", cause);\n      yield* Fx.fail(\n        new AuthError(\n          \"OAUTH_PROVIDER_ERROR\",\n          \"OAuth provider returned an error\",\n          {\n            cause: JSON.stringify(cause),\n          },\n        ),\n      );\n    }\n\n    // 2. Get code\n    const code = yield* params.code != null\n      ? Fx.succeed(params.code)\n      : Fx.fail(\n          new AuthError(\n            \"OAUTH_PROVIDER_ERROR\",\n            \"Missing authorization code in callback\",\n          ),\n        );\n\n    // 3. Read PKCE verifier from cookie if applicable\n    let codeVerifier: string | undefined;\n    if (isPKCEProvider(arcticProvider)) {\n      const pkceCookieName = oauthCookieName(\"pkce\", providerId);\n      codeVerifier = yield* cookies[pkceCookieName] != null\n        ? Fx.succeed(cookies[pkceCookieName]!)\n        : Fx.fail(\n            new AuthError(\n              \"OAUTH_MISSING_VERIFIER\",\n              \"Missing PKCE verifier cookie for OAuth callback\",\n            ),\n          );\n      resCookies.push(clearCookie(\"pkce\", providerId));\n    }\n\n    let nonce: string | undefined;\n    if (oauthConfig.nonce === true) {\n      const nonceCookieName = oauthCookieName(\"nonce\", providerId);\n      nonce = yield* cookies[nonceCookieName] != null\n        ? Fx.succeed(cookies[nonceCookieName]!)\n        : Fx.fail(\n            new AuthError(\n              \"OAUTH_PROVIDER_ERROR\",\n              \"Missing nonce cookie for OAuth callback\",\n            ),\n          );\n      resCookies.push(clearCookie(\"nonce\", providerId));\n    }\n\n    // 4. Exchange code for tokens\n    const tokens = yield* exchangeCode(arcticProvider, code, codeVerifier);\n\n    if (oauthConfig.validateTokens !== undefined) {\n      yield* Fx.from({\n        ok: () => oauthConfig.validateTokens!(tokens, { nonce }),\n        err: (e) =>\n          new AuthError(\n            \"OAUTH_PROVIDER_ERROR\",\n            `Token validation failed: ${e instanceof Error ? e.message : String(e)}`,\n          ),\n      });\n    }\n\n    // 5. Extract profile\n    const rawProfile = yield* extractProfile(providerId, oauthConfig, tokens);\n    const profile = yield* validateProfileId(providerId, rawProfile);\n\n    logWithLevel(\"DEBUG\", \"OAuth callback profile extracted\", {\n      providerId,\n      profileId: profile.id,\n    });\n\n    // 6. Compute signature for verifier validation\n    const state = storedState!;\n    const signature = getAuthorizationSignature({ codeVerifier, state });\n\n    return {\n      profile,\n      providerAccountId: profile.id,\n      cookies: resCookies,\n      signature,\n    };\n  });\n}\n"],"mappings":";;;;;;;;;;;;;;;;;AA+DA,MAAM,aAAa;AAEnB,SAAS,gBAAgB,MAAkC,YAAoB;AAE7E,SADe,CAAC,YAAY,QAAQ,IAAI,gBAAgB,GAAG,YAAY,MACvD,aAAa,UAAU;;AAGzC,SAAS,aACP,MACA,YACA,OACa;CACb,MAAM,0BAAU,IAAI,MAAM;AAC1B,SAAQ,QAAQ,QAAQ,SAAS,GAAG,aAAa,IAAK;AACtD,QAAO;EACL,MAAM,gBAAgB,MAAM,WAAW;EACvC;EACA,SAAS;GAAE,GAAG;GAAuB;GAAS;EAC/C;;AAGH,SAAS,YACP,MACA,YACa;AACb,QAAO;EACL,MAAM,gBAAgB,MAAM,WAAW;EACvC,OAAO;EACP,SAAS;GAAE,GAAG;GAAuB,QAAQ;GAAG;EACjD;;;;;;;AAYH,SAAgB,0BAA0B,EACxC,cACA,SAIC;AACD,QAAO,CAAC,cAAc,MAAM,CAAC,QAAQ,UAAU,UAAU,OAAU,CAAC,KAAK,IAAI;;;;;;;AAY/E,SAAS,eAAe,UAAwB;AAC9C,QACE,OAAO,SAAS,2BAA2B,cAC3C,SAAS,uBAAuB,UAAU;;;;;;AAY9C,SAAS,aACP,gBACA,MACA,cACoC;AACpC,QAAO,GAAG,KAAK;EACb,UACE,eAAe,eAAe,GAC1B,eAAe,0BAA0B,MAAM,aAAa,GAC5D,eAAe,0BAA0B,KAAK;EACpD,MAAM,MAAM;AACV,OAAI,aAAa,OAAO,mBACtB,QAAO,IAAI,UACT,wBACA,0BAA0B,EAAE,OAC7B;AAEH,OAAI,aAAa,OAAO,iBACtB,QAAO,IAAI,UACT,wBACA,wCAAwC,EAAE,UAC3C;AAKH,UAAO,IAAI,UACT,wBACA,2CAA2C,aAAa,QAAQ,EAAE,UAAU,OAAO,EAAE,GACtF;;EAEJ,CAAC,CAAC,KACD,GAAG,OAAO,WAAW;AAKnB,SAAO,GAAG,QAAQ,OAAO;GACzB,CACH;;;;;;AAOH,SAAS,eACP,YACA,aACA,QAC6B;CAC7B,MAAM,aACJ,cAAc,OAAO,QACrB,OAAQ,OAAO,KAAa,aAAa;CAC3C,MAAM,gBAAgB,YAAY,UAC9B,EAAE,QAAQ,YAAqB,GAC/B,aACE,EAAE,QAAQ,WAAoB,GAC9B,EAAE,QAAQ,WAAoB;AAEpC,QAAO,GAAG,MAAM,eAAe,cAAc,QAAQ;EACnD,WAAW,mBACT,GAAG,KAAK;GACN,UAAU,YAAY,QAAS,OAAO;GACtC,MAAM,MACJ,IAAI,UACF,yBACA,2BAA2B,aAAa,QAAQ,EAAE,UAAU,OAAO,EAAE,GACtE;GACJ,CAAC;EACJ,UAAU,mBAAmB;GAC3B,MAAM,SAAS,OAAO,cAAc,OAAO,SAAS,CAAC;AAIrD,UAAO,GAAG,QAAQ;IAChB,IAAK,OAAO,OAAkB,OAAO,YAAY;IACjD,MAAO,OAAO,QAAmB;IACjC,OAAQ,OAAO,SAAoB;IACnC,OAAQ,OAAO,WAAsB;IACtC,CAAC;;EAEJ,UAAU,mBACR,GAAG,KACD,IAAI,UACF,yBACA,aAAa,WAAW,6HAEzB,CACF;EACJ,CAAC;;;;;AAMJ,SAAS,kBACP,YACA,SAC6B;AAC7B,QAAO,OAAO,QAAQ,OAAO,YAAY,QAAQ,KAC7C,GAAG,QAAQ,QAAQ,GACnB,GAAG,KACD,IAAI,UACF,yBACA,6BAA6B,WAAW,qDACzC,CACF;;;;;;;;AAaP,eAAsB,4BACpB,YACA,gBACA,aAC8B;CAC9B,MAAM,QAAQ,OAAO,eAAe;CACpC,MAAM,UAAyB,EAAE;CACjC,IAAI;CAEJ,MAAM,SAAS,YAAY,UAAU,EAAE;CAEvC,IAAI;AAEJ,KAAI,eAAe,eAAe,EAAE;AAClC,iBAAe,OAAO,sBAAsB;AAC5C,QAAM,eAAe,uBAAuB,OAAO,cAAc,OAAO;AACxE,UAAQ,KAAK,aAAa,QAAQ,YAAY,aAAa,CAAC;OAE5D,OAAM,eAAe,uBAAuB,OAAO,OAAO;AAG5D,SAAQ,KAAK,aAAa,SAAS,YAAY,MAAM,CAAC;AAEtD,KAAI,YAAY,UAAU,MAAM;EAC9B,MAAM,QAAQ,OAAO,eAAe;AACpC,MAAI,aAAa,IAAI,SAAS,MAAM;AACpC,UAAQ,KAAK,aAAa,SAAS,YAAY,MAAM,CAAC;;AAGxD,cAAa,SAAS,mCAAmC;EACvD,KAAK,IAAI,UAAU;EACnB;EACA,SAAS,CAAC,CAAC;EACZ,CAAC;CAEF,MAAM,YAAY,0BAA0B;EAAE;EAAc;EAAO,CAAC;AAEpE,QAAO;EACL,UAAU,IAAI,UAAU;EACxB;EACA;EACD;;;;;;;;;AAcH,SAAgB,oBACd,YACA,gBACA,aACA,QACA,SAC+B;AAC/B,QAAO,GAAG,IAAI,aAAa;EACzB,MAAM,aAA4B,EAAE;EAIpC,MAAM,cAAc,QADI,gBAAgB,SAAS,WAAW;EAE5D,MAAM,gBAAgB,OAAO;AAE7B,SAAO,GAAG,MACR,CAAC,eAAe,CAAC,iBAAiB,gBAAgB,eAClD,GAAG,KAAK,IAAI,UAAU,sBAAsB,CAAC,CAC9C;AACD,aAAW,KAAK,YAAY,SAAS,WAAW,CAAC;AAGjD,MAAI,OAAO,OAAO;GAChB,MAAM,QAAQ;IACZ;IACA,OAAO,OAAO;IACd,mBAAmB,OAAO;IAC3B;AACD,gBAAa,SAAS,sBAAsB,MAAM;AAClD,UAAO,GAAG,KACR,IAAI,UACF,wBACA,oCACA,EACE,OAAO,KAAK,UAAU,MAAM,EAC7B,CACF,CACF;;EAIH,MAAM,OAAO,OAAO,OAAO,QAAQ,OAC/B,GAAG,QAAQ,OAAO,KAAK,GACvB,GAAG,KACD,IAAI,UACF,wBACA,yCACD,CACF;EAGL,IAAI;AACJ,MAAI,eAAe,eAAe,EAAE;GAClC,MAAM,iBAAiB,gBAAgB,QAAQ,WAAW;AAC1D,kBAAe,OAAO,QAAQ,mBAAmB,OAC7C,GAAG,QAAQ,QAAQ,gBAAiB,GACpC,GAAG,KACD,IAAI,UACF,0BACA,kDACD,CACF;AACL,cAAW,KAAK,YAAY,QAAQ,WAAW,CAAC;;EAGlD,IAAI;AACJ,MAAI,YAAY,UAAU,MAAM;GAC9B,MAAM,kBAAkB,gBAAgB,SAAS,WAAW;AAC5D,WAAQ,OAAO,QAAQ,oBAAoB,OACvC,GAAG,QAAQ,QAAQ,iBAAkB,GACrC,GAAG,KACD,IAAI,UACF,wBACA,0CACD,CACF;AACL,cAAW,KAAK,YAAY,SAAS,WAAW,CAAC;;EAInD,MAAM,SAAS,OAAO,aAAa,gBAAgB,MAAM,aAAa;AAEtE,MAAI,YAAY,mBAAmB,OACjC,QAAO,GAAG,KAAK;GACb,UAAU,YAAY,eAAgB,QAAQ,EAAE,OAAO,CAAC;GACxD,MAAM,MACJ,IAAI,UACF,wBACA,4BAA4B,aAAa,QAAQ,EAAE,UAAU,OAAO,EAAE,GACvE;GACJ,CAAC;EAKJ,MAAM,UAAU,OAAO,kBAAkB,YADtB,OAAO,eAAe,YAAY,aAAa,OAAO,CACT;AAEhE,eAAa,SAAS,oCAAoC;GACxD;GACA,WAAW,QAAQ;GACpB,CAAC;EAIF,MAAM,YAAY,0BAA0B;GAAE;GAAc,OAD9C;GACqD,CAAC;AAEpE,SAAO;GACL;GACA,mBAAmB,QAAQ;GAC3B,SAAS;GACT;GACD;GACD"}
+{"version":3,"file":"oauth.js","names":[],"sources":["../../../src/server/oauth.ts"],"sourcesContent":["/**\n * Arctic-based OAuth flow implementation.\n *\n * Uses Arctic for OAuth provider integration.\n *\n * All functions return `Fx<A, ConvexError<any>>` composed via `Fx.gen` pipelines.\n *\n * @internal\n * @module\n */\n\nimport { Fx } from \"@robelest/fx\";\nimport { Cv } from \"@robelest/fx/convex\";\nimport * as arctic from \"arctic\";\nimport type { ConvexError } from \"convex/values\";\n\nimport { SHARED_COOKIE_OPTIONS } from \"./cookies\";\nimport type { OAuthProfile } from \"./types\";\nimport { logWithLevel } from \"./utils\";\nimport { isLocalHost } from \"./utils\";\n\ntype OAuthProviderConfigLike = {\n  scopes?: string[];\n  profile?: (tokens: arctic.OAuth2Tokens) => Promise<OAuthProfile>;\n  nonce?: boolean;\n  validateTokens?: (\n    tokens: arctic.OAuth2Tokens,\n    ctx: { nonce?: string },\n  ) => Promise<void>;\n};\n\n// ============================================================================\n// Types\n// ============================================================================\n\n/** A cookie to be set on the HTTP response. */\n/** @internal */\nexport interface OAuthCookie {\n  name: string;\n  value: string;\n  options: Record<string, unknown>;\n}\n\n/** Result of creating an authorization URL. */\n/** @internal */\nexport interface AuthorizationResult {\n  redirect: string;\n  cookies: OAuthCookie[];\n  signature: string;\n}\n\n/** Result of handling an OAuth callback. */\n/** @internal */\nexport interface CallbackResult {\n  profile: OAuthProfile;\n  providerAccountId: string;\n  cookies: OAuthCookie[];\n  signature: string;\n}\n\n// ============================================================================\n// Cookie helpers\n// ============================================================================\n\nconst COOKIE_TTL = 60 * 15; // 15 minutes\n\nfunction oauthCookieName(type: \"state\" | \"pkce\" | \"nonce\", providerId: string) {\n  const prefix = !isLocalHost(process.env.CONVEX_SITE_URL) ? \"__Host-\" : \"\";\n  return prefix + providerId + \"OAuth\" + type;\n}\n\nfunction createCookie(\n  type: \"state\" | \"pkce\" | \"nonce\",\n  providerId: string,\n  value: string,\n): OAuthCookie {\n  const expires = new Date();\n  expires.setTime(expires.getTime() + COOKIE_TTL * 1000);\n  return {\n    name: oauthCookieName(type, providerId),\n    value,\n    options: { ...SHARED_COOKIE_OPTIONS, expires },\n  };\n}\n\nfunction clearCookie(\n  type: \"state\" | \"pkce\" | \"nonce\",\n  providerId: string,\n): OAuthCookie {\n  return {\n    name: oauthCookieName(type, providerId),\n    value: \"\",\n    options: { ...SHARED_COOKIE_OPTIONS, maxAge: 0 },\n  };\n}\n\n// ============================================================================\n// Signature (ConvexAuth-specific verifier mechanism)\n// ============================================================================\n\n/**\n * Creates a signature string from the OAuth state parameters.\n * This is stored in the verifier table and validated during callback.\n */\n/** @internal */\nexport function getAuthorizationSignature({\n  codeVerifier,\n  state,\n}: {\n  codeVerifier?: string;\n  state?: string;\n}) {\n  return [codeVerifier, state].filter((param) => param !== undefined).join(\" \");\n}\n\n// ============================================================================\n// PKCE Detection\n// ============================================================================\n\n/**\n * Detect whether an Arctic provider uses PKCE by checking the arity\n * of `createAuthorizationURL`. PKCE providers take 3 args\n * (state, codeVerifier, scopes), non-PKCE take 2 (state, scopes).\n */\nfunction isPKCEProvider(provider: any): boolean {\n  return (\n    typeof provider.createAuthorizationURL === \"function\" &&\n    provider.createAuthorizationURL.length >= 3\n  );\n}\n\n// ============================================================================\n// Token exchange — wraps Arctic's validateAuthorizationCode\n// ============================================================================\n\n/**\n * Exchange the authorization code for tokens via Arctic.\n * Maps Arctic-specific errors to typed `ConvexError<any>` failures.\n */\nfunction exchangeCode(\n  arcticProvider: any,\n  code: string,\n  codeVerifier: string | undefined,\n): Fx<arctic.OAuth2Tokens, ConvexError<any>> {\n  return Fx.from({\n    ok: () =>\n      isPKCEProvider(arcticProvider)\n        ? arcticProvider.validateAuthorizationCode(code, codeVerifier)\n        : arcticProvider.validateAuthorizationCode(code),\n    err: (e) => {\n      if (e instanceof arctic.OAuth2RequestError) {\n        return Cv.error({\n          code: \"OAUTH_PROVIDER_ERROR\",\n          message: `Token exchange failed: ${e.code}`,\n        });\n      }\n      if (e instanceof arctic.ArcticFetchError) {\n        return Cv.error({\n          code: \"OAUTH_PROVIDER_ERROR\",\n          message: `Network error during token exchange: ${e.message}`,\n        });\n      }\n      // Unknown error — treat as unrecoverable defect; we surface it as\n      // an ConvexError<any> here so the pipeline type stays Fx<_, ConvexError<any>>.\n      // The original `throw e` re-throw is replicated via Fx.fatal below.\n      return Cv.error({\n        code: \"OAUTH_PROVIDER_ERROR\",\n        message: `Unexpected error during token exchange: ${e instanceof Error ? e.message : String(e)}`,\n      });\n    },\n  }).pipe(\n    Fx.chain((tokens) => {\n      // If the original error was neither OAuth2RequestError nor\n      // ArcticFetchError the old code re-threw it raw. We replicate that\n      // by checking whether we created an \"Unexpected\" marker message\n      // — but since `Fx.from` already mapped it, we just pass through.\n      return Fx.succeed(tokens);\n    }),\n  );\n}\n\n/**\n * Extract the user profile from tokens using the config callback,\n * OIDC auto-decode, or fail if neither is available.\n */\nfunction extractProfile(\n  providerId: string,\n  oauthConfig: OAuthProviderConfigLike,\n  tokens: arctic.OAuth2Tokens,\n): Fx<OAuthProfile, ConvexError<any>> {\n  const hasIdToken =\n    \"id_token\" in tokens.data &&\n    typeof (tokens.data as any).id_token === \"string\";\n  const profileSource = oauthConfig.profile\n    ? { source: \"callback\" as const }\n    : hasIdToken\n      ? { source: \"idToken\" as const }\n      : { source: \"missing\" as const };\n\n  return Fx.match(profileSource, profileSource.source, {\n    callback: (_profileSource) =>\n      Fx.from({\n        ok: () => oauthConfig.profile!(tokens),\n        err: (e) =>\n          Cv.error({\n            code: \"OAUTH_INVALID_PROFILE\",\n            message: `Profile callback threw: ${e instanceof Error ? e.message : String(e)}`,\n          }),\n      }),\n    idToken: (_profileSource) => {\n      const claims = arctic.decodeIdToken(tokens.idToken()) as Record<\n        string,\n        unknown\n      >;\n      return Fx.succeed({\n        id: (claims.sub as string) ?? crypto.randomUUID(),\n        name: (claims.name as string) ?? undefined,\n        email: (claims.email as string) ?? undefined,\n        image: (claims.picture as string) ?? undefined,\n      });\n    },\n    missing: (_profileSource) =>\n      Cv.fail({\n        code: \"OAUTH_INVALID_PROFILE\",\n        message:\n          `Provider \"${providerId}\" does not return an ID token. ` +\n          `Add a \\`profile\\` callback in the OAuth() config to extract user info from the access token.`,\n      }),\n  });\n}\n\n/**\n * Validate that the profile has a non-empty string `id`.\n */\nfunction validateProfileId(\n  providerId: string,\n  profile: OAuthProfile,\n): Fx<OAuthProfile, ConvexError<any>> {\n  return typeof profile.id === \"string\" && profile.id\n    ? Fx.succeed(profile)\n    : Cv.fail({\n        code: \"OAUTH_INVALID_PROFILE\",\n        message: `The profile callback for \"${providerId}\" must return an object with a string \\`id\\` field.`,\n      });\n}\n\n// ============================================================================\n// Authorization URL creation\n// ============================================================================\n\n/**\n * Create an OAuth authorization URL using an Arctic provider.\n *\n * Handles PKCE detection, state generation, and cookie creation.\n */\n/** @internal */\nexport async function createOAuthAuthorizationURL(\n  providerId: string,\n  arcticProvider: any,\n  oauthConfig: OAuthProviderConfigLike,\n): Promise<AuthorizationResult> {\n  const state = arctic.generateState();\n  const cookies: OAuthCookie[] = [];\n  let codeVerifier: string | undefined;\n\n  const scopes = oauthConfig.scopes ?? [];\n\n  let url: URL;\n\n  if (isPKCEProvider(arcticProvider)) {\n    codeVerifier = arctic.generateCodeVerifier();\n    url = arcticProvider.createAuthorizationURL(state, codeVerifier, scopes);\n    cookies.push(createCookie(\"pkce\", providerId, codeVerifier));\n  } else {\n    url = arcticProvider.createAuthorizationURL(state, scopes);\n  }\n\n  cookies.push(createCookie(\"state\", providerId, state));\n\n  if (oauthConfig.nonce === true) {\n    const nonce = arctic.generateState();\n    url.searchParams.set(\"nonce\", nonce);\n    cookies.push(createCookie(\"nonce\", providerId, nonce));\n  }\n\n  logWithLevel(\"DEBUG\", \"OAuth authorization URL created\", {\n    url: url.toString(),\n    providerId,\n    hasPKCE: !!codeVerifier,\n  });\n\n  const signature = getAuthorizationSignature({ codeVerifier, state });\n\n  return {\n    redirect: url.toString(),\n    cookies,\n    signature,\n  };\n}\n\n// ============================================================================\n// OAuth callback handling\n// ============================================================================\n\n/**\n * Handle the OAuth callback: validate state, exchange code for tokens,\n * extract profile.\n *\n * Returns `Fx<CallbackResult, ConvexError<any>>` composed via `Fx.gen`.\n */\n/** @internal */\nexport function handleOAuthCallback(\n  providerId: string,\n  arcticProvider: any,\n  oauthConfig: OAuthProviderConfigLike,\n  params: Record<string, string>,\n  cookies: Record<string, string | undefined>,\n): Fx<CallbackResult, ConvexError<any>> {\n  return Fx.gen(function* () {\n    const resCookies: OAuthCookie[] = [];\n\n    // 1. Validate state\n    const stateCookieName = oauthCookieName(\"state\", providerId);\n    const storedState = cookies[stateCookieName];\n    const returnedState = params.state;\n\n    yield* Fx.guard(\n      !storedState || !returnedState || storedState !== returnedState,\n      Cv.fail({\n        code: \"OAUTH_INVALID_STATE\",\n        message: \"Invalid OAuth state. Please try signing in again.\",\n      }),\n    );\n    resCookies.push(clearCookie(\"state\", providerId));\n\n    // Check for error from provider\n    if (params.error) {\n      const cause = {\n        providerId,\n        error: params.error,\n        error_description: params.error_description,\n      };\n      logWithLevel(\"DEBUG\", \"OAuthCallbackError\", cause);\n      yield* Cv.fail({\n        code: \"OAUTH_PROVIDER_ERROR\",\n        message: \"OAuth provider returned an error\",\n        cause: JSON.stringify(cause),\n      });\n    }\n\n    // 2. Get code\n    const code = yield* params.code != null\n      ? Fx.succeed(params.code)\n      : Cv.fail({\n          code: \"OAUTH_PROVIDER_ERROR\",\n          message: \"Missing authorization code in callback\",\n        });\n\n    // 3. Read PKCE verifier from cookie if applicable\n    let codeVerifier: string | undefined;\n    if (isPKCEProvider(arcticProvider)) {\n      const pkceCookieName = oauthCookieName(\"pkce\", providerId);\n      codeVerifier = yield* cookies[pkceCookieName] != null\n        ? Fx.succeed(cookies[pkceCookieName]!)\n        : Cv.fail({\n            code: \"OAUTH_MISSING_VERIFIER\",\n            message: \"Missing PKCE verifier cookie for OAuth callback\",\n          });\n      resCookies.push(clearCookie(\"pkce\", providerId));\n    }\n\n    let nonce: string | undefined;\n    if (oauthConfig.nonce === true) {\n      const nonceCookieName = oauthCookieName(\"nonce\", providerId);\n      nonce = yield* cookies[nonceCookieName] != null\n        ? Fx.succeed(cookies[nonceCookieName]!)\n        : Cv.fail({\n            code: \"OAUTH_PROVIDER_ERROR\",\n            message: \"Missing nonce cookie for OAuth callback\",\n          });\n      resCookies.push(clearCookie(\"nonce\", providerId));\n    }\n\n    // 4. Exchange code for tokens\n    const tokens = yield* exchangeCode(arcticProvider, code, codeVerifier);\n\n    if (oauthConfig.validateTokens !== undefined) {\n      yield* Fx.from({\n        ok: () => oauthConfig.validateTokens!(tokens, { nonce }),\n        err: (e) =>\n          Cv.error({\n            code: \"OAUTH_PROVIDER_ERROR\",\n            message: `Token validation failed: ${e instanceof Error ? e.message : String(e)}`,\n          }),\n      });\n    }\n\n    // 5. Extract profile\n    const rawProfile = yield* extractProfile(providerId, oauthConfig, tokens);\n    const profile = yield* validateProfileId(providerId, rawProfile);\n\n    logWithLevel(\"DEBUG\", \"OAuth callback profile extracted\", {\n      providerId,\n      profileId: profile.id,\n    });\n\n    // 6. Compute signature for verifier validation\n    const state = storedState!;\n    const signature = getAuthorizationSignature({ codeVerifier, state });\n\n    return {\n      profile,\n      providerAccountId: profile.id,\n      cookies: resCookies,\n      signature,\n    };\n  });\n}\n"],"mappings":";;;;;;;;;;;;;;;;;AAgEA,MAAM,aAAa;AAEnB,SAAS,gBAAgB,MAAkC,YAAoB;AAE7E,SADe,CAAC,YAAY,QAAQ,IAAI,gBAAgB,GAAG,YAAY,MACvD,aAAa,UAAU;;AAGzC,SAAS,aACP,MACA,YACA,OACa;CACb,MAAM,0BAAU,IAAI,MAAM;AAC1B,SAAQ,QAAQ,QAAQ,SAAS,GAAG,aAAa,IAAK;AACtD,QAAO;EACL,MAAM,gBAAgB,MAAM,WAAW;EACvC;EACA,SAAS;GAAE,GAAG;GAAuB;GAAS;EAC/C;;AAGH,SAAS,YACP,MACA,YACa;AACb,QAAO;EACL,MAAM,gBAAgB,MAAM,WAAW;EACvC,OAAO;EACP,SAAS;GAAE,GAAG;GAAuB,QAAQ;GAAG;EACjD;;;;;;;AAYH,SAAgB,0BAA0B,EACxC,cACA,SAIC;AACD,QAAO,CAAC,cAAc,MAAM,CAAC,QAAQ,UAAU,UAAU,OAAU,CAAC,KAAK,IAAI;;;;;;;AAY/E,SAAS,eAAe,UAAwB;AAC9C,QACE,OAAO,SAAS,2BAA2B,cAC3C,SAAS,uBAAuB,UAAU;;;;;;AAY9C,SAAS,aACP,gBACA,MACA,cAC2C;AAC3C,QAAO,GAAG,KAAK;EACb,UACE,eAAe,eAAe,GAC1B,eAAe,0BAA0B,MAAM,aAAa,GAC5D,eAAe,0BAA0B,KAAK;EACpD,MAAM,MAAM;AACV,OAAI,aAAa,OAAO,mBACtB,QAAO,GAAG,MAAM;IACd,MAAM;IACN,SAAS,0BAA0B,EAAE;IACtC,CAAC;AAEJ,OAAI,aAAa,OAAO,iBACtB,QAAO,GAAG,MAAM;IACd,MAAM;IACN,SAAS,wCAAwC,EAAE;IACpD,CAAC;AAKJ,UAAO,GAAG,MAAM;IACd,MAAM;IACN,SAAS,2CAA2C,aAAa,QAAQ,EAAE,UAAU,OAAO,EAAE;IAC/F,CAAC;;EAEL,CAAC,CAAC,KACD,GAAG,OAAO,WAAW;AAKnB,SAAO,GAAG,QAAQ,OAAO;GACzB,CACH;;;;;;AAOH,SAAS,eACP,YACA,aACA,QACoC;CACpC,MAAM,aACJ,cAAc,OAAO,QACrB,OAAQ,OAAO,KAAa,aAAa;CAC3C,MAAM,gBAAgB,YAAY,UAC9B,EAAE,QAAQ,YAAqB,GAC/B,aACE,EAAE,QAAQ,WAAoB,GAC9B,EAAE,QAAQ,WAAoB;AAEpC,QAAO,GAAG,MAAM,eAAe,cAAc,QAAQ;EACnD,WAAW,mBACT,GAAG,KAAK;GACN,UAAU,YAAY,QAAS,OAAO;GACtC,MAAM,MACJ,GAAG,MAAM;IACP,MAAM;IACN,SAAS,2BAA2B,aAAa,QAAQ,EAAE,UAAU,OAAO,EAAE;IAC/E,CAAC;GACL,CAAC;EACJ,UAAU,mBAAmB;GAC3B,MAAM,SAAS,OAAO,cAAc,OAAO,SAAS,CAAC;AAIrD,UAAO,GAAG,QAAQ;IAChB,IAAK,OAAO,OAAkB,OAAO,YAAY;IACjD,MAAO,OAAO,QAAmB;IACjC,OAAQ,OAAO,SAAoB;IACnC,OAAQ,OAAO,WAAsB;IACtC,CAAC;;EAEJ,UAAU,mBACR,GAAG,KAAK;GACN,MAAM;GACN,SACE,aAAa,WAAW;GAE3B,CAAC;EACL,CAAC;;;;;AAMJ,SAAS,kBACP,YACA,SACoC;AACpC,QAAO,OAAO,QAAQ,OAAO,YAAY,QAAQ,KAC7C,GAAG,QAAQ,QAAQ,GACnB,GAAG,KAAK;EACN,MAAM;EACN,SAAS,6BAA6B,WAAW;EAClD,CAAC;;;;;;;;AAaR,eAAsB,4BACpB,YACA,gBACA,aAC8B;CAC9B,MAAM,QAAQ,OAAO,eAAe;CACpC,MAAM,UAAyB,EAAE;CACjC,IAAI;CAEJ,MAAM,SAAS,YAAY,UAAU,EAAE;CAEvC,IAAI;AAEJ,KAAI,eAAe,eAAe,EAAE;AAClC,iBAAe,OAAO,sBAAsB;AAC5C,QAAM,eAAe,uBAAuB,OAAO,cAAc,OAAO;AACxE,UAAQ,KAAK,aAAa,QAAQ,YAAY,aAAa,CAAC;OAE5D,OAAM,eAAe,uBAAuB,OAAO,OAAO;AAG5D,SAAQ,KAAK,aAAa,SAAS,YAAY,MAAM,CAAC;AAEtD,KAAI,YAAY,UAAU,MAAM;EAC9B,MAAM,QAAQ,OAAO,eAAe;AACpC,MAAI,aAAa,IAAI,SAAS,MAAM;AACpC,UAAQ,KAAK,aAAa,SAAS,YAAY,MAAM,CAAC;;AAGxD,cAAa,SAAS,mCAAmC;EACvD,KAAK,IAAI,UAAU;EACnB;EACA,SAAS,CAAC,CAAC;EACZ,CAAC;CAEF,MAAM,YAAY,0BAA0B;EAAE;EAAc;EAAO,CAAC;AAEpE,QAAO;EACL,UAAU,IAAI,UAAU;EACxB;EACA;EACD;;;;;;;;;AAcH,SAAgB,oBACd,YACA,gBACA,aACA,QACA,SACsC;AACtC,QAAO,GAAG,IAAI,aAAa;EACzB,MAAM,aAA4B,EAAE;EAIpC,MAAM,cAAc,QADI,gBAAgB,SAAS,WAAW;EAE5D,MAAM,gBAAgB,OAAO;AAE7B,SAAO,GAAG,MACR,CAAC,eAAe,CAAC,iBAAiB,gBAAgB,eAClD,GAAG,KAAK;GACN,MAAM;GACN,SAAS;GACV,CAAC,CACH;AACD,aAAW,KAAK,YAAY,SAAS,WAAW,CAAC;AAGjD,MAAI,OAAO,OAAO;GAChB,MAAM,QAAQ;IACZ;IACA,OAAO,OAAO;IACd,mBAAmB,OAAO;IAC3B;AACD,gBAAa,SAAS,sBAAsB,MAAM;AAClD,UAAO,GAAG,KAAK;IACb,MAAM;IACN,SAAS;IACT,OAAO,KAAK,UAAU,MAAM;IAC7B,CAAC;;EAIJ,MAAM,OAAO,OAAO,OAAO,QAAQ,OAC/B,GAAG,QAAQ,OAAO,KAAK,GACvB,GAAG,KAAK;GACN,MAAM;GACN,SAAS;GACV,CAAC;EAGN,IAAI;AACJ,MAAI,eAAe,eAAe,EAAE;GAClC,MAAM,iBAAiB,gBAAgB,QAAQ,WAAW;AAC1D,kBAAe,OAAO,QAAQ,mBAAmB,OAC7C,GAAG,QAAQ,QAAQ,gBAAiB,GACpC,GAAG,KAAK;IACN,MAAM;IACN,SAAS;IACV,CAAC;AACN,cAAW,KAAK,YAAY,QAAQ,WAAW,CAAC;;EAGlD,IAAI;AACJ,MAAI,YAAY,UAAU,MAAM;GAC9B,MAAM,kBAAkB,gBAAgB,SAAS,WAAW;AAC5D,WAAQ,OAAO,QAAQ,oBAAoB,OACvC,GAAG,QAAQ,QAAQ,iBAAkB,GACrC,GAAG,KAAK;IACN,MAAM;IACN,SAAS;IACV,CAAC;AACN,cAAW,KAAK,YAAY,SAAS,WAAW,CAAC;;EAInD,MAAM,SAAS,OAAO,aAAa,gBAAgB,MAAM,aAAa;AAEtE,MAAI,YAAY,mBAAmB,OACjC,QAAO,GAAG,KAAK;GACb,UAAU,YAAY,eAAgB,QAAQ,EAAE,OAAO,CAAC;GACxD,MAAM,MACJ,GAAG,MAAM;IACP,MAAM;IACN,SAAS,4BAA4B,aAAa,QAAQ,EAAE,UAAU,OAAO,EAAE;IAChF,CAAC;GACL,CAAC;EAKJ,MAAM,UAAU,OAAO,kBAAkB,YADtB,OAAO,eAAe,YAAY,aAAa,OAAO,CACT;AAEhE,eAAa,SAAS,oCAAoC;GACxD;GACA,WAAW,QAAQ;GACpB,CAAC;EAIF,MAAM,YAAY,0BAA0B;GAAE;GAAc,OAD9C;GACqD,CAAC;AAEpE,SAAO;GACL;GACA,mBAAmB,QAAQ;GAC3B,SAAS;GACT;GACD;GACD"}