@robelest/convex-auth 0.0.4-preview.21 → 0.0.4-preview.23

package/src/server/enterprise/http.ts

@@ -1,11 +1,10 @@
+import { Fx } from "@robelest/fx";
+import { Cv } from "@robelest/fx/convex";
 import type { GenericActionCtx, HttpRouter } from "convex/server";
+import { ConvexError } from "convex/values";
 import { serialize as serializeCookie } from "cookie";
 
 import { redirectToParamCookie, useRedirectToParam } from "../cookies";
-import { isAuthError } from "../errors";
-import { Fx } from "@robelest/fx";
-
-import { AuthError } from "../authError";
 import { addSSORoutes, convertErrorsToResponse, getCookies } from "../http";
 import type { SSORuntimeRoute } from "../http";
 import { createOAuthAuthorizationURL, handleOAuthCallback } from "../oauth";
@@ -207,12 +206,10 @@ export function addEnterpriseHttpRuntime(deps: EnterpriseHttpRuntimeDeps) {
           runtimeRoute.protocol !== "saml" ||
             runtimeRoute.rest.length !== 1 ||
             runtimeRoute.rest[0] !== "acs",
-          Fx.fail(
-            new AuthError(
-              "INVALID_PARAMETERS",
-              "Invalid enterprise runtime path.",
-            ).toConvexError(),
-          ),
+          Cv.fail({
+            code: "INVALID_PARAMETERS",
+            message: "Invalid enterprise runtime path.",
+          }),
         );
 
         const enterpriseId = runtimeRoute.enterpriseId;
@@ -230,10 +227,10 @@ export function addEnterpriseHttpRuntime(deps: EnterpriseHttpRuntimeDeps) {
               config: loaded.config,
             }),
           err: (e) =>
-            new AuthError(
-              "OAUTH_PROVIDER_ERROR",
-              `SAML response parse failed: ${e instanceof Error ? e.message : String(e)}`,
-            ).toConvexError(),
+            Cv.error({
+              code: "OAUTH_PROVIDER_ERROR",
+              message: `SAML response parse failed: ${e instanceof Error ? e.message : String(e)}`,
+            }),
         });
 
         yield* Fx.from({
@@ -247,10 +244,11 @@ export function addEnterpriseHttpRuntime(deps: EnterpriseHttpRuntimeDeps) {
             return Promise.resolve();
           },
           err: () =>
-            new AuthError(
-              "OAUTH_INVALID_STATE",
-              "SAML RelayState did not match the pending login request.",
-            ).toConvexError(),
+            Cv.error({
+              code: "OAUTH_INVALID_STATE",
+              message:
+                "SAML RelayState did not match the pending login request.",
+            }),
         });
 
         const { samlAttributes, samlSessionIndex, ...userProfile } =
@@ -331,10 +329,10 @@ export function addEnterpriseHttpRuntime(deps: EnterpriseHttpRuntimeDeps) {
       runtimeRoute.rest.length !== 1 ||
       runtimeRoute.rest[0] !== "slo"
     ) {
-      throw new AuthError(
-        "INVALID_PARAMETERS",
-        "Invalid enterprise runtime path.",
-      ).toConvexError();
+      throw Cv.error({
+        code: "INVALID_PARAMETERS",
+        message: "Invalid enterprise runtime path.",
+      });
     }
     const { loaded, enterprise } = await loadActiveEnterpriseSamlOrThrow(
       ctx,
@@ -371,10 +369,10 @@ export function addEnterpriseHttpRuntime(deps: EnterpriseHttpRuntimeDeps) {
     if (parsedMessage.hasSamlResponse) {
       return new Response(null, { status: 204 });
     }
-    throw new AuthError(
-      "INVALID_PARAMETERS",
-      "Missing SAML logout payload.",
-    ).toConvexError();
+    throw Cv.error({
+      code: "INVALID_PARAMETERS",
+      message: "Missing SAML logout payload.",
+    });
   };
 
   const handleScimRequest = async (
@@ -645,7 +643,7 @@ export function addEnterpriseHttpRuntime(deps: EnterpriseHttpRuntimeDeps) {
           userId,
           data: patchData,
         });
-        const resolution = await auth.member.resolve(state.ctx, {
+        const resolution = await auth.member.inspect(state.ctx, {
           groupId: state.enterprise.groupId,
           userId,
         });
@@ -711,7 +709,7 @@ export function addEnterpriseHttpRuntime(deps: EnterpriseHttpRuntimeDeps) {
         );
         if (missing) return missing;
         const userId = state.parsedPath.resourceId!;
-        const resolution = await auth.member.resolve(state.ctx, {
+        const resolution = await auth.member.inspect(state.ctx, {
           groupId: state.enterprise.groupId,
           userId,
         });
@@ -961,15 +959,12 @@ export function addEnterpriseHttpRuntime(deps: EnterpriseHttpRuntimeDeps) {
             );
             const userId = match?.[1];
             if (userId) {
-              const resolution = await auth.member.resolve(
-                state.ctx,
-                { groupId, userId },
-              );
+              const resolution = await auth.member.inspect(state.ctx, {
+                groupId,
+                userId,
+              });
               if (resolution.membership) {
-                await auth.member.delete(
-                  state.ctx,
-                  resolution.membership._id,
-                );
+                await auth.member.delete(state.ctx, resolution.membership._id);
               }
             }
           }
@@ -1105,7 +1100,13 @@ export function addEnterpriseHttpRuntime(deps: EnterpriseHttpRuntimeDeps) {
       ) {
         return scimError(400, "invalidFilter", error.message);
       }
-      if (isAuthError(error)) {
+      if (
+        error instanceof ConvexError &&
+        typeof error.data === "object" &&
+        error.data !== null &&
+        "code" in error.data &&
+        "message" in error.data
+      ) {
         const code = error.data.code as string;
         const status =
           code === "MISSING_BEARER_TOKEN" || code === "INVALID_API_KEY"
@@ -1141,7 +1142,10 @@ export function addEnterpriseHttpRuntime(deps: EnterpriseHttpRuntimeDeps) {
       const url = new URL(request.url);
       const verifier = url.searchParams.get("code");
       if (!verifier) {
-        throw new AuthError("OAUTH_MISSING_VERIFIER").toConvexError();
+        throw Cv.error({
+          code: "OAUTH_MISSING_VERIFIER",
+          message: "Missing sign-in verifier.",
+        });
       }
       const { loaded, enterprise } = await loadActiveEnterpriseSamlOrThrow(
         ctx,
@@ -1204,7 +1208,10 @@ export function addEnterpriseHttpRuntime(deps: EnterpriseHttpRuntimeDeps) {
       const url = new URL(request.url);
       const verifier = url.searchParams.get("code");
       if (!verifier) {
-        throw new AuthError("OAUTH_MISSING_VERIFIER").toConvexError();
+        throw Cv.error({
+          code: "OAUTH_MISSING_VERIFIER",
+          message: "Missing sign-in verifier.",
+        });
       }
       const { enterprise, oidc } = await loadEnterpriseOidcOrThrow(
         ctx,

package/src/server/http.ts

@@ -1,3 +1,5 @@
+import { Fx } from "@robelest/fx";
+import { Cv } from "@robelest/fx/convex";
 import {
   GenericActionCtx,
   GenericDataModel,
@@ -7,10 +9,6 @@ import {
 import { ConvexError } from "convex/values";
 import { parse as parseCookies } from "cookie";
 
-import { isAuthError } from "./errors";
-import { Fx } from "@robelest/fx";
-
-import { AuthError } from "./authError";
 import type { CorsConfig, HttpKeyContext } from "./types";
 import { logError } from "./utils";
 
@@ -59,19 +57,21 @@ export function createHttpAction(auth: {
             const rawKey = authHeader.slice(7);
 
             const keyResult = await Fx.run(
-              Fx.from({
-                ok: () => auth.key.verify(genericCtx, rawKey),
-                err: (error) => error,
-              }).pipe(
-                Fx.fold({
-                  ok: (result) => ({ ok: true, value: result }) as const,
-                  err: (error) => ({ ok: false, error }) as const,
-                }),
+              Fx.attempt(
+                () => auth.key.verify(genericCtx, rawKey),
+                (result) => ({ ok: true, value: result }) as const,
+                (error) => ({ ok: false, error }) as const,
               ),
             );
 
             if (!keyResult.ok) {
-              if (isAuthError(keyResult.error)) {
+              if (
+                keyResult.error instanceof ConvexError &&
+                typeof keyResult.error.data === "object" &&
+                keyResult.error.data !== null &&
+                "code" in keyResult.error.data &&
+                "message" in keyResult.error.data
+              ) {
                 const { code, message } = keyResult.error.data as {
                   code: string;
                   message: string;
@@ -219,7 +219,13 @@ export function convertErrorsToResponse(
         err: (error) => error,
       }).pipe(
         Fx.recover((error) => {
-          if (isAuthError(error)) {
+          if (
+            error instanceof ConvexError &&
+            typeof error.data === "object" &&
+            error.data !== null &&
+            "code" in error.data &&
+            "message" in error.data
+          ) {
             return Fx.succeed(
               new Response(
                 JSON.stringify({
@@ -426,10 +432,10 @@ export function addSSORoutes(
           deps.routeBase,
         );
         if (!route) {
-          throw new AuthError(
-            "INVALID_PARAMETERS",
-            "Invalid enterprise runtime path.",
-          ).toConvexError();
+          throw Cv.error({
+            code: "INVALID_PARAMETERS",
+            message: "Invalid enterprise runtime path.",
+          });
         }
         if (route.protocol === "saml" && route.rest.length === 1) {
           if (route.rest[0] === "metadata") {
@@ -456,10 +462,10 @@ export function addSSORoutes(
         if (route.protocol === "scim" && route.rest[0] === "v2") {
           return await deps.handleScimRequest(ctx, request);
         }
-        throw new AuthError(
-          "INVALID_PARAMETERS",
-          "Invalid enterprise runtime path.",
-        ).toConvexError();
+        throw Cv.error({
+          code: "INVALID_PARAMETERS",
+          message: "Invalid enterprise runtime path.",
+        });
       }),
     ),
   });
@@ -484,10 +490,10 @@ export function addSSORoutes(
         if (route?.protocol === "scim" && route.rest[0] === "v2") {
           return await deps.handleScimRequest(ctx, request);
         }
-        throw new AuthError(
-          "INVALID_PARAMETERS",
-          "Invalid enterprise runtime path.",
-        ).toConvexError();
+        throw Cv.error({
+          code: "INVALID_PARAMETERS",
+          message: "Invalid enterprise runtime path.",
+        });
       }),
     ),
   });
@@ -504,10 +510,10 @@ export function addSSORoutes(
         if (route?.protocol === "scim" && route.rest[0] === "v2") {
           return await deps.handleScimRequest(ctx, request);
         }
-        throw new AuthError(
-          "INVALID_PARAMETERS",
-          "Invalid enterprise runtime path.",
-        ).toConvexError();
+        throw Cv.error({
+          code: "INVALID_PARAMETERS",
+          message: "Invalid enterprise runtime path.",
+        });
       }),
     ),
   });

package/src/server/identity.ts

@@ -1,4 +1,4 @@
-import { AuthError } from "./authError";
+import { Cv } from "@robelest/fx/convex";
 
 /** @internal */
 export function userIdFromIdentitySubject(subject: string): string {
@@ -9,10 +9,10 @@ export function userIdFromIdentitySubject(subject: string): string {
     rest.length === 0 ||
     rest.some((segment) => segment.length === 0)
   ) {
-    throw new AuthError(
-      "INTERNAL_ERROR",
-      "Authenticated identity subject is malformed.",
-    );
+    throw Cv.error({
+      code: "INTERNAL_ERROR",
+      message: "Authenticated identity subject is malformed.",
+    });
   }
   return userId;
 }

package/src/server/index.ts

@@ -2,7 +2,9 @@ export { AuthCtx, createAuth } from "./auth";
 export type {
   AuthApi,
   AuthApiBase,
+  AuthContext,
   AuthConfig,
+  AuthCtxConfig,
   ConvexAuthResult,
   InferAuth,
   InferClientApi,

package/src/server/limits.ts

@@ -1,10 +1,9 @@
 import { Fx } from "@robelest/fx";
+import { ConvexError } from "convex/values";
 
 import { authDb } from "./db";
-import { AuthError } from "./authError";
 import { Doc, MutationCtx } from "./types";
 import { ConvexAuthConfig } from "./types";
-import { errorMessage } from "./utils";
 
 const DEFAULT_MAX_SIGN_IN_ATTEMPTS_PER_HOUR = 10;
 
@@ -16,7 +15,7 @@ export const isSignInRateLimited = (
   ctx: MutationCtx,
   identifier: string,
   config: ConvexAuthConfig,
-): Fx<boolean, AuthError> =>
+): Fx<boolean, ConvexError<any>> =>
   getRateLimitState(ctx, identifier, config).pipe(
     Fx.map((state) => state !== null && state.attemptsLeft < 1),
   );
@@ -31,40 +30,28 @@ export const recordFailedSignIn = (
   ctx: MutationCtx,
   identifier: string,
   config: ConvexAuthConfig,
-): Fx<void, AuthError> =>
-  getRateLimitState(ctx, identifier, config).pipe(
-    Fx.chain((state) =>
-      state !== null
-        ? Fx.from({
-            ok: () =>
-              authDb(ctx, config).rateLimits.patch(state.limit._id, {
-                attemptsLeft: state.attemptsLeft - 1,
-                lastAttemptTime: Date.now(),
-              }),
-            err: (e) =>
-              new AuthError(
-                "INTERNAL_ERROR",
-                `Failed to patch rate limit: ${errorMessage(e)}`,
-              ),
-          })
-        : Fx.from({
-            ok: () =>
-              authDb(ctx, config).rateLimits.create({
-                identifier,
-                attemptsLeft:
-                  (config.signIn?.maxFailedAttemptsPerHour ??
-                    DEFAULT_MAX_SIGN_IN_ATTEMPTS_PER_HOUR) - 1,
-                lastAttemptTime: Date.now(),
-              }),
-            err: (e) =>
-              new AuthError(
-                "INTERNAL_ERROR",
-                `Failed to create rate limit: ${errorMessage(e)}`,
-              ),
-          }),
-    ),
-    Fx.map(() => undefined),
-  );
+): Fx<void, ConvexError<any>> =>
+  Fx.gen(function* () {
+    const state = yield* getRateLimitState(ctx, identifier, config);
+    if (state !== null) {
+      yield* Fx.promise(() =>
+        authDb(ctx, config).rateLimits.patch(state.limit._id, {
+          attemptsLeft: state.attemptsLeft - 1,
+          lastAttemptTime: Date.now(),
+        }),
+      );
+    } else {
+      yield* Fx.promise(() =>
+        authDb(ctx, config).rateLimits.create({
+          identifier,
+          attemptsLeft:
+            (config.signIn?.maxFailedAttemptsPerHour ??
+              DEFAULT_MAX_SIGN_IN_ATTEMPTS_PER_HOUR) - 1,
+          lastAttemptTime: Date.now(),
+        }),
+      );
+    }
+  });
 
 /**
  * Reset the rate limit for the given identifier (e.g. after successful sign-in).
@@ -74,21 +61,15 @@ export const resetSignInRateLimit = (
   ctx: MutationCtx,
   identifier: string,
   config: ConvexAuthConfig,
-): Fx<void, AuthError> =>
-  getRateLimitState(ctx, identifier, config).pipe(
-    Fx.chain((state) =>
-      state !== null
-        ? Fx.from({
-            ok: () => authDb(ctx, config).rateLimits.delete(state.limit._id),
-            err: (e) =>
-              new AuthError(
-                "INTERNAL_ERROR",
-                `Failed to delete rate limit: ${errorMessage(e)}`,
-              ),
-          })
-        : Fx.unit,
-    ),
-  );
+): Fx<void, ConvexError<any>> =>
+  Fx.gen(function* () {
+    const state = yield* getRateLimitState(ctx, identifier, config);
+    if (state !== null) {
+      yield* Fx.promise(() =>
+        authDb(ctx, config).rateLimits.delete(state.limit._id),
+      );
+    }
+  });
 
 // ---------------------------------------------------------------------------
 // Internal
@@ -103,32 +84,24 @@ const getRateLimitState = (
   ctx: MutationCtx,
   identifier: string,
   config: ConvexAuthConfig,
-): Fx<RateLimitState, AuthError> => {
-  const now = Date.now();
-  const maxAttemptsPerHour =
-    config.signIn?.maxFailedAttemptsPerHour ??
-    DEFAULT_MAX_SIGN_IN_ATTEMPTS_PER_HOUR;
+): Fx<RateLimitState, ConvexError<any>> =>
+  Fx.gen(function* () {
+    const now = Date.now();
+    const maxAttemptsPerHour =
+      config.signIn?.maxFailedAttemptsPerHour ??
+      DEFAULT_MAX_SIGN_IN_ATTEMPTS_PER_HOUR;
 
-  return Fx.from({
-    ok: () => authDb(ctx, config).rateLimits.get(identifier),
-    err: (e) =>
-      new AuthError(
-        "INTERNAL_ERROR",
-        `Failed to get rate limit: ${errorMessage(e)}`,
-      ),
-  }).pipe(
-    Fx.map((raw) => {
-      const limit = raw as
-        | (Doc<"RateLimit"> & { attemptsLeft: number; lastAttemptTime: number })
-        | null;
-      if (limit === null) return null;
-      const elapsed = now - limit.lastAttemptTime;
-      const maxAttemptsPerMs = maxAttemptsPerHour / (60 * 60 * 1000);
-      const attemptsLeft = Math.min(
-        maxAttemptsPerHour,
-        limit.attemptsLeft + elapsed * maxAttemptsPerMs,
-      );
-      return { limit, attemptsLeft };
-    }),
-  );
-};
+    const limit = (yield* Fx.promise(() =>
+      authDb(ctx, config).rateLimits.get(identifier),
+    )) as
+      | (Doc<"RateLimit"> & { attemptsLeft: number; lastAttemptTime: number })
+      | null;
+    if (limit === null) return null;
+    const elapsed = now - limit.lastAttemptTime;
+    const maxAttemptsPerMs = maxAttemptsPerHour / (60 * 60 * 1000);
+    const attemptsLeft = Math.min(
+      maxAttemptsPerHour,
+      limit.attemptsLeft + elapsed * maxAttemptsPerMs,
+    );
+    return { limit, attemptsLeft };
+  });