@robelest/convex-auth 0.0.4-preview.21 → 0.0.4-preview.23

package/src/server/mutations/register.ts

@@ -1,10 +1,10 @@
 import { Fx } from "@robelest/fx";
+import { Cv } from "@robelest/fx/convex";
 import type { GenericActionCtx, GenericDataModel } from "convex/server";
 import { Infer, v } from "convex/values";
 
-import { authDb } from "../db";
-import { AuthError } from "../authError";
 import * as Provider from "../crypto";
+import { authDb } from "../db";
 import { getAuthSessionId } from "../sessions";
 import { Doc, MutationCtx } from "../types";
 import { ConvexCredentialsConfig } from "../types";
@@ -47,141 +47,96 @@ export async function createAccountFromCredentialsImpl(
   const provider = getProviderOrThrow(providerId) as ConvexCredentialsConfig;
 
   return Fx.run(
-    Fx.from({
-      ok: () =>
-        db.accounts.get(
-          provider.id,
-          account.id,
-        ) as Promise<Doc<"Account"> | null>,
-      err: () => new AuthError("INTERNAL_ERROR", "Failed to look up account"),
-    }).pipe(
-      Fx.chain((existingAccount) => {
-        if (existingAccount !== null) {
-          const verifyExistingAccountFx =
-            account.secret !== undefined
-              ? Provider.verify(
-                  provider,
-                  account.secret,
-                  existingAccount.secret ?? "",
-                ).pipe(
-                  Fx.chain((valid) =>
-                    valid
-                      ? Fx.succeed(undefined)
-                      : Fx.fail(
-                          new AuthError(
-                            "ACCOUNT_ALREADY_EXISTS",
-                            `Account ${account.id} already exists`,
-                          ),
-                        ),
-                  ),
-                )
-              : Fx.succeed(undefined);
+    Fx.gen(function* () {
+      const existingAccount = yield* Fx.promise(
+        () =>
+          db.accounts.get(
+            provider.id,
+            account.id,
+          ) as Promise<Doc<"Account"> | null>,
+      );
 
-          return verifyExistingAccountFx.pipe(
-            Fx.chain(() =>
-              Fx.from({
-                ok: () =>
-                  db.users.getById(
-                    existingAccount.userId,
-                  ) as Promise<Doc<"User"> | null>,
-                err: () =>
-                  new AuthError(
-                    "ACCOUNT_NOT_FOUND",
-                    `Linked user for account ${account.id} was not found.`,
-                  ),
-              }).pipe(
-                Fx.chain((doc) =>
-                  doc === null
-                    ? Fx.fail(
-                        new AuthError(
-                          "ACCOUNT_NOT_FOUND",
-                          `Linked user for account ${account.id} was not found.`,
-                        ),
-                      )
-                    : Fx.succeed(doc),
-                ),
-              ),
-            ),
-            Fx.map((user) => ({
-              account: existingAccount,
-              user,
-            })),
+      if (existingAccount !== null) {
+        if (account.secret !== undefined) {
+          const valid = yield* Provider.verify(
+            provider,
+            account.secret,
+            existingAccount.secret ?? "",
           );
+          if (!valid) {
+            return yield* Cv.fail({
+              code: "ACCOUNT_ALREADY_EXISTS",
+              message: `Account ${account.id} already exists`,
+            });
+          }
         }
 
-        const secretFx: Fx<string | undefined, AuthError> =
-          account.secret !== undefined
-            ? Provider.hash(provider, account.secret)
-            : Fx.succeed<string | undefined>(undefined);
-
-        return secretFx.pipe(
-          Fx.chain((secret) =>
-            Fx.from({
-              ok: async () =>
-                upsertUserAndAccount(
-                  ctx,
-                  await getAuthSessionId(ctx),
-                  { providerAccountId: account.id, secret },
-                  {
-                    type: "credentials",
-                    provider,
-                    profile,
-                    shouldLinkViaEmail,
-                    shouldLinkViaPhone,
-                  },
-                  config,
-                ),
-              err: () => new AuthError("INTERNAL_ERROR"),
-            }),
-          ),
-          Fx.chain((result) => {
-            const { userId, accountId } = result as {
-              userId: string;
-              accountId: string;
-            };
-            return Fx.zip(
-              Fx.from({
-                ok: () =>
-                  db.accounts.getById(
-                    accountId,
-                  ) as Promise<Doc<"Account"> | null>,
-                err: () => new AuthError("INTERNAL_ERROR"),
-              }),
-              Fx.from({
-                ok: () =>
-                  db.users.getById(userId) as Promise<Doc<"User"> | null>,
-                err: () => new AuthError("INTERNAL_ERROR"),
-              }),
-            );
-          }),
-          Fx.chain((pair) => {
-            const [createdAccount, createdUser] = pair as [
-              Doc<"Account"> | null,
-              Doc<"User"> | null,
-            ];
-            return createdAccount === null
-              ? Fx.fail(
-                  new AuthError(
-                    "ACCOUNT_NOT_FOUND",
-                    `Created account was not found.`,
-                  ),
-                )
-              : createdUser === null
-                ? Fx.fail(
-                    new AuthError(
-                      "USER_UPDATE_FAILED",
-                      `Created user was not found.`,
-                    ),
-                  )
-                : Fx.succeed({
-                    account: createdAccount,
-                    user: createdUser,
-                  });
-          }),
+        const user = yield* Fx.promise(
+          () =>
+            db.users.getById(
+              existingAccount.userId,
+            ) as Promise<Doc<"User"> | null>,
         );
-      }),
-      Fx.recover((e) => Fx.fatal((e as AuthError).toConvexError())),
-    ),
+        if (user === null) {
+          return yield* Cv.fail({
+            code: "ACCOUNT_NOT_FOUND",
+            message: `Linked user for account ${account.id} was not found.`,
+          });
+        }
+
+        return { account: existingAccount, user };
+      }
+
+      const secret =
+        account.secret !== undefined
+          ? yield* Provider.hash(provider, account.secret)
+          : undefined;
+
+      const result = yield* Fx.promise(async () =>
+        upsertUserAndAccount(
+          ctx,
+          await getAuthSessionId(ctx),
+          { providerAccountId: account.id, secret },
+          {
+            type: "credentials",
+            provider,
+            profile,
+            shouldLinkViaEmail,
+            shouldLinkViaPhone,
+          },
+          config,
+        ),
+      );
+
+      const { userId, accountId } = result as {
+        userId: string;
+        accountId: string;
+      };
+      const [createdAccount, createdUser] = yield* Fx.zip(
+        Fx.promise(
+          () =>
+            db.accounts.getById(accountId) as Promise<Doc<"Account"> | null>,
+        ),
+        Fx.promise(
+          () => db.users.getById(userId) as Promise<Doc<"User"> | null>,
+        ),
+      );
+
+      if (createdAccount === null) {
+        return yield* Cv.fail({
+          code: "ACCOUNT_NOT_FOUND",
+          message: `Created account was not found.`,
+        });
+      }
+      if (createdUser === null) {
+        return yield* Cv.fail({
+          code: "USER_UPDATE_FAILED",
+          message: `Created user was not found.`,
+        });
+      }
+
+      return { account: createdAccount, user: createdUser };
+    }),
   ) as Promise<ReturnType>;
 }
 

package/src/server/mutations/retrieve.ts

@@ -2,9 +2,8 @@ import { Fx } from "@robelest/fx";
 import type { GenericActionCtx, GenericDataModel } from "convex/server";
 import { Infer, v } from "convex/values";
 
-import { authDb } from "../db";
-import { AuthError } from "../authError";
 import * as Provider from "../crypto";
+import { authDb } from "../db";
 import {
   isSignInRateLimited,
   recordFailedSignIn,
@@ -39,53 +38,54 @@ export function retrieveAccountWithCredentialsImpl(
     account: { id: account.id, secret: maybeRedact(account.secret ?? "") },
   });
 
-  return Fx.from({
-    ok: async () => {
-      const existingAccount = (await db.accounts.get(
-        providerId,
-        account.id,
-      )) as Doc<"Account"> | null;
-      if (existingAccount === null) {
-        return "InvalidAccountId" as const;
-      }
-
-      if (account.secret !== undefined) {
-        const limited = await Fx.run(
-          isSignInRateLimited(ctx, existingAccount._id, config),
-        );
-        if (limited) {
-          return "TooManyFailedAttempts" as const;
-        }
+  return Fx.gen(function* () {
+    const existingAccount = yield* Fx.promise(
+      () =>
+        db.accounts.get(
+          providerId,
+          account.id,
+        ) as Promise<Doc<"Account"> | null>,
+    );
+    if (existingAccount === null) {
+      return "InvalidAccountId" as const;
+    }
 
-        const valid = await Fx.run(
-          Provider.verify(
-            getProviderOrThrow(providerId),
-            account.secret,
-            existingAccount.secret ?? "",
-          ),
-        );
-        if (!valid) {
-          await Fx.run(recordFailedSignIn(ctx, existingAccount._id, config));
-          return "InvalidSecret" as const;
-        }
-
-        await Fx.run(resetSignInRateLimit(ctx, existingAccount._id, config));
+    if (account.secret !== undefined) {
+      const limited = yield* isSignInRateLimited(
+        ctx,
+        existingAccount._id,
+        config,
+      );
+      if (limited) {
+        return "TooManyFailedAttempts" as const;
       }
 
-      const user = (await db.users.getById(
-        existingAccount.userId,
-      )) as Doc<"User"> | null;
-      if (user === null) {
-        logWithLevel(
-          LOG_LEVELS.ERROR,
-          `Account ${existingAccount._id} is linked to missing user ${existingAccount.userId}`,
-        );
-        return "InvalidAccountId" as const;
+      const valid = yield* Provider.verify(
+        getProviderOrThrow(providerId),
+        account.secret,
+        existingAccount.secret ?? "",
+      );
+      if (!valid) {
+        yield* recordFailedSignIn(ctx, existingAccount._id, config);
+        return "InvalidSecret" as const;
       }
 
-      return { account: existingAccount, user } as const;
-    },
-    err: () => new AuthError("INTERNAL_ERROR", "Failed to look up account"),
+      yield* resetSignInRateLimit(ctx, existingAccount._id, config);
+    }
+
+    const user = yield* Fx.promise(
+      () =>
+        db.users.getById(existingAccount.userId) as Promise<Doc<"User"> | null>,
+    );
+    if (user === null) {
+      logWithLevel(
+        LOG_LEVELS.ERROR,
+        `Account ${existingAccount._id} is linked to missing user ${existingAccount.userId}`,
+      );
+      return "InvalidAccountId" as const;
+    }
+
+    return { account: existingAccount, user } as ReturnType;
   }).pipe(
     Fx.fold({
       ok: (v) => v as ReturnType,

package/src/server/mutations/signature.ts

@@ -1,10 +1,10 @@
 import { Fx } from "@robelest/fx";
+import { Cv } from "@robelest/fx/convex";
 import type { GenericActionCtx, GenericDataModel } from "convex/server";
-import { GenericId, Infer, v } from "convex/values";
+import { ConvexError, GenericId, Infer, v } from "convex/values";
 
-import { authDb } from "../db";
-import { AuthError } from "../authError";
 import * as Provider from "../crypto";
+import { authDb } from "../db";
 import { MutationCtx } from "../types";
 import { AUTH_STORE_REF } from "./store/refs";
 
@@ -19,17 +19,24 @@ export function verifierSignatureImpl(
   ctx: MutationCtx,
   args: Infer<typeof verifierSignatureArgs>,
   config: Provider.Config,
-): Fx<ReturnType, AuthError> {
+): Fx<ReturnType, ConvexError<any>> {
   return Fx.gen(function* () {
     const { verifier, signature } = args;
     const db = authDb(ctx, config);
     const verifierDoc = yield* Fx.from({
       ok: () => db.verifiers.getById(verifier as GenericId<"AuthVerifier">),
-      err: () => new AuthError("INVALID_VERIFIER"),
+      err: () =>
+        Cv.error({
+          code: "INVALID_VERIFIER",
+          message: "Invalid or expired verifier.",
+        }),
     }).pipe(
       Fx.chain((doc) =>
         doc === null
-          ? Fx.fail(new AuthError("INVALID_VERIFIER"))
+          ? Cv.fail({
+              code: "INVALID_VERIFIER",
+              message: "Invalid or expired verifier.",
+            })
           : Fx.succeed(doc),
       ),
     );

package/src/server/mutations/signout.ts

@@ -2,8 +2,8 @@ import { Fx } from "@robelest/fx";
 import type { GenericActionCtx, GenericDataModel } from "convex/server";
 import { GenericId } from "convex/values";
 
-import { authDb } from "../db";
 import * as Provider from "../crypto";
+import { authDb } from "../db";
 import { deleteSession, getAuthSessionId } from "../sessions";
 import { MutationCtx } from "../types";
 import { AUTH_STORE_REF } from "./store/refs";

package/src/server/mutations/store.ts

@@ -84,53 +84,38 @@ export const storeImpl = async (
   logWithLevel(LOG_LEVELS.INFO, `\`auth:store\` type: ${args.type}`);
   return Fx.run(
     Fx.match(args, args.type, {
-      signIn: (a) =>
-        Fx.from({
-          ok: () => signInImpl(ctx, a, config),
-          err: (e) => e as never,
-        }),
+      signIn: (a) => Fx.promise(() => signInImpl(ctx, a, config)),
       signOut: () => signOutImpl(ctx, config),
       refreshSession: (a) =>
-        Fx.from({
-          ok: () => refreshSessionImpl(ctx, a, getProviderOrThrow, config),
-          err: (e) => e as never,
-        }),
+        Fx.promise(() =>
+          refreshSessionImpl(ctx, a, getProviderOrThrow, config),
+        ),
       verifyCodeAndSignIn: (a) =>
-        Fx.from({
-          ok: () => verifyCodeAndSignInImpl(ctx, a, getProviderOrThrow, config),
-          err: (e) => e as never,
-        }),
+        Fx.promise(() =>
+          verifyCodeAndSignInImpl(ctx, a, getProviderOrThrow, config),
+        ),
       verifier: () => verifierImpl(ctx, config),
       verifierSignature: (a) =>
         verifierSignatureImpl(ctx, a, config).pipe(
-          Fx.recover((e) => Fx.fatal(e.toConvexError())),
+          Fx.recover((e) => Fx.fatal(e)),
         ),
       userOAuth: (a) =>
         userOAuthImpl(ctx, a, getProviderOrThrow, config).pipe(
-          Fx.recover((e) => Fx.fatal(e.toConvexError())),
+          Fx.recover((e) => Fx.fatal(e)),
         ),
       createVerificationCode: (a) =>
-        Fx.from({
-          ok: () =>
-            createVerificationCodeImpl(ctx, a, getProviderOrThrow, config),
-          err: (e) => e as never,
-        }),
+        Fx.promise(() =>
+          createVerificationCodeImpl(ctx, a, getProviderOrThrow, config),
+        ),
       createAccountFromCredentials: (a) =>
-        Fx.from({
-          ok: () =>
-            createAccountFromCredentialsImpl(
-              ctx,
-              a,
-              getProviderOrThrow,
-              config,
-            ),
-          err: (e) => e as never,
-        }),
+        Fx.promise(() =>
+          createAccountFromCredentialsImpl(ctx, a, getProviderOrThrow, config),
+        ),
       retrieveAccountWithCredentials: (a) =>
         retrieveAccountWithCredentialsImpl(ctx, a, getProviderOrThrow, config),
       modifyAccount: (a) =>
         modifyAccountImpl(ctx, a, getProviderOrThrow, config).pipe(
-          Fx.recover((e) => Fx.fatal(e.toConvexError())),
+          Fx.recover((e) => Fx.fatal(e)),
         ),
       invalidateSessions: (a) => invalidateSessionsImpl(ctx, a, config),
     }),

package/src/server/mutations/verifier.ts

@@ -2,8 +2,8 @@ import { Fx } from "@robelest/fx";
 import type { GenericActionCtx, GenericDataModel } from "convex/server";
 import { GenericId } from "convex/values";
 
-import { authDb } from "../db";
 import * as Provider from "../crypto";
+import { authDb } from "../db";
 import { getAuthSessionId } from "../sessions";
 import { MutationCtx } from "../types";
 import { AUTH_STORE_REF } from "./store/refs";

package/src/server/mutations/verify.ts

@@ -2,8 +2,10 @@ import { Fx } from "@robelest/fx";
 import type { GenericActionCtx, GenericDataModel } from "convex/server";
 import { Infer, v } from "convex/values";
 
-import { authDb } from "../db";
 import * as Provider from "../crypto";
+import { authDb } from "../db";
+import { createSyntheticOAuthMaterializedConfig } from "../enterprise/oidc";
+import { isEnterpriseProviderId } from "../enterprise/shared";
 import {
   isSignInRateLimited,
   recordFailedSignIn,
@@ -14,10 +16,6 @@ import {
   getAuthSessionId,
   maybeGenerateTokensForSession,
 } from "../sessions";
-import {
-  createSyntheticOAuthMaterializedConfig,
-} from "../enterprise/oidc";
-import { isEnterpriseProviderId } from "../enterprise/shared";
 import { MutationCtx, SessionInfo } from "../types";
 import { upsertUserAndAccount } from "../users";
 import { LOG_LEVELS, logWithLevel, sha256 } from "../utils";