@robelest/convex-auth 0.0.4-preview.22 → 0.0.4-preview.24

package/dist/server/http.js.map

@@ -1 +1 @@
-{"version":3,"file":"http.js","names":["result","parseCookies"],"sources":["../../src/server/http.ts"],"sourcesContent":["import {\n  GenericActionCtx,\n  GenericDataModel,\n  HttpRouter,\n  httpActionGeneric,\n} from \"convex/server\";\nimport { ConvexError } from \"convex/values\";\nimport { parse as parseCookies } from \"cookie\";\n\nimport { isAuthError } from \"./errors\";\nimport { Fx } from \"@robelest/fx\";\n\nimport { AuthError } from \"./authError\";\nimport type { CorsConfig, HttpKeyContext } from \"./types\";\nimport { logError } from \"./utils\";\n\nexport function createHttpAction(auth: {\n  key: { verify: (ctx: GenericActionCtx<any>, rawKey: string) => Promise<any> };\n}) {\n  return (\n    handler: (\n      ctx: GenericActionCtx<GenericDataModel> & HttpKeyContext,\n      request: Request,\n    ) => Promise<Response | Record<string, unknown>>,\n    options?: {\n      scope?: { resource: string; action: string };\n      cors?: CorsConfig;\n    },\n  ) => {\n    const corsConfig = options?.cors ?? {};\n    const corsHeaders: Record<string, string> = {\n      \"Access-Control-Allow-Origin\": corsConfig.origin ?? \"*\",\n      \"Access-Control-Allow-Methods\":\n        corsConfig.methods ?? \"GET,POST,PUT,PATCH,DELETE,OPTIONS\",\n      \"Access-Control-Allow-Headers\":\n        corsConfig.headers ?? \"Content-Type,Authorization\",\n    };\n\n    return httpActionGeneric(async (genericCtx, request) => {\n      return Fx.run(\n        Fx.from({\n          ok: async () => {\n            const authHeader = request.headers.get(\"Authorization\");\n            if (!authHeader?.startsWith(\"Bearer \")) {\n              return new Response(\n                JSON.stringify({\n                  error: \"Missing or malformed Authorization: Bearer header.\",\n                  code: \"MISSING_BEARER_TOKEN\",\n                }),\n                {\n                  status: 401,\n                  headers: {\n                    ...corsHeaders,\n                    \"Content-Type\": \"application/json\",\n                  },\n                },\n              );\n            }\n            const rawKey = authHeader.slice(7);\n\n            const keyResult = await Fx.run(\n              Fx.from({\n                ok: () => auth.key.verify(genericCtx, rawKey),\n                err: (error) => error,\n              }).pipe(\n                Fx.fold({\n                  ok: (result) => ({ ok: true, value: result }) as const,\n                  err: (error) => ({ ok: false, error }) as const,\n                }),\n              ),\n            );\n\n            if (!keyResult.ok) {\n              if (isAuthError(keyResult.error)) {\n                const { code, message } = keyResult.error.data as {\n                  code: string;\n                  message: string;\n                };\n                return new Response(JSON.stringify({ error: message, code }), {\n                  status: 403,\n                  headers: {\n                    ...corsHeaders,\n                    \"Content-Type\": \"application/json\",\n                  },\n                });\n              }\n              throw keyResult.error;\n            }\n\n            if (\n              options?.scope &&\n              !keyResult.value.scopes.can(\n                options.scope.resource,\n                options.scope.action,\n              )\n            ) {\n              return new Response(\n                JSON.stringify({\n                  error: \"This API key does not have the required permissions.\",\n                  code: \"SCOPE_CHECK_FAILED\",\n                }),\n                {\n                  status: 403,\n                  headers: {\n                    ...corsHeaders,\n                    \"Content-Type\": \"application/json\",\n                  },\n                },\n              );\n            }\n\n            const enrichedCtx = Object.assign(genericCtx, {\n              key: {\n                userId: keyResult.value.userId,\n                keyId: keyResult.value.keyId,\n                scopes: keyResult.value.scopes,\n              },\n            });\n            const result = await handler(enrichedCtx, request);\n\n            if (result instanceof Response) {\n              const headers = new Headers(result.headers);\n              for (const [k, val] of Object.entries(corsHeaders)) {\n                if (!headers.has(k)) headers.set(k, val);\n              }\n              return new Response(result.body, {\n                status: result.status,\n                statusText: result.statusText,\n                headers,\n              });\n            }\n\n            return new Response(JSON.stringify(result), {\n              status: 200,\n              headers: {\n                ...corsHeaders,\n                \"Content-Type\": \"application/json\",\n              },\n            });\n          },\n          err: (error) => error,\n        }).pipe(\n          Fx.recover((error) => {\n            logError(error);\n            return Fx.succeed(\n              new Response(\n                JSON.stringify({\n                  error: \"An unexpected error occurred.\",\n                  code: \"INTERNAL_ERROR\",\n                }),\n                {\n                  status: 500,\n                  headers: {\n                    ...corsHeaders,\n                    \"Content-Type\": \"application/json\",\n                  },\n                },\n              ),\n            );\n          }),\n        ),\n      );\n    });\n  };\n}\n\nexport function createHttpRoute(\n  wrapAction: ReturnType<typeof createHttpAction>,\n) {\n  return (\n    http: { route: (config: any) => void },\n    routeConfig: {\n      path: string;\n      method: \"GET\" | \"POST\" | \"PUT\" | \"PATCH\" | \"DELETE\";\n      handler: (\n        ctx: GenericActionCtx<GenericDataModel> & HttpKeyContext,\n        request: Request,\n      ) => Promise<Response | Record<string, unknown>>;\n      scope?: { resource: string; action: string };\n      cors?: CorsConfig;\n    },\n  ) => {\n    const corsConfig = routeConfig.cors ?? {};\n    const corsHeaders: Record<string, string> = {\n      \"Access-Control-Allow-Origin\": corsConfig.origin ?? \"*\",\n      \"Access-Control-Allow-Methods\":\n        corsConfig.methods ?? \"GET,POST,PUT,PATCH,DELETE,OPTIONS\",\n      \"Access-Control-Allow-Headers\":\n        corsConfig.headers ?? \"Content-Type,Authorization\",\n    };\n\n    http.route({\n      path: routeConfig.path,\n      method: \"OPTIONS\",\n      handler: httpActionGeneric(async () => {\n        return new Response(null, { status: 204, headers: corsHeaders });\n      }),\n    });\n\n    http.route({\n      path: routeConfig.path,\n      method: routeConfig.method,\n      handler: wrapAction(routeConfig.handler, {\n        scope: routeConfig.scope,\n        cors: routeConfig.cors,\n      }),\n    });\n  };\n}\n\nexport function convertErrorsToResponse(\n  errorStatusCode: number,\n  action: (ctx: GenericActionCtx<any>, request: Request) => Promise<Response>,\n) {\n  return async (ctx: GenericActionCtx<any>, request: Request) => {\n    return Fx.run(\n      Fx.from({\n        ok: () => action(ctx, request),\n        err: (error) => error,\n      }).pipe(\n        Fx.recover((error) => {\n          if (isAuthError(error)) {\n            return Fx.succeed(\n              new Response(\n                JSON.stringify({\n                  code: error.data.code,\n                  message: error.data.message,\n                }),\n                {\n                  status: errorStatusCode,\n                  headers: { \"Content-Type\": \"application/json\" },\n                },\n              ),\n            );\n          } else if (error instanceof ConvexError) {\n            return Fx.succeed(\n              new Response(null, {\n                status: errorStatusCode,\n                statusText:\n                  typeof error.data === \"string\" ? error.data : \"Error\",\n              }),\n            );\n          } else {\n            logError(error);\n            return Fx.succeed(\n              new Response(null, {\n                status: 500,\n                statusText: \"Internal Server Error\",\n              }),\n            );\n          }\n        }),\n      ),\n    );\n  };\n}\n\nexport function getCookies(\n  request: Request,\n): Record<string, string | undefined> {\n  return parseCookies(request.headers.get(\"Cookie\") ?? \"\");\n}\n\nexport type SSORuntimeRoute = {\n  pathname?: string;\n  enterpriseId: string;\n  protocol: \"oidc\" | \"saml\" | \"scim\";\n  rest: string[];\n};\n\nfunction parseEnterpriseRuntimeRoute(\n  pathname: string,\n  routeBase: string,\n): SSORuntimeRoute | null {\n  const runtimePrefix = `${routeBase}/`;\n  const runtimeParts = pathname.startsWith(runtimePrefix)\n    ? pathname.slice(runtimePrefix.length).split(\"/\").filter(Boolean)\n    : [];\n  const [runtimeEnterpriseId, protocol, ...rest] = runtimeParts;\n  if (\n    runtimeEnterpriseId === undefined ||\n    (protocol !== \"oidc\" && protocol !== \"saml\" && protocol !== \"scim\") ||\n    rest.length === 0\n  ) {\n    return null;\n  }\n  return {\n    pathname,\n    enterpriseId: runtimeEnterpriseId,\n    protocol,\n    rest,\n  };\n}\n\nexport function addOpenIdRoutes(\n  http: HttpRouter,\n  deps: {\n    getIssuer: () => string;\n    getJwks: () => string;\n  },\n) {\n  const cacheControl =\n    \"public, max-age=15, stale-while-revalidate=15, stale-if-error=86400\";\n\n  http.route({\n    path: \"/.well-known/openid-configuration\",\n    method: \"GET\",\n    handler: httpActionGeneric(async () => {\n      const issuer = deps.getIssuer();\n      return new Response(\n        JSON.stringify({\n          issuer,\n          jwks_uri: `${issuer}/.well-known/jwks.json`,\n        }),\n        {\n          status: 200,\n          headers: {\n            \"Content-Type\": \"application/json\",\n            \"Cache-Control\": cacheControl,\n          },\n        },\n      );\n    }),\n  });\n\n  http.route({\n    path: \"/.well-known/jwks.json\",\n    method: \"GET\",\n    handler: httpActionGeneric(async () => {\n      return new Response(deps.getJwks(), {\n        status: 200,\n        headers: {\n          \"Content-Type\": \"application/json\",\n          \"Cache-Control\": cacheControl,\n        },\n      });\n    }),\n  });\n}\n\nexport function addAuthRoutes(\n  http: HttpRouter,\n  deps: {\n    handleSignIn: (\n      ctx: GenericActionCtx<any>,\n      request: Request,\n    ) => Promise<Response>;\n    handleCallback: (\n      ctx: GenericActionCtx<any>,\n      request: Request,\n    ) => Promise<Response>;\n  },\n) {\n  http.route({\n    pathPrefix: \"/api/auth/signin/\",\n    method: \"GET\",\n    handler: httpActionGeneric(deps.handleSignIn),\n  });\n\n  const callbackHandler = httpActionGeneric(deps.handleCallback);\n\n  http.route({\n    pathPrefix: \"/api/auth/callback/\",\n    method: \"GET\",\n    handler: callbackHandler,\n  });\n\n  http.route({\n    pathPrefix: \"/api/auth/callback/\",\n    method: \"POST\",\n    handler: callbackHandler,\n  });\n}\n\nexport function addSSORoutes(\n  http: HttpRouter,\n  deps: {\n    routeBase: string;\n    convertErrorsToResponse: typeof convertErrorsToResponse;\n    handleSamlMetadata: (\n      ctx: GenericActionCtx<any>,\n      request: Request,\n      route: SSORuntimeRoute,\n    ) => Promise<Response>;\n    handleSamlSignIn: (\n      ctx: GenericActionCtx<any>,\n      request: Request,\n      route: SSORuntimeRoute,\n    ) => Promise<Response>;\n    handleOidcSignIn: (\n      ctx: GenericActionCtx<any>,\n      request: Request,\n      route: SSORuntimeRoute,\n    ) => Promise<Response>;\n    handleOidcCallback: (\n      ctx: GenericActionCtx<any>,\n      request: Request,\n      route: SSORuntimeRoute,\n    ) => Promise<Response>;\n    handleSamlAcs: (\n      ctx: GenericActionCtx<any>,\n      request: Request,\n      route: SSORuntimeRoute,\n    ) => Promise<Response>;\n    handleSamlSlo: (\n      ctx: GenericActionCtx<any>,\n      request: Request,\n      route: SSORuntimeRoute,\n    ) => Promise<Response>;\n    handleScimRequest: (\n      ctx: GenericActionCtx<any>,\n      request: Request,\n    ) => Promise<Response>;\n    scimError: (status: number, scimType: string, detail: string) => Response;\n  },\n) {\n  const routePrefix = `${deps.routeBase}/`;\n\n  http.route({\n    pathPrefix: routePrefix,\n    method: \"GET\",\n    handler: httpActionGeneric(\n      deps.convertErrorsToResponse(400, async (ctx, request) => {\n        const route = parseEnterpriseRuntimeRoute(\n          new URL(request.url).pathname,\n          deps.routeBase,\n        );\n        if (!route) {\n          throw new AuthError(\n            \"INVALID_PARAMETERS\",\n            \"Invalid enterprise runtime path.\",\n          ).toConvexError();\n        }\n        if (route.protocol === \"saml\" && route.rest.length === 1) {\n          if (route.rest[0] === \"metadata\") {\n            return await deps.handleSamlMetadata(ctx, request, route);\n          }\n          if (route.rest[0] === \"signin\") {\n            return await deps.handleSamlSignIn(ctx, request, route);\n          }\n          if (route.rest[0] === \"acs\") {\n            return await deps.handleSamlAcs(ctx, request, route);\n          }\n          if (route.rest[0] === \"slo\") {\n            return await deps.handleSamlSlo(ctx, request, route);\n          }\n        }\n        if (route.protocol === \"oidc\" && route.rest.length === 1) {\n          if (route.rest[0] === \"signin\") {\n            return await deps.handleOidcSignIn(ctx, request, route);\n          }\n          if (route.rest[0] === \"callback\") {\n            return await deps.handleOidcCallback(ctx, request, route);\n          }\n        }\n        if (route.protocol === \"scim\" && route.rest[0] === \"v2\") {\n          return await deps.handleScimRequest(ctx, request);\n        }\n        throw new AuthError(\n          \"INVALID_PARAMETERS\",\n          \"Invalid enterprise runtime path.\",\n        ).toConvexError();\n      }),\n    ),\n  });\n\n  http.route({\n    pathPrefix: routePrefix,\n    method: \"POST\",\n    handler: httpActionGeneric(\n      deps.convertErrorsToResponse(400, async (ctx, request) => {\n        const route = parseEnterpriseRuntimeRoute(\n          new URL(request.url).pathname,\n          deps.routeBase,\n        );\n        if (route?.protocol === \"saml\" && route.rest.length === 1) {\n          if (route.rest[0] === \"acs\") {\n            return await deps.handleSamlAcs(ctx, request, route);\n          }\n          if (route.rest[0] === \"slo\") {\n            return await deps.handleSamlSlo(ctx, request, route);\n          }\n        }\n        if (route?.protocol === \"scim\" && route.rest[0] === \"v2\") {\n          return await deps.handleScimRequest(ctx, request);\n        }\n        throw new AuthError(\n          \"INVALID_PARAMETERS\",\n          \"Invalid enterprise runtime path.\",\n        ).toConvexError();\n      }),\n    ),\n  });\n\n  http.route({\n    pathPrefix: routePrefix,\n    method: \"PUT\",\n    handler: httpActionGeneric(\n      deps.convertErrorsToResponse(400, async (ctx, request) => {\n        const route = parseEnterpriseRuntimeRoute(\n          new URL(request.url).pathname,\n          deps.routeBase,\n        );\n        if (route?.protocol === \"scim\" && route.rest[0] === \"v2\") {\n          return await deps.handleScimRequest(ctx, request);\n        }\n        throw new AuthError(\n          \"INVALID_PARAMETERS\",\n          \"Invalid enterprise runtime path.\",\n        ).toConvexError();\n      }),\n    ),\n  });\n\n  for (const method of [\"PATCH\", \"DELETE\"] as const) {\n    http.route({\n      pathPrefix: routePrefix,\n      method,\n      handler: httpActionGeneric(async (ctx, request) => {\n        const route = parseEnterpriseRuntimeRoute(\n          new URL(request.url).pathname,\n          deps.routeBase,\n        );\n        if (!route || route.protocol !== \"scim\" || route.rest[0] !== \"v2\") {\n          return deps.scimError(404, \"notFound\", \"SCIM resource not found.\");\n        }\n        return await deps.handleScimRequest(ctx, request);\n      }),\n    });\n  }\n}\n"],"mappings":";;;;;;;;;AAgBA,SAAgB,iBAAiB,MAE9B;AACD,SACE,SAIA,YAIG;EACH,MAAM,aAAa,SAAS,QAAQ,EAAE;EACtC,MAAM,cAAsC;GAC1C,+BAA+B,WAAW,UAAU;GACpD,gCACE,WAAW,WAAW;GACxB,gCACE,WAAW,WAAW;GACzB;AAED,SAAO,kBAAkB,OAAO,YAAY,YAAY;AACtD,UAAO,GAAG,IACR,GAAG,KAAK;IACN,IAAI,YAAY;KACd,MAAM,aAAa,QAAQ,QAAQ,IAAI,gBAAgB;AACvD,SAAI,CAAC,YAAY,WAAW,UAAU,CACpC,QAAO,IAAI,SACT,KAAK,UAAU;MACb,OAAO;MACP,MAAM;MACP,CAAC,EACF;MACE,QAAQ;MACR,SAAS;OACP,GAAG;OACH,gBAAgB;OACjB;MACF,CACF;KAEH,MAAM,SAAS,WAAW,MAAM,EAAE;KAElC,MAAM,YAAY,MAAM,GAAG,IACzB,GAAG,KAAK;MACN,UAAU,KAAK,IAAI,OAAO,YAAY,OAAO;MAC7C,MAAM,UAAU;MACjB,CAAC,CAAC,KACD,GAAG,KAAK;MACN,KAAK,cAAY;OAAE,IAAI;OAAM,OAAOA;OAAQ;MAC5C,MAAM,WAAW;OAAE,IAAI;OAAO;OAAO;MACtC,CAAC,CACH,CACF;AAED,SAAI,CAAC,UAAU,IAAI;AACjB,UAAI,YAAY,UAAU,MAAM,EAAE;OAChC,MAAM,EAAE,MAAM,YAAY,UAAU,MAAM;AAI1C,cAAO,IAAI,SAAS,KAAK,UAAU;QAAE,OAAO;QAAS;QAAM,CAAC,EAAE;QAC5D,QAAQ;QACR,SAAS;SACP,GAAG;SACH,gBAAgB;SACjB;QACF,CAAC;;AAEJ,YAAM,UAAU;;AAGlB,SACE,SAAS,SACT,CAAC,UAAU,MAAM,OAAO,IACtB,QAAQ,MAAM,UACd,QAAQ,MAAM,OACf,CAED,QAAO,IAAI,SACT,KAAK,UAAU;MACb,OAAO;MACP,MAAM;MACP,CAAC,EACF;MACE,QAAQ;MACR,SAAS;OACP,GAAG;OACH,gBAAgB;OACjB;MACF,CACF;KAUH,MAAM,SAAS,MAAM,QAPD,OAAO,OAAO,YAAY,EAC5C,KAAK;MACH,QAAQ,UAAU,MAAM;MACxB,OAAO,UAAU,MAAM;MACvB,QAAQ,UAAU,MAAM;MACzB,EACF,CAAC,EACwC,QAAQ;AAElD,SAAI,kBAAkB,UAAU;MAC9B,MAAM,UAAU,IAAI,QAAQ,OAAO,QAAQ;AAC3C,WAAK,MAAM,CAAC,GAAG,QAAQ,OAAO,QAAQ,YAAY,CAChD,KAAI,CAAC,QAAQ,IAAI,EAAE,CAAE,SAAQ,IAAI,GAAG,IAAI;AAE1C,aAAO,IAAI,SAAS,OAAO,MAAM;OAC/B,QAAQ,OAAO;OACf,YAAY,OAAO;OACnB;OACD,CAAC;;AAGJ,YAAO,IAAI,SAAS,KAAK,UAAU,OAAO,EAAE;MAC1C,QAAQ;MACR,SAAS;OACP,GAAG;OACH,gBAAgB;OACjB;MACF,CAAC;;IAEJ,MAAM,UAAU;IACjB,CAAC,CAAC,KACD,GAAG,SAAS,UAAU;AACpB,aAAS,MAAM;AACf,WAAO,GAAG,QACR,IAAI,SACF,KAAK,UAAU;KACb,OAAO;KACP,MAAM;KACP,CAAC,EACF;KACE,QAAQ;KACR,SAAS;MACP,GAAG;MACH,gBAAgB;MACjB;KACF,CACF,CACF;KACD,CACH,CACF;IACD;;;AAIN,SAAgB,gBACd,YACA;AACA,SACE,MACA,gBAUG;EACH,MAAM,aAAa,YAAY,QAAQ,EAAE;EACzC,MAAM,cAAsC;GAC1C,+BAA+B,WAAW,UAAU;GACpD,gCACE,WAAW,WAAW;GACxB,gCACE,WAAW,WAAW;GACzB;AAED,OAAK,MAAM;GACT,MAAM,YAAY;GAClB,QAAQ;GACR,SAAS,kBAAkB,YAAY;AACrC,WAAO,IAAI,SAAS,MAAM;KAAE,QAAQ;KAAK,SAAS;KAAa,CAAC;KAChE;GACH,CAAC;AAEF,OAAK,MAAM;GACT,MAAM,YAAY;GAClB,QAAQ,YAAY;GACpB,SAAS,WAAW,YAAY,SAAS;IACvC,OAAO,YAAY;IACnB,MAAM,YAAY;IACnB,CAAC;GACH,CAAC;;;AAIN,SAAgB,wBACd,iBACA,QACA;AACA,QAAO,OAAO,KAA4B,YAAqB;AAC7D,SAAO,GAAG,IACR,GAAG,KAAK;GACN,UAAU,OAAO,KAAK,QAAQ;GAC9B,MAAM,UAAU;GACjB,CAAC,CAAC,KACD,GAAG,SAAS,UAAU;AACpB,OAAI,YAAY,MAAM,CACpB,QAAO,GAAG,QACR,IAAI,SACF,KAAK,UAAU;IACb,MAAM,MAAM,KAAK;IACjB,SAAS,MAAM,KAAK;IACrB,CAAC,EACF;IACE,QAAQ;IACR,SAAS,EAAE,gBAAgB,oBAAoB;IAChD,CACF,CACF;YACQ,iBAAiB,YAC1B,QAAO,GAAG,QACR,IAAI,SAAS,MAAM;IACjB,QAAQ;IACR,YACE,OAAO,MAAM,SAAS,WAAW,MAAM,OAAO;IACjD,CAAC,CACH;QACI;AACL,aAAS,MAAM;AACf,WAAO,GAAG,QACR,IAAI,SAAS,MAAM;KACjB,QAAQ;KACR,YAAY;KACb,CAAC,CACH;;IAEH,CACH,CACF;;;AAIL,SAAgB,WACd,SACoC;AACpC,QAAOC,MAAa,QAAQ,QAAQ,IAAI,SAAS,IAAI,GAAG;;AAU1D,SAAS,4BACP,UACA,WACwB;CACxB,MAAM,gBAAgB,GAAG,UAAU;CAInC,MAAM,CAAC,qBAAqB,UAAU,GAAG,QAHpB,SAAS,WAAW,cAAc,GACnD,SAAS,MAAM,cAAc,OAAO,CAAC,MAAM,IAAI,CAAC,OAAO,QAAQ,GAC/D,EAAE;AAEN,KACE,wBAAwB,UACvB,aAAa,UAAU,aAAa,UAAU,aAAa,UAC5D,KAAK,WAAW,EAEhB,QAAO;AAET,QAAO;EACL;EACA,cAAc;EACd;EACA;EACD;;AAGH,SAAgB,gBACd,MACA,MAIA;CACA,MAAM,eACJ;AAEF,MAAK,MAAM;EACT,MAAM;EACN,QAAQ;EACR,SAAS,kBAAkB,YAAY;GACrC,MAAM,SAAS,KAAK,WAAW;AAC/B,UAAO,IAAI,SACT,KAAK,UAAU;IACb;IACA,UAAU,GAAG,OAAO;IACrB,CAAC,EACF;IACE,QAAQ;IACR,SAAS;KACP,gBAAgB;KAChB,iBAAiB;KAClB;IACF,CACF;IACD;EACH,CAAC;AAEF,MAAK,MAAM;EACT,MAAM;EACN,QAAQ;EACR,SAAS,kBAAkB,YAAY;AACrC,UAAO,IAAI,SAAS,KAAK,SAAS,EAAE;IAClC,QAAQ;IACR,SAAS;KACP,gBAAgB;KAChB,iBAAiB;KAClB;IACF,CAAC;IACF;EACH,CAAC;;AAGJ,SAAgB,cACd,MACA,MAUA;AACA,MAAK,MAAM;EACT,YAAY;EACZ,QAAQ;EACR,SAAS,kBAAkB,KAAK,aAAa;EAC9C,CAAC;CAEF,MAAM,kBAAkB,kBAAkB,KAAK,eAAe;AAE9D,MAAK,MAAM;EACT,YAAY;EACZ,QAAQ;EACR,SAAS;EACV,CAAC;AAEF,MAAK,MAAM;EACT,YAAY;EACZ,QAAQ;EACR,SAAS;EACV,CAAC;;AAGJ,SAAgB,aACd,MACA,MAuCA;CACA,MAAM,cAAc,GAAG,KAAK,UAAU;AAEtC,MAAK,MAAM;EACT,YAAY;EACZ,QAAQ;EACR,SAAS,kBACP,KAAK,wBAAwB,KAAK,OAAO,KAAK,YAAY;GACxD,MAAM,QAAQ,4BACZ,IAAI,IAAI,QAAQ,IAAI,CAAC,UACrB,KAAK,UACN;AACD,OAAI,CAAC,MACH,OAAM,IAAI,UACR,sBACA,mCACD,CAAC,eAAe;AAEnB,OAAI,MAAM,aAAa,UAAU,MAAM,KAAK,WAAW,GAAG;AACxD,QAAI,MAAM,KAAK,OAAO,WACpB,QAAO,MAAM,KAAK,mBAAmB,KAAK,SAAS,MAAM;AAE3D,QAAI,MAAM,KAAK,OAAO,SACpB,QAAO,MAAM,KAAK,iBAAiB,KAAK,SAAS,MAAM;AAEzD,QAAI,MAAM,KAAK,OAAO,MACpB,QAAO,MAAM,KAAK,cAAc,KAAK,SAAS,MAAM;AAEtD,QAAI,MAAM,KAAK,OAAO,MACpB,QAAO,MAAM,KAAK,cAAc,KAAK,SAAS,MAAM;;AAGxD,OAAI,MAAM,aAAa,UAAU,MAAM,KAAK,WAAW,GAAG;AACxD,QAAI,MAAM,KAAK,OAAO,SACpB,QAAO,MAAM,KAAK,iBAAiB,KAAK,SAAS,MAAM;AAEzD,QAAI,MAAM,KAAK,OAAO,WACpB,QAAO,MAAM,KAAK,mBAAmB,KAAK,SAAS,MAAM;;AAG7D,OAAI,MAAM,aAAa,UAAU,MAAM,KAAK,OAAO,KACjD,QAAO,MAAM,KAAK,kBAAkB,KAAK,QAAQ;AAEnD,SAAM,IAAI,UACR,sBACA,mCACD,CAAC,eAAe;IACjB,CACH;EACF,CAAC;AAEF,MAAK,MAAM;EACT,YAAY;EACZ,QAAQ;EACR,SAAS,kBACP,KAAK,wBAAwB,KAAK,OAAO,KAAK,YAAY;GACxD,MAAM,QAAQ,4BACZ,IAAI,IAAI,QAAQ,IAAI,CAAC,UACrB,KAAK,UACN;AACD,OAAI,OAAO,aAAa,UAAU,MAAM,KAAK,WAAW,GAAG;AACzD,QAAI,MAAM,KAAK,OAAO,MACpB,QAAO,MAAM,KAAK,cAAc,KAAK,SAAS,MAAM;AAEtD,QAAI,MAAM,KAAK,OAAO,MACpB,QAAO,MAAM,KAAK,cAAc,KAAK,SAAS,MAAM;;AAGxD,OAAI,OAAO,aAAa,UAAU,MAAM,KAAK,OAAO,KAClD,QAAO,MAAM,KAAK,kBAAkB,KAAK,QAAQ;AAEnD,SAAM,IAAI,UACR,sBACA,mCACD,CAAC,eAAe;IACjB,CACH;EACF,CAAC;AAEF,MAAK,MAAM;EACT,YAAY;EACZ,QAAQ;EACR,SAAS,kBACP,KAAK,wBAAwB,KAAK,OAAO,KAAK,YAAY;GACxD,MAAM,QAAQ,4BACZ,IAAI,IAAI,QAAQ,IAAI,CAAC,UACrB,KAAK,UACN;AACD,OAAI,OAAO,aAAa,UAAU,MAAM,KAAK,OAAO,KAClD,QAAO,MAAM,KAAK,kBAAkB,KAAK,QAAQ;AAEnD,SAAM,IAAI,UACR,sBACA,mCACD,CAAC,eAAe;IACjB,CACH;EACF,CAAC;AAEF,MAAK,MAAM,UAAU,CAAC,SAAS,SAAS,CACtC,MAAK,MAAM;EACT,YAAY;EACZ;EACA,SAAS,kBAAkB,OAAO,KAAK,YAAY;GACjD,MAAM,QAAQ,4BACZ,IAAI,IAAI,QAAQ,IAAI,CAAC,UACrB,KAAK,UACN;AACD,OAAI,CAAC,SAAS,MAAM,aAAa,UAAU,MAAM,KAAK,OAAO,KAC3D,QAAO,KAAK,UAAU,KAAK,YAAY,2BAA2B;AAEpE,UAAO,MAAM,KAAK,kBAAkB,KAAK,QAAQ;IACjD;EACH,CAAC"}
+{"version":3,"file":"http.js","names":["result","parseCookies"],"sources":["../../src/server/http.ts"],"sourcesContent":["import { Fx } from \"@robelest/fx\";\nimport { Cv } from \"@robelest/fx/convex\";\nimport {\n  GenericActionCtx,\n  GenericDataModel,\n  HttpRouter,\n  httpActionGeneric,\n} from \"convex/server\";\nimport { ConvexError } from \"convex/values\";\nimport { parse as parseCookies } from \"cookie\";\n\nimport type {\n  AuthContext,\n  OptionalAuthContext,\n  UserDoc,\n} from \"./auth\";\nimport {\n  createUnauthenticatedAuthContext,\n  getAuthContextForUser,\n  getSessionUserId,\n} from \"./context\";\nimport type { CorsConfig, HttpKeyContext } from \"./types\";\nimport { logError } from \"./utils\";\n\ntype HttpContextAuthLike = {\n  user: {\n    get: (ctx: any, userId: string) => Promise<UserDoc>;\n    getActiveGroup: (\n      ctx: any,\n      args: { userId: string },\n    ) => Promise<string | null>;\n  };\n  member: {\n    inspect: (\n      ctx: any,\n      args: { userId: string; groupId: string },\n    ) => Promise<{\n      membership: unknown;\n      roleIds: string[];\n      grants: string[];\n    }>;\n  };\n  key: {\n    verify: (ctx: GenericActionCtx<any>, rawKey: string) => Promise<{\n      userId: string;\n      keyId: string;\n      scopes: HttpKeyContext[\"key\"][\"scopes\"];\n    }>;\n  };\n};\n\n/**\n * Auth context returned by `auth.http.context(ctx, request)`.\n *\n * This resolves raw HTTP authentication in two steps:\n * 1. session auth from `ctx.auth.getUserIdentity()`\n * 2. API key auth from `Authorization: Bearer sk_*`\n *\n * The `source` field tells you which authentication path succeeded.\n * When `source === \"key\"`, the verified API key metadata is available on\n * `key`.\n *\n * @example\n * ```ts\n * const authContext = await auth.http.context(ctx, request);\n * if (authContext.source === \"key\") {\n *   console.log(authContext.key.keyId);\n * }\n * ```\n */\nexport type HttpAuthContext =\n  | (AuthContext & {\n      /** The request authenticated through a browser or session token. */\n      source: \"session\";\n      /** No API key was used for this request. */\n      key: null;\n    })\n  | (AuthContext & {\n      /** The request authenticated through an API key. */\n      source: \"key\";\n      /** Verified API key metadata for the request. */\n      key: HttpKeyContext[\"key\"];\n    });\n\n/**\n * Nullable HTTP auth context returned by\n * `auth.http.context(ctx, request, { optional: true })`.\n *\n * This preserves a stable auth-shaped object for raw `httpAction` handlers\n * that allow anonymous callers.\n */\nexport type OptionalHttpAuthContext =\n  | (OptionalAuthContext & {\n      /** No authentication source was resolved. */\n      source: null;\n      /** No API key metadata is available. */\n      key: null;\n    })\n  | HttpAuthContext;\n\n/**\n * Configuration for {@link createAuth().http.context}.\n *\n * This mirrors {@link AuthContextConfig} for raw HTTP handlers and adds support\n * for enriching mixed session/API-key auth results.\n *\n * @typeParam TResolve - Extra fields returned from `resolve()` and merged into\n *   the resolved HTTP auth context.\n *\n * @example\n * ```ts\n * const authContext = await auth.http.context(ctx, request, {\n *   resolve: async (_ctx, user, authState) => ({\n *     email: user.email,\n *     isMachineRequest: authState.source === \"key\",\n *   }),\n * });\n * ```\n */\nexport type HttpAuthContextConfig<\n  TResolve extends Record<string, unknown> = Record<string, never>,\n> = {\n  /**\n   * Allow unauthenticated callers and return a null-shaped auth object instead\n   * of throwing `NOT_SIGNED_IN`.\n   */\n  optional?: boolean;\n  /**\n   * Attach additional derived fields to the resolved HTTP auth context.\n   *\n   * This callback runs only when authentication succeeds.\n   */\n  resolve?: (\n    ctx: GenericActionCtx<any>,\n    user: UserDoc,\n    auth: HttpAuthContext,\n  ) => Promise<TResolve> | TResolve;\n  /**\n   * Override or wrap HTTP auth resolution.\n   *\n   * Return `undefined` to use the built-in session-or-key resolver, `null` for\n   * an explicit unauthenticated state, or a fully resolved\n   * {@link HttpAuthContext}.\n   */\n  authResolve?: (\n    ctx: GenericActionCtx<any>,\n    fallback: () => Promise<HttpAuthContext | null>,\n  ) =>\n    | Promise<HttpAuthContext | null | undefined>\n    | HttpAuthContext\n    | null\n    | undefined;\n};\n\nfunction createNotSignedInError() {\n  return Cv.error({\n    code: \"NOT_SIGNED_IN\",\n    message: \"Authentication required.\",\n  });\n}\n\nasync function getHttpKeyContext(\n  auth: HttpContextAuthLike,\n  ctx: GenericActionCtx<any>,\n  request: Request,\n): Promise<HttpAuthContext | null> {\n  const authHeader = request.headers.get(\"Authorization\");\n  if (!authHeader?.startsWith(\"Bearer sk_\")) {\n    return null;\n  }\n\n  try {\n    const verified = await auth.key.verify(ctx, authHeader.slice(7));\n    const authContext = await getAuthContextForUser(auth, ctx, verified.userId);\n    return {\n      ...authContext,\n      source: \"key\",\n      key: {\n        userId: verified.userId,\n        keyId: verified.keyId,\n        scopes: verified.scopes,\n      },\n    };\n  } catch {\n    return null;\n  }\n}\n\nasync function resolveHttpAuthContext(\n  auth: HttpContextAuthLike,\n  ctx: GenericActionCtx<any>,\n  request: Request,\n): Promise<HttpAuthContext | null> {\n  const sessionUserId = await getSessionUserId(ctx);\n  if (sessionUserId !== null) {\n    const authContext = await getAuthContextForUser(auth, ctx, sessionUserId);\n    return {\n      ...authContext,\n      source: \"session\",\n      key: null,\n    };\n  }\n\n  return await getHttpKeyContext(auth, ctx, request);\n}\n\n/**\n * @internal\n * Create the implementation behind `auth.http.context(...)`.\n */\nexport function createHttpContext(auth: HttpContextAuthLike): {\n  <TResolve extends Record<string, unknown> = Record<string, never>>(\n    ctx: GenericActionCtx<any>,\n    request: Request,\n    config: HttpAuthContextConfig<TResolve> & { optional: true },\n  ): Promise<OptionalHttpAuthContext & TResolve>;\n  <TResolve extends Record<string, unknown> = Record<string, never>>(\n    ctx: GenericActionCtx<any>,\n    request: Request,\n    config?: HttpAuthContextConfig<TResolve>,\n  ): Promise<HttpAuthContext & TResolve>;\n} {\n  return (async (\n    ctx: GenericActionCtx<any>,\n    request: Request,\n    config?: HttpAuthContextConfig<any>,\n  ) => {\n    const fallback = () => resolveHttpAuthContext(auth, ctx, request);\n    const authOverride = config?.authResolve\n      ? await config.authResolve(ctx, fallback)\n      : undefined;\n    const resolved =\n      authOverride === undefined ? await fallback() : authOverride;\n\n    if (resolved === null) {\n      if (config?.optional !== true) {\n        throw createNotSignedInError();\n      }\n      return {\n        ...createUnauthenticatedAuthContext(),\n        source: null,\n        key: null,\n      };\n    }\n\n    const extra = config?.resolve\n      ? await config.resolve(ctx, resolved.user, resolved)\n      : {};\n\n    return {\n      ...resolved,\n      ...extra,\n    };\n  }) as {\n    <TResolve extends Record<string, unknown> = Record<string, never>>(\n      ctx: GenericActionCtx<any>,\n      request: Request,\n      config: HttpAuthContextConfig<TResolve> & { optional: true },\n    ): Promise<OptionalHttpAuthContext & TResolve>;\n    <TResolve extends Record<string, unknown> = Record<string, never>>(\n      ctx: GenericActionCtx<any>,\n      request: Request,\n      config?: HttpAuthContextConfig<TResolve>,\n    ): Promise<HttpAuthContext & TResolve>;\n  };\n}\n\nexport function createHttpAction(auth: {\n  key: { verify: (ctx: GenericActionCtx<any>, rawKey: string) => Promise<any> };\n}) {\n  return (\n    handler: (\n      ctx: GenericActionCtx<GenericDataModel> & HttpKeyContext,\n      request: Request,\n    ) => Promise<Response | Record<string, unknown>>,\n    options?: {\n      scope?: { resource: string; action: string };\n      cors?: CorsConfig;\n    },\n  ) => {\n    const corsConfig = options?.cors ?? {};\n    const corsHeaders: Record<string, string> = {\n      \"Access-Control-Allow-Origin\": corsConfig.origin ?? \"*\",\n      \"Access-Control-Allow-Methods\":\n        corsConfig.methods ?? \"GET,POST,PUT,PATCH,DELETE,OPTIONS\",\n      \"Access-Control-Allow-Headers\":\n        corsConfig.headers ?? \"Content-Type,Authorization\",\n    };\n\n    return httpActionGeneric(async (genericCtx, request) => {\n      return Fx.run(\n        Fx.from({\n          ok: async () => {\n            const authHeader = request.headers.get(\"Authorization\");\n            if (!authHeader?.startsWith(\"Bearer \")) {\n              return new Response(\n                JSON.stringify({\n                  error: \"Missing or malformed Authorization: Bearer header.\",\n                  code: \"MISSING_BEARER_TOKEN\",\n                }),\n                {\n                  status: 401,\n                  headers: {\n                    ...corsHeaders,\n                    \"Content-Type\": \"application/json\",\n                  },\n                },\n              );\n            }\n            const rawKey = authHeader.slice(7);\n\n            const keyResult = await Fx.run(\n              Fx.attempt(\n                () => auth.key.verify(genericCtx, rawKey),\n                (result) => ({ ok: true, value: result }) as const,\n                (error) => ({ ok: false, error }) as const,\n              ),\n            );\n\n            if (!keyResult.ok) {\n              if (\n                keyResult.error instanceof ConvexError &&\n                typeof keyResult.error.data === \"object\" &&\n                keyResult.error.data !== null &&\n                \"code\" in keyResult.error.data &&\n                \"message\" in keyResult.error.data\n              ) {\n                const { code, message } = keyResult.error.data as {\n                  code: string;\n                  message: string;\n                };\n                return new Response(JSON.stringify({ error: message, code }), {\n                  status: 403,\n                  headers: {\n                    ...corsHeaders,\n                    \"Content-Type\": \"application/json\",\n                  },\n                });\n              }\n              throw keyResult.error;\n            }\n\n            if (\n              options?.scope &&\n              !keyResult.value.scopes.can(\n                options.scope.resource,\n                options.scope.action,\n              )\n            ) {\n              return new Response(\n                JSON.stringify({\n                  error: \"This API key does not have the required permissions.\",\n                  code: \"SCOPE_CHECK_FAILED\",\n                }),\n                {\n                  status: 403,\n                  headers: {\n                    ...corsHeaders,\n                    \"Content-Type\": \"application/json\",\n                  },\n                },\n              );\n            }\n\n            const enrichedCtx = Object.assign(genericCtx, {\n              key: {\n                userId: keyResult.value.userId,\n                keyId: keyResult.value.keyId,\n                scopes: keyResult.value.scopes,\n              },\n            });\n            const result = await handler(enrichedCtx, request);\n\n            if (result instanceof Response) {\n              const headers = new Headers(result.headers);\n              for (const [k, val] of Object.entries(corsHeaders)) {\n                if (!headers.has(k)) headers.set(k, val);\n              }\n              return new Response(result.body, {\n                status: result.status,\n                statusText: result.statusText,\n                headers,\n              });\n            }\n\n            return new Response(JSON.stringify(result), {\n              status: 200,\n              headers: {\n                ...corsHeaders,\n                \"Content-Type\": \"application/json\",\n              },\n            });\n          },\n          err: (error) => error,\n        }).pipe(\n          Fx.recover((error) => {\n            logError(error);\n            return Fx.succeed(\n              new Response(\n                JSON.stringify({\n                  error: \"An unexpected error occurred.\",\n                  code: \"INTERNAL_ERROR\",\n                }),\n                {\n                  status: 500,\n                  headers: {\n                    ...corsHeaders,\n                    \"Content-Type\": \"application/json\",\n                  },\n                },\n              ),\n            );\n          }),\n        ),\n      );\n    });\n  };\n}\n\nexport function createHttpRoute(\n  wrapAction: ReturnType<typeof createHttpAction>,\n) {\n  return (\n    http: { route: (config: any) => void },\n    routeConfig: {\n      path: string;\n      method: \"GET\" | \"POST\" | \"PUT\" | \"PATCH\" | \"DELETE\";\n      handler: (\n        ctx: GenericActionCtx<GenericDataModel> & HttpKeyContext,\n        request: Request,\n      ) => Promise<Response | Record<string, unknown>>;\n      scope?: { resource: string; action: string };\n      cors?: CorsConfig;\n    },\n  ) => {\n    const corsConfig = routeConfig.cors ?? {};\n    const corsHeaders: Record<string, string> = {\n      \"Access-Control-Allow-Origin\": corsConfig.origin ?? \"*\",\n      \"Access-Control-Allow-Methods\":\n        corsConfig.methods ?? \"GET,POST,PUT,PATCH,DELETE,OPTIONS\",\n      \"Access-Control-Allow-Headers\":\n        corsConfig.headers ?? \"Content-Type,Authorization\",\n    };\n\n    http.route({\n      path: routeConfig.path,\n      method: \"OPTIONS\",\n      handler: httpActionGeneric(async () => {\n        return new Response(null, { status: 204, headers: corsHeaders });\n      }),\n    });\n\n    http.route({\n      path: routeConfig.path,\n      method: routeConfig.method,\n      handler: wrapAction(routeConfig.handler, {\n        scope: routeConfig.scope,\n        cors: routeConfig.cors,\n      }),\n    });\n  };\n}\n\nexport function convertErrorsToResponse(\n  errorStatusCode: number,\n  action: (ctx: GenericActionCtx<any>, request: Request) => Promise<Response>,\n) {\n  return async (ctx: GenericActionCtx<any>, request: Request) => {\n    return Fx.run(\n      Fx.from({\n        ok: () => action(ctx, request),\n        err: (error) => error,\n      }).pipe(\n        Fx.recover((error) => {\n          if (\n            error instanceof ConvexError &&\n            typeof error.data === \"object\" &&\n            error.data !== null &&\n            \"code\" in error.data &&\n            \"message\" in error.data\n          ) {\n            return Fx.succeed(\n              new Response(\n                JSON.stringify({\n                  code: error.data.code,\n                  message: error.data.message,\n                }),\n                {\n                  status: errorStatusCode,\n                  headers: { \"Content-Type\": \"application/json\" },\n                },\n              ),\n            );\n          } else if (error instanceof ConvexError) {\n            return Fx.succeed(\n              new Response(null, {\n                status: errorStatusCode,\n                statusText:\n                  typeof error.data === \"string\" ? error.data : \"Error\",\n              }),\n            );\n          } else {\n            logError(error);\n            return Fx.succeed(\n              new Response(null, {\n                status: 500,\n                statusText: \"Internal Server Error\",\n              }),\n            );\n          }\n        }),\n      ),\n    );\n  };\n}\n\nexport function getCookies(\n  request: Request,\n): Record<string, string | undefined> {\n  return parseCookies(request.headers.get(\"Cookie\") ?? \"\");\n}\n\nexport type SSORuntimeRoute = {\n  pathname?: string;\n  enterpriseId: string;\n  protocol: \"oidc\" | \"saml\" | \"scim\";\n  rest: string[];\n};\n\nfunction parseEnterpriseRuntimeRoute(\n  pathname: string,\n  routeBase: string,\n): SSORuntimeRoute | null {\n  const runtimePrefix = `${routeBase}/`;\n  const runtimeParts = pathname.startsWith(runtimePrefix)\n    ? pathname.slice(runtimePrefix.length).split(\"/\").filter(Boolean)\n    : [];\n  const [runtimeEnterpriseId, protocol, ...rest] = runtimeParts;\n  if (\n    runtimeEnterpriseId === undefined ||\n    (protocol !== \"oidc\" && protocol !== \"saml\" && protocol !== \"scim\") ||\n    rest.length === 0\n  ) {\n    return null;\n  }\n  return {\n    pathname,\n    enterpriseId: runtimeEnterpriseId,\n    protocol,\n    rest,\n  };\n}\n\nexport function addOpenIdRoutes(\n  http: HttpRouter,\n  deps: {\n    getIssuer: () => string;\n    getJwks: () => string;\n  },\n) {\n  const cacheControl =\n    \"public, max-age=15, stale-while-revalidate=15, stale-if-error=86400\";\n\n  http.route({\n    path: \"/.well-known/openid-configuration\",\n    method: \"GET\",\n    handler: httpActionGeneric(async () => {\n      const issuer = deps.getIssuer();\n      return new Response(\n        JSON.stringify({\n          issuer,\n          jwks_uri: `${issuer}/.well-known/jwks.json`,\n        }),\n        {\n          status: 200,\n          headers: {\n            \"Content-Type\": \"application/json\",\n            \"Cache-Control\": cacheControl,\n          },\n        },\n      );\n    }),\n  });\n\n  http.route({\n    path: \"/.well-known/jwks.json\",\n    method: \"GET\",\n    handler: httpActionGeneric(async () => {\n      return new Response(deps.getJwks(), {\n        status: 200,\n        headers: {\n          \"Content-Type\": \"application/json\",\n          \"Cache-Control\": cacheControl,\n        },\n      });\n    }),\n  });\n}\n\nexport function addAuthRoutes(\n  http: HttpRouter,\n  deps: {\n    handleSignIn: (\n      ctx: GenericActionCtx<any>,\n      request: Request,\n    ) => Promise<Response>;\n    handleCallback: (\n      ctx: GenericActionCtx<any>,\n      request: Request,\n    ) => Promise<Response>;\n  },\n) {\n  http.route({\n    pathPrefix: \"/api/auth/signin/\",\n    method: \"GET\",\n    handler: httpActionGeneric(deps.handleSignIn),\n  });\n\n  const callbackHandler = httpActionGeneric(deps.handleCallback);\n\n  http.route({\n    pathPrefix: \"/api/auth/callback/\",\n    method: \"GET\",\n    handler: callbackHandler,\n  });\n\n  http.route({\n    pathPrefix: \"/api/auth/callback/\",\n    method: \"POST\",\n    handler: callbackHandler,\n  });\n}\n\nexport function addSSORoutes(\n  http: HttpRouter,\n  deps: {\n    routeBase: string;\n    convertErrorsToResponse: typeof convertErrorsToResponse;\n    handleSamlMetadata: (\n      ctx: GenericActionCtx<any>,\n      request: Request,\n      route: SSORuntimeRoute,\n    ) => Promise<Response>;\n    handleSamlSignIn: (\n      ctx: GenericActionCtx<any>,\n      request: Request,\n      route: SSORuntimeRoute,\n    ) => Promise<Response>;\n    handleOidcSignIn: (\n      ctx: GenericActionCtx<any>,\n      request: Request,\n      route: SSORuntimeRoute,\n    ) => Promise<Response>;\n    handleOidcCallback: (\n      ctx: GenericActionCtx<any>,\n      request: Request,\n      route: SSORuntimeRoute,\n    ) => Promise<Response>;\n    handleSamlAcs: (\n      ctx: GenericActionCtx<any>,\n      request: Request,\n      route: SSORuntimeRoute,\n    ) => Promise<Response>;\n    handleSamlSlo: (\n      ctx: GenericActionCtx<any>,\n      request: Request,\n      route: SSORuntimeRoute,\n    ) => Promise<Response>;\n    handleScimRequest: (\n      ctx: GenericActionCtx<any>,\n      request: Request,\n    ) => Promise<Response>;\n    scimError: (status: number, scimType: string, detail: string) => Response;\n  },\n) {\n  const routePrefix = `${deps.routeBase}/`;\n\n  http.route({\n    pathPrefix: routePrefix,\n    method: \"GET\",\n    handler: httpActionGeneric(\n      deps.convertErrorsToResponse(400, async (ctx, request) => {\n        const route = parseEnterpriseRuntimeRoute(\n          new URL(request.url).pathname,\n          deps.routeBase,\n        );\n        if (!route) {\n          throw Cv.error({\n            code: \"INVALID_PARAMETERS\",\n            message: \"Invalid enterprise runtime path.\",\n          });\n        }\n        if (route.protocol === \"saml\" && route.rest.length === 1) {\n          if (route.rest[0] === \"metadata\") {\n            return await deps.handleSamlMetadata(ctx, request, route);\n          }\n          if (route.rest[0] === \"signin\") {\n            return await deps.handleSamlSignIn(ctx, request, route);\n          }\n          if (route.rest[0] === \"acs\") {\n            return await deps.handleSamlAcs(ctx, request, route);\n          }\n          if (route.rest[0] === \"slo\") {\n            return await deps.handleSamlSlo(ctx, request, route);\n          }\n        }\n        if (route.protocol === \"oidc\" && route.rest.length === 1) {\n          if (route.rest[0] === \"signin\") {\n            return await deps.handleOidcSignIn(ctx, request, route);\n          }\n          if (route.rest[0] === \"callback\") {\n            return await deps.handleOidcCallback(ctx, request, route);\n          }\n        }\n        if (route.protocol === \"scim\" && route.rest[0] === \"v2\") {\n          return await deps.handleScimRequest(ctx, request);\n        }\n        throw Cv.error({\n          code: \"INVALID_PARAMETERS\",\n          message: \"Invalid enterprise runtime path.\",\n        });\n      }),\n    ),\n  });\n\n  http.route({\n    pathPrefix: routePrefix,\n    method: \"POST\",\n    handler: httpActionGeneric(\n      deps.convertErrorsToResponse(400, async (ctx, request) => {\n        const route = parseEnterpriseRuntimeRoute(\n          new URL(request.url).pathname,\n          deps.routeBase,\n        );\n        if (route?.protocol === \"saml\" && route.rest.length === 1) {\n          if (route.rest[0] === \"acs\") {\n            return await deps.handleSamlAcs(ctx, request, route);\n          }\n          if (route.rest[0] === \"slo\") {\n            return await deps.handleSamlSlo(ctx, request, route);\n          }\n        }\n        if (route?.protocol === \"scim\" && route.rest[0] === \"v2\") {\n          return await deps.handleScimRequest(ctx, request);\n        }\n        throw Cv.error({\n          code: \"INVALID_PARAMETERS\",\n          message: \"Invalid enterprise runtime path.\",\n        });\n      }),\n    ),\n  });\n\n  http.route({\n    pathPrefix: routePrefix,\n    method: \"PUT\",\n    handler: httpActionGeneric(\n      deps.convertErrorsToResponse(400, async (ctx, request) => {\n        const route = parseEnterpriseRuntimeRoute(\n          new URL(request.url).pathname,\n          deps.routeBase,\n        );\n        if (route?.protocol === \"scim\" && route.rest[0] === \"v2\") {\n          return await deps.handleScimRequest(ctx, request);\n        }\n        throw Cv.error({\n          code: \"INVALID_PARAMETERS\",\n          message: \"Invalid enterprise runtime path.\",\n        });\n      }),\n    ),\n  });\n\n  for (const method of [\"PATCH\", \"DELETE\"] as const) {\n    http.route({\n      pathPrefix: routePrefix,\n      method,\n      handler: httpActionGeneric(async (ctx, request) => {\n        const route = parseEnterpriseRuntimeRoute(\n          new URL(request.url).pathname,\n          deps.routeBase,\n        );\n        if (!route || route.protocol !== \"scim\" || route.rest[0] !== \"v2\") {\n          return deps.scimError(404, \"notFound\", \"SCIM resource not found.\");\n        }\n        return await deps.handleScimRequest(ctx, request);\n      }),\n    });\n  }\n}\n"],"mappings":";;;;;;;;;AA0JA,SAAS,yBAAyB;AAChC,QAAO,GAAG,MAAM;EACd,MAAM;EACN,SAAS;EACV,CAAC;;AAGJ,eAAe,kBACb,MACA,KACA,SACiC;CACjC,MAAM,aAAa,QAAQ,QAAQ,IAAI,gBAAgB;AACvD,KAAI,CAAC,YAAY,WAAW,aAAa,CACvC,QAAO;AAGT,KAAI;EACF,MAAM,WAAW,MAAM,KAAK,IAAI,OAAO,KAAK,WAAW,MAAM,EAAE,CAAC;AAEhE,SAAO;GACL,GAFkB,MAAM,sBAAsB,MAAM,KAAK,SAAS,OAAO;GAGzE,QAAQ;GACR,KAAK;IACH,QAAQ,SAAS;IACjB,OAAO,SAAS;IAChB,QAAQ,SAAS;IAClB;GACF;SACK;AACN,SAAO;;;AAIX,eAAe,uBACb,MACA,KACA,SACiC;CACjC,MAAM,gBAAgB,MAAM,iBAAiB,IAAI;AACjD,KAAI,kBAAkB,KAEpB,QAAO;EACL,GAFkB,MAAM,sBAAsB,MAAM,KAAK,cAAc;EAGvE,QAAQ;EACR,KAAK;EACN;AAGH,QAAO,MAAM,kBAAkB,MAAM,KAAK,QAAQ;;;;;;AAOpD,SAAgB,kBAAkB,MAWhC;AACA,SAAQ,OACN,KACA,SACA,WACG;EACH,MAAM,iBAAiB,uBAAuB,MAAM,KAAK,QAAQ;EACjE,MAAM,eAAe,QAAQ,cACzB,MAAM,OAAO,YAAY,KAAK,SAAS,GACvC;EACJ,MAAM,WACJ,iBAAiB,SAAY,MAAM,UAAU,GAAG;AAElD,MAAI,aAAa,MAAM;AACrB,OAAI,QAAQ,aAAa,KACvB,OAAM,wBAAwB;AAEhC,UAAO;IACL,GAAG,kCAAkC;IACrC,QAAQ;IACR,KAAK;IACN;;EAGH,MAAM,QAAQ,QAAQ,UAClB,MAAM,OAAO,QAAQ,KAAK,SAAS,MAAM,SAAS,GAClD,EAAE;AAEN,SAAO;GACL,GAAG;GACH,GAAG;GACJ;;;AAeL,SAAgB,iBAAiB,MAE9B;AACD,SACE,SAIA,YAIG;EACH,MAAM,aAAa,SAAS,QAAQ,EAAE;EACtC,MAAM,cAAsC;GAC1C,+BAA+B,WAAW,UAAU;GACpD,gCACE,WAAW,WAAW;GACxB,gCACE,WAAW,WAAW;GACzB;AAED,SAAO,kBAAkB,OAAO,YAAY,YAAY;AACtD,UAAO,GAAG,IACR,GAAG,KAAK;IACN,IAAI,YAAY;KACd,MAAM,aAAa,QAAQ,QAAQ,IAAI,gBAAgB;AACvD,SAAI,CAAC,YAAY,WAAW,UAAU,CACpC,QAAO,IAAI,SACT,KAAK,UAAU;MACb,OAAO;MACP,MAAM;MACP,CAAC,EACF;MACE,QAAQ;MACR,SAAS;OACP,GAAG;OACH,gBAAgB;OACjB;MACF,CACF;KAEH,MAAM,SAAS,WAAW,MAAM,EAAE;KAElC,MAAM,YAAY,MAAM,GAAG,IACzB,GAAG,cACK,KAAK,IAAI,OAAO,YAAY,OAAO,GACxC,cAAY;MAAE,IAAI;MAAM,OAAOA;MAAQ,IACvC,WAAW;MAAE,IAAI;MAAO;MAAO,EACjC,CACF;AAED,SAAI,CAAC,UAAU,IAAI;AACjB,UACE,UAAU,iBAAiB,eAC3B,OAAO,UAAU,MAAM,SAAS,YAChC,UAAU,MAAM,SAAS,QACzB,UAAU,UAAU,MAAM,QAC1B,aAAa,UAAU,MAAM,MAC7B;OACA,MAAM,EAAE,MAAM,YAAY,UAAU,MAAM;AAI1C,cAAO,IAAI,SAAS,KAAK,UAAU;QAAE,OAAO;QAAS;QAAM,CAAC,EAAE;QAC5D,QAAQ;QACR,SAAS;SACP,GAAG;SACH,gBAAgB;SACjB;QACF,CAAC;;AAEJ,YAAM,UAAU;;AAGlB,SACE,SAAS,SACT,CAAC,UAAU,MAAM,OAAO,IACtB,QAAQ,MAAM,UACd,QAAQ,MAAM,OACf,CAED,QAAO,IAAI,SACT,KAAK,UAAU;MACb,OAAO;MACP,MAAM;MACP,CAAC,EACF;MACE,QAAQ;MACR,SAAS;OACP,GAAG;OACH,gBAAgB;OACjB;MACF,CACF;KAUH,MAAM,SAAS,MAAM,QAPD,OAAO,OAAO,YAAY,EAC5C,KAAK;MACH,QAAQ,UAAU,MAAM;MACxB,OAAO,UAAU,MAAM;MACvB,QAAQ,UAAU,MAAM;MACzB,EACF,CAAC,EACwC,QAAQ;AAElD,SAAI,kBAAkB,UAAU;MAC9B,MAAM,UAAU,IAAI,QAAQ,OAAO,QAAQ;AAC3C,WAAK,MAAM,CAAC,GAAG,QAAQ,OAAO,QAAQ,YAAY,CAChD,KAAI,CAAC,QAAQ,IAAI,EAAE,CAAE,SAAQ,IAAI,GAAG,IAAI;AAE1C,aAAO,IAAI,SAAS,OAAO,MAAM;OAC/B,QAAQ,OAAO;OACf,YAAY,OAAO;OACnB;OACD,CAAC;;AAGJ,YAAO,IAAI,SAAS,KAAK,UAAU,OAAO,EAAE;MAC1C,QAAQ;MACR,SAAS;OACP,GAAG;OACH,gBAAgB;OACjB;MACF,CAAC;;IAEJ,MAAM,UAAU;IACjB,CAAC,CAAC,KACD,GAAG,SAAS,UAAU;AACpB,aAAS,MAAM;AACf,WAAO,GAAG,QACR,IAAI,SACF,KAAK,UAAU;KACb,OAAO;KACP,MAAM;KACP,CAAC,EACF;KACE,QAAQ;KACR,SAAS;MACP,GAAG;MACH,gBAAgB;MACjB;KACF,CACF,CACF;KACD,CACH,CACF;IACD;;;AAIN,SAAgB,gBACd,YACA;AACA,SACE,MACA,gBAUG;EACH,MAAM,aAAa,YAAY,QAAQ,EAAE;EACzC,MAAM,cAAsC;GAC1C,+BAA+B,WAAW,UAAU;GACpD,gCACE,WAAW,WAAW;GACxB,gCACE,WAAW,WAAW;GACzB;AAED,OAAK,MAAM;GACT,MAAM,YAAY;GAClB,QAAQ;GACR,SAAS,kBAAkB,YAAY;AACrC,WAAO,IAAI,SAAS,MAAM;KAAE,QAAQ;KAAK,SAAS;KAAa,CAAC;KAChE;GACH,CAAC;AAEF,OAAK,MAAM;GACT,MAAM,YAAY;GAClB,QAAQ,YAAY;GACpB,SAAS,WAAW,YAAY,SAAS;IACvC,OAAO,YAAY;IACnB,MAAM,YAAY;IACnB,CAAC;GACH,CAAC;;;AAIN,SAAgB,wBACd,iBACA,QACA;AACA,QAAO,OAAO,KAA4B,YAAqB;AAC7D,SAAO,GAAG,IACR,GAAG,KAAK;GACN,UAAU,OAAO,KAAK,QAAQ;GAC9B,MAAM,UAAU;GACjB,CAAC,CAAC,KACD,GAAG,SAAS,UAAU;AACpB,OACE,iBAAiB,eACjB,OAAO,MAAM,SAAS,YACtB,MAAM,SAAS,QACf,UAAU,MAAM,QAChB,aAAa,MAAM,KAEnB,QAAO,GAAG,QACR,IAAI,SACF,KAAK,UAAU;IACb,MAAM,MAAM,KAAK;IACjB,SAAS,MAAM,KAAK;IACrB,CAAC,EACF;IACE,QAAQ;IACR,SAAS,EAAE,gBAAgB,oBAAoB;IAChD,CACF,CACF;YACQ,iBAAiB,YAC1B,QAAO,GAAG,QACR,IAAI,SAAS,MAAM;IACjB,QAAQ;IACR,YACE,OAAO,MAAM,SAAS,WAAW,MAAM,OAAO;IACjD,CAAC,CACH;QACI;AACL,aAAS,MAAM;AACf,WAAO,GAAG,QACR,IAAI,SAAS,MAAM;KACjB,QAAQ;KACR,YAAY;KACb,CAAC,CACH;;IAEH,CACH,CACF;;;AAIL,SAAgB,WACd,SACoC;AACpC,QAAOC,MAAa,QAAQ,QAAQ,IAAI,SAAS,IAAI,GAAG;;AAU1D,SAAS,4BACP,UACA,WACwB;CACxB,MAAM,gBAAgB,GAAG,UAAU;CAInC,MAAM,CAAC,qBAAqB,UAAU,GAAG,QAHpB,SAAS,WAAW,cAAc,GACnD,SAAS,MAAM,cAAc,OAAO,CAAC,MAAM,IAAI,CAAC,OAAO,QAAQ,GAC/D,EAAE;AAEN,KACE,wBAAwB,UACvB,aAAa,UAAU,aAAa,UAAU,aAAa,UAC5D,KAAK,WAAW,EAEhB,QAAO;AAET,QAAO;EACL;EACA,cAAc;EACd;EACA;EACD;;AAGH,SAAgB,gBACd,MACA,MAIA;CACA,MAAM,eACJ;AAEF,MAAK,MAAM;EACT,MAAM;EACN,QAAQ;EACR,SAAS,kBAAkB,YAAY;GACrC,MAAM,SAAS,KAAK,WAAW;AAC/B,UAAO,IAAI,SACT,KAAK,UAAU;IACb;IACA,UAAU,GAAG,OAAO;IACrB,CAAC,EACF;IACE,QAAQ;IACR,SAAS;KACP,gBAAgB;KAChB,iBAAiB;KAClB;IACF,CACF;IACD;EACH,CAAC;AAEF,MAAK,MAAM;EACT,MAAM;EACN,QAAQ;EACR,SAAS,kBAAkB,YAAY;AACrC,UAAO,IAAI,SAAS,KAAK,SAAS,EAAE;IAClC,QAAQ;IACR,SAAS;KACP,gBAAgB;KAChB,iBAAiB;KAClB;IACF,CAAC;IACF;EACH,CAAC;;AAGJ,SAAgB,cACd,MACA,MAUA;AACA,MAAK,MAAM;EACT,YAAY;EACZ,QAAQ;EACR,SAAS,kBAAkB,KAAK,aAAa;EAC9C,CAAC;CAEF,MAAM,kBAAkB,kBAAkB,KAAK,eAAe;AAE9D,MAAK,MAAM;EACT,YAAY;EACZ,QAAQ;EACR,SAAS;EACV,CAAC;AAEF,MAAK,MAAM;EACT,YAAY;EACZ,QAAQ;EACR,SAAS;EACV,CAAC;;AAGJ,SAAgB,aACd,MACA,MAuCA;CACA,MAAM,cAAc,GAAG,KAAK,UAAU;AAEtC,MAAK,MAAM;EACT,YAAY;EACZ,QAAQ;EACR,SAAS,kBACP,KAAK,wBAAwB,KAAK,OAAO,KAAK,YAAY;GACxD,MAAM,QAAQ,4BACZ,IAAI,IAAI,QAAQ,IAAI,CAAC,UACrB,KAAK,UACN;AACD,OAAI,CAAC,MACH,OAAM,GAAG,MAAM;IACb,MAAM;IACN,SAAS;IACV,CAAC;AAEJ,OAAI,MAAM,aAAa,UAAU,MAAM,KAAK,WAAW,GAAG;AACxD,QAAI,MAAM,KAAK,OAAO,WACpB,QAAO,MAAM,KAAK,mBAAmB,KAAK,SAAS,MAAM;AAE3D,QAAI,MAAM,KAAK,OAAO,SACpB,QAAO,MAAM,KAAK,iBAAiB,KAAK,SAAS,MAAM;AAEzD,QAAI,MAAM,KAAK,OAAO,MACpB,QAAO,MAAM,KAAK,cAAc,KAAK,SAAS,MAAM;AAEtD,QAAI,MAAM,KAAK,OAAO,MACpB,QAAO,MAAM,KAAK,cAAc,KAAK,SAAS,MAAM;;AAGxD,OAAI,MAAM,aAAa,UAAU,MAAM,KAAK,WAAW,GAAG;AACxD,QAAI,MAAM,KAAK,OAAO,SACpB,QAAO,MAAM,KAAK,iBAAiB,KAAK,SAAS,MAAM;AAEzD,QAAI,MAAM,KAAK,OAAO,WACpB,QAAO,MAAM,KAAK,mBAAmB,KAAK,SAAS,MAAM;;AAG7D,OAAI,MAAM,aAAa,UAAU,MAAM,KAAK,OAAO,KACjD,QAAO,MAAM,KAAK,kBAAkB,KAAK,QAAQ;AAEnD,SAAM,GAAG,MAAM;IACb,MAAM;IACN,SAAS;IACV,CAAC;IACF,CACH;EACF,CAAC;AAEF,MAAK,MAAM;EACT,YAAY;EACZ,QAAQ;EACR,SAAS,kBACP,KAAK,wBAAwB,KAAK,OAAO,KAAK,YAAY;GACxD,MAAM,QAAQ,4BACZ,IAAI,IAAI,QAAQ,IAAI,CAAC,UACrB,KAAK,UACN;AACD,OAAI,OAAO,aAAa,UAAU,MAAM,KAAK,WAAW,GAAG;AACzD,QAAI,MAAM,KAAK,OAAO,MACpB,QAAO,MAAM,KAAK,cAAc,KAAK,SAAS,MAAM;AAEtD,QAAI,MAAM,KAAK,OAAO,MACpB,QAAO,MAAM,KAAK,cAAc,KAAK,SAAS,MAAM;;AAGxD,OAAI,OAAO,aAAa,UAAU,MAAM,KAAK,OAAO,KAClD,QAAO,MAAM,KAAK,kBAAkB,KAAK,QAAQ;AAEnD,SAAM,GAAG,MAAM;IACb,MAAM;IACN,SAAS;IACV,CAAC;IACF,CACH;EACF,CAAC;AAEF,MAAK,MAAM;EACT,YAAY;EACZ,QAAQ;EACR,SAAS,kBACP,KAAK,wBAAwB,KAAK,OAAO,KAAK,YAAY;GACxD,MAAM,QAAQ,4BACZ,IAAI,IAAI,QAAQ,IAAI,CAAC,UACrB,KAAK,UACN;AACD,OAAI,OAAO,aAAa,UAAU,MAAM,KAAK,OAAO,KAClD,QAAO,MAAM,KAAK,kBAAkB,KAAK,QAAQ;AAEnD,SAAM,GAAG,MAAM;IACb,MAAM;IACN,SAAS;IACV,CAAC;IACF,CACH;EACF,CAAC;AAEF,MAAK,MAAM,UAAU,CAAC,SAAS,SAAS,CACtC,MAAK,MAAM;EACT,YAAY;EACZ;EACA,SAAS,kBAAkB,OAAO,KAAK,YAAY;GACjD,MAAM,QAAQ,4BACZ,IAAI,IAAI,QAAQ,IAAI,CAAC,UACrB,KAAK,UACN;AACD,OAAI,CAAC,SAAS,MAAM,aAAa,UAAU,MAAM,KAAK,OAAO,KAC3D,QAAO,KAAK,UAAU,KAAK,YAAY,2BAA2B;AAEpE,UAAO,MAAM,KAAK,kBAAkB,KAAK,QAAQ;IACjD;EACH,CAAC"}

package/dist/server/identity.js

@@ -1,10 +1,13 @@
-import { AuthError } from "./authError.js";
+import { Cv } from "@robelest/fx/convex";
 
 //#region src/server/identity.ts
 /** @internal */
 function userIdFromIdentitySubject(subject) {
 	const [userId, ...rest] = subject.split("|");
-	if (typeof userId !== "string" || userId.length === 0 || rest.length === 0 || rest.some((segment) => segment.length === 0)) throw new AuthError("INTERNAL_ERROR", "Authenticated identity subject is malformed.");
+	if (typeof userId !== "string" || userId.length === 0 || rest.length === 0 || rest.some((segment) => segment.length === 0)) throw Cv.error({
+		code: "INTERNAL_ERROR",
+		message: "Authenticated identity subject is malformed."
+	});
 	return userId;
 }
 

package/dist/server/identity.js.map

@@ -1 +1 @@
-{"version":3,"file":"identity.js","names":[],"sources":["../../src/server/identity.ts"],"sourcesContent":["import { AuthError } from \"./authError\";\n\n/** @internal */\nexport function userIdFromIdentitySubject(subject: string): string {\n  const [userId, ...rest] = subject.split(\"|\");\n  if (\n    typeof userId !== \"string\" ||\n    userId.length === 0 ||\n    rest.length === 0 ||\n    rest.some((segment) => segment.length === 0)\n  ) {\n    throw new AuthError(\n      \"INTERNAL_ERROR\",\n      \"Authenticated identity subject is malformed.\",\n    );\n  }\n  return userId;\n}\n"],"mappings":";;;;AAGA,SAAgB,0BAA0B,SAAyB;CACjE,MAAM,CAAC,QAAQ,GAAG,QAAQ,QAAQ,MAAM,IAAI;AAC5C,KACE,OAAO,WAAW,YAClB,OAAO,WAAW,KAClB,KAAK,WAAW,KAChB,KAAK,MAAM,YAAY,QAAQ,WAAW,EAAE,CAE5C,OAAM,IAAI,UACR,kBACA,+CACD;AAEH,QAAO"}
+{"version":3,"file":"identity.js","names":[],"sources":["../../src/server/identity.ts"],"sourcesContent":["import { Cv } from \"@robelest/fx/convex\";\n\n/** @internal */\nexport function userIdFromIdentitySubject(subject: string): string {\n  const [userId, ...rest] = subject.split(\"|\");\n  if (\n    typeof userId !== \"string\" ||\n    userId.length === 0 ||\n    rest.length === 0 ||\n    rest.some((segment) => segment.length === 0)\n  ) {\n    throw Cv.error({\n      code: \"INTERNAL_ERROR\",\n      message: \"Authenticated identity subject is malformed.\",\n    });\n  }\n  return userId;\n}\n"],"mappings":";;;;AAGA,SAAgB,0BAA0B,SAAyB;CACjE,MAAM,CAAC,QAAQ,GAAG,QAAQ,QAAQ,MAAM,IAAI;AAC5C,KACE,OAAO,WAAW,YAClB,OAAO,WAAW,KAClB,KAAK,WAAW,KAChB,KAAK,MAAM,YAAY,QAAQ,WAAW,EAAE,CAE5C,OAAM,GAAG,MAAM;EACb,MAAM;EACN,SAAS;EACV,CAAC;AAEJ,QAAO"}

package/dist/server/index.d.ts

@@ -1,4 +1,5 @@
-import { AuthApi, AuthApiBase, AuthConfig, AuthCtx, AuthCtxConfig, AuthResolvedContext, ConvexAuthResult, InferAuth, InferClientApi, UserDoc, createAuth } from "./auth.js";
+import { AuthApi, AuthApiBase, AuthConfig, AuthContext, AuthContextConfig, ConvexAuthResult, InferAuth, InferClientApi, OptionalAuthContext, UserDoc, createAuth } from "./auth.js";
+import { HttpAuthContext, HttpAuthContextConfig, OptionalHttpAuthContext } from "./http.js";
 import { EnterpriseAdminAuthorizationInput, EnterpriseAdminPermission, EnterpriseAuthorizer, EnterpriseMountOptions, enterprise, scim, sso } from "./mounts.js";
 import { AuthCookie, AuthCookieConfig, AuthCookies, RefreshResult, ServerOptions, authCookieNames, parseAuthCookies, serializeAuthCookies, server, shouldProxyAuthAction, structuredAuthCookies } from "./ssr.js";
-export { type AuthApi, type AuthApiBase, type AuthConfig, type AuthCookie, type AuthCookieConfig, type AuthCookies, AuthCtx, type AuthCtxConfig, type AuthResolvedContext, type ConvexAuthResult, type EnterpriseAdminAuthorizationInput, type EnterpriseAdminPermission, type EnterpriseAuthorizer, type EnterpriseMountOptions, type InferAuth, type InferClientApi, type RefreshResult, type ServerOptions, type UserDoc, authCookieNames, createAuth, enterprise, parseAuthCookies, scim, serializeAuthCookies, server, shouldProxyAuthAction, sso, structuredAuthCookies };
+export { type AuthApi, type AuthApiBase, type AuthConfig, type AuthContext, type AuthContextConfig, type AuthCookie, type AuthCookieConfig, type AuthCookies, type ConvexAuthResult, type EnterpriseAdminAuthorizationInput, type EnterpriseAdminPermission, type EnterpriseAuthorizer, type EnterpriseMountOptions, type HttpAuthContext, type HttpAuthContextConfig, type InferAuth, type InferClientApi, type OptionalAuthContext, type OptionalHttpAuthContext, type RefreshResult, type ServerOptions, type UserDoc, authCookieNames, createAuth, enterprise, parseAuthCookies, scim, serializeAuthCookies, server, shouldProxyAuthAction, sso, structuredAuthCookies };

package/dist/server/index.js

@@ -1,5 +1,5 @@
-import { AuthCtx, createAuth } from "./auth.js";
+import { createAuth } from "./auth.js";
 import { enterprise, scim, sso } from "./mounts.js";
 import { authCookieNames, parseAuthCookies, serializeAuthCookies, server, shouldProxyAuthAction, structuredAuthCookies } from "./ssr.js";
 
-export { AuthCtx, authCookieNames, createAuth, enterprise, parseAuthCookies, scim, serializeAuthCookies, server, shouldProxyAuthAction, sso, structuredAuthCookies };
+export { authCookieNames, createAuth, enterprise, parseAuthCookies, scim, serializeAuthCookies, server, shouldProxyAuthAction, sso, structuredAuthCookies };

package/dist/server/limits.js

@@ -1,5 +1,3 @@
-import { AuthError } from "./authError.js";
-import { errorMessage } from "./utils.js";
 import { authDb } from "./db.js";
 import { Fx } from "@robelest/fx";
 
@@ -16,45 +14,38 @@ const isSignInRateLimited = (ctx, identifier, config) => getRateLimitState(ctx,
 * If a record exists, decrement; otherwise create.
 */
 /** @internal */
-const recordFailedSignIn = (ctx, identifier, config) => getRateLimitState(ctx, identifier, config).pipe(Fx.chain((state) => state !== null ? Fx.from({
-	ok: () => authDb(ctx, config).rateLimits.patch(state.limit._id, {
+const recordFailedSignIn = (ctx, identifier, config) => Fx.gen(function* () {
+	const state = yield* getRateLimitState(ctx, identifier, config);
+	if (state !== null) yield* Fx.promise(() => authDb(ctx, config).rateLimits.patch(state.limit._id, {
 		attemptsLeft: state.attemptsLeft - 1,
 		lastAttemptTime: Date.now()
-	}),
-	err: (e) => new AuthError("INTERNAL_ERROR", `Failed to patch rate limit: ${errorMessage(e)}`)
-}) : Fx.from({
-	ok: () => authDb(ctx, config).rateLimits.create({
+	}));
+	else yield* Fx.promise(() => authDb(ctx, config).rateLimits.create({
 		identifier,
 		attemptsLeft: (config.signIn?.maxFailedAttemptsPerHour ?? DEFAULT_MAX_SIGN_IN_ATTEMPTS_PER_HOUR) - 1,
 		lastAttemptTime: Date.now()
-	}),
-	err: (e) => new AuthError("INTERNAL_ERROR", `Failed to create rate limit: ${errorMessage(e)}`)
-})), Fx.map(() => void 0));
+	}));
+});
 /**
 * Reset the rate limit for the given identifier (e.g. after successful sign-in).
 */
 /** @internal */
-const resetSignInRateLimit = (ctx, identifier, config) => getRateLimitState(ctx, identifier, config).pipe(Fx.chain((state) => state !== null ? Fx.from({
-	ok: () => authDb(ctx, config).rateLimits.delete(state.limit._id),
-	err: (e) => new AuthError("INTERNAL_ERROR", `Failed to delete rate limit: ${errorMessage(e)}`)
-}) : Fx.unit));
-const getRateLimitState = (ctx, identifier, config) => {
+const resetSignInRateLimit = (ctx, identifier, config) => Fx.gen(function* () {
+	const state = yield* getRateLimitState(ctx, identifier, config);
+	if (state !== null) yield* Fx.promise(() => authDb(ctx, config).rateLimits.delete(state.limit._id));
+});
+const getRateLimitState = (ctx, identifier, config) => Fx.gen(function* () {
 	const now = Date.now();
 	const maxAttemptsPerHour = config.signIn?.maxFailedAttemptsPerHour ?? DEFAULT_MAX_SIGN_IN_ATTEMPTS_PER_HOUR;
-	return Fx.from({
-		ok: () => authDb(ctx, config).rateLimits.get(identifier),
-		err: (e) => new AuthError("INTERNAL_ERROR", `Failed to get rate limit: ${errorMessage(e)}`)
-	}).pipe(Fx.map((raw) => {
-		const limit = raw;
-		if (limit === null) return null;
-		const elapsed = now - limit.lastAttemptTime;
-		const maxAttemptsPerMs = maxAttemptsPerHour / (3600 * 1e3);
-		return {
-			limit,
-			attemptsLeft: Math.min(maxAttemptsPerHour, limit.attemptsLeft + elapsed * maxAttemptsPerMs)
-		};
-	}));
-};
+	const limit = yield* Fx.promise(() => authDb(ctx, config).rateLimits.get(identifier));
+	if (limit === null) return null;
+	const elapsed = now - limit.lastAttemptTime;
+	const maxAttemptsPerMs = maxAttemptsPerHour / (3600 * 1e3);
+	return {
+		limit,
+		attemptsLeft: Math.min(maxAttemptsPerHour, limit.attemptsLeft + elapsed * maxAttemptsPerMs)
+	};
+});
 
 //#endregion
 export { isSignInRateLimited, recordFailedSignIn, resetSignInRateLimit };

package/dist/server/limits.js.map

@@ -1 +1 @@
-{"version":3,"file":"limits.js","names":[],"sources":["../../src/server/limits.ts"],"sourcesContent":["import { Fx } from \"@robelest/fx\";\n\nimport { authDb } from \"./db\";\nimport { AuthError } from \"./authError\";\nimport { Doc, MutationCtx } from \"./types\";\nimport { ConvexAuthConfig } from \"./types\";\nimport { errorMessage } from \"./utils\";\n\nconst DEFAULT_MAX_SIGN_IN_ATTEMPTS_PER_HOUR = 10;\n\n/**\n * Check whether the given identifier is currently rate-limited.\n */\n/** @internal */\nexport const isSignInRateLimited = (\n  ctx: MutationCtx,\n  identifier: string,\n  config: ConvexAuthConfig,\n): Fx<boolean, AuthError> =>\n  getRateLimitState(ctx, identifier, config).pipe(\n    Fx.map((state) => state !== null && state.attemptsLeft < 1),\n  );\n\n/**\n * Record a failed sign-in attempt for the given identifier.\n *\n * If a record exists, decrement; otherwise create.\n */\n/** @internal */\nexport const recordFailedSignIn = (\n  ctx: MutationCtx,\n  identifier: string,\n  config: ConvexAuthConfig,\n): Fx<void, AuthError> =>\n  getRateLimitState(ctx, identifier, config).pipe(\n    Fx.chain((state) =>\n      state !== null\n        ? Fx.from({\n            ok: () =>\n              authDb(ctx, config).rateLimits.patch(state.limit._id, {\n                attemptsLeft: state.attemptsLeft - 1,\n                lastAttemptTime: Date.now(),\n              }),\n            err: (e) =>\n              new AuthError(\n                \"INTERNAL_ERROR\",\n                `Failed to patch rate limit: ${errorMessage(e)}`,\n              ),\n          })\n        : Fx.from({\n            ok: () =>\n              authDb(ctx, config).rateLimits.create({\n                identifier,\n                attemptsLeft:\n                  (config.signIn?.maxFailedAttemptsPerHour ??\n                    DEFAULT_MAX_SIGN_IN_ATTEMPTS_PER_HOUR) - 1,\n                lastAttemptTime: Date.now(),\n              }),\n            err: (e) =>\n              new AuthError(\n                \"INTERNAL_ERROR\",\n                `Failed to create rate limit: ${errorMessage(e)}`,\n              ),\n          }),\n    ),\n    Fx.map(() => undefined),\n  );\n\n/**\n * Reset the rate limit for the given identifier (e.g. after successful sign-in).\n */\n/** @internal */\nexport const resetSignInRateLimit = (\n  ctx: MutationCtx,\n  identifier: string,\n  config: ConvexAuthConfig,\n): Fx<void, AuthError> =>\n  getRateLimitState(ctx, identifier, config).pipe(\n    Fx.chain((state) =>\n      state !== null\n        ? Fx.from({\n            ok: () => authDb(ctx, config).rateLimits.delete(state.limit._id),\n            err: (e) =>\n              new AuthError(\n                \"INTERNAL_ERROR\",\n                `Failed to delete rate limit: ${errorMessage(e)}`,\n              ),\n          })\n        : Fx.unit,\n    ),\n  );\n\n// ---------------------------------------------------------------------------\n// Internal\n// ---------------------------------------------------------------------------\n\ntype RateLimitState = {\n  limit: Doc<\"RateLimit\"> & { attemptsLeft: number; lastAttemptTime: number };\n  attemptsLeft: number;\n} | null;\n\nconst getRateLimitState = (\n  ctx: MutationCtx,\n  identifier: string,\n  config: ConvexAuthConfig,\n): Fx<RateLimitState, AuthError> => {\n  const now = Date.now();\n  const maxAttemptsPerHour =\n    config.signIn?.maxFailedAttemptsPerHour ??\n    DEFAULT_MAX_SIGN_IN_ATTEMPTS_PER_HOUR;\n\n  return Fx.from({\n    ok: () => authDb(ctx, config).rateLimits.get(identifier),\n    err: (e) =>\n      new AuthError(\n        \"INTERNAL_ERROR\",\n        `Failed to get rate limit: ${errorMessage(e)}`,\n      ),\n  }).pipe(\n    Fx.map((raw) => {\n      const limit = raw as\n        | (Doc<\"RateLimit\"> & { attemptsLeft: number; lastAttemptTime: number })\n        | null;\n      if (limit === null) return null;\n      const elapsed = now - limit.lastAttemptTime;\n      const maxAttemptsPerMs = maxAttemptsPerHour / (60 * 60 * 1000);\n      const attemptsLeft = Math.min(\n        maxAttemptsPerHour,\n        limit.attemptsLeft + elapsed * maxAttemptsPerMs,\n      );\n      return { limit, attemptsLeft };\n    }),\n  );\n};\n"],"mappings":";;;;;;AAQA,MAAM,wCAAwC;;;;;AAM9C,MAAa,uBACX,KACA,YACA,WAEA,kBAAkB,KAAK,YAAY,OAAO,CAAC,KACzC,GAAG,KAAK,UAAU,UAAU,QAAQ,MAAM,eAAe,EAAE,CAC5D;;;;;;;AAQH,MAAa,sBACX,KACA,YACA,WAEA,kBAAkB,KAAK,YAAY,OAAO,CAAC,KACzC,GAAG,OAAO,UACR,UAAU,OACN,GAAG,KAAK;CACN,UACE,OAAO,KAAK,OAAO,CAAC,WAAW,MAAM,MAAM,MAAM,KAAK;EACpD,cAAc,MAAM,eAAe;EACnC,iBAAiB,KAAK,KAAK;EAC5B,CAAC;CACJ,MAAM,MACJ,IAAI,UACF,kBACA,+BAA+B,aAAa,EAAE,GAC/C;CACJ,CAAC,GACF,GAAG,KAAK;CACN,UACE,OAAO,KAAK,OAAO,CAAC,WAAW,OAAO;EACpC;EACA,eACG,OAAO,QAAQ,4BACd,yCAAyC;EAC7C,iBAAiB,KAAK,KAAK;EAC5B,CAAC;CACJ,MAAM,MACJ,IAAI,UACF,kBACA,gCAAgC,aAAa,EAAE,GAChD;CACJ,CAAC,CACP,EACD,GAAG,UAAU,OAAU,CACxB;;;;;AAMH,MAAa,wBACX,KACA,YACA,WAEA,kBAAkB,KAAK,YAAY,OAAO,CAAC,KACzC,GAAG,OAAO,UACR,UAAU,OACN,GAAG,KAAK;CACN,UAAU,OAAO,KAAK,OAAO,CAAC,WAAW,OAAO,MAAM,MAAM,IAAI;CAChE,MAAM,MACJ,IAAI,UACF,kBACA,gCAAgC,aAAa,EAAE,GAChD;CACJ,CAAC,GACF,GAAG,KACR,CACF;AAWH,MAAM,qBACJ,KACA,YACA,WACkC;CAClC,MAAM,MAAM,KAAK,KAAK;CACtB,MAAM,qBACJ,OAAO,QAAQ,4BACf;AAEF,QAAO,GAAG,KAAK;EACb,UAAU,OAAO,KAAK,OAAO,CAAC,WAAW,IAAI,WAAW;EACxD,MAAM,MACJ,IAAI,UACF,kBACA,6BAA6B,aAAa,EAAE,GAC7C;EACJ,CAAC,CAAC,KACD,GAAG,KAAK,QAAQ;EACd,MAAM,QAAQ;AAGd,MAAI,UAAU,KAAM,QAAO;EAC3B,MAAM,UAAU,MAAM,MAAM;EAC5B,MAAM,mBAAmB,sBAAsB,OAAU;AAKzD,SAAO;GAAE;GAAO,cAJK,KAAK,IACxB,oBACA,MAAM,eAAe,UAAU,iBAChC;GAC6B;GAC9B,CACH"}
+{"version":3,"file":"limits.js","names":[],"sources":["../../src/server/limits.ts"],"sourcesContent":["import { Fx } from \"@robelest/fx\";\nimport { ConvexError } from \"convex/values\";\n\nimport { authDb } from \"./db\";\nimport { Doc, MutationCtx } from \"./types\";\nimport { ConvexAuthConfig } from \"./types\";\n\nconst DEFAULT_MAX_SIGN_IN_ATTEMPTS_PER_HOUR = 10;\n\n/**\n * Check whether the given identifier is currently rate-limited.\n */\n/** @internal */\nexport const isSignInRateLimited = (\n  ctx: MutationCtx,\n  identifier: string,\n  config: ConvexAuthConfig,\n): Fx<boolean, ConvexError<any>> =>\n  getRateLimitState(ctx, identifier, config).pipe(\n    Fx.map((state) => state !== null && state.attemptsLeft < 1),\n  );\n\n/**\n * Record a failed sign-in attempt for the given identifier.\n *\n * If a record exists, decrement; otherwise create.\n */\n/** @internal */\nexport const recordFailedSignIn = (\n  ctx: MutationCtx,\n  identifier: string,\n  config: ConvexAuthConfig,\n): Fx<void, ConvexError<any>> =>\n  Fx.gen(function* () {\n    const state = yield* getRateLimitState(ctx, identifier, config);\n    if (state !== null) {\n      yield* Fx.promise(() =>\n        authDb(ctx, config).rateLimits.patch(state.limit._id, {\n          attemptsLeft: state.attemptsLeft - 1,\n          lastAttemptTime: Date.now(),\n        }),\n      );\n    } else {\n      yield* Fx.promise(() =>\n        authDb(ctx, config).rateLimits.create({\n          identifier,\n          attemptsLeft:\n            (config.signIn?.maxFailedAttemptsPerHour ??\n              DEFAULT_MAX_SIGN_IN_ATTEMPTS_PER_HOUR) - 1,\n          lastAttemptTime: Date.now(),\n        }),\n      );\n    }\n  });\n\n/**\n * Reset the rate limit for the given identifier (e.g. after successful sign-in).\n */\n/** @internal */\nexport const resetSignInRateLimit = (\n  ctx: MutationCtx,\n  identifier: string,\n  config: ConvexAuthConfig,\n): Fx<void, ConvexError<any>> =>\n  Fx.gen(function* () {\n    const state = yield* getRateLimitState(ctx, identifier, config);\n    if (state !== null) {\n      yield* Fx.promise(() =>\n        authDb(ctx, config).rateLimits.delete(state.limit._id),\n      );\n    }\n  });\n\n// ---------------------------------------------------------------------------\n// Internal\n// ---------------------------------------------------------------------------\n\ntype RateLimitState = {\n  limit: Doc<\"RateLimit\"> & { attemptsLeft: number; lastAttemptTime: number };\n  attemptsLeft: number;\n} | null;\n\nconst getRateLimitState = (\n  ctx: MutationCtx,\n  identifier: string,\n  config: ConvexAuthConfig,\n): Fx<RateLimitState, ConvexError<any>> =>\n  Fx.gen(function* () {\n    const now = Date.now();\n    const maxAttemptsPerHour =\n      config.signIn?.maxFailedAttemptsPerHour ??\n      DEFAULT_MAX_SIGN_IN_ATTEMPTS_PER_HOUR;\n\n    const limit = (yield* Fx.promise(() =>\n      authDb(ctx, config).rateLimits.get(identifier),\n    )) as\n      | (Doc<\"RateLimit\"> & { attemptsLeft: number; lastAttemptTime: number })\n      | null;\n    if (limit === null) return null;\n    const elapsed = now - limit.lastAttemptTime;\n    const maxAttemptsPerMs = maxAttemptsPerHour / (60 * 60 * 1000);\n    const attemptsLeft = Math.min(\n      maxAttemptsPerHour,\n      limit.attemptsLeft + elapsed * maxAttemptsPerMs,\n    );\n    return { limit, attemptsLeft };\n  });\n"],"mappings":";;;;AAOA,MAAM,wCAAwC;;;;;AAM9C,MAAa,uBACX,KACA,YACA,WAEA,kBAAkB,KAAK,YAAY,OAAO,CAAC,KACzC,GAAG,KAAK,UAAU,UAAU,QAAQ,MAAM,eAAe,EAAE,CAC5D;;;;;;;AAQH,MAAa,sBACX,KACA,YACA,WAEA,GAAG,IAAI,aAAa;CAClB,MAAM,QAAQ,OAAO,kBAAkB,KAAK,YAAY,OAAO;AAC/D,KAAI,UAAU,KACZ,QAAO,GAAG,cACR,OAAO,KAAK,OAAO,CAAC,WAAW,MAAM,MAAM,MAAM,KAAK;EACpD,cAAc,MAAM,eAAe;EACnC,iBAAiB,KAAK,KAAK;EAC5B,CAAC,CACH;KAED,QAAO,GAAG,cACR,OAAO,KAAK,OAAO,CAAC,WAAW,OAAO;EACpC;EACA,eACG,OAAO,QAAQ,4BACd,yCAAyC;EAC7C,iBAAiB,KAAK,KAAK;EAC5B,CAAC,CACH;EAEH;;;;;AAMJ,MAAa,wBACX,KACA,YACA,WAEA,GAAG,IAAI,aAAa;CAClB,MAAM,QAAQ,OAAO,kBAAkB,KAAK,YAAY,OAAO;AAC/D,KAAI,UAAU,KACZ,QAAO,GAAG,cACR,OAAO,KAAK,OAAO,CAAC,WAAW,OAAO,MAAM,MAAM,IAAI,CACvD;EAEH;AAWJ,MAAM,qBACJ,KACA,YACA,WAEA,GAAG,IAAI,aAAa;CAClB,MAAM,MAAM,KAAK,KAAK;CACtB,MAAM,qBACJ,OAAO,QAAQ,4BACf;CAEF,MAAM,QAAS,OAAO,GAAG,cACvB,OAAO,KAAK,OAAO,CAAC,WAAW,IAAI,WAAW,CAC/C;AAGD,KAAI,UAAU,KAAM,QAAO;CAC3B,MAAM,UAAU,MAAM,MAAM;CAC5B,MAAM,mBAAmB,sBAAsB,OAAU;AAKzD,QAAO;EAAE;EAAO,cAJK,KAAK,IACxB,oBACA,MAAM,eAAe,UAAU,iBAChC;EAC6B;EAC9B"}

package/dist/server/mounts.d.ts

@@ -36,11 +36,11 @@ type EnterpriseAdminAuthorizationInput = {
 /**
  * App-defined authorization hook for mounted enterprise admin APIs.
  *
- * Return `void` (or resolve) to allow the operation, or `{ ok: false }` to deny it.
+ * Return `void` (or resolve) to allow the operation, or throw to deny it.
  *
  * @param ctx - Convex context with `ctx.auth` for identity checks.
  * @param input - The {@link EnterpriseAdminAuthorizationInput} describing who is doing what.
- * @returns `void` to allow, `{ ok: false }` to deny.
+ * @returns `void` to allow; throw to deny.
  *
  * @example
  * ```ts
@@ -48,16 +48,14 @@ type EnterpriseAdminAuthorizationInput = {
  *
  * const authorized: EnterpriseAuthorizer = async (ctx, input) => {
  *   const identity = await ctx.auth.getUserIdentity();
- *   if (!identity) return { ok: false };
+ *   if (!identity) throw new Error("Forbidden");
  *   // Allow all admin ops for the org owner
  * };
  * ```
  */
 type EnterpriseAuthorizer = (ctx: {
   auth: convex_server0.Auth;
-}, input: EnterpriseAdminAuthorizationInput) => Promise<void | {
-  ok: false;
-}>;
+}, input: EnterpriseAdminAuthorizationInput) => Promise<void>;
 type RoleRef<TRoleId extends string> = {
   id: TRoleId;
 };
@@ -126,14 +124,14 @@ type EnterpriseMountOptions<TRoleId extends string = string> = {
  * @see {@link scim}
  * @see {@link enterprise}
  */
-declare function sso<TAuthorization extends AuthAuthorizationConfig | undefined = undefined>(auth: Pick<AuthApi<TAuthorization>, "group" | "member" | "sso" | "user">, options?: MountedEnterpriseOptions<AuthRoleId<TAuthorization>>): {
+declare function sso<TAuthorization extends AuthAuthorizationConfig | undefined = undefined>(auth: Pick<AuthApi<TAuthorization>, "context" | "group" | "member" | "sso">, options?: MountedEnterpriseOptions<AuthRoleId<TAuthorization>>): {
   admin: {
     connection: {
       create: convex_server0.RegisteredMutation<"public", {
+        groupId?: string | undefined;
         name?: string | undefined;
         slug?: string | undefined;
         status?: "draft" | "active" | "disabled" | undefined;
-        groupId?: string | undefined;
         domain?: string | undefined;
       }, Promise<any>>;
       get: convex_server0.RegisteredQuery<"public", {
@@ -146,12 +144,12 @@ declare function sso<TAuthorization extends AuthAuthorizationConfig | undefined
         domain: string;
       }, Promise<any>>;
       list: convex_server0.RegisteredQuery<"public", {
+        limit?: number | undefined;
         where?: {
+          groupId?: string | undefined;
           slug?: string | undefined;
           status?: "draft" | "active" | "disabled" | undefined;
-          groupId?: string | undefined;
         } | undefined;
-        limit?: number | undefined;
         cursor?: string | null | undefined;
         orderBy?: string | undefined;
         order?: "asc" | "desc" | undefined;
@@ -164,13 +162,7 @@ declare function sso<TAuthorization extends AuthAuthorizationConfig | undefined
           status?: "draft" | "active" | "disabled" | undefined;
         };
       }, Promise<{
-        ok: false;
-        code: "NOT_SIGNED_IN" | "FORBIDDEN";
-        enterpriseId?: undefined;
-      } | {
-        ok: true;
         enterpriseId: string;
-        code?: undefined;
       }>>;
       delete: convex_server0.RegisteredMutation<"public", {
         enterpriseId: string;
@@ -194,12 +186,12 @@ declare function sso<TAuthorization extends AuthAuthorizationConfig | undefined
         }, Promise<any>>;
         verification: {
           request: convex_server0.RegisteredMutation<"public", {
-            enterpriseId: string;
             domain: string;
+            enterpriseId: string;
           }, Promise<any>>;
           confirm: convex_server0.RegisteredAction<"public", {
-            enterpriseId: string;
             domain: string;
+            enterpriseId: string;
           }, Promise<any>>;
         };
       };
@@ -263,8 +255,8 @@ declare function sso<TAuthorization extends AuthAuthorizationConfig | undefined
         patch: {
           identity?: {
             accountLinking?: {
-              saml?: "verifiedEmail" | "none" | undefined;
               oidc?: "verifiedEmail" | "none" | undefined;
+              saml?: "verifiedEmail" | "none" | undefined;
             } | undefined;
           } | undefined;
           provisioning?: {
@@ -287,9 +279,9 @@ declare function sso<TAuthorization extends AuthAuthorizationConfig | undefined
     };
     audit: {
       list: convex_server0.RegisteredQuery<"public", {
-        enterpriseId?: string | undefined;
         groupId?: string | undefined;
         limit?: number | undefined;
+        enterpriseId?: string | undefined;
       }, Promise<any>>;
     };
     webhook: {
@@ -302,21 +294,11 @@ declare function sso<TAuthorization extends AuthAuthorizationConfig | undefined
       endpoint: {
         create: convex_server0.RegisteredMutation<"public", {
           createdByUserId?: string | undefined;
-          enterpriseId: string;
           secret: string;
+          enterpriseId: string;
           url: string;
           subscriptions: string[];
         }, Promise<{
-          ok: false;
-          code: "NOT_SIGNED_IN" | "FORBIDDEN";
-          _id?: undefined;
-          enterpriseId?: undefined;
-          url?: undefined;
-          subscriptions?: undefined;
-          createdByUserId?: undefined;
-          status?: undefined;
-          failureCount?: undefined;
-        } | {
           _id: any;
           enterpriseId: string;
           url: string;
@@ -324,8 +306,6 @@ declare function sso<TAuthorization extends AuthAuthorizationConfig | undefined
           createdByUserId: string;
           status: string;
           failureCount: number;
-          ok?: undefined;
-          code?: undefined;
         }>>;
         list: convex_server0.RegisteredQuery<"public", {
           enterpriseId: string;
@@ -339,8 +319,8 @@ declare function sso<TAuthorization extends AuthAuthorizationConfig | undefined
   client: {
     signIn: convex_server0.RegisteredQuery<"public", {
       email?: string | undefined;
-      enterpriseId?: string | undefined;
       domain?: string | undefined;
+      enterpriseId?: string | undefined;
       redirectTo?: string | undefined;
     }, Promise<any>>;
     metadata: convex_server0.RegisteredQuery<"public", {
@@ -380,7 +360,7 @@ declare function sso<TAuthorization extends AuthAuthorizationConfig | undefined
  * @see {@link sso}
  * @see {@link enterprise}
  */
-declare function scim<TAuthorization extends AuthAuthorizationConfig | undefined = undefined>(auth: Pick<AuthApi<TAuthorization>, "scim" | "sso" | "user">, options?: MountedEnterpriseOptions<AuthRoleId<TAuthorization>>): {
+declare function scim<TAuthorization extends AuthAuthorizationConfig | undefined = undefined>(auth: Pick<AuthApi<TAuthorization>, "context" | "scim" | "sso">, options?: MountedEnterpriseOptions<AuthRoleId<TAuthorization>>): {
   admin: {
     configure: convex_server0.RegisteredMutation<"public", {
       status?: "draft" | "active" | "disabled" | undefined;
@@ -430,12 +410,12 @@ declare function scim<TAuthorization extends AuthAuthorizationConfig | undefined
  * @see {@link sso}
  * @see {@link scim}
  */
-declare function enterprise<TAuthorization extends AuthAuthorizationConfig | undefined = undefined>(auth: Pick<AuthApi<TAuthorization>, "group" | "member" | "scim" | "sso" | "user">, options: EnterpriseMountOptions<AuthRoleId<TAuthorization>>): {
+declare function enterprise<TAuthorization extends AuthAuthorizationConfig | undefined = undefined>(auth: Pick<AuthApi<TAuthorization>, "context" | "group" | "member" | "scim" | "sso">, options: EnterpriseMountOptions<AuthRoleId<TAuthorization>>): {
   createConnection: convex_server0.RegisteredMutation<"public", {
+    groupId?: string | undefined;
     name?: string | undefined;
     slug?: string | undefined;
     status?: "draft" | "active" | "disabled" | undefined;
-    groupId?: string | undefined;
     domain?: string | undefined;
   }, Promise<any>>;
   getConnection: convex_server0.RegisteredQuery<"public", {
@@ -448,12 +428,12 @@ declare function enterprise<TAuthorization extends AuthAuthorizationConfig | und
     domain: string;
   }, Promise<any>>;
   listConnections: convex_server0.RegisteredQuery<"public", {
+    limit?: number | undefined;
     where?: {
+      groupId?: string | undefined;
       slug?: string | undefined;
       status?: "draft" | "active" | "disabled" | undefined;
-      groupId?: string | undefined;
     } | undefined;
-    limit?: number | undefined;
     cursor?: string | null | undefined;
     orderBy?: string | undefined;
     order?: "asc" | "desc" | undefined;
@@ -466,13 +446,7 @@ declare function enterprise<TAuthorization extends AuthAuthorizationConfig | und
       status?: "draft" | "active" | "disabled" | undefined;
     };
   }, Promise<{
-    ok: false;
-    code: "NOT_SIGNED_IN" | "FORBIDDEN";
-    enterpriseId?: undefined;
-  } | {
-    ok: true;
     enterpriseId: string;
-    code?: undefined;
   }>>;
   deleteConnection: convex_server0.RegisteredMutation<"public", {
     enterpriseId: string;
@@ -494,12 +468,12 @@ declare function enterprise<TAuthorization extends AuthAuthorizationConfig | und
     }[];
   }, Promise<any>>;
   requestDomainVerification: convex_server0.RegisteredMutation<"public", {
-    enterpriseId: string;
     domain: string;
+    enterpriseId: string;
   }, Promise<any>>;
   confirmDomainVerification: convex_server0.RegisteredAction<"public", {
-    enterpriseId: string;
     domain: string;
+    enterpriseId: string;
   }, Promise<any>>;
   configureOidc: convex_server0.RegisteredMutation<"public", {
     scopes?: string[] | undefined;
@@ -555,8 +529,8 @@ declare function enterprise<TAuthorization extends AuthAuthorizationConfig | und
     patch: {
       identity?: {
         accountLinking?: {
-          saml?: "verifiedEmail" | "none" | undefined;
           oidc?: "verifiedEmail" | "none" | undefined;
+          saml?: "verifiedEmail" | "none" | undefined;
         } | undefined;
       } | undefined;
       provisioning?: {
@@ -577,27 +551,17 @@ declare function enterprise<TAuthorization extends AuthAuthorizationConfig | und
     enterpriseId: string;
   }, Promise<any>>;
   listAudit: convex_server0.RegisteredQuery<"public", {
-    enterpriseId?: string | undefined;
     groupId?: string | undefined;
     limit?: number | undefined;
+    enterpriseId?: string | undefined;
   }, Promise<any>>;
   createWebhookEndpoint: convex_server0.RegisteredMutation<"public", {
     createdByUserId?: string | undefined;
-    enterpriseId: string;
     secret: string;
+    enterpriseId: string;
     url: string;
     subscriptions: string[];
   }, Promise<{
-    ok: false;
-    code: "NOT_SIGNED_IN" | "FORBIDDEN";
-    _id?: undefined;
-    enterpriseId?: undefined;
-    url?: undefined;
-    subscriptions?: undefined;
-    createdByUserId?: undefined;
-    status?: undefined;
-    failureCount?: undefined;
-  } | {
     _id: any;
     enterpriseId: string;
     url: string;
@@ -605,8 +569,6 @@ declare function enterprise<TAuthorization extends AuthAuthorizationConfig | und
     createdByUserId: string;
     status: string;
     failureCount: number;
-    ok?: undefined;
-    code?: undefined;
   }>>;
   listWebhookEndpoints: convex_server0.RegisteredQuery<"public", {
     enterpriseId: string;
@@ -631,8 +593,8 @@ declare function enterprise<TAuthorization extends AuthAuthorizationConfig | und
   }, Promise<any>>;
   signIn: convex_server0.RegisteredQuery<"public", {
     email?: string | undefined;
-    enterpriseId?: string | undefined;
     domain?: string | undefined;
+    enterpriseId?: string | undefined;
     redirectTo?: string | undefined;
   }, Promise<any>>;
   metadata: convex_server0.RegisteredQuery<"public", {

package/dist/server/mounts.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"mounts.d.ts","names":[],"sources":["../../src/server/mounts.ts"],"mappings":";;;;;;;;AA+BA;;;;;AAiBA;;;;;;;;KAjBY,yBAAA;;;;AAkDZ;;;KAjCY,iCAAA;EAmCH,2DAjCP,MAAA,UAkCU;EAhCV,UAAA,EAAY,yBAAA,EA8BL;EA5BP,YAAA,WA4BA;EA1BA,OAAA,WA2BA;EAzBA,eAAA;AAAA;;;AA0BiC;;;;;;;;;AAEiB;;;;;;;;;KALxC,oBAAA,IACV,GAAA;EAAO,IAAA,EADuB,cAAA,CACO,IAAA;AAAA,GACrC,KAAA,EAAO,iCAAA,KACJ,OAAA;EAAiB,EAAA;AAAA;AAAA,KAEjB,OAAA;EAAoC,EAAA,EAAI,OAAA;AAAA;AAAA,KAExC,wBAAA;EACH,KAAA;IACE,UAAA,GAAa,oBAAA;IACb,KAAA,GAAQ,KAAA,CAAM,OAAA,GAAU,OAAA,CAAQ,OAAA;EAAA;AAAA;;;;;;;;;;;;;;;;;;;;AA6KpC;KArJY,sBAAA;EACV,KAAA;IACE,UAAA,EAAY,oBAAA;IACZ,KAAA,GAAQ,KAAA,CAAM,OAAA,GAAU,OAAA,CAAQ,OAAA;EAAA;AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;iBAkJpB,GAAA,wBACS,uBAAA,yBAAA,CAEvB,IAAA,EAAM,IAAA,CAAK,OAAA,CAAQ,cAAA,yCACnB,OAAA,GAAU,wBAAA,CAAyB,UAAA,CAAW,cAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;iBA8hBhC,IAAA,wBACS,uBAAA,yBAAA,CAEvB,IAAA,EAAM,IAAA,CAAK,OAAA,CAAQ,cAAA,6BACnB,OAAA,GAAU,wBAAA,CAAyB,UAAA,CAAW,cAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;iBAkFhC,UAAA,wBACS,uBAAA,yBAAA,CAEvB,IAAA,EAAM,IAAA,CACJ,OAAA,CAAQ,cAAA,kDAGV,OAAA,EAAS,sBAAA,CAAuB,UAAA,CAAW,cAAA"}
+{"version":3,"file":"mounts.d.ts","names":[],"sources":["../../src/server/mounts.ts"],"mappings":";;;;;;;;AAgCA;;;;;AAiBA;;;;;;;;KAjBY,yBAAA;;;;AAkDZ;;;KAjCY,iCAAA;EAmCH,2DAjCP,MAAA,UAkCU;EAhCV,UAAA,EAAY,yBAAA,EA8BL;EA5BP,YAAA,WA4BA;EA1BA,OAAA,WA2BA;EAzBA,eAAA;AAAA;;AA0BiB;;;;;;;;;AAEiC;;;;;;;;;;KALxC,oBAAA,IACV,GAAA;EAAO,IAAA,EADuB,cAAA,CACO,IAAA;AAAA,GACrC,KAAA,EAAO,iCAAA,KACJ,OAAA;AAAA,KAEA,OAAA;EAAoC,EAAA,EAAI,OAAA;AAAA;AAAA,KAExC,wBAAA;EACH,KAAA;IACE,UAAA,GAAa,oBAAA;IACb,KAAA,GAAQ,KAAA,CAAM,OAAA,GAAU,OAAA,CAAQ,OAAA;EAAA;AAAA;;;;;;;;;;;;;;;;;;;;;KAwBxB,sBAAA;EACV,KAAA;IACE,UAAA,EAAY,oBAAA;IACZ,KAAA,GAAQ,KAAA,CAAM,OAAA,GAAU,OAAA,CAAQ,OAAA;EAAA;AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;iBAqJpB,GAAA,wBACS,uBAAA,yBAAA,CAEvB,IAAA,EAAM,IAAA,CACJ,OAAA,CAAQ,cAAA,4CAGV,OAAA,GAAU,wBAAA,CAAyB,UAAA,CAAW,cAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;iBAkgBhC,IAAA,wBACS,uBAAA,yBAAA,CAEvB,IAAA,EAAM,IAAA,CAAK,OAAA,CAAQ,cAAA,gCACnB,OAAA,GAAU,wBAAA,CAAyB,UAAA,CAAW,cAAA;;;;;;;;;;;;;;;;AAJhD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;iBAmFgB,UAAA,wBACS,uBAAA,yBAAA,CAEvB,IAAA,EAAM,IAAA,CACJ,OAAA,CAAQ,cAAA,qDAGV,OAAA,EAAS,sBAAA,CAAuB,UAAA,CAAW,cAAA"}