@robelest/convex-auth 0.0.4-preview.22 → 0.0.4-preview.24

package/src/server/limits.ts

@@ -1,10 +1,9 @@
 import { Fx } from "@robelest/fx";
+import { ConvexError } from "convex/values";
 
 import { authDb } from "./db";
-import { AuthError } from "./authError";
 import { Doc, MutationCtx } from "./types";
 import { ConvexAuthConfig } from "./types";
-import { errorMessage } from "./utils";
 
 const DEFAULT_MAX_SIGN_IN_ATTEMPTS_PER_HOUR = 10;
 
@@ -16,7 +15,7 @@ export const isSignInRateLimited = (
   ctx: MutationCtx,
   identifier: string,
   config: ConvexAuthConfig,
-): Fx<boolean, AuthError> =>
+): Fx<boolean, ConvexError<any>> =>
   getRateLimitState(ctx, identifier, config).pipe(
     Fx.map((state) => state !== null && state.attemptsLeft < 1),
   );
@@ -31,40 +30,28 @@ export const recordFailedSignIn = (
   ctx: MutationCtx,
   identifier: string,
   config: ConvexAuthConfig,
-): Fx<void, AuthError> =>
-  getRateLimitState(ctx, identifier, config).pipe(
-    Fx.chain((state) =>
-      state !== null
-        ? Fx.from({
-            ok: () =>
-              authDb(ctx, config).rateLimits.patch(state.limit._id, {
-                attemptsLeft: state.attemptsLeft - 1,
-                lastAttemptTime: Date.now(),
-              }),
-            err: (e) =>
-              new AuthError(
-                "INTERNAL_ERROR",
-                `Failed to patch rate limit: ${errorMessage(e)}`,
-              ),
-          })
-        : Fx.from({
-            ok: () =>
-              authDb(ctx, config).rateLimits.create({
-                identifier,
-                attemptsLeft:
-                  (config.signIn?.maxFailedAttemptsPerHour ??
-                    DEFAULT_MAX_SIGN_IN_ATTEMPTS_PER_HOUR) - 1,
-                lastAttemptTime: Date.now(),
-              }),
-            err: (e) =>
-              new AuthError(
-                "INTERNAL_ERROR",
-                `Failed to create rate limit: ${errorMessage(e)}`,
-              ),
-          }),
-    ),
-    Fx.map(() => undefined),
-  );
+): Fx<void, ConvexError<any>> =>
+  Fx.gen(function* () {
+    const state = yield* getRateLimitState(ctx, identifier, config);
+    if (state !== null) {
+      yield* Fx.promise(() =>
+        authDb(ctx, config).rateLimits.patch(state.limit._id, {
+          attemptsLeft: state.attemptsLeft - 1,
+          lastAttemptTime: Date.now(),
+        }),
+      );
+    } else {
+      yield* Fx.promise(() =>
+        authDb(ctx, config).rateLimits.create({
+          identifier,
+          attemptsLeft:
+            (config.signIn?.maxFailedAttemptsPerHour ??
+              DEFAULT_MAX_SIGN_IN_ATTEMPTS_PER_HOUR) - 1,
+          lastAttemptTime: Date.now(),
+        }),
+      );
+    }
+  });
 
 /**
  * Reset the rate limit for the given identifier (e.g. after successful sign-in).
@@ -74,21 +61,15 @@ export const resetSignInRateLimit = (
   ctx: MutationCtx,
   identifier: string,
   config: ConvexAuthConfig,
-): Fx<void, AuthError> =>
-  getRateLimitState(ctx, identifier, config).pipe(
-    Fx.chain((state) =>
-      state !== null
-        ? Fx.from({
-            ok: () => authDb(ctx, config).rateLimits.delete(state.limit._id),
-            err: (e) =>
-              new AuthError(
-                "INTERNAL_ERROR",
-                `Failed to delete rate limit: ${errorMessage(e)}`,
-              ),
-          })
-        : Fx.unit,
-    ),
-  );
+): Fx<void, ConvexError<any>> =>
+  Fx.gen(function* () {
+    const state = yield* getRateLimitState(ctx, identifier, config);
+    if (state !== null) {
+      yield* Fx.promise(() =>
+        authDb(ctx, config).rateLimits.delete(state.limit._id),
+      );
+    }
+  });
 
 // ---------------------------------------------------------------------------
 // Internal
@@ -103,32 +84,24 @@ const getRateLimitState = (
   ctx: MutationCtx,
   identifier: string,
   config: ConvexAuthConfig,
-): Fx<RateLimitState, AuthError> => {
-  const now = Date.now();
-  const maxAttemptsPerHour =
-    config.signIn?.maxFailedAttemptsPerHour ??
-    DEFAULT_MAX_SIGN_IN_ATTEMPTS_PER_HOUR;
+): Fx<RateLimitState, ConvexError<any>> =>
+  Fx.gen(function* () {
+    const now = Date.now();
+    const maxAttemptsPerHour =
+      config.signIn?.maxFailedAttemptsPerHour ??
+      DEFAULT_MAX_SIGN_IN_ATTEMPTS_PER_HOUR;
 
-  return Fx.from({
-    ok: () => authDb(ctx, config).rateLimits.get(identifier),
-    err: (e) =>
-      new AuthError(
-        "INTERNAL_ERROR",
-        `Failed to get rate limit: ${errorMessage(e)}`,
-      ),
-  }).pipe(
-    Fx.map((raw) => {
-      const limit = raw as
-        | (Doc<"RateLimit"> & { attemptsLeft: number; lastAttemptTime: number })
-        | null;
-      if (limit === null) return null;
-      const elapsed = now - limit.lastAttemptTime;
-      const maxAttemptsPerMs = maxAttemptsPerHour / (60 * 60 * 1000);
-      const attemptsLeft = Math.min(
-        maxAttemptsPerHour,
-        limit.attemptsLeft + elapsed * maxAttemptsPerMs,
-      );
-      return { limit, attemptsLeft };
-    }),
-  );
-};
+    const limit = (yield* Fx.promise(() =>
+      authDb(ctx, config).rateLimits.get(identifier),
+    )) as
+      | (Doc<"RateLimit"> & { attemptsLeft: number; lastAttemptTime: number })
+      | null;
+    if (limit === null) return null;
+    const elapsed = now - limit.lastAttemptTime;
+    const maxAttemptsPerMs = maxAttemptsPerHour / (60 * 60 * 1000);
+    const attemptsLeft = Math.min(
+      maxAttemptsPerHour,
+      limit.attemptsLeft + elapsed * maxAttemptsPerMs,
+    );
+    return { limit, attemptsLeft };
+  });

package/src/server/mounts.ts

@@ -1,3 +1,4 @@
+import { Cv } from "@robelest/fx/convex";
 import { actionGeneric, mutationGeneric, queryGeneric } from "convex/server";
 import { ConvexError, v } from "convex/values";
 
@@ -62,11 +63,11 @@ export type EnterpriseAdminAuthorizationInput = {
 /**
  * App-defined authorization hook for mounted enterprise admin APIs.
  *
- * Return `void` (or resolve) to allow the operation, or `{ ok: false }` to deny it.
+ * Return `void` (or resolve) to allow the operation, or throw to deny it.
  *
  * @param ctx - Convex context with `ctx.auth` for identity checks.
  * @param input - The {@link EnterpriseAdminAuthorizationInput} describing who is doing what.
- * @returns `void` to allow, `{ ok: false }` to deny.
+ * @returns `void` to allow; throw to deny.
  *
  * @example
  * ```ts
@@ -74,7 +75,7 @@ export type EnterpriseAdminAuthorizationInput = {
  *
  * const authorized: EnterpriseAuthorizer = async (ctx, input) => {
  *   const identity = await ctx.auth.getUserIdentity();
- *   if (!identity) return { ok: false };
+ *   if (!identity) throw new Error("Forbidden");
  *   // Allow all admin ops for the org owner
  * };
  * ```
@@ -82,7 +83,7 @@ export type EnterpriseAdminAuthorizationInput = {
 export type EnterpriseAuthorizer = (
   ctx: { auth: import("convex/server").Auth },
   input: EnterpriseAdminAuthorizationInput,
-) => Promise<void | { ok: false }>;
+) => Promise<void>;
 
 type RoleRef<TRoleId extends string> = { id: TRoleId };
 
@@ -126,11 +127,11 @@ type MountedEnterpriseTarget = {
   domain?: string;
 };
 
-function requireSignedInUser(auth: Pick<AuthApi, "user">) {
+function requireSignedInUser(auth: Pick<AuthApi, "context">) {
   return async (ctx: {
     auth: import("convex/server").Auth;
   }): Promise<string | null> => {
-    return await auth.user.id(ctx as never);
+    return (await auth.context(ctx as never, { optional: true })).userId;
   };
 }
 
@@ -197,7 +198,7 @@ async function resolveMountedEnterpriseTarget(
 }
 
 function createMountedAdminAuthorizer(
-  auth: Pick<AuthApi, "sso" | "user">,
+  auth: Pick<AuthApi, "context" | "sso">,
   options?: MountedEnterpriseOptions,
 ) {
   const requireUserId = requireSignedInUser(auth);
@@ -209,23 +210,26 @@ function createMountedAdminAuthorizer(
   ) => {
     const userId = await requireUserId(ctx);
     if (userId === null) {
-      return { ok: false as const, code: "NOT_SIGNED_IN" as const };
+      throw Cv.error({
+        code: "NOT_SIGNED_IN",
+        message: "You must be signed in to perform this action.",
+      });
     }
     if (!options?.admin?.authorized) {
-      return { ok: false as const, code: "FORBIDDEN" as const };
+      throw Cv.error({
+        code: "FORBIDDEN",
+        message: "Access denied.",
+      });
     }
     const resolved = await resolveMountedEnterpriseTarget(auth, ctx, target);
-    const authResult = await options.admin.authorized(ctx, {
+    await options.admin.authorized(ctx, {
       userId,
       permission,
       enterpriseId: resolved.enterpriseId,
       groupId: resolved.groupId,
       resolvedGroupId: resolved.resolvedGroupId,
     });
-    if (authResult && !authResult.ok) {
-      return { ok: false as const, code: "FORBIDDEN" as const };
-    }
-    return { ok: true as const, userId, ...resolved };
+    return { userId, ...resolved };
   };
 }
 
@@ -265,7 +269,10 @@ function createMountedAdminAuthorizer(
 export function sso<
   TAuthorization extends AuthAuthorizationConfig | undefined = undefined,
 >(
-  auth: Pick<AuthApi<TAuthorization>, "group" | "member" | "sso" | "user">,
+  auth: Pick<
+    AuthApi<TAuthorization>,
+    "context" | "group" | "member" | "sso"
+  >,
   options?: MountedEnterpriseOptions<AuthRoleId<TAuthorization>>,
 ) {
   const authorize = createMountedAdminAuthorizer(auth, options);
@@ -286,8 +293,6 @@ export function sso<
             const authResult = await authorize(ctx, "sso.connection.create", {
               groupId: args.groupId,
             });
-            if (!authResult.ok)
-              return { ok: false as const, code: authResult.code };
             const { userId } = authResult;
             const createsGroup = args.groupId === undefined;
             const groupId =
@@ -332,10 +337,9 @@ export function sso<
         get: queryGeneric({
           args: { enterpriseId: v.string() },
           handler: async (ctx, args) => {
-            const _auth = await authorize(ctx, "sso.connection.read", {
+            await authorize(ctx, "sso.connection.read", {
               enterpriseId: args.enterpriseId,
             });
-            if (!_auth.ok) return null;
             return await auth.sso.admin.connection.get(
               ctx as never,
               args.enterpriseId,
@@ -345,10 +349,9 @@ export function sso<
         getByGroup: queryGeneric({
           args: { groupId: v.string() },
           handler: async (ctx, args) => {
-            const _auth = await authorize(ctx, "sso.connection.read", {
+            await authorize(ctx, "sso.connection.read", {
               groupId: args.groupId,
             });
-            if (!_auth.ok) return null;
             return await auth.sso.admin.connection.getByGroup(
               ctx as never,
               args.groupId,
@@ -358,10 +361,9 @@ export function sso<
         getByDomain: queryGeneric({
           args: { domain: v.string() },
           handler: async (ctx, args) => {
-            const _auth = await authorize(ctx, "sso.connection.read", {
+            await authorize(ctx, "sso.connection.read", {
               domain: args.domain,
             });
-            if (!_auth.ok) return null;
             return await auth.sso.admin.connection.getByDomain(
               ctx as never,
               args.domain,
@@ -377,10 +379,9 @@ export function sso<
             order: v.optional(v.union(v.literal("asc"), v.literal("desc"))),
           },
           handler: async (ctx, args) => {
-            const _auth = await authorize(ctx, "sso.connection.read", {
+            await authorize(ctx, "sso.connection.read", {
               groupId: args.where?.groupId,
             });
-            if (!_auth.ok) return null;
             return await auth.sso.admin.connection.list(
               ctx as never,
               args as never,
@@ -397,25 +398,23 @@ export function sso<
             }),
           },
           handler: async (ctx, args) => {
-            const _auth = await authorize(ctx, "sso.connection.manage", {
+            await authorize(ctx, "sso.connection.manage", {
               enterpriseId: args.enterpriseId,
             });
-            if (!_auth.ok) return { ok: false as const, code: _auth.code };
             await auth.sso.admin.connection.update(
               ctx as never,
               args.enterpriseId,
               args.data,
             );
-            return { ok: true as const, enterpriseId: args.enterpriseId };
+            return { enterpriseId: args.enterpriseId };
           },
         }),
         delete: mutationGeneric({
           args: { enterpriseId: v.string() },
           handler: async (ctx, args) => {
-            const _auth = await authorize(ctx, "sso.connection.manage", {
+            await authorize(ctx, "sso.connection.manage", {
               enterpriseId: args.enterpriseId,
             });
-            if (!_auth.ok) return { ok: false as const, code: _auth.code };
             return await auth.sso.admin.connection.delete(
               ctx as never,
               args.enterpriseId,
@@ -425,10 +424,9 @@ export function sso<
         status: queryGeneric({
           args: { enterpriseId: v.string() },
           handler: async (ctx, args) => {
-            const _auth = await authorize(ctx, "sso.connection.read", {
+            await authorize(ctx, "sso.connection.read", {
               enterpriseId: args.enterpriseId,
             });
-            if (!_auth.ok) return null;
             return await auth.sso.admin.connection.status(
               ctx as never,
               args.enterpriseId,
@@ -439,10 +437,9 @@ export function sso<
           list: queryGeneric({
             args: { enterpriseId: v.string() },
             handler: async (ctx, args) => {
-              const _auth = await authorize(ctx, "sso.connection.read", {
+              await authorize(ctx, "sso.connection.read", {
                 enterpriseId: args.enterpriseId,
               });
-              if (!_auth.ok) return null;
               return await auth.sso.admin.connection.domain.list(
                 ctx as never,
                 args.enterpriseId,
@@ -452,10 +449,9 @@ export function sso<
           validate: queryGeneric({
             args: { enterpriseId: v.string() },
             handler: async (ctx, args) => {
-              const _auth = await authorize(ctx, "sso.domain.manage", {
+              await authorize(ctx, "sso.domain.manage", {
                 enterpriseId: args.enterpriseId,
               });
-              if (!_auth.ok) return null;
               return await auth.sso.admin.connection.domain.validate(
                 ctx as never,
                 args.enterpriseId,
@@ -468,10 +464,9 @@ export function sso<
               domains: v.array(enterpriseDomainInputValidator),
             },
             handler: async (ctx, args) => {
-              const _auth = await authorize(ctx, "sso.domain.manage", {
+              await authorize(ctx, "sso.domain.manage", {
                 enterpriseId: args.enterpriseId,
               });
-              if (!_auth.ok) return { ok: false as const, code: _auth.code };
               return await auth.sso.admin.connection.domain.set(
                 ctx as never,
                 args.enterpriseId,
@@ -483,10 +478,9 @@ export function sso<
             request: mutationGeneric({
               args: enterpriseDomainVerificationInputValidator,
               handler: async (ctx, args) => {
-                const _auth = await authorize(ctx, "sso.domain.manage", {
+                await authorize(ctx, "sso.domain.manage", {
                   enterpriseId: args.enterpriseId,
                 });
-                if (!_auth.ok) return { ok: false as const, code: _auth.code };
                 return await auth.sso.admin.connection.domain.verification.request(
                   ctx as never,
                   args,
@@ -496,10 +490,9 @@ export function sso<
             confirm: actionGeneric({
               args: enterpriseDomainVerificationInputValidator,
               handler: async (ctx, args) => {
-                const _auth = await authorize(ctx, "sso.domain.manage", {
+                await authorize(ctx, "sso.domain.manage", {
                   enterpriseId: args.enterpriseId,
                 });
-                if (!_auth.ok) return { ok: false as const, code: _auth.code };
                 return await auth.sso.admin.connection.domain.verification.confirm(
                   ctx as never,
                   args,
@@ -524,20 +517,18 @@ export function sso<
             extraFields: v.optional(v.record(v.string(), v.string())),
           },
           handler: async (ctx, args) => {
-            const _auth = await authorize(ctx, "sso.protocol.manage", {
+            await authorize(ctx, "sso.protocol.manage", {
               enterpriseId: args.enterpriseId,
             });
-            if (!_auth.ok) return { ok: false as const, code: _auth.code };
             return await auth.sso.admin.oidc.configure(ctx as never, args);
           },
         }),
         get: queryGeneric({
           args: { enterpriseId: v.string() },
           handler: async (ctx, args) => {
-            const _auth = await authorize(ctx, "sso.connection.read", {
+            await authorize(ctx, "sso.connection.read", {
               enterpriseId: args.enterpriseId,
             });
-            if (!_auth.ok) return null;
             return await auth.sso.admin.oidc.get(
               ctx as never,
               args.enterpriseId,
@@ -547,10 +538,9 @@ export function sso<
         validate: actionGeneric({
           args: { enterpriseId: v.string() },
           handler: async (ctx, args) => {
-            const _auth = await authorize(ctx, "sso.protocol.manage", {
+            await authorize(ctx, "sso.protocol.manage", {
               enterpriseId: args.enterpriseId,
             });
-            if (!_auth.ok) return { ok: false as const, code: _auth.code };
             return await auth.sso.admin.oidc.validate(
               ctx as never,
               args.enterpriseId,
@@ -572,20 +562,18 @@ export function sso<
             sp: v.optional(enterpriseSamlSpValidator),
           },
           handler: async (ctx, args) => {
-            const _auth = await authorize(ctx, "sso.protocol.manage", {
+            await authorize(ctx, "sso.protocol.manage", {
               enterpriseId: args.enterpriseId,
             });
-            if (!_auth.ok) return { ok: false as const, code: _auth.code };
             return await auth.sso.admin.saml.configure(ctx as never, args);
           },
         }),
         validate: queryGeneric({
           args: { enterpriseId: v.string() },
           handler: async (ctx, args) => {
-            const _auth = await authorize(ctx, "sso.protocol.manage", {
+            await authorize(ctx, "sso.protocol.manage", {
               enterpriseId: args.enterpriseId,
             });
-            if (!_auth.ok) return null;
             return await auth.sso.admin.saml.validate(
               ctx as never,
               args.enterpriseId,
@@ -597,10 +585,9 @@ export function sso<
         get: queryGeneric({
           args: { enterpriseId: v.string() },
           handler: async (ctx, args) => {
-            const _auth = await authorize(ctx, "sso.connection.read", {
+            await authorize(ctx, "sso.connection.read", {
               enterpriseId: args.enterpriseId,
             });
-            if (!_auth.ok) return null;
             return await auth.sso.admin.policy.get(
               ctx as never,
               args.enterpriseId,
@@ -613,10 +600,9 @@ export function sso<
             patch: enterprisePolicyPatchValidator,
           },
           handler: async (ctx, args) => {
-            const _auth = await authorize(ctx, "sso.policy.manage", {
+            await authorize(ctx, "sso.policy.manage", {
               enterpriseId: args.enterpriseId,
             });
-            if (!_auth.ok) return { ok: false as const, code: _auth.code };
             return await auth.sso.admin.policy.update(
               ctx as never,
               args.enterpriseId,
@@ -627,10 +613,9 @@ export function sso<
         validate: queryGeneric({
           args: { enterpriseId: v.string() },
           handler: async (ctx, args) => {
-            const _auth = await authorize(ctx, "sso.policy.manage", {
+            await authorize(ctx, "sso.policy.manage", {
               enterpriseId: args.enterpriseId,
             });
-            if (!_auth.ok) return null;
             return await auth.sso.admin.policy.validate(
               ctx as never,
               args.enterpriseId,
@@ -646,11 +631,10 @@ export function sso<
             limit: v.optional(v.number()),
           },
           handler: async (ctx, args) => {
-            const _auth = await authorize(ctx, "sso.audit.read", {
+            await authorize(ctx, "sso.audit.read", {
               enterpriseId: args.enterpriseId,
               groupId: args.groupId,
             });
-            if (!_auth.ok) return null;
             return await auth.sso.admin.audit.list(ctx as never, args);
           },
         }),
@@ -663,10 +647,9 @@ export function sso<
               limit: v.optional(v.number()),
             },
             handler: async (ctx, args) => {
-              const _auth = await authorize(ctx, "sso.webhook.manage", {
+              await authorize(ctx, "sso.webhook.manage", {
                 enterpriseId: args.enterpriseId,
               });
-              if (!_auth.ok) return null;
               return await (auth.sso.admin.webhook as any).delivery.list(
                 ctx as never,
                 args,
@@ -687,8 +670,6 @@ export function sso<
               const authResult = await authorize(ctx, "sso.webhook.manage", {
                 enterpriseId: args.enterpriseId,
               });
-              if (!authResult.ok)
-                return { ok: false as const, code: authResult.code };
               const { userId } = authResult;
               const result = await auth.sso.admin.webhook.endpoint.create(
                 ctx as never,
@@ -711,10 +692,9 @@ export function sso<
           list: queryGeneric({
             args: { enterpriseId: v.string() },
             handler: async (ctx, args) => {
-              const _auth = await authorize(ctx, "sso.webhook.manage", {
+              await authorize(ctx, "sso.webhook.manage", {
                 enterpriseId: args.enterpriseId,
               });
-              if (!_auth.ok) return null;
               const endpoints = await auth.sso.admin.webhook.endpoint.list(
                 ctx as never,
                 args.enterpriseId,
@@ -733,16 +713,15 @@ export function sso<
                 args.endpointId,
               );
               if (!endpoint) {
-                return {
-                  ok: false as const,
-                  code: "INVALID_PARAMETERS" as const,
-                };
+                throw Cv.error({
+                  code: "INVALID_PARAMETERS",
+                  message: "Webhook endpoint not found.",
+                });
               }
-              const _auth = await authorize(ctx, "sso.webhook.manage", {
+              await authorize(ctx, "sso.webhook.manage", {
                 enterpriseId: endpoint.enterpriseId,
                 groupId: endpoint.groupId,
               });
-              if (!_auth.ok) return { ok: false as const, code: _auth.code };
               return await auth.sso.admin.webhook.endpoint.disable(
                 ctx as never,
                 args.endpointId,
@@ -811,7 +790,7 @@ export function sso<
 export function scim<
   TAuthorization extends AuthAuthorizationConfig | undefined = undefined,
 >(
-  auth: Pick<AuthApi<TAuthorization>, "scim" | "sso" | "user">,
+  auth: Pick<AuthApi<TAuthorization>, "context" | "scim" | "sso">,
   options?: MountedEnterpriseOptions<AuthRoleId<TAuthorization>>,
 ) {
   const authorize = createMountedAdminAuthorizer(auth, options);
@@ -825,30 +804,27 @@ export function scim<
           status: v.optional(enterpriseStatusValidator),
         },
         handler: async (ctx, args) => {
-          const _auth = await authorize(ctx, "scim.manage", {
+          await authorize(ctx, "scim.manage", {
             enterpriseId: args.enterpriseId,
           });
-          if (!_auth.ok) return { ok: false as const, code: _auth.code };
           return await auth.scim.admin.configure(ctx as never, args);
         },
       }),
       get: queryGeneric({
         args: { enterpriseId: v.string() },
         handler: async (ctx, args) => {
-          const _auth = await authorize(ctx, "scim.manage", {
+          await authorize(ctx, "scim.manage", {
             enterpriseId: args.enterpriseId,
           });
-          if (!_auth.ok) return null;
           return await auth.scim.admin.get(ctx as never, args.enterpriseId);
         },
       }),
       validate: queryGeneric({
         args: { enterpriseId: v.string() },
         handler: async (ctx, args) => {
-          const _auth = await authorize(ctx, "scim.manage", {
+          await authorize(ctx, "scim.manage", {
             enterpriseId: args.enterpriseId,
           });
-          if (!_auth.ok) return null;
           return await auth.scim.admin.validate(
             ctx as never,
             args.enterpriseId,
@@ -899,7 +875,7 @@ export function enterprise<
 >(
   auth: Pick<
     AuthApi<TAuthorization>,
-    "group" | "member" | "scim" | "sso" | "user"
+    "context" | "group" | "member" | "scim" | "sso"
   >,
   options: EnterpriseMountOptions<AuthRoleId<TAuthorization>>,
 ) {