@robelest/convex-auth 0.0.4-preview.22 → 0.0.4-preview.24

package/dist/component/server/core.js

@@ -1,7 +1,9 @@
+import { getSessionUserId } from "./context.js";
+import { materializeProvider } from "./config.js";
 import { TOKEN_SUB_CLAIM_DIVIDER, generateRandomString, sha256 } from "./utils.js";
 import { buildScopeChecker, checkKeyRateLimit, generateApiKey, hashApiKey } from "./keys.js";
-import { materializeProvider } from "./config.js";
 import { signInImpl } from "./signin.js";
+import { Cv } from "@robelest/fx/convex";
 
 //#region src/server/core.ts
 /**
@@ -26,14 +28,12 @@ function createCoreDomains(deps) {
 	const normalizeRoleIds = (roleIds) => {
 		const normalized = Array.from(new Set(roleIds ?? []));
 		const invalid = normalized.filter((id) => getRoleDefinition(id) === null);
-		if (invalid.length > 0) return {
-			ok: false,
+		if (invalid.length > 0) throw Cv.error({
+			code: "INVALID_ROLE_IDS",
+			message: "One or more role IDs are invalid.",
 			invalidRoleIds: invalid
-		};
-		return {
-			ok: true,
-			roleIds: normalized
-		};
+		});
+		return normalized;
 	};
 	const listAllKeysByUser = async (ctx, userId) => {
 		const items = [];
@@ -81,23 +81,6 @@ function createCoreDomains(deps) {
 		return ctx[AUTH_CACHE];
 	}
 	const user = {
-		id: async (ctx, request) => {
-			const identity = await ctx.auth.getUserIdentity();
-			if (identity !== null) {
-				const [userId] = identity.subject.split(TOKEN_SUB_CLAIM_DIVIDER);
-				return userId;
-			}
-			if (request !== void 0 && "runMutation" in ctx && ctx.runMutation) {
-				const authHeader = request.headers.get("Authorization");
-				if (authHeader?.startsWith("Bearer sk_")) {
-					const rawKey = authHeader.slice(7);
-					const result = await getAuth().key.verify(ctx, rawKey);
-					if (result.ok) return result.userId;
-					return null;
-				}
-			}
-			return null;
-		},
 		get: async (ctx, userId) => {
 			const c = cache(ctx);
 			if (c.users.has(userId)) return c.users.get(userId);
@@ -109,7 +92,7 @@ function createCoreDomains(deps) {
 			return await ctx.runQuery(config.component.public.userList, opts);
 		},
 		viewer: async (ctx) => {
-			const userId = await user.id(ctx);
+			const userId = await getSessionUserId(ctx);
 			if (userId === null) return null;
 			return await user.get(ctx, userId);
 		},
@@ -118,10 +101,7 @@ function createCoreDomains(deps) {
 				userId,
 				data
 			});
-			return {
-				ok: true,
-				userId
-			};
+			return { userId };
 		},
 		setActiveGroup: async (ctx, opts) => {
 			const doc = await user.get(ctx, opts.userId);
@@ -130,7 +110,6 @@ function createCoreDomains(deps) {
 				const { lastActiveGroup: _omit, ...rest } = existingExtend;
 				await user.update(ctx, opts.userId, { extend: rest });
 				return {
-					ok: true,
 					userId: opts.userId,
 					groupId: null
 				};
@@ -140,7 +119,6 @@ function createCoreDomains(deps) {
 				lastActiveGroup: opts.groupId
 			} });
 			return {
-				ok: true,
 				userId: opts.userId,
 				groupId: opts.groupId
 			};
@@ -164,10 +142,10 @@ function createCoreDomains(deps) {
 				ctx.runQuery(config.component.public.totpListByUserId, { userId })
 			]);
 			const totalLinked = sessions.length + accounts.length + keys.length + members.length + passkeys.length + totps.length;
-			if (!cascade && totalLinked > 0) return {
-				ok: false,
-				code: "INVALID_PARAMETERS"
-			};
+			if (!cascade && totalLinked > 0) throw Cv.error({
+				code: "INVALID_PARAMETERS",
+				message: "The provided parameters are invalid."
+			});
 			const deletions = [];
 			for (const s of sessions) deletions.push(ctx.runMutation(config.component.public.sessionDelete, { sessionId: s._id }));
 			for (const a of accounts) deletions.push(ctx.runMutation(config.component.public.accountDelete, { accountId: a._id }));
@@ -177,10 +155,7 @@ function createCoreDomains(deps) {
 			for (const t of totps) deletions.push(ctx.runMutation(config.component.public.totpDelete, { totpId: t._id }));
 			await Promise.all(deletions);
 			await ctx.runMutation(config.component.public.userDelete, { userId });
-			return {
-				ok: true,
-				userId
-			};
+			return { userId };
 		}
 	};
 	const session = {
@@ -193,7 +168,6 @@ function createCoreDomains(deps) {
 		invalidate: async (ctx, args) => {
 			await callInvalidateSessions(ctx, args);
 			return {
-				ok: true,
 				userId: args.userId,
 				except: args.except ?? []
 			};
@@ -207,10 +181,7 @@ function createCoreDomains(deps) {
 	};
 	const account = {
 		create: async (ctx, args) => {
-			return {
-				ok: true,
-				...await callCreateAccountFromCredentials(ctx, args)
-			};
+			return { ...await callCreateAccountFromCredentials(ctx, args) };
 		},
 		get: async (ctx, args) => {
 			const result = await callRetrieveAccountWithCredentials(ctx, args);
@@ -219,26 +190,20 @@ function createCoreDomains(deps) {
 		},
 		update: async (ctx, args) => {
 			await callModifyAccount(ctx, args);
-			return {
-				ok: true,
-				accountId: args.account.id
-			};
+			return { accountId: args.account.id };
 		},
 		delete: async (ctx, accountId) => {
 			const doc = await ctx.runQuery(config.component.public.accountGetById, { accountId });
-			if (doc === null) return {
-				ok: false,
-				code: "ACCOUNT_NOT_FOUND"
-			};
-			if ((await ctx.runQuery(config.component.public.accountListByUser, { userId: doc.userId })).length <= 1) return {
-				ok: false,
-				code: "INVALID_PARAMETERS"
-			};
+			if (doc === null) throw Cv.error({
+				code: "ACCOUNT_NOT_FOUND",
+				message: "Account not found."
+			});
+			if ((await ctx.runQuery(config.component.public.accountListByUser, { userId: doc.userId })).length <= 1) throw Cv.error({
+				code: "INVALID_PARAMETERS",
+				message: "The provided parameters are invalid."
+			});
 			await ctx.runMutation(config.component.public.accountDelete, { accountId });
-			return {
-				ok: true,
-				accountId
-			};
+			return { accountId };
 		},
 		listPasskeys: async (ctx, opts) => {
 			return await ctx.runQuery(config.component.public.passkeyListByUserId, opts);
@@ -248,27 +213,18 @@ function createCoreDomains(deps) {
 				passkeyId,
 				data: { name }
 			});
-			return {
-				ok: true,
-				passkeyId
-			};
+			return { passkeyId };
 		},
 		deletePasskey: async (ctx, passkeyId) => {
 			await ctx.runMutation(config.component.public.passkeyDelete, { passkeyId });
-			return {
-				ok: true,
-				passkeyId
-			};
+			return { passkeyId };
 		},
 		listTotps: async (ctx, opts) => {
 			return await ctx.runQuery(config.component.public.totpListByUserId, opts);
 		},
 		deleteTotp: async (ctx, totpId) => {
 			await ctx.runMutation(config.component.public.totpDelete, { totpId });
-			return {
-				ok: true,
-				totpId
-			};
+			return { totpId };
 		}
 	};
 	const provider = { signIn: async (ctx, providerConfig, args) => {
@@ -283,10 +239,7 @@ function createCoreDomains(deps) {
 	} };
 	const group = {
 		create: async (ctx, data) => {
-			return {
-				ok: true,
-				groupId: await ctx.runMutation(config.component.public.groupCreate, data)
-			};
+			return { groupId: await ctx.runMutation(config.component.public.groupCreate, data) };
 		},
 		get: async (ctx, groupId) => {
 			const c = cache(ctx);
@@ -309,17 +262,11 @@ function createCoreDomains(deps) {
 				groupId,
 				data
 			});
-			return {
-				ok: true,
-				groupId
-			};
+			return { groupId };
 		},
 		delete: async (ctx, groupId) => {
 			await ctx.runMutation(config.component.public.groupDelete, { groupId });
-			return {
-				ok: true,
-				groupId
-			};
+			return { groupId };
 		},
 		ancestors: async (ctx, opts) => {
 			const maxDepth = Math.max(0, Math.floor(opts.maxDepth ?? 32));
@@ -362,19 +309,11 @@ function createCoreDomains(deps) {
 	};
 	const member = {
 		create: async (ctx, data) => {
-			const normalized = normalizeRoleIds(data.roleIds);
-			if (!normalized.ok) return {
-				ok: false,
-				code: "INVALID_ROLE_IDS",
-				invalidRoleIds: normalized.invalidRoleIds
-			};
-			return {
-				ok: true,
-				memberId: await ctx.runMutation(config.component.public.memberAdd, {
-					...data,
-					roleIds: normalized.roleIds
-				})
-			};
+			const roleIds = normalizeRoleIds(data.roleIds);
+			return { memberId: await ctx.runMutation(config.component.public.memberAdd, {
+				...data,
+				roleIds
+			}) };
 		},
 		get: async (ctx, memberId) => {
 			return await ctx.runQuery(config.component.public.memberGet, { memberId });
@@ -390,137 +329,84 @@ function createCoreDomains(deps) {
 		},
 		delete: async (ctx, memberId) => {
 			await ctx.runMutation(config.component.public.memberRemove, { memberId });
-			return {
-				ok: true,
-				memberId
-			};
+			return { memberId };
 		},
 		update: async (ctx, memberId, data) => {
 			const nextData = { ...data };
-			if ("roleIds" in nextData) {
-				const normalized = normalizeRoleIds(Array.isArray(nextData.roleIds) ? nextData.roleIds : void 0);
-				if (!normalized.ok) return {
-					ok: false,
-					code: "INVALID_ROLE_IDS",
-					invalidRoleIds: normalized.invalidRoleIds
-				};
-				nextData.roleIds = normalized.roleIds;
-			}
+			if ("roleIds" in nextData) nextData.roleIds = normalizeRoleIds(Array.isArray(nextData.roleIds) ? nextData.roleIds : void 0);
 			await ctx.runMutation(config.component.public.memberUpdate, {
 				memberId,
 				data: nextData
 			});
-			return {
-				ok: true,
-				memberId
-			};
+			return { memberId };
 		},
-		resolve: async (ctx, opts) => {
-			const normalized = normalizeRoleIds(opts.roleIds);
-			if (!normalized.ok) return {
-				ok: false,
-				membership: null,
-				matchedGroupId: null,
-				roleIds: [],
-				grants: [],
-				missingGrants: Array.from(new Set(opts.grants ?? [])),
-				depth: null,
-				isDirect: false,
-				isInherited: false,
-				traversedGroupIds: [],
-				code: "INVALID_ROLE_IDS",
-				invalidRoleIds: normalized.invalidRoleIds
-			};
-			const requestedRoleIds = normalized.roleIds;
-			const roleFilter = requestedRoleIds.length > 0 ? new Set(requestedRoleIds) : null;
-			const requiredGrants = Array.from(new Set(opts.grants ?? []));
+		inspect: async (ctx, opts) => {
 			const useAncestry = opts.ancestry === true;
 			let membership = null;
-			let matchedGroupId = null;
-			let depth = null;
-			let isDirect = false;
-			let isInherited = false;
-			let traversedGroupIds = [];
 			if (useAncestry) {
 				const maxDepth = Math.max(0, Math.floor(opts.maxDepth ?? 32));
-				const result = await ctx.runQuery(config.component.public.memberResolve, {
+				membership = (await ctx.runQuery(config.component.public.memberResolve, {
 					userId: opts.userId,
 					groupId: opts.groupId,
 					maxDepth,
 					ancestry: true
-				});
-				membership = result.membership;
-				matchedGroupId = result.matchedGroupId;
-				depth = result.depth;
-				isDirect = result.isDirect;
-				isInherited = result.isInherited;
-				traversedGroupIds = result.traversedGroupIds ?? [];
-			} else {
-				const doc = await ctx.runQuery(config.component.public.memberGetByGroupAndUser, {
-					userId: opts.userId,
-					groupId: opts.groupId
-				});
-				membership = doc;
-				matchedGroupId = doc ? opts.groupId : null;
-				depth = doc ? 0 : null;
-				isDirect = doc !== null;
-			}
+				})).membership;
+			} else membership = await ctx.runQuery(config.component.public.memberGetByGroupAndUser, {
+				userId: opts.userId,
+				groupId: opts.groupId
+			});
 			if (membership === null) return {
-				ok: false,
 				membership: null,
-				matchedGroupId: null,
 				roleIds: [],
-				grants: [],
-				missingGrants: requiredGrants,
-				depth: null,
-				isDirect: false,
-				isInherited: false,
-				traversedGroupIds
+				grants: []
 			};
 			const membershipRoleIds = membership.roleIds ?? [];
 			const membershipGrants = resolveGrantedPermissions(membershipRoleIds);
-			if (roleFilter !== null && !membershipRoleIds.some((roleId) => roleFilter.has(roleId))) return {
-				ok: false,
-				membership: null,
-				matchedGroupId: null,
-				roleIds: [],
-				grants: [],
-				missingGrants: requiredGrants,
-				depth: null,
-				isDirect: false,
-				isInherited: false,
-				traversedGroupIds
-			};
-			const missingGrants = requiredGrants.filter((grant) => !membershipGrants.includes(grant));
 			return {
-				ok: missingGrants.length === 0,
 				membership,
-				matchedGroupId,
 				roleIds: membershipRoleIds,
-				grants: membershipGrants,
-				missingGrants,
-				depth,
-				isDirect,
-				isInherited,
-				traversedGroupIds
+				grants: membershipGrants
 			};
+		},
+		require: async (ctx, opts) => {
+			const validatedRoleIds = normalizeRoleIds(opts.roleIds);
+			const requiredGrants = Array.from(new Set(opts.grants ?? []));
+			const roleFilter = validatedRoleIds.length > 0 ? new Set(validatedRoleIds) : null;
+			const result = await member.inspect(ctx, {
+				userId: opts.userId,
+				groupId: opts.groupId,
+				ancestry: opts.ancestry,
+				maxDepth: opts.maxDepth
+			});
+			if (result.membership === null) throw Cv.error({
+				code: "NOT_A_MEMBER",
+				message: "User is not a member of this group.",
+				groupId: opts.groupId
+			});
+			if (roleFilter !== null && !result.roleIds.some((roleId) => roleFilter.has(roleId))) throw Cv.error({
+				code: "NOT_A_MEMBER",
+				message: "User is not a member of this group.",
+				groupId: opts.groupId
+			});
+			const missingGrants = requiredGrants.filter((grant) => !result.grants.includes(grant));
+			if (missingGrants.length > 0) throw Cv.error({
+				code: "MISSING_GRANTS",
+				message: "User is missing required grants.",
+				groupId: opts.groupId,
+				missingGrants
+			});
+			return result;
 		}
 	};
 	const invite = {
 		create: async (ctx, data) => {
-			const normalized = normalizeRoleIds(data.roleIds);
-			if (!normalized.ok) return {
-				ok: false,
-				code: "INVALID_ROLE_IDS",
-				invalidRoleIds: normalized.invalidRoleIds
-			};
+			const roleIds = normalizeRoleIds(data.roleIds);
 			const token = generateRandomString(inviteTokenLength, inviteTokenAlphabet);
 			const tokenHash = await sha256(token);
 			return {
-				ok: true,
 				inviteId: await ctx.runMutation(config.component.public.inviteCreate, {
 					...data,
-					roleIds: normalized.roleIds,
+					roleIds,
 					tokenHash,
 					status: "pending"
 				}),
@@ -537,13 +423,10 @@ function createCoreDomains(deps) {
 			},
 			accept: async (ctx, args) => {
 				const tokenHash = await sha256(args.token);
-				return {
-					ok: true,
-					...await ctx.runMutation(config.component.public.inviteAcceptByToken, {
-						tokenHash,
-						acceptedByUserId: args.acceptedByUserId
-					})
-				};
+				return { ...await ctx.runMutation(config.component.public.inviteAcceptByToken, {
+					tokenHash,
+					acceptedByUserId: args.acceptedByUserId
+				}) };
 			}
 		},
 		list: async (ctx, opts) => {
@@ -561,24 +444,19 @@ function createCoreDomains(deps) {
 				...acceptedByUserId ? { acceptedByUserId } : {}
 			});
 			return {
-				ok: true,
 				inviteId,
 				acceptedByUserId: acceptedByUserId ?? null
 			};
 		},
 		revoke: async (ctx, inviteId) => {
 			await ctx.runMutation(config.component.public.inviteRevoke, { inviteId });
-			return {
-				ok: true,
-				inviteId
-			};
+			return { inviteId };
 		}
 	};
 	const key = {
 		create: async (ctx, opts) => {
 			const { raw, hashedKey, displayPrefix } = await generateApiKey("sk_");
 			return {
-				ok: true,
 				keyId: await ctx.runMutation(config.component.public.keyInsert, {
 					userId: opts.userId,
 					prefix: displayPrefix,
@@ -595,26 +473,26 @@ function createCoreDomains(deps) {
 		verify: async (ctx, rawKey) => {
 			const hashedKey = await hashApiKey(rawKey);
 			const doc = await ctx.runQuery(config.component.public.keyGetByHashedKey, { hashedKey });
-			if (!doc) return {
-				ok: false,
-				code: "INVALID_API_KEY"
-			};
+			if (!doc) throw Cv.error({
+				code: "INVALID_API_KEY",
+				message: "Invalid API key."
+			});
 			const k = doc;
-			if (k.revoked) return {
-				ok: false,
-				code: "API_KEY_REVOKED"
-			};
-			if (k.expiresAt && k.expiresAt < Date.now()) return {
-				ok: false,
-				code: "API_KEY_EXPIRED"
-			};
+			if (k.revoked) throw Cv.error({
+				code: "API_KEY_REVOKED",
+				message: "This API key has been revoked."
+			});
+			if (k.expiresAt && k.expiresAt < Date.now()) throw Cv.error({
+				code: "API_KEY_EXPIRED",
+				message: "This API key has expired."
+			});
 			const patchData = { lastUsedAt: Date.now() };
 			if (k.rateLimit) {
 				const { limited, newState } = checkKeyRateLimit(k.rateLimit, k.rateLimitState ?? void 0);
-				if (limited) return {
-					ok: false,
-					code: "API_KEY_RATE_LIMITED"
-				};
+				if (limited) throw Cv.error({
+					code: "API_KEY_RATE_LIMITED",
+					message: "API key rate limit exceeded. Please try again later."
+				});
 				patchData.rateLimitState = newState;
 			}
 			await ctx.runMutation(config.component.public.keyPatch, {
@@ -622,7 +500,6 @@ function createCoreDomains(deps) {
 				data: patchData
 			});
 			return {
-				ok: true,
 				userId: k.userId,
 				keyId: k._id,
 				scopes: buildScopeChecker(k.scopes)
@@ -638,50 +515,36 @@ function createCoreDomains(deps) {
 			});
 		},
 		get: async (ctx, keyId) => {
-			const doc = await ctx.runQuery(config.component.public.keyGetById, { keyId });
-			if (!doc) return { ok: false };
-			return {
-				ok: true,
-				key: doc
-			};
+			return await ctx.runQuery(config.component.public.keyGetById, { keyId }) ?? null;
 		},
 		update: async (ctx, keyId, data) => {
 			await ctx.runMutation(config.component.public.keyPatch, {
 				keyId,
 				data
 			});
-			return {
-				ok: true,
-				keyId
-			};
+			return { keyId };
 		},
 		revoke: async (ctx, keyId) => {
 			await ctx.runMutation(config.component.public.keyPatch, {
 				keyId,
 				data: { revoked: true }
 			});
-			return {
-				ok: true,
-				keyId
-			};
+			return { keyId };
 		},
 		delete: async (ctx, keyId) => {
 			await ctx.runMutation(config.component.public.keyDelete, { keyId });
-			return {
-				ok: true,
-				keyId
-			};
+			return { keyId };
 		},
 		rotate: async (ctx, keyId, opts) => {
 			const existing = await ctx.runQuery(config.component.public.keyGetById, { keyId });
-			if (!existing) return {
-				ok: false,
-				code: "INVALID_PARAMETERS"
-			};
-			if (existing.revoked === true) return {
-				ok: false,
-				code: "API_KEY_REVOKED"
-			};
+			if (!existing) throw Cv.error({
+				code: "INVALID_PARAMETERS",
+				message: "The provided parameters are invalid."
+			});
+			if (existing.revoked === true) throw Cv.error({
+				code: "API_KEY_REVOKED",
+				message: "This API key has been revoked."
+			});
 			await ctx.runMutation(config.component.public.keyPatch, {
 				keyId,
 				data: { revoked: true }