@robelest/convex-auth 0.0.4-preview.25 → 0.0.4-preview.28

package/dist/component/public/identity/tokens.js

@@ -1,5 +1,5 @@
-import { mutation, query } from "../../functions.js";
 import { vRefreshTokenDoc } from "../../model.js";
+import { mutation, query } from "../../functions.js";
 import { v } from "convex/values";
 
 //#region src/component/public/identity/tokens.ts
@@ -159,7 +159,7 @@ const refreshTokenListBySession = query({
 	args: { sessionId: v.id("Session") },
 	returns: v.array(vRefreshTokenDoc),
 	handler: async (ctx, { sessionId }) => {
-		return await ctx.db.query("RefreshToken").withIndex("session_id_parent_refresh_token_id", (q) => q.eq("sessionId", sessionId)).collect();
+		return await ctx.db.query("RefreshToken").withIndex("session_id", (q) => q.eq("sessionId", sessionId)).collect();
 	}
 });
 /**
@@ -186,11 +186,89 @@ const refreshTokenDeleteAll = mutation({
 	args: { sessionId: v.id("Session") },
 	returns: v.null(),
 	handler: async (ctx, { sessionId }) => {
-		const tokens = await ctx.db.query("RefreshToken").withIndex("session_id_parent_refresh_token_id", (q) => q.eq("sessionId", sessionId)).collect();
+		const tokens = await ctx.db.query("RefreshToken").withIndex("session_id", (q) => q.eq("sessionId", sessionId)).collect();
 		await Promise.all(tokens.map((token) => ctx.db.delete("RefreshToken", token._id)));
 		return null;
 	}
 });
+const refreshSessionExchangeResult = v.union(v.object({
+	userId: v.id("User"),
+	sessionId: v.id("Session"),
+	refreshTokenId: v.id("RefreshToken")
+}), v.null());
+const refreshTokenExchange = mutation({
+	args: {
+		refreshTokenId: v.id("RefreshToken"),
+		sessionId: v.id("Session"),
+		now: v.number(),
+		refreshTokenExpirationTime: v.number(),
+		reuseWindowMs: v.number()
+	},
+	returns: refreshSessionExchangeResult,
+	handler: async (ctx, args) => {
+		const cleanupSessionArtifacts = async () => {
+			if (await ctx.db.get("Session", args.sessionId) !== null) await ctx.db.delete("Session", args.sessionId);
+			const tokens = await ctx.db.query("RefreshToken").withIndex("session_id", (q) => q.eq("sessionId", args.sessionId)).collect();
+			await Promise.all(tokens.map((token) => ctx.db.delete("RefreshToken", token._id)));
+		};
+		const refreshTokenDoc = await ctx.db.get("RefreshToken", args.refreshTokenId);
+		if (refreshTokenDoc === null || refreshTokenDoc.expirationTime < args.now || refreshTokenDoc.sessionId !== args.sessionId) {
+			await cleanupSessionArtifacts();
+			return null;
+		}
+		const session = await ctx.db.get("Session", args.sessionId);
+		if (session === null || session.expirationTime < args.now) {
+			await cleanupSessionArtifacts();
+			return null;
+		}
+		const issueRefreshToken = () => ctx.db.insert("RefreshToken", {
+			sessionId: args.sessionId,
+			expirationTime: args.refreshTokenExpirationTime,
+			parentRefreshTokenId: args.refreshTokenId
+		});
+		if (refreshTokenDoc.firstUsedTime === void 0) {
+			await ctx.db.patch("RefreshToken", args.refreshTokenId, { firstUsedTime: args.now });
+			const refreshTokenId = await issueRefreshToken();
+			return {
+				userId: session.userId,
+				sessionId: args.sessionId,
+				refreshTokenId
+			};
+		}
+		const activeRefreshToken = await ctx.db.query("RefreshToken").withIndex("session_id_first_used", (q) => q.eq("sessionId", args.sessionId).eq("firstUsedTime", void 0)).order("desc").first();
+		if (activeRefreshToken !== null && activeRefreshToken.parentRefreshTokenId === args.refreshTokenId) return {
+			userId: session.userId,
+			sessionId: args.sessionId,
+			refreshTokenId: activeRefreshToken._id
+		};
+		if (refreshTokenDoc.firstUsedTime + args.reuseWindowMs > args.now) {
+			const refreshTokenId = await issueRefreshToken();
+			return {
+				userId: session.userId,
+				sessionId: args.sessionId,
+				refreshTokenId
+			};
+		}
+		const tokensToInvalidate = [refreshTokenDoc];
+		const visited = new Set([refreshTokenDoc._id]);
+		let frontier = [refreshTokenDoc._id];
+		while (frontier.length > 0) {
+			const nextFrontier = [];
+			for (const parentRefreshTokenId of frontier) {
+				const children = await ctx.db.query("RefreshToken").withIndex("session_id_parent_refresh_token_id", (q) => q.eq("sessionId", args.sessionId).eq("parentRefreshTokenId", parentRefreshTokenId)).collect();
+				for (const child of children) {
+					if (visited.has(child._id)) continue;
+					visited.add(child._id);
+					tokensToInvalidate.push(child);
+					nextFrontier.push(child._id);
+				}
+			}
+			frontier = nextFrontier;
+		}
+		await Promise.all(tokensToInvalidate.filter((token) => token.firstUsedTime === void 0 || token.firstUsedTime > args.now - args.reuseWindowMs).map((token) => ctx.db.patch("RefreshToken", token._id, { firstUsedTime: args.now - args.reuseWindowMs })));
+		return null;
+	}
+});
 /**
 * Get the active (unused) refresh token for a session.
 *
@@ -223,5 +301,5 @@ const refreshTokenGetActive = query({
 });
 
 //#endregion
-export { refreshTokenCreate, refreshTokenDeleteAll, refreshTokenGetActive, refreshTokenGetById, refreshTokenGetChildren, refreshTokenListBySession, refreshTokenPatch };
+export { refreshTokenCreate, refreshTokenDeleteAll, refreshTokenExchange, refreshTokenGetActive, refreshTokenGetById, refreshTokenGetChildren, refreshTokenListBySession, refreshTokenPatch };
 //# sourceMappingURL=tokens.js.map

package/dist/component/public/identity/users.js

@@ -1,5 +1,5 @@
-import { mutation, query } from "../../functions.js";
 import { vPaginated, vUserDoc } from "../../model.js";
+import { mutation, query } from "../../functions.js";
 import { v } from "convex/values";
 
 //#region src/component/public/identity/users.ts

package/dist/component/public/identity/verifiers.js

@@ -1,5 +1,5 @@
-import { mutation, query } from "../../functions.js";
 import { vAuthVerifierDoc } from "../../model.js";
+import { mutation, query } from "../../functions.js";
 import { v } from "convex/values";
 
 //#region src/component/public/identity/verifiers.ts
@@ -24,10 +24,16 @@ import { v } from "convex/values";
 * ```
 */
 const verifierCreate = mutation({
-	args: { sessionId: v.optional(v.id("Session")) },
+	args: {
+		sessionId: v.optional(v.id("Session")),
+		signature: v.optional(v.string())
+	},
 	returns: v.id("AuthVerifier"),
-	handler: async (ctx, { sessionId }) => {
-		return await ctx.db.insert("AuthVerifier", { sessionId });
+	handler: async (ctx, { sessionId, signature }) => {
+		return await ctx.db.insert("AuthVerifier", {
+			sessionId,
+			signature
+		});
 	}
 });
 /**

package/dist/component/public/security/keys.js

@@ -1,5 +1,5 @@
-import { mutation, query } from "../../functions.js";
 import { vApiKeyDoc, vApiKeyRateLimit, vApiKeyRateLimitState, vApiKeyScope, vPaginated } from "../../model.js";
+import { mutation, query } from "../../functions.js";
 import { ConvexError, v } from "convex/values";
 
 //#region src/component/public/security/keys.ts

package/dist/component/public/security/limits.js

@@ -1,5 +1,5 @@
-import { mutation, query } from "../../functions.js";
 import { vRateLimitResult } from "../../model.js";
+import { mutation, query } from "../../functions.js";
 import { v } from "convex/values";
 
 //#region src/component/public/security/limits.ts

package/dist/component/public/{enterprise → sso}/audit.js

@@ -1,17 +1,17 @@
+import { vAuditActorType, vAuditStatus, vGroupAuditEventDoc } from "../../model.js";
 import { mutation, query } from "../../functions.js";
-import { vAuditActorType, vAuditStatus, vEnterpriseAuditEventDoc } from "../../model.js";
 import { v } from "convex/values";
 
-//#region src/component/public/enterprise/audit.ts
+//#region src/component/public/sso/audit.ts
 /**
-* Record a new audit event for an enterprise.
+* Record a new audit event for an group.sso.
 *
 * Inserts an immutable audit log entry capturing who performed what action,
 * on which subject, and whether it succeeded or failed. Use this to maintain
 * a tamper-evident trail of security-relevant events.
 *
-* @param args.enterpriseId - The ID of the enterprise this event belongs to.
-* @param args.groupId - The ID of the root group that owns the enterprise.
+* @param args.connectionId - Optional connection ID when the event belongs to a specific group connection.
+* @param args.groupId - The ID of the root group that owns the group.sso.
 * @param args.eventType - A string identifying the type of event (e.g. `"user.login"`, `"scim.provision"`).
 * @param args.actorType - The kind of actor: `"user"`, `"system"`, `"scim"`, `"api_key"`, or `"webhook"`.
 * @param args.actorId - An optional identifier for the actor (e.g. a user ID or API key ID).
@@ -22,14 +22,14 @@ import { v } from "convex/values";
 * @param args.requestId - An optional correlation ID tying this event to a specific request.
 * @param args.ip - An optional IP address of the actor.
 * @param args.metadata - An optional arbitrary object with additional event details.
-* @returns The ID of the newly created `EnterpriseAuditEvent` document.
+* @returns The ID of the newly created `GroupAuditEvent` document.
 *
 * @example
 * ```ts
 * const eventId = await ctx.runMutation(
-*   components.auth.enterprise.enterpriseAuditEventCreate,
+*   components.auth.group.sso.groupAuditEventCreate,
 *   {
-*     enterpriseId,
+*     connectionId,
 *     groupId: orgGroupId,
 *     eventType: "user.login",
 *     actorType: "user",
@@ -43,9 +43,9 @@ import { v } from "convex/values";
 * );
 * ```
 */
-const enterpriseAuditEventCreate = mutation({
+const groupAuditEventCreate = mutation({
 	args: {
-		enterpriseId: v.id("Enterprise"),
+		connectionId: v.optional(v.id("GroupConnection")),
 		groupId: v.id("Group"),
 		eventType: v.string(),
 		actorType: vAuditActorType,
@@ -58,21 +58,21 @@ const enterpriseAuditEventCreate = mutation({
 		ip: v.optional(v.string()),
 		metadata: v.optional(v.any())
 	},
-	returns: v.id("EnterpriseAuditEvent"),
+	returns: v.id("GroupAuditEvent"),
 	handler: async (ctx, args) => {
-		return await ctx.db.insert("EnterpriseAuditEvent", args);
+		return await ctx.db.insert("GroupAuditEvent", args);
 	}
 });
 /**
-* List audit events, optionally filtered by enterprise or group.
+* List audit events, optionally filtered by group connection or group.
 *
-* Returns audit events in reverse chronological order. When `enterpriseId` is
-* provided, events are filtered using the `enterprise_id_occurred_at` index.
+* Returns audit events in reverse chronological order. When `connectionId` is
+* provided, events are filtered using the `group_connection_id_occurred_at` index.
 * When only `groupId` is provided, the `group_id_occurred_at` index is used.
-* If neither filter is given, the most recent events across all enterprises
+* If neither filter is given, the most recent events across all group connections
 * are returned.
 *
-* @param args.enterpriseId - An optional enterprise ID to scope events to a single enterprise.
+* @param args.connectionId - An optional group connection ID to scope events to a single group.sso.
 * @param args.groupId - An optional group ID to scope events to a single group.
 * @param args.limit - Maximum number of events to return (clamped between 1 and 100, defaults to 50).
 * @returns An array of audit event documents, most recent first.
@@ -80,29 +80,29 @@ const enterpriseAuditEventCreate = mutation({
 * @example
 * ```ts
 * const events = await ctx.runQuery(
-*   components.auth.enterprise.enterpriseAuditEventList,
-*   { enterpriseId, limit: 20 },
+*   components.auth.group.sso.groupAuditEventList,
+*   { connectionId, limit: 20 },
 * );
 * for (const event of events) {
 *   console.log(event.eventType, event.actorType, event.status);
 * }
 * ```
 */
-const enterpriseAuditEventList = query({
+const groupAuditEventList = query({
 	args: {
-		enterpriseId: v.optional(v.id("Enterprise")),
+		connectionId: v.optional(v.id("GroupConnection")),
 		groupId: v.optional(v.id("Group")),
 		limit: v.optional(v.number())
 	},
-	returns: v.array(vEnterpriseAuditEventDoc),
+	returns: v.array(vGroupAuditEventDoc),
 	handler: async (ctx, args) => {
 		const limit = Math.min(Math.max(args.limit ?? 50, 1), 100);
-		if (args.enterpriseId !== void 0) return await ctx.db.query("EnterpriseAuditEvent").withIndex("enterprise_id_occurred_at", (idx) => idx.eq("enterpriseId", args.enterpriseId)).order("desc").take(limit);
-		if (args.groupId !== void 0) return await ctx.db.query("EnterpriseAuditEvent").withIndex("group_id_occurred_at", (idx) => idx.eq("groupId", args.groupId)).order("desc").take(limit);
-		return await ctx.db.query("EnterpriseAuditEvent").order("desc").take(limit);
+		if (args.connectionId !== void 0) return await ctx.db.query("GroupAuditEvent").withIndex("group_connection_id_occurred_at", (idx) => idx.eq("connectionId", args.connectionId)).order("desc").take(limit);
+		if (args.groupId !== void 0) return await ctx.db.query("GroupAuditEvent").withIndex("group_id_occurred_at", (idx) => idx.eq("groupId", args.groupId)).order("desc").take(limit);
+		return await ctx.db.query("GroupAuditEvent").order("desc").take(limit);
 	}
 });
 
 //#endregion
-export { enterpriseAuditEventCreate, enterpriseAuditEventList };
+export { groupAuditEventCreate, groupAuditEventList };
 //# sourceMappingURL=audit.js.map

package/dist/component/public/sso/core.js

@@ -0,0 +1,263 @@
+import { vGroupConnectionDoc, vGroupConnectionDomainDoc, vGroupConnectionProtocol, vGroupConnectionStatus, vPaginated } from "../../model.js";
+import { mutation, query } from "../../functions.js";
+import { v } from "convex/values";
+
+//#region src/component/public/sso/core.ts
+/**
+* Create a new group connection record attached to a root group.
+*
+* Creates a new group SSO connection attached to a root group.
+* The group connection status defaults to `"draft"` when not explicitly provided.
+*
+* @param args.groupId - The ID of the root group that owns this group.sso.
+* @param args.slug - An optional URL-friendly identifier for the group.sso.
+* @param args.name - An optional human-readable display name for the group.sso.
+* @param args.protocol - The protocol for this group connection (`"oidc"` or `"saml"`).
+* @param args.status - The lifecycle status (`"draft"`, `"active"`, or `"disabled"`). Defaults to `"draft"`.
+* @param args.config - An optional arbitrary configuration blob for group connection-specific settings.
+* @param args.extend - An optional arbitrary extension object for custom fields.
+* @returns The ID of the newly created `Group Connection` document.
+*
+* @example
+* ```ts
+* const connectionId = await ctx.runMutation(
+*   components.auth.group.sso.groupConnectionCreate,
+*   {
+*     groupId: orgGroupId,
+*     slug: "acme-corp",
+*     name: "Acme Corporation",
+*     status: "active",
+*   },
+* );
+* ```
+*/
+const groupConnectionCreate = mutation({
+	args: {
+		groupId: v.id("Group"),
+		slug: v.optional(v.string()),
+		name: v.optional(v.string()),
+		protocol: vGroupConnectionProtocol,
+		status: v.optional(vGroupConnectionStatus),
+		config: v.optional(v.any()),
+		extend: v.optional(v.any())
+	},
+	returns: v.id("GroupConnection"),
+	handler: async (ctx, args) => {
+		return await ctx.db.insert("GroupConnection", {
+			...args,
+			status: args.status ?? "draft"
+		});
+	}
+});
+/**
+* Retrieve a single group connection record by its document ID.
+*
+* Returns the full group connection document if it exists, or `null` if no
+* group connection is found with the given ID.
+*
+* @param args.connectionId - The document ID of the group connection to retrieve.
+* @returns The group connection document, or `null` if not found.
+*
+* @example
+* ```ts
+* const connection = await ctx.runQuery(
+*   components.auth.group.sso.groupConnectionGet,
+*   { connectionId },
+* );
+* if (connection) {
+*   console.log(group.sso.name, group.sso.status);
+* }
+* ```
+*/
+const groupConnectionGet = query({
+	args: { connectionId: v.id("GroupConnection") },
+	returns: v.union(vGroupConnectionDoc, v.null()),
+	handler: async (ctx, { connectionId }) => {
+		return await ctx.db.get("GroupConnection", connectionId);
+	}
+});
+/**
+* Retrieve an group connection record by one of its linked domain names.
+*
+* Looks up a `GroupConnectionDomain` row matching the given domain string, then
+* resolves the parent group.sso. Returns both the group connection and the matched
+* domain document, or `null` if the domain is not registered or its group connection
+* no longer exists.
+*
+* @param args.domain - The domain name to search for (e.g. `"acme.com"`).
+* @returns An object containing the `group connection` and `domain` documents, or `null` if not found.
+*
+* @example
+* ```ts
+* const result = await ctx.runQuery(
+*   components.auth.group.sso.groupConnectionGetByDomain,
+*   { domain: "acme.com" },
+* );
+* if (result) {
+*   console.log(result.connection.name, result.domain.verifiedAt);
+* }
+* ```
+*/
+const groupConnectionGetByDomain = query({
+	args: { domain: v.string() },
+	returns: v.union(v.object({
+		connection: vGroupConnectionDoc,
+		domain: vGroupConnectionDomainDoc
+	}), v.null()),
+	handler: async (ctx, { domain }) => {
+		const domainRow = await ctx.db.query("GroupConnectionDomain").withIndex("domain", (idx) => idx.eq("domain", domain)).first();
+		if (!domainRow) return null;
+		const connection = await ctx.db.get("GroupConnection", domainRow.connectionId);
+		if (!connection) return null;
+		return {
+			connection,
+			domain: domainRow
+		};
+	}
+});
+/**
+* List group connection records with optional filtering and cursor-based pagination.
+*
+* Supports filtering by `groupId`, `slug`, and/or `status`. The query selects
+* the most specific index available for the primary filter, then applies
+* remaining predicates as post-filters. Results are ordered by creation time
+* (or the specified field) and paginated using an opaque cursor.
+*
+* @param args.where - Optional filter criteria: `groupId`, `slug`, and/or `status`.
+* @param args.limit - Maximum number of items per page (clamped between 1 and 100, defaults to 50).
+* @param args.cursor - An opaque cursor string returned from a previous call to fetch the next page, or `null` / omitted for the first page.
+* @param args.orderBy - The field to sort results by: `"_creationTime"`, `"name"`, `"slug"`, or `"status"`.
+* @param args.order - Sort direction: `"asc"` or `"desc"` (defaults to `"desc"`).
+* @returns A paginated result containing `items` (array of group connection documents) and `nextCursor` (`string | null`).
+*
+* @example
+* ```ts
+* const page = await ctx.runQuery(
+*   components.auth.group.sso.groupConnectionList,
+*   {
+*     where: { status: "active" },
+*     limit: 25,
+*     order: "asc",
+*   },
+* );
+* for (const ent of page.items) {
+*   console.log(ent.name);
+* }
+* // Fetch next page:
+* const nextPage = await ctx.runQuery(
+*   components.auth.group.sso.groupConnectionList,
+*   { where: { status: "active" }, cursor: page.nextCursor },
+* );
+* ```
+*/
+const groupConnectionList = query({
+	args: {
+		where: v.optional(v.object({
+			groupId: v.optional(v.id("Group")),
+			slug: v.optional(v.string()),
+			status: v.optional(vGroupConnectionStatus)
+		})),
+		limit: v.optional(v.number()),
+		cursor: v.optional(v.union(v.string(), v.null())),
+		orderBy: v.optional(v.union(v.literal("_creationTime"), v.literal("name"), v.literal("slug"), v.literal("status"))),
+		order: v.optional(v.union(v.literal("asc"), v.literal("desc")))
+	},
+	returns: vPaginated(vGroupConnectionDoc),
+	handler: async (ctx, args) => {
+		const where = args.where ?? {};
+		const limit = Math.min(Math.max(args.limit ?? 50, 1), 100);
+		const order = args.order ?? "desc";
+		let q;
+		if (where.groupId !== void 0) q = ctx.db.query("GroupConnection").withIndex("group_id", (idx) => idx.eq("groupId", where.groupId));
+		else if (where.slug !== void 0) q = ctx.db.query("GroupConnection").withIndex("slug", (idx) => idx.eq("slug", where.slug));
+		else if (where.status !== void 0) q = ctx.db.query("GroupConnection").withIndex("status", (idx) => idx.eq("status", where.status));
+		else q = ctx.db.query("GroupConnection");
+		if (where.groupId !== void 0 && where.slug !== void 0) q = q.filter((f) => f.eq(f.field("slug"), where.slug));
+		if (where.status !== void 0 && where.groupId === void 0) {} else if (where.status !== void 0) q = q.filter((f) => f.eq(f.field("status"), where.status));
+		q = q.order(order);
+		const all = await q.collect();
+		let startIdx = 0;
+		if (args.cursor) {
+			const cursorIdx = all.findIndex((doc) => doc._id === args.cursor);
+			if (cursorIdx !== -1) startIdx = cursorIdx + 1;
+		}
+		const page = all.slice(startIdx, startIdx + limit + 1);
+		const hasMore = page.length > limit;
+		const items = hasMore ? page.slice(0, limit) : page;
+		return {
+			items,
+			nextCursor: hasMore ? items[items.length - 1]._id : null
+		};
+	}
+});
+/**
+* Partially update (patch) an existing group connection record.
+*
+* Merges the provided `data` fields into the existing group connection document.
+* Only the fields present in `data` are changed; all other fields are preserved.
+*
+* @param args.connectionId - The document ID of the group connection to update.
+* @param args.data - An object containing the fields to update (e.g. `{ name, status, policy }`).
+* @returns `null` on success.
+*
+* @example
+* ```ts
+* await ctx.runMutation(
+*   components.auth.group.sso.groupConnectionUpdate,
+*   {
+*     connectionId,
+*     data: { status: "active", name: "Acme Corp (Renamed)" },
+*   },
+* );
+* ```
+*/
+const groupConnectionUpdate = mutation({
+	args: {
+		connectionId: v.id("GroupConnection"),
+		data: v.any()
+	},
+	returns: v.null(),
+	handler: async (ctx, { connectionId, data }) => {
+		await ctx.db.patch(connectionId, data);
+		return null;
+	}
+});
+/**
+* Delete an group connection record and all of its associated child data.
+*
+* This cascading delete removes the group connection document along with all linked
+* domain records, domain verification records, and group connection secrets. Callers
+* should ensure that higher-level cleanup (e.g. SCIM identities, webhook
+* endpoints) is handled separately if needed.
+*
+* @param args.connectionId - The document ID of the group connection to delete.
+* @returns `null` on success.
+*
+* @example
+* ```ts
+* await ctx.runMutation(
+*   components.auth.group.sso.groupConnectionDelete,
+*   { connectionId },
+* );
+* ```
+*/
+const groupConnectionDelete = mutation({
+	args: { connectionId: v.id("GroupConnection") },
+	returns: v.null(),
+	handler: async (ctx, { connectionId }) => {
+		const domains = await ctx.db.query("GroupConnectionDomain").withIndex("connection_id", (idx) => idx.eq("connectionId", connectionId)).collect();
+		for (const domain of domains) {
+			const verification = await ctx.db.query("GroupConnectionDomainVerification").withIndex("domain_id", (idx) => idx.eq("domainId", domain._id)).first();
+			if (verification) await ctx.db.delete(verification._id);
+			await ctx.db.delete(domain._id);
+		}
+		const secrets = await ctx.db.query("GroupConnectionSecret").withIndex("connection_id", (idx) => idx.eq("connectionId", connectionId)).collect();
+		for (const secret of secrets) await ctx.db.delete(secret._id);
+		await ctx.db.delete(connectionId);
+		return null;
+	}
+});
+
+//#endregion
+export { groupConnectionCreate, groupConnectionDelete, groupConnectionGet, groupConnectionGetByDomain, groupConnectionList, groupConnectionUpdate };
+//# sourceMappingURL=core.js.map