@robelest/convex-auth 0.0.4-preview.25 → 0.0.4-preview.28

package/src/providers/device.ts

@@ -1,87 +0,0 @@
-/**
- * Device authorization provider (RFC 8628).
- *
- * Enables input-constrained devices (CLIs, TVs, IoT) to authenticate
- * by displaying a short code that the user enters on a secondary device.
- *
- * ```ts
- * import { Device } from "@robelest/convex-auth/providers";
- *
- * new Device()
- * ```
- *
- * @module
- */
-
-import type { DeviceProviderConfig } from "../server/types";
-
-/**
- * Configuration for the Device authorization provider.
- */
-export interface DeviceConfig {
-  /**
-   * User code character set.
-   * Default: `"BCDFGHJKLMNPQRSTVWXZ"` (base-20, no vowels per RFC 8628 §6.1).
-   */
-  charset?: string;
-  /** User code length (before formatting). Default: 8. */
-  userCodeLength?: number;
-  /** Device code + user code lifetime in seconds. Default: 900 (15 min). */
-  expiresIn?: number;
-  /** Minimum polling interval in seconds. Default: 5. */
-  interval?: number;
-  /**
-   * Base URL for the verification page where users enter the device code.
-   *
-   * Example: `"http://localhost:3000/device"` or `"https://myapp.com/device"`.
-   *
-   * If not provided, falls back to `SITE_URL + "/device"`.
-   */
-  verificationUri?: string;
-}
-
-/** No-vowel base-20 charset per RFC 8628 §6.1 recommendation. */
-const DEFAULT_CHARSET = "BCDFGHJKLMNPQRSTVWXZ";
-
-/**
- * Device authorization provider (RFC 8628).
- *
- * Enables input-constrained devices (CLIs, TVs, IoT) to authenticate
- * by displaying a short user code. The user visits a verification page
- * on a secondary device, signs in with any existing provider, and
- * enters the code to authorize the device.
- *
- * @example
- * ```ts
- * import { createAuth } from "@robelest/convex-auth/component";
- * import { Device } from "@robelest/convex-auth/providers";
- * import { components } from "./_generated/api";
- *
- * const auth = createAuth(components.auth, {
- *   providers: [new Device()],
- * });
- * ```
- */
-export class Device {
-  readonly id: string;
-  readonly type = "device" as const;
-  readonly config: DeviceConfig;
-
-  constructor(config: DeviceConfig = {}) {
-    this.id = "device";
-    this.config = config;
-  }
-
-  /** @internal Convert to the internal materialized config shape. */
-  _toMaterialized(): DeviceProviderConfig {
-    return {
-      id: this.id,
-      type: "device",
-      charset: this.config.charset ?? DEFAULT_CHARSET,
-      userCodeLength: this.config.userCodeLength ?? 8,
-      expiresIn: this.config.expiresIn ?? 900,
-      interval: this.config.interval ?? 5,
-      verificationUri: this.config.verificationUri,
-    };
-  }
-}

package/src/providers/email.ts

@@ -1,99 +0,0 @@
-/**
- * Email (magic link / OTP) authentication provider.
- *
- * @module
- */
-
-import { defaultMagicLinkEmail } from "../server/templates";
-import type { EmailConfig } from "../server/types";
-
-/**
- * User-facing configuration for the {@link Email} provider.
- *
- * Use this to wire your email delivery service into Convex Auth's magic-link
- * or OTP flow.
- */
-export interface EmailProviderConfig {
-  /** Sender address (e.g. "My App <noreply@example.com>"). */
-  from: string;
-  /** Send the verification email. Receives the Convex action context. */
-  send: (
-    ctx: any,
-    opts: { from: string; to: string; subject: string; html: string },
-  ) => Promise<void>;
-  /** Override to generate a custom verification token. */
-  generateVerificationToken?: () => Promise<string>;
-  /** Provider ID override. Defaults to "email". */
-  id?: string;
-  /** Token expiration in seconds. Defaults to 86400 (24 hours). */
-  maxAge?: number;
-}
-
-/**
- * Email provider for magic-link or one-time-code sign-in.
- *
- * Sends verification emails through your `send()` implementation and converts
- * the result into Convex Auth's internal email-provider runtime shape.
- *
- * @example
- * ```ts
- * import { Email } from "@robelest/convex-auth/providers";
- *
- * const email = new Email({
- *   from: "My App <noreply@example.com>",
- *   send: async (_ctx, { to, subject, html }) => {
- *     await resend.emails.send({ from: "noreply@example.com", to, subject, html });
- *   },
- * });
- * ```
- */
-export class Email {
-  readonly id: string;
-  readonly type = "email" as const;
-
-  /**
-   * Create an email provider instance.
-   *
-   * @param config - Email transport and provider settings.
-   * @throws {Error} When `config.from` is empty or whitespace-only.
-   */
-  constructor(public readonly config: EmailProviderConfig) {
-    const from = config.from.trim();
-    if (from.length === 0) {
-      throw new Error(
-        "Email provider requires a non-empty `from` address " +
-          '(for example, `"My App <noreply@example.com>"`).',
-      );
-    }
-    this.id = config.id ?? "email";
-  }
-
-  /** @internal */
-  _toMaterialized(): EmailConfig {
-    const from = this.config.from.trim();
-    const { send } = this.config;
-    const { generateVerificationToken } = this.config;
-    return {
-      id: this.id,
-      type: "email",
-      name: "Email",
-      from,
-      maxAge: this.config.maxAge ?? 60 * 60 * 24,
-      authorize: undefined,
-      sendVerificationRequest: async ({ identifier, url }, ctx) => {
-        if (!ctx) {
-          throw new Error("Email provider requires a Convex action context.");
-        }
-        const { host } = new URL(url);
-        await send(ctx, {
-          from,
-          to: identifier,
-          subject: `Sign in to ${host}`,
-          html: defaultMagicLinkEmail(url, host),
-        });
-      },
-      generateVerificationToken,
-      options: { from } as any,
-    };
-  }
-}

package/src/providers/index.ts

@@ -1,31 +0,0 @@
-/**
- * Provider exports for `@robelest/convex-auth/providers`.
- *
- * All non-OAuth providers are classes following the Arctic pattern.
- * OAuth providers are wrapped via the `OAuth()` factory which attaches
- * scopes and profile config to an Arctic provider instance.
- *
- * @module
- */
-
-export { OAuth } from "./oauth";
-export type { OAuthConfig } from "./oauth";
-export { Password } from "./password";
-export type { PasswordConfig } from "./password";
-export { Passkey } from "./passkey";
-export type { PasskeyConfig } from "./passkey";
-export { Totp } from "./totp";
-export type { TotpConfig } from "./totp";
-export { Anonymous } from "./anonymous";
-export type { AnonymousConfig } from "./anonymous";
-export { Credentials } from "./credentials";
-export type { CredentialsConfig } from "./credentials";
-export { Device } from "./device";
-export type { DeviceConfig } from "./device";
-export { SSO } from "./sso";
-export { Email } from "./email";
-export type { EmailProviderConfig } from "./email";
-export type { EmailConfig } from "../server/types";
-export { Phone } from "./phone";
-export type { PhoneProviderConfig } from "./phone";
-export type { PhoneConfig } from "../server/types";

package/src/providers/oauth.ts

@@ -1,117 +0,0 @@
-/**
- * OAuth provider factory for wrapping Arctic provider instances.
- *
- * ```ts
- * import { Google, GitHub } from "arctic";
- * import { OAuth } from "@robelest/convex-auth/providers";
- *
- * OAuth(new Google(clientId, clientSecret, redirectURI), {
- *   scopes: ["openid", "profile", "email"],
- * })
- * ```
- *
- * @module
- */
-
-import type { OAuth2Tokens } from "arctic";
-
-import type { OAuthProfile } from "../server/types";
-
-/**
- * Configuration for an OAuth provider.
- */
-export interface OAuthConfig {
-  /** OAuth scopes to request during authorization. */
-  scopes?: string[];
-  /**
-   * Extract user profile from tokens.
-   *
-   * Required for non-OIDC providers (e.g. GitHub) that don't return an ID token.
-   * For OIDC providers, defaults to decoding the ID token claims.
-   */
-  profile?: (tokens: OAuth2Tokens) => Promise<OAuthProfile>;
-  /**
-   * Override the provider ID derived from the class name.
-   * Used for route matching (`/api/auth/signin/{id}`).
-   */
-  id?: string;
-}
-
-/** The internal tag for identifying OAuth provider configs. */
-export const OAUTH_PROVIDER_TAG = "__convex_oauth" as const;
-
-/**
- * An OAuth provider instance with config attached.
- *
- * Created by the `OAuth()` factory. The runtime detects these via the `_tag` field.
- */
-export interface OAuthProviderInstance {
-  readonly _tag: typeof OAUTH_PROVIDER_TAG;
-  /** The provider ID (e.g. "google", "github"). */
-  readonly id: string;
-  /** The Arctic provider instance. */
-  readonly provider: any;
-  /** OAuth scopes. */
-  readonly scopes: string[];
-  /** Optional profile extraction callback. */
-  readonly profile?: (tokens: OAuth2Tokens) => Promise<OAuthProfile>;
-}
-
-/**
- * Wrap an Arctic provider instance with scopes and profile config.
- *
- * The provider ID is derived from `provider.constructor.name.toLowerCase()`
- * unless overridden via `config.id`.
- *
- * @param provider - An Arctic provider instance (e.g. `new Google(...)`)
- * @param config - Optional scopes, profile callback, and ID override
- * @returns A tagged OAuth provider config for the `providers` array
- *
- * @example
- * ```ts
- * import { Google } from "arctic";
- * import { OAuth } from "@robelest/convex-auth/providers";
- *
- * OAuth(new Google(clientId, clientSecret, redirectURI), {
- *   scopes: ["openid", "profile", "email"],
- * })
- * ```
- */
-export function OAuth(
-  provider: any,
-  config?: OAuthConfig,
-): OAuthProviderInstance {
-  if (
-    !provider ||
-    typeof provider.createAuthorizationURL !== "function" ||
-    typeof provider.validateAuthorizationCode !== "function"
-  ) {
-    throw new Error(
-      "OAuth() expects an Arctic provider instance with createAuthorizationURL and validateAuthorizationCode methods.",
-    );
-  }
-
-  const id = config?.id ?? provider.constructor?.name?.toLowerCase() ?? "oauth";
-
-  return {
-    _tag: OAUTH_PROVIDER_TAG,
-    id,
-    provider,
-    scopes: config?.scopes ?? [],
-    profile: config?.profile,
-  };
-}
-
-/**
- * Type guard to check if a provider config is an OAuth provider.
- */
-export function isOAuthProvider(
-  value: unknown,
-): value is OAuthProviderInstance {
-  return (
-    typeof value === "object" &&
-    value !== null &&
-    "_tag" in value &&
-    (value as any)._tag === OAUTH_PROVIDER_TAG
-  );
-}

package/src/providers/passkey.ts

@@ -1,77 +0,0 @@
-/**
- * Passkey (WebAuthn) authentication provider.
- *
- * ```ts
- * import { Passkey } from "@robelest/convex-auth/providers";
- *
- * new Passkey({ rpName: "My App" })
- * ```
- *
- * @module
- */
-
-import type { PasskeyProviderConfig } from "../server/types";
-
-/**
- * Configuration for the Passkey provider.
- */
-export interface PasskeyConfig {
-  /** Relying Party display name. Defaults to SITE_URL hostname. */
-  rpName?: string;
-  /** Relying Party ID (hostname). Defaults to SITE_URL hostname. */
-  rpId?: string;
-  /** Allowed origins for credential verification. Defaults to SITE_URL plus SECONDARY_URL. */
-  origin?: string | string[];
-  /** Attestation conveyance preference. Defaults to "none". */
-  attestation?: "none" | "direct";
-  /** User verification requirement. Defaults to "required". */
-  userVerification?: "required" | "preferred" | "discouraged";
-  /** Resident key (discoverable credential) preference. Defaults to "preferred". */
-  residentKey?: "required" | "preferred" | "discouraged";
-  /** Restrict to platform or cross-platform authenticators. */
-  authenticatorAttachment?: "platform" | "cross-platform";
-  /** Supported COSE algorithms. Defaults to [-7 (ES256), -257 (RS256)]. */
-  algorithms?: number[];
-  /** Challenge expiration in ms. Defaults to 300_000 (5 minutes). */
-  challengeExpirationMs?: number;
-}
-
-/**
- * Passkey (WebAuthn) authentication provider.
- *
- * Enables passwordless authentication via biometrics, security keys,
- * and synced passkeys using the Web Authentication API.
- *
- * @example
- * ```ts
- * import { Passkey } from "@robelest/convex-auth/providers";
- *
- * new Passkey({ rpName: "My App" })
- * ```
- */
-export class Passkey {
-  readonly id: string;
-  readonly type = "passkey" as const;
-  readonly config: PasskeyConfig;
-
-  constructor(config: PasskeyConfig = {}) {
-    this.id = "passkey";
-    this.config = config;
-  }
-
-  /** @internal Convert to the internal materialized config shape. */
-  _toMaterialized(): PasskeyProviderConfig {
-    return {
-      id: this.id,
-      type: "passkey",
-      options: {
-        attestation: "none",
-        userVerification: "required",
-        residentKey: "preferred",
-        algorithms: [-7, -257], // ES256, RS256
-        challengeExpirationMs: 300_000, // 5 minutes
-        ...this.config,
-      },
-    };
-  }
-}