@robelest/convex-auth 0.0.4-preview.25 → 0.0.4-preview.28

package/src/providers/password.ts

@@ -1,441 +0,0 @@
-/**
- * Configure {@link Password} provider for email/password authentication.
- *
- * The `Password` provider supports the following flows, determined
- * by the `flow` parameter:
- *
- * - `"signUp"`: Create a new account with a password.
- * - `"signIn"`: Sign in with an existing account and password.
- * - `"reset"`: Request a password reset.
- * - `"reset-verification"`: Verify a password reset code and change password.
- * - `"email-verification"`: If email verification is enabled and `code` is
- *    included in params, verify an OTP.
- *
- * ```ts
- * import { Password } from "@robelest/convex-auth/providers";
- *
- * new Password()
- * ```
- *
- * @module
- */
-
-import { scryptAsync } from "@noble/hashes/scrypt.js";
-import { bytesToHex } from "@noble/hashes/utils.js";
-import { Fx } from "@robelest/fx";
-import {
-  DocumentByName,
-  GenericDataModel,
-  WithoutSystemFields,
-} from "convex/server";
-import { Value } from "convex/values";
-
-import type {
-  EmailConfig,
-  GenericActionCtxWithAuthConfig,
-  GenericDoc,
-  AuthProviderConfig,
-  ConvexCredentialsConfig,
-} from "../server/types";
-import { Credentials, type CredentialsConfig } from "./credentials";
-
-/**
- * The available options to a {@link Password} provider for Convex Auth.
- */
-export interface PasswordConfig<DataModel extends GenericDataModel> {
-  /**
-   * Uniquely identifies the provider, allowing to use
-   * multiple different {@link Password} providers.
-   */
-  id?: string;
-  /**
-   * Perform checks on provided params and customize the user
-   * information stored after sign up, including email normalization.
-   *
-   * Called for every flow ("signUp", "signIn", "reset",
-   * "reset-verification" and "email-verification").
-   */
-  profile?: (
-    /**
-     * The values passed to the `signIn` function.
-     */
-    params: Record<string, Value | undefined>,
-    /**
-     * Convex ActionCtx in case you want to read from or write to
-     * the database.
-     */
-    ctx: GenericActionCtxWithAuthConfig<DataModel>,
-  ) => WithoutSystemFields<DocumentByName<DataModel, "User">> & {
-    email: string;
-  };
-  /**
-   * Performs custom validation on password provided during sign up or reset.
-   *
-   * Otherwise the default validation is used (password is not empty and
-   * at least 8 characters in length).
-   *
-   * If the provided password is invalid, implementations must throw an Error.
-   *
-   * @param password the password supplied during "signUp" or
-   *                 "reset-verification" flows.
-   */
-  validatePasswordRequirements?: (password: string) => void;
-  /**
-   * Provide hashing and verification functions if you want to control
-   * how passwords are hashed.
-   */
-  crypto?: CredentialsConfig["crypto"];
-  /**
-   * An email provider used to require verification
-   * before password reset.
-   */
-  reset?: EmailConfig | ((...args: any) => EmailConfig);
-  /**
-   * An email provider used to require verification
-   * before sign up / sign in.
-   */
-  verify?: EmailConfig | ((...args: any) => EmailConfig);
-}
-
-type PasswordFlowDispatch =
-  | { tag: "signUp" }
-  | { tag: "signIn" }
-  | { tag: "reset" }
-  | { tag: "resetVerification" }
-  | { tag: "emailVerification" }
-  | { tag: "invalid"; flow: unknown };
-
-const PASSWORD_FLOW_TAG = {
-  signUp: "signUp",
-  signIn: "signIn",
-  reset: "reset",
-  "reset-verification": "resetVerification",
-  "email-verification": "emailVerification",
-} as const;
-
-type PasswordFlowInput = keyof typeof PASSWORD_FLOW_TAG;
-
-function decodePasswordFlow(flow: unknown): PasswordFlowDispatch {
-  if (typeof flow !== "string") {
-    return { tag: "invalid", flow };
-  }
-
-  const tag = PASSWORD_FLOW_TAG[flow as PasswordFlowInput];
-  return tag === undefined ? { tag: "invalid", flow } : { tag };
-}
-
-/**
- * Email and password authentication provider.
- *
- * Passwords are by default hashed using scrypt.
- * You can customize the hashing via the `crypto` option.
- *
- * Email verification is not required unless you pass
- * an email provider to the `verify` option.
- *
- * @example
- * ```ts
- * import { Password } from "@robelest/convex-auth/providers";
- *
- * new Password()
- * new Password({ verify: myEmailProvider })
- * ```
- */
-export class Password<DataModel extends GenericDataModel = GenericDataModel> {
-  readonly id: string;
-  readonly type = "credentials" as const;
-  readonly config: PasswordConfig<DataModel>;
-
-  constructor(
-    config: PasswordConfig<DataModel> = {} as PasswordConfig<DataModel>,
-  ) {
-    this.id = config.id ?? "password";
-    this.config = config;
-  }
-
-  /** @internal Convert to the internal materialized config shape. */
-  _toMaterialized(): ConvexCredentialsConfig {
-    const config = this.config;
-    const provider = this.id;
-
-    return new Credentials<DataModel>({
-      id: "password",
-      authorize: async (params, ctx) => {
-        const flowDispatch = decodePasswordFlow(params.flow);
-
-        const validatePasswordRequirements = (password: string) => {
-          if (config.validatePasswordRequirements !== undefined) {
-            config.validatePasswordRequirements(password);
-            return;
-          }
-          validateDefaultPasswordRequirements(password);
-        };
-
-        await Fx.run(
-          Fx.match(flowDispatch, flowDispatch.tag, {
-            signUp: () =>
-              Fx.sync(() => {
-                validatePasswordRequirements(params.password as string);
-              }),
-            resetVerification: () =>
-              Fx.sync(() => {
-                validatePasswordRequirements(params.newPassword as string);
-              }),
-            signIn: () => Fx.succeed(undefined),
-            reset: () => Fx.succeed(undefined),
-            emailVerification: () => Fx.succeed(undefined),
-            invalid: () => Fx.succeed(undefined),
-          }),
-        );
-
-        const profile = config.profile?.(params, ctx) ?? defaultProfile(params);
-        const { email } = profile;
-        const requirePasswordParam = (
-          value: unknown,
-          flow: "signUp" | "signIn",
-        ) => {
-          if (typeof value !== "string" || value.length === 0) {
-            throw new Error(`Missing \`password\` param for \`${flow}\` flow`);
-          }
-          return value;
-        };
-
-        const finalizeCredentialsResult = async (
-          account: GenericDoc<DataModel, "Account">,
-          user: GenericDoc<DataModel, "User">,
-        ) => {
-          if (config.verify && !account.emailVerified) {
-            return await ctx.auth.provider.signIn(
-              ctx,
-              config.verify as AuthProviderConfig,
-              {
-                accountId: account._id,
-                params,
-              },
-            );
-          }
-          return { userId: user._id };
-        };
-
-        return await Fx.run(
-          Fx.match(flowDispatch, flowDispatch.tag, {
-            signUp: () =>
-              Fx.promise(async () => {
-                const secret = requirePasswordParam(params.password, "signUp");
-                const created = await ctx.auth.account.create(ctx, {
-                  provider,
-                  account: { id: email, secret },
-                  profile: profile as any,
-                  shouldLinkViaEmail: config.verify !== undefined,
-                  shouldLinkViaPhone: false,
-                });
-                return await finalizeCredentialsResult(
-                  created.account,
-                  created.user,
-                );
-              }),
-            signIn: () =>
-              Fx.promise(async () => {
-                const secret = requirePasswordParam(params.password, "signIn");
-                const retrieved = await ctx.auth.account.get(ctx, {
-                  provider,
-                  account: { id: email, secret },
-                });
-                if (retrieved === null) {
-                  throw new Error("Invalid credentials");
-                }
-                return await finalizeCredentialsResult(
-                  retrieved.account,
-                  retrieved.user,
-                );
-              }),
-            reset: () =>
-              Fx.promise(async () => {
-                if (!config.reset) {
-                  throw new Error(
-                    `Password reset is not enabled for ${provider}`,
-                  );
-                }
-                const { account } = await ctx.auth.account.get(ctx, {
-                  provider,
-                  account: { id: email },
-                });
-                return await ctx.auth.provider.signIn(
-                  ctx,
-                  config.reset as AuthProviderConfig,
-                  {
-                    accountId: account._id,
-                    params,
-                  },
-                );
-              }),
-            resetVerification: () =>
-              Fx.promise(async () => {
-                if (!config.reset) {
-                  throw new Error(
-                    `Password reset is not enabled for ${provider}`,
-                  );
-                }
-                if (params.newPassword === undefined) {
-                  throw new Error(
-                    "Missing `newPassword` param for `reset-verification` flow",
-                  );
-                }
-                const result = await ctx.auth.provider.signIn(
-                  ctx,
-                  config.reset as AuthProviderConfig,
-                  { params },
-                );
-                if (result === null) {
-                  throw new Error("Invalid code");
-                }
-                const { userId, sessionId } = result;
-                const secret = params.newPassword as string;
-                await ctx.auth.account.update(ctx, {
-                  provider,
-                  account: { id: email, secret },
-                });
-                await ctx.auth.session.invalidate(ctx, {
-                  userId,
-                  except: [sessionId],
-                });
-                return { userId, sessionId };
-              }),
-            emailVerification: () =>
-              Fx.promise(async () => {
-                if (!config.verify) {
-                  throw new Error(
-                    `Email verification is not enabled for ${provider}`,
-                  );
-                }
-                const { account } = await ctx.auth.account.get(ctx, {
-                  provider,
-                  account: { id: email },
-                });
-                return await ctx.auth.provider.signIn(
-                  ctx,
-                  config.verify as AuthProviderConfig,
-                  {
-                    accountId: account._id,
-                    params,
-                  },
-                );
-              }),
-            invalid: () =>
-              Fx.fatal(
-                new Error(
-                  "Missing `flow` param, it must be one of " +
-                    '"signUp", "signIn", "reset", "reset-verification" or ' +
-                    '"email-verification"!',
-                ),
-              ),
-          }),
-        );
-      },
-      crypto: config.crypto ?? {
-        async hashSecret(password: string) {
-          return await hashPassword(password);
-        },
-        async verifySecret(password: string, hash: string) {
-          return await verifyPassword(password, hash);
-        },
-      },
-      extraProviders: [
-        config.reset as AuthProviderConfig | undefined,
-        config.verify as AuthProviderConfig | undefined,
-      ],
-      ...config,
-    })._toMaterialized();
-  }
-}
-
-// ============================================================================
-// Helpers
-// ============================================================================
-
-function validateDefaultPasswordRequirements(password: string) {
-  if (!password || password.length < 8) {
-    throw new Error("Invalid password");
-  }
-}
-
-function defaultProfile(params: Record<string, unknown>) {
-  const email = params.email;
-  if (typeof email !== "string" || email.trim().length === 0) {
-    throw new Error("Missing `email` param");
-  }
-  return {
-    email,
-  };
-}
-
-const PASSWORD_HASH_PARAMS = {
-  N: 16384,
-  r: 16,
-  p: 1,
-  dkLen: 64,
-} as const;
-
-const PASSWORD_HASH_PREFIX = `scrypt:N=${PASSWORD_HASH_PARAMS.N},r=${PASSWORD_HASH_PARAMS.r},p=${PASSWORD_HASH_PARAMS.p},dkLen=${PASSWORD_HASH_PARAMS.dkLen}`;
-
-async function hashPassword(password: string) {
-  const salt = crypto.getRandomValues(new Uint8Array(32));
-  const hash = await scryptAsync(password, salt, PASSWORD_HASH_PARAMS);
-  return `${PASSWORD_HASH_PREFIX}$${bytesToHex(salt)}$${bytesToHex(hash)}`;
-}
-
-async function verifyPassword(password: string, storedHash: string) {
-  const [prefix, saltHex, hashHex] = storedHash.split("$");
-  if (
-    prefix !== PASSWORD_HASH_PREFIX ||
-    saltHex === undefined ||
-    hashHex === undefined
-  ) {
-    return false;
-  }
-
-  let salt: Uint8Array;
-  let expectedHash: Uint8Array;
-  try {
-    salt = hexToBytes(saltHex);
-    expectedHash = hexToBytes(hashHex);
-  } catch {
-    return false;
-  }
-  if (
-    salt.length !== 32 ||
-    expectedHash.length !== PASSWORD_HASH_PARAMS.dkLen
-  ) {
-    return false;
-  }
-
-  const actualHash = await scryptAsync(password, salt, PASSWORD_HASH_PARAMS);
-  return constantTimeEqual(actualHash, expectedHash);
-}
-
-function hexToBytes(hex: string) {
-  if (hex.length % 2 !== 0) {
-    throw new Error("Invalid password hash");
-  }
-  const bytes = new Uint8Array(hex.length / 2);
-  for (let i = 0; i < bytes.length; i++) {
-    const start = i * 2;
-    const value = Number.parseInt(hex.slice(start, start + 2), 16);
-    if (Number.isNaN(value)) {
-      throw new Error("Invalid password hash");
-    }
-    bytes[i] = value;
-  }
-  return bytes;
-}
-
-function constantTimeEqual(left: Uint8Array, right: Uint8Array) {
-  if (left.length !== right.length) {
-    return false;
-  }
-  let diff = 0;
-  for (let i = 0; i < left.length; i++) {
-    diff |= left[i] ^ right[i];
-  }
-  return diff === 0;
-}

package/src/providers/phone.ts

@@ -1,93 +0,0 @@
-/**
- * Phone / SMS authentication provider.
- *
- * @module
- */
-
-import { Fx } from "@robelest/fx";
-
-import type { PhoneConfig } from "../server/types";
-
-/**
- * User-facing configuration for the {@link Phone} provider.
- *
- * Use this to send SMS or other phone-based verification messages during
- * sign-in.
- */
-export interface PhoneProviderConfig {
-  /** Send the verification code to the user's phone. */
-  send: PhoneConfig["sendVerificationRequest"];
-  /** Provider ID override. Defaults to "phone". */
-  id?: string;
-  /** Token expiration in seconds. Defaults to 1200 (20 minutes). */
-  maxAge?: number;
-}
-
-/**
- * Phone provider for SMS or phone-number verification flows.
- *
- * Wraps your `send()` implementation and materializes the runtime behavior
- * Convex Auth needs for short-code or magic-link-style phone verification.
- *
- * @example
- * ```ts
- * import { Phone } from "@robelest/convex-auth/providers";
- *
- * const phone = new Phone({
- *   send: async ({ identifier, token }) => {
- *     await sms.send({ to: identifier, body: `Your sign-in code is ${token}` });
- *   },
- * });
- * ```
- */
-export class Phone {
-  readonly id: string;
-  readonly type = "phone" as const;
-
-  /**
-   * Create a phone provider instance.
-   *
-   * @param config - Phone delivery and provider settings.
-   */
-  constructor(public readonly config: PhoneProviderConfig) {
-    this.id = config.id ?? "phone";
-  }
-
-  /** @internal */
-  _toMaterialized(): PhoneConfig {
-    return {
-      id: this.id,
-      type: "phone",
-      maxAge: this.config.maxAge ?? 60 * 20,
-      authorize: async (params, account) => {
-        const dispatch =
-          typeof params.phone !== "string"
-            ? ({ tag: "missingPhone" } as const)
-            : account.providerAccountId !== params.phone
-              ? ({ tag: "mismatch" } as const)
-              : ({ tag: "ok" } as const);
-
-        return await Fx.run(
-          Fx.match(dispatch, dispatch.tag, {
-            missingPhone: () =>
-              Fx.fatal(
-                new Error(
-                  "Token verification requires a `phone` in params of `signIn`.",
-                ),
-              ),
-            mismatch: () =>
-              Fx.fatal(
-                new Error(
-                  "Short verification code requires a matching `phone` " +
-                    "in params of `signIn`.",
-                ),
-              ),
-            ok: () => Fx.succeed(undefined),
-          }),
-        );
-      },
-      sendVerificationRequest: this.config.send,
-      options: {} as any,
-    };
-  }
-}

package/src/providers/sso.ts

@@ -1,54 +0,0 @@
-/**
- * Enterprise SSO provider (OIDC + SAML + SCIM).
- *
- * Adding `new SSO()` to your providers list enables enterprise SSO
- * sign-in flows and registers the OIDC, SAML, and SCIM runtime HTTP
- * routes. It also makes `auth.sso.*` available on the auth
- * object returned by `createAuth`.
- *
- * ```ts
- * import { SSO } from "@robelest/convex-auth/providers";
- *
- * const auth = createAuth(components.auth, {
- *   providers: [new SSO(), new Password()],
- * });
- *
- * // auth.sso is now available
- * await auth.sso.admin.oidc.configure(ctx, { enterpriseId, clientId, ... });
- * ```
- *
- * Without `new SSO()` in the providers list, `auth.sso` is not
- * present on the returned object and accessing it is a TypeScript error.
- *
- * @module
- */
-
-import type { SSOProviderConfig } from "../server/types";
-
-/**
- * Enterprise SSO provider.
- *
- * Zero-configuration — sensible defaults are applied for all enterprise
- * protocols (OIDC, SAML, SCIM). Per-tenant configuration is done at
- * runtime via `auth.sso.*` helpers.
- *
- * @example
- * ```ts
- * import { createAuth } from "@robelest/convex-auth/component";
- * import { SSO, Password } from "@robelest/convex-auth/providers";
- * import { components } from "./_generated/api";
- *
- * export const auth = createAuth(components.auth, {
- *   providers: [new SSO(), new Password()],
- * });
- * ```
- */
-export class SSO {
-  readonly id = "enterprise-sso";
-  readonly type = "sso" as const;
-
-  /** @internal Convert to the internal materialized config shape. */
-  _toMaterialized(): SSOProviderConfig {
-    return { id: this.id, type: "sso" };
-  }
-}

package/src/providers/totp.ts

@@ -1,62 +0,0 @@
-/**
- * TOTP (Time-based One-Time Password) two-factor authentication provider.
- *
- * ```ts
- * import { Totp } from "@robelest/convex-auth/providers";
- *
- * new Totp({ issuer: "My App" })
- * ```
- *
- * @module
- */
-
-import type { TotpProviderConfig } from "../server/types";
-
-/**
- * Configuration for the TOTP provider.
- */
-export interface TotpConfig {
-  /** Issuer name shown in authenticator apps (e.g. "My App"). */
-  issuer?: string;
-  /** Number of digits in each code (default: 6). */
-  digits?: number;
-  /** Time period in seconds for code rotation (default: 30). */
-  period?: number;
-}
-
-/**
- * TOTP (Time-based One-Time Password) two-factor authentication provider.
- *
- * Generates time-based one-time passwords compatible with authenticator
- * apps like Google Authenticator and Authy.
- *
- * @example
- * ```ts
- * import { Totp } from "@robelest/convex-auth/providers";
- *
- * new Totp({ issuer: "My App" })
- * ```
- */
-export class Totp {
-  readonly id: string;
-  readonly type = "totp" as const;
-  readonly config: TotpConfig;
-
-  constructor(config: TotpConfig = {}) {
-    this.id = "totp";
-    this.config = config;
-  }
-
-  /** @internal Convert to the internal materialized config shape. */
-  _toMaterialized(): TotpProviderConfig {
-    return {
-      id: this.id,
-      type: "totp",
-      options: {
-        issuer: this.config.issuer ?? "ConvexAuth",
-        digits: this.config.digits ?? 6,
-        period: this.config.period ?? 30,
-      },
-    };
-  }
-}

package/src/samlify.d.ts

@@ -1,53 +0,0 @@
-declare module "@robelest/samlify" {
-  export const Constants: {
-    namespace: {
-      binding: {
-        redirect: string;
-        post: string;
-      };
-    };
-  };
-
-  export function setSchemaValidator(validator: {
-    validate: (xml: string) => Promise<string>;
-  }): void;
-
-  export function IdentityProvider(options: { metadata: string }): {
-    entityMeta: {
-      getEntityID(): string;
-      getSingleSignOnService(binding: string): string | undefined;
-      getSingleLogoutService(binding: string): string | undefined;
-      getX509Certificate(use: string): string | string[] | null;
-      getNameIDFormat(): string[] | string | undefined;
-      isWantAuthnRequestsSigned(): boolean;
-    };
-  };
-
-  export function ServiceProvider(options: Record<string, unknown>): {
-    getMetadata(): string;
-    createLoginRequest(
-      idp: unknown,
-      binding: unknown,
-    ):
-      | Promise<{
-          id: string;
-          context: string;
-          entityEndpoint?: string;
-        }>
-      | {
-          id: string;
-          context: string;
-          entityEndpoint?: string;
-        };
-    parseLoginResponse(
-      idp: unknown,
-      binding: unknown,
-      request: { query: Record<string, string>; body: Record<string, string> },
-    ): Promise<unknown>;
-    parseLogoutRequest(
-      idp: unknown,
-      binding: unknown,
-      request: { query: Record<string, string>; body: Record<string, string> },
-    ): Promise<unknown>;
-  };
-}