@robelest/convex-auth 0.0.4-preview.25 → 0.0.4-preview.28

package/src/server/crypto.ts

@@ -1,90 +0,0 @@
-import { Fx } from "@robelest/fx";
-import { Cv } from "@robelest/fx/convex";
-import { ConvexError } from "convex/values";
-
-import { AuthProviderMaterializedConfig } from "./types";
-import { ConvexAuthMaterializedConfig } from "./types";
-import { errorMessage } from "./utils";
-
-/**
- * Hash a secret using the provider's `crypto.hashSecret` function.
- *
- * Validates that the provider is a credentials provider and has the
- * required crypto function, returning typed errors through the Fx channel.
- */
-/** @internal */
-export const hash = (
-  provider: any,
-  secret: string,
-): Fx<string, ConvexError<any>> =>
-  Fx.gen(function* () {
-    if (provider.type !== "credentials") {
-      return yield* Cv.fail({
-        code: "INVALID_CREDENTIALS_PROVIDER",
-        message: `Provider ${provider.id} is not a credentials provider`,
-      });
-    }
-
-    const hashSecretFn = provider.crypto?.hashSecret as
-      | ((s: string) => Promise<string>)
-      | undefined;
-    if (!hashSecretFn) {
-      return yield* Cv.fail({
-        code: "MISSING_CRYPTO_FUNCTION",
-        message: `Provider ${provider.id} does not have a \`crypto.hashSecret\` function`,
-      });
-    }
-
-    return yield* Fx.from({
-      ok: () => hashSecretFn(secret),
-      err: (e) =>
-        Cv.error({
-          code: "INTERNAL_ERROR",
-          message: `Hash failed: ${errorMessage(e)}`,
-        }),
-    });
-  });
-
-/**
- * Verify a secret against a hash using the provider's `crypto.verifySecret` function.
- */
-/** @internal */
-export const verify = (
-  provider: AuthProviderMaterializedConfig,
-  secret: string,
-  hashValue: string,
-): Fx<boolean, ConvexError<any>> =>
-  Fx.gen(function* () {
-    if (provider.type !== "credentials") {
-      return yield* Cv.fail({
-        code: "INVALID_CREDENTIALS_PROVIDER",
-        message: `Provider ${provider.id} is not a credentials provider`,
-      });
-    }
-
-    const verifySecretFn = (provider as any).crypto?.verifySecret as
-      | ((s: string, h: string) => Promise<boolean>)
-      | undefined;
-    if (!verifySecretFn) {
-      return yield* Cv.fail({
-        code: "MISSING_CRYPTO_FUNCTION",
-        message: `Provider ${provider.id} does not have a \`crypto.verifySecret\` function`,
-      });
-    }
-
-    return yield* Fx.from({
-      ok: () => verifySecretFn(secret, hashValue),
-      err: (e) =>
-        Cv.error({
-          code: "INTERNAL_ERROR",
-          message: `Verify failed: ${errorMessage(e)}`,
-        }),
-    });
-  });
-
-export type GetProviderOrThrowFunc = (
-  provider: string,
-  allowExtraProviders?: boolean,
-) => AuthProviderMaterializedConfig;
-
-export type Config = ConvexAuthMaterializedConfig;

package/src/server/db.ts

@@ -1,203 +0,0 @@
-import {
-  GenericActionCtx,
-  GenericDataModel,
-  GenericMutationCtx,
-  FunctionReference,
-} from "convex/server";
-
-type MutationCtxLike = Pick<
-  GenericMutationCtx<GenericDataModel>,
-  "runQuery" | "runMutation"
->;
-type ActionCtxLike = Pick<
-  GenericActionCtx<GenericDataModel>,
-  "runQuery" | "runMutation" | "runAction"
->;
-
-type CtxLike = MutationCtxLike | ActionCtxLike;
-
-type AuthComponentApiLike = {
-  public: {
-    userGetById: FunctionReference<"query", "internal">;
-    userFindByVerifiedEmail: FunctionReference<"query", "internal">;
-    userFindByVerifiedPhone: FunctionReference<"query", "internal">;
-    userInsert: FunctionReference<"mutation", "internal">;
-    userPatch: FunctionReference<"mutation", "internal">;
-    userUpsert: FunctionReference<"mutation", "internal">;
-    accountGet: FunctionReference<"query", "internal">;
-    accountGetById: FunctionReference<"query", "internal">;
-    accountInsert: FunctionReference<"mutation", "internal">;
-    accountPatch: FunctionReference<"mutation", "internal">;
-    accountDelete: FunctionReference<"mutation", "internal">;
-    sessionCreate: FunctionReference<"mutation", "internal">;
-    sessionGetById: FunctionReference<"query", "internal">;
-    sessionDelete: FunctionReference<"mutation", "internal">;
-    sessionListByUser: FunctionReference<"query", "internal">;
-    verifierCreate: FunctionReference<"mutation", "internal">;
-    verifierGetById: FunctionReference<"query", "internal">;
-    verifierGetBySignature: FunctionReference<"query", "internal">;
-    verifierPatch: FunctionReference<"mutation", "internal">;
-    verifierDelete: FunctionReference<"mutation", "internal">;
-    verificationCodeGetByAccountId: FunctionReference<"query", "internal">;
-    verificationCodeGetByCode: FunctionReference<"query", "internal">;
-    verificationCodeCreate: FunctionReference<"mutation", "internal">;
-    verificationCodeDelete: FunctionReference<"mutation", "internal">;
-    refreshTokenCreate: FunctionReference<"mutation", "internal">;
-    refreshTokenGetById: FunctionReference<"query", "internal">;
-    refreshTokenPatch: FunctionReference<"mutation", "internal">;
-    refreshTokenGetChildren: FunctionReference<"query", "internal">;
-    refreshTokenListBySession: FunctionReference<"query", "internal">;
-    refreshTokenDeleteAll: FunctionReference<"mutation", "internal">;
-    refreshTokenGetActive: FunctionReference<"query", "internal">;
-    rateLimitGet: FunctionReference<"query", "internal">;
-    rateLimitCreate: FunctionReference<"mutation", "internal">;
-    rateLimitPatch: FunctionReference<"mutation", "internal">;
-    rateLimitDelete: FunctionReference<"mutation", "internal">;
-  };
-};
-
-/** @internal */
-export type AuthDbConfig = { component: AuthComponentApiLike };
-
-/** @internal */
-export type AuthDb = ReturnType<typeof authDb>;
-
-/** @internal */
-export function authDb(ctx: CtxLike, config: AuthDbConfig) {
-  const component = config.component;
-  return {
-    users: {
-      getById: (userId: string) =>
-        ctx.runQuery(component.public.userGetById, { userId }),
-      findByVerifiedEmail: (email: string) =>
-        ctx.runQuery(component.public.userFindByVerifiedEmail, { email }),
-      findByVerifiedPhone: (phone: string) =>
-        ctx.runQuery(component.public.userFindByVerifiedPhone, { phone }),
-      insert: (data: Record<string, unknown>) =>
-        ctx.runMutation(component.public.userInsert, {
-          data,
-        }) as Promise<string>,
-      patch: (userId: string, data: Record<string, unknown>) =>
-        ctx.runMutation(component.public.userPatch, { userId, data }),
-      upsert: (userId: string | undefined, data: Record<string, unknown>) =>
-        ctx.runMutation(component.public.userUpsert, {
-          userId,
-          data,
-        }) as Promise<string>,
-    },
-    accounts: {
-      get: (provider: string, providerAccountId: string) =>
-        ctx.runQuery(component.public.accountGet, {
-          provider,
-          providerAccountId,
-        }),
-      getById: (accountId: string) =>
-        ctx.runQuery(component.public.accountGetById, { accountId }),
-      create: (args: {
-        userId: string;
-        provider: string;
-        providerAccountId: string;
-        secret?: string;
-        extend?: Record<string, unknown>;
-      }) =>
-        ctx.runMutation(
-          component.public.accountInsert,
-          args,
-        ) as Promise<string>,
-      patch: (accountId: string, data: Record<string, unknown>) =>
-        ctx.runMutation(component.public.accountPatch, { accountId, data }),
-      delete: (accountId: string) =>
-        ctx.runMutation(component.public.accountDelete, { accountId }),
-    },
-    sessions: {
-      create: (userId: string, expirationTime: number) =>
-        ctx.runMutation(component.public.sessionCreate, {
-          userId,
-          expirationTime,
-        }) as Promise<string>,
-      getById: (sessionId: string) =>
-        ctx.runQuery(component.public.sessionGetById, { sessionId }),
-      delete: (sessionId: string) =>
-        ctx.runMutation(component.public.sessionDelete, { sessionId }),
-      listByUser: (userId: string) =>
-        ctx.runQuery(component.public.sessionListByUser, { userId }),
-    },
-    verifiers: {
-      create: (sessionId?: string) =>
-        ctx.runMutation(component.public.verifierCreate, {
-          sessionId,
-        }) as Promise<string>,
-      getById: (verifierId: string) =>
-        ctx.runQuery(component.public.verifierGetById, { verifierId }),
-      getBySignature: (signature: string) =>
-        ctx.runQuery(component.public.verifierGetBySignature, { signature }),
-      patch: (verifierId: string, data: Record<string, unknown>) =>
-        ctx.runMutation(component.public.verifierPatch, { verifierId, data }),
-      delete: (verifierId: string) =>
-        ctx.runMutation(component.public.verifierDelete, { verifierId }),
-    },
-    verificationCodes: {
-      getByAccountId: (accountId: string) =>
-        ctx.runQuery(component.public.verificationCodeGetByAccountId, {
-          accountId,
-        }),
-      getByCode: (code: string) =>
-        ctx.runQuery(component.public.verificationCodeGetByCode, { code }),
-      create: (args: {
-        accountId: string;
-        provider: string;
-        code: string;
-        expirationTime: number;
-        verifier?: string;
-        emailVerified?: string;
-        phoneVerified?: string;
-      }) => ctx.runMutation(component.public.verificationCodeCreate, args),
-      delete: (verificationCodeId: string) =>
-        ctx.runMutation(component.public.verificationCodeDelete, {
-          verificationCodeId,
-        }),
-    },
-    refreshTokens: {
-      create: (args: {
-        sessionId: string;
-        expirationTime: number;
-        parentRefreshTokenId?: string;
-      }) =>
-        ctx.runMutation(
-          component.public.refreshTokenCreate,
-          args,
-        ) as Promise<string>,
-      getById: (refreshTokenId: string) =>
-        ctx.runQuery(component.public.refreshTokenGetById, { refreshTokenId }),
-      patch: (refreshTokenId: string, data: Record<string, unknown>) =>
-        ctx.runMutation(component.public.refreshTokenPatch, {
-          refreshTokenId,
-          data,
-        }),
-      getChildren: (sessionId: string, parentRefreshTokenId: string) =>
-        ctx.runQuery(component.public.refreshTokenGetChildren, {
-          sessionId,
-          parentRefreshTokenId,
-        }),
-      listBySession: (sessionId: string) =>
-        ctx.runQuery(component.public.refreshTokenListBySession, { sessionId }),
-      deleteAll: (sessionId: string) =>
-        ctx.runMutation(component.public.refreshTokenDeleteAll, { sessionId }),
-      getActive: (sessionId: string) =>
-        ctx.runQuery(component.public.refreshTokenGetActive, { sessionId }),
-    },
-    rateLimits: {
-      get: (identifier: string) =>
-        ctx.runQuery(component.public.rateLimitGet, { identifier }),
-      create: (args: {
-        identifier: string;
-        attemptsLeft: number;
-        lastAttemptTime: number;
-      }) => ctx.runMutation(component.public.rateLimitCreate, args),
-      patch: (rateLimitId: string, data: Record<string, unknown>) =>
-        ctx.runMutation(component.public.rateLimitPatch, { rateLimitId, data }),
-      delete: (rateLimitId: string) =>
-        ctx.runMutation(component.public.rateLimitDelete, { rateLimitId }),
-    },
-  };
-}

package/src/server/device.ts

@@ -1,254 +0,0 @@
-/**
- * Server-side device authorization flow logic (RFC 8628).
- *
- * Handles the three phases of the device flow:
- * 1. (default) — Generate a device code + user code pair
- * 2. poll      — Device checks whether the user has authorized yet
- * 3. verify    — Authenticated user links a user code to their session
- *
- * Uses `@oslojs/crypto/random` for code generation and
- * `@oslojs/crypto/sha2` for hashing device codes before storage.
- */
-
-import { Fx } from "@robelest/fx";
-import { Cv } from "@robelest/fx/convex";
-import { ConvexError } from "convex/values";
-
-import { userIdFromIdentitySubject } from "./identity";
-import { callSignIn } from "./mutations/index";
-import { DeviceProviderConfig, GenericActionCtxWithAuthConfig } from "./types";
-import {
-  AuthDataModel,
-  SessionInfo,
-  mutateDeviceInsert,
-  queryDeviceByCodeHash,
-  queryDeviceByUserCode,
-  mutateDeviceAuthorize,
-  mutateDeviceUpdateLastPolled,
-  mutateDeviceDelete,
-} from "./types";
-import { generateRandomString, sha256 } from "./utils";
-import { requireEnv } from "./utils";
-
-type EnrichedActionCtx = GenericActionCtxWithAuthConfig<AuthDataModel>;
-
-// ============================================================================
-// Constants
-// ============================================================================
-
-const DEVICE_CODE_ALPHABET =
-  "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789";
-const DEVICE_CODE_LENGTH = 40;
-const DEVICE_FLOWS = ["create", "poll", "verify"] as const;
-
-// ============================================================================
-// Create flow
-// ============================================================================
-
-// ============================================================================
-// Poll flow — pipeline of validations + status dispatch
-// ============================================================================
-
-// ============================================================================
-// Main dispatch
-// ============================================================================
-
-type DeviceResult =
-  | {
-      kind: "deviceCode";
-      deviceCode: string;
-      userCode: string;
-      verificationUri: string;
-      verificationUriComplete: string;
-      expiresIn: number;
-      interval: number;
-    }
-  | { kind: "signedIn"; signedIn: SessionInfo | null };
-
-/** @internal */
-export const handleDevice = (
-  ctx: EnrichedActionCtx,
-  provider: DeviceProviderConfig,
-  args: { params?: Record<string, any> },
-): Fx<DeviceResult, ConvexError<any>> =>
-  Fx.from({
-    ok: async () => {
-      const params = (args.params ?? {}) as Record<string, unknown>;
-      const flow = (typeof params.flow === "string" ? params.flow : "create") as
-        | "create"
-        | "poll"
-        | "verify";
-
-      if (!DEVICE_FLOWS.some((candidate) => candidate === flow)) {
-        throw Cv.error({
-          code: "DEVICE_MISSING_FLOW",
-          message:
-            "Missing `flow` parameter. Expected one of: create, poll, verify",
-        });
-      }
-
-      if (flow === "create") {
-        const deviceCode = generateRandomString(
-          DEVICE_CODE_LENGTH,
-          DEVICE_CODE_ALPHABET,
-        );
-        const deviceCodeHash = await sha256(deviceCode);
-
-        const rawUserCode = generateRandomString(
-          provider.userCodeLength,
-          provider.charset,
-        );
-        const mid = Math.floor(rawUserCode.length / 2);
-        const userCode =
-          rawUserCode.slice(0, mid) + "-" + rawUserCode.slice(mid);
-
-        const expiresAt = Date.now() + provider.expiresIn * 1000;
-        await mutateDeviceInsert(ctx, {
-          deviceCodeHash,
-          userCode,
-          expiresAt,
-          interval: provider.interval,
-          status: "pending",
-        });
-
-        const verificationUri =
-          provider.verificationUri ??
-          `${process.env.SITE_URL ?? requireEnv("SITE_URL")}/device`;
-
-        return {
-          kind: "deviceCode" as const,
-          deviceCode,
-          userCode,
-          verificationUri,
-          verificationUriComplete: `${verificationUri}?user_code=${encodeURIComponent(userCode)}`,
-          expiresIn: provider.expiresIn,
-          interval: provider.interval,
-        };
-      }
-
-      if (flow === "poll") {
-        if (typeof params.deviceCode !== "string") {
-          throw Cv.error({
-            code: "DEVICE_MISSING_FLOW",
-            message: "Missing `deviceCode` parameter for poll flow.",
-          });
-        }
-
-        const hash = await sha256(params.deviceCode);
-        const doc = await queryDeviceByCodeHash(ctx, hash);
-        if (doc === null) {
-          throw Cv.error({
-            code: "DEVICE_CODE_EXPIRED",
-            message:
-              "The device code has expired. Please start a new authorization request.",
-          });
-        }
-        if (Date.now() > doc.expiresAt) {
-          await mutateDeviceDelete(ctx, doc._id);
-          throw Cv.error({
-            code: "DEVICE_CODE_EXPIRED",
-            message:
-              "The device code has expired. Please start a new authorization request.",
-          });
-        }
-        if (
-          doc.lastPolledAt !== undefined &&
-          (Date.now() - doc.lastPolledAt) / 1000 < doc.interval
-        ) {
-          throw Cv.error({
-            code: "DEVICE_SLOW_DOWN",
-            message:
-              "Polling too frequently. Increase the interval between requests.",
-          });
-        }
-
-        await mutateDeviceUpdateLastPolled(ctx, doc._id, Date.now());
-
-        if (doc.status === "pending") {
-          throw Cv.error({
-            code: "DEVICE_AUTHORIZATION_PENDING",
-            message: "The user has not yet authorized this device.",
-          });
-        }
-        if (doc.status === "denied") {
-          await mutateDeviceDelete(ctx, doc._id);
-          throw Cv.error({
-            code: "DEVICE_CODE_DENIED",
-            message: "The authorization request was denied.",
-          });
-        }
-
-        if (!doc.userId || !doc.sessionId) {
-          throw Cv.error({
-            code: "INTERNAL_ERROR",
-            message: "Authorized device code missing userId or sessionId",
-          });
-        }
-
-        await mutateDeviceDelete(ctx, doc._id);
-        const signInResult = await callSignIn(ctx, {
-          userId: doc.userId,
-          sessionId: doc.sessionId,
-          generateTokens: true,
-        });
-        return { kind: "signedIn" as const, signedIn: signInResult };
-      }
-
-      if (typeof params.userCode !== "string") {
-        throw Cv.error({
-          code: "DEVICE_INVALID_USER_CODE",
-          message: "Missing `userCode` parameter for verify flow.",
-        });
-      }
-
-      const identity = await ctx.auth.getUserIdentity();
-      if (identity === null) {
-        throw Cv.error({
-          code: "NOT_SIGNED_IN",
-          message: "You must be signed in to authorize a device.",
-        });
-      }
-
-      const userId = userIdFromIdentitySubject(identity.subject);
-      const doc = await queryDeviceByUserCode(ctx, params.userCode);
-      if (doc === null) {
-        throw Cv.error({
-          code: "DEVICE_INVALID_USER_CODE",
-          message: "Invalid or expired user code.",
-        });
-      }
-      if (Date.now() > doc.expiresAt) {
-        await mutateDeviceDelete(ctx, doc._id);
-        throw Cv.error({
-          code: "DEVICE_CODE_EXPIRED",
-          message:
-            "The device code has expired. Please start a new authorization request.",
-        });
-      }
-      if (doc.status !== "pending") {
-        throw Cv.error({
-          code: "DEVICE_ALREADY_AUTHORIZED",
-          message: "This device code has already been authorized.",
-        });
-      }
-
-      const signInResult = await callSignIn(ctx, {
-        userId,
-        generateTokens: false,
-      });
-      await mutateDeviceAuthorize(
-        ctx,
-        doc._id,
-        signInResult.userId,
-        signInResult.sessionId,
-      );
-      return { kind: "signedIn" as const, signedIn: null };
-    },
-    err: (e) =>
-      e instanceof ConvexError
-        ? e
-        : Cv.error({
-            code: "INTERNAL_ERROR",
-            message: `Device flow failed: ${String(e)}`,
-          }),
-  });

package/src/server/enterprise/config.ts

@@ -1,51 +0,0 @@
-import { asRecord } from "./shared";
-
-const getProtocolConfig = (config: unknown, protocol: "oidc" | "saml") => {
-  const base = asRecord(config);
-  const direct = base?.[protocol];
-  const viaProtocols = asRecord(base?.protocols)?.[protocol];
-  return asRecord(direct) ?? asRecord(viaProtocols) ?? {};
-};
-
-/** @internal */
-export function getOidcConfig(config: unknown): Record<string, any> {
-  return getProtocolConfig(config, "oidc");
-}
-
-/** @internal */
-export function getPublicOidcConfig(config: unknown): Record<string, any> {
-  const oidc = getOidcConfig(config);
-  const { clientSecret: _clientSecret, ...publicOidc } = oidc;
-  return publicOidc;
-}
-
-/** @internal */
-export function withOidcSecretState(
-  config: Record<string, any>,
-  hasClientSecret: boolean,
-) {
-  return {
-    ...config,
-    hasClientSecret,
-  };
-}
-
-/** @internal */
-export function getSamlConfig(config: unknown): Record<string, any> {
-  return getProtocolConfig(config, "saml");
-}
-
-/** @internal */
-export function upsertProtocolConfig(
-  config: unknown,
-  protocol: "oidc" | "saml",
-  protocolConfig: Record<string, unknown>,
-) {
-  const base = asRecord(config) ?? {};
-  const protocols = asRecord(base.protocols) ?? {};
-  protocols[protocol] = {
-    ...asRecord(protocols[protocol]),
-    ...protocolConfig,
-  };
-  return { ...base, protocols };
-}