@robelest/convex-auth 0.0.4-preview.25 → 0.0.4-preview.28

package/dist/component/public/{enterprise → sso}/scim.js

@@ -1,30 +1,30 @@
+import { vGroupConnectionScimConfigDoc, vGroupConnectionScimIdentityDoc, vScimResourceType, vScimStatus } from "../../model.js";
 import { mutation, query } from "../../functions.js";
-import { vEnterpriseScimConfigDoc, vEnterpriseScimIdentityDoc, vScimResourceType, vScimStatus } from "../../model.js";
 import { v } from "convex/values";
 
-//#region src/component/public/enterprise/scim.ts
+//#region src/component/public/sso/scim.ts
 /**
-* Create or update the SCIM provisioning configuration for an enterprise.
+* Create or update the SCIM provisioning configuration for an group.sso.
 *
-* If a SCIM config already exists for the given enterprise, all fields are
+* If a SCIM config already exists for the given group connection, all fields are
 * patched in place (useful for rotating the bearer token). Otherwise a new
-* config document is created. Only one SCIM config is allowed per enterprise.
+* config document is created. Only one SCIM config is allowed per group.sso.
 *
-* @param args.enterpriseId - The ID of the enterprise to configure SCIM for.
-* @param args.groupId - The ID of the root group that owns the enterprise.
+* @param args.connectionId - The ID of the group connection to configure SCIM for.
+* @param args.groupId - The ID of the root group that owns the group.sso.
 * @param args.status - The SCIM config lifecycle status: `"draft"`, `"active"`, or `"disabled"`.
 * @param args.basePath - The base URL path for the SCIM endpoint (e.g. `"/scim/v2"`).
 * @param args.tokenHash - A hash of the bearer token used to authenticate SCIM requests.
 * @param args.lastRotatedAt - An optional epoch timestamp (ms) recording when the token was last rotated.
 * @param args.extend - An optional arbitrary extension object for custom SCIM settings.
-* @returns The ID of the created or updated `EnterpriseScimConfig` document.
+* @returns The ID of the created or updated `GroupConnectionScimConfig` document.
 *
 * @example
 * ```ts
 * const configId = await ctx.runMutation(
-*   components.auth.enterprise.enterpriseScimConfigUpsert,
+*   components.auth.group.sso.groupConnectionScimConfigUpsert,
 *   {
-*     enterpriseId,
+*     connectionId,
 *     groupId: orgGroupId,
 *     status: "active",
 *     basePath: "/scim/v2",
@@ -34,9 +34,9 @@ import { v } from "convex/values";
 * );
 * ```
 */
-const enterpriseScimConfigUpsert = mutation({
+const groupConnectionScimConfigUpsert = mutation({
 	args: {
-		enterpriseId: v.id("Enterprise"),
+		connectionId: v.id("GroupConnection"),
 		groupId: v.id("Group"),
 		status: vScimStatus,
 		basePath: v.string(),
@@ -44,47 +44,47 @@ const enterpriseScimConfigUpsert = mutation({
 		lastRotatedAt: v.optional(v.number()),
 		extend: v.optional(v.any())
 	},
-	returns: v.id("EnterpriseScimConfig"),
+	returns: v.id("GroupConnectionScimConfig"),
 	handler: async (ctx, args) => {
-		const existing = await ctx.db.query("EnterpriseScimConfig").withIndex("enterprise_id", (idx) => idx.eq("enterpriseId", args.enterpriseId)).first();
+		const existing = await ctx.db.query("GroupConnectionScimConfig").withIndex("group_connection_id", (idx) => idx.eq("connectionId", args.connectionId)).first();
 		if (existing) {
 			await ctx.db.patch(existing._id, args);
 			return existing._id;
 		}
-		return await ctx.db.insert("EnterpriseScimConfig", args);
+		return await ctx.db.insert("GroupConnectionScimConfig", args);
 	}
 });
 /**
-* Retrieve the SCIM configuration for a specific enterprise.
+* Retrieve the SCIM configuration for a specific group.sso.
 *
-* Looks up the SCIM config document by enterprise ID using the
-* `enterprise_id` index. Returns `null` if SCIM has not been configured.
+* Looks up the SCIM config document by group connection ID using the
+* `group_connection_id` index. Returns `null` if SCIM has not been configured.
 *
-* @param args.enterpriseId - The ID of the enterprise whose SCIM config to retrieve.
+* @param args.connectionId - The ID of the group connection whose SCIM config to retrieve.
 * @returns The SCIM configuration document, or `null` if not configured.
 *
 * @example
 * ```ts
 * const config = await ctx.runQuery(
-*   components.auth.enterprise.enterpriseScimConfigGetByEnterprise,
-*   { enterpriseId },
+*   components.auth.public.groupConnectionScimConfigGetByGroupConnection,
+*   { connectionId },
 * );
 * if (config) {
 *   console.log(config.status, config.basePath);
 * }
 * ```
 */
-const enterpriseScimConfigGetByEnterprise = query({
-	args: { enterpriseId: v.id("Enterprise") },
-	returns: v.union(vEnterpriseScimConfigDoc, v.null()),
-	handler: async (ctx, { enterpriseId }) => {
-		return await ctx.db.query("EnterpriseScimConfig").withIndex("enterprise_id", (idx) => idx.eq("enterpriseId", enterpriseId)).first();
+const groupConnectionScimConfigGetByGroupConnection = query({
+	args: { connectionId: v.id("GroupConnection") },
+	returns: v.union(vGroupConnectionScimConfigDoc, v.null()),
+	handler: async (ctx, { connectionId }) => {
+		return await ctx.db.query("GroupConnectionScimConfig").withIndex("group_connection_id", (idx) => idx.eq("connectionId", connectionId)).first();
 	}
 });
 /**
 * Look up a SCIM configuration by its bearer token hash.
 *
-* Used during SCIM request authentication to resolve which enterprise a
+* Used during SCIM request authentication to resolve which group connection a
 * given bearer token belongs to. Returns `null` if no config matches.
 *
 * @param args.tokenHash - The hash of the bearer token from the incoming SCIM request.
@@ -93,29 +93,29 @@ const enterpriseScimConfigGetByEnterprise = query({
 * @example
 * ```ts
 * const config = await ctx.runQuery(
-*   components.auth.enterprise.enterpriseScimConfigGetByTokenHash,
+*   components.auth.group.sso.groupConnectionScimConfigGetByTokenHash,
 *   { tokenHash: "sha256:abc123..." },
 * );
 * if (config) {
-*   console.log("Authenticated enterprise:", config.enterpriseId);
+*   console.log("Authenticated group:", config.connectionId);
 * }
 * ```
 */
-const enterpriseScimConfigGetByTokenHash = query({
+const groupConnectionScimConfigGetByTokenHash = query({
 	args: { tokenHash: v.string() },
-	returns: v.union(vEnterpriseScimConfigDoc, v.null()),
+	returns: v.union(vGroupConnectionScimConfigDoc, v.null()),
 	handler: async (ctx, { tokenHash }) => {
-		return await ctx.db.query("EnterpriseScimConfig").withIndex("token_hash", (idx) => idx.eq("tokenHash", tokenHash)).first();
+		return await ctx.db.query("GroupConnectionScimConfig").withIndex("token_hash", (idx) => idx.eq("tokenHash", tokenHash)).first();
 	}
 });
 /**
-* Retrieve a SCIM identity by enterprise, resource type, and external ID.
+* Retrieve a SCIM identity by group connection, resource type, and external ID.
 *
 * Looks up a SCIM-provisioned identity using the composite index on
-* `(enterpriseId, resourceType, externalId)`. This is the primary lookup
+* `(connectionId, resourceType, externalId)`. This is the primary lookup
 * used when processing incoming SCIM user or group operations.
 *
-* @param args.enterpriseId - The ID of the enterprise that owns the SCIM identity.
+* @param args.connectionId - The ID of the group connection that owns the SCIM identity.
 * @param args.resourceType - The SCIM resource type: `"user"` or `"group"`.
 * @param args.externalId - The external identifier assigned by the identity provider.
 * @returns The SCIM identity document, or `null` if not found.
@@ -123,24 +123,24 @@ const enterpriseScimConfigGetByTokenHash = query({
 * @example
 * ```ts
 * const identity = await ctx.runQuery(
-*   components.auth.enterprise.enterpriseScimIdentityGet,
+*   components.auth.group.sso.groupConnectionScimIdentityGet,
 *   {
-*     enterpriseId,
+*     connectionId,
 *     resourceType: "user",
 *     externalId: "okta-user-abc123",
 *   },
 * );
 * ```
 */
-const enterpriseScimIdentityGet = query({
+const groupConnectionScimIdentityGet = query({
 	args: {
-		enterpriseId: v.id("Enterprise"),
+		connectionId: v.id("GroupConnection"),
 		resourceType: vScimResourceType,
 		externalId: v.string()
 	},
-	returns: v.union(vEnterpriseScimIdentityDoc, v.null()),
+	returns: v.union(vGroupConnectionScimIdentityDoc, v.null()),
 	handler: async (ctx, args) => {
-		return await ctx.db.query("EnterpriseScimIdentity").withIndex("enterprise_id_resource_type_external_id", (idx) => idx.eq("enterpriseId", args.enterpriseId).eq("resourceType", args.resourceType).eq("externalId", args.externalId)).first();
+		return await ctx.db.query("GroupConnectionScimIdentity").withIndex("group_connection_id_resource_type_external_id", (idx) => idx.eq("connectionId", args.connectionId).eq("resourceType", args.resourceType).eq("externalId", args.externalId)).first();
 	}
 });
 /**
@@ -156,7 +156,7 @@ const enterpriseScimIdentityGet = query({
 * @example
 * ```ts
 * const scimIdentity = await ctx.runQuery(
-*   components.auth.enterprise.enterpriseScimIdentityGetByUser,
+*   components.auth.group.sso.groupConnectionScimIdentityGetByUser,
 *   { userId },
 * );
 * if (scimIdentity) {
@@ -164,40 +164,40 @@ const enterpriseScimIdentityGet = query({
 * }
 * ```
 */
-const enterpriseScimIdentityGetByUser = query({
+const groupConnectionScimIdentityGetByUser = query({
 	args: { userId: v.id("User") },
-	returns: v.union(vEnterpriseScimIdentityDoc, v.null()),
+	returns: v.union(vGroupConnectionScimIdentityDoc, v.null()),
 	handler: async (ctx, { userId }) => {
-		return await ctx.db.query("EnterpriseScimIdentity").withIndex("user_id", (idx) => idx.eq("userId", userId)).first();
+		return await ctx.db.query("GroupConnectionScimIdentity").withIndex("user_id", (idx) => idx.eq("userId", userId)).first();
 	}
 });
 /**
-* Retrieve the SCIM identity for a specific user within a specific enterprise.
+* Retrieve the SCIM identity for a specific user within a specific group.sso.
 *
-* Uses the composite `(enterpriseId, userId)` index to find the SCIM identity
-* that links a user to a particular enterprise. This is useful when a user may
-* belong to multiple enterprises.
+* Uses the composite `(connectionId, userId)` index to find the SCIM identity
+* that links a user to a particular group.sso. This is useful when a user may
+* belong to multiple group connections.
 *
-* @param args.enterpriseId - The ID of the enterprise to scope the lookup to.
+* @param args.connectionId - The ID of the group connection to scope the lookup to.
 * @param args.userId - The document ID of the user.
 * @returns The SCIM identity document, or `null` if not found.
 *
 * @example
 * ```ts
 * const identity = await ctx.runQuery(
-*   components.auth.enterprise.enterpriseScimIdentityGetByEnterpriseAndUser,
-*   { enterpriseId, userId },
+*   components.auth.public.groupConnectionScimIdentityGetByGroupConnectionAndUser,
+*   { connectionId, userId },
 * );
 * ```
 */
-const enterpriseScimIdentityGetByEnterpriseAndUser = query({
+const groupConnectionScimIdentityGetByGroupConnectionAndUser = query({
 	args: {
-		enterpriseId: v.id("Enterprise"),
+		connectionId: v.id("GroupConnection"),
 		userId: v.id("User")
 	},
-	returns: v.union(vEnterpriseScimIdentityDoc, v.null()),
-	handler: async (ctx, { enterpriseId, userId }) => {
-		return await ctx.db.query("EnterpriseScimIdentity").withIndex("enterprise_id_user_id", (idx) => idx.eq("enterpriseId", enterpriseId).eq("userId", userId)).first();
+	returns: v.union(vGroupConnectionScimIdentityDoc, v.null()),
+	handler: async (ctx, { connectionId, userId }) => {
+		return await ctx.db.query("GroupConnectionScimIdentity").withIndex("group_connection_id_user_id", (idx) => idx.eq("connectionId", connectionId).eq("userId", userId)).first();
 	}
 });
 /**
@@ -213,7 +213,7 @@ const enterpriseScimIdentityGetByEnterpriseAndUser = query({
 * @example
 * ```ts
 * const scimGroup = await ctx.runQuery(
-*   components.auth.enterprise.enterpriseScimIdentityGetByMappedGroup,
+*   components.auth.public.groupConnectionScimIdentityGetByMappedGroup,
 *   { mappedGroupId: teamGroupId },
 * );
 * if (scimGroup) {
@@ -221,50 +221,50 @@ const enterpriseScimIdentityGetByEnterpriseAndUser = query({
 * }
 * ```
 */
-const enterpriseScimIdentityGetByMappedGroup = query({
+const groupConnectionScimIdentityGetByMappedGroup = query({
 	args: { mappedGroupId: v.id("Group") },
-	returns: v.union(vEnterpriseScimIdentityDoc, v.null()),
+	returns: v.union(vGroupConnectionScimIdentityDoc, v.null()),
 	handler: async (ctx, { mappedGroupId }) => {
-		return await ctx.db.query("EnterpriseScimIdentity").withIndex("mapped_group_id", (idx) => idx.eq("mappedGroupId", mappedGroupId)).first();
+		return await ctx.db.query("GroupConnectionScimIdentity").withIndex("mapped_group_id", (idx) => idx.eq("mappedGroupId", mappedGroupId)).first();
 	}
 });
 /**
-* List all SCIM identities belonging to a specific enterprise.
+* List all SCIM identities belonging to a specific group.sso.
 *
-* Returns all `EnterpriseScimIdentity` documents for the given enterprise,
+* Returns all `GroupConnectionScimIdentity` documents for the given group connection,
 * including both user and group resource types. Useful for displaying all
 * SCIM-provisioned resources or for bulk operations.
 *
-* @param args.enterpriseId - The ID of the enterprise whose SCIM identities to list.
+* @param args.connectionId - The ID of the group connection whose SCIM identities to list.
 * @returns An array of SCIM identity documents.
 *
 * @example
 * ```ts
 * const identities = await ctx.runQuery(
-*   components.auth.enterprise.enterpriseScimIdentityListByEnterprise,
-*   { enterpriseId },
+*   components.auth.public.groupConnectionScimIdentityListByGroupConnection,
+*   { connectionId },
 * );
 * const users = identities.filter((i) => i.resourceType === "user");
 * const groups = identities.filter((i) => i.resourceType === "group");
 * ```
 */
-const enterpriseScimIdentityListByEnterprise = query({
-	args: { enterpriseId: v.id("Enterprise") },
-	returns: v.array(vEnterpriseScimIdentityDoc),
-	handler: async (ctx, { enterpriseId }) => {
-		return await ctx.db.query("EnterpriseScimIdentity").withIndex("enterprise_id", (idx) => idx.eq("enterpriseId", enterpriseId)).collect();
+const groupConnectionScimIdentityListByGroupConnection = query({
+	args: { connectionId: v.id("GroupConnection") },
+	returns: v.array(vGroupConnectionScimIdentityDoc),
+	handler: async (ctx, { connectionId }) => {
+		return await ctx.db.query("GroupConnectionScimIdentity").withIndex("group_connection_id", (idx) => idx.eq("connectionId", connectionId)).collect();
 	}
 });
 /**
 * Create or update a SCIM-provisioned identity record.
 *
-* If a SCIM identity with the same `(enterpriseId, resourceType, externalId)`
+* If a SCIM identity with the same `(connectionId, resourceType, externalId)`
 * already exists, its fields are patched in place. Otherwise a new record is
 * created. This is the core upsert used by the SCIM provisioning handler to
 * sync users and groups from external identity providers.
 *
-* @param args.enterpriseId - The ID of the enterprise the identity belongs to.
-* @param args.groupId - The ID of the root group that owns the enterprise.
+* @param args.connectionId - The ID of the group connection the identity belongs to.
+* @param args.groupId - The ID of the root group that owns the group.sso.
 * @param args.resourceType - The SCIM resource type: `"user"` or `"group"`.
 * @param args.externalId - The external identifier assigned by the identity provider.
 * @param args.userId - An optional link to the internal user document (for user resources).
@@ -272,14 +272,14 @@ const enterpriseScimIdentityListByEnterprise = query({
 * @param args.lastProvisionedAt - An optional epoch timestamp (ms) of the last sync.
 * @param args.active - An optional flag indicating whether the identity is active.
 * @param args.raw - An optional raw SCIM payload stored for debugging or re-processing.
-* @returns The ID of the created or updated `EnterpriseScimIdentity` document.
+* @returns The ID of the created or updated `GroupConnectionScimIdentity` document.
 *
 * @example
 * ```ts
 * const identityId = await ctx.runMutation(
-*   components.auth.enterprise.enterpriseScimIdentityUpsert,
+*   components.auth.group.sso.groupConnectionScimIdentityUpsert,
 *   {
-*     enterpriseId,
+*     connectionId,
 *     groupId: orgGroupId,
 *     resourceType: "user",
 *     externalId: "okta-user-abc123",
@@ -291,9 +291,9 @@ const enterpriseScimIdentityListByEnterprise = query({
 * );
 * ```
 */
-const enterpriseScimIdentityUpsert = mutation({
+const groupConnectionScimIdentityUpsert = mutation({
 	args: {
-		enterpriseId: v.id("Enterprise"),
+		connectionId: v.id("GroupConnection"),
 		groupId: v.id("Group"),
 		resourceType: vScimResourceType,
 		externalId: v.string(),
@@ -303,20 +303,20 @@ const enterpriseScimIdentityUpsert = mutation({
 		active: v.optional(v.boolean()),
 		raw: v.optional(v.any())
 	},
-	returns: v.id("EnterpriseScimIdentity"),
+	returns: v.id("GroupConnectionScimIdentity"),
 	handler: async (ctx, args) => {
-		const existing = await ctx.db.query("EnterpriseScimIdentity").withIndex("enterprise_id_resource_type_external_id", (idx) => idx.eq("enterpriseId", args.enterpriseId).eq("resourceType", args.resourceType).eq("externalId", args.externalId)).first();
+		const existing = await ctx.db.query("GroupConnectionScimIdentity").withIndex("group_connection_id_resource_type_external_id", (idx) => idx.eq("connectionId", args.connectionId).eq("resourceType", args.resourceType).eq("externalId", args.externalId)).first();
 		if (existing) {
 			await ctx.db.patch(existing._id, args);
 			return existing._id;
 		}
-		return await ctx.db.insert("EnterpriseScimIdentity", args);
+		return await ctx.db.insert("GroupConnectionScimIdentity", args);
 	}
 });
 /**
 * Permanently delete a SCIM identity record.
 *
-* Removes the `EnterpriseScimIdentity` document. This is typically called
+* Removes the `GroupConnectionScimIdentity` document. This is typically called
 * when a SCIM DELETE request is received for a user or group resource.
 *
 * @param args.identityId - The document ID of the SCIM identity to delete.
@@ -325,13 +325,13 @@ const enterpriseScimIdentityUpsert = mutation({
 * @example
 * ```ts
 * await ctx.runMutation(
-*   components.auth.enterprise.enterpriseScimIdentityDelete,
+*   components.auth.group.sso.groupConnectionScimIdentityDelete,
 *   { identityId: scimIdentity._id },
 * );
 * ```
 */
-const enterpriseScimIdentityDelete = mutation({
-	args: { identityId: v.id("EnterpriseScimIdentity") },
+const groupConnectionScimIdentityDelete = mutation({
+	args: { identityId: v.id("GroupConnectionScimIdentity") },
 	returns: v.null(),
 	handler: async (ctx, { identityId }) => {
 		await ctx.db.delete(identityId);
@@ -340,5 +340,5 @@ const enterpriseScimIdentityDelete = mutation({
 });
 
 //#endregion
-export { enterpriseScimConfigGetByEnterprise, enterpriseScimConfigGetByTokenHash, enterpriseScimConfigUpsert, enterpriseScimIdentityDelete, enterpriseScimIdentityGet, enterpriseScimIdentityGetByEnterpriseAndUser, enterpriseScimIdentityGetByMappedGroup, enterpriseScimIdentityGetByUser, enterpriseScimIdentityListByEnterprise, enterpriseScimIdentityUpsert };
+export { groupConnectionScimConfigGetByGroupConnection, groupConnectionScimConfigGetByTokenHash, groupConnectionScimConfigUpsert, groupConnectionScimIdentityDelete, groupConnectionScimIdentityGet, groupConnectionScimIdentityGetByGroupConnectionAndUser, groupConnectionScimIdentityGetByMappedGroup, groupConnectionScimIdentityGetByUser, groupConnectionScimIdentityListByGroupConnection, groupConnectionScimIdentityUpsert };
 //# sourceMappingURL=scim.js.map

package/dist/component/public/sso/secrets.js

@@ -0,0 +1,125 @@
+import { vGroupConnectionSecretDoc, vGroupConnectionSecretKind } from "../../model.js";
+import { mutation, query } from "../../functions.js";
+import { v } from "convex/values";
+
+//#region src/component/public/sso/secrets.ts
+/**
+* Create or update an encrypted secret for an connection.
+*
+* Stores a secret identified by the combination of `(connectionId, kind)`.
+* If a secret of the same kind already exists for the connection, it is
+* updated with the new ciphertext and timestamp. Otherwise a new secret
+* document is created. Only one secret per kind is allowed per connection.
+*
+* @param args.connectionId - The ID of the connection the secret belongs to.
+* @param args.groupId - The ID of the root group that owns the connection.
+* @param args.kind - The type of secret being stored (e.g. `"oidc_client_secret"`).
+* @param args.ciphertext - The encrypted secret value.
+* @param args.updatedAt - Epoch timestamp (ms) when the secret was last updated.
+* @returns The ID of the created or updated `GroupConnectionSecret` document.
+*
+* @example
+* ```ts
+* const secretId = await ctx.runMutation(
+*   components.auth.connection.groupConnectionSecretUpsert,
+*   {
+*     connectionId,
+*     groupId: orgGroupId,
+*     kind: "oidc_client_secret",
+*     ciphertext: "encrypted:aes256:...",
+*     updatedAt: Date.now(),
+*   },
+* );
+* ```
+*/
+const groupConnectionSecretUpsert = mutation({
+	args: {
+		connectionId: v.id("GroupConnection"),
+		groupId: v.id("Group"),
+		kind: vGroupConnectionSecretKind,
+		ciphertext: v.string(),
+		updatedAt: v.number()
+	},
+	returns: v.id("GroupConnectionSecret"),
+	handler: async (ctx, args) => {
+		const { connectionId, ...rest } = args;
+		const existing = await ctx.db.query("GroupConnectionSecret").withIndex("connection_id_kind", (idx) => idx.eq("connectionId", connectionId).eq("kind", args.kind)).first();
+		if (existing) {
+			await ctx.db.patch(existing._id, {
+				connectionId,
+				...rest
+			});
+			return existing._id;
+		}
+		return await ctx.db.insert("GroupConnectionSecret", {
+			connectionId,
+			...rest
+		});
+	}
+});
+/**
+* Retrieve an encrypted secret for an connection by kind.
+*
+* Looks up the secret using the composite `(connectionId, kind)` index.
+* Returns the full document including the ciphertext, or `null` if no secret
+* of that kind has been stored for the connection.
+*
+* @param args.connectionId - The ID of the connection whose secret to retrieve.
+* @param args.kind - The type of secret to look up (e.g. `"oidc_client_secret"`).
+* @returns The connection secret document, or `null` if not found.
+*
+* @example
+* ```ts
+* const secret = await ctx.runQuery(
+*   components.auth.connection.groupConnectionSecretGet,
+*   { connectionId, kind: "oidc_client_secret" },
+* );
+* if (secret) {
+*   const plaintext = decrypt(secret.ciphertext);
+* }
+* ```
+*/
+const groupConnectionSecretGet = query({
+	args: {
+		connectionId: v.id("GroupConnection"),
+		kind: vGroupConnectionSecretKind
+	},
+	returns: v.union(vGroupConnectionSecretDoc, v.null()),
+	handler: async (ctx, { connectionId, kind }) => {
+		return await ctx.db.query("GroupConnectionSecret").withIndex("connection_id_kind", (idx) => idx.eq("connectionId", connectionId).eq("kind", kind)).first();
+	}
+});
+/**
+* Delete an encrypted secret for an connection by kind.
+*
+* Removes the secret document matching the `(connectionId, kind)` pair.
+* If no such secret exists, this is a no-op.
+*
+* @param args.connectionId - The ID of the connection whose secret to delete.
+* @param args.kind - The type of secret to remove (e.g. `"oidc_client_secret"`).
+* @returns `null` on success.
+*
+* @example
+* ```ts
+* await ctx.runMutation(
+*   components.auth.connection.groupConnectionSecretDelete,
+*   { connectionId, kind: "oidc_client_secret" },
+* );
+* ```
+*/
+const groupConnectionSecretDelete = mutation({
+	args: {
+		connectionId: v.id("GroupConnection"),
+		kind: vGroupConnectionSecretKind
+	},
+	returns: v.null(),
+	handler: async (ctx, { connectionId, kind }) => {
+		const existing = await ctx.db.query("GroupConnectionSecret").withIndex("connection_id_kind", (idx) => idx.eq("connectionId", connectionId).eq("kind", kind)).first();
+		if (existing) await ctx.db.delete(existing._id);
+		return null;
+	}
+});
+
+//#endregion
+export { groupConnectionSecretDelete, groupConnectionSecretGet, groupConnectionSecretUpsert };
+//# sourceMappingURL=secrets.js.map