@robelest/convex-auth 0.0.4-preview.25 → 0.0.4-preview.28

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (666) hide show
  1. package/README.md +43 -36
  2. package/dist/bin.js +5765 -4880
  3. package/dist/browser/index.d.ts +30 -0
  4. package/dist/browser/index.js +93 -0
  5. package/dist/browser/locks.js +11 -0
  6. package/dist/browser/navigation.js +14 -0
  7. package/dist/{factors → browser}/passkey.js +23 -32
  8. package/dist/browser/runtime.js +92 -0
  9. package/dist/client/core/types.d.ts +452 -5
  10. package/dist/client/core/types.js +17 -0
  11. package/dist/client/errors.js +19 -0
  12. package/dist/client/factors/device.js +94 -0
  13. package/dist/{factors → client/factors}/totp.js +12 -4
  14. package/dist/client/index.d.ts +47 -1
  15. package/dist/client/index.js +269 -232
  16. package/dist/client/runtime/mutex.js +24 -0
  17. package/dist/client/runtime/proxy.js +30 -0
  18. package/dist/client/runtime/storage.js +45 -0
  19. package/dist/client/services/adapters.js +7 -0
  20. package/dist/client/services/http.js +6 -0
  21. package/dist/client/services/resolve.js +13 -0
  22. package/dist/client/services/runtime.js +6 -0
  23. package/dist/component/_generated/component.d.ts +1355 -1399
  24. package/dist/component/convex.config.d.ts +2 -2
  25. package/dist/component/index.d.ts +4 -26
  26. package/dist/component/index.js +1 -1
  27. package/dist/component/model.d.ts +26 -112
  28. package/dist/component/model.js +76 -54
  29. package/dist/component/modules.js +38 -0
  30. package/dist/component/public/factors/devices.js +1 -1
  31. package/dist/component/public/factors/passkeys.js +1 -1
  32. package/dist/component/public/factors/totp.js +1 -1
  33. package/dist/component/public/groups/core.js +2 -2
  34. package/dist/component/public/groups/invites.js +1 -1
  35. package/dist/component/public/groups/members.js +1 -1
  36. package/dist/component/public/identity/accounts.js +1 -1
  37. package/dist/component/public/identity/codes.js +1 -1
  38. package/dist/component/public/identity/sessions.js +39 -2
  39. package/dist/component/public/identity/tokens.js +82 -4
  40. package/dist/component/public/identity/users.js +1 -1
  41. package/dist/component/public/identity/verifiers.js +10 -4
  42. package/dist/component/public/security/keys.js +1 -1
  43. package/dist/component/public/security/limits.js +1 -1
  44. package/dist/component/public/{enterprise → sso}/audit.js +26 -26
  45. package/dist/component/public/sso/core.js +263 -0
  46. package/dist/component/public/sso/domains.js +280 -0
  47. package/dist/component/public/{enterprise → sso}/scim.js +87 -87
  48. package/dist/component/public/sso/secrets.js +125 -0
  49. package/dist/component/public/{enterprise → sso}/webhooks.js +59 -59
  50. package/dist/component/public.js +9 -9
  51. package/dist/component/schema.d.ts +472 -393
  52. package/dist/component/schema.js +36 -35
  53. package/dist/core/index.d.ts +380 -0
  54. package/dist/core/index.js +83 -0
  55. package/dist/otel.d.ts +69 -0
  56. package/dist/otel.js +82 -0
  57. package/dist/providers/anonymous.d.ts +15 -34
  58. package/dist/providers/anonymous.js +27 -35
  59. package/dist/providers/apple.d.ts +59 -0
  60. package/dist/providers/apple.js +58 -0
  61. package/dist/providers/credentials.d.ts +18 -34
  62. package/dist/providers/credentials.js +16 -27
  63. package/dist/providers/custom.d.ts +94 -0
  64. package/dist/providers/custom.js +119 -0
  65. package/dist/providers/device.d.ts +15 -49
  66. package/dist/providers/device.js +17 -34
  67. package/dist/providers/email.d.ts +21 -38
  68. package/dist/providers/email.js +36 -55
  69. package/dist/providers/github.d.ts +54 -0
  70. package/dist/providers/github.js +75 -0
  71. package/dist/providers/google.d.ts +54 -0
  72. package/dist/providers/google.js +61 -0
  73. package/dist/providers/index.d.ts +16 -12
  74. package/dist/providers/index.js +15 -11
  75. package/dist/providers/microsoft.d.ts +57 -0
  76. package/dist/providers/microsoft.js +101 -0
  77. package/dist/providers/passkey.d.ts +19 -35
  78. package/dist/providers/passkey.js +20 -30
  79. package/dist/providers/password.d.ts +17 -18
  80. package/dist/providers/password.js +121 -143
  81. package/dist/providers/phone.d.ts +13 -28
  82. package/dist/providers/phone.js +21 -46
  83. package/dist/providers/sso.d.ts +16 -36
  84. package/dist/providers/sso.js +21 -22
  85. package/dist/providers/totp.d.ts +13 -29
  86. package/dist/providers/totp.js +17 -27
  87. package/dist/server/auth-context.d.ts +204 -0
  88. package/dist/server/auth-context.js +76 -0
  89. package/dist/server/auth.d.ts +99 -244
  90. package/dist/server/auth.js +56 -152
  91. package/dist/server/componentContext.d.ts +12 -0
  92. package/dist/server/componentContext.js +1 -0
  93. package/dist/server/config.js +6 -67
  94. package/dist/server/constants.js +6 -0
  95. package/dist/server/contract.d.ts +105 -0
  96. package/dist/server/contract.js +43 -0
  97. package/dist/server/cookies.js +3 -2
  98. package/dist/server/core.js +31 -36
  99. package/dist/server/crypto.js +34 -44
  100. package/dist/server/db.js +6 -1
  101. package/dist/server/device.js +96 -130
  102. package/dist/server/env.js +48 -0
  103. package/dist/server/errors.js +20 -0
  104. package/dist/server/http.d.ts +15 -59
  105. package/dist/server/http.js +136 -120
  106. package/dist/server/identity.js +2 -2
  107. package/dist/server/index.d.ts +5 -4
  108. package/dist/server/index.js +3 -3
  109. package/dist/server/keys.js +10 -1
  110. package/dist/server/limits.js +26 -26
  111. package/dist/server/log.js +28 -0
  112. package/dist/server/mounts.d.ts +1107 -296
  113. package/dist/server/mounts.js +315 -196
  114. package/dist/server/mutations/account.js +11 -14
  115. package/dist/server/mutations/code.js +6 -5
  116. package/dist/server/mutations/invalidate.js +9 -11
  117. package/dist/server/mutations/oauth.js +112 -73
  118. package/dist/server/mutations/refresh.js +47 -97
  119. package/dist/server/mutations/register.js +37 -35
  120. package/dist/server/mutations/retrieve.js +16 -16
  121. package/dist/server/mutations/signature.js +15 -18
  122. package/dist/server/mutations/signin.js +10 -5
  123. package/dist/server/mutations/signout.js +11 -14
  124. package/dist/server/mutations/store.js +25 -18
  125. package/dist/server/mutations/verifier.js +11 -8
  126. package/dist/server/mutations/verify.js +53 -41
  127. package/dist/server/oauth/factory.js +44 -0
  128. package/dist/server/oauth/index.js +12 -0
  129. package/dist/server/oauth/runtime.js +248 -0
  130. package/dist/server/passkey.js +331 -365
  131. package/dist/server/payloads.d.ts +16 -0
  132. package/dist/server/payloads.js +30 -0
  133. package/dist/server/{ssr.d.ts → prefetch.d.ts} +2 -2
  134. package/dist/server/prefetch.js +635 -0
  135. package/dist/server/random.js +19 -0
  136. package/dist/server/redirects.js +10 -5
  137. package/dist/server/refresh.js +14 -86
  138. package/dist/server/runtime.d.ts +531 -31
  139. package/dist/server/runtime.js +106 -267
  140. package/dist/server/secret.js +44 -0
  141. package/dist/server/services/config.js +10 -0
  142. package/dist/server/services/group.js +211 -0
  143. package/dist/server/services/logger.js +8 -0
  144. package/dist/server/services/providers.js +22 -0
  145. package/dist/server/services/refresh.js +8 -0
  146. package/dist/server/services/resolve.js +27 -0
  147. package/dist/server/services/signin.js +8 -0
  148. package/dist/server/sessions.js +35 -34
  149. package/dist/server/signin.js +229 -140
  150. package/dist/server/{enterprise → sso}/config.js +10 -3
  151. package/dist/server/sso/domain.d.ts +614 -0
  152. package/dist/server/sso/domain.js +1175 -0
  153. package/dist/server/sso/http.js +1060 -0
  154. package/dist/server/sso/oidc.js +324 -0
  155. package/dist/server/sso/policies.js +59 -0
  156. package/dist/server/sso/policy.js +139 -0
  157. package/dist/server/sso/profile.js +22 -0
  158. package/dist/server/sso/provision.js +179 -0
  159. package/dist/{component/server/enterprise → server/sso}/saml.js +142 -56
  160. package/dist/{component/server/enterprise → server/sso}/scim.js +13 -7
  161. package/dist/server/sso/shared.js +74 -0
  162. package/dist/server/sso/validators.js +88 -0
  163. package/dist/server/sso/webhook.js +94 -0
  164. package/dist/server/tokens.js +16 -4
  165. package/dist/server/totp.js +155 -164
  166. package/dist/server/types.d.ts +306 -296
  167. package/dist/server/types.js +1 -30
  168. package/dist/server/url.js +32 -0
  169. package/dist/server/users.js +74 -40
  170. package/dist/server/utils/cache.js +51 -0
  171. package/dist/server/utils/dispatch.js +36 -0
  172. package/dist/server/utils/retry.js +24 -0
  173. package/dist/server/utils/span.js +32 -0
  174. package/dist/shared/errors.js +19 -0
  175. package/dist/shared/log.js +45 -0
  176. package/{src/test.ts → dist/test.d.ts} +21 -22
  177. package/dist/test.js +51 -0
  178. package/package.json +70 -42
  179. package/dist/authorization/index.d.ts.map +0 -1
  180. package/dist/authorization/index.js.map +0 -1
  181. package/dist/client/core/types.d.ts.map +0 -1
  182. package/dist/client/index.d.ts.map +0 -1
  183. package/dist/client/index.js.map +0 -1
  184. package/dist/component/_generated/api.d.ts +0 -75
  185. package/dist/component/_generated/api.d.ts.map +0 -1
  186. package/dist/component/_generated/api.js.map +0 -1
  187. package/dist/component/_generated/component.d.ts.map +0 -1
  188. package/dist/component/_generated/dataModel.d.ts +0 -42
  189. package/dist/component/_generated/dataModel.d.ts.map +0 -1
  190. package/dist/component/_generated/server.d.ts +0 -117
  191. package/dist/component/_generated/server.d.ts.map +0 -1
  192. package/dist/component/_generated/server.js.map +0 -1
  193. package/dist/component/_virtual/rolldown_runtime.js +0 -18
  194. package/dist/component/client/core/types.d.ts +0 -2
  195. package/dist/component/client/index.d.ts +0 -1
  196. package/dist/component/convex.config.d.ts.map +0 -1
  197. package/dist/component/convex.config.js.map +0 -1
  198. package/dist/component/functions.d.ts +0 -25
  199. package/dist/component/functions.d.ts.map +0 -1
  200. package/dist/component/functions.js.map +0 -1
  201. package/dist/component/index.d.ts.map +0 -1
  202. package/dist/component/model.d.ts.map +0 -1
  203. package/dist/component/model.js.map +0 -1
  204. package/dist/component/providers/anonymous.d.ts +0 -54
  205. package/dist/component/providers/anonymous.d.ts.map +0 -1
  206. package/dist/component/providers/credentials.d.ts +0 -38
  207. package/dist/component/providers/credentials.d.ts.map +0 -1
  208. package/dist/component/providers/device.d.ts +0 -67
  209. package/dist/component/providers/device.d.ts.map +0 -1
  210. package/dist/component/providers/email.d.ts +0 -62
  211. package/dist/component/providers/email.d.ts.map +0 -1
  212. package/dist/component/providers/oauth.d.ts +0 -25
  213. package/dist/component/providers/oauth.d.ts.map +0 -1
  214. package/dist/component/providers/oauth.js +0 -13
  215. package/dist/component/providers/oauth.js.map +0 -1
  216. package/dist/component/providers/passkey.d.ts +0 -57
  217. package/dist/component/providers/passkey.d.ts.map +0 -1
  218. package/dist/component/providers/password.d.ts +0 -88
  219. package/dist/component/providers/password.d.ts.map +0 -1
  220. package/dist/component/providers/phone.d.ts +0 -48
  221. package/dist/component/providers/phone.d.ts.map +0 -1
  222. package/dist/component/providers/sso.d.ts +0 -50
  223. package/dist/component/providers/sso.d.ts.map +0 -1
  224. package/dist/component/providers/totp.d.ts +0 -45
  225. package/dist/component/providers/totp.d.ts.map +0 -1
  226. package/dist/component/public/enterprise/audit.d.ts +0 -73
  227. package/dist/component/public/enterprise/audit.d.ts.map +0 -1
  228. package/dist/component/public/enterprise/audit.js.map +0 -1
  229. package/dist/component/public/enterprise/core.d.ts +0 -176
  230. package/dist/component/public/enterprise/core.d.ts.map +0 -1
  231. package/dist/component/public/enterprise/core.js +0 -292
  232. package/dist/component/public/enterprise/core.js.map +0 -1
  233. package/dist/component/public/enterprise/domains.d.ts +0 -174
  234. package/dist/component/public/enterprise/domains.d.ts.map +0 -1
  235. package/dist/component/public/enterprise/domains.js +0 -271
  236. package/dist/component/public/enterprise/domains.js.map +0 -1
  237. package/dist/component/public/enterprise/scim.d.ts +0 -245
  238. package/dist/component/public/enterprise/scim.d.ts.map +0 -1
  239. package/dist/component/public/enterprise/scim.js.map +0 -1
  240. package/dist/component/public/enterprise/secrets.d.ts +0 -78
  241. package/dist/component/public/enterprise/secrets.d.ts.map +0 -1
  242. package/dist/component/public/enterprise/secrets.js +0 -118
  243. package/dist/component/public/enterprise/secrets.js.map +0 -1
  244. package/dist/component/public/enterprise/webhooks.d.ts +0 -211
  245. package/dist/component/public/enterprise/webhooks.d.ts.map +0 -1
  246. package/dist/component/public/enterprise/webhooks.js.map +0 -1
  247. package/dist/component/public/factors/devices.d.ts +0 -157
  248. package/dist/component/public/factors/devices.d.ts.map +0 -1
  249. package/dist/component/public/factors/devices.js.map +0 -1
  250. package/dist/component/public/factors/passkeys.d.ts +0 -175
  251. package/dist/component/public/factors/passkeys.d.ts.map +0 -1
  252. package/dist/component/public/factors/passkeys.js.map +0 -1
  253. package/dist/component/public/factors/totp.d.ts +0 -189
  254. package/dist/component/public/factors/totp.d.ts.map +0 -1
  255. package/dist/component/public/factors/totp.js.map +0 -1
  256. package/dist/component/public/groups/core.d.ts +0 -137
  257. package/dist/component/public/groups/core.d.ts.map +0 -1
  258. package/dist/component/public/groups/core.js.map +0 -1
  259. package/dist/component/public/groups/invites.d.ts +0 -217
  260. package/dist/component/public/groups/invites.d.ts.map +0 -1
  261. package/dist/component/public/groups/invites.js.map +0 -1
  262. package/dist/component/public/groups/members.d.ts +0 -204
  263. package/dist/component/public/groups/members.d.ts.map +0 -1
  264. package/dist/component/public/groups/members.js.map +0 -1
  265. package/dist/component/public/identity/accounts.d.ts +0 -147
  266. package/dist/component/public/identity/accounts.d.ts.map +0 -1
  267. package/dist/component/public/identity/accounts.js.map +0 -1
  268. package/dist/component/public/identity/codes.d.ts +0 -104
  269. package/dist/component/public/identity/codes.d.ts.map +0 -1
  270. package/dist/component/public/identity/codes.js.map +0 -1
  271. package/dist/component/public/identity/sessions.d.ts +0 -128
  272. package/dist/component/public/identity/sessions.d.ts.map +0 -1
  273. package/dist/component/public/identity/sessions.js.map +0 -1
  274. package/dist/component/public/identity/tokens.d.ts +0 -169
  275. package/dist/component/public/identity/tokens.d.ts.map +0 -1
  276. package/dist/component/public/identity/tokens.js.map +0 -1
  277. package/dist/component/public/identity/users.d.ts +0 -212
  278. package/dist/component/public/identity/users.d.ts.map +0 -1
  279. package/dist/component/public/identity/users.js.map +0 -1
  280. package/dist/component/public/identity/verifiers.d.ts +0 -116
  281. package/dist/component/public/identity/verifiers.d.ts.map +0 -1
  282. package/dist/component/public/identity/verifiers.js.map +0 -1
  283. package/dist/component/public/security/keys.d.ts +0 -209
  284. package/dist/component/public/security/keys.d.ts.map +0 -1
  285. package/dist/component/public/security/keys.js.map +0 -1
  286. package/dist/component/public/security/limits.d.ts +0 -114
  287. package/dist/component/public/security/limits.d.ts.map +0 -1
  288. package/dist/component/public/security/limits.js.map +0 -1
  289. package/dist/component/public.d.ts +0 -28
  290. package/dist/component/public.d.ts.map +0 -1
  291. package/dist/component/schema.d.ts.map +0 -1
  292. package/dist/component/schema.js.map +0 -1
  293. package/dist/component/server/auth.d.ts +0 -447
  294. package/dist/component/server/auth.d.ts.map +0 -1
  295. package/dist/component/server/auth.js +0 -254
  296. package/dist/component/server/auth.js.map +0 -1
  297. package/dist/component/server/config.js +0 -121
  298. package/dist/component/server/config.js.map +0 -1
  299. package/dist/component/server/context.js +0 -53
  300. package/dist/component/server/context.js.map +0 -1
  301. package/dist/component/server/cookies.js +0 -47
  302. package/dist/component/server/cookies.js.map +0 -1
  303. package/dist/component/server/core.js +0 -576
  304. package/dist/component/server/core.js.map +0 -1
  305. package/dist/component/server/crypto.js +0 -56
  306. package/dist/component/server/crypto.js.map +0 -1
  307. package/dist/component/server/db.js +0 -87
  308. package/dist/component/server/db.js.map +0 -1
  309. package/dist/component/server/device.js +0 -152
  310. package/dist/component/server/device.js.map +0 -1
  311. package/dist/component/server/enterprise/config.js +0 -46
  312. package/dist/component/server/enterprise/config.js.map +0 -1
  313. package/dist/component/server/enterprise/domain.js +0 -974
  314. package/dist/component/server/enterprise/domain.js.map +0 -1
  315. package/dist/component/server/enterprise/http.js +0 -787
  316. package/dist/component/server/enterprise/http.js.map +0 -1
  317. package/dist/component/server/enterprise/oidc.js +0 -248
  318. package/dist/component/server/enterprise/oidc.js.map +0 -1
  319. package/dist/component/server/enterprise/policy.js +0 -85
  320. package/dist/component/server/enterprise/policy.js.map +0 -1
  321. package/dist/component/server/enterprise/saml.js.map +0 -1
  322. package/dist/component/server/enterprise/scim.js.map +0 -1
  323. package/dist/component/server/enterprise/shared.js +0 -51
  324. package/dist/component/server/enterprise/shared.js.map +0 -1
  325. package/dist/component/server/http.d.ts +0 -85
  326. package/dist/component/server/http.d.ts.map +0 -1
  327. package/dist/component/server/http.js +0 -351
  328. package/dist/component/server/http.js.map +0 -1
  329. package/dist/component/server/identity.js +0 -16
  330. package/dist/component/server/identity.js.map +0 -1
  331. package/dist/component/server/keys.js +0 -96
  332. package/dist/component/server/keys.js.map +0 -1
  333. package/dist/component/server/limits.js +0 -52
  334. package/dist/component/server/limits.js.map +0 -1
  335. package/dist/component/server/mutations/account.js +0 -46
  336. package/dist/component/server/mutations/account.js.map +0 -1
  337. package/dist/component/server/mutations/code.js +0 -68
  338. package/dist/component/server/mutations/code.js.map +0 -1
  339. package/dist/component/server/mutations/invalidate.js +0 -32
  340. package/dist/component/server/mutations/invalidate.js.map +0 -1
  341. package/dist/component/server/mutations/oauth.js +0 -116
  342. package/dist/component/server/mutations/oauth.js.map +0 -1
  343. package/dist/component/server/mutations/refresh.js +0 -119
  344. package/dist/component/server/mutations/refresh.js.map +0 -1
  345. package/dist/component/server/mutations/register.js +0 -87
  346. package/dist/component/server/mutations/register.js.map +0 -1
  347. package/dist/component/server/mutations/retrieve.js +0 -61
  348. package/dist/component/server/mutations/retrieve.js.map +0 -1
  349. package/dist/component/server/mutations/signature.js +0 -38
  350. package/dist/component/server/mutations/signature.js.map +0 -1
  351. package/dist/component/server/mutations/signin.js +0 -27
  352. package/dist/component/server/mutations/signin.js.map +0 -1
  353. package/dist/component/server/mutations/signout.js +0 -27
  354. package/dist/component/server/mutations/signout.js.map +0 -1
  355. package/dist/component/server/mutations/store/refs.js +0 -15
  356. package/dist/component/server/mutations/store/refs.js.map +0 -1
  357. package/dist/component/server/mutations/store.js +0 -70
  358. package/dist/component/server/mutations/store.js.map +0 -1
  359. package/dist/component/server/mutations/verifier.js +0 -18
  360. package/dist/component/server/mutations/verifier.js.map +0 -1
  361. package/dist/component/server/mutations/verify.js +0 -98
  362. package/dist/component/server/mutations/verify.js.map +0 -1
  363. package/dist/component/server/oauth.js +0 -242
  364. package/dist/component/server/oauth.js.map +0 -1
  365. package/dist/component/server/passkey.js +0 -415
  366. package/dist/component/server/passkey.js.map +0 -1
  367. package/dist/component/server/redirects.js +0 -40
  368. package/dist/component/server/redirects.js.map +0 -1
  369. package/dist/component/server/refresh.js +0 -99
  370. package/dist/component/server/refresh.js.map +0 -1
  371. package/dist/component/server/runtime.d.ts +0 -136
  372. package/dist/component/server/runtime.d.ts.map +0 -1
  373. package/dist/component/server/runtime.js +0 -456
  374. package/dist/component/server/runtime.js.map +0 -1
  375. package/dist/component/server/sessions.js +0 -71
  376. package/dist/component/server/sessions.js.map +0 -1
  377. package/dist/component/server/signin.js +0 -225
  378. package/dist/component/server/signin.js.map +0 -1
  379. package/dist/component/server/tokens.js +0 -17
  380. package/dist/component/server/tokens.js.map +0 -1
  381. package/dist/component/server/totp.js +0 -208
  382. package/dist/component/server/totp.js.map +0 -1
  383. package/dist/component/server/types.d.ts +0 -949
  384. package/dist/component/server/types.d.ts.map +0 -1
  385. package/dist/component/server/types.js +0 -79
  386. package/dist/component/server/types.js.map +0 -1
  387. package/dist/component/server/users.js +0 -123
  388. package/dist/component/server/users.js.map +0 -1
  389. package/dist/component/server/utils.js +0 -140
  390. package/dist/component/server/utils.js.map +0 -1
  391. package/dist/core/types.d.ts +0 -361
  392. package/dist/core/types.d.ts.map +0 -1
  393. package/dist/factors/device.js +0 -104
  394. package/dist/factors/device.js.map +0 -1
  395. package/dist/factors/passkey.js.map +0 -1
  396. package/dist/factors/totp.js.map +0 -1
  397. package/dist/providers/anonymous.d.ts.map +0 -1
  398. package/dist/providers/anonymous.js.map +0 -1
  399. package/dist/providers/credentials.d.ts.map +0 -1
  400. package/dist/providers/credentials.js.map +0 -1
  401. package/dist/providers/device.d.ts.map +0 -1
  402. package/dist/providers/device.js.map +0 -1
  403. package/dist/providers/email.d.ts.map +0 -1
  404. package/dist/providers/email.js.map +0 -1
  405. package/dist/providers/oauth.d.ts +0 -69
  406. package/dist/providers/oauth.d.ts.map +0 -1
  407. package/dist/providers/oauth.js +0 -43
  408. package/dist/providers/oauth.js.map +0 -1
  409. package/dist/providers/passkey.d.ts.map +0 -1
  410. package/dist/providers/passkey.js.map +0 -1
  411. package/dist/providers/password.d.ts.map +0 -1
  412. package/dist/providers/password.js.map +0 -1
  413. package/dist/providers/phone.d.ts.map +0 -1
  414. package/dist/providers/phone.js.map +0 -1
  415. package/dist/providers/sso.d.ts.map +0 -1
  416. package/dist/providers/sso.js.map +0 -1
  417. package/dist/providers/totp.d.ts.map +0 -1
  418. package/dist/providers/totp.js.map +0 -1
  419. package/dist/runtime/browser.js +0 -68
  420. package/dist/runtime/browser.js.map +0 -1
  421. package/dist/runtime/invite.js.map +0 -1
  422. package/dist/runtime/proxy.js +0 -70
  423. package/dist/runtime/proxy.js.map +0 -1
  424. package/dist/runtime/storage.js +0 -37
  425. package/dist/runtime/storage.js.map +0 -1
  426. package/dist/server/auth.d.ts.map +0 -1
  427. package/dist/server/auth.js.map +0 -1
  428. package/dist/server/config.d.ts +0 -1
  429. package/dist/server/config.js.map +0 -1
  430. package/dist/server/context.d.ts +0 -1
  431. package/dist/server/context.js.map +0 -1
  432. package/dist/server/cookies.d.ts +0 -1
  433. package/dist/server/cookies.js.map +0 -1
  434. package/dist/server/core.d.ts +0 -1315
  435. package/dist/server/core.d.ts.map +0 -1
  436. package/dist/server/core.js.map +0 -1
  437. package/dist/server/crypto.d.ts +0 -8
  438. package/dist/server/crypto.d.ts.map +0 -1
  439. package/dist/server/crypto.js.map +0 -1
  440. package/dist/server/db.d.ts +0 -1
  441. package/dist/server/db.js.map +0 -1
  442. package/dist/server/device.d.ts +0 -1
  443. package/dist/server/device.js.map +0 -1
  444. package/dist/server/enterprise/config.d.ts +0 -1
  445. package/dist/server/enterprise/config.js.map +0 -1
  446. package/dist/server/enterprise/domain.d.ts +0 -401
  447. package/dist/server/enterprise/domain.d.ts.map +0 -1
  448. package/dist/server/enterprise/domain.js +0 -974
  449. package/dist/server/enterprise/domain.js.map +0 -1
  450. package/dist/server/enterprise/http.d.ts +0 -26
  451. package/dist/server/enterprise/http.d.ts.map +0 -1
  452. package/dist/server/enterprise/http.js +0 -787
  453. package/dist/server/enterprise/http.js.map +0 -1
  454. package/dist/server/enterprise/oidc.d.ts +0 -1
  455. package/dist/server/enterprise/oidc.js +0 -248
  456. package/dist/server/enterprise/oidc.js.map +0 -1
  457. package/dist/server/enterprise/policy.d.ts +0 -1
  458. package/dist/server/enterprise/policy.js +0 -85
  459. package/dist/server/enterprise/policy.js.map +0 -1
  460. package/dist/server/enterprise/saml.d.ts +0 -1
  461. package/dist/server/enterprise/saml.js +0 -338
  462. package/dist/server/enterprise/saml.js.map +0 -1
  463. package/dist/server/enterprise/scim.d.ts +0 -1
  464. package/dist/server/enterprise/scim.js +0 -97
  465. package/dist/server/enterprise/scim.js.map +0 -1
  466. package/dist/server/enterprise/shared.d.ts +0 -5
  467. package/dist/server/enterprise/shared.d.ts.map +0 -1
  468. package/dist/server/enterprise/shared.js +0 -51
  469. package/dist/server/enterprise/shared.js.map +0 -1
  470. package/dist/server/enterprise/validators.d.ts +0 -1
  471. package/dist/server/enterprise/validators.js +0 -60
  472. package/dist/server/enterprise/validators.js.map +0 -1
  473. package/dist/server/http.d.ts.map +0 -1
  474. package/dist/server/http.js.map +0 -1
  475. package/dist/server/identity.d.ts +0 -1
  476. package/dist/server/identity.js.map +0 -1
  477. package/dist/server/keys.d.ts +0 -1
  478. package/dist/server/keys.js.map +0 -1
  479. package/dist/server/limits.d.ts +0 -1
  480. package/dist/server/limits.js.map +0 -1
  481. package/dist/server/mounts.d.ts.map +0 -1
  482. package/dist/server/mounts.js.map +0 -1
  483. package/dist/server/mutations/account.d.ts +0 -29
  484. package/dist/server/mutations/account.d.ts.map +0 -1
  485. package/dist/server/mutations/account.js.map +0 -1
  486. package/dist/server/mutations/code.d.ts +0 -30
  487. package/dist/server/mutations/code.d.ts.map +0 -1
  488. package/dist/server/mutations/code.js.map +0 -1
  489. package/dist/server/mutations/index.d.ts +0 -14
  490. package/dist/server/mutations/invalidate.d.ts +0 -20
  491. package/dist/server/mutations/invalidate.d.ts.map +0 -1
  492. package/dist/server/mutations/invalidate.js.map +0 -1
  493. package/dist/server/mutations/oauth.d.ts +0 -30
  494. package/dist/server/mutations/oauth.d.ts.map +0 -1
  495. package/dist/server/mutations/oauth.js.map +0 -1
  496. package/dist/server/mutations/refresh.d.ts +0 -21
  497. package/dist/server/mutations/refresh.d.ts.map +0 -1
  498. package/dist/server/mutations/refresh.js.map +0 -1
  499. package/dist/server/mutations/register.d.ts +0 -38
  500. package/dist/server/mutations/register.d.ts.map +0 -1
  501. package/dist/server/mutations/register.js.map +0 -1
  502. package/dist/server/mutations/retrieve.d.ts +0 -33
  503. package/dist/server/mutations/retrieve.d.ts.map +0 -1
  504. package/dist/server/mutations/retrieve.js.map +0 -1
  505. package/dist/server/mutations/signature.d.ts +0 -21
  506. package/dist/server/mutations/signature.d.ts.map +0 -1
  507. package/dist/server/mutations/signature.js.map +0 -1
  508. package/dist/server/mutations/signin.d.ts +0 -22
  509. package/dist/server/mutations/signin.d.ts.map +0 -1
  510. package/dist/server/mutations/signin.js.map +0 -1
  511. package/dist/server/mutations/signout.d.ts +0 -16
  512. package/dist/server/mutations/signout.d.ts.map +0 -1
  513. package/dist/server/mutations/signout.js.map +0 -1
  514. package/dist/server/mutations/store/refs.d.ts +0 -12
  515. package/dist/server/mutations/store/refs.d.ts.map +0 -1
  516. package/dist/server/mutations/store/refs.js.map +0 -1
  517. package/dist/server/mutations/store.d.ts +0 -306
  518. package/dist/server/mutations/store.d.ts.map +0 -1
  519. package/dist/server/mutations/store.js.map +0 -1
  520. package/dist/server/mutations/verifier.d.ts +0 -13
  521. package/dist/server/mutations/verifier.d.ts.map +0 -1
  522. package/dist/server/mutations/verifier.js.map +0 -1
  523. package/dist/server/mutations/verify.d.ts +0 -26
  524. package/dist/server/mutations/verify.d.ts.map +0 -1
  525. package/dist/server/mutations/verify.js.map +0 -1
  526. package/dist/server/oauth.d.ts +0 -1
  527. package/dist/server/oauth.js +0 -242
  528. package/dist/server/oauth.js.map +0 -1
  529. package/dist/server/passkey.d.ts +0 -27
  530. package/dist/server/passkey.d.ts.map +0 -1
  531. package/dist/server/passkey.js.map +0 -1
  532. package/dist/server/redirects.d.ts +0 -1
  533. package/dist/server/redirects.js.map +0 -1
  534. package/dist/server/refresh.d.ts +0 -1
  535. package/dist/server/refresh.js.map +0 -1
  536. package/dist/server/runtime.d.ts.map +0 -1
  537. package/dist/server/runtime.js.map +0 -1
  538. package/dist/server/sessions.d.ts +0 -1
  539. package/dist/server/sessions.js.map +0 -1
  540. package/dist/server/signin.d.ts +0 -1
  541. package/dist/server/signin.js.map +0 -1
  542. package/dist/server/ssr.d.ts.map +0 -1
  543. package/dist/server/ssr.js +0 -777
  544. package/dist/server/ssr.js.map +0 -1
  545. package/dist/server/templates.d.ts +0 -1
  546. package/dist/server/templates.js.map +0 -1
  547. package/dist/server/tokens.d.ts +0 -1
  548. package/dist/server/tokens.js.map +0 -1
  549. package/dist/server/totp.d.ts +0 -1
  550. package/dist/server/totp.js.map +0 -1
  551. package/dist/server/types.d.ts.map +0 -1
  552. package/dist/server/types.js.map +0 -1
  553. package/dist/server/users.d.ts +0 -1
  554. package/dist/server/users.js.map +0 -1
  555. package/dist/server/utils.d.ts +0 -1
  556. package/dist/server/utils.js +0 -140
  557. package/dist/server/utils.js.map +0 -1
  558. package/src/authorization/index.ts +0 -83
  559. package/src/cli/bin.ts +0 -5
  560. package/src/cli/command.ts +0 -70
  561. package/src/cli/index.ts +0 -1112
  562. package/src/cli/keys.ts +0 -23
  563. package/src/client/core/types.ts +0 -437
  564. package/src/client/factors/device.ts +0 -158
  565. package/src/client/factors/passkey.ts +0 -279
  566. package/src/client/factors/totp.ts +0 -150
  567. package/src/client/index.ts +0 -1124
  568. package/src/client/runtime/browser.ts +0 -112
  569. package/src/client/runtime/invite.ts +0 -63
  570. package/src/client/runtime/proxy.ts +0 -111
  571. package/src/client/runtime/storage.ts +0 -79
  572. package/src/component/_generated/api.ts +0 -96
  573. package/src/component/_generated/component.ts +0 -3774
  574. package/src/component/_generated/dataModel.ts +0 -60
  575. package/src/component/_generated/server.ts +0 -156
  576. package/src/component/convex.config.ts +0 -5
  577. package/src/component/functions.ts +0 -104
  578. package/src/component/index.ts +0 -42
  579. package/src/component/model.ts +0 -449
  580. package/src/component/public/enterprise/audit.ts +0 -125
  581. package/src/component/public/enterprise/core.ts +0 -355
  582. package/src/component/public/enterprise/domains.ts +0 -327
  583. package/src/component/public/enterprise/scim.ts +0 -397
  584. package/src/component/public/enterprise/secrets.ts +0 -133
  585. package/src/component/public/enterprise/webhooks.ts +0 -307
  586. package/src/component/public/factors/devices.ts +0 -224
  587. package/src/component/public/factors/passkeys.ts +0 -243
  588. package/src/component/public/factors/totp.ts +0 -259
  589. package/src/component/public/groups/core.ts +0 -481
  590. package/src/component/public/groups/invites.ts +0 -608
  591. package/src/component/public/groups/members.ts +0 -410
  592. package/src/component/public/identity/accounts.ts +0 -207
  593. package/src/component/public/identity/codes.ts +0 -149
  594. package/src/component/public/identity/sessions.ts +0 -210
  595. package/src/component/public/identity/tokens.ts +0 -251
  596. package/src/component/public/identity/users.ts +0 -355
  597. package/src/component/public/identity/verifiers.ts +0 -158
  598. package/src/component/public/security/keys.ts +0 -366
  599. package/src/component/public/security/limits.ts +0 -174
  600. package/src/component/public.ts +0 -27
  601. package/src/component/schema.ts +0 -505
  602. package/src/providers/anonymous.ts +0 -99
  603. package/src/providers/credentials.ts +0 -102
  604. package/src/providers/device.ts +0 -87
  605. package/src/providers/email.ts +0 -99
  606. package/src/providers/index.ts +0 -31
  607. package/src/providers/oauth.ts +0 -117
  608. package/src/providers/passkey.ts +0 -77
  609. package/src/providers/password.ts +0 -441
  610. package/src/providers/phone.ts +0 -93
  611. package/src/providers/sso.ts +0 -54
  612. package/src/providers/totp.ts +0 -62
  613. package/src/samlify.d.ts +0 -53
  614. package/src/server/auth.ts +0 -949
  615. package/src/server/config.ts +0 -200
  616. package/src/server/context.ts +0 -90
  617. package/src/server/cookies.ts +0 -49
  618. package/src/server/core.ts +0 -2004
  619. package/src/server/crypto.ts +0 -90
  620. package/src/server/db.ts +0 -203
  621. package/src/server/device.ts +0 -254
  622. package/src/server/enterprise/config.ts +0 -51
  623. package/src/server/enterprise/domain.ts +0 -1739
  624. package/src/server/enterprise/http.ts +0 -1331
  625. package/src/server/enterprise/oidc.ts +0 -500
  626. package/src/server/enterprise/policy.ts +0 -128
  627. package/src/server/enterprise/saml.ts +0 -578
  628. package/src/server/enterprise/scim.ts +0 -135
  629. package/src/server/enterprise/shared.ts +0 -134
  630. package/src/server/enterprise/validators.ts +0 -93
  631. package/src/server/http.ts +0 -790
  632. package/src/server/identity.ts +0 -18
  633. package/src/server/index.ts +0 -40
  634. package/src/server/keys.ts +0 -158
  635. package/src/server/limits.ts +0 -107
  636. package/src/server/mounts.ts +0 -924
  637. package/src/server/mutations/account.ts +0 -62
  638. package/src/server/mutations/code.ts +0 -119
  639. package/src/server/mutations/index.ts +0 -13
  640. package/src/server/mutations/invalidate.ts +0 -50
  641. package/src/server/mutations/oauth.ts +0 -243
  642. package/src/server/mutations/refresh.ts +0 -299
  643. package/src/server/mutations/register.ts +0 -155
  644. package/src/server/mutations/retrieve.ts +0 -109
  645. package/src/server/mutations/signature.ts +0 -57
  646. package/src/server/mutations/signin.ts +0 -54
  647. package/src/server/mutations/signout.ts +0 -43
  648. package/src/server/mutations/store/refs.ts +0 -10
  649. package/src/server/mutations/store.ts +0 -123
  650. package/src/server/mutations/verifier.ts +0 -34
  651. package/src/server/mutations/verify.ts +0 -200
  652. package/src/server/oauth.ts +0 -418
  653. package/src/server/passkey.ts +0 -838
  654. package/src/server/redirects.ts +0 -59
  655. package/src/server/refresh.ts +0 -218
  656. package/src/server/runtime.ts +0 -918
  657. package/src/server/sessions.ts +0 -132
  658. package/src/server/signin.ts +0 -445
  659. package/src/server/ssr.ts +0 -1747
  660. package/src/server/templates.ts +0 -82
  661. package/src/server/tokens.ts +0 -35
  662. package/src/server/totp.ts +0 -399
  663. package/src/server/types.ts +0 -1942
  664. package/src/server/users.ts +0 -291
  665. package/src/server/utils.ts +0 -220
  666. /package/dist/{runtime → client/runtime}/invite.js +0 -0
package/src/server/enterprise/saml.ts DELETED
@@ -1,578 +0,0 @@
1
- import {
2
- decodeBase64urlIgnorePadding,
3
- encodeBase64urlNoPadding,
4
- } from "@oslojs/encoding";
5
- import {
6
- Constants,
7
- IdentityProvider,
8
- ServiceProvider,
9
- setSchemaValidator,
10
- } from "@robelest/samlify";
11
-
12
- import type { SAMLAttributeMapping } from "../types";
13
- import { getSamlConfig } from "./config";
14
- import type {
15
- EnterpriseSamlHttpRequest,
16
- EnterpriseSamlRelayState,
17
- EnterpriseSamlSource,
18
- ParsedSamlMetadata,
19
- } from "./shared";
20
- import { asRecord, getEnterpriseSamlUrls } from "./shared";
21
-
22
- // Samlify requires a schema validator to be registered before parsing any SAML
23
- // response. We use a permissive validator that always resolves because Convex's
24
- // edge runtime has no file-system access for XML schema files, and structural
25
- // correctness is already ensured by the XML parser. This is called directly
26
- // before each parse operation since Convex can restart the V8 isolate between
27
- // requests, resetting module-level state.
28
- const _samlifyPermissiveValidator = {
29
- validate: (_xml: string) => Promise.resolve("OK"),
30
- };
31
- function ensureSamlifyValidator() {
32
- setSchemaValidator(_samlifyPermissiveValidator);
33
- }
34
-
35
- /** @internal */
36
- export function createSamlPostBindingResponse(opts: {
37
- endpoint: string;
38
- parameter: "SAMLRequest" | "SAMLResponse";
39
- value: string;
40
- relayState?: string;
41
- }) {
42
- const fields = [
43
- `<input type="hidden" name="${opts.parameter}" value="${opts.value.replace(/"/g, "&quot;")}" />`,
44
- opts.relayState
45
- ? `<input type="hidden" name="RelayState" value="${opts.relayState.replace(/"/g, "&quot;")}" />`
46
- : "",
47
- ].join("");
48
- return new Response(
49
- `<!doctype html><html><body><form method="POST" action="${opts.endpoint}">${fields}</form><script>document.forms[0].submit();</script></body></html>`,
50
- { status: 200, headers: { "Content-Type": "text/html; charset=utf-8" } },
51
- );
52
- }
53
-
54
- /** @internal */
55
- export function decodeRelayState(
56
- value: string | null,
57
- ): Record<string, unknown> {
58
- if (!value) {
59
- return {};
60
- }
61
- try {
62
- return JSON.parse(
63
- new TextDecoder().decode(decodeBase64urlIgnorePadding(value)),
64
- );
65
- } catch {
66
- return {};
67
- }
68
- }
69
-
70
- /** @internal */
71
- export function encodeEnterpriseSamlRelayState(
72
- value: EnterpriseSamlRelayState,
73
- ) {
74
- return encodeBase64urlNoPadding(
75
- new TextEncoder().encode(
76
- JSON.stringify({
77
- source: `${value.source.kind}:${value.source.id}`,
78
- signature: value.signature,
79
- requestId: value.requestId,
80
- state: value.state,
81
- redirectTo: value.redirectTo,
82
- }),
83
- ),
84
- );
85
- }
86
-
87
- /** @internal */
88
- export function decodeEnterpriseSamlRelayStateOrThrow(
89
- value: string | null,
90
- ): EnterpriseSamlRelayState {
91
- if (!value) {
92
- throw new Error("Missing SAML RelayState.");
93
- }
94
- const decoded = decodeRelayState(value);
95
- if (
96
- typeof decoded.source !== "string" ||
97
- typeof decoded.signature !== "string" ||
98
- typeof decoded.requestId !== "string" ||
99
- typeof decoded.state !== "string"
100
- ) {
101
- throw new Error("Invalid SAML RelayState.");
102
- }
103
- const [kind, ...rest] = decoded.source.split(":");
104
- const id = rest.join(":");
105
- if (kind !== "enterprise" || id.length === 0) {
106
- throw new Error("Invalid enterprise SAML source.");
107
- }
108
- return {
109
- source: { kind, id } as EnterpriseSamlSource,
110
- signature: decoded.signature,
111
- requestId: decoded.requestId,
112
- state: decoded.state,
113
- redirectTo:
114
- typeof decoded.redirectTo === "string" ? decoded.redirectTo : undefined,
115
- };
116
- }
117
-
118
- /** @internal */
119
- export async function readRequestBody(
120
- request: Request,
121
- ): Promise<Record<string, string>> {
122
- const contentType = request.headers.get("Content-Type") ?? "";
123
- if (
124
- contentType.includes("application/x-www-form-urlencoded") ||
125
- contentType.includes("multipart/form-data")
126
- ) {
127
- const form = await request.formData();
128
- const body: Record<string, string> = {};
129
- form.forEach((value, key) => {
130
- body[key] = typeof value === "string" ? value : value.name;
131
- });
132
- return body;
133
- }
134
- return {};
135
- }
136
-
137
- /** @internal */
138
- export async function readEnterpriseSamlHttpRequest(
139
- request: Request,
140
- ): Promise<EnterpriseSamlHttpRequest> {
141
- const url = new URL(request.url);
142
- const body = await readRequestBody(request);
143
- const query = Object.fromEntries(url.searchParams);
144
- const binding =
145
- request.method === "GET"
146
- ? "redirect"
147
- : body.SAMLResponse || body.SAMLRequest
148
- ? "post"
149
- : "redirect";
150
- return {
151
- url,
152
- body,
153
- query,
154
- binding,
155
- relayState:
156
- body.RelayState ?? url.searchParams.get("RelayState") ?? undefined,
157
- hasSamlRequest: Boolean(
158
- body.SAMLRequest ?? url.searchParams.get("SAMLRequest"),
159
- ),
160
- hasSamlResponse: Boolean(
161
- body.SAMLResponse ?? url.searchParams.get("SAMLResponse"),
162
- ),
163
- };
164
- }
165
-
166
- /** @internal */
167
- export function parseSamlIdpMetadata(metadata: string): ParsedSamlMetadata {
168
- const idp = IdentityProvider({ metadata });
169
- const entityMeta = idp.entityMeta;
170
-
171
- const normalizeService = (value: unknown): string | undefined => {
172
- return typeof value === "string" && value.length > 0 ? value : undefined;
173
- };
174
-
175
- return {
176
- issuer: entityMeta.getEntityID(),
177
- sso: {
178
- redirect: normalizeService(entityMeta.getSingleSignOnService("redirect")),
179
- post: normalizeService(entityMeta.getSingleSignOnService("post")),
180
- },
181
- slo: {
182
- redirect: normalizeService(entityMeta.getSingleLogoutService("redirect")),
183
- post: normalizeService(entityMeta.getSingleLogoutService("post")),
184
- },
185
- signingCert: entityMeta.getX509Certificate("signing"),
186
- encryptionCert: entityMeta.getX509Certificate("encrypt"),
187
- nameIdFormats: (() => {
188
- const nameIdFormat = entityMeta.getNameIDFormat();
189
- return Array.isArray(nameIdFormat) ? nameIdFormat : [];
190
- })(),
191
- wantsSignedAuthnRequests: entityMeta.isWantAuthnRequestsSigned(),
192
- };
193
- }
194
-
195
- /** @internal */
196
- export function createServiceProviderMetadata(opts: {
197
- entityId: string;
198
- acsUrl: string;
199
- sloUrl?: string;
200
- authnRequestsSigned?: boolean;
201
- signingCert?: string | string[];
202
- encryptCert?: string | string[];
203
- privateKey?: string;
204
- privateKeyPass?: string;
205
- encPrivateKey?: string;
206
- encPrivateKeyPass?: string;
207
- }) {
208
- const binding = Constants.namespace.binding;
209
- const sp = ServiceProvider({
210
- entityID: opts.entityId,
211
- authnRequestsSigned: opts.authnRequestsSigned ?? false,
212
- privateKey: opts.privateKey,
213
- privateKeyPass: opts.privateKeyPass,
214
- signingCert: opts.signingCert,
215
- encryptCert: opts.encryptCert,
216
- encPrivateKey: opts.encPrivateKey,
217
- encPrivateKeyPass: opts.encPrivateKeyPass,
218
- assertionConsumerService: [
219
- {
220
- Binding: binding.post,
221
- Location: opts.acsUrl,
222
- },
223
- ],
224
- singleLogoutService: opts.sloUrl
225
- ? [
226
- {
227
- Binding: binding.redirect,
228
- Location: opts.sloUrl,
229
- },
230
- {
231
- Binding: binding.post,
232
- Location: opts.sloUrl,
233
- },
234
- ]
235
- : undefined,
236
- });
237
- return sp.getMetadata();
238
- }
239
-
240
- /** @internal */
241
- export function createEnterpriseSamlMetadataXml(opts: {
242
- rootUrl: string;
243
- source: EnterpriseSamlSource;
244
- config: unknown;
245
- }) {
246
- return createServiceProviderMetadata(
247
- getSamlServiceProviderOptions({
248
- rootUrl: opts.rootUrl,
249
- source: opts.source,
250
- config: opts.config,
251
- }),
252
- );
253
- }
254
-
255
- /** @internal */
256
- export function getSamlServiceProviderOptions(opts: {
257
- rootUrl: string;
258
- source: EnterpriseSamlSource;
259
- config: unknown;
260
- overrides?: {
261
- entityId?: string;
262
- acsUrl?: string;
263
- sloUrl?: string;
264
- };
265
- relayState?: string;
266
- }) {
267
- const saml = getSamlConfig(opts.config);
268
- const sp = asRecord(saml.sp) ?? {};
269
- const urls = getEnterpriseSamlUrls({
270
- rootUrl: opts.rootUrl,
271
- source: opts.source,
272
- });
273
- return {
274
- entityId: opts.overrides?.entityId ?? sp.entityId ?? urls.metadataUrl,
275
- acsUrl: opts.overrides?.acsUrl ?? sp.acsUrl ?? urls.acsUrl,
276
- sloUrl: opts.overrides?.sloUrl ?? sp.sloUrl ?? urls.sloUrl,
277
- relayState: opts.relayState,
278
- authnRequestsSigned: saml.signAuthnRequests,
279
- signingCert: sp.signingCert,
280
- encryptCert: sp.encryptCert,
281
- privateKey: sp.privateKey,
282
- privateKeyPass: sp.privateKeyPass,
283
- encPrivateKey: sp.encPrivateKey,
284
- encPrivateKeyPass: sp.encPrivateKeyPass,
285
- };
286
- }
287
-
288
- /** @internal */
289
- export function createSamlServiceProvider(opts: {
290
- entityId: string;
291
- acsUrl: string;
292
- sloUrl?: string;
293
- relayState?: string;
294
- authnRequestsSigned?: boolean;
295
- signingCert?: string | string[];
296
- encryptCert?: string | string[];
297
- privateKey?: string;
298
- privateKeyPass?: string;
299
- encPrivateKey?: string;
300
- encPrivateKeyPass?: string;
301
- }) {
302
- const binding = Constants.namespace.binding;
303
- return ServiceProvider({
304
- entityID: opts.entityId,
305
- relayState: opts.relayState ?? "",
306
- authnRequestsSigned: opts.authnRequestsSigned ?? false,
307
- privateKey: opts.privateKey,
308
- privateKeyPass: opts.privateKeyPass,
309
- signingCert: opts.signingCert,
310
- encryptCert: opts.encryptCert,
311
- encPrivateKey: opts.encPrivateKey,
312
- encPrivateKeyPass: opts.encPrivateKeyPass,
313
- assertionConsumerService: [
314
- {
315
- Binding: binding.post,
316
- Location: opts.acsUrl,
317
- },
318
- ],
319
- singleLogoutService: opts.sloUrl
320
- ? [
321
- { Binding: binding.redirect, Location: opts.sloUrl },
322
- { Binding: binding.post, Location: opts.sloUrl },
323
- ]
324
- : undefined,
325
- });
326
- }
327
-
328
- /** @internal */
329
- export function createEnterpriseSamlRuntime(opts: {
330
- rootUrl: string;
331
- source: EnterpriseSamlSource;
332
- config: unknown;
333
- relayState?: string;
334
- overrides?: {
335
- entityId?: string;
336
- acsUrl?: string;
337
- sloUrl?: string;
338
- };
339
- }) {
340
- const saml = getSamlConfig(opts.config);
341
- const spOptions = getSamlServiceProviderOptions({
342
- rootUrl: opts.rootUrl,
343
- source: opts.source,
344
- config: opts.config,
345
- relayState: opts.relayState,
346
- overrides: opts.overrides,
347
- });
348
- if (typeof saml.idp?.metadataXml !== "string") {
349
- throw new Error("SAML IdP metadata is missing.");
350
- }
351
- return {
352
- saml,
353
- sp: createSamlServiceProvider(spOptions),
354
- idp: IdentityProvider({ metadata: saml.idp.metadataXml }),
355
- urls: getEnterpriseSamlUrls({ rootUrl: opts.rootUrl, source: opts.source }),
356
- };
357
- }
358
-
359
- /** @internal */
360
- export function createEnterpriseSamlSignInRequest(opts: {
361
- rootUrl: string;
362
- source: EnterpriseSamlSource;
363
- config: unknown;
364
- state: string;
365
- signature: string;
366
- redirectTo?: string;
367
- }) {
368
- const runtime = createEnterpriseSamlRuntime({
369
- rootUrl: opts.rootUrl,
370
- source: opts.source,
371
- config: opts.config,
372
- });
373
- const binding = runtime.saml.idp.sso?.redirect ? "redirect" : "post";
374
- const loginRequest = runtime.sp.createLoginRequest(
375
- runtime.idp,
376
- binding as any,
377
- ) as any;
378
- const relayState = encodeEnterpriseSamlRelayState({
379
- source: opts.source,
380
- signature: opts.signature,
381
- requestId: loginRequest.id,
382
- state: opts.state,
383
- redirectTo: opts.redirectTo,
384
- });
385
- return {
386
- requestId: loginRequest.id as string,
387
- binding,
388
- relayState,
389
- redirectUrl:
390
- binding === "redirect"
391
- ? (() => {
392
- const redirectUrl = new URL(loginRequest.context);
393
- redirectUrl.searchParams.set("RelayState", relayState);
394
- return redirectUrl.toString();
395
- })()
396
- : undefined,
397
- post:
398
- binding === "post"
399
- ? {
400
- endpoint: loginRequest.entityEndpoint as string,
401
- value: loginRequest.context as string,
402
- }
403
- : undefined,
404
- };
405
- }
406
-
407
- /** @internal */
408
- export async function parseEnterpriseSamlLoginResponse(opts: {
409
- request: Request;
410
- rootUrl: string;
411
- source: EnterpriseSamlSource;
412
- config: unknown;
413
- }) {
414
- ensureSamlifyValidator();
415
- const httpRequest = await readEnterpriseSamlHttpRequest(opts.request);
416
- const runtime = createEnterpriseSamlRuntime({
417
- rootUrl: opts.rootUrl,
418
- source: opts.source,
419
- config: opts.config,
420
- });
421
- const parsed = (await runtime.sp.parseLoginResponse(
422
- runtime.idp as any,
423
- httpRequest.binding as any,
424
- {
425
- query: httpRequest.query,
426
- body: httpRequest.body,
427
- },
428
- )) as any;
429
- // Check for weak SAML algorithms and warn.
430
- warnWeakSamlAlgorithms(parsed);
431
-
432
- return {
433
- ...httpRequest,
434
- runtime,
435
- parsed,
436
- relayState: decodeEnterpriseSamlRelayStateOrThrow(
437
- httpRequest.relayState ?? null,
438
- ),
439
- };
440
- }
441
-
442
- const WEAK_SAML_ALGORITHMS = new Set([
443
- // Signature algorithms
444
- "http://www.w3.org/2000/09/xmldsig#rsa-sha1",
445
- "http://www.w3.org/2000/09/xmldsig#dsa-sha1",
446
- // Digest algorithms
447
- "http://www.w3.org/2000/09/xmldsig#sha1",
448
- // Key encryption
449
- "http://www.w3.org/2001/04/xmlenc#rsa-1_5",
450
- // Data encryption
451
- "http://www.w3.org/2001/04/xmlenc#tripledes-cbc",
452
- ]);
453
-
454
- /**
455
- * Warn when the SAML response uses weak cryptographic algorithms
456
- * such as SHA-1, RSA 1.5, or 3DES.
457
- */
458
- function warnWeakSamlAlgorithms(parsed: any) {
459
- try {
460
- const sigAlg =
461
- parsed?.extract?.signature?.signatureAlgorithm ??
462
- parsed?.extract?.response?.signatureAlgorithm;
463
- const digestAlg = parsed?.extract?.signature?.digestAlgorithm;
464
-
465
- if (sigAlg && WEAK_SAML_ALGORITHMS.has(sigAlg)) {
466
- console.warn(
467
- `[convex-auth] SAML response uses weak signature algorithm: ${sigAlg}. ` +
468
- `Consider upgrading your IdP to use RSA-SHA256 or stronger.`,
469
- );
470
- }
471
- if (digestAlg && WEAK_SAML_ALGORITHMS.has(digestAlg)) {
472
- console.warn(
473
- `[convex-auth] SAML response uses weak digest algorithm: ${digestAlg}. ` +
474
- `Consider upgrading your IdP to use SHA-256 or stronger.`,
475
- );
476
- }
477
- } catch {
478
- // Non-critical — don't break auth flow for algorithm check failures
479
- }
480
- }
481
-
482
- /** @internal */
483
- export function validateEnterpriseSamlLoginRelayState(opts: {
484
- relayState: EnterpriseSamlRelayState;
485
- source: EnterpriseSamlSource;
486
- inResponseTo?: string;
487
- }) {
488
- if (
489
- opts.relayState.source.kind !== opts.source.kind ||
490
- opts.relayState.source.id !== opts.source.id ||
491
- opts.relayState.requestId !== opts.inResponseTo
492
- ) {
493
- throw new Error("SAML RelayState did not match the pending login request.");
494
- }
495
- }
496
-
497
- /** @internal */
498
- export async function parseEnterpriseSamlLogoutMessage(opts: {
499
- request: Request;
500
- rootUrl: string;
501
- source: EnterpriseSamlSource;
502
- config: unknown;
503
- }) {
504
- ensureSamlifyValidator();
505
- const httpRequest = await readEnterpriseSamlHttpRequest(opts.request);
506
- const runtime = createEnterpriseSamlRuntime({
507
- rootUrl: opts.rootUrl,
508
- source: opts.source,
509
- config: opts.config,
510
- relayState: httpRequest.relayState,
511
- });
512
- const parsedRequest = httpRequest.hasSamlRequest
513
- ? ((await runtime.sp.parseLogoutRequest(
514
- runtime.idp as any,
515
- httpRequest.binding as any,
516
- {
517
- query: httpRequest.query,
518
- body: httpRequest.body,
519
- },
520
- )) as any)
521
- : undefined;
522
- return {
523
- ...httpRequest,
524
- runtime,
525
- parsedRequest,
526
- };
527
- }
528
-
529
- /** @internal */
530
- export function profileFromSamlExtract(
531
- extract: any,
532
- mapping?: SAMLAttributeMapping,
533
- ) {
534
- const attributes =
535
- typeof extract?.attributes === "object" && extract.attributes !== null
536
- ? (extract.attributes as Record<string, unknown>)
537
- : {};
538
- const resolveFirst = (...keys: Array<string | undefined>) => {
539
- for (const key of keys) {
540
- if (!key) {
541
- continue;
542
- }
543
- const attribute = attributes[key];
544
- const value = Array.isArray(attribute) ? attribute[0] : attribute;
545
- if (value !== undefined) {
546
- return value;
547
- }
548
- }
549
- return undefined;
550
- };
551
- const fieldResolvers = {
552
- email: () => resolveFirst(mapping?.email),
553
- name: () =>
554
- resolveFirst(mapping?.name) ??
555
- ([resolveFirst(mapping?.firstName), resolveFirst(mapping?.lastName)]
556
- .filter(Boolean)
557
- .join(" ") ||
558
- undefined),
559
- subject: () =>
560
- resolveFirst(mapping?.subject) ?? (extract?.nameID as string | undefined),
561
- } as const;
562
- const subject = fieldResolvers.subject() as string | undefined;
563
- if (subject === undefined) {
564
- throw new Error(
565
- "SAML profile is missing a subject. Configure `attributeMapping.subject` or ensure the assertion includes a NameID.",
566
- );
567
- }
568
- const email = fieldResolvers.email() as string | undefined;
569
- const name = fieldResolvers.name() as string | undefined;
570
- return {
571
- id: subject,
572
- email,
573
- emailVerified: typeof email === "string" ? true : undefined,
574
- name,
575
- samlAttributes: attributes,
576
- samlSessionIndex: extract?.sessionIndex?.SessionIndex as string | undefined,
577
- };
578
- }
package/src/server/enterprise/scim.ts DELETED
@@ -1,135 +0,0 @@
1
- import type { ScimListRequest } from "./shared";
2
- import { SCIM_GROUP_SCHEMA_ID, SCIM_USER_SCHEMA_ID } from "./shared";
3
-
4
- /** @internal */
5
- export function parseScimPath(pathname: string) {
6
- const parts = pathname.split("/").filter(Boolean);
7
- const [api, auth, sso, enterpriseId, protocol, version, ...rest] = parts;
8
-
9
- if (
10
- api !== "api" ||
11
- auth !== "auth" ||
12
- sso !== "sso" ||
13
- !enterpriseId ||
14
- enterpriseId === "setup" ||
15
- protocol !== "scim" ||
16
- version !== "v2"
17
- ) {
18
- return {
19
- enterpriseId: "",
20
- resource: "",
21
- resourceId: undefined,
22
- };
23
- }
24
-
25
- return {
26
- enterpriseId,
27
- resource: rest[0] ?? "",
28
- resourceId: rest[1],
29
- };
30
- }
31
-
32
- /** @internal */
33
- export function parseScimListRequest(url: URL): ScimListRequest {
34
- const startIndex = Math.max(
35
- 1,
36
- Number(url.searchParams.get("startIndex") ?? "1"),
37
- );
38
- const count = Math.min(
39
- 100,
40
- Math.max(1, Number(url.searchParams.get("count") ?? "100")),
41
- );
42
- const filterParam = url.searchParams.get("filter");
43
- const filter = filterParam
44
- ? (() => {
45
- const match = filterParam.match(/^([A-Za-z0-9_.]+)\s+eq\s+"([^"]+)"$/);
46
- if (!match) {
47
- throw new Error("Unsupported SCIM filter.");
48
- }
49
- return { attribute: match[1]!, value: match[2]! };
50
- })()
51
- : undefined;
52
- return { startIndex, count, filter };
53
- }
54
-
55
- /** @internal */
56
- export function scimJson(data: unknown, status = 200, headers?: HeadersInit) {
57
- const responseHeaders = new Headers({
58
- "Content-Type": "application/scim+json",
59
- });
60
- if (headers) {
61
- new Headers(headers).forEach((value, key) => {
62
- responseHeaders.set(key, value);
63
- });
64
- }
65
- return new Response(JSON.stringify(data), {
66
- status,
67
- headers: responseHeaders,
68
- });
69
- }
70
-
71
- /** @internal */
72
- export function scimError(status: number, scimType: string, detail: string) {
73
- return scimJson(
74
- {
75
- schemas: ["urn:ietf:params:scim:api:messages:2.0:Error"],
76
- status: String(status),
77
- scimType,
78
- detail,
79
- },
80
- status,
81
- );
82
- }
83
-
84
- /** @internal */
85
- export function serializeScimUser(args: {
86
- id: string;
87
- user: Record<string, any>;
88
- externalId?: string;
89
- active?: boolean;
90
- location?: string;
91
- }) {
92
- return {
93
- schemas: [SCIM_USER_SCHEMA_ID],
94
- id: args.id,
95
- externalId: args.externalId,
96
- meta: {
97
- resourceType: "User",
98
- location: args.location,
99
- },
100
- userName: args.user.email ?? args.user.phone ?? args.user.name ?? args.id,
101
- active: args.active ?? true,
102
- name:
103
- args.user.name !== undefined ? { formatted: args.user.name } : undefined,
104
- emails:
105
- typeof args.user.email === "string"
106
- ? [{ value: args.user.email, primary: true }]
107
- : undefined,
108
- phoneNumbers:
109
- typeof args.user.phone === "string"
110
- ? [{ value: args.user.phone, primary: true }]
111
- : undefined,
112
- displayName: args.user.name,
113
- };
114
- }
115
-
116
- /** @internal */
117
- export function serializeScimGroup(args: {
118
- id: string;
119
- group: Record<string, any>;
120
- externalId?: string;
121
- members?: Array<{ value: string; display?: string }>;
122
- location?: string;
123
- }) {
124
- return {
125
- schemas: [SCIM_GROUP_SCHEMA_ID],
126
- id: args.id,
127
- externalId: args.externalId,
128
- meta: {
129
- resourceType: "Group",
130
- location: args.location,
131
- },
132
- displayName: args.group.name ?? args.id,
133
- members: args.members ?? [],
134
- };
135
- }