@robelest/convex-auth 0.0.4-preview.25 → 0.0.4-preview.28

package/src/server/identity.ts

@@ -1,18 +0,0 @@
-import { Cv } from "@robelest/fx/convex";
-
-/** @internal */
-export function userIdFromIdentitySubject(subject: string): string {
-  const [userId, ...rest] = subject.split("|");
-  if (
-    typeof userId !== "string" ||
-    userId.length === 0 ||
-    rest.length === 0 ||
-    rest.some((segment) => segment.length === 0)
-  ) {
-    throw Cv.error({
-      code: "INTERNAL_ERROR",
-      message: "Authenticated identity subject is malformed.",
-    });
-  }
-  return userId;
-}

package/src/server/index.ts

@@ -1,40 +0,0 @@
-export { createAuth } from "./auth";
-export type {
-  AuthApi,
-  AuthApiBase,
-  AuthContext,
-  AuthContextConfig,
-  AuthConfig,
-  ConvexAuthResult,
-  InferAuth,
-  InferClientApi,
-  OptionalAuthContext,
-  UserDoc,
-} from "./auth";
-export type {
-  HttpAuthContext,
-  HttpAuthContextConfig,
-  OptionalHttpAuthContext,
-} from "./http";
-export type {
-  EnterpriseAdminAuthorizationInput,
-  EnterpriseAdminPermission,
-  EnterpriseAuthorizer,
-  EnterpriseMountOptions,
-} from "./mounts";
-export { enterprise, scim, sso } from "./mounts";
-export type {
-  AuthCookie,
-  AuthCookieConfig,
-  AuthCookies,
-  RefreshResult,
-  ServerOptions,
-} from "./ssr";
-export {
-  authCookieNames,
-  parseAuthCookies,
-  serializeAuthCookies,
-  server,
-  shouldProxyAuthAction,
-  structuredAuthCookies,
-} from "./ssr";

package/src/server/keys.ts

@@ -1,158 +0,0 @@
-/**
- * API Key crypto utilities.
- *
- * Uses `@oslojs/crypto` primitives for key generation and hashing:
- * - SHA-256 for hashing keys (API keys have high entropy, no need for bcrypt)
- * - Cryptographically secure random generation for key material
- *
- * @module
- */
-
-import type { KeyScope, ScopeChecker } from "./types";
-import { sha256, generateRandomString } from "./utils";
-
-// ============================================================================
-// Constants
-// ============================================================================
-
-const DEFAULT_KEY_PREFIX = "sk_";
-const KEY_RANDOM_LENGTH = 32;
-const KEY_RANDOM_ALPHABET =
-  "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789";
-
-/**
- * How many characters of the full key to store as the visible prefix.
- * Includes the prefix string (e.g. "sk_") plus a few random chars.
- */
-const VISIBLE_PREFIX_EXTRA_CHARS = 4;
-
-// ============================================================================
-// Key generation
-// ============================================================================
-
-/**
- * Generate a new API key.
- *
- * Returns the raw key (to be shown once to the user) and metadata for storage.
- * The raw key is `{prefix}{32 random alphanumeric chars}`.
- *
- * @param prefix - Key prefix, defaults to "sk_"
- * @returns `{ raw, hashedKey, displayPrefix }`
- */
-/** @internal */
-export async function generateApiKey(
-  prefix: string = DEFAULT_KEY_PREFIX,
-): Promise<{
-  /** The full raw key — show to user once, never store. */
-  raw: string;
-  /** SHA-256 hex hash of the raw key — store this. */
-  hashedKey: string;
-  /** Truncated prefix for display (e.g. "sk_aBc1..."). */
-  displayPrefix: string;
-}> {
-  const randomPart = generateRandomString(
-    KEY_RANDOM_LENGTH,
-    KEY_RANDOM_ALPHABET,
-  );
-  const raw = `${prefix}${randomPart}`;
-  const hashedKey = await sha256(raw);
-  const displayPrefix = `${raw.substring(0, prefix.length + VISIBLE_PREFIX_EXTRA_CHARS)}...`;
-
-  return { raw, hashedKey, displayPrefix };
-}
-
-/**
- * Hash a raw API key for lookup.
- *
- * Used during Bearer token verification to find the stored key record.
- */
-/** @internal */
-export async function hashApiKey(rawKey: string): Promise<string> {
-  return sha256(rawKey);
-}
-
-// ============================================================================
-// Scope checker
-// ============================================================================
-
-/**
- * Build a `ScopeChecker` from an array of `KeyScope` entries.
- *
- * The checker provides a `.can(resource, action)` method that returns `true`
- * if any scope entry grants the requested permission.
- *
- * A wildcard action `"*"` grants all actions on that resource.
- * A wildcard resource `"*"` grants the action on all resources.
- */
-/** @internal */
-export function buildScopeChecker(scopes: KeyScope[]): ScopeChecker {
-  return {
-    scopes,
-    can(resource: string, action: string): boolean {
-      return scopes.some(
-        (scope) =>
-          (scope.resource === resource || scope.resource === "*") &&
-          (scope.actions.includes(action) || scope.actions.includes("*")),
-      );
-    },
-  };
-}
-
-// ============================================================================
-// Per-key rate limiting (token-bucket)
-// ============================================================================
-
-/**
- * Check whether a key is rate-limited based on its stored state.
- *
- * Uses the same token-bucket algorithm as sign-in rate limiting:
- * tokens refill linearly over the configured window.
- *
- * @returns `{ limited: boolean; newState: { attemptsLeft, lastAttemptTime } }`
- */
-/** @internal */
-export function checkKeyRateLimit(
-  rateLimit: { maxRequests: number; windowMs: number },
-  state: { attemptsLeft: number; lastAttemptTime: number } | undefined,
-): {
-  limited: boolean;
-  newState: { attemptsLeft: number; lastAttemptTime: number };
-} {
-  const now = Date.now();
-
-  if (!state) {
-    // First request — create initial state with one token consumed.
-    return {
-      limited: false,
-      newState: {
-        attemptsLeft: rateLimit.maxRequests - 1,
-        lastAttemptTime: now,
-      },
-    };
-  }
-
-  const elapsed = now - state.lastAttemptTime;
-  const refillRate = rateLimit.maxRequests / rateLimit.windowMs;
-  const refilled = Math.min(
-    rateLimit.maxRequests,
-    state.attemptsLeft + elapsed * refillRate,
-  );
-
-  if (refilled < 1) {
-    return {
-      limited: true,
-      newState: {
-        attemptsLeft: refilled,
-        lastAttemptTime: now,
-      },
-    };
-  }
-
-  return {
-    limited: false,
-    newState: {
-      attemptsLeft: refilled - 1,
-      lastAttemptTime: now,
-    },
-  };
-}

package/src/server/limits.ts

@@ -1,107 +0,0 @@
-import { Fx } from "@robelest/fx";
-import { ConvexError } from "convex/values";
-
-import { authDb } from "./db";
-import { Doc, MutationCtx } from "./types";
-import { ConvexAuthConfig } from "./types";
-
-const DEFAULT_MAX_SIGN_IN_ATTEMPTS_PER_HOUR = 10;
-
-/**
- * Check whether the given identifier is currently rate-limited.
- */
-/** @internal */
-export const isSignInRateLimited = (
-  ctx: MutationCtx,
-  identifier: string,
-  config: ConvexAuthConfig,
-): Fx<boolean, ConvexError<any>> =>
-  getRateLimitState(ctx, identifier, config).pipe(
-    Fx.map((state) => state !== null && state.attemptsLeft < 1),
-  );
-
-/**
- * Record a failed sign-in attempt for the given identifier.
- *
- * If a record exists, decrement; otherwise create.
- */
-/** @internal */
-export const recordFailedSignIn = (
-  ctx: MutationCtx,
-  identifier: string,
-  config: ConvexAuthConfig,
-): Fx<void, ConvexError<any>> =>
-  Fx.gen(function* () {
-    const state = yield* getRateLimitState(ctx, identifier, config);
-    if (state !== null) {
-      yield* Fx.promise(() =>
-        authDb(ctx, config).rateLimits.patch(state.limit._id, {
-          attemptsLeft: state.attemptsLeft - 1,
-          lastAttemptTime: Date.now(),
-        }),
-      );
-    } else {
-      yield* Fx.promise(() =>
-        authDb(ctx, config).rateLimits.create({
-          identifier,
-          attemptsLeft:
-            (config.signIn?.maxFailedAttemptsPerHour ??
-              DEFAULT_MAX_SIGN_IN_ATTEMPTS_PER_HOUR) - 1,
-          lastAttemptTime: Date.now(),
-        }),
-      );
-    }
-  });
-
-/**
- * Reset the rate limit for the given identifier (e.g. after successful sign-in).
- */
-/** @internal */
-export const resetSignInRateLimit = (
-  ctx: MutationCtx,
-  identifier: string,
-  config: ConvexAuthConfig,
-): Fx<void, ConvexError<any>> =>
-  Fx.gen(function* () {
-    const state = yield* getRateLimitState(ctx, identifier, config);
-    if (state !== null) {
-      yield* Fx.promise(() =>
-        authDb(ctx, config).rateLimits.delete(state.limit._id),
-      );
-    }
-  });
-
-// ---------------------------------------------------------------------------
-// Internal
-// ---------------------------------------------------------------------------
-
-type RateLimitState = {
-  limit: Doc<"RateLimit"> & { attemptsLeft: number; lastAttemptTime: number };
-  attemptsLeft: number;
-} | null;
-
-const getRateLimitState = (
-  ctx: MutationCtx,
-  identifier: string,
-  config: ConvexAuthConfig,
-): Fx<RateLimitState, ConvexError<any>> =>
-  Fx.gen(function* () {
-    const now = Date.now();
-    const maxAttemptsPerHour =
-      config.signIn?.maxFailedAttemptsPerHour ??
-      DEFAULT_MAX_SIGN_IN_ATTEMPTS_PER_HOUR;
-
-    const limit = (yield* Fx.promise(() =>
-      authDb(ctx, config).rateLimits.get(identifier),
-    )) as
-      | (Doc<"RateLimit"> & { attemptsLeft: number; lastAttemptTime: number })
-      | null;
-    if (limit === null) return null;
-    const elapsed = now - limit.lastAttemptTime;
-    const maxAttemptsPerMs = maxAttemptsPerHour / (60 * 60 * 1000);
-    const attemptsLeft = Math.min(
-      maxAttemptsPerHour,
-      limit.attemptsLeft + elapsed * maxAttemptsPerMs,
-    );
-    return { limit, attemptsLeft };
-  });