@robelest/convex-auth 0.0.4-preview.25 → 0.0.4-preview.28

package/src/server/mutations/account.ts

@@ -1,62 +0,0 @@
-import { Fx } from "@robelest/fx";
-import { Cv } from "@robelest/fx/convex";
-import type { GenericActionCtx, GenericDataModel } from "convex/server";
-import { ConvexError, Infer, v } from "convex/values";
-
-import { GetProviderOrThrowFunc, hash } from "../crypto";
-import * as Provider from "../crypto";
-import { authDb } from "../db";
-import { MutationCtx } from "../types";
-import { LOG_LEVELS, logWithLevel, maybeRedact } from "../utils";
-import { AUTH_STORE_REF } from "./store/refs";
-
-export const modifyAccountArgs = v.object({
-  provider: v.string(),
-  account: v.object({ id: v.string(), secret: v.string() }),
-});
-
-export function modifyAccountImpl(
-  ctx: MutationCtx,
-  args: Infer<typeof modifyAccountArgs>,
-  getProviderOrThrow: GetProviderOrThrowFunc,
-  config: Provider.Config,
-): Fx<void, ConvexError<any>> {
-  const { provider, account } = args;
-  const db = authDb(ctx, config);
-
-  logWithLevel(LOG_LEVELS.DEBUG, "modifyAccountImpl args:", {
-    provider,
-    account: { id: account.id, secret: maybeRedact(account.secret ?? "") },
-  });
-
-  return Fx.gen(function* () {
-    const existingAccount = yield* Fx.promise(() =>
-      db.accounts.get(provider, account.id),
-    );
-    if (existingAccount === null) {
-      return yield* Cv.fail({
-        code: "ACCOUNT_NOT_FOUND",
-        message: `Cannot modify account with ID ${account.id} because it does not exist`,
-      });
-    }
-    const hashedSecret = yield* hash(
-      getProviderOrThrow(provider),
-      account.secret,
-    );
-    yield* Fx.promise(() =>
-      db.accounts.patch(existingAccount._id, { secret: hashedSecret }),
-    );
-  });
-}
-
-export const callModifyAccount = async <DataModel extends GenericDataModel>(
-  ctx: GenericActionCtx<DataModel>,
-  args: Infer<typeof modifyAccountArgs>,
-): Promise<void> => {
-  return ctx.runMutation(AUTH_STORE_REF, {
-    args: {
-      type: "modifyAccount",
-      ...args,
-    },
-  });
-};

package/src/server/mutations/code.ts

@@ -1,119 +0,0 @@
-import { Cv } from "@robelest/fx/convex";
-import type { GenericActionCtx, GenericDataModel } from "convex/server";
-import { GenericId, Infer, v } from "convex/values";
-
-import * as Provider from "../crypto";
-import { authDb } from "../db";
-import { getAuthSessionId } from "../sessions";
-import { MutationCtx } from "../types";
-import { EmailConfig, PhoneConfig } from "../types";
-import { upsertUserAndAccount } from "../users";
-import { LOG_LEVELS, logWithLevel, sha256 } from "../utils";
-import { AUTH_STORE_REF } from "./store/refs";
-
-export const createVerificationCodeArgs = v.object({
-  accountId: v.optional(v.string()),
-  provider: v.string(),
-  email: v.optional(v.string()),
-  phone: v.optional(v.string()),
-  code: v.string(),
-  expirationTime: v.number(),
-  allowExtraProviders: v.boolean(),
-});
-
-type ReturnType = string;
-
-export async function createVerificationCodeImpl(
-  ctx: MutationCtx,
-  args: Infer<typeof createVerificationCodeArgs>,
-  getProviderOrThrow: Provider.GetProviderOrThrowFunc,
-  config: Provider.Config,
-): Promise<ReturnType> {
-  logWithLevel(LOG_LEVELS.DEBUG, "createVerificationCodeImpl args:", args);
-  const {
-    email,
-    phone,
-    code,
-    expirationTime,
-    provider: providerId,
-    accountId: existingAccountId,
-    allowExtraProviders,
-  } = args;
-  const db = authDb(ctx, config);
-  const typedExistingAccountId = existingAccountId as
-    | GenericId<"Account">
-    | undefined;
-  const existingAccount =
-    typedExistingAccountId !== undefined
-      ? ((await db.accounts.getById(typedExistingAccountId)) ??
-        (() => {
-          throw Cv.error({
-            code: "ACCOUNT_NOT_FOUND",
-            message: `Expected an account to exist for ID "${typedExistingAccountId}"`,
-          });
-        })())
-      : await db.accounts.get(providerId, email ?? phone!);
-
-  const provider = getProviderOrThrow(providerId, allowExtraProviders) as
-    | EmailConfig
-    | PhoneConfig;
-  const { accountId } = await upsertUserAndAccount(
-    ctx,
-    await getAuthSessionId(ctx),
-    existingAccount !== null
-      ? { existingAccount }
-      : { providerAccountId: email ?? phone! },
-    provider.type === "email"
-      ? { type: "email", provider, profile: { email: email! } }
-      : { type: "phone", provider, profile: { phone: phone! } },
-    config,
-  );
-  await generateUniqueVerificationCode(
-    ctx,
-    accountId,
-    providerId,
-    code,
-    expirationTime,
-    { email, phone },
-    config,
-  );
-  return email ?? phone!;
-}
-
-export const callCreateVerificationCode = async <
-  DataModel extends GenericDataModel,
->(
-  ctx: GenericActionCtx<DataModel>,
-  args: Infer<typeof createVerificationCodeArgs>,
-): Promise<ReturnType> => {
-  return ctx.runMutation(AUTH_STORE_REF, {
-    args: {
-      type: "createVerificationCode",
-      ...args,
-    },
-  });
-};
-
-async function generateUniqueVerificationCode(
-  ctx: MutationCtx,
-  accountId: GenericId<"Account">,
-  provider: string,
-  code: string,
-  expirationTime: number,
-  { email, phone }: { email?: string; phone?: string },
-  config: Provider.Config,
-) {
-  const db = authDb(ctx, config);
-  const existingCode = await db.verificationCodes.getByAccountId(accountId);
-  if (existingCode !== null) {
-    await db.verificationCodes.delete(existingCode._id);
-  }
-  await db.verificationCodes.create({
-    accountId,
-    provider,
-    code: await sha256(code),
-    expirationTime,
-    emailVerified: email,
-    phoneVerified: phone,
-  });
-}

package/src/server/mutations/index.ts

@@ -1,13 +0,0 @@
-export { callModifyAccount } from "./account";
-export { callCreateVerificationCode } from "./code";
-export { callInvalidateSessions } from "./invalidate";
-export { callUserOAuth } from "./oauth";
-export { callRefreshSession } from "./refresh";
-export { callCreateAccountFromCredentials } from "./register";
-export { callRetrieveAccountWithCredentials } from "./retrieve";
-export { callVerifierSignature } from "./signature";
-export { callSignIn } from "./signin";
-export { callSignOut } from "./signout";
-export { storeArgs, storeImpl } from "./store";
-export { callVerifier } from "./verifier";
-export { callVerifyCodeAndSignIn } from "./verify";

package/src/server/mutations/invalidate.ts

@@ -1,50 +0,0 @@
-import { Fx } from "@robelest/fx";
-import type { GenericActionCtx, GenericDataModel } from "convex/server";
-import { GenericId, Infer, v } from "convex/values";
-
-import * as Provider from "../crypto";
-import { authDb } from "../db";
-import { deleteSession } from "../sessions";
-import { Doc, MutationCtx } from "../types";
-import { LOG_LEVELS, logWithLevel } from "../utils";
-import { AUTH_STORE_REF } from "./store/refs";
-
-export const invalidateSessionsArgs = v.object({
-  userId: v.string(),
-  except: v.optional(v.array(v.string())),
-});
-
-export const callInvalidateSessions = async <
-  DataModel extends GenericDataModel,
->(
-  ctx: GenericActionCtx<DataModel>,
-  args: Infer<typeof invalidateSessionsArgs>,
-): Promise<void> => {
-  return ctx.runMutation(AUTH_STORE_REF, {
-    args: {
-      type: "invalidateSessions",
-      ...args,
-    },
-  });
-};
-
-export function invalidateSessionsImpl(
-  ctx: MutationCtx,
-  args: Infer<typeof invalidateSessionsArgs>,
-  config: Provider.Config,
-): Fx<void, never> {
-  return Fx.gen(function* () {
-    logWithLevel(LOG_LEVELS.DEBUG, "invalidateSessionsImpl args:", args);
-    const { userId, except } = args;
-    const exceptSet = new Set(except ?? []);
-    const typedUserId = userId as GenericId<"User">;
-    const sessions = (yield* Fx.promise(() =>
-      authDb(ctx, config).sessions.listByUser(typedUserId),
-    )) as Doc<"Session">[];
-    yield* Fx.each(sessions, (session: Doc<"Session">) =>
-      exceptSet.has(session._id)
-        ? Fx.unit
-        : Fx.promise(() => deleteSession(ctx, session, config)),
-    );
-  });
-}

package/src/server/mutations/oauth.ts

@@ -1,243 +0,0 @@
-import { Fx } from "@robelest/fx";
-import { Cv } from "@robelest/fx/convex";
-import type { GenericActionCtx, GenericDataModel } from "convex/server";
-import type { ConvexError } from "convex/values";
-import { Infer, v } from "convex/values";
-
-import * as Provider from "../crypto";
-import { authDb } from "../db";
-import { createSyntheticOAuthMaterializedConfig } from "../enterprise/oidc";
-import { normalizeEnterprisePolicy } from "../enterprise/policy";
-import {
-  ENTERPRISE_OIDC_PROVIDER_PREFIX,
-  ENTERPRISE_SAML_PROVIDER_PREFIX,
-  isEnterpriseProviderId,
-} from "../enterprise/shared";
-import { MutationCtx } from "../types";
-import type { AuthProviderMaterializedConfig } from "../types";
-import { upsertUserAndAccount } from "../users";
-import { generateRandomString, logWithLevel, sha256 } from "../utils";
-import { AUTH_STORE_REF } from "./store/refs";
-
-const OAUTH_SIGN_IN_EXPIRATION_MS = 1000 * 60 * 2; // 2 minutes
-
-export const userOAuthArgs = v.object({
-  provider: v.string(),
-  providerAccountId: v.string(),
-  profile: v.any(),
-  signature: v.string(),
-  accountExtend: v.optional(v.any()),
-});
-
-function normalizeAccountExtend(
-  provider: string,
-  providerAccountId: string,
-  accountExtend: unknown,
-) {
-  const baseIdentity: Record<string, unknown> = {
-    type: "oauth",
-    provider,
-    providerAccountId,
-  };
-  if (provider.startsWith(ENTERPRISE_OIDC_PROVIDER_PREFIX)) {
-    baseIdentity.type = "enterprise-oidc";
-    baseIdentity.enterpriseId = provider.slice(
-      ENTERPRISE_OIDC_PROVIDER_PREFIX.length,
-    );
-  }
-  if (provider.startsWith(ENTERPRISE_SAML_PROVIDER_PREFIX)) {
-    baseIdentity.type = "enterprise-saml";
-    baseIdentity.enterpriseId = provider.slice(
-      ENTERPRISE_SAML_PROVIDER_PREFIX.length,
-    );
-  }
-  const provided =
-    typeof accountExtend === "object" &&
-    accountExtend !== null &&
-    !Array.isArray(accountExtend)
-      ? (accountExtend as Record<string, unknown>)
-      : undefined;
-  const providedIdentity =
-    provided &&
-    typeof provided.identity === "object" &&
-    provided.identity !== null &&
-    !Array.isArray(provided.identity)
-      ? (provided.identity as Record<string, unknown>)
-      : undefined;
-  return {
-    ...provided,
-    identity: {
-      ...baseIdentity,
-      ...providedIdentity,
-    },
-  };
-}
-
-type ReturnType = string;
-
-export function userOAuthImpl(
-  ctx: MutationCtx,
-  args: Infer<typeof userOAuthArgs>,
-  getProviderOrThrow: Provider.GetProviderOrThrowFunc,
-  config: Provider.Config,
-): Fx<ReturnType, ConvexError<{ code: string; message: string }>> {
-  return Fx.gen(function* () {
-    logWithLevel("DEBUG", "userOAuthImpl args:", args);
-    const { profile, provider, providerAccountId, signature, accountExtend } =
-      args;
-    const db = authDb(ctx, config);
-    const existingAccount = yield* Fx.promise(() =>
-      db.accounts.get(provider, providerAccountId),
-    );
-    const enterpriseId = provider.startsWith(ENTERPRISE_OIDC_PROVIDER_PREFIX)
-      ? provider.slice(ENTERPRISE_OIDC_PROVIDER_PREFIX.length)
-      : provider.startsWith(ENTERPRISE_SAML_PROVIDER_PREFIX)
-        ? provider.slice(ENTERPRISE_SAML_PROVIDER_PREFIX.length)
-        : null;
-    const enterprise =
-      enterpriseId !== null
-        ? yield* Fx.promise(() =>
-            ctx.runQuery(config.component.public.enterpriseGet, {
-              enterpriseId,
-            }),
-          )
-        : null;
-    const enterprisePolicy = enterprise
-      ? normalizeEnterprisePolicy(enterprise.policy)
-      : null;
-    const enterpriseProtocol = provider.startsWith(
-      ENTERPRISE_OIDC_PROVIDER_PREFIX,
-    )
-      ? "oidc"
-      : provider.startsWith(ENTERPRISE_SAML_PROVIDER_PREFIX)
-        ? "saml"
-        : null;
-
-    const existingScimIdentity =
-      enterpriseId !== null &&
-      existingAccount === null &&
-      enterprisePolicy?.provisioning.scimReuse.user === "externalId"
-        ? yield* Fx.promise(() =>
-            ctx.runQuery(config.component.public.enterpriseScimIdentityGet, {
-              enterpriseId,
-              resourceType: "user",
-              externalId: providerAccountId,
-            }),
-          )
-        : null;
-
-    const verifier = yield* Fx.from({
-      ok: () => db.verifiers.getBySignature(signature),
-      err: () =>
-        Cv.error({
-          code: "OAUTH_INVALID_STATE",
-          message: "Invalid OAuth state. Please try signing in again.",
-        }),
-    }).pipe(
-      Fx.chain((doc) =>
-        doc === null
-          ? Cv.fail({
-              code: "OAUTH_INVALID_STATE",
-              message: "Invalid OAuth state. Please try signing in again.",
-            })
-          : Fx.succeed(doc),
-      ),
-    );
-
-    const { accountId } = yield* Fx.promise(() =>
-      upsertUserAndAccount(
-        ctx,
-        verifier.sessionId ?? null,
-        existingAccount !== null ? { existingAccount } : { providerAccountId },
-        {
-          type: "oauth",
-          provider: (isEnterpriseProviderId(provider)
-            ? createSyntheticOAuthMaterializedConfig(provider, {
-                accountLinking:
-                  enterpriseProtocol === "oidc"
-                    ? enterprisePolicy?.identity.accountLinking.oidc
-                    : enterpriseProtocol === "saml"
-                      ? enterprisePolicy?.identity.accountLinking.saml
-                      : undefined,
-              })
-            : getProviderOrThrow(provider)) as AuthProviderMaterializedConfig,
-          profile,
-          accountExtend: normalizeAccountExtend(
-            provider,
-            providerAccountId,
-            accountExtend,
-          ),
-        },
-        config,
-        existingScimIdentity?.userId
-          ? { existingUserId: existingScimIdentity.userId }
-          : undefined,
-      ),
-    );
-
-    // JIT group provisioning: if this is an enterprise SSO sign-in and the
-    // enterprise connection has a groupId, auto-add the user as a member of
-    // that group if they aren't already a member.
-    if (
-      enterpriseId !== null &&
-      enterprisePolicy?.provisioning.jit.mode === "createUserAndMembership"
-    ) {
-      const account = yield* Fx.promise(() => db.accounts.getById(accountId));
-      const userId = account?.userId;
-      if (userId) {
-        const groupId = (enterprise as any)?.groupId as string | undefined;
-        if (groupId) {
-          const existingMembership = yield* Fx.promise(() =>
-            ctx.runQuery(config.component.public.memberGetByGroupAndUser, {
-              userId,
-              groupId,
-            }),
-          );
-          if (existingMembership === null) {
-            yield* Fx.promise(() =>
-              ctx.runMutation(config.component.public.memberAdd, {
-                groupId,
-                userId,
-                roleIds: enterprisePolicy.provisioning.jit.defaultRoleIds,
-                status: "active",
-              }),
-            );
-          }
-        }
-      }
-    }
-
-    const code = generateRandomString(8, "0123456789");
-    yield* Fx.promise(() => db.verifiers.delete(verifier._id));
-    const existingVerificationCode = yield* Fx.promise(() =>
-      db.verificationCodes.getByAccountId(accountId),
-    );
-    if (existingVerificationCode !== null) {
-      yield* Fx.promise(() =>
-        db.verificationCodes.delete(existingVerificationCode._id),
-      );
-    }
-    yield* Fx.promise(async () =>
-      db.verificationCodes.create({
-        code: await sha256(code),
-        accountId,
-        provider,
-        expirationTime: Date.now() + OAUTH_SIGN_IN_EXPIRATION_MS,
-        verifier: verifier._id,
-      }),
-    );
-    return code;
-  });
-}
-
-export const callUserOAuth = async <DataModel extends GenericDataModel>(
-  ctx: GenericActionCtx<DataModel>,
-  args: Infer<typeof userOAuthArgs>,
-): Promise<ReturnType> => {
-  return ctx.runMutation(AUTH_STORE_REF, {
-    args: {
-      type: "userOAuth",
-      ...args,
-    },
-  });
-};