@robelest/convex-auth 0.0.4-preview.25 → 0.0.4-preview.28

package/src/server/mutations/refresh.ts

@@ -1,299 +0,0 @@
-import { Fx } from "@robelest/fx";
-import type { GenericActionCtx, GenericDataModel } from "convex/server";
-import { ConvexError, Infer, v } from "convex/values";
-
-import * as Provider from "../crypto";
-import { authDb } from "../db";
-import {
-  invalidateRefreshTokensInSubtree,
-  parseRefreshToken,
-  REFRESH_TOKEN_REUSE_WINDOW_MS,
-  refreshTokenIfValid,
-} from "../refresh";
-import { generateTokensForSession } from "../sessions";
-import { MutationCtx } from "../types";
-import { logWithLevel, maybeRedact } from "../utils";
-import { AUTH_STORE_REF } from "./store/refs";
-
-export const refreshSessionArgs = v.object({
-  refreshToken: v.string(),
-});
-
-type RefreshResult = null | {
-  token: string;
-  refreshToken: string;
-};
-
-// ============================================================================
-// Small helpers for the refresh pipeline
-// ============================================================================
-
-/** A soft refresh failure — logged and collapsed to null at the boundary. */
-class RefreshFailure {
-  readonly _tag = "RefreshFailure" as const;
-  constructor(readonly reason: string) {}
-}
-
-// ============================================================================
-// Main exported function
-// ============================================================================
-
-export async function refreshSessionImpl(
-  ctx: MutationCtx,
-  args: Infer<typeof refreshSessionArgs>,
-  _getProviderOrThrow: Provider.GetProviderOrThrowFunc,
-  config: Provider.Config,
-): Promise<RefreshResult> {
-  const db = authDb(ctx, config);
-  const { refreshToken } = args;
-
-  return Fx.run(
-    parseRefreshToken(refreshToken).pipe(
-      Fx.recover((err: ConvexError<any>) =>
-        Fx.fail(new RefreshFailure(err.data.message)),
-      ),
-      Fx.tap(({ refreshTokenId, sessionId: tokenSessionId }) =>
-        Fx.sync(() =>
-          logWithLevel(
-            "DEBUG",
-            `refreshSessionImpl args: Token ID: ${maybeRedact(refreshTokenId)} Session ID: ${maybeRedact(tokenSessionId)}`,
-          ),
-        ),
-      ),
-      Fx.chain(({ refreshTokenId, sessionId: tokenSessionId }) =>
-        refreshTokenIfValid(ctx, refreshTokenId, tokenSessionId, config).pipe(
-          Fx.chain((validationResult) =>
-            validationResult === null
-              ? Fx.gen(function* () {
-                  yield* Fx.from({
-                    ok: async () => {
-                      const session = await (db as any).sessions.getById(
-                        tokenSessionId,
-                      );
-                      if (session !== null) {
-                        await (db as any).sessions.delete(session._id);
-                      }
-                    },
-                    err: () =>
-                      new RefreshFailure(
-                        "Skipping invalid session id during refresh cleanup",
-                      ),
-                  }).pipe(
-                    Fx.recover((f) => {
-                      logWithLevel("DEBUG", f.reason);
-                      return Fx.succeed(undefined as void);
-                    }),
-                  );
-
-                  yield* Fx.from({
-                    ok: () =>
-                      authDb(ctx, config).refreshTokens.deleteAll(
-                        tokenSessionId as any,
-                      ),
-                    err: () =>
-                      new RefreshFailure(
-                        "Skipping invalid token session id during refresh token cleanup",
-                      ),
-                  }).pipe(
-                    Fx.recover((f) => {
-                      logWithLevel("DEBUG", f.reason);
-                      return Fx.succeed(undefined as void);
-                    }),
-                  );
-
-                  return null;
-                })
-              : (() => {
-                  const { session } = validationResult;
-                  const sessionId = session._id;
-                  const userId = session.userId;
-                  const tokenFirstUsed =
-                    validationResult.refreshTokenDoc.firstUsedTime;
-                  return tokenFirstUsed === undefined
-                    ? Fx.from({
-                        ok: async () => {
-                          await (db as any).refreshTokens.patch(
-                            refreshTokenId,
-                            {
-                              firstUsedTime: Date.now(),
-                            },
-                          );
-                          const result = await generateTokensForSession(
-                            ctx,
-                            config,
-                            {
-                              userId,
-                              sessionId,
-                              issuedRefreshTokenId: null,
-                              parentRefreshTokenId: refreshTokenId as any,
-                            },
-                          );
-                          const { refreshTokenId: newRefreshTokenId } =
-                            await Fx.run(
-                              parseRefreshToken(result.refreshToken),
-                            );
-                          logWithLevel(
-                            "DEBUG",
-                            `Exchanged ${maybeRedact(validationResult.refreshTokenDoc._id)} (first use) for new refresh token ${maybeRedact(newRefreshTokenId)}`,
-                          );
-                          return result;
-                        },
-                        err: () =>
-                          new RefreshFailure(
-                            "Failed during first-use token exchange",
-                          ),
-                      })
-                    : Fx.from({
-                        ok: () =>
-                          authDb(ctx, config).refreshTokens.getActive(
-                            tokenSessionId as any,
-                          ),
-                        err: () =>
-                          new RefreshFailure(
-                            "Failed to load active refresh token",
-                          ),
-                      }).pipe(
-                        Fx.chain((activeRefreshToken) => {
-                          logWithLevel(
-                            "DEBUG",
-                            `Active refresh token: ${maybeRedact(activeRefreshToken?._id ?? "(none)")}, parent ${maybeRedact(activeRefreshToken?.parentRefreshTokenId ?? "(none)")}`,
-                          );
-
-                          const reuseDispatch =
-                            activeRefreshToken !== null &&
-                            activeRefreshToken.parentRefreshTokenId ===
-                              refreshTokenId
-                              ? ({
-                                  tag: "parentOfActive",
-                                  activeRefreshToken,
-                                } as const)
-                              : tokenFirstUsed + REFRESH_TOKEN_REUSE_WINDOW_MS >
-                                  Date.now()
-                                ? ({ tag: "withinReuseWindow" } as const)
-                                : ({ tag: "outsideReuseWindow" } as const);
-
-                          if (reuseDispatch.tag === "parentOfActive") {
-                            return Fx.from({
-                              ok: () =>
-                                generateTokensForSession(ctx, config, {
-                                  userId,
-                                  sessionId,
-                                  issuedRefreshTokenId:
-                                    reuseDispatch.activeRefreshToken._id,
-                                  parentRefreshTokenId: refreshTokenId as any,
-                                }),
-                              err: () =>
-                                new RefreshFailure(
-                                  "Failed to generate tokens for parent reuse",
-                                ),
-                            }).pipe(
-                              Fx.tap(() =>
-                                Fx.sync(() =>
-                                  logWithLevel(
-                                    "DEBUG",
-                                    `Token ${maybeRedact(validationResult.refreshTokenDoc._id)} is parent of active refresh token ${maybeRedact(reuseDispatch.activeRefreshToken._id)}, so returning that token`,
-                                  ),
-                                ),
-                              ),
-                            );
-                          }
-
-                          if (reuseDispatch.tag === "withinReuseWindow") {
-                            return Fx.from({
-                              ok: async () => {
-                                const result = await generateTokensForSession(
-                                  ctx,
-                                  config,
-                                  {
-                                    userId,
-                                    sessionId,
-                                    issuedRefreshTokenId: null,
-                                    parentRefreshTokenId: refreshTokenId as any,
-                                  },
-                                );
-                                const { refreshTokenId: newRefreshTokenId } =
-                                  await Fx.run(
-                                    parseRefreshToken(result.refreshToken),
-                                  );
-                                logWithLevel(
-                                  "DEBUG",
-                                  `Exchanged ${maybeRedact(validationResult.refreshTokenDoc._id)} (reuse) for new refresh token ${maybeRedact(newRefreshTokenId)}`,
-                                );
-                                return result;
-                              },
-                              err: () =>
-                                new RefreshFailure(
-                                  "Failed to generate tokens for reuse window",
-                                ),
-                            });
-                          }
-
-                          logWithLevel(
-                            "ERROR",
-                            "Refresh token used outside of reuse window",
-                          );
-                          logWithLevel(
-                            "DEBUG",
-                            `Token ${maybeRedact(validationResult.refreshTokenDoc._id)} being used outside of reuse window, so invalidating all refresh tokens in subtree`,
-                          );
-                          return Fx.from({
-                            ok: async () => {
-                              const tokensToInvalidate =
-                                await invalidateRefreshTokensInSubtree(
-                                  ctx,
-                                  validationResult.refreshTokenDoc,
-                                  config,
-                                );
-                              logWithLevel(
-                                "DEBUG",
-                                `Invalidated ${tokensToInvalidate.length} refresh tokens in subtree: ${tokensToInvalidate
-                                  .map((token) => maybeRedact(token._id))
-                                  .join(", ")}`,
-                              );
-                              return null;
-                            },
-                            err: () =>
-                              new RefreshFailure(
-                                "Failed to invalidate refresh tokens in subtree",
-                              ),
-                          });
-                        }),
-                      );
-                })(),
-          ),
-        ),
-      ),
-      Fx.fold({
-        ok: (result) => result,
-        err: (failure) => {
-          logWithLevel("DEBUG", failure.reason);
-          return null;
-        },
-      }),
-    ),
-  );
-}
-
-// ============================================================================
-// Invalid token path — cleanup session and refresh tokens
-// ============================================================================
-
-// ============================================================================
-// Valid token path — dispatch on first-use / parent / reuse-window / stale
-// ============================================================================
-
-// ============================================================================
-// Action-level caller (unchanged — just forwards to mutation)
-// ============================================================================
-
-export const callRefreshSession = async <DataModel extends GenericDataModel>(
-  ctx: GenericActionCtx<DataModel>,
-  args: Infer<typeof refreshSessionArgs>,
-): Promise<RefreshResult> => {
-  return ctx.runMutation(AUTH_STORE_REF, {
-    args: {
-      type: "refreshSession",
-      ...args,
-    },
-  });
-};

package/src/server/mutations/register.ts

@@ -1,155 +0,0 @@
-import { Fx } from "@robelest/fx";
-import { Cv } from "@robelest/fx/convex";
-import type { GenericActionCtx, GenericDataModel } from "convex/server";
-import { Infer, v } from "convex/values";
-
-import * as Provider from "../crypto";
-import { authDb } from "../db";
-import { getAuthSessionId } from "../sessions";
-import { Doc, MutationCtx } from "../types";
-import { ConvexCredentialsConfig } from "../types";
-import { upsertUserAndAccount } from "../users";
-import { LOG_LEVELS, logWithLevel, maybeRedact } from "../utils";
-import { AUTH_STORE_REF } from "./store/refs";
-
-export const createAccountFromCredentialsArgs = v.object({
-  provider: v.string(),
-  account: v.object({ id: v.string(), secret: v.optional(v.string()) }),
-  profile: v.any(),
-  shouldLinkViaEmail: v.optional(v.boolean()),
-  shouldLinkViaPhone: v.optional(v.boolean()),
-});
-
-type ReturnType = { account: Doc<"Account">; user: Doc<"User"> };
-
-export async function createAccountFromCredentialsImpl(
-  ctx: MutationCtx,
-  args: Infer<typeof createAccountFromCredentialsArgs>,
-  getProviderOrThrow: Provider.GetProviderOrThrowFunc,
-  config: Provider.Config,
-): Promise<ReturnType> {
-  logWithLevel(LOG_LEVELS.DEBUG, "createAccountFromCredentialsImpl args:", {
-    provider: args.provider,
-    account: {
-      id: args.account.id,
-      secret: maybeRedact(args.account.secret ?? ""),
-    },
-  });
-
-  const {
-    provider: providerId,
-    account,
-    profile,
-    shouldLinkViaEmail,
-    shouldLinkViaPhone,
-  } = args;
-  const db = authDb(ctx, config);
-  const provider = getProviderOrThrow(providerId) as ConvexCredentialsConfig;
-
-  return Fx.run(
-    Fx.gen(function* () {
-      const existingAccount = yield* Fx.promise(
-        () =>
-          db.accounts.get(
-            provider.id,
-            account.id,
-          ) as Promise<Doc<"Account"> | null>,
-      );
-
-      if (existingAccount !== null) {
-        if (account.secret !== undefined) {
-          const valid = yield* Provider.verify(
-            provider,
-            account.secret,
-            existingAccount.secret ?? "",
-          );
-          if (!valid) {
-            return yield* Cv.fail({
-              code: "ACCOUNT_ALREADY_EXISTS",
-              message: `Account ${account.id} already exists`,
-            });
-          }
-        }
-
-        const user = yield* Fx.promise(
-          () =>
-            db.users.getById(
-              existingAccount.userId,
-            ) as Promise<Doc<"User"> | null>,
-        );
-        if (user === null) {
-          return yield* Cv.fail({
-            code: "ACCOUNT_NOT_FOUND",
-            message: `Linked user for account ${account.id} was not found.`,
-          });
-        }
-
-        return { account: existingAccount, user };
-      }
-
-      const secret =
-        account.secret !== undefined
-          ? yield* Provider.hash(provider, account.secret)
-          : undefined;
-
-      const result = yield* Fx.promise(async () =>
-        upsertUserAndAccount(
-          ctx,
-          await getAuthSessionId(ctx),
-          { providerAccountId: account.id, secret },
-          {
-            type: "credentials",
-            provider,
-            profile,
-            shouldLinkViaEmail,
-            shouldLinkViaPhone,
-          },
-          config,
-        ),
-      );
-
-      const { userId, accountId } = result as {
-        userId: string;
-        accountId: string;
-      };
-      const [createdAccount, createdUser] = yield* Fx.zip(
-        Fx.promise(
-          () =>
-            db.accounts.getById(accountId) as Promise<Doc<"Account"> | null>,
-        ),
-        Fx.promise(
-          () => db.users.getById(userId) as Promise<Doc<"User"> | null>,
-        ),
-      );
-
-      if (createdAccount === null) {
-        return yield* Cv.fail({
-          code: "ACCOUNT_NOT_FOUND",
-          message: `Created account was not found.`,
-        });
-      }
-      if (createdUser === null) {
-        return yield* Cv.fail({
-          code: "USER_UPDATE_FAILED",
-          message: `Created user was not found.`,
-        });
-      }
-
-      return { account: createdAccount, user: createdUser };
-    }),
-  ) as Promise<ReturnType>;
-}
-
-export const callCreateAccountFromCredentials = async <
-  DataModel extends GenericDataModel,
->(
-  ctx: GenericActionCtx<DataModel>,
-  args: Infer<typeof createAccountFromCredentialsArgs>,
-): Promise<ReturnType> => {
-  return ctx.runMutation(AUTH_STORE_REF, {
-    args: {
-      type: "createAccountFromCredentials",
-      ...args,
-    },
-  });
-};

package/src/server/mutations/retrieve.ts

@@ -1,109 +0,0 @@
-import { Fx } from "@robelest/fx";
-import type { GenericActionCtx, GenericDataModel } from "convex/server";
-import { Infer, v } from "convex/values";
-
-import * as Provider from "../crypto";
-import { authDb } from "../db";
-import {
-  isSignInRateLimited,
-  recordFailedSignIn,
-  resetSignInRateLimit,
-} from "../limits";
-import { Doc, MutationCtx } from "../types";
-import { LOG_LEVELS, logWithLevel, maybeRedact } from "../utils";
-import { AUTH_STORE_REF } from "./store/refs";
-
-export const retrieveAccountWithCredentialsArgs = v.object({
-  provider: v.string(),
-  account: v.object({ id: v.string(), secret: v.optional(v.string()) }),
-});
-
-type ReturnType =
-  | "InvalidAccountId"
-  | "TooManyFailedAttempts"
-  | "InvalidSecret"
-  | { account: Doc<"Account">; user: Doc<"User"> };
-
-export function retrieveAccountWithCredentialsImpl(
-  ctx: MutationCtx,
-  args: Infer<typeof retrieveAccountWithCredentialsArgs>,
-  getProviderOrThrow: Provider.GetProviderOrThrowFunc,
-  config: Provider.Config,
-): Fx<ReturnType> {
-  const { provider: providerId, account } = args;
-  const db = authDb(ctx, config);
-
-  logWithLevel(LOG_LEVELS.DEBUG, "retrieveAccountWithCredentialsImpl args:", {
-    provider: providerId,
-    account: { id: account.id, secret: maybeRedact(account.secret ?? "") },
-  });
-
-  return Fx.gen(function* () {
-    const existingAccount = yield* Fx.promise(
-      () =>
-        db.accounts.get(
-          providerId,
-          account.id,
-        ) as Promise<Doc<"Account"> | null>,
-    );
-    if (existingAccount === null) {
-      return "InvalidAccountId" as const;
-    }
-
-    if (account.secret !== undefined) {
-      const limited = yield* isSignInRateLimited(
-        ctx,
-        existingAccount._id,
-        config,
-      );
-      if (limited) {
-        return "TooManyFailedAttempts" as const;
-      }
-
-      const valid = yield* Provider.verify(
-        getProviderOrThrow(providerId),
-        account.secret,
-        existingAccount.secret ?? "",
-      );
-      if (!valid) {
-        yield* recordFailedSignIn(ctx, existingAccount._id, config);
-        return "InvalidSecret" as const;
-      }
-
-      yield* resetSignInRateLimit(ctx, existingAccount._id, config);
-    }
-
-    const user = yield* Fx.promise(
-      () =>
-        db.users.getById(existingAccount.userId) as Promise<Doc<"User"> | null>,
-    );
-    if (user === null) {
-      logWithLevel(
-        LOG_LEVELS.ERROR,
-        `Account ${existingAccount._id} is linked to missing user ${existingAccount.userId}`,
-      );
-      return "InvalidAccountId" as const;
-    }
-
-    return { account: existingAccount, user } as ReturnType;
-  }).pipe(
-    Fx.fold({
-      ok: (v) => v as ReturnType,
-      err: () => "InvalidAccountId" as ReturnType,
-    }),
-  );
-}
-
-export const callRetrieveAccountWithCredentials = async <
-  DataModel extends GenericDataModel,
->(
-  ctx: GenericActionCtx<DataModel>,
-  args: Infer<typeof retrieveAccountWithCredentialsArgs>,
-): Promise<ReturnType> => {
-  return ctx.runMutation(AUTH_STORE_REF, {
-    args: {
-      type: "retrieveAccountWithCredentials",
-      ...args,
-    },
-  });
-};

package/src/server/mutations/signature.ts

@@ -1,57 +0,0 @@
-import { Fx } from "@robelest/fx";
-import { Cv } from "@robelest/fx/convex";
-import type { GenericActionCtx, GenericDataModel } from "convex/server";
-import { ConvexError, GenericId, Infer, v } from "convex/values";
-
-import * as Provider from "../crypto";
-import { authDb } from "../db";
-import { MutationCtx } from "../types";
-import { AUTH_STORE_REF } from "./store/refs";
-
-export const verifierSignatureArgs = v.object({
-  verifier: v.string(),
-  signature: v.string(),
-});
-
-type ReturnType = void;
-
-export function verifierSignatureImpl(
-  ctx: MutationCtx,
-  args: Infer<typeof verifierSignatureArgs>,
-  config: Provider.Config,
-): Fx<ReturnType, ConvexError<any>> {
-  return Fx.gen(function* () {
-    const { verifier, signature } = args;
-    const db = authDb(ctx, config);
-    const verifierDoc = yield* Fx.from({
-      ok: () => db.verifiers.getById(verifier as GenericId<"AuthVerifier">),
-      err: () =>
-        Cv.error({
-          code: "INVALID_VERIFIER",
-          message: "Invalid or expired verifier.",
-        }),
-    }).pipe(
-      Fx.chain((doc) =>
-        doc === null
-          ? Cv.fail({
-              code: "INVALID_VERIFIER",
-              message: "Invalid or expired verifier.",
-            })
-          : Fx.succeed(doc),
-      ),
-    );
-    yield* Fx.promise(() => db.verifiers.patch(verifierDoc._id, { signature }));
-  });
-}
-
-export const callVerifierSignature = async <DataModel extends GenericDataModel>(
-  ctx: GenericActionCtx<DataModel>,
-  args: Infer<typeof verifierSignatureArgs>,
-): Promise<void> => {
-  return ctx.runMutation(AUTH_STORE_REF, {
-    args: {
-      type: "verifierSignature",
-      ...args,
-    },
-  });
-};

package/src/server/mutations/signin.ts

@@ -1,54 +0,0 @@
-import type { GenericActionCtx, GenericDataModel } from "convex/server";
-import { GenericId, Infer, v } from "convex/values";
-
-import * as Provider from "../crypto";
-import {
-  createNewAndDeleteExistingSession,
-  maybeGenerateTokensForSession,
-} from "../sessions";
-import { MutationCtx, SessionInfo } from "../types";
-import { LOG_LEVELS, logWithLevel } from "../utils";
-import { AUTH_STORE_REF } from "./store/refs";
-
-export const signInArgs = v.object({
-  userId: v.string(),
-  sessionId: v.optional(v.string()),
-  generateTokens: v.boolean(),
-});
-
-type ReturnType = SessionInfo;
-
-export async function signInImpl(
-  ctx: MutationCtx,
-  args: Infer<typeof signInArgs>,
-  config: Provider.Config,
-): Promise<ReturnType> {
-  logWithLevel(LOG_LEVELS.DEBUG, "signInImpl args:", args);
-  const { userId, sessionId: existingSessionId, generateTokens } = args;
-  const typedUserId = userId as GenericId<"User">;
-  const typedExistingSessionId = existingSessionId as
-    | GenericId<"Session">
-    | undefined;
-  const sessionId =
-    typedExistingSessionId ??
-    (await createNewAndDeleteExistingSession(ctx, config, typedUserId));
-  return await maybeGenerateTokensForSession(
-    ctx,
-    config,
-    typedUserId,
-    sessionId,
-    generateTokens,
-  );
-}
-
-export const callSignIn = async <DataModel extends GenericDataModel>(
-  ctx: GenericActionCtx<DataModel>,
-  args: Infer<typeof signInArgs>,
-): Promise<ReturnType> => {
-  return ctx.runMutation(AUTH_STORE_REF, {
-    args: {
-      type: "signIn",
-      ...args,
-    },
-  });
-};