@robelest/convex-auth 0.0.4-preview.25 → 0.0.4-preview.28

package/src/server/mutations/signout.ts

@@ -1,43 +0,0 @@
-import { Fx } from "@robelest/fx";
-import type { GenericActionCtx, GenericDataModel } from "convex/server";
-import { GenericId } from "convex/values";
-
-import * as Provider from "../crypto";
-import { authDb } from "../db";
-import { deleteSession, getAuthSessionId } from "../sessions";
-import { MutationCtx } from "../types";
-import { AUTH_STORE_REF } from "./store/refs";
-
-type ReturnType = {
-  userId: GenericId<"User">;
-  sessionId: GenericId<"Session">;
-} | null;
-
-export function signOutImpl(
-  ctx: MutationCtx,
-  config: Provider.Config,
-): Fx<ReturnType, never> {
-  return Fx.gen(function* () {
-    const db = authDb(ctx, config);
-    const sessionId = yield* Fx.promise(() => getAuthSessionId(ctx));
-    if (sessionId === null) {
-      return null;
-    }
-    const session = yield* Fx.promise(() => db.sessions.getById(sessionId));
-    if (session === null) {
-      return null;
-    }
-    yield* Fx.promise(() => deleteSession(ctx, session, config));
-    return { userId: session.userId, sessionId: session._id };
-  });
-}
-
-export const callSignOut = async <DataModel extends GenericDataModel>(
-  ctx: GenericActionCtx<DataModel>,
-): Promise<void> => {
-  return ctx.runMutation(AUTH_STORE_REF, {
-    args: {
-      type: "signOut",
-    },
-  });
-};

package/src/server/mutations/store/refs.ts

@@ -1,10 +0,0 @@
-import { makeFunctionReference } from "convex/server";
-
-/**
- * Internal function reference for the library's store dispatch mutation.
- *
- * The package cannot import the consumer app's generated `api` module,
- * so it uses a canonical function reference name that matches the app-level
- * `export const { store } = auth` surface.
- */
-export const AUTH_STORE_REF = makeFunctionReference("auth:store") as any;

package/src/server/mutations/store.ts

@@ -1,123 +0,0 @@
-import { Fx } from "@robelest/fx";
-import { Infer, v } from "convex/values";
-
-import * as Provider from "../crypto";
-import { MutationCtx } from "../types";
-import { LOG_LEVELS, logWithLevel } from "../utils";
-import { modifyAccountArgs, modifyAccountImpl } from "./account";
-import { createVerificationCodeArgs, createVerificationCodeImpl } from "./code";
-import { invalidateSessionsArgs, invalidateSessionsImpl } from "./invalidate";
-import { userOAuthArgs, userOAuthImpl } from "./oauth";
-import { refreshSessionArgs, refreshSessionImpl } from "./refresh";
-import {
-  createAccountFromCredentialsArgs,
-  createAccountFromCredentialsImpl,
-} from "./register";
-import {
-  retrieveAccountWithCredentialsArgs,
-  retrieveAccountWithCredentialsImpl,
-} from "./retrieve";
-import { verifierSignatureArgs, verifierSignatureImpl } from "./signature";
-import { signInArgs, signInImpl } from "./signin";
-import { signOutImpl } from "./signout";
-import { verifierImpl } from "./verifier";
-import { verifyCodeAndSignInArgs, verifyCodeAndSignInImpl } from "./verify";
-
-export const storeArgs = v.object({
-  args: v.union(
-    v.object({
-      type: v.literal("signIn"),
-      ...signInArgs.fields,
-    }),
-    v.object({
-      type: v.literal("signOut"),
-    }),
-    v.object({
-      type: v.literal("refreshSession"),
-      ...refreshSessionArgs.fields,
-    }),
-    v.object({
-      type: v.literal("verifyCodeAndSignIn"),
-      ...verifyCodeAndSignInArgs.fields,
-    }),
-    v.object({
-      type: v.literal("verifier"),
-    }),
-    v.object({
-      type: v.literal("verifierSignature"),
-      ...verifierSignatureArgs.fields,
-    }),
-    v.object({
-      type: v.literal("userOAuth"),
-      ...userOAuthArgs.fields,
-    }),
-    v.object({
-      type: v.literal("createVerificationCode"),
-      ...createVerificationCodeArgs.fields,
-    }),
-    v.object({
-      type: v.literal("createAccountFromCredentials"),
-      ...createAccountFromCredentialsArgs.fields,
-    }),
-    v.object({
-      type: v.literal("retrieveAccountWithCredentials"),
-      ...retrieveAccountWithCredentialsArgs.fields,
-    }),
-    v.object({
-      type: v.literal("modifyAccount"),
-      ...modifyAccountArgs.fields,
-    }),
-    v.object({
-      type: v.literal("invalidateSessions"),
-      ...invalidateSessionsArgs.fields,
-    }),
-  ),
-});
-
-export const storeImpl = async (
-  ctx: MutationCtx,
-  fnArgs: Infer<typeof storeArgs>,
-  getProviderOrThrow: Provider.GetProviderOrThrowFunc,
-  config: Provider.Config,
-) => {
-  const args = fnArgs.args;
-  logWithLevel(LOG_LEVELS.INFO, `\`auth:store\` type: ${args.type}`);
-  return Fx.run(
-    Fx.match(args, args.type, {
-      signIn: (a) => Fx.promise(() => signInImpl(ctx, a, config)),
-      signOut: () => signOutImpl(ctx, config),
-      refreshSession: (a) =>
-        Fx.promise(() =>
-          refreshSessionImpl(ctx, a, getProviderOrThrow, config),
-        ),
-      verifyCodeAndSignIn: (a) =>
-        Fx.promise(() =>
-          verifyCodeAndSignInImpl(ctx, a, getProviderOrThrow, config),
-        ),
-      verifier: () => verifierImpl(ctx, config),
-      verifierSignature: (a) =>
-        verifierSignatureImpl(ctx, a, config).pipe(
-          Fx.recover((e) => Fx.fatal(e)),
-        ),
-      userOAuth: (a) =>
-        userOAuthImpl(ctx, a, getProviderOrThrow, config).pipe(
-          Fx.recover((e) => Fx.fatal(e)),
-        ),
-      createVerificationCode: (a) =>
-        Fx.promise(() =>
-          createVerificationCodeImpl(ctx, a, getProviderOrThrow, config),
-        ),
-      createAccountFromCredentials: (a) =>
-        Fx.promise(() =>
-          createAccountFromCredentialsImpl(ctx, a, getProviderOrThrow, config),
-        ),
-      retrieveAccountWithCredentials: (a) =>
-        retrieveAccountWithCredentialsImpl(ctx, a, getProviderOrThrow, config),
-      modifyAccount: (a) =>
-        modifyAccountImpl(ctx, a, getProviderOrThrow, config).pipe(
-          Fx.recover((e) => Fx.fatal(e)),
-        ),
-      invalidateSessions: (a) => invalidateSessionsImpl(ctx, a, config),
-    }),
-  );
-};

package/src/server/mutations/verifier.ts

@@ -1,34 +0,0 @@
-import { Fx } from "@robelest/fx";
-import type { GenericActionCtx, GenericDataModel } from "convex/server";
-import { GenericId } from "convex/values";
-
-import * as Provider from "../crypto";
-import { authDb } from "../db";
-import { getAuthSessionId } from "../sessions";
-import { MutationCtx } from "../types";
-import { AUTH_STORE_REF } from "./store/refs";
-
-type ReturnType = GenericId<"AuthVerifier">;
-
-export function verifierImpl(
-  ctx: MutationCtx,
-  config: Provider.Config,
-): Fx<ReturnType, never> {
-  return Fx.gen(function* () {
-    return (yield* Fx.promise(async () =>
-      authDb(ctx, config).verifiers.create(
-        (await getAuthSessionId(ctx)) ?? undefined,
-      ),
-    )) as ReturnType;
-  });
-}
-
-export const callVerifier = async <DataModel extends GenericDataModel>(
-  ctx: GenericActionCtx<DataModel>,
-): Promise<ReturnType> => {
-  return ctx.runMutation(AUTH_STORE_REF, {
-    args: {
-      type: "verifier",
-    },
-  });
-};

package/src/server/mutations/verify.ts

@@ -1,200 +0,0 @@
-import { Fx } from "@robelest/fx";
-import type { GenericActionCtx, GenericDataModel } from "convex/server";
-import { Infer, v } from "convex/values";
-
-import * as Provider from "../crypto";
-import { authDb } from "../db";
-import { createSyntheticOAuthMaterializedConfig } from "../enterprise/oidc";
-import { isEnterpriseProviderId } from "../enterprise/shared";
-import {
-  isSignInRateLimited,
-  recordFailedSignIn,
-  resetSignInRateLimit,
-} from "../limits";
-import {
-  createNewAndDeleteExistingSession,
-  getAuthSessionId,
-  maybeGenerateTokensForSession,
-} from "../sessions";
-import { MutationCtx, SessionInfo } from "../types";
-import { upsertUserAndAccount } from "../users";
-import { LOG_LEVELS, logWithLevel, sha256 } from "../utils";
-import { requireEnv } from "../utils";
-import { AUTH_STORE_REF } from "./store/refs";
-
-export const verifyCodeAndSignInArgs = v.object({
-  params: v.any(),
-  provider: v.optional(v.string()),
-  verifier: v.optional(v.string()),
-  generateTokens: v.boolean(),
-  allowExtraProviders: v.boolean(),
-});
-
-type ReturnType = null | SessionInfo;
-
-// ============================================================================
-// Small validators for the verification pipeline
-// ============================================================================
-
-/** A soft verification failure — logged and collapsed to null at the boundary. */
-class VerifyFailure {
-  readonly _tag = "VerifyFailure" as const;
-  constructor(readonly reason: string) {}
-}
-
-// ============================================================================
-// Main exported function
-// ============================================================================
-
-export async function verifyCodeAndSignInImpl(
-  ctx: MutationCtx,
-  args: Infer<typeof verifyCodeAndSignInArgs>,
-  getProviderOrThrow: Provider.GetProviderOrThrowFunc,
-  config: Provider.Config,
-): Promise<ReturnType> {
-  logWithLevel(LOG_LEVELS.DEBUG, "verifyCodeAndSignInImpl args:", {
-    params: { email: args.params.email, phone: args.params.phone },
-    provider: args.provider,
-    verifier: args.verifier,
-    generateTokens: args.generateTokens,
-    allowExtraProviders: args.allowExtraProviders,
-  });
-
-  const { generateTokens, provider, allowExtraProviders } = args;
-  if (generateTokens) {
-    requireEnv("JWT_PRIVATE_KEY");
-    requireEnv("JWKS");
-    requireEnv("CONVEX_SITE_URL");
-  }
-  const identifier: string | undefined = args.params.email ?? args.params.phone;
-
-  try {
-    if (identifier !== undefined) {
-      const limited = await Fx.run(
-        isSignInRateLimited(ctx, identifier, config),
-      );
-      if (limited) {
-        throw new VerifyFailure(
-          "Too many failed attempts to verify code for this email",
-        );
-      }
-    }
-
-    const db = authDb(ctx, config);
-    const { params, verifier } = args;
-    const hash = await sha256(params.code);
-    const code = await db.verificationCodes.getByCode(hash);
-    if (code === null) {
-      throw new VerifyFailure("Invalid verification code");
-    }
-
-    await db.verificationCodes.delete(code._id);
-
-    if (code.verifier !== verifier) {
-      throw new VerifyFailure("Invalid verifier");
-    }
-    if (code.expirationTime < Date.now()) {
-      throw new VerifyFailure("Expired verification code");
-    }
-    if (provider !== undefined && code.provider !== provider) {
-      throw new VerifyFailure(
-        `Invalid provider "${provider}" for given \`code\``,
-      );
-    }
-
-    const account = await db.accounts.getById(code.accountId);
-    if (account === null) {
-      throw new VerifyFailure(
-        "Account associated with this email has been deleted",
-      );
-    }
-
-    const codeProvider = isEnterpriseProviderId(code.provider)
-      ? createSyntheticOAuthMaterializedConfig(code.provider)
-      : getProviderOrThrow(code.provider, allowExtraProviders);
-
-    if (
-      codeProvider !== null &&
-      (codeProvider.type === "email" || codeProvider.type === "phone") &&
-      codeProvider.authorize !== undefined
-    ) {
-      await codeProvider.authorize(args.params, account);
-    }
-
-    const methodProvider = isEnterpriseProviderId(account.provider)
-      ? createSyntheticOAuthMaterializedConfig(account.provider)
-      : getProviderOrThrow(account.provider);
-
-    const userId =
-      methodProvider.type === "oauth"
-        ? account.userId
-        : (
-            await upsertUserAndAccount(
-              ctx,
-              await getAuthSessionId(ctx),
-              { existingAccount: account },
-              {
-                type: "verification",
-                provider: methodProvider,
-                profile: {
-                  ...(code.emailVerified !== undefined
-                    ? { email: code.emailVerified, emailVerified: true }
-                    : {}),
-                  ...(code.phoneVerified !== undefined
-                    ? { phone: code.phoneVerified, phoneVerified: true }
-                    : {}),
-                },
-              },
-              config,
-            )
-          ).userId;
-
-    if (identifier !== undefined) {
-      await Fx.run(resetSignInRateLimit(ctx, identifier, config));
-    }
-
-    const sessionId = await createNewAndDeleteExistingSession(
-      ctx,
-      config,
-      userId,
-    );
-    return await maybeGenerateTokensForSession(
-      ctx,
-      config,
-      userId,
-      sessionId,
-      generateTokens,
-    );
-  } catch (error) {
-    if (error instanceof VerifyFailure) {
-      logWithLevel(LOG_LEVELS.ERROR, error.reason);
-      if (identifier !== undefined) {
-        await Fx.run(recordFailedSignIn(ctx, identifier, config));
-      }
-      return null;
-    }
-    logWithLevel(
-      LOG_LEVELS.ERROR,
-      `verifyCodeAndSignInImpl failed: ${String(error)}`,
-    );
-    return null;
-  }
-}
-
-// ============================================================================
-// Action-level caller (unchanged — just forwards to mutation)
-// ============================================================================
-
-export const callVerifyCodeAndSignIn = async <
-  DataModel extends GenericDataModel,
->(
-  ctx: GenericActionCtx<DataModel>,
-  args: Infer<typeof verifyCodeAndSignInArgs>,
-): Promise<ReturnType> => {
-  return ctx.runMutation(AUTH_STORE_REF, {
-    args: {
-      type: "verifyCodeAndSignIn",
-      ...args,
-    },
-  });
-};