@robelest/convex-auth 0.0.4-preview.25 → 0.0.4-preview.28

package/src/server/sessions.ts

@@ -1,132 +0,0 @@
-import { Auth } from "convex/server";
-import { GenericId } from "convex/values";
-
-import { authDb } from "./db";
-import { createRefreshToken } from "./refresh";
-import { generateToken } from "./tokens";
-import { Doc, MutationCtx, SessionInfo } from "./types";
-import { ConvexAuthConfig } from "./types";
-import {
-  LOG_LEVELS,
-  TOKEN_SUB_CLAIM_DIVIDER,
-  REFRESH_TOKEN_DIVIDER,
-  logWithLevel,
-  maybeRedact,
-} from "./utils";
-
-const DEFAULT_SESSION_TOTAL_DURATION_MS = 1000 * 60 * 60 * 24 * 30; // 30 days
-
-/** @internal */
-export async function maybeGenerateTokensForSession(
-  ctx: MutationCtx,
-  config: ConvexAuthConfig,
-  userId: GenericId<"User">,
-  sessionId: GenericId<"Session">,
-  generateTokens: boolean,
-): Promise<SessionInfo> {
-  return {
-    userId,
-    sessionId,
-    tokens: generateTokens
-      ? await generateTokensForSession(ctx, config, {
-          userId,
-          sessionId,
-          issuedRefreshTokenId: null,
-          parentRefreshTokenId: null,
-        })
-      : null,
-  };
-}
-
-/** @internal */
-export async function createNewAndDeleteExistingSession(
-  ctx: MutationCtx,
-  config: ConvexAuthConfig,
-  userId: GenericId<"User">,
-) {
-  const db = authDb(ctx, config);
-  const existingSessionId = await getAuthSessionId(ctx);
-  if (existingSessionId !== null) {
-    const existingSession = await db.sessions.getById(existingSessionId);
-    if (existingSession !== null) {
-      await deleteSession(ctx, existingSession, config);
-    }
-  }
-  return await createSession(ctx, userId, config);
-}
-
-/** @internal */
-export async function generateTokensForSession(
-  ctx: MutationCtx,
-  config: ConvexAuthConfig,
-  args: {
-    userId: GenericId<"User">;
-    sessionId: GenericId<"Session">;
-    issuedRefreshTokenId: GenericId<"RefreshToken"> | null;
-    parentRefreshTokenId: GenericId<"RefreshToken"> | null;
-  },
-) {
-  const ids = { userId: args.userId, sessionId: args.sessionId };
-  const refreshTokenId =
-    args.issuedRefreshTokenId ??
-    (await createRefreshToken(
-      ctx,
-      config,
-      args.sessionId,
-      args.parentRefreshTokenId,
-    ));
-  const result = {
-    token: await generateToken(ids, config),
-    refreshToken: `${refreshTokenId}${REFRESH_TOKEN_DIVIDER}${args.sessionId}`,
-  };
-  logWithLevel(
-    LOG_LEVELS.DEBUG,
-    `Generated token ${maybeRedact(result.token)} and refresh token ${maybeRedact(refreshTokenId)} for session ${maybeRedact(args.sessionId)}`,
-  );
-  return result;
-}
-
-async function createSession(
-  ctx: MutationCtx,
-  userId: GenericId<"User">,
-  config: ConvexAuthConfig,
-) {
-  const db = authDb(ctx, config);
-  const expirationTime =
-    Date.now() +
-    (config.session?.totalDurationMs ??
-      (process.env.AUTH_SESSION_TOTAL_DURATION_MS !== undefined
-        ? Number(process.env.AUTH_SESSION_TOTAL_DURATION_MS)
-        : undefined) ??
-      DEFAULT_SESSION_TOTAL_DURATION_MS);
-  return (await db.sessions.create(
-    userId,
-    expirationTime,
-  )) as GenericId<"Session">;
-}
-
-/** @internal */
-export async function deleteSession(
-  ctx: MutationCtx,
-  session: Doc<"Session">,
-  config: ConvexAuthConfig,
-) {
-  const db = authDb(ctx, config);
-  await db.sessions.delete(session._id);
-  await db.refreshTokens.deleteAll(session._id);
-}
-
-/**
- * Return the current session ID from the auth identity subject.
- *
- * Internal helper used by auth runtime internals and `auth.session.current`.
- */
-/** @internal */
-export async function getAuthSessionId(ctx: { auth: Auth }) {
-  const identity = await ctx.auth.getUserIdentity();
-  if (identity === null) {
-    return null;
-  }
-  const [, sessionId] = identity.subject.split(TOKEN_SUB_CLAIM_DIVIDER);
-  return sessionId as GenericId<"Session">;
-}

package/src/server/signin.ts

@@ -1,445 +0,0 @@
-import type { Fx as FxType } from "@robelest/fx";
-import { Fx } from "@robelest/fx";
-import { Cv } from "@robelest/fx/convex";
-import { GenericId } from "convex/values";
-import { ConvexError } from "convex/values";
-
-import { handleDevice } from "./device";
-import {
-  callCreateVerificationCode,
-  callRefreshSession,
-  callSignIn,
-  callVerifier,
-  callVerifierSignature,
-  callVerifyCodeAndSignIn,
-} from "./mutations/index";
-import { handlePasskeyFx } from "./passkey";
-import { redirectAbsoluteUrl, setURLSearchParam } from "./redirects";
-import { handleTotp } from "./totp";
-import {
-  AuthProviderMaterializedConfig,
-  ConvexCredentialsConfig,
-  EmailConfig,
-  GenericActionCtxWithAuthConfig,
-  PhoneConfig,
-} from "./types";
-import {
-  AuthDataModel,
-  SessionInfo,
-  SessionInfoWithTokens,
-  Tokens,
-  queryTotpVerifiedByUserId,
-} from "./types";
-import type { OAuthMaterializedConfig } from "./types";
-import { generateRandomString } from "./utils";
-import { requireEnv } from "./utils";
-
-const DEFAULT_EMAIL_VERIFICATION_CODE_DURATION_S = 60 * 60 * 24; // 24 hours
-
-type EnrichedActionCtx = GenericActionCtxWithAuthConfig<AuthDataModel>;
-
-type SignInResult =
-  | { kind: "signedIn"; signedIn: SessionInfo | null }
-  | { kind: "refreshTokens"; signedIn: { tokens: Tokens } }
-  | { kind: "started"; started: true }
-  | { kind: "redirect"; redirect: string; verifier: string }
-  | { kind: "passkeyOptions"; options: Record<string, any>; verifier: string }
-  | { kind: "totpRequired"; verifier: string }
-  | {
-      kind: "totpSetup";
-      uri: string;
-      secret: string;
-      verifier: string;
-      totpId: string;
-    }
-  | {
-      kind: "deviceCode";
-      deviceCode: string;
-      userCode: string;
-      verificationUri: string;
-      verificationUriComplete: string;
-      expiresIn: number;
-      interval: number;
-    };
-
-/** @internal */
-export async function signInImpl(
-  ctx: EnrichedActionCtx,
-  provider: AuthProviderMaterializedConfig | null,
-  args: {
-    accountId?: GenericId<"Account">;
-    params?: Record<string, any>;
-    verifier?: string;
-    refreshToken?: string;
-    calledBy?: string;
-  },
-  options: {
-    generateTokens: boolean;
-    allowExtraProviders: boolean;
-  },
-): Promise<SignInResult> {
-  const fx = signInFx(ctx, provider, args, options);
-  return Fx.run(fx.pipe(Fx.recover((e) => Fx.fatal(e))));
-}
-
-/**
- * Core sign-in pipeline as an Fx generator.
- *
- * Handles: refresh tokens, verification codes, then dispatches by
- * provider type using a dispatch map (no if-chain).
- */
-function signInFx(
-  ctx: EnrichedActionCtx,
-  provider: AuthProviderMaterializedConfig | null,
-  args: {
-    accountId?: GenericId<"Account">;
-    params?: Record<string, any>;
-    verifier?: string;
-    refreshToken?: string;
-    calledBy?: string;
-  },
-  options: {
-    generateTokens: boolean;
-    allowExtraProviders: boolean;
-  },
-): FxType<SignInResult, ConvexError<any>> {
-  return Fx.gen(function* () {
-    // --- Refresh token (no provider) ---
-    if (provider === null && args.refreshToken) {
-      const tokens = yield* Fx.promise(() =>
-        callRefreshSession(ctx, { refreshToken: args.refreshToken! }),
-      );
-      if (tokens === null) {
-        return { kind: "signedIn" as const, signedIn: null };
-      }
-      return { kind: "refreshTokens" as const, signedIn: { tokens } };
-    }
-
-    // --- Verify code (no provider, code present) ---
-    if (provider === null && args.params?.code !== undefined) {
-      const result = yield* Fx.promise(() =>
-        callVerifyCodeAndSignIn(ctx, {
-          params: args.params,
-          verifier: args.verifier,
-          generateTokens: true,
-          allowExtraProviders: options.allowExtraProviders,
-        }),
-      );
-      return { kind: "signedIn" as const, signedIn: result };
-    }
-
-    // --- Provider is required past this point ---
-    const resolvedProvider = yield* provider != null
-      ? Fx.succeed(provider)
-      : Cv.fail({
-          code: "SIGN_IN_MISSING_PARAMS",
-          message: "Cannot sign in: missing provider, code, or refresh token.",
-        });
-
-    // --- Dispatch by provider type ---
-    return yield* Fx.match(resolvedProvider).on("type", {
-      email: (p) => handleEmailAndPhoneProviderFx(ctx, p, args, options),
-      phone: (p) => handleEmailAndPhoneProviderFx(ctx, p, args, options),
-      credentials: (p) => handleCredentialsFx(ctx, p, args, options),
-      oauth: (p) => handleOAuthProviderFx(ctx, p, args, options),
-      passkey: (p) => handlePasskeyFx(ctx, p, args),
-      totp: (p) => handleTotp(ctx, p, args),
-      device: (p) => handleDevice(ctx, p, args),
-      sso: (_p) => handleSsoProviderFx(ctx, args),
-    });
-  });
-}
-
-// ============================================================================
-// Email / Phone
-// ============================================================================
-
-function handleEmailAndPhoneProviderFx(
-  ctx: EnrichedActionCtx,
-  provider: EmailConfig | PhoneConfig,
-  args: {
-    params?: Record<string, any>;
-    accountId?: GenericId<"Account">;
-  },
-  options: {
-    generateTokens: boolean;
-    allowExtraProviders: boolean;
-  },
-): FxType<
-  | { kind: "started"; started: true }
-  | { kind: "signedIn"; signedIn: SessionInfoWithTokens },
-  ConvexError<any>
-> {
-  return Fx.gen(function* () {
-    // --- Code verification path ---
-    if (args.params?.code !== undefined) {
-      const result = yield* Fx.promise(() =>
-        callVerifyCodeAndSignIn(ctx, {
-          params: args.params,
-          provider: provider.id,
-          generateTokens: options.generateTokens,
-          allowExtraProviders: options.allowExtraProviders,
-        }),
-      );
-      const verified = yield* result != null
-        ? Fx.succeed(result)
-        : Cv.fail({
-            code: "INVALID_VERIFICATION_CODE",
-            message: "Invalid or expired verification code.",
-          });
-      return {
-        kind: "signedIn" as const,
-        signedIn: verified as SessionInfoWithTokens,
-      };
-    }
-
-    // --- Send verification code path ---
-    const alphabet =
-      "0123456789ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz";
-    const code = provider.generateVerificationToken
-      ? yield* Fx.from({
-          ok: async () => provider.generateVerificationToken!(),
-          err: () =>
-            Cv.error({
-              code: "INTERNAL_ERROR",
-              message: "Failed to generate verification token",
-            }),
-        })
-      : generateRandomString(32, alphabet);
-    const expirationTime =
-      Date.now() +
-      (provider.maxAge ?? DEFAULT_EMAIL_VERIFICATION_CODE_DURATION_S) * 1000;
-
-    const identifier = yield* Fx.promise(() =>
-      callCreateVerificationCode(ctx, {
-        provider: provider.id,
-        accountId: args.accountId,
-        email: args.params?.email,
-        phone: args.params?.phone,
-        code,
-        expirationTime,
-        allowExtraProviders: options.allowExtraProviders,
-      }),
-    );
-    const destination = yield* Fx.promise(() =>
-      redirectAbsoluteUrl(
-        ctx.auth.config,
-        (args.params ?? {}) as { redirectTo: unknown },
-      ),
-    );
-    const verificationArgs = {
-      identifier,
-      url: setURLSearchParam(destination, "code", code),
-      token: code,
-      expires: new Date(expirationTime),
-    };
-    yield* Fx.match(provider).on("type", {
-      email: (p) =>
-        Fx.from({
-          ok: async () =>
-            p.sendVerificationRequest(
-              {
-                ...verificationArgs,
-                provider: p,
-                request: new Request("http://localhost"),
-              },
-              ctx,
-            ),
-          err: () =>
-            Cv.error({
-              code: "INTERNAL_ERROR",
-              message: "Failed to send email code",
-            }),
-        }),
-      phone: (p) =>
-        Fx.from({
-          ok: async () =>
-            p.sendVerificationRequest(
-              { ...verificationArgs, provider: p },
-              ctx,
-            ),
-          err: () =>
-            Cv.error({
-              code: "INTERNAL_ERROR",
-              message: "Failed to send phone code",
-            }),
-        }),
-    });
-    return { kind: "started" as const, started: true as const };
-  });
-}
-
-// ============================================================================
-// Credentials
-// ============================================================================
-
-function handleCredentialsFx(
-  ctx: EnrichedActionCtx,
-  provider: ConvexCredentialsConfig,
-  args: {
-    params?: Record<string, any>;
-  },
-  options: {
-    generateTokens: boolean;
-  },
-): FxType<
-  | { kind: "signedIn"; signedIn: SessionInfo | null }
-  | { kind: "totpRequired"; verifier: string },
-  ConvexError<any>
-> {
-  return Fx.gen(function* () {
-    const result = yield* Fx.promise(() =>
-      provider.authorize(args.params ?? {}, ctx),
-    );
-    if (result === null) {
-      return { kind: "signedIn" as const, signedIn: null };
-    }
-
-    // Check if user has TOTP 2FA enrolled before issuing tokens
-    const hasTotpEnrolled = yield* Fx.promise(async () => {
-      const totpDoc = await queryTotpVerifiedByUserId(ctx, result.userId);
-      return totpDoc !== null;
-    });
-    if (hasTotpEnrolled) {
-      // Create session but withhold tokens — TOTP verification needed
-      yield* Fx.promise(() =>
-        callSignIn(ctx, {
-          userId: result.userId,
-          sessionId: result.sessionId,
-          generateTokens: false,
-        }),
-      );
-      // Store userId in verifier so the TOTP verify flow can complete sign-in
-      const verifier = yield* Fx.promise(() => callVerifier(ctx));
-      yield* Fx.promise(() =>
-        callVerifierSignature(ctx, {
-          verifier,
-          signature: JSON.stringify({ userId: result.userId }),
-        }),
-      );
-      return { kind: "totpRequired" as const, verifier };
-    }
-
-    const idsAndTokens = yield* Fx.promise(() =>
-      callSignIn(ctx, {
-        userId: result.userId,
-        sessionId: result.sessionId,
-        generateTokens: options.generateTokens,
-      }),
-    );
-    return { kind: "signedIn" as const, signedIn: idsAndTokens };
-  });
-}
-
-// ============================================================================
-// OAuth
-// ============================================================================
-
-function handleOAuthProviderFx(
-  ctx: EnrichedActionCtx,
-  provider: OAuthMaterializedConfig,
-  args: {
-    params?: Record<string, any>;
-    verifier?: string;
-  },
-  options: {
-    allowExtraProviders: boolean;
-  },
-): FxType<
-  | { kind: "signedIn"; signedIn: SessionInfoWithTokens | null }
-  | { kind: "redirect"; redirect: string; verifier: string },
-  ConvexError<any>
-> {
-  return Fx.gen(function* () {
-    // --- Code verification path ---
-    if (args.params?.code !== undefined) {
-      const result = yield* Fx.promise(() =>
-        callVerifyCodeAndSignIn(ctx, {
-          params: args.params,
-          verifier: args.verifier,
-          generateTokens: true,
-          allowExtraProviders: options.allowExtraProviders,
-        }),
-      );
-      return {
-        kind: "signedIn" as const,
-        signedIn: result as SessionInfoWithTokens | null,
-      };
-    }
-
-    // --- Build redirect URL ---
-    const redirect = new URL(
-      (process.env.CUSTOM_AUTH_SITE_URL ?? requireEnv("CONVEX_SITE_URL")) +
-        `/api/auth/signin/${provider.id}`,
-    );
-    const verifier = yield* Fx.promise(() => callVerifier(ctx));
-    redirect.searchParams.set("code", verifier);
-
-    if (args.params?.redirectTo !== undefined) {
-      yield* Fx.guard(
-        typeof args.params.redirectTo !== "string",
-        Cv.fail({
-          code: "INVALID_REDIRECT",
-          message: `Expected \`redirectTo\` to be a string, got ${args.params.redirectTo}`,
-        }),
-      );
-      redirect.searchParams.set("redirectTo", args.params.redirectTo);
-    }
-
-    return {
-      kind: "redirect" as const,
-      redirect: redirect.toString(),
-      verifier,
-    };
-  });
-}
-
-// ============================================================================
-// SSO (Enterprise OIDC / SAML)
-// ============================================================================
-
-function handleSsoProviderFx(
-  ctx: EnrichedActionCtx,
-  args: {
-    params?: Record<string, any>;
-  },
-): FxType<
-  { kind: "redirect"; redirect: string; verifier: string },
-  ConvexError<any>
-> {
-  return Fx.gen(function* () {
-    const enterpriseId = args.params?.enterpriseId;
-    if (!enterpriseId || typeof enterpriseId !== "string") {
-      return yield* Cv.fail({
-        code: "SIGN_IN_MISSING_PARAMS",
-        message: "enterpriseId is required for SSO sign-in.",
-      });
-    }
-
-    const protocol: "oidc" | "saml" = args.params?.protocol ?? "oidc";
-    if (protocol !== "oidc" && protocol !== "saml") {
-      return yield* Cv.fail({
-        code: "SIGN_IN_MISSING_PARAMS",
-        message: `Invalid SSO protocol: ${protocol as string}. Expected "oidc" or "saml".`,
-      });
-    }
-
-    const verifier = yield* Fx.promise(() => callVerifier(ctx));
-    const siteUrl =
-      process.env.CUSTOM_AUTH_SITE_URL ?? requireEnv("CONVEX_SITE_URL");
-    const redirect = new URL(
-      `${siteUrl}/api/auth/sso/${enterpriseId}/${protocol}/signin`,
-    );
-    redirect.searchParams.set("code", verifier);
-
-    if (typeof args.params?.redirectTo === "string") {
-      redirect.searchParams.set("redirectTo", args.params.redirectTo);
-    }
-
-    return {
-      kind: "redirect" as const,
-      redirect: redirect.toString(),
-      verifier,
-    };
-  });
-}