@robelest/convex-auth 0.0.4-preview.25 → 0.0.4-preview.28

package/src/server/users.ts

@@ -1,291 +0,0 @@
-import { Fx } from "@robelest/fx";
-import { Cv } from "@robelest/fx/convex";
-import { GenericId } from "convex/values";
-
-import { authDb } from "./db";
-import { Doc, MutationCtx } from "./types";
-import { AuthProviderMaterializedConfig, ConvexAuthConfig } from "./types";
-import { LOG_LEVELS, logWithLevel } from "./utils";
-
-type CreateOrUpdateUserArgs = {
-  type: "oauth" | "credentials" | "email" | "phone" | "verification";
-  provider: AuthProviderMaterializedConfig;
-  profile: Record<string, unknown> & {
-    email?: string;
-    phone?: string;
-    emailVerified?: boolean;
-    phoneVerified?: boolean;
-  };
-  accountExtend?: Record<string, unknown>;
-  shouldLinkViaEmail?: boolean;
-  shouldLinkViaPhone?: boolean;
-};
-
-function mergeExtend(
-  existing: unknown,
-  incoming: Record<string, unknown> | undefined,
-) {
-  if (!incoming) {
-    return undefined;
-  }
-  const existingRecord =
-    typeof existing === "object" &&
-    existing !== null &&
-    !Array.isArray(existing)
-      ? (existing as Record<string, unknown>)
-      : undefined;
-  return existingRecord ? { ...existingRecord, ...incoming } : incoming;
-}
-
-/** @internal */
-export async function upsertUserAndAccount(
-  ctx: MutationCtx,
-  sessionId: GenericId<"Session"> | null,
-  account:
-    | { existingAccount: Doc<"Account"> }
-    | {
-        providerAccountId: string;
-        secret?: string;
-      },
-  args: CreateOrUpdateUserArgs,
-  config: ConvexAuthConfig,
-  opts?: { existingUserId?: GenericId<"User"> },
-): Promise<{
-  userId: GenericId<"User">;
-  accountId: GenericId<"Account">;
-}> {
-  const userId = await defaultCreateOrUpdateUser(
-    ctx,
-    sessionId,
-    "existingAccount" in account ? account.existingAccount : null,
-    args,
-    config,
-    opts?.existingUserId ?? null,
-  );
-  const accountId = await createOrUpdateAccount(
-    ctx,
-    userId,
-    account,
-    args,
-    config,
-  );
-  return { userId, accountId };
-}
-
-async function defaultCreateOrUpdateUser(
-  ctx: MutationCtx,
-  existingSessionId: GenericId<"Session"> | null,
-  existingAccount: Doc<"Account"> | null,
-  args: CreateOrUpdateUserArgs,
-  config: ConvexAuthConfig,
-  existingUserIdOverride: GenericId<"User"> | null,
-) {
-  logWithLevel(LOG_LEVELS.DEBUG, "defaultCreateOrUpdateUser args:", {
-    existingAccountId: existingAccount?._id,
-    existingSessionId,
-    args,
-  });
-  const existingUserId = existingAccount?.userId ?? null;
-  const db = authDb(ctx, config);
-  if (config.callbacks?.createOrUpdateUser !== undefined) {
-    logWithLevel(LOG_LEVELS.DEBUG, "Using custom createOrUpdateUser callback");
-    return await config.callbacks.createOrUpdateUser(ctx, {
-      existingUserId,
-      ...args,
-    });
-  }
-
-  const {
-    provider,
-    profile: {
-      id: _profileId,
-      emailVerified: profileEmailVerified,
-      phoneVerified: profilePhoneVerified,
-      ...profile
-    },
-  } = args;
-  const emailVerified =
-    profileEmailVerified ??
-    (provider.type === "oauth" && provider.accountLinking !== "none");
-  const phoneVerified = profilePhoneVerified ?? false;
-  const shouldLinkViaEmail =
-    args.shouldLinkViaEmail || emailVerified || provider.type === "email";
-  const shouldLinkViaPhone =
-    args.shouldLinkViaPhone || phoneVerified || provider.type === "phone";
-
-  let userId = existingUserId ?? existingUserIdOverride;
-  if (existingUserId === null) {
-    const existingUserWithVerifiedEmailId =
-      typeof profile.email === "string" && shouldLinkViaEmail
-        ? ((await uniqueUserWithVerifiedEmail(ctx, profile.email, config))
-            ?._id ?? null)
-        : null;
-
-    const existingUserWithVerifiedPhoneId =
-      typeof profile.phone === "string" && shouldLinkViaPhone
-        ? ((await uniqueUserWithVerifiedPhone(ctx, profile.phone, config))
-            ?._id ?? null)
-        : null;
-    const linkDispatch = {
-      tag:
-        existingUserWithVerifiedEmailId !== null &&
-        existingUserWithVerifiedPhoneId !== null
-          ? "both"
-          : existingUserWithVerifiedEmailId !== null
-            ? "email"
-            : existingUserWithVerifiedPhoneId !== null
-              ? "phone"
-              : "none",
-      existingUserWithVerifiedEmailId,
-      existingUserWithVerifiedPhoneId,
-    } as const;
-
-    const linkHandlers = {
-      both: () =>
-        Fx.sync(() => {
-          logWithLevel(
-            LOG_LEVELS.DEBUG,
-            `Found existing email and phone verified users, so not linking: email: ${linkDispatch.existingUserWithVerifiedEmailId}, phone: ${linkDispatch.existingUserWithVerifiedPhoneId}`,
-          );
-          return null;
-        }),
-      email: () =>
-        Fx.sync(() => {
-          logWithLevel(
-            LOG_LEVELS.DEBUG,
-            `Found existing email verified user, linking: ${linkDispatch.existingUserWithVerifiedEmailId}`,
-          );
-          return linkDispatch.existingUserWithVerifiedEmailId;
-        }),
-      phone: () =>
-        Fx.sync(() => {
-          logWithLevel(
-            LOG_LEVELS.DEBUG,
-            `Found existing phone verified user, linking: ${linkDispatch.existingUserWithVerifiedPhoneId}`,
-          );
-          return linkDispatch.existingUserWithVerifiedPhoneId;
-        }),
-      none: () =>
-        Fx.sync(() => {
-          logWithLevel(
-            LOG_LEVELS.DEBUG,
-            "No existing verified users found, creating new user",
-          );
-          return null;
-        }),
-    } as const;
-
-    userId = await Fx.run(linkHandlers[linkDispatch.tag]());
-  }
-  const userData = {
-    ...(emailVerified ? { emailVerificationTime: Date.now() } : null),
-    ...(phoneVerified ? { phoneVerificationTime: Date.now() } : null),
-    ...profile,
-  };
-  const existingOrLinkedUserId = userId;
-  if (userId !== null) {
-    await Fx.run(
-      Fx.from({
-        ok: () => db.users.patch(userId!, userData),
-        err: (error) =>
-          Cv.error({
-            code: "USER_UPDATE_FAILED",
-            message:
-              `Could not update user document with ID \`${userId}\`, ` +
-              `either the user has been deleted but their account has not, ` +
-              `or the profile data doesn't match the \`users\` table schema: ` +
-              `${(error as Error).message}`,
-          }),
-      }).pipe(Fx.recover((e) => Fx.fatal(e))),
-    );
-  } else {
-    userId = (await db.users.insert(userData)) as GenericId<"User">;
-  }
-  const afterUserCreatedOrUpdated = config.callbacks?.afterUserCreatedOrUpdated;
-  if (afterUserCreatedOrUpdated !== undefined) {
-    logWithLevel(
-      LOG_LEVELS.DEBUG,
-      "Calling custom afterUserCreatedOrUpdated callback",
-    );
-    await afterUserCreatedOrUpdated(ctx, {
-      userId,
-      existingUserId: existingOrLinkedUserId,
-      ...args,
-    });
-  } else {
-    logWithLevel(
-      LOG_LEVELS.DEBUG,
-      "No custom afterUserCreatedOrUpdated callback, skipping",
-    );
-  }
-  return userId;
-}
-
-async function uniqueUserWithVerifiedEmail(
-  ctx: MutationCtx,
-  email: string,
-  config: ConvexAuthConfig,
-) {
-  const db = authDb(ctx, config);
-  return (await db.users.findByVerifiedEmail(email)) as Doc<"User"> | null;
-}
-
-async function uniqueUserWithVerifiedPhone(
-  ctx: MutationCtx,
-  phone: string,
-  config: ConvexAuthConfig,
-) {
-  const db = authDb(ctx, config);
-  return (await db.users.findByVerifiedPhone(phone)) as Doc<"User"> | null;
-}
-
-async function createOrUpdateAccount(
-  ctx: MutationCtx,
-  userId: GenericId<"User">,
-  account:
-    | { existingAccount: Doc<"Account"> }
-    | {
-        providerAccountId: string;
-        secret?: string;
-      },
-  args: CreateOrUpdateUserArgs,
-  config: ConvexAuthConfig,
-) {
-  const db = authDb(ctx, config);
-  const mergedExtend =
-    "existingAccount" in account
-      ? mergeExtend(account.existingAccount.extend, args.accountExtend)
-      : args.accountExtend;
-  const accountId =
-    "existingAccount" in account
-      ? account.existingAccount._id
-      : ((await db.accounts.create({
-          userId,
-          provider: args.provider.id,
-          providerAccountId: account.providerAccountId,
-          secret: account.secret,
-          extend: mergedExtend,
-        })) as GenericId<"Account">);
-  // This is never used with the default `createOrUpdateUser` implementation,
-  // but it is used for manual linking via custom `createOrUpdateUser`:
-  if (
-    "existingAccount" in account &&
-    account.existingAccount.userId !== userId
-  ) {
-    await db.accounts.patch(accountId, { userId });
-  }
-  const accountPatchData: Record<string, unknown> = {};
-  if (mergedExtend) {
-    accountPatchData.extend = mergedExtend;
-  }
-  if (args.profile.emailVerified) {
-    accountPatchData.emailVerified = args.profile.email;
-  }
-  if (args.profile.phoneVerified) {
-    accountPatchData.phoneVerified = args.profile.phone;
-  }
-  if (Object.keys(accountPatchData).length > 0) {
-    await db.accounts.patch(accountId, accountPatchData);
-  }
-  return accountId;
-}

package/src/server/utils.ts

@@ -1,220 +0,0 @@
-import {
-  RandomReader,
-  generateRandomString as osloGenerateRandomString,
-} from "@oslojs/crypto/random";
-import { sha256 as rawSha256 } from "@oslojs/crypto/sha2";
-import {
-  decodeBase64urlIgnorePadding,
-  encodeBase64urlNoPadding,
-  encodeHexLowerCase,
-} from "@oslojs/encoding";
-import { Cv } from "@robelest/fx/convex";
-
-/**
- * Require an environment variable to be set, throwing at config time if missing.
- *
- * Uses `Cv.error()` directly since this is a synchronous guard
- * called inline in many expressions — not suitable for Fx pipeline wrapping.
- */
-/** @internal */
-export function requireEnv(name: string) {
-  const value = process.env[name];
-  if (value === undefined) {
-    throw Cv.error({
-      code: "MISSING_ENV_VAR",
-      message: `Missing environment variable \`${name}\``,
-    });
-  }
-  return value;
-}
-
-/** @internal */
-export function normalizeUrl(url: string) {
-  return url.replace(/\/$/, "");
-}
-
-/** @internal */
-export function siteUrlsFromEnv() {
-  const primaryUrl = normalizeUrl(requireEnv("SITE_URL"));
-  const secondary = process.env.SECONDARY_URL;
-  const secondaryUrls =
-    secondary
-      ?.split(",")
-      .map((url) => url.trim())
-      .filter((url) => url.length > 0)
-      .map(normalizeUrl) ?? [];
-  return {
-    primaryUrl,
-    allowedUrls: [...new Set([primaryUrl, ...secondaryUrls])],
-  };
-}
-
-/** @internal */
-export function isLocalHost(host?: string) {
-  if (host === undefined) {
-    return false;
-  }
-  const raw = host.includes("://") ? host : `http://${host}`;
-  let url: URL;
-  try {
-    url = new URL(raw);
-  } catch {
-    return false;
-  }
-  return (
-    url.hostname === "localhost" ||
-    url.hostname === "127.0.0.1" ||
-    url.hostname === "::1"
-  );
-}
-
-// Internal server utilities (merged from former internalUtils.ts)
-
-/** @internal */
-export const TOKEN_SUB_CLAIM_DIVIDER = "|";
-/** @internal */
-export const REFRESH_TOKEN_DIVIDER = "|";
-
-/** @internal */
-export async function sha256(input: string) {
-  return encodeHexLowerCase(rawSha256(new TextEncoder().encode(input)));
-}
-
-/** @internal */
-export function generateRandomString(length: number, alphabet: string) {
-  const random: RandomReader = {
-    read(bytes) {
-      crypto.getRandomValues(bytes as Uint8Array<ArrayBuffer>);
-    },
-  };
-
-  return osloGenerateRandomString(random, alphabet, length);
-}
-
-/** @internal */
-export function errorMessage(error: unknown) {
-  return error instanceof Error ? error.message : String(error);
-}
-
-/** @internal */
-export function logError(error: unknown) {
-  logWithLevel(
-    LOG_LEVELS.ERROR,
-    error instanceof Error
-      ? error.message + "\n" + error.stack?.replace("\\n", "\n")
-      : error,
-  );
-}
-
-/** @internal */
-export const LOG_LEVELS = {
-  ERROR: "ERROR",
-  WARN: "WARN",
-  INFO: "INFO",
-  DEBUG: "DEBUG",
-} as const;
-type LogLevel = keyof typeof LOG_LEVELS;
-
-/** @internal */
-export function logWithLevel(level: LogLevel, ...args: unknown[]) {
-  const configuredLogLevel =
-    LOG_LEVELS[
-      (process.env.AUTH_LOG_LEVEL as LogLevel | undefined) ?? "INFO"
-    ] ?? "INFO";
-  switch (level) {
-    case "ERROR":
-      console.error(...args);
-      break;
-    case "WARN":
-      if (configuredLogLevel !== "ERROR") {
-        console.warn(...args);
-      }
-      break;
-    case "INFO":
-      if (configuredLogLevel === "INFO" || configuredLogLevel === "DEBUG") {
-        console.info(...args);
-      }
-      break;
-    case "DEBUG":
-      if (configuredLogLevel === "DEBUG") {
-        console.debug(...args);
-      }
-      break;
-  }
-}
-
-const UNREDACTED_LENGTH = 5;
-/** @internal */
-export function maybeRedact(value: string) {
-  if (value === "") {
-    return "";
-  }
-  const shouldRedact = process.env.AUTH_LOG_SECRETS !== "true";
-  if (shouldRedact) {
-    if (value.length < UNREDACTED_LENGTH * 2) {
-      return "<redacted>";
-    }
-    return (
-      value.substring(0, UNREDACTED_LENGTH) +
-      "<redacted>" +
-      value.substring(value.length - UNREDACTED_LENGTH)
-    );
-  } else {
-    return value;
-  }
-}
-
-const SECRET_KEY_ENV = "AUTH_SECRET_ENCRYPTION_KEY";
-const SECRET_IV_LENGTH = 12;
-
-function toArrayBuffer(bytes: Uint8Array) {
-  return bytes.buffer.slice(
-    bytes.byteOffset,
-    bytes.byteOffset + bytes.byteLength,
-  ) as ArrayBuffer;
-}
-
-async function getSecretCryptoKey() {
-  const material = requireEnv(SECRET_KEY_ENV);
-  const rawKey = rawSha256(new TextEncoder().encode(material));
-  return await crypto.subtle.importKey(
-    "raw",
-    toArrayBuffer(rawKey),
-    { name: "AES-GCM" },
-    false,
-    ["encrypt", "decrypt"],
-  );
-}
-
-/** @internal */
-export async function encryptSecret(value: string) {
-  const key = await getSecretCryptoKey();
-  const iv = crypto.getRandomValues(new Uint8Array(SECRET_IV_LENGTH));
-  const encrypted = await crypto.subtle.encrypt(
-    { name: "AES-GCM", iv: toArrayBuffer(iv) },
-    key,
-    toArrayBuffer(new TextEncoder().encode(value)),
-  );
-  return `${encodeBase64urlNoPadding(iv)}.${encodeBase64urlNoPadding(new Uint8Array(encrypted))}`;
-}
-
-/** @internal */
-export async function decryptSecret(ciphertext: string) {
-  const [ivEncoded, payloadEncoded] = ciphertext.split(".");
-  if (!ivEncoded || !payloadEncoded) {
-    throw Cv.error({
-      code: "INVALID_PARAMETERS",
-      message: "Stored enterprise secret is malformed.",
-    });
-  }
-  const key = await getSecretCryptoKey();
-  const decrypted = await crypto.subtle.decrypt(
-    {
-      name: "AES-GCM",
-      iv: toArrayBuffer(decodeBase64urlIgnorePadding(ivEncoded)),
-    },
-    key,
-    toArrayBuffer(decodeBase64urlIgnorePadding(payloadEncoded)),
-  );
-  return new TextDecoder().decode(decrypted);
-}