@robelest/convex-auth 0.0.4-preview.25 → 0.0.4-preview.28

package/dist/providers/google.js

@@ -0,0 +1,61 @@
+import { envOptionalString, readConfigSync } from "../server/env.js";
+import { createArcticOAuthClient, createOAuthProvider } from "../server/oauth/factory.js";
+import { Google } from "arctic";
+
+//#region src/providers/google.ts
+/**
+* Google OAuth provider.
+*
+* ```ts
+* import { google } from "@robelest/convex-auth/providers/google";
+*
+* google({
+*   clientId: process.env.AUTH_GOOGLE_ID!,
+*   clientSecret: process.env.AUTH_GOOGLE_SECRET!,
+* })
+* ```
+*
+* @module
+*/
+const DEFAULT_SCOPES = [
+	"openid",
+	"profile",
+	"email"
+];
+/**
+* Create a Google OAuth provider.
+*
+* Uses the Google OpenID Connect flow and requests `openid profile email` by
+* default.
+*
+* @param config - Google OAuth client settings.
+* @returns A configured Google OAuth provider for `createAuth`.
+* @throws {Error} When no callback URL can be derived and `redirectUri` is omitted.
+*
+* @example
+* ```ts
+* import { google } from "@robelest/convex-auth/providers/google";
+*
+* google({
+*   clientId: process.env.AUTH_GOOGLE_ID!,
+*   clientSecret: process.env.AUTH_GOOGLE_SECRET!,
+* })
+* ```
+*/
+function google(config) {
+	return createOAuthProvider({
+		id: "google",
+		provider: createArcticOAuthClient(new Google(config.clientId, config.clientSecret, config.redirectUri ?? defaultRedirectUri("google")), { pkce: "required" }),
+		scopes: config.scopes ?? DEFAULT_SCOPES,
+		accountLinking: config.accountLinking
+	});
+}
+function defaultRedirectUri(providerId) {
+	const rootUrl = readConfigSync(envOptionalString("CUSTOM_AUTH_SITE_URL")) ?? readConfigSync(envOptionalString("CONVEX_SITE_URL"));
+	if (!rootUrl) throw new Error(`Missing CONVEX_SITE_URL while configuring ${providerId} OAuth provider. Set CONVEX_SITE_URL or pass redirectUri explicitly.`);
+	return `${rootUrl}/api/auth/callback/${providerId}`;
+}
+
+//#endregion
+export { google };
+//# sourceMappingURL=google.js.map

package/dist/providers/index.d.ts

@@ -1,12 +1,16 @@
-import { OAuth, OAuthConfig } from "./oauth.js";
-import { Credentials, CredentialsConfig } from "./credentials.js";
-import { Password, PasswordConfig } from "./password.js";
-import { Passkey, PasskeyConfig } from "./passkey.js";
-import { Totp, TotpConfig } from "./totp.js";
-import { Device, DeviceConfig } from "./device.js";
-import { SSO } from "./sso.js";
-import { Email, EmailProviderConfig } from "./email.js";
-import { Phone, PhoneProviderConfig } from "./phone.js";
-import { EmailConfig, PhoneConfig } from "../server/types.js";
-import { Anonymous, AnonymousConfig } from "./anonymous.js";
-export { Anonymous, type AnonymousConfig, Credentials, type CredentialsConfig, Device, type DeviceConfig, Email, type EmailConfig, type EmailProviderConfig, OAuth, type OAuthConfig, Passkey, type PasskeyConfig, Password, type PasswordConfig, Phone, type PhoneConfig, type PhoneProviderConfig, SSO, Totp, type TotpConfig };
+import { CredentialsConfig, credentials } from "./credentials.js";
+import { EmailConfig, OAuthProfile, OAuthTokens, PhoneConfig } from "../server/types.js";
+import { AnonymousConfig, anonymous } from "./anonymous.js";
+import { AppleConfig, apple } from "./apple.js";
+import { CustomOAuthAuthorizationConfig, CustomOAuthConfig, CustomOAuthTokenConfig, custom } from "./custom.js";
+import { DeviceConfig, device } from "./device.js";
+import { EmailProviderConfig, email } from "./email.js";
+import { GitHubConfig, github } from "./github.js";
+import { GoogleConfig, google } from "./google.js";
+import { PasswordConfig, password } from "./password.js";
+import { PasskeyConfig, passkey } from "./passkey.js";
+import { TotpConfig, totp } from "./totp.js";
+import { MicrosoftConfig, microsoft } from "./microsoft.js";
+import { sso } from "./sso.js";
+import { PhoneProviderConfig, phone } from "./phone.js";
+export { type AnonymousConfig, type AppleConfig, type CredentialsConfig, type CustomOAuthAuthorizationConfig, type CustomOAuthConfig, type CustomOAuthTokenConfig, type DeviceConfig, type EmailConfig, type EmailProviderConfig, type GitHubConfig, type GoogleConfig, type MicrosoftConfig, type OAuthProfile, type OAuthTokens, type PasskeyConfig, type PasswordConfig, type PhoneConfig, type PhoneProviderConfig, type TotpConfig, anonymous, apple, credentials, custom, device, email, github, google, microsoft, passkey, password, phone, sso, totp };

package/dist/providers/index.js

@@ -1,12 +1,16 @@
-import { Credentials } from "./credentials.js";
-import { Anonymous } from "./anonymous.js";
-import { Device } from "./device.js";
-import { Email } from "./email.js";
-import { OAuth } from "./oauth.js";
-import { Password } from "./password.js";
-import { Passkey } from "./passkey.js";
-import { Totp } from "./totp.js";
-import { SSO } from "./sso.js";
-import { Phone } from "./phone.js";
+import { credentials } from "./credentials.js";
+import { anonymous } from "./anonymous.js";
+import { apple } from "./apple.js";
+import { custom } from "./custom.js";
+import { device } from "./device.js";
+import { email } from "./email.js";
+import { github } from "./github.js";
+import { google } from "./google.js";
+import { password } from "./password.js";
+import { passkey } from "./passkey.js";
+import { totp } from "./totp.js";
+import { microsoft } from "./microsoft.js";
+import { sso } from "./sso.js";
+import { phone } from "./phone.js";
 
-export { Anonymous, Credentials, Device, Email, OAuth, Passkey, Password, Phone, SSO, Totp };
+export { anonymous, apple, credentials, custom, device, email, github, google, microsoft, passkey, password, phone, sso, totp };

package/dist/providers/microsoft.d.ts

@@ -0,0 +1,57 @@
+import { OAuthMaterializedConfig } from "../server/types.js";
+
+//#region src/providers/microsoft.d.ts
+/**
+ * Microsoft OAuth provider.
+ *
+ * ```ts
+ * import { microsoft } from "@robelest/convex-auth/providers/microsoft";
+ *
+ * microsoft({
+ *   tenant: process.env.AUTH_MICROSOFT_TENANT_ID!,
+ *   clientId: process.env.AUTH_MICROSOFT_ID!,
+ *   clientSecret: process.env.AUTH_MICROSOFT_SECRET!,
+ * })
+ * ```
+ *
+ * @module
+ */
+/** Configuration for the {@link microsoft} provider. */
+interface MicrosoftConfig {
+  /** Microsoft Entra tenant ID or domain used to scope the OAuth issuer. */
+  tenant: string;
+  /** OAuth client ID from Microsoft Entra ID. */
+  clientId: string;
+  /** OAuth client secret for confidential clients, when required. */
+  clientSecret?: string | null;
+  /** Optional callback URL override. Defaults to `CUSTOM_AUTH_SITE_URL` or `CONVEX_SITE_URL` plus `/api/auth/callback/microsoft`. */
+  redirectUri?: string;
+  /** Optional OAuth scopes. Defaults to `openid profile email`. */
+  scopes?: string[];
+  /** Account-linking strategy for existing users with matching email addresses. */
+  accountLinking?: "verifiedEmail" | "none";
+}
+/**
+ * Create a Microsoft OAuth provider.
+ *
+ * This wrapper enables nonce handling and validates the returned ID token.
+ *
+ * @param config - Microsoft Entra ID client settings.
+ * @returns A configured Microsoft OAuth provider for `createAuth`.
+ * @throws {Error} When no callback URL can be derived and `redirectUri` is omitted.
+ *
+ * @example
+ * ```ts
+ * import { microsoft } from "@robelest/convex-auth/providers/microsoft";
+ *
+ * microsoft({
+ *   tenant: process.env.AUTH_MICROSOFT_TENANT_ID!,
+ *   clientId: process.env.AUTH_MICROSOFT_ID!,
+ *   clientSecret: process.env.AUTH_MICROSOFT_SECRET!,
+ * })
+ * ```
+ */
+declare function microsoft(config: MicrosoftConfig): OAuthMaterializedConfig;
+//#endregion
+export { MicrosoftConfig, microsoft };
+//# sourceMappingURL=microsoft.d.ts.map

package/dist/providers/microsoft.js

@@ -0,0 +1,101 @@
+import { envOptionalString, readConfigSync } from "../server/env.js";
+import { createArcticOAuthClient, createOAuthProvider } from "../server/oauth/factory.js";
+import { createRemoteJWKSet, decodeProtectedHeader, jwtVerify } from "jose";
+import { MicrosoftEntraId } from "arctic";
+
+//#region src/providers/microsoft.ts
+/**
+* Microsoft OAuth provider.
+*
+* ```ts
+* import { microsoft } from "@robelest/convex-auth/providers/microsoft";
+*
+* microsoft({
+*   tenant: process.env.AUTH_MICROSOFT_TENANT_ID!,
+*   clientId: process.env.AUTH_MICROSOFT_ID!,
+*   clientSecret: process.env.AUTH_MICROSOFT_SECRET!,
+* })
+* ```
+*
+* @module
+*/
+const DEFAULT_SCOPES = [
+	"openid",
+	"profile",
+	"email"
+];
+/**
+* Create a Microsoft OAuth provider.
+*
+* This wrapper enables nonce handling and validates the returned ID token.
+*
+* @param config - Microsoft Entra ID client settings.
+* @returns A configured Microsoft OAuth provider for `createAuth`.
+* @throws {Error} When no callback URL can be derived and `redirectUri` is omitted.
+*
+* @example
+* ```ts
+* import { microsoft } from "@robelest/convex-auth/providers/microsoft";
+*
+* microsoft({
+*   tenant: process.env.AUTH_MICROSOFT_TENANT_ID!,
+*   clientId: process.env.AUTH_MICROSOFT_ID!,
+*   clientSecret: process.env.AUTH_MICROSOFT_SECRET!,
+* })
+* ```
+*/
+function microsoft(config) {
+	const provider = new MicrosoftEntraId(config.tenant, config.clientId, config.clientSecret ?? null, config.redirectUri ?? defaultRedirectUri("microsoft"));
+	const issuer = `https://login.microsoftonline.com/${config.tenant}/v2.0`;
+	const jwks = createRemoteJWKSet(new URL(`${issuer}/discovery/v2.0/keys`));
+	return createOAuthProvider({
+		id: "microsoft",
+		provider: createArcticOAuthClient(provider, { pkce: "required" }),
+		scopes: config.scopes ?? DEFAULT_SCOPES,
+		nonce: true,
+		accountLinking: config.accountLinking,
+		validateTokens: async (tokens, ctx) => {
+			if (!ctx.nonce) throw new Error("Microsoft OAuth requires a nonce.");
+			if (!tokens.idToken) throw new Error("Microsoft OAuth response is missing id_token.");
+			const idToken = tokens.idToken;
+			const tokenAlg = decodeProtectedHeader(idToken).alg;
+			const verification = await (tokenAlg === "HS256" || tokenAlg === "HS384" || tokenAlg === "HS512" ? jwtVerify(idToken, (() => {
+				if (!config.clientSecret) throw new Error("Microsoft token uses symmetric signatures but clientSecret is missing.");
+				return new TextEncoder().encode(config.clientSecret);
+			})(), {
+				issuer,
+				audience: config.clientId,
+				requiredClaims: [
+					"iss",
+					"sub",
+					"aud",
+					"exp",
+					"iat"
+				],
+				clockTolerance: 10
+			}) : jwtVerify(idToken, jwks, {
+				issuer,
+				audience: config.clientId,
+				requiredClaims: [
+					"iss",
+					"sub",
+					"aud",
+					"exp",
+					"iat"
+				],
+				clockTolerance: 10
+			}));
+			if (verification.payload.nonce !== ctx.nonce) throw new Error("Microsoft OAuth nonce mismatch.");
+			if (Array.isArray(verification.payload.aud) && verification.payload.aud.length > 1 && verification.payload.azp !== config.clientId) throw new Error("Microsoft OAuth authorized party does not match client ID.");
+		}
+	});
+}
+function defaultRedirectUri(providerId) {
+	const rootUrl = readConfigSync(envOptionalString("CUSTOM_AUTH_SITE_URL")) ?? readConfigSync(envOptionalString("CONVEX_SITE_URL"));
+	if (!rootUrl) throw new Error(`Missing CONVEX_SITE_URL while configuring ${providerId} OAuth provider. Set CONVEX_SITE_URL or pass redirectUri explicitly.`);
+	return `${rootUrl}/api/auth/callback/${providerId}`;
+}
+
+//#endregion
+export { microsoft };
+//# sourceMappingURL=microsoft.js.map

package/dist/providers/passkey.d.ts

@@ -1,57 +1,41 @@
+import { PasskeyProviderConfig } from "../server/types.js";
+
 //#region src/providers/passkey.d.ts
-/**
- * Passkey (WebAuthn) authentication provider.
- *
- * ```ts
- * import { Passkey } from "@robelest/convex-auth/providers";
- *
- * new Passkey({ rpName: "My App" })
- * ```
- *
- * @module
- */
-/**
- * Configuration for the Passkey provider.
- */
+/** Configuration for the {@link passkey} provider. */
 interface PasskeyConfig {
-  /** Relying Party display name. Defaults to SITE_URL hostname. */
+  /** Human-readable relying party name shown in authenticator prompts. */
   rpName?: string;
-  /** Relying Party ID (hostname). Defaults to SITE_URL hostname. */
+  /** Relying party ID, typically your app's hostname. */
   rpId?: string;
-  /** Allowed origins for credential verification. Defaults to SITE_URL plus SECONDARY_URL. */
+  /** Allowed origins for registration and authentication ceremonies. */
   origin?: string | string[];
-  /** Attestation conveyance preference. Defaults to "none". */
+  /** Attestation conveyance preference sent to authenticators. */
   attestation?: "none" | "direct";
-  /** User verification requirement. Defaults to "required". */
+  /** User verification requirement for authentication ceremonies. */
   userVerification?: "required" | "preferred" | "discouraged";
-  /** Resident key (discoverable credential) preference. Defaults to "preferred". */
+  /** Discoverable credential preference for resident keys. */
   residentKey?: "required" | "preferred" | "discouraged";
-  /** Restrict to platform or cross-platform authenticators. */
+  /** Restrict credentials to platform or roaming authenticators. */
   authenticatorAttachment?: "platform" | "cross-platform";
-  /** Supported COSE algorithms. Defaults to [-7 (ES256), -257 (RS256)]. */
+  /** Supported COSE algorithms in authenticator preference order. */
   algorithms?: number[];
-  /** Challenge expiration in ms. Defaults to 300_000 (5 minutes). */
+  /** Challenge lifetime in milliseconds before registration/login expires. */
   challengeExpirationMs?: number;
 }
 /**
- * Passkey (WebAuthn) authentication provider.
+ * Create a passkey provider.
  *
- * Enables passwordless authentication via biometrics, security keys,
- * and synced passkeys using the Web Authentication API.
+ * @param config - Optional WebAuthn relying party and challenge settings.
+ * @returns A configured passkey provider for `createAuth`.
  *
  * @example
  * ```ts
- * import { Passkey } from "@robelest/convex-auth/providers";
+ * import { passkey } from "@robelest/convex-auth/providers";
  *
- * new Passkey({ rpName: "My App" })
+ * passkey({ rpName: "My App" })
  * ```
  */
-declare class Passkey {
-  readonly id: string;
-  readonly type: "passkey";
-  readonly config: PasskeyConfig;
-  constructor(config?: PasskeyConfig);
-}
+declare function passkey(config?: PasskeyConfig): PasskeyProviderConfig;
 //#endregion
-export { Passkey, PasskeyConfig };
+export { PasskeyConfig, passkey };
 //# sourceMappingURL=passkey.d.ts.map

package/dist/providers/passkey.js

@@ -1,42 +1,32 @@
 //#region src/providers/passkey.ts
 /**
-* Passkey (WebAuthn) authentication provider.
+* Create a passkey provider.
 *
-* Enables passwordless authentication via biometrics, security keys,
-* and synced passkeys using the Web Authentication API.
+* @param config - Optional WebAuthn relying party and challenge settings.
+* @returns A configured passkey provider for `createAuth`.
 *
 * @example
 * ```ts
-* import { Passkey } from "@robelest/convex-auth/providers";
+* import { passkey } from "@robelest/convex-auth/providers";
 *
-* new Passkey({ rpName: "My App" })
+* passkey({ rpName: "My App" })
 * ```
 */
-var Passkey = class {
-	id;
-	type = "passkey";
-	config;
-	constructor(config = {}) {
-		this.id = "passkey";
-		this.config = config;
-	}
-	/** @internal Convert to the internal materialized config shape. */
-	_toMaterialized() {
-		return {
-			id: this.id,
-			type: "passkey",
-			options: {
-				attestation: "none",
-				userVerification: "required",
-				residentKey: "preferred",
-				algorithms: [-7, -257],
-				challengeExpirationMs: 3e5,
-				...this.config
-			}
-		};
-	}
-};
+function passkey(config = {}) {
+	return {
+		id: "passkey",
+		type: "passkey",
+		options: {
+			attestation: "none",
+			userVerification: "required",
+			residentKey: "preferred",
+			algorithms: [-7, -257],
+			challengeExpirationMs: 3e5,
+			...config
+		}
+	};
+}
 
 //#endregion
-export { Passkey };
+export { passkey };
 //# sourceMappingURL=passkey.js.map

package/dist/providers/password.d.ts

@@ -1,16 +1,14 @@
 import { CredentialsConfig } from "./credentials.js";
-import { EmailConfig, GenericActionCtxWithAuthConfig } from "../server/types.js";
-import { DocumentByName, GenericDataModel, WithoutSystemFields } from "convex/server";
+import { ConvexCredentialsConfig, EmailConfig, GenericActionCtxWithAuthConfig } from "../server/types.js";
 import { Value } from "convex/values";
+import { DocumentByName, GenericDataModel, WithoutSystemFields } from "convex/server";
 
 //#region src/providers/password.d.ts
-/**
- * The available options to a {@link Password} provider for Convex Auth.
- */
+/** Configuration for the {@link password} provider. */
 interface PasswordConfig<DataModel extends GenericDataModel> {
   /**
    * Uniquely identifies the provider, allowing to use
-   * multiple different {@link Password} providers.
+   * multiple different password providers.
    */
   id?: string;
   /**
@@ -53,13 +51,14 @@ interface PasswordConfig<DataModel extends GenericDataModel> {
    * An email provider used to require verification
    * before password reset.
    */
-  reset?: EmailConfig | ((...args: any) => EmailConfig);
+  reset?: EmailConfig | PasswordEmailProviderFactory;
   /**
    * An email provider used to require verification
    * before sign up / sign in.
    */
-  verify?: EmailConfig | ((...args: any) => EmailConfig);
+  verify?: EmailConfig | PasswordEmailProviderFactory;
 }
+type PasswordEmailProviderFactory = () => EmailConfig;
 /**
  * Email and password authentication provider.
  *
@@ -71,18 +70,18 @@ interface PasswordConfig<DataModel extends GenericDataModel> {
  *
  * @example
  * ```ts
- * import { Password } from "@robelest/convex-auth/providers";
+ * import { password } from "@robelest/convex-auth/providers";
  *
- * new Password()
- * new Password({ verify: myEmailProvider })
+ * password()
+ * password({ verify: myEmailProvider })
  * ```
+ *
+ * @typeParam DataModel - The Convex data model used by the auth context.
+ * @param config - Password flow hooks and optional verification providers.
+ * @returns A configured password provider for `createAuth`.
+ * @throws {Error} During sign-in flows when required password params are missing or reset is not enabled.
  */
-declare class Password<DataModel extends GenericDataModel = GenericDataModel> {
-  readonly id: string;
-  readonly type: "credentials";
-  readonly config: PasswordConfig<DataModel>;
-  constructor(config?: PasswordConfig<DataModel>);
-}
+declare function password<DataModel extends GenericDataModel = GenericDataModel>(config?: PasswordConfig<DataModel>): ConvexCredentialsConfig;
 //#endregion
-export { Password, PasswordConfig };
+export { PasswordConfig, password };
 //# sourceMappingURL=password.d.ts.map