@robelest/convex-auth 0.0.4-preview.25 → 0.0.4-preview.28

package/dist/providers/password.js

@@ -1,13 +1,12 @@
-import { Credentials } from "./credentials.js";
+import { credentials } from "./credentials.js";
 import { scryptAsync } from "@noble/hashes/scrypt.js";
 import { bytesToHex } from "@noble/hashes/utils.js";
-import { Fx } from "@robelest/fx";
 
 //#region src/providers/password.ts
 /**
-* Configure {@link Password} provider for email/password authentication.
+* Configure the password provider for email/password authentication.
 *
-* The `Password` provider supports the following flows, determined
+* The password provider supports the following flows, determined
 * by the `flow` parameter:
 *
 * - `"signUp"`: Create a new account with a password.
@@ -18,9 +17,9 @@ import { Fx } from "@robelest/fx";
 *    included in params, verify an OTP.
 *
 * ```ts
-* import { Password } from "@robelest/convex-auth/providers";
+* import { password } from "@robelest/convex-auth/providers";
 *
-* new Password()
+* password()
 * ```
 *
 * @module
@@ -54,148 +53,127 @@ function decodePasswordFlow(flow) {
 *
 * @example
 * ```ts
-* import { Password } from "@robelest/convex-auth/providers";
+* import { password } from "@robelest/convex-auth/providers";
 *
-* new Password()
-* new Password({ verify: myEmailProvider })
+* password()
+* password({ verify: myEmailProvider })
 * ```
+*
+* @typeParam DataModel - The Convex data model used by the auth context.
+* @param config - Password flow hooks and optional verification providers.
+* @returns A configured password provider for `createAuth`.
+* @throws {Error} During sign-in flows when required password params are missing or reset is not enabled.
 */
-var Password = class {
-	id;
-	type = "credentials";
-	config;
-	constructor(config = {}) {
-		this.id = config.id ?? "password";
-		this.config = config;
-	}
-	/** @internal Convert to the internal materialized config shape. */
-	_toMaterialized() {
-		const config = this.config;
-		const provider = this.id;
-		return new Credentials({
-			id: "password",
-			authorize: async (params, ctx) => {
-				const flowDispatch = decodePasswordFlow(params.flow);
-				const validatePasswordRequirements = (password) => {
-					if (config.validatePasswordRequirements !== void 0) {
-						config.validatePasswordRequirements(password);
-						return;
+function password(config = {}) {
+	const provider = config.id ?? "password";
+	const resetProvider = typeof config.reset === "function" ? config.reset() : config.reset;
+	const verifyProvider = typeof config.verify === "function" ? config.verify() : config.verify;
+	return credentials({
+		id: provider,
+		authorize: async (params, ctx) => {
+			const flowDispatch = decodePasswordFlow(params.flow);
+			const validatePasswordRequirements = (password) => {
+				if (config.validatePasswordRequirements !== void 0) {
+					config.validatePasswordRequirements(password);
+					return;
+				}
+				validateDefaultPasswordRequirements(password);
+			};
+			if (flowDispatch.tag === "signUp") validatePasswordRequirements(params.password);
+			else if (flowDispatch.tag === "resetVerification") validatePasswordRequirements(params.newPassword);
+			const profile = config.profile?.(params, ctx) ?? defaultProfile(params);
+			const { email } = profile;
+			const requirePasswordParam = (value, flow) => {
+				if (typeof value !== "string" || value.length === 0) throw new Error(`Missing \`password\` param for \`${flow}\` flow`);
+				return value;
+			};
+			const finalizeCredentialsResult = async (account, user) => {
+				if (verifyProvider && !account.emailVerified) return await ctx.auth.provider.signIn(ctx, verifyProvider, {
+					accountId: account._id,
+					params
+				});
+				return { userId: user._id };
+			};
+			if (flowDispatch.tag === "signUp") {
+				const secret = requirePasswordParam(params.password, "signUp");
+				const created = await ctx.auth.account.create(ctx, {
+					provider,
+					account: {
+						id: email,
+						secret
+					},
+					profile,
+					shouldLinkViaEmail: config.verify !== void 0,
+					shouldLinkViaPhone: false
+				});
+				return await finalizeCredentialsResult(created.account, created.user);
+			} else if (flowDispatch.tag === "signIn") {
+				const secret = requirePasswordParam(params.password, "signIn");
+				const retrieved = await ctx.auth.account.get(ctx, {
+					provider,
+					account: {
+						id: email,
+						secret
 					}
-					validateDefaultPasswordRequirements(password);
-				};
-				await Fx.run(Fx.match(flowDispatch, flowDispatch.tag, {
-					signUp: () => Fx.sync(() => {
-						validatePasswordRequirements(params.password);
-					}),
-					resetVerification: () => Fx.sync(() => {
-						validatePasswordRequirements(params.newPassword);
-					}),
-					signIn: () => Fx.succeed(void 0),
-					reset: () => Fx.succeed(void 0),
-					emailVerification: () => Fx.succeed(void 0),
-					invalid: () => Fx.succeed(void 0)
-				}));
-				const profile = config.profile?.(params, ctx) ?? defaultProfile(params);
-				const { email } = profile;
-				const requirePasswordParam = (value, flow) => {
-					if (typeof value !== "string" || value.length === 0) throw new Error(`Missing \`password\` param for \`${flow}\` flow`);
-					return value;
-				};
-				const finalizeCredentialsResult = async (account, user) => {
-					if (config.verify && !account.emailVerified) return await ctx.auth.provider.signIn(ctx, config.verify, {
-						accountId: account._id,
-						params
-					});
-					return { userId: user._id };
+				});
+				if (retrieved === null) throw new Error("Invalid credentials");
+				return await finalizeCredentialsResult(retrieved.account, retrieved.user);
+			} else if (flowDispatch.tag === "reset") {
+				if (!resetProvider) throw new Error(`Password reset is not enabled for ${provider}`);
+				const { account } = await ctx.auth.account.get(ctx, {
+					provider,
+					account: { id: email }
+				});
+				return await ctx.auth.provider.signIn(ctx, resetProvider, {
+					accountId: account._id,
+					params
+				});
+			} else if (flowDispatch.tag === "resetVerification") {
+				if (!resetProvider) throw new Error(`Password reset is not enabled for ${provider}`);
+				if (params.newPassword === void 0) throw new Error("Missing `newPassword` param for `reset-verification` flow");
+				const result = await ctx.auth.provider.signIn(ctx, resetProvider, { params });
+				if (result === null) throw new Error("Invalid code");
+				const { userId, sessionId } = result;
+				const secret = params.newPassword;
+				await ctx.auth.account.update(ctx, {
+					provider,
+					account: {
+						id: email,
+						secret
+					}
+				});
+				await ctx.auth.session.invalidate(ctx, {
+					userId,
+					except: [sessionId]
+				});
+				return {
+					userId,
+					sessionId
 				};
-				return await Fx.run(Fx.match(flowDispatch, flowDispatch.tag, {
-					signUp: () => Fx.promise(async () => {
-						const secret = requirePasswordParam(params.password, "signUp");
-						const created = await ctx.auth.account.create(ctx, {
-							provider,
-							account: {
-								id: email,
-								secret
-							},
-							profile,
-							shouldLinkViaEmail: config.verify !== void 0,
-							shouldLinkViaPhone: false
-						});
-						return await finalizeCredentialsResult(created.account, created.user);
-					}),
-					signIn: () => Fx.promise(async () => {
-						const secret = requirePasswordParam(params.password, "signIn");
-						const retrieved = await ctx.auth.account.get(ctx, {
-							provider,
-							account: {
-								id: email,
-								secret
-							}
-						});
-						if (retrieved === null) throw new Error("Invalid credentials");
-						return await finalizeCredentialsResult(retrieved.account, retrieved.user);
-					}),
-					reset: () => Fx.promise(async () => {
-						if (!config.reset) throw new Error(`Password reset is not enabled for ${provider}`);
-						const { account } = await ctx.auth.account.get(ctx, {
-							provider,
-							account: { id: email }
-						});
-						return await ctx.auth.provider.signIn(ctx, config.reset, {
-							accountId: account._id,
-							params
-						});
-					}),
-					resetVerification: () => Fx.promise(async () => {
-						if (!config.reset) throw new Error(`Password reset is not enabled for ${provider}`);
-						if (params.newPassword === void 0) throw new Error("Missing `newPassword` param for `reset-verification` flow");
-						const result = await ctx.auth.provider.signIn(ctx, config.reset, { params });
-						if (result === null) throw new Error("Invalid code");
-						const { userId, sessionId } = result;
-						const secret = params.newPassword;
-						await ctx.auth.account.update(ctx, {
-							provider,
-							account: {
-								id: email,
-								secret
-							}
-						});
-						await ctx.auth.session.invalidate(ctx, {
-							userId,
-							except: [sessionId]
-						});
-						return {
-							userId,
-							sessionId
-						};
-					}),
-					emailVerification: () => Fx.promise(async () => {
-						if (!config.verify) throw new Error(`Email verification is not enabled for ${provider}`);
-						const { account } = await ctx.auth.account.get(ctx, {
-							provider,
-							account: { id: email }
-						});
-						return await ctx.auth.provider.signIn(ctx, config.verify, {
-							accountId: account._id,
-							params
-						});
-					}),
-					invalid: () => Fx.fatal(/* @__PURE__ */ new Error("Missing `flow` param, it must be one of \"signUp\", \"signIn\", \"reset\", \"reset-verification\" or \"email-verification\"!"))
-				}));
+			} else if (flowDispatch.tag === "emailVerification") {
+				if (!verifyProvider) throw new Error(`Email verification is not enabled for ${provider}`);
+				const { account } = await ctx.auth.account.get(ctx, {
+					provider,
+					account: { id: email }
+				});
+				return await ctx.auth.provider.signIn(ctx, verifyProvider, {
+					accountId: account._id,
+					params
+				});
+			} else throw new Error("Missing `flow` param, it must be one of \"signUp\", \"signIn\", \"reset\", \"reset-verification\" or \"email-verification\"!");
+		},
+		crypto: config.crypto ?? {
+			async hashSecret(password) {
+				return await hashPassword(password);
 			},
-			crypto: config.crypto ?? {
-				async hashSecret(password) {
-					return await hashPassword(password);
-				},
-				async verifySecret(password, hash) {
-					return await verifyPassword(password, hash);
-				}
-			},
-			extraProviders: [config.reset, config.verify],
-			...config
-		})._toMaterialized();
-	}
-};
+			async verifySecret(password, hash) {
+				return await verifyPassword(password, hash);
+			}
+		},
+		extraProviders: [resetProvider, verifyProvider],
+		...config
+	});
+}
 function validateDefaultPasswordRequirements(password) {
 	if (!password || password.length < 8) throw new Error("Invalid password");
 }
@@ -249,5 +227,5 @@ function constantTimeEqual(left, right) {
 }
 
 //#endregion
-export { Password };
+export { password };
 //# sourceMappingURL=password.js.map

package/dist/providers/phone.d.ts

@@ -1,48 +1,33 @@
 import { PhoneConfig } from "../server/types.js";
 
 //#region src/providers/phone.d.ts
-/**
- * User-facing configuration for the {@link Phone} provider.
- *
- * Use this to send SMS or other phone-based verification messages during
- * sign-in.
- */
+/** Configuration for the {@link phone} provider. */
 interface PhoneProviderConfig {
-  /** Send the verification code to the user's phone. */
+  /** SMS or phone delivery callback for verification tokens. */
   send: PhoneConfig["sendVerificationRequest"];
-  /** Provider ID override. Defaults to "phone". */
+  /** Stable provider identifier used in `signIn("<id>")`. */
   id?: string;
-  /** Token expiration in seconds. Defaults to 1200 (20 minutes). */
+  /** Verification token lifetime in seconds. */
   maxAge?: number;
 }
 /**
- * Phone provider for SMS or phone-number verification flows.
+ * Create a phone or SMS verification provider.
  *
- * Wraps your `send()` implementation and materializes the runtime behavior
- * Convex Auth needs for short-code or magic-link-style phone verification.
+ * @param config - SMS delivery hook and optional provider settings.
+ * @returns A configured phone provider for `createAuth`.
  *
  * @example
  * ```ts
- * import { Phone } from "@robelest/convex-auth/providers";
+ * import { phone } from "@robelest/convex-auth/providers";
  *
- * const phone = new Phone({
+ * phone({
  *   send: async ({ identifier, token }) => {
- *     await sms.send({ to: identifier, body: `Your sign-in code is ${token}` });
+ *     await sendSms(identifier, `Your sign-in code is ${token}`);
  *   },
- * });
+ * })
  * ```
  */
-declare class Phone {
-  readonly config: PhoneProviderConfig;
-  readonly id: string;
-  readonly type: "phone";
-  /**
-   * Create a phone provider instance.
-   *
-   * @param config - Phone delivery and provider settings.
-   */
-  constructor(config: PhoneProviderConfig);
-}
+declare function phone(config: PhoneProviderConfig): PhoneConfig;
 //#endregion
-export { Phone, PhoneProviderConfig };
+export { PhoneProviderConfig, phone };
 //# sourceMappingURL=phone.d.ts.map

package/dist/providers/phone.js

@@ -1,60 +1,35 @@
-import { Fx } from "@robelest/fx";
-
 //#region src/providers/phone.ts
 /**
-* Phone / SMS authentication provider.
-*
-* @module
-*/
-/**
-* Phone provider for SMS or phone-number verification flows.
+* Create a phone or SMS verification provider.
 *
-* Wraps your `send()` implementation and materializes the runtime behavior
-* Convex Auth needs for short-code or magic-link-style phone verification.
+* @param config - SMS delivery hook and optional provider settings.
+* @returns A configured phone provider for `createAuth`.
 *
 * @example
 * ```ts
-* import { Phone } from "@robelest/convex-auth/providers";
+* import { phone } from "@robelest/convex-auth/providers";
 *
-* const phone = new Phone({
+* phone({
 *   send: async ({ identifier, token }) => {
-*     await sms.send({ to: identifier, body: `Your sign-in code is ${token}` });
+*     await sendSms(identifier, `Your sign-in code is ${token}`);
 *   },
-* });
+* })
 * ```
 */
-var Phone = class {
-	id;
-	type = "phone";
-	/**
-	* Create a phone provider instance.
-	*
-	* @param config - Phone delivery and provider settings.
-	*/
-	constructor(config) {
-		this.config = config;
-		this.id = config.id ?? "phone";
-	}
-	/** @internal */
-	_toMaterialized() {
-		return {
-			id: this.id,
-			type: "phone",
-			maxAge: this.config.maxAge ?? 1200,
-			authorize: async (params, account) => {
-				const dispatch = typeof params.phone !== "string" ? { tag: "missingPhone" } : account.providerAccountId !== params.phone ? { tag: "mismatch" } : { tag: "ok" };
-				return await Fx.run(Fx.match(dispatch, dispatch.tag, {
-					missingPhone: () => Fx.fatal(/* @__PURE__ */ new Error("Token verification requires a `phone` in params of `signIn`.")),
-					mismatch: () => Fx.fatal(/* @__PURE__ */ new Error("Short verification code requires a matching `phone` in params of `signIn`.")),
-					ok: () => Fx.succeed(void 0)
-				}));
-			},
-			sendVerificationRequest: this.config.send,
-			options: {}
-		};
-	}
-};
+function phone(config) {
+	return {
+		id: config.id ?? "phone",
+		type: "phone",
+		maxAge: config.maxAge ?? 1200,
+		authorize: async (params, account) => {
+			if (typeof params.phone !== "string") throw new Error("Token verification requires a `phone` in params of `signIn`.");
+			if (account.providerAccountId !== params.phone) throw new Error("Short verification code requires a matching `phone` in params of `signIn`.");
+		},
+		sendVerificationRequest: config.send,
+		options: {}
+	};
+}
 
 //#endregion
-export { Phone };
+export { phone };
 //# sourceMappingURL=phone.js.map

package/dist/providers/sso.d.ts

@@ -1,50 +1,30 @@
+import { SSOProviderConfig } from "../server/types.js";
+
 //#region src/providers/sso.d.ts
 /**
- * Enterprise SSO provider (OIDC + SAML + SCIM).
+ * Create the group SSO provider.
  *
- * Adding `new SSO()` to your providers list enables enterprise SSO
- * sign-in flows and registers the OIDC, SAML, and SCIM runtime HTTP
- * routes. It also makes `auth.sso.*` available on the auth
- * object returned by `createAuth`.
+ * @param options - Optional SSO provider settings.
+ * @param options.redirectURI - Override the callback URI used for provider
+ *   initiated sign-in flows.
+ * @returns A provider that enables the `auth.group.sso.*` server helpers and
+ * registers the runtime SSO routes.
  *
+ * @example
  * ```ts
- * import { SSO } from "@robelest/convex-auth/providers";
- *
- * const auth = createAuth(components.auth, {
- *   providers: [new SSO(), new Password()],
- * });
+ * import { sso } from "@robelest/convex-auth/providers";
  *
- * // auth.sso is now available
- * await auth.sso.admin.oidc.configure(ctx, { enterpriseId, clientId, ... });
+ * sso()
  * ```
  *
- * Without `new SSO()` in the providers list, `auth.sso` is not
- * present on the returned object and accessing it is a TypeScript error.
- *
- * @module
- */
-/**
- * Enterprise SSO provider.
- *
- * Zero-configuration — sensible defaults are applied for all enterprise
- * protocols (OIDC, SAML, SCIM). Per-tenant configuration is done at
- * runtime via `auth.sso.*` helpers.
- *
  * @example
  * ```ts
- * import { createAuth } from "@robelest/convex-auth/component";
- * import { SSO, Password } from "@robelest/convex-auth/providers";
- * import { components } from "./_generated/api";
- *
- * export const auth = createAuth(components.auth, {
- *   providers: [new SSO(), new Password()],
- * });
+ * sso({ redirectURI: "https://app.example.com/auth/sso/callback" })
  * ```
  */
-declare class SSO {
-  readonly id = "enterprise-sso";
-  readonly type: "sso";
-}
+declare function sso(options?: {
+  redirectURI?: string;
+}): SSOProviderConfig;
 //#endregion
-export { SSO };
+export { sso };
 //# sourceMappingURL=sso.d.ts.map

package/dist/providers/sso.js

@@ -1,34 +1,33 @@
 //#region src/providers/sso.ts
 /**
-* Enterprise SSO provider.
+* Create the group SSO provider.
 *
-* Zero-configuration — sensible defaults are applied for all enterprise
-* protocols (OIDC, SAML, SCIM). Per-tenant configuration is done at
-* runtime via `auth.sso.*` helpers.
+* @param options - Optional SSO provider settings.
+* @param options.redirectURI - Override the callback URI used for provider
+*   initiated sign-in flows.
+* @returns A provider that enables the `auth.group.sso.*` server helpers and
+* registers the runtime SSO routes.
 *
 * @example
 * ```ts
-* import { createAuth } from "@robelest/convex-auth/component";
-* import { SSO, Password } from "@robelest/convex-auth/providers";
-* import { components } from "./_generated/api";
+* import { sso } from "@robelest/convex-auth/providers";
 *
-* export const auth = createAuth(components.auth, {
-*   providers: [new SSO(), new Password()],
-* });
+* sso()
+* ```
+*
+* @example
+* ```ts
+* sso({ redirectURI: "https://app.example.com/auth/sso/callback" })
 * ```
 */
-var SSO = class {
-	id = "enterprise-sso";
-	type = "sso";
-	/** @internal Convert to the internal materialized config shape. */
-	_toMaterialized() {
-		return {
-			id: this.id,
-			type: "sso"
-		};
-	}
-};
+function sso(options) {
+	return {
+		id: "sso",
+		type: "sso",
+		redirectURI: options?.redirectURI
+	};
+}
 
 //#endregion
-export { SSO };
+export { sso };
 //# sourceMappingURL=sso.js.map

package/dist/providers/totp.d.ts

@@ -1,45 +1,29 @@
+import { TotpProviderConfig } from "../server/types.js";
+
 //#region src/providers/totp.d.ts
-/**
- * TOTP (Time-based One-Time Password) two-factor authentication provider.
- *
- * ```ts
- * import { Totp } from "@robelest/convex-auth/providers";
- *
- * new Totp({ issuer: "My App" })
- * ```
- *
- * @module
- */
-/**
- * Configuration for the TOTP provider.
- */
+/** Configuration for the {@link totp} provider. */
 interface TotpConfig {
-  /** Issuer name shown in authenticator apps (e.g. "My App"). */
+  /** Issuer label embedded in the otpauth URI shown to authenticator apps. */
   issuer?: string;
-  /** Number of digits in each code (default: 6). */
+  /** Number of digits expected in generated TOTP codes. */
   digits?: number;
-  /** Time period in seconds for code rotation (default: 30). */
+  /** Time step, in seconds, used when generating and validating codes. */
   period?: number;
 }
 /**
- * TOTP (Time-based One-Time Password) two-factor authentication provider.
+ * Create a TOTP provider.
  *
- * Generates time-based one-time passwords compatible with authenticator
- * apps like Google Authenticator and Authy.
+ * @param config - Optional issuer and token generation settings.
+ * @returns A configured TOTP provider for `createAuth`.
  *
  * @example
  * ```ts
- * import { Totp } from "@robelest/convex-auth/providers";
+ * import { totp } from "@robelest/convex-auth/providers";
  *
- * new Totp({ issuer: "My App" })
+ * totp({ issuer: "My App" })
  * ```
  */
-declare class Totp {
-  readonly id: string;
-  readonly type: "totp";
-  readonly config: TotpConfig;
-  constructor(config?: TotpConfig);
-}
+declare function totp(config?: TotpConfig): TotpProviderConfig;
 //#endregion
-export { Totp, TotpConfig };
+export { TotpConfig, totp };
 //# sourceMappingURL=totp.d.ts.map