@robelest/convex-auth 0.0.4-preview.25 → 0.0.4-preview.28

package/dist/server/http.d.ts

@@ -1,9 +1,16 @@
-import { CorsConfig, HttpKeyContext } from "./types.js";
-import { AuthContext, OptionalAuthContext, UserDoc } from "./auth.js";
-import * as convex_server65 from "convex/server";
-import { GenericActionCtx, GenericDataModel, HttpRouter } from "convex/server";
+import { ComponentReadCtx } from "./componentContext.js";
+import { HttpKeyContext } from "./types.js";
+import { AuthContext, OptionalAuthContext, UserDoc } from "./auth-context.js";
+import "./auth.js";
+import { GenericActionCtx, GenericDataModel, HttpRouter, UserIdentity } from "convex/server";
 
 //#region src/server/http.d.ts
+type HttpIdentityCtx = {
+  auth: {
+    getUserIdentity: () => Promise<UserIdentity | null>;
+  };
+};
+type HttpContextCtx = HttpIdentityCtx & ComponentReadCtx;
 /**
  * Auth context returned by `auth.http.context(ctx, request)`.
  *
@@ -60,7 +67,7 @@ type OptionalHttpAuthContext = (OptionalAuthContext & {
  * });
  * ```
  */
-type HttpAuthContextConfig<TResolve extends Record<string, unknown> = Record<string, never>> = {
+type HttpAuthContextConfig<TResolve extends Record<string, unknown> = Record<string, never>, TCtx extends HttpContextCtx = HttpContextCtx> = {
   /**
    * Allow unauthenticated callers and return a null-shaped auth object instead
    * of throwing `NOT_SIGNED_IN`.
@@ -71,7 +78,7 @@ type HttpAuthContextConfig<TResolve extends Record<string, unknown> = Record<str
    *
    * This callback runs only when authentication succeeds.
    */
-  resolve?: (ctx: GenericActionCtx<any>, user: UserDoc, auth: HttpAuthContext) => Promise<TResolve> | TResolve;
+  resolve?: (ctx: TCtx, user: UserDoc, auth: HttpAuthContext) => Promise<TResolve> | TResolve;
   /**
    * Override or wrap HTTP auth resolution.
    *
@@ -79,59 +86,8 @@ type HttpAuthContextConfig<TResolve extends Record<string, unknown> = Record<str
    * an explicit unauthenticated state, or a fully resolved
    * {@link HttpAuthContext}.
    */
-  authResolve?: (ctx: GenericActionCtx<any>, fallback: () => Promise<HttpAuthContext | null>) => Promise<HttpAuthContext | null | undefined> | HttpAuthContext | null | undefined;
-};
-declare function createHttpAction(auth: {
-  key: {
-    verify: (ctx: GenericActionCtx<any>, rawKey: string) => Promise<any>;
-  };
-}): (handler: (ctx: GenericActionCtx<GenericDataModel> & HttpKeyContext, request: Request) => Promise<Response | Record<string, unknown>>, options?: {
-  scope?: {
-    resource: string;
-    action: string;
-  };
-  cors?: CorsConfig;
-}) => convex_server65.PublicHttpAction;
-declare function createHttpRoute(wrapAction: ReturnType<typeof createHttpAction>): (http: {
-  route: (config: any) => void;
-}, routeConfig: {
-  path: string;
-  method: "GET" | "POST" | "PUT" | "PATCH" | "DELETE";
-  handler: (ctx: GenericActionCtx<GenericDataModel> & HttpKeyContext, request: Request) => Promise<Response | Record<string, unknown>>;
-  scope?: {
-    resource: string;
-    action: string;
-  };
-  cors?: CorsConfig;
-}) => void;
-declare function convertErrorsToResponse(errorStatusCode: number, action: (ctx: GenericActionCtx<any>, request: Request) => Promise<Response>): (ctx: GenericActionCtx<any>, request: Request) => Promise<Response>;
-declare function getCookies(request: Request): Record<string, string | undefined>;
-type SSORuntimeRoute = {
-  pathname?: string;
-  enterpriseId: string;
-  protocol: "oidc" | "saml" | "scim";
-  rest: string[];
+  authResolve?: (ctx: TCtx, fallback: () => Promise<HttpAuthContext | null>) => Promise<HttpAuthContext | null | undefined> | HttpAuthContext | null | undefined;
 };
-declare function addOpenIdRoutes(http: HttpRouter, deps: {
-  getIssuer: () => string;
-  getJwks: () => string;
-}): void;
-declare function addAuthRoutes(http: HttpRouter, deps: {
-  handleSignIn: (ctx: GenericActionCtx<any>, request: Request) => Promise<Response>;
-  handleCallback: (ctx: GenericActionCtx<any>, request: Request) => Promise<Response>;
-}): void;
-declare function addSSORoutes(http: HttpRouter, deps: {
-  routeBase: string;
-  convertErrorsToResponse: typeof convertErrorsToResponse;
-  handleSamlMetadata: (ctx: GenericActionCtx<any>, request: Request, route: SSORuntimeRoute) => Promise<Response>;
-  handleSamlSignIn: (ctx: GenericActionCtx<any>, request: Request, route: SSORuntimeRoute) => Promise<Response>;
-  handleOidcSignIn: (ctx: GenericActionCtx<any>, request: Request, route: SSORuntimeRoute) => Promise<Response>;
-  handleOidcCallback: (ctx: GenericActionCtx<any>, request: Request, route: SSORuntimeRoute) => Promise<Response>;
-  handleSamlAcs: (ctx: GenericActionCtx<any>, request: Request, route: SSORuntimeRoute) => Promise<Response>;
-  handleSamlSlo: (ctx: GenericActionCtx<any>, request: Request, route: SSORuntimeRoute) => Promise<Response>;
-  handleScimRequest: (ctx: GenericActionCtx<any>, request: Request) => Promise<Response>;
-  scimError: (status: number, scimType: string, detail: string) => Response;
-}): void;
 //#endregion
-export { HttpAuthContext, HttpAuthContextConfig, OptionalHttpAuthContext, SSORuntimeRoute, addAuthRoutes, addOpenIdRoutes, addSSORoutes, convertErrorsToResponse, createHttpAction, createHttpRoute, getCookies };
+export { HttpAuthContext, HttpAuthContextConfig, OptionalHttpAuthContext };
 //# sourceMappingURL=http.d.ts.map

package/dist/server/http.js

@@ -1,18 +1,30 @@
 import { createUnauthenticatedAuthContext, getAuthContextForUser, getSessionUserId } from "./context.js";
-import { logError } from "./utils.js";
-import { Fx } from "@robelest/fx";
-import { Cv } from "@robelest/fx/convex";
-import { httpActionGeneric } from "convex/server";
+import { logError } from "./log.js";
 import { ConvexError } from "convex/values";
+import { httpActionGeneric } from "convex/server";
 import { parse } from "cookie";
 
 //#region src/server/http.ts
 function createNotSignedInError() {
-	return Cv.error({
+	return new ConvexError({
 		code: "NOT_SIGNED_IN",
 		message: "Authentication required."
 	});
 }
+/**
+* Build CORS headers by matching the request's Origin against allowed origins.
+* Defaults to `defaultOrigins` (site URLs) when no per-route config is given.
+*/
+function buildCorsHeaders(request, corsConfig, defaultOrigins) {
+	const origins = corsConfig?.origins ?? (typeof defaultOrigins === "function" ? defaultOrigins() : defaultOrigins);
+	const requestOrigin = request.headers.get("Origin");
+	const matchedOrigin = origins.includes("*") ? "*" : requestOrigin && origins.includes(requestOrigin) ? requestOrigin : null;
+	return {
+		...matchedOrigin ? { "Access-Control-Allow-Origin": matchedOrigin } : {},
+		"Access-Control-Allow-Methods": corsConfig?.methods ?? "GET,POST,PUT,PATCH,DELETE,OPTIONS",
+		"Access-Control-Allow-Headers": corsConfig?.headers ?? "Content-Type,Authorization"
+	};
+}
 async function getHttpKeyContext(auth, ctx, request) {
 	const authHeader = request.headers.get("Authorization");
 	if (!authHeader?.startsWith("Bearer sk_")) return null;
@@ -64,88 +76,84 @@ function createHttpContext(auth) {
 		};
 	});
 }
-function createHttpAction(auth) {
+function createHttpAction(auth, defaultOrigins) {
 	return (handler, options) => {
-		const corsConfig = options?.cors ?? {};
-		const corsHeaders = {
-			"Access-Control-Allow-Origin": corsConfig.origin ?? "*",
-			"Access-Control-Allow-Methods": corsConfig.methods ?? "GET,POST,PUT,PATCH,DELETE,OPTIONS",
-			"Access-Control-Allow-Headers": corsConfig.headers ?? "Content-Type,Authorization"
-		};
 		return httpActionGeneric(async (genericCtx, request) => {
-			return Fx.run(Fx.from({
-				ok: async () => {
-					const authHeader = request.headers.get("Authorization");
-					if (!authHeader?.startsWith("Bearer ")) return new Response(JSON.stringify({
-						error: "Missing or malformed Authorization: Bearer header.",
-						code: "MISSING_BEARER_TOKEN"
-					}), {
-						status: 401,
-						headers: {
-							...corsHeaders,
-							"Content-Type": "application/json"
-						}
-					});
-					const rawKey = authHeader.slice(7);
-					const keyResult = await Fx.run(Fx.attempt(() => auth.key.verify(genericCtx, rawKey), (result$1) => ({
+			const corsHeaders = buildCorsHeaders(request, options?.cors, defaultOrigins);
+			try {
+				const authHeader = request.headers.get("Authorization");
+				if (!authHeader?.startsWith("Bearer ")) return new Response(JSON.stringify({
+					error: "Missing or malformed Authorization: Bearer header.",
+					code: "MISSING_BEARER_TOKEN"
+				}), {
+					status: 401,
+					headers: {
+						...corsHeaders,
+						"Content-Type": "application/json"
+					}
+				});
+				const rawKey = authHeader.slice(7);
+				let keyResult;
+				try {
+					keyResult = {
 						ok: true,
-						value: result$1
-					}), (error) => ({
+						value: await auth.key.verify(genericCtx, rawKey)
+					};
+				} catch (error) {
+					keyResult = {
 						ok: false,
 						error
-					})));
-					if (!keyResult.ok) {
-						if (keyResult.error instanceof ConvexError && typeof keyResult.error.data === "object" && keyResult.error.data !== null && "code" in keyResult.error.data && "message" in keyResult.error.data) {
-							const { code, message } = keyResult.error.data;
-							return new Response(JSON.stringify({
-								error: message,
-								code
-							}), {
-								status: 403,
-								headers: {
-									...corsHeaders,
-									"Content-Type": "application/json"
-								}
-							});
-						}
-						throw keyResult.error;
-					}
-					if (options?.scope && !keyResult.value.scopes.can(options.scope.resource, options.scope.action)) return new Response(JSON.stringify({
-						error: "This API key does not have the required permissions.",
-						code: "SCOPE_CHECK_FAILED"
-					}), {
-						status: 403,
-						headers: {
-							...corsHeaders,
-							"Content-Type": "application/json"
-						}
-					});
-					const result = await handler(Object.assign(genericCtx, { key: {
-						userId: keyResult.value.userId,
-						keyId: keyResult.value.keyId,
-						scopes: keyResult.value.scopes
-					} }), request);
-					if (result instanceof Response) {
-						const headers = new Headers(result.headers);
-						for (const [k, val] of Object.entries(corsHeaders)) if (!headers.has(k)) headers.set(k, val);
-						return new Response(result.body, {
-							status: result.status,
-							statusText: result.statusText,
-							headers
+					};
+				}
+				if (!keyResult.ok) {
+					if (keyResult.error instanceof ConvexError && typeof keyResult.error.data === "object" && keyResult.error.data !== null && "code" in keyResult.error.data && "message" in keyResult.error.data) {
+						const { code, message } = keyResult.error.data;
+						return new Response(JSON.stringify({
+							error: message,
+							code
+						}), {
+							status: 403,
+							headers: {
+								...corsHeaders,
+								"Content-Type": "application/json"
+							}
 						});
 					}
-					return new Response(JSON.stringify(result), {
-						status: 200,
-						headers: {
-							...corsHeaders,
-							"Content-Type": "application/json"
-						}
+					throw keyResult.error;
+				}
+				if (options?.scope && !keyResult.value.scopes.can(options.scope.resource, options.scope.action)) return new Response(JSON.stringify({
+					error: "This API key does not have the required permissions.",
+					code: "SCOPE_CHECK_FAILED"
+				}), {
+					status: 403,
+					headers: {
+						...corsHeaders,
+						"Content-Type": "application/json"
+					}
+				});
+				const result = await handler(Object.assign(genericCtx, { key: {
+					userId: keyResult.value.userId,
+					keyId: keyResult.value.keyId,
+					scopes: keyResult.value.scopes
+				} }), request);
+				return result instanceof Response ? (() => {
+					const headers = new Headers(result.headers);
+					for (const [k, val] of Object.entries(corsHeaders)) if (!headers.has(k)) headers.set(k, val);
+					return new Response(result.body, {
+						status: result.status,
+						statusText: result.statusText,
+						headers
 					});
-				},
-				err: (error) => error
-			}).pipe(Fx.recover((error) => {
+				})() : new Response(JSON.stringify(result), {
+					status: 200,
+					headers: {
+						...corsHeaders,
+						"Content-Type": "application/json"
+					}
+				});
+			} catch (error) {
 				logError(error);
-				return Fx.succeed(new Response(JSON.stringify({
+				return new Response(JSON.stringify({
 					error: "An unexpected error occurred.",
 					code: "INTERNAL_ERROR"
 				}), {
@@ -154,23 +162,18 @@ function createHttpAction(auth) {
 						...corsHeaders,
 						"Content-Type": "application/json"
 					}
-				}));
-			})));
+				});
+			}
 		});
 	};
 }
-function createHttpRoute(wrapAction) {
+function createHttpRoute(wrapAction, defaultOrigins) {
 	return (http, routeConfig) => {
-		const corsConfig = routeConfig.cors ?? {};
-		const corsHeaders = {
-			"Access-Control-Allow-Origin": corsConfig.origin ?? "*",
-			"Access-Control-Allow-Methods": corsConfig.methods ?? "GET,POST,PUT,PATCH,DELETE,OPTIONS",
-			"Access-Control-Allow-Headers": corsConfig.headers ?? "Content-Type,Authorization"
-		};
 		http.route({
 			path: routeConfig.path,
 			method: "OPTIONS",
-			handler: httpActionGeneric(async () => {
+			handler: httpActionGeneric(async (_ctx, request) => {
+				const corsHeaders = buildCorsHeaders(request, routeConfig.cors, defaultOrigins);
 				return new Response(null, {
 					status: 204,
 					headers: corsHeaders
@@ -189,41 +192,38 @@ function createHttpRoute(wrapAction) {
 }
 function convertErrorsToResponse(errorStatusCode, action) {
 	return async (ctx, request) => {
-		return Fx.run(Fx.from({
-			ok: () => action(ctx, request),
-			err: (error) => error
-		}).pipe(Fx.recover((error) => {
-			if (error instanceof ConvexError && typeof error.data === "object" && error.data !== null && "code" in error.data && "message" in error.data) return Fx.succeed(new Response(JSON.stringify({
+		try {
+			return await action(ctx, request);
+		} catch (error) {
+			if (error instanceof ConvexError && typeof error.data === "object" && error.data !== null && "code" in error.data && "message" in error.data) return new Response(JSON.stringify({
 				code: error.data.code,
 				message: error.data.message
 			}), {
 				status: errorStatusCode,
 				headers: { "Content-Type": "application/json" }
-			}));
-			else if (error instanceof ConvexError) return Fx.succeed(new Response(null, {
+			});
+			if (error instanceof ConvexError) return new Response(null, {
 				status: errorStatusCode,
 				statusText: typeof error.data === "string" ? error.data : "Error"
-			}));
-			else {
-				logError(error);
-				return Fx.succeed(new Response(null, {
-					status: 500,
-					statusText: "Internal Server Error"
-				}));
-			}
-		})));
+			});
+			logError(error);
+			return new Response(null, {
+				status: 500,
+				statusText: "Internal Server Error"
+			});
+		}
 	};
 }
 function getCookies(request) {
 	return parse(request.headers.get("Cookie") ?? "");
 }
-function parseEnterpriseRuntimeRoute(pathname, routeBase) {
+function parseConnectionRuntimeRoute(pathname, routeBase) {
 	const runtimePrefix = `${routeBase}/`;
-	const [runtimeEnterpriseId, protocol, ...rest] = pathname.startsWith(runtimePrefix) ? pathname.slice(runtimePrefix.length).split("/").filter(Boolean) : [];
-	if (runtimeEnterpriseId === void 0 || protocol !== "oidc" && protocol !== "saml" && protocol !== "scim" || rest.length === 0) return null;
+	const [runtimeConnectionId, protocol, ...rest] = pathname.startsWith(runtimePrefix) ? pathname.slice(runtimePrefix.length).split("/").filter(Boolean) : [];
+	if (runtimeConnectionId === void 0 || protocol !== "oidc" && protocol !== "saml" && protocol !== "scim" || rest.length === 0) return null;
 	return {
 		pathname,
-		enterpriseId: runtimeEnterpriseId,
+		connectionId: runtimeConnectionId,
 		protocol,
 		rest
 	};
@@ -281,14 +281,30 @@ function addAuthRoutes(http, deps) {
 }
 function addSSORoutes(http, deps) {
 	const routePrefix = `${deps.routeBase}/`;
+	const sharedOidcCallbackPath = deps.sharedOidcCallbackPath ? (() => {
+		if (/^https?:\/\//.test(deps.sharedOidcCallbackPath)) return new URL(deps.sharedOidcCallbackPath).pathname;
+		return deps.sharedOidcCallbackPath.startsWith("/") ? deps.sharedOidcCallbackPath : `/${deps.sharedOidcCallbackPath}`;
+	})() : void 0;
+	if (sharedOidcCallbackPath) {
+		http.route({
+			path: sharedOidcCallbackPath,
+			method: "GET",
+			handler: httpActionGeneric(deps.convertErrorsToResponse(400, async (ctx, request) => deps.handleOidcSharedCallback(ctx, request)))
+		});
+		http.route({
+			path: sharedOidcCallbackPath,
+			method: "POST",
+			handler: httpActionGeneric(deps.convertErrorsToResponse(400, async (ctx, request) => deps.handleOidcSharedCallback(ctx, request)))
+		});
+	}
 	http.route({
 		pathPrefix: routePrefix,
 		method: "GET",
 		handler: httpActionGeneric(deps.convertErrorsToResponse(400, async (ctx, request) => {
-			const route = parseEnterpriseRuntimeRoute(new URL(request.url).pathname, deps.routeBase);
-			if (!route) throw Cv.error({
+			const route = parseConnectionRuntimeRoute(new URL(request.url).pathname, deps.routeBase);
+			if (!route) throw new ConvexError({
 				code: "INVALID_PARAMETERS",
-				message: "Invalid enterprise runtime path."
+				message: "Invalid connection runtime path."
 			});
 			if (route.protocol === "saml" && route.rest.length === 1) {
 				if (route.rest[0] === "metadata") return await deps.handleSamlMetadata(ctx, request, route);
@@ -301,9 +317,9 @@ function addSSORoutes(http, deps) {
 				if (route.rest[0] === "callback") return await deps.handleOidcCallback(ctx, request, route);
 			}
 			if (route.protocol === "scim" && route.rest[0] === "v2") return await deps.handleScimRequest(ctx, request);
-			throw Cv.error({
+			throw new ConvexError({
 				code: "INVALID_PARAMETERS",
-				message: "Invalid enterprise runtime path."
+				message: "Invalid connection runtime path."
 			});
 		}))
 	});
@@ -311,15 +327,15 @@ function addSSORoutes(http, deps) {
 		pathPrefix: routePrefix,
 		method: "POST",
 		handler: httpActionGeneric(deps.convertErrorsToResponse(400, async (ctx, request) => {
-			const route = parseEnterpriseRuntimeRoute(new URL(request.url).pathname, deps.routeBase);
+			const route = parseConnectionRuntimeRoute(new URL(request.url).pathname, deps.routeBase);
 			if (route?.protocol === "saml" && route.rest.length === 1) {
 				if (route.rest[0] === "acs") return await deps.handleSamlAcs(ctx, request, route);
 				if (route.rest[0] === "slo") return await deps.handleSamlSlo(ctx, request, route);
 			}
 			if (route?.protocol === "scim" && route.rest[0] === "v2") return await deps.handleScimRequest(ctx, request);
-			throw Cv.error({
+			throw new ConvexError({
 				code: "INVALID_PARAMETERS",
-				message: "Invalid enterprise runtime path."
+				message: "Invalid connection runtime path."
 			});
 		}))
 	});
@@ -327,11 +343,11 @@ function addSSORoutes(http, deps) {
 		pathPrefix: routePrefix,
 		method: "PUT",
 		handler: httpActionGeneric(deps.convertErrorsToResponse(400, async (ctx, request) => {
-			const route = parseEnterpriseRuntimeRoute(new URL(request.url).pathname, deps.routeBase);
+			const route = parseConnectionRuntimeRoute(new URL(request.url).pathname, deps.routeBase);
 			if (route?.protocol === "scim" && route.rest[0] === "v2") return await deps.handleScimRequest(ctx, request);
-			throw Cv.error({
+			throw new ConvexError({
 				code: "INVALID_PARAMETERS",
-				message: "Invalid enterprise runtime path."
+				message: "Invalid connection runtime path."
 			});
 		}))
 	});
@@ -339,7 +355,7 @@ function addSSORoutes(http, deps) {
 		pathPrefix: routePrefix,
 		method,
 		handler: httpActionGeneric(async (ctx, request) => {
-			const route = parseEnterpriseRuntimeRoute(new URL(request.url).pathname, deps.routeBase);
+			const route = parseConnectionRuntimeRoute(new URL(request.url).pathname, deps.routeBase);
 			if (!route || route.protocol !== "scim" || route.rest[0] !== "v2") return deps.scimError(404, "notFound", "SCIM resource not found.");
 			return await deps.handleScimRequest(ctx, request);
 		})

package/dist/server/identity.js

@@ -1,10 +1,10 @@
-import { Cv } from "@robelest/fx/convex";
+import { ConvexError } from "convex/values";
 
 //#region src/server/identity.ts
 /** @internal */
 function userIdFromIdentitySubject(subject) {
 	const [userId, ...rest] = subject.split("|");
-	if (typeof userId !== "string" || userId.length === 0 || rest.length === 0 || rest.some((segment) => segment.length === 0)) throw Cv.error({
+	if (typeof userId !== "string" || userId.length === 0 || rest.length === 0 || rest.some((segment) => segment.length === 0)) throw new ConvexError({
 		code: "INTERNAL_ERROR",
 		message: "Authenticated identity subject is malformed."
 	});

package/dist/server/index.d.ts

@@ -1,5 +1,6 @@
-import { AuthApi, AuthApiBase, AuthConfig, AuthContext, AuthContextConfig, ConvexAuthResult, InferAuth, InferClientApi, OptionalAuthContext, UserDoc, createAuth } from "./auth.js";
+import { AuthConfig, AuthContext, AuthContextConfig, InferAuth, OptionalAuthContext, UserDoc } from "./auth-context.js";
 import { HttpAuthContext, HttpAuthContextConfig, OptionalHttpAuthContext } from "./http.js";
-import { EnterpriseAdminAuthorizationInput, EnterpriseAdminPermission, EnterpriseAuthorizer, EnterpriseMountOptions, enterprise, scim, sso } from "./mounts.js";
-import { AuthCookie, AuthCookieConfig, AuthCookies, RefreshResult, ServerOptions, authCookieNames, parseAuthCookies, serializeAuthCookies, server, shouldProxyAuthAction, structuredAuthCookies } from "./ssr.js";
-export { type AuthApi, type AuthApiBase, type AuthConfig, type AuthContext, type AuthContextConfig, type AuthCookie, type AuthCookieConfig, type AuthCookies, type ConvexAuthResult, type EnterpriseAdminAuthorizationInput, type EnterpriseAdminPermission, type EnterpriseAuthorizer, type EnterpriseMountOptions, type HttpAuthContext, type HttpAuthContextConfig, type InferAuth, type InferClientApi, type OptionalAuthContext, type OptionalHttpAuthContext, type RefreshResult, type ServerOptions, type UserDoc, authCookieNames, createAuth, enterprise, parseAuthCookies, scim, serializeAuthCookies, server, shouldProxyAuthAction, sso, structuredAuthCookies };
+import { AuthApi, AuthApiBase, ConvexAuthResult, InferClientApi, createAuth } from "./auth.js";
+import { CreateAuthGroupSsoOptions, GroupSsoAccessHandler, GroupSsoAccessInput, GroupSsoAccessPermissions, GroupSsoPermission, GroupSsoResolvedAccessHandler, createAuthGroupSso, scim, sso } from "./mounts.js";
+import { AuthCookie, AuthCookieConfig, AuthCookies, RefreshResult, ServerOptions, authCookieNames, parseAuthCookies, serializeAuthCookies, server, shouldProxyAuthAction, structuredAuthCookies } from "./prefetch.js";
+export { type AuthApi, type AuthApiBase, type AuthConfig, type AuthContext, type AuthContextConfig, type AuthCookie, type AuthCookieConfig, type AuthCookies, type ConvexAuthResult, type CreateAuthGroupSsoOptions, type GroupSsoAccessHandler, type GroupSsoAccessInput, type GroupSsoAccessPermissions, type GroupSsoPermission, type GroupSsoResolvedAccessHandler, type HttpAuthContext, type HttpAuthContextConfig, type InferAuth, type InferClientApi, type OptionalAuthContext, type OptionalHttpAuthContext, type RefreshResult, type ServerOptions, type UserDoc, authCookieNames, createAuth, createAuthGroupSso, parseAuthCookies, scim, serializeAuthCookies, server, shouldProxyAuthAction, sso, structuredAuthCookies };

package/dist/server/index.js

@@ -1,5 +1,5 @@
 import { createAuth } from "./auth.js";
-import { enterprise, scim, sso } from "./mounts.js";
-import { authCookieNames, parseAuthCookies, serializeAuthCookies, server, shouldProxyAuthAction, structuredAuthCookies } from "./ssr.js";
+import { createAuthGroupSso, scim, sso } from "./mounts.js";
+import { authCookieNames, parseAuthCookies, serializeAuthCookies, server, shouldProxyAuthAction, structuredAuthCookies } from "./prefetch.js";
 
-export { authCookieNames, createAuth, enterprise, parseAuthCookies, scim, serializeAuthCookies, server, shouldProxyAuthAction, sso, structuredAuthCookies };
+export { authCookieNames, createAuth, createAuthGroupSso, parseAuthCookies, scim, serializeAuthCookies, server, shouldProxyAuthAction, sso, structuredAuthCookies };

package/dist/server/keys.js

@@ -1,6 +1,15 @@
-import { generateRandomString, sha256 } from "./utils.js";
+import { generateRandomString, sha256 } from "./random.js";
 
 //#region src/server/keys.ts
+/**
+* API Key crypto utilities.
+*
+* Uses `@oslojs/crypto` primitives for key generation and hashing:
+* - SHA-256 for hashing keys (API keys have high entropy, no need for bcrypt)
+* - Cryptographically secure random generation for key material
+*
+* @module
+*/
 const DEFAULT_KEY_PREFIX = "sk_";
 const KEY_RANDOM_LENGTH = 32;
 const KEY_RANDOM_ALPHABET = "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789";

package/dist/server/limits.js

@@ -1,51 +1,51 @@
 import { authDb } from "./db.js";
-import { Fx } from "@robelest/fx";
 
 //#region src/server/limits.ts
 const DEFAULT_MAX_SIGN_IN_ATTEMPTS_PER_HOUR = 10;
 /**
 * Check whether the given identifier is currently rate-limited.
+* @internal
 */
-/** @internal */
-const isSignInRateLimited = (ctx, identifier, config) => getRateLimitState(ctx, identifier, config).pipe(Fx.map((state) => state !== null && state.attemptsLeft < 1));
+async function isSignInRateLimited(ctx, identifier, config) {
+	const state = await getRateLimitState(ctx, identifier, config);
+	return state !== null && state.attemptsLeft < 1;
+}
 /**
 * Record a failed sign-in attempt for the given identifier.
-*
-* If a record exists, decrement; otherwise create.
+* @internal
 */
-/** @internal */
-const recordFailedSignIn = (ctx, identifier, config) => Fx.gen(function* () {
-	const state = yield* getRateLimitState(ctx, identifier, config);
-	if (state !== null) yield* Fx.promise(() => authDb(ctx, config).rateLimits.patch(state.limit._id, {
+async function recordFailedSignIn(ctx, identifier, config) {
+	const state = await getRateLimitState(ctx, identifier, config);
+	if (state !== null) await authDb(ctx, config).rateLimits.patch(state.limit._id, {
 		attemptsLeft: state.attemptsLeft - 1,
 		lastAttemptTime: Date.now()
-	}));
-	else yield* Fx.promise(() => authDb(ctx, config).rateLimits.create({
+	});
+	else await authDb(ctx, config).rateLimits.create({
 		identifier,
 		attemptsLeft: (config.signIn?.maxFailedAttemptsPerHour ?? DEFAULT_MAX_SIGN_IN_ATTEMPTS_PER_HOUR) - 1,
 		lastAttemptTime: Date.now()
-	}));
-});
+	});
+}
 /**
-* Reset the rate limit for the given identifier (e.g. after successful sign-in).
+* Reset the rate limit for the given identifier.
+* @internal
 */
-/** @internal */
-const resetSignInRateLimit = (ctx, identifier, config) => Fx.gen(function* () {
-	const state = yield* getRateLimitState(ctx, identifier, config);
-	if (state !== null) yield* Fx.promise(() => authDb(ctx, config).rateLimits.delete(state.limit._id));
-});
-const getRateLimitState = (ctx, identifier, config) => Fx.gen(function* () {
+async function resetSignInRateLimit(ctx, identifier, config) {
+	const state = await getRateLimitState(ctx, identifier, config);
+	if (state !== null) await authDb(ctx, config).rateLimits.delete(state.limit._id);
+}
+async function getRateLimitState(ctx, identifier, config) {
+	const typedLimit = await authDb(ctx, config).rateLimits.get(identifier);
+	if (typedLimit === null) return null;
 	const now = Date.now();
 	const maxAttemptsPerHour = config.signIn?.maxFailedAttemptsPerHour ?? DEFAULT_MAX_SIGN_IN_ATTEMPTS_PER_HOUR;
-	const limit = yield* Fx.promise(() => authDb(ctx, config).rateLimits.get(identifier));
-	if (limit === null) return null;
-	const elapsed = now - limit.lastAttemptTime;
+	const elapsed = now - typedLimit.lastAttemptTime;
 	const maxAttemptsPerMs = maxAttemptsPerHour / (3600 * 1e3);
 	return {
-		limit,
-		attemptsLeft: Math.min(maxAttemptsPerHour, limit.attemptsLeft + elapsed * maxAttemptsPerMs)
+		limit: typedLimit,
+		attemptsLeft: Math.min(maxAttemptsPerHour, typedLimit.attemptsLeft + elapsed * maxAttemptsPerMs)
 	};
-});
+}
 
 //#endregion
 export { isSignInRateLimited, recordFailedSignIn, resetSignInRateLimit };

package/dist/server/log.js

@@ -0,0 +1,28 @@
+import { LOG_LEVELS, logMessage } from "../shared/log.js";
+import { envBoolean, envOptionalString, readConfigSync } from "./env.js";
+
+//#region src/server/log.ts
+const configuredLogLevel = LOG_LEVELS[readConfigSync(envOptionalString("AUTH_LOG_LEVEL")) ?? "INFO"] ?? "INFO";
+const shouldRedactSecrets = !readConfigSync(envBoolean("AUTH_LOG_SECRETS") ?? false);
+/** @internal */
+function log(level, ...args) {
+	return logMessage("convex-auth", level, args, configuredLogLevel);
+}
+/** @internal */
+function logError(error) {
+	return log(LOG_LEVELS.ERROR, error instanceof Error ? error.message + "\n" + error.stack?.replace("\\n", "\n") : error);
+}
+const UNREDACTED_LENGTH = 5;
+/** @internal */
+function maybeRedact(value) {
+	if (value === "") return "";
+	if (shouldRedactSecrets) {
+		if (value.length < UNREDACTED_LENGTH * 2) return "<redacted>";
+		return value.substring(0, UNREDACTED_LENGTH) + "<redacted>" + value.substring(value.length - UNREDACTED_LENGTH);
+	}
+	return value;
+}
+
+//#endregion
+export { log, logError, maybeRedact };
+//# sourceMappingURL=log.js.map