@robelest/convex-auth 0.0.4-preview.25 → 0.0.4-preview.28

package/dist/server/mutations/account.js

@@ -1,10 +1,9 @@
-import { LOG_LEVELS, logWithLevel, maybeRedact } from "../utils.js";
+import { LOG_LEVELS } from "../../shared/log.js";
 import { hash } from "../crypto.js";
 import { authDb } from "../db.js";
+import { log, maybeRedact } from "../log.js";
 import { AUTH_STORE_REF } from "./store/refs.js";
-import { Fx } from "@robelest/fx";
-import { Cv } from "@robelest/fx/convex";
-import { v } from "convex/values";
+import { ConvexError, v } from "convex/values";
 
 //#region src/server/mutations/account.ts
 const modifyAccountArgs = v.object({
@@ -14,25 +13,23 @@ const modifyAccountArgs = v.object({
 		secret: v.string()
 	})
 });
-function modifyAccountImpl(ctx, args, getProviderOrThrow, config) {
+async function modifyAccountImpl(ctx, args, getProviderOrThrow, config) {
 	const { provider, account } = args;
 	const db = authDb(ctx, config);
-	logWithLevel(LOG_LEVELS.DEBUG, "modifyAccountImpl args:", {
+	log(LOG_LEVELS.DEBUG, "modifyAccountImpl args:", {
 		provider,
 		account: {
 			id: account.id,
 			secret: maybeRedact(account.secret ?? "")
 		}
 	});
-	return Fx.gen(function* () {
-		const existingAccount = yield* Fx.promise(() => db.accounts.get(provider, account.id));
-		if (existingAccount === null) return yield* Cv.fail({
-			code: "ACCOUNT_NOT_FOUND",
-			message: `Cannot modify account with ID ${account.id} because it does not exist`
-		});
-		const hashedSecret = yield* hash(getProviderOrThrow(provider), account.secret);
-		yield* Fx.promise(() => db.accounts.patch(existingAccount._id, { secret: hashedSecret }));
+	const existingAccount = await db.accounts.get(provider, account.id);
+	if (existingAccount === null) throw new ConvexError({
+		code: "ACCOUNT_NOT_FOUND",
+		message: `Cannot modify account with ID ${account.id} because it does not exist`
 	});
+	const hashedSecret = await hash(getProviderOrThrow(provider), account.secret);
+	await db.accounts.patch(existingAccount._id, { secret: hashedSecret });
 }
 const callModifyAccount = async (ctx, args) => {
 	return ctx.runMutation(AUTH_STORE_REF, { args: {

package/dist/server/mutations/code.js

@@ -1,10 +1,11 @@
-import { LOG_LEVELS, logWithLevel, sha256 } from "../utils.js";
+import { LOG_LEVELS } from "../../shared/log.js";
+import { sha256 } from "../random.js";
 import { authDb } from "../db.js";
+import { log } from "../log.js";
 import { AUTH_STORE_REF } from "./store/refs.js";
 import { getAuthSessionId } from "../sessions.js";
 import { upsertUserAndAccount } from "../users.js";
-import { Cv } from "@robelest/fx/convex";
-import { v } from "convex/values";
+import { ConvexError, v } from "convex/values";
 
 //#region src/server/mutations/code.ts
 const createVerificationCodeArgs = v.object({
@@ -17,12 +18,12 @@ const createVerificationCodeArgs = v.object({
 	allowExtraProviders: v.boolean()
 });
 async function createVerificationCodeImpl(ctx, args, getProviderOrThrow, config) {
-	logWithLevel(LOG_LEVELS.DEBUG, "createVerificationCodeImpl args:", args);
+	log(LOG_LEVELS.DEBUG, "createVerificationCodeImpl args:", args);
 	const { email, phone, code, expirationTime, provider: providerId, accountId: existingAccountId, allowExtraProviders } = args;
 	const db = authDb(ctx, config);
 	const typedExistingAccountId = existingAccountId;
 	const existingAccount = typedExistingAccountId !== void 0 ? await db.accounts.getById(typedExistingAccountId) ?? (() => {
-		throw Cv.error({
+		throw new ConvexError({
 			code: "ACCOUNT_NOT_FOUND",
 			message: `Expected an account to exist for ID "${typedExistingAccountId}"`
 		});

package/dist/server/mutations/invalidate.js

@@ -1,8 +1,8 @@
-import { LOG_LEVELS, logWithLevel } from "../utils.js";
+import { LOG_LEVELS } from "../../shared/log.js";
 import { authDb } from "../db.js";
+import { log } from "../log.js";
 import { AUTH_STORE_REF } from "./store/refs.js";
 import { deleteSession } from "../sessions.js";
-import { Fx } from "@robelest/fx";
 import { v } from "convex/values";
 
 //#region src/server/mutations/invalidate.ts
@@ -16,15 +16,13 @@ const callInvalidateSessions = async (ctx, args) => {
 		...args
 	} });
 };
-function invalidateSessionsImpl(ctx, args, config) {
-	return Fx.gen(function* () {
-		logWithLevel(LOG_LEVELS.DEBUG, "invalidateSessionsImpl args:", args);
-		const { userId, except } = args;
-		const exceptSet = new Set(except ?? []);
-		const typedUserId = userId;
-		const sessions = yield* Fx.promise(() => authDb(ctx, config).sessions.listByUser(typedUserId));
-		yield* Fx.each(sessions, (session) => exceptSet.has(session._id) ? Fx.unit : Fx.promise(() => deleteSession(ctx, session, config)));
-	});
+async function invalidateSessionsImpl(ctx, args, config) {
+	log(LOG_LEVELS.DEBUG, "invalidateSessionsImpl args:", args);
+	const { userId, except } = args;
+	const exceptSet = new Set(except ?? []);
+	const typedUserId = userId;
+	const sessions = await authDb(ctx, config).sessions.listByUser(typedUserId);
+	await Promise.all(sessions.map((session) => exceptSet.has(session._id) ? Promise.resolve() : deleteSession(ctx, session, config)));
 }
 
 //#endregion

package/dist/server/mutations/oauth.js

@@ -1,22 +1,23 @@
-import { generateRandomString, logWithLevel, sha256 } from "../utils.js";
+import { generateRandomString, sha256 } from "../random.js";
 import { authDb } from "../db.js";
+import { log } from "../log.js";
 import { AUTH_STORE_REF } from "./store/refs.js";
 import { upsertUserAndAccount } from "../users.js";
-import { ENTERPRISE_OIDC_PROVIDER_PREFIX, ENTERPRISE_SAML_PROVIDER_PREFIX, isEnterpriseProviderId } from "../enterprise/shared.js";
-import { createSyntheticOAuthMaterializedConfig } from "../enterprise/oidc.js";
-import { normalizeEnterprisePolicy } from "../enterprise/policy.js";
-import { Fx } from "@robelest/fx";
-import { Cv } from "@robelest/fx/convex";
-import { v } from "convex/values";
+import { getGroup, getGroupConnection } from "../contract.js";
+import { accountExtendValidator, payloadRecordValidator } from "../payloads.js";
+import { GROUP_OIDC_PROVIDER_PREFIX, GROUP_SAML_PROVIDER_PREFIX, isGroupProviderId } from "../sso/shared.js";
+import { createSyntheticOAuthMaterializedConfig } from "../sso/oidc.js";
+import { normalizeGroupConnectionPolicy, resolveProvisionedRoleIds } from "../sso/policy.js";
+import { ConvexError, v } from "convex/values";
 
 //#region src/server/mutations/oauth.ts
 const OAUTH_SIGN_IN_EXPIRATION_MS = 1e3 * 60 * 2;
 const userOAuthArgs = v.object({
 	provider: v.string(),
 	providerAccountId: v.string(),
-	profile: v.any(),
+	profile: payloadRecordValidator,
 	signature: v.string(),
-	accountExtend: v.optional(v.any())
+	accountExtend: v.optional(accountExtendValidator)
 });
 function normalizeAccountExtend(provider, providerAccountId, accountExtend) {
 	const baseIdentity = {
@@ -24,16 +25,16 @@ function normalizeAccountExtend(provider, providerAccountId, accountExtend) {
 		provider,
 		providerAccountId
 	};
-	if (provider.startsWith(ENTERPRISE_OIDC_PROVIDER_PREFIX)) {
-		baseIdentity.type = "enterprise-oidc";
-		baseIdentity.enterpriseId = provider.slice(ENTERPRISE_OIDC_PROVIDER_PREFIX.length);
+	if (provider.startsWith(GROUP_OIDC_PROVIDER_PREFIX)) {
+		baseIdentity.type = "group-connection-oidc";
+		baseIdentity.connectionId = provider.slice(GROUP_OIDC_PROVIDER_PREFIX.length);
 	}
-	if (provider.startsWith(ENTERPRISE_SAML_PROVIDER_PREFIX)) {
-		baseIdentity.type = "enterprise-saml";
-		baseIdentity.enterpriseId = provider.slice(ENTERPRISE_SAML_PROVIDER_PREFIX.length);
+	if (provider.startsWith(GROUP_SAML_PROVIDER_PREFIX)) {
+		baseIdentity.type = "group-connection-saml";
+		baseIdentity.connectionId = provider.slice(GROUP_SAML_PROVIDER_PREFIX.length);
 	}
-	const provided = typeof accountExtend === "object" && accountExtend !== null && !Array.isArray(accountExtend) ? accountExtend : void 0;
-	const providedIdentity = provided && typeof provided.identity === "object" && provided.identity !== null && !Array.isArray(provided.identity) ? provided.identity : void 0;
+	const provided = accountExtend;
+	const providedIdentity = provided?.identity;
 	return {
 		...provided,
 		identity: {
@@ -42,67 +43,105 @@ function normalizeAccountExtend(provider, providerAccountId, accountExtend) {
 		}
 	};
 }
-function userOAuthImpl(ctx, args, getProviderOrThrow, config) {
-	return Fx.gen(function* () {
-		logWithLevel("DEBUG", "userOAuthImpl args:", args);
-		const { profile, provider, providerAccountId, signature, accountExtend } = args;
-		const db = authDb(ctx, config);
-		const existingAccount = yield* Fx.promise(() => db.accounts.get(provider, providerAccountId));
-		const enterpriseId = provider.startsWith(ENTERPRISE_OIDC_PROVIDER_PREFIX) ? provider.slice(ENTERPRISE_OIDC_PROVIDER_PREFIX.length) : provider.startsWith(ENTERPRISE_SAML_PROVIDER_PREFIX) ? provider.slice(ENTERPRISE_SAML_PROVIDER_PREFIX.length) : null;
-		const enterprise = enterpriseId !== null ? yield* Fx.promise(() => ctx.runQuery(config.component.public.enterpriseGet, { enterpriseId })) : null;
-		const enterprisePolicy = enterprise ? normalizeEnterprisePolicy(enterprise.policy) : null;
-		const enterpriseProtocol = provider.startsWith(ENTERPRISE_OIDC_PROVIDER_PREFIX) ? "oidc" : provider.startsWith(ENTERPRISE_SAML_PROVIDER_PREFIX) ? "saml" : null;
-		const existingScimIdentity = enterpriseId !== null && existingAccount === null && enterprisePolicy?.provisioning.scimReuse.user === "externalId" ? yield* Fx.promise(() => ctx.runQuery(config.component.public.enterpriseScimIdentityGet, {
-			enterpriseId,
-			resourceType: "user",
-			externalId: providerAccountId
-		})) : null;
-		const verifier = yield* Fx.from({
-			ok: () => db.verifiers.getBySignature(signature),
-			err: () => Cv.error({
-				code: "OAUTH_INVALID_STATE",
-				message: "Invalid OAuth state. Please try signing in again."
-			})
-		}).pipe(Fx.chain((doc) => doc === null ? Cv.fail({
+async function userOAuthImpl(ctx, args, getProviderOrThrow, config) {
+	log("DEBUG", "userOAuthImpl args:", args);
+	const { profile, provider, providerAccountId, signature, accountExtend } = args;
+	const typedProfile = profile;
+	const db = authDb(ctx, config);
+	const connectionId = provider.startsWith(GROUP_OIDC_PROVIDER_PREFIX) ? provider.slice(GROUP_OIDC_PROVIDER_PREFIX.length) : provider.startsWith(GROUP_SAML_PROVIDER_PREFIX) ? provider.slice(GROUP_SAML_PROVIDER_PREFIX.length) : null;
+	const connectionProtocol = provider.startsWith(GROUP_OIDC_PROVIDER_PREFIX) ? "oidc" : provider.startsWith(GROUP_SAML_PROVIDER_PREFIX) ? "saml" : null;
+	const existingAccount = await db.accounts.get(provider, providerAccountId);
+	const connection = connectionId !== null ? await getGroupConnection(ctx, config.component.public, connectionId) : null;
+	const group = connection !== null ? await getGroup(ctx, config.component.public, connection.groupId) : null;
+	const connectionPolicy = connection ? normalizeGroupConnectionPolicy(group?.policy) : null;
+	const existingScimIdentity = connectionId !== null && existingAccount === null && connectionPolicy?.provisioning.scimReuse.user === "externalId" ? await ctx.runQuery(config.component.public.groupConnectionScimIdentityGet, {
+		connectionId,
+		resourceType: "user",
+		externalId: providerAccountId
+	}) : null;
+	let verifier;
+	try {
+		verifier = await db.verifiers.getBySignature(signature);
+	} catch {
+		throw new ConvexError({
 			code: "OAUTH_INVALID_STATE",
 			message: "Invalid OAuth state. Please try signing in again."
-		}) : Fx.succeed(doc)));
-		const { accountId } = yield* Fx.promise(() => upsertUserAndAccount(ctx, verifier.sessionId ?? null, existingAccount !== null ? { existingAccount } : { providerAccountId }, {
-			type: "oauth",
-			provider: isEnterpriseProviderId(provider) ? createSyntheticOAuthMaterializedConfig(provider, { accountLinking: enterpriseProtocol === "oidc" ? enterprisePolicy?.identity.accountLinking.oidc : enterpriseProtocol === "saml" ? enterprisePolicy?.identity.accountLinking.saml : void 0 }) : getProviderOrThrow(provider),
-			profile,
-			accountExtend: normalizeAccountExtend(provider, providerAccountId, accountExtend)
-		}, config, existingScimIdentity?.userId ? { existingUserId: existingScimIdentity.userId } : void 0));
-		if (enterpriseId !== null && enterprisePolicy?.provisioning.jit.mode === "createUserAndMembership") {
-			const userId = (yield* Fx.promise(() => db.accounts.getById(accountId)))?.userId;
-			if (userId) {
-				const groupId = enterprise?.groupId;
-				if (groupId) {
-					if ((yield* Fx.promise(() => ctx.runQuery(config.component.public.memberGetByGroupAndUser, {
-						userId,
-						groupId
-					}))) === null) yield* Fx.promise(() => ctx.runMutation(config.component.public.memberAdd, {
-						groupId,
-						userId,
-						roleIds: enterprisePolicy.provisioning.jit.defaultRoleIds,
-						status: "active"
-					}));
-				}
+		});
+	}
+	if (verifier === null) throw new ConvexError({
+		code: "OAUTH_INVALID_STATE",
+		message: "Invalid OAuth state. Please try signing in again."
+	});
+	const profileResolved = (config.sso?.hooks?.profileResolved ? await config.sso.hooks.profileResolved({
+		protocol: connectionProtocol ?? "oidc",
+		connectionId: connectionId ?? void 0,
+		profile: typedProfile
+	}) : void 0) ?? typedProfile;
+	const profileForProvisioning = (config.sso?.hooks?.beforeProvision ? await config.sso.hooks.beforeProvision({
+		protocol: connectionProtocol ?? "oidc",
+		connectionId: connectionId ?? void 0,
+		profile: profileResolved
+	}) : void 0) ?? profileResolved;
+	const { accountId } = await upsertUserAndAccount(ctx, verifier.sessionId ?? null, existingAccount !== null ? { existingAccount } : { providerAccountId }, {
+		type: "oauth",
+		provider: isGroupProviderId(provider) ? createSyntheticOAuthMaterializedConfig(provider, { accountLinking: connectionProtocol === "oidc" ? connectionPolicy?.identity.accountLinking.oidc : connectionProtocol === "saml" ? connectionPolicy?.identity.accountLinking.saml : void 0 }) : getProviderOrThrow(provider),
+		profile: profileForProvisioning,
+		accountExtend: normalizeAccountExtend(provider, providerAccountId, accountExtend)
+	}, config, connectionPolicy?.provisioning.user ? {
+		existingUserId: existingScimIdentity?.userId,
+		provisioningUser: connectionPolicy.provisioning.user,
+		source: "login"
+	} : existingScimIdentity?.userId ? { existingUserId: existingScimIdentity.userId } : void 0);
+	if (connectionId !== null && connectionPolicy?.provisioning.jit.mode === "createUserAndMembership") {
+		const userId = (await db.accounts.getById(accountId))?.userId;
+		if (userId) {
+			const groupId = connection?.groupId;
+			if (groupId) {
+				const provisionedRoleIds = resolveProvisionedRoleIds({
+					policy: connectionPolicy,
+					groups: Array.isArray(typedProfile.groups) ? typedProfile.groups : void 0,
+					roles: Array.isArray(typedProfile.roles) ? typedProfile.roles : void 0
+				});
+				const existingMembership = await ctx.runQuery(config.component.public.memberGetByGroupAndUser, {
+					userId,
+					groupId
+				});
+				if (existingMembership === null) await ctx.runMutation(config.component.public.memberAdd, {
+					groupId,
+					userId,
+					roleIds: provisionedRoleIds,
+					status: "active"
+				});
+				else if (provisionedRoleIds.length > 0) await ctx.runMutation(config.component.public.memberUpdate, {
+					memberId: existingMembership._id,
+					data: { roleIds: provisionedRoleIds }
+				});
 			}
 		}
-		const code = generateRandomString(8, "0123456789");
-		yield* Fx.promise(() => db.verifiers.delete(verifier._id));
-		const existingVerificationCode = yield* Fx.promise(() => db.verificationCodes.getByAccountId(accountId));
-		if (existingVerificationCode !== null) yield* Fx.promise(() => db.verificationCodes.delete(existingVerificationCode._id));
-		yield* Fx.promise(async () => db.verificationCodes.create({
-			code: await sha256(code),
-			accountId,
-			provider,
-			expirationTime: Date.now() + OAUTH_SIGN_IN_EXPIRATION_MS,
-			verifier: verifier._id
-		}));
-		return code;
+	}
+	if (connectionId !== null) {
+		const userId = (await db.accounts.getById(accountId))?.userId;
+		if (userId) {
+			if (config.sso?.hooks?.afterProvision) await config.sso.hooks.afterProvision({
+				protocol: connectionProtocol ?? "oidc",
+				connectionId,
+				profile: profileForProvisioning,
+				userId
+			});
+		}
+	}
+	const code = generateRandomString(8, "0123456789");
+	await db.verifiers.delete(verifier._id);
+	const existingVerificationCode = await db.verificationCodes.getByAccountId(accountId);
+	if (existingVerificationCode !== null) await db.verificationCodes.delete(existingVerificationCode._id);
+	await db.verificationCodes.create({
+		code: await sha256(code),
+		accountId,
+		provider,
+		expirationTime: Date.now() + OAUTH_SIGN_IN_EXPIRATION_MS,
+		verifier: verifier._id
 	});
+	return code;
 }
 const callUserOAuth = async (ctx, args) => {
 	return ctx.runMutation(AUTH_STORE_REF, { args: {

package/dist/server/mutations/refresh.js

@@ -1,112 +1,62 @@
-import { logWithLevel, maybeRedact } from "../utils.js";
 import { authDb } from "../db.js";
+import { log, maybeRedact } from "../log.js";
 import { AUTH_STORE_REF } from "./store/refs.js";
-import { REFRESH_TOKEN_REUSE_WINDOW_MS, invalidateRefreshTokensInSubtree, parseRefreshToken, refreshTokenIfValid } from "../refresh.js";
+import { REFRESH_TOKEN_REUSE_WINDOW_MS, parseRefreshToken, refreshTokenExpirationTime } from "../refresh.js";
 import { generateTokensForSession } from "../sessions.js";
-import { Fx } from "@robelest/fx";
+import { withSpan } from "../utils/span.js";
 import { v } from "convex/values";
 
 //#region src/server/mutations/refresh.ts
 const refreshSessionArgs = v.object({ refreshToken: v.string() });
-/** A soft refresh failure — logged and collapsed to null at the boundary. */
-var RefreshFailure = class {
-	_tag = "RefreshFailure";
-	constructor(reason) {
-		this.reason = reason;
-	}
-};
-async function refreshSessionImpl(ctx, args, _getProviderOrThrow, config) {
+async function refreshSessionImpl(ctx, args, config) {
 	const db = authDb(ctx, config);
-	const { refreshToken } = args;
-	return Fx.run(parseRefreshToken(refreshToken).pipe(Fx.recover((err) => Fx.fail(new RefreshFailure(err.data.message))), Fx.tap(({ refreshTokenId, sessionId: tokenSessionId }) => Fx.sync(() => logWithLevel("DEBUG", `refreshSessionImpl args: Token ID: ${maybeRedact(refreshTokenId)} Session ID: ${maybeRedact(tokenSessionId)}`))), Fx.chain(({ refreshTokenId, sessionId: tokenSessionId }) => refreshTokenIfValid(ctx, refreshTokenId, tokenSessionId, config).pipe(Fx.chain((validationResult) => validationResult === null ? Fx.gen(function* () {
-		yield* Fx.from({
-			ok: async () => {
-				const session = await db.sessions.getById(tokenSessionId);
-				if (session !== null) await db.sessions.delete(session._id);
-			},
-			err: () => new RefreshFailure("Skipping invalid session id during refresh cleanup")
-		}).pipe(Fx.recover((f) => {
-			logWithLevel("DEBUG", f.reason);
-			return Fx.succeed(void 0);
-		}));
-		yield* Fx.from({
-			ok: () => authDb(ctx, config).refreshTokens.deleteAll(tokenSessionId),
-			err: () => new RefreshFailure("Skipping invalid token session id during refresh token cleanup")
-		}).pipe(Fx.recover((f) => {
-			logWithLevel("DEBUG", f.reason);
-			return Fx.succeed(void 0);
-		}));
-		return null;
-	}) : (() => {
-		const { session } = validationResult;
-		const sessionId = session._id;
-		const userId = session.userId;
-		const tokenFirstUsed = validationResult.refreshTokenDoc.firstUsedTime;
-		return tokenFirstUsed === void 0 ? Fx.from({
-			ok: async () => {
-				await db.refreshTokens.patch(refreshTokenId, { firstUsedTime: Date.now() });
-				const result = await generateTokensForSession(ctx, config, {
-					userId,
+	return withSpan("convex-auth.refresh.session", { hasRefreshToken: true }, async () => {
+		try {
+			let refreshTokenId;
+			let sessionId;
+			try {
+				({refreshTokenId, sessionId} = parseRefreshToken(args.refreshToken));
+			} catch {
+				throw new RefreshFailure("Failed to parse refresh token");
+			}
+			log("DEBUG", `refreshSessionImpl args: Token ID: ${maybeRedact(refreshTokenId)} Session ID: ${maybeRedact(sessionId)}`);
+			let exchanged;
+			try {
+				exchanged = await db.refreshTokens.exchange({
+					refreshTokenId,
 					sessionId,
-					issuedRefreshTokenId: null,
-					parentRefreshTokenId: refreshTokenId
+					now: Date.now(),
+					refreshTokenExpirationTime: refreshTokenExpirationTime(config),
+					reuseWindowMs: REFRESH_TOKEN_REUSE_WINDOW_MS
 				});
-				const { refreshTokenId: newRefreshTokenId } = await Fx.run(parseRefreshToken(result.refreshToken));
-				logWithLevel("DEBUG", `Exchanged ${maybeRedact(validationResult.refreshTokenDoc._id)} (first use) for new refresh token ${maybeRedact(newRefreshTokenId)}`);
-				return result;
-			},
-			err: () => new RefreshFailure("Failed during first-use token exchange")
-		}) : Fx.from({
-			ok: () => authDb(ctx, config).refreshTokens.getActive(tokenSessionId),
-			err: () => new RefreshFailure("Failed to load active refresh token")
-		}).pipe(Fx.chain((activeRefreshToken) => {
-			logWithLevel("DEBUG", `Active refresh token: ${maybeRedact(activeRefreshToken?._id ?? "(none)")}, parent ${maybeRedact(activeRefreshToken?.parentRefreshTokenId ?? "(none)")}`);
-			const reuseDispatch = activeRefreshToken !== null && activeRefreshToken.parentRefreshTokenId === refreshTokenId ? {
-				tag: "parentOfActive",
-				activeRefreshToken
-			} : tokenFirstUsed + REFRESH_TOKEN_REUSE_WINDOW_MS > Date.now() ? { tag: "withinReuseWindow" } : { tag: "outsideReuseWindow" };
-			if (reuseDispatch.tag === "parentOfActive") return Fx.from({
-				ok: () => generateTokensForSession(ctx, config, {
-					userId,
-					sessionId,
-					issuedRefreshTokenId: reuseDispatch.activeRefreshToken._id,
-					parentRefreshTokenId: refreshTokenId
-				}),
-				err: () => new RefreshFailure("Failed to generate tokens for parent reuse")
-			}).pipe(Fx.tap(() => Fx.sync(() => logWithLevel("DEBUG", `Token ${maybeRedact(validationResult.refreshTokenDoc._id)} is parent of active refresh token ${maybeRedact(reuseDispatch.activeRefreshToken._id)}, so returning that token`))));
-			if (reuseDispatch.tag === "withinReuseWindow") return Fx.from({
-				ok: async () => {
-					const result = await generateTokensForSession(ctx, config, {
-						userId,
-						sessionId,
-						issuedRefreshTokenId: null,
-						parentRefreshTokenId: refreshTokenId
-					});
-					const { refreshTokenId: newRefreshTokenId } = await Fx.run(parseRefreshToken(result.refreshToken));
-					logWithLevel("DEBUG", `Exchanged ${maybeRedact(validationResult.refreshTokenDoc._id)} (reuse) for new refresh token ${maybeRedact(newRefreshTokenId)}`);
-					return result;
-				},
-				err: () => new RefreshFailure("Failed to generate tokens for reuse window")
-			});
-			logWithLevel("ERROR", "Refresh token used outside of reuse window");
-			logWithLevel("DEBUG", `Token ${maybeRedact(validationResult.refreshTokenDoc._id)} being used outside of reuse window, so invalidating all refresh tokens in subtree`);
-			return Fx.from({
-				ok: async () => {
-					const tokensToInvalidate = await invalidateRefreshTokensInSubtree(ctx, validationResult.refreshTokenDoc, config);
-					logWithLevel("DEBUG", `Invalidated ${tokensToInvalidate.length} refresh tokens in subtree: ${tokensToInvalidate.map((token) => maybeRedact(token._id)).join(", ")}`);
-					return null;
-				},
-				err: () => new RefreshFailure("Failed to invalidate refresh tokens in subtree")
-			});
-		}));
-	})()))), Fx.fold({
-		ok: (result) => result,
-		err: (failure) => {
-			logWithLevel("DEBUG", failure.reason);
-			return null;
+			} catch {
+				throw new RefreshFailure("Failed to exchange refresh token");
+			}
+			if (exchanged === null) return null;
+			try {
+				return await generateTokensForSession(config, {
+					userId: exchanged.userId,
+					sessionId: exchanged.sessionId,
+					refreshTokenId: exchanged.refreshTokenId
+				});
+			} catch {
+				throw new RefreshFailure("Failed to generate refresh-session tokens");
+			}
+		} catch (e) {
+			if (e instanceof RefreshFailure) {
+				log("DEBUG", e.reason);
+				return null;
+			}
+			throw e;
 		}
-	})));
+	});
 }
+var RefreshFailure = class extends Error {
+	constructor(reason) {
+		super(reason);
+		this.reason = reason;
+	}
+};
 const callRefreshSession = async (ctx, args) => {
 	return ctx.runMutation(AUTH_STORE_REF, { args: {
 		type: "refreshSession",

package/dist/server/mutations/register.js

@@ -1,12 +1,12 @@
-import { LOG_LEVELS, logWithLevel, maybeRedact } from "../utils.js";
+import { LOG_LEVELS } from "../../shared/log.js";
 import { hash, verify } from "../crypto.js";
 import { authDb } from "../db.js";
+import { log, maybeRedact } from "../log.js";
 import { AUTH_STORE_REF } from "./store/refs.js";
 import { getAuthSessionId } from "../sessions.js";
 import { upsertUserAndAccount } from "../users.js";
-import { Fx } from "@robelest/fx";
-import { Cv } from "@robelest/fx/convex";
-import { v } from "convex/values";
+import { payloadRecordValidator } from "../payloads.js";
+import { ConvexError, v } from "convex/values";
 
 //#region src/server/mutations/register.ts
 const createAccountFromCredentialsArgs = v.object({
@@ -15,12 +15,12 @@ const createAccountFromCredentialsArgs = v.object({
 		id: v.string(),
 		secret: v.optional(v.string())
 	}),
-	profile: v.any(),
+	profile: payloadRecordValidator,
 	shouldLinkViaEmail: v.optional(v.boolean()),
 	shouldLinkViaPhone: v.optional(v.boolean())
 });
 async function createAccountFromCredentialsImpl(ctx, args, getProviderOrThrow, config) {
-	logWithLevel(LOG_LEVELS.DEBUG, "createAccountFromCredentialsImpl args:", {
+	log(LOG_LEVELS.DEBUG, "createAccountFromCredentialsImpl args:", {
 		provider: args.provider,
 		account: {
 			id: args.account.id,
@@ -30,50 +30,52 @@ async function createAccountFromCredentialsImpl(ctx, args, getProviderOrThrow, c
 	const { provider: providerId, account, profile, shouldLinkViaEmail, shouldLinkViaPhone } = args;
 	const db = authDb(ctx, config);
 	const provider = getProviderOrThrow(providerId);
-	return Fx.run(Fx.gen(function* () {
-		const existingAccount = yield* Fx.promise(() => db.accounts.get(provider.id, account.id));
-		if (existingAccount !== null) {
-			if (account.secret !== void 0) {
-				if (!(yield* verify(provider, account.secret, existingAccount.secret ?? ""))) return yield* Cv.fail({
-					code: "ACCOUNT_ALREADY_EXISTS",
-					message: `Account ${account.id} already exists`
-				});
-			}
-			const user = yield* Fx.promise(() => db.users.getById(existingAccount.userId));
-			if (user === null) return yield* Cv.fail({
-				code: "ACCOUNT_NOT_FOUND",
-				message: `Linked user for account ${account.id} was not found.`
-			});
-			return {
-				account: existingAccount,
-				user
-			};
-		}
-		const secret = account.secret !== void 0 ? yield* hash(provider, account.secret) : void 0;
-		const { userId, accountId } = yield* Fx.promise(async () => upsertUserAndAccount(ctx, await getAuthSessionId(ctx), {
+	const typedProfile = profile;
+	const existingAccount = await db.accounts.get(provider.id, account.id);
+	if (existingAccount === null) {
+		const accountSecret = account.secret;
+		const secret = accountSecret === void 0 ? void 0 : await hash(provider, accountSecret);
+		const { userId, accountId } = await upsertUserAndAccount(ctx, await getAuthSessionId(ctx), {
 			providerAccountId: account.id,
 			secret
 		}, {
 			type: "credentials",
 			provider,
-			profile,
+			profile: typedProfile,
 			shouldLinkViaEmail,
 			shouldLinkViaPhone
-		}, config));
-		const [createdAccount, createdUser] = yield* Fx.zip(Fx.promise(() => db.accounts.getById(accountId)), Fx.promise(() => db.users.getById(userId)));
-		if (createdAccount === null) return yield* Cv.fail({
+		}, config);
+		const [createdAccount, createdUser] = await Promise.all([db.accounts.getById(accountId), db.users.getById(userId)]);
+		if (createdAccount === null) throw new ConvexError({
 			code: "ACCOUNT_NOT_FOUND",
-			message: `Created account was not found.`
+			message: "Created account was not found."
 		});
-		if (createdUser === null) return yield* Cv.fail({
+		if (createdUser === null) throw new ConvexError({
 			code: "USER_UPDATE_FAILED",
-			message: `Created user was not found.`
+			message: "Created user was not found."
 		});
 		return {
 			account: createdAccount,
 			user: createdUser
 		};
-	}));
+	} else {
+		if (account.secret !== void 0) {
+			const accountSecret = account.secret;
+			if (!await verify(provider, accountSecret, existingAccount.secret ?? "")) throw new ConvexError({
+				code: "INVALID_CREDENTIALS",
+				message: "Invalid credentials."
+			});
+		}
+		const user = await db.users.getById(existingAccount.userId);
+		if (user === null) throw new ConvexError({
+			code: "ACCOUNT_NOT_FOUND",
+			message: `Linked user for account ${account.id} was not found.`
+		});
+		return {
+			account: existingAccount,
+			user
+		};
+	}
 }
 const callCreateAccountFromCredentials = async (ctx, args) => {
 	return ctx.runMutation(AUTH_STORE_REF, { args: {