@robelest/convex-auth 0.0.4-preview.25 → 0.0.4-preview.28

package/dist/server/runtime.js

@@ -1,34 +1,35 @@
-import { configDefaults, listAvailableProviders } from "./config.js";
-import { LOG_LEVELS, decryptSecret, encryptSecret, generateRandomString, logError, logWithLevel, requireEnv, sha256 } from "./utils.js";
-import { redirectToParamCookie, useRedirectToParam } from "./cookies.js";
+import { LOG_LEVELS } from "../shared/log.js";
+import { generateRandomString, sha256 } from "./random.js";
+import { createCoreDomains } from "./core.js";
+import { requireEnv } from "./env.js";
+import { log, logError } from "./log.js";
 import { callModifyAccount } from "./mutations/account.js";
 import { callInvalidateSessions } from "./mutations/invalidate.js";
-import { enterpriseOidcProviderId, getEnterpriseOidcUrls, isEnterpriseSamlSourceActive, normalizeDomain } from "./enterprise/shared.js";
-import { normalizeEnterprisePolicy, patchEnterprisePolicy } from "./enterprise/policy.js";
+import { payloadRecordValidator } from "./payloads.js";
+import { normalizeGroupConnectionPolicy } from "./sso/policy.js";
 import { callUserOAuth } from "./mutations/oauth.js";
 import { callCreateAccountFromCredentials } from "./mutations/register.js";
 import { callRetrieveAccountWithCredentials } from "./mutations/retrieve.js";
 import { callVerifierSignature } from "./mutations/signature.js";
 import { callSignOut } from "./mutations/signout.js";
 import { storeArgs, storeImpl } from "./mutations/store.js";
-import { redirectAbsoluteUrl, setURLSearchParam } from "./redirects.js";
-import { signInImpl } from "./signin.js";
-import { createCoreDomains } from "./core.js";
-import { getOidcConfig, getPublicOidcConfig, getSamlConfig, upsertProtocolConfig, withOidcSecretState } from "./enterprise/config.js";
-import { createEnterpriseDomain } from "./enterprise/domain.js";
+import { siteUrlsFromEnv } from "./url.js";
+import { redirectToParamCookie, useRedirectToParam } from "./cookies.js";
 import { addAuthRoutes, addOpenIdRoutes, convertErrorsToResponse, createHttpAction, createHttpContext, createHttpRoute, getCookies } from "./http.js";
-import { createOAuthAuthorizationURL, handleOAuthCallback } from "./oauth.js";
-import { createServiceProviderMetadata, getSamlServiceProviderOptions, parseSamlIdpMetadata } from "./enterprise/saml.js";
-import { parseScimPath } from "./enterprise/scim.js";
-import { addEnterpriseHttpRuntime } from "./enterprise/http.js";
-import { Fx } from "@robelest/fx";
-import { Cv } from "@robelest/fx/convex";
+import { createOAuthAuthorizationURL, handleOAuthCallback } from "./oauth/runtime.js";
+import { redirectAbsoluteUrl, setURLSearchParam } from "./redirects.js";
+import { encryptSecret } from "./secret.js";
+import { createGroupService } from "./services/group.js";
+import { resolveServerServices } from "./services/resolve.js";
+import { createGroupConnectionDomain } from "./sso/domain.js";
+import { addGroupHttpRuntime } from "./sso/http.js";
+import { ConvexError, v } from "convex/values";
 import { actionGeneric, internalMutationGeneric } from "convex/server";
-import { v } from "convex/values";
 import { serialize } from "cookie";
 
 //#region src/server/runtime.ts
-const ENTERPRISE_OIDC_CLIENT_SECRET_KIND = "oidc_client_secret";
+const GROUP_CONNECTION_OIDC_CLIENT_SECRET_KIND = "oidc_client_secret";
+const convexError = (data) => new ConvexError(data);
 /**
 * Configure the Convex Auth library. Returns an object with
 * functions and `auth` helper. You must export the functions
@@ -48,172 +49,22 @@ const ENTERPRISE_OIDC_CLIENT_SECRET_KIND = "oidc_client_secret";
 *          `convex/auth.ts` file.
 */
 function Auth(config_) {
-	const config = configDefaults(config_);
+	const services = resolveServerServices(config_);
+	const config = services.config;
 	const hasOAuth = config.providers.some((provider) => provider.type === "oauth");
 	const hasSSO = config.providers.some((provider) => provider.type === "sso");
-	const getProviderOrThrow = (id, allowExtraProviders = false) => {
-		const provider = config.providers.find((configuredProvider) => configuredProvider.id === id) ?? (allowExtraProviders ? config.extraProviders.find((configuredProvider) => configuredProvider.id === id) : void 0);
-		if (provider === void 0) {
-			const detail = `Provider \`${id}\` is not configured, available providers are ${listAvailableProviders(config, allowExtraProviders)}.`;
-			logWithLevel(LOG_LEVELS.ERROR, detail);
-			throw Cv.error({
-				code: "PROVIDER_NOT_CONFIGURED",
-				message: detail,
-				provider: id
-			});
-		}
-		return provider;
-	};
-	const getEnterpriseSecret = async (ctx, enterpriseId, kind) => {
-		return await ctx.runQuery(config.component.public.enterpriseSecretGet, {
-			enterpriseId,
-			kind
-		});
-	};
-	const getEnterpriseOidcConfigWithSecret = async (ctx, enterprise) => {
-		const oidc = getOidcConfig(enterprise.config);
-		const secret = await getEnterpriseSecret(ctx, enterprise._id, ENTERPRISE_OIDC_CLIENT_SECRET_KIND);
-		return {
-			...oidc,
-			...secret ? { clientSecret: await decryptSecret(secret.ciphertext) } : {}
-		};
-	};
+	const ssoProvider = config.providers.find((provider) => provider.type === "sso");
+	const getProviderOrThrow = services.providerRegistry.getProviderOrThrow;
 	const INVITE_TOKEN_ALPHABET = "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789";
 	const INVITE_TOKEN_LENGTH = 48;
-	const enterpriseNotFoundError = "Enterprise not found.";
-	const ENTERPRISE_CONTROL_ROUTE_BASE = "/api/auth/sso";
-	const getPolicyFromEnterprise = (enterprise) => normalizeEnterprisePolicy(enterprise.policy);
-	const loadEnterpriseOrThrow = async (ctx, enterpriseId) => {
-		const enterprise = await ctx.runQuery(config.component.public.enterpriseGet, { enterpriseId });
-		if (!enterprise) throw Cv.error({
-			code: "INVALID_PARAMETERS",
-			message: enterpriseNotFoundError
-		});
-		return enterprise;
-	};
-	const loadActiveEnterpriseOrThrow = async (ctx, enterpriseId) => {
-		const enterprise = await loadEnterpriseOrThrow(ctx, enterpriseId);
-		if (enterprise.status !== "active") throw Cv.error({
-			code: "INVALID_PARAMETERS",
-			message: "Enterprise connection is not active."
-		});
-		return enterprise;
-	};
-	const loadActiveEnterpriseSamlOrThrow = async (ctx, enterpriseId) => {
-		const enterprise = await loadEnterpriseOrThrow(ctx, enterpriseId);
-		const loaded = {
-			source: {
-				kind: "enterprise",
-				id: enterpriseId
-			},
-			config: enterprise.config,
-			status: enterprise.status,
-			enterprise
-		};
-		if (!isEnterpriseSamlSourceActive(loaded)) throw Cv.error({
-			code: "INVALID_PARAMETERS",
-			message: "Enterprise connection is not active."
-		});
-		const saml = getSamlConfig(loaded.config);
-		if (!saml.idp?.metadataXml) throw Cv.error({
-			code: "PROVIDER_NOT_CONFIGURED",
-			message: "SAML is not configured for this enterprise."
-		});
-		return {
-			loaded,
-			enterprise,
-			saml
-		};
-	};
-	const loadEnterpriseOidcOrThrow = async (ctx, enterpriseId) => {
-		const enterprise = await loadActiveEnterpriseOrThrow(ctx, enterpriseId);
-		const oidc = await getEnterpriseOidcConfigWithSecret(ctx, enterprise);
-		if (oidc.enabled !== true) throw Cv.error({
-			code: "PROVIDER_NOT_CONFIGURED",
-			message: "OIDC is not configured for this enterprise."
-		});
-		return {
-			enterprise,
-			oidc
-		};
-	};
-	const validateEnterprisePolicy = (policy) => {
-		const checks = [];
-		checks.push({
-			name: "policy_version",
-			ok: policy.version === 1
-		});
-		checks.push({
-			name: "jit_default_role_ids_present",
-			ok: policy.provisioning.jit.mode !== "createUserAndMembership" || policy.provisioning.jit.defaultRoleIds.length > 0,
-			message: policy.provisioning.jit.mode === "createUserAndMembership" && policy.provisioning.jit.defaultRoleIds.length === 0 ? "At least one default roleId is required when JIT membership provisioning is enabled." : void 0
-		});
-		checks.push({
-			name: "jit_default_role_ids_known",
-			ok: policy.provisioning.jit.defaultRoleIds.every((roleId) => config.authorization.roles[roleId] !== void 0),
-			message: policy.provisioning.jit.defaultRoleIds.every((roleId) => config.authorization.roles[roleId] !== void 0) ? void 0 : "JIT defaultRoleIds contains unknown roleIds."
-		});
-		checks.push({
-			name: "scim_reuse_supported",
-			ok: policy.provisioning.scimReuse.user === "externalId" || policy.provisioning.scimReuse.user === "none"
-		});
-		return checks;
-	};
-	const recordEnterpriseAuditEvent = async (ctx, data) => {
-		const { ok, ...rest } = data;
-		return await ctx.runMutation(config.component.public.enterpriseAuditEventCreate, {
-			...rest,
-			status: ok ? "success" : "failure",
-			occurredAt: Date.now()
-		});
-	};
-	const emitEnterpriseWebhookDeliveries = async (ctx, data) => {
-		const endpoints = await ctx.runQuery(config.component.public.enterpriseWebhookEndpointList, { enterpriseId: data.enterpriseId });
-		for (const endpoint of endpoints) {
-			if (endpoint.status !== "active" || !endpoint.subscriptions.includes(data.eventType)) continue;
-			await ctx.runMutation(config.component.public.enterpriseWebhookDeliveryEnqueue, {
-				enterpriseId: data.enterpriseId,
-				endpointId: endpoint._id,
-				auditEventId: data.auditEventId,
-				eventType: data.eventType,
-				payload: data.payload,
-				nextAttemptAt: Date.now()
-			});
-		}
-	};
-	const getEnterpriseScimContext = async (ctx, request) => {
-		const authHeader = request.headers.get("Authorization");
-		if (!authHeader?.startsWith("Bearer ")) throw Cv.error({
-			code: "MISSING_BEARER_TOKEN",
-			message: "Missing or malformed Authorization: Bearer header."
-		});
-		const token = authHeader.slice(7);
-		const scimConfig = await ctx.runQuery(config.component.public.enterpriseScimConfigGetByTokenHash, { tokenHash: await sha256(token) });
-		if (!scimConfig || scimConfig.status !== "active") throw Cv.error({
-			code: "INVALID_API_KEY",
-			message: "Invalid SCIM token."
-		});
-		const parsedPath = parseScimPath(new URL(request.url).pathname);
-		if (parsedPath.enterpriseId !== scimConfig.enterpriseId) throw Cv.error({
-			code: "INVALID_API_KEY",
-			message: "SCIM token/tenant mismatch."
-		});
-		const enterprise = await ctx.runQuery(config.component.public.enterpriseGet, { enterpriseId: scimConfig.enterpriseId });
-		if (enterprise === null) throw Cv.error({
-			code: "INVALID_PARAMETERS",
-			message: "Enterprise not found."
-		});
-		return {
-			scimConfig,
-			enterprise,
-			parsedPath
-		};
-	};
-	let auth;
-	auth = {
+	const GROUP_CONNECTION_ROUTE_BASE = "/api/auth/connections";
+	const group = createGroupService({
+		config,
+		sha256
+	});
+	const authBase = {
 		...createCoreDomains({
 			config,
-			getAuth: () => auth,
 			callInvalidateSessions,
 			callCreateAccountFromCredentials,
 			callRetrieveAccountWithCredentials,
@@ -222,77 +73,65 @@ function Auth(config_) {
 			inviteTokenAlphabet: INVITE_TOKEN_ALPHABET,
 			inviteTokenLength: INVITE_TOKEN_LENGTH
 		}),
-		sso: createEnterpriseDomain({
+		sso: createGroupConnectionDomain({
 			config,
-			getAuth: () => auth,
-			normalizeEnterprisePolicy,
-			normalizeDomain,
-			getEnterpriseSecret,
-			loadEnterpriseOrThrow,
-			validateEnterprisePolicy,
-			recordEnterpriseAuditEvent,
-			emitEnterpriseWebhookDeliveries,
-			enterpriseNotFoundError,
-			ENTERPRISE_OIDC_CLIENT_SECRET_KIND,
+			getGroupConnectionSecret: group.getGroupConnectionSecret,
+			loadConnectionOrThrow: group.loadConnectionOrThrow,
+			validateGroupConnectionPolicy: group.validateGroupConnectionPolicy,
+			recordGroupAuditEvent: group.recordGroupAuditEvent,
+			emitGroupWebhookDeliveries: group.emitGroupWebhookDeliveries,
+			connectionNotFoundError: "Connection not found.",
+			GROUP_CONNECTION_OIDC_CLIENT_SECRET_KIND,
 			requireEnv,
 			generateRandomString,
 			INVITE_TOKEN_ALPHABET,
 			sha256,
 			encryptSecret,
-			upsertProtocolConfig,
-			parseSamlIdpMetadata,
-			createServiceProviderMetadata,
-			getSamlServiceProviderOptions,
-			getPublicOidcConfig,
-			withOidcSecretState,
-			getOidcConfig,
-			getEnterpriseOidcUrls,
-			enterpriseOidcProviderId,
-			getPolicyFromEnterprise,
-			patchEnterprisePolicy
+			loadGroupPolicyOrThrow: group.loadGroupPolicyOrThrow
 		})
 	};
-	auth.http = {
-		add: (http) => {
-			addOpenIdRoutes(http, {
+	const getDefaultCorsOrigins = () => siteUrlsFromEnv().allowedUrls.map((u) => new URL(u).origin);
+	const http = {
+		add: (http$1) => {
+			addOpenIdRoutes(http$1, {
 				getIssuer: () => requireEnv("CONVEX_SITE_URL"),
 				getJwks: () => requireEnv("JWKS")
 			});
-			addEnterpriseHttpRuntime({
-				http,
+			addGroupHttpRuntime({
+				http: http$1,
 				hasSSO,
-				auth,
+				auth: authBase,
 				config,
-				routeBase: ENTERPRISE_CONTROL_ROUTE_BASE,
+				routeBase: GROUP_CONNECTION_ROUTE_BASE,
 				requireEnv,
-				loadActiveEnterpriseSamlOrThrow,
-				loadEnterpriseOidcOrThrow,
-				getEnterpriseScimContext,
-				getPolicyFromEnterprise,
-				normalizeEnterprisePolicy,
-				recordEnterpriseAuditEvent,
-				emitEnterpriseWebhookDeliveries,
+				loadActiveConnectionSamlOrThrow: group.loadActiveConnectionSamlOrThrow,
+				loadConnectionOidcOrThrow: group.loadConnectionOidcOrThrow,
+				getGroupConnectionScimContext: group.getGroupConnectionScimContext,
+				loadGroupPolicyOrThrow: group.loadGroupPolicyOrThrow,
+				normalizeGroupConnectionPolicy,
+				recordGroupAuditEvent: group.recordGroupAuditEvent,
+				emitGroupWebhookDeliveries: group.emitGroupWebhookDeliveries,
 				generateRandomString,
 				inviteTokenAlphabet: INVITE_TOKEN_ALPHABET,
 				callUserOAuth,
-				callVerifierSignature
+				callVerifierSignature,
+				sharedOidcRedirectURI: ssoProvider?.redirectURI
 			});
-			if (hasOAuth) addAuthRoutes(http, {
+			if (hasOAuth) addAuthRoutes(http$1, {
 				handleSignIn: convertErrorsToResponse(400, async (ctx, request) => {
 					const url = new URL(request.url);
 					const pathParts = url.pathname.split("/");
 					const providerId = pathParts[pathParts.length - 1];
-					if (providerId === null) throw Cv.error({
+					if (providerId === null) throw convexError({
 						code: "OAUTH_MISSING_PROVIDER",
 						message: "Missing OAuth provider ID."
 					});
 					const verifier = url.searchParams.get("code");
-					if (verifier === null) throw Cv.error({
+					if (verifier === null) throw convexError({
 						code: "OAUTH_MISSING_VERIFIER",
 						message: "Missing sign-in verifier."
 					});
-					const oauthConfig = getProviderOrThrow(providerId);
-					const { redirect, cookies, signature } = await createOAuthAuthorizationURL(providerId, oauthConfig.provider, oauthConfig);
+					const { redirect, cookies, signature } = await createOAuthAuthorizationURL(providerId, getProviderOrThrow(providerId));
 					await callVerifierSignature(ctx, {
 						verifier,
 						signature
@@ -310,57 +149,54 @@ function Auth(config_) {
 					const url = new URL(request.url);
 					const callbackPathParts = new URL(request.url).pathname.split("/");
 					const providerId = callbackPathParts[callbackPathParts.length - 1];
-					if (!providerId) throw Cv.error({
+					if (!providerId) throw convexError({
 						code: "OAUTH_MISSING_PROVIDER",
 						message: "Missing OAuth provider ID."
 					});
-					logWithLevel(LOG_LEVELS.DEBUG, "Handling OAuth callback for provider:", providerId);
+					log(LOG_LEVELS.DEBUG, "Handling OAuth callback for provider:", providerId);
 					const provider = getProviderOrThrow(providerId);
 					const cookies = getCookies(request);
 					const maybeRedirectTo = useRedirectToParam(provider.id, cookies);
 					const destinationUrl = await redirectAbsoluteUrl(config, { redirectTo: maybeRedirectTo?.redirectTo });
 					const params = url.searchParams;
-					if (request.headers.get("Content-Type") === "application/x-www-form-urlencoded") (await request.formData()).forEach((value, key) => {
+					if (request.headers.get("Content-Type")?.includes("application/x-www-form-urlencoded")) (await request.formData()).forEach((value, key) => {
 						if (typeof value === "string") params.append(key, value);
 					});
-					return Fx.run(Fx.from({
-						ok: async () => {
-							const oauthConfig = provider;
-							const result = await Fx.run(handleOAuthCallback(providerId, oauthConfig.provider, oauthConfig, Object.fromEntries(params.entries()), cookies));
-							const oauthCookies = result.cookies;
-							const { id: profileId, ...profileData } = result.profile;
-							const { signature } = result;
-							const redirUrl = setURLSearchParam(destinationUrl, "code", await callUserOAuth(ctx, {
-								provider: providerId,
-								providerAccountId: profileId,
-								profile: profileData,
-								signature
-							}));
-							const redirHeaders = new Headers({ Location: redirUrl });
-							redirHeaders.set("Cache-Control", "must-revalidate");
-							for (const { name, value, options } of [...oauthCookies, ...maybeRedirectTo !== null ? [maybeRedirectTo.updatedCookie] : []]) redirHeaders.append("Set-Cookie", serialize(name, value, options));
-							return new Response(null, {
-								status: 302,
-								headers: redirHeaders
-							});
-						},
-						err: (error) => error
-					}).pipe(Fx.recover((error) => {
+					try {
+						const result = await handleOAuthCallback(providerId, provider, Object.fromEntries(params.entries()), cookies);
+						const oauthCookies = result.cookies;
+						const { id: profileId, ...profileData } = result.profile;
+						const { signature } = result;
+						const redirUrl = setURLSearchParam(destinationUrl, "code", await callUserOAuth(ctx, {
+							provider: providerId,
+							providerAccountId: profileId,
+							profile: profileData,
+							signature
+						}));
+						const redirHeaders = new Headers({ Location: redirUrl });
+						redirHeaders.set("Cache-Control", "must-revalidate");
+						for (const { name, value, options } of [...oauthCookies, ...maybeRedirectTo !== null ? [maybeRedirectTo.updatedCookie] : []]) redirHeaders.append("Set-Cookie", serialize(name, value, options));
+						return new Response(null, {
+							status: 302,
+							headers: redirHeaders
+						});
+					} catch (error) {
 						logError(error);
 						const respHeaders = new Headers({ Location: destinationUrl });
 						for (const { name, value, options } of maybeRedirectTo !== null ? [maybeRedirectTo.updatedCookie] : []) respHeaders.append("Set-Cookie", serialize(name, value, options));
-						return Fx.succeed(new Response(null, {
+						return new Response(null, {
 							status: 302,
 							headers: respHeaders
-						}));
-					})));
+						});
+					}
 				}
 			});
 		},
-		context: createHttpContext(auth),
-		action: createHttpAction(auth),
-		route: createHttpRoute(createHttpAction(auth))
+		context: createHttpContext(authBase),
+		action: createHttpAction(authBase, getDefaultCorsOrigins),
+		route: createHttpRoute(createHttpAction(authBase, getDefaultCorsOrigins), getDefaultCorsOrigins)
 	};
+	const auth = Object.assign(authBase, { http });
 	const enrichCtx = (ctx) => ({
 		...ctx,
 		auth: {
@@ -377,43 +213,44 @@ function Auth(config_) {
 		signIn: actionGeneric({
 			args: {
 				provider: v.optional(v.string()),
-				params: v.optional(v.any()),
+				params: v.optional(payloadRecordValidator),
 				verifier: v.optional(v.string()),
 				refreshToken: v.optional(v.string()),
 				calledBy: v.optional(v.string())
 			},
 			handler: async (ctx, args) => {
-				if (args.calledBy !== void 0) logWithLevel("INFO", `\`auth:signIn\` called by ${args.calledBy}`);
+				if (args.calledBy !== void 0) log("INFO", `\`auth:signIn\` called by ${args.calledBy}`);
 				const provider = args.provider !== void 0 ? getProviderOrThrow(args.provider) : null;
-				const result = await signInImpl(enrichCtx(ctx), provider, args, {
+				const result = await services.signIn.signIn(enrichCtx(ctx), provider, args, {
 					generateTokens: true,
-					allowExtraProviders: false
+					allowExtraProviders: false,
+					resolveSsoProtocol: group.resolveGroupConnectionSsoProtocolOrThrow
 				});
-				return Fx.run(Fx.match(result, result.kind, {
-					redirect: (r) => Fx.succeed({
+				const handler = {
+					redirect: (r) => ({
 						kind: "redirect",
 						redirect: r.redirect,
 						verifier: r.verifier
 					}),
-					signedIn: (r) => Fx.succeed({
+					signedIn: (r) => ({
 						kind: "signedIn",
 						tokens: r.signedIn?.tokens ?? null
 					}),
-					refreshTokens: (r) => Fx.succeed({
+					refreshTokens: (r) => ({
 						kind: "signedIn",
 						tokens: r.signedIn?.tokens ?? null
 					}),
-					started: () => Fx.succeed({ kind: "started" }),
-					passkeyOptions: (r) => Fx.succeed({
+					started: () => ({ kind: "started" }),
+					passkeyOptions: (r) => ({
 						kind: "passkeyOptions",
 						options: r.options,
 						verifier: r.verifier
 					}),
-					totpRequired: (r) => Fx.succeed({
+					totpRequired: (r) => ({
 						kind: "totpRequired",
 						verifier: r.verifier
 					}),
-					totpSetup: (r) => Fx.succeed({
+					totpSetup: (r) => ({
 						kind: "totpSetup",
 						totpSetup: {
 							uri: r.uri,
@@ -422,7 +259,7 @@ function Auth(config_) {
 						},
 						verifier: r.verifier
 					}),
-					deviceCode: (r) => Fx.succeed({
+					deviceCode: (r) => ({
 						kind: "deviceCode",
 						deviceCode: {
 							deviceCode: r.deviceCode,
@@ -433,7 +270,9 @@ function Auth(config_) {
 							interval: r.interval
 						}
 					})
-				}));
+				}[result.kind];
+				if (!handler) throw new Error(`Unexpected sign-in result kind: ${result.kind}`);
+				return handler(result);
 			}
 		}),
 		signOut: actionGeneric({
@@ -445,7 +284,7 @@ function Auth(config_) {
 		store: internalMutationGeneric({
 			args: storeArgs,
 			handler: async (ctx, args) => {
-				return storeImpl(ctx, args, getProviderOrThrow, config);
+				return storeImpl(ctx, args, services);
 			}
 		})
 	};

package/dist/server/secret.js

@@ -0,0 +1,44 @@
+import { requireEnv } from "./env.js";
+import { ConvexError } from "convex/values";
+import { sha256 } from "@oslojs/crypto/sha2";
+import { decodeBase64urlIgnorePadding, encodeBase64urlNoPadding } from "@oslojs/encoding";
+
+//#region src/server/secret.ts
+const SECRET_KEY_ENV = "AUTH_SECRET_ENCRYPTION_KEY";
+const SECRET_IV_LENGTH = 12;
+function toArrayBuffer(bytes) {
+	return bytes.buffer.slice(bytes.byteOffset, bytes.byteOffset + bytes.byteLength);
+}
+async function getSecretCryptoKey() {
+	const material = requireEnv(SECRET_KEY_ENV);
+	const rawKey = sha256(new TextEncoder().encode(material));
+	return await crypto.subtle.importKey("raw", toArrayBuffer(rawKey), { name: "AES-GCM" }, false, ["encrypt", "decrypt"]);
+}
+/** @internal */
+async function encryptSecret(value) {
+	const key = await getSecretCryptoKey();
+	const iv = crypto.getRandomValues(new Uint8Array(SECRET_IV_LENGTH));
+	const encrypted = await crypto.subtle.encrypt({
+		name: "AES-GCM",
+		iv: toArrayBuffer(iv)
+	}, key, toArrayBuffer(new TextEncoder().encode(value)));
+	return `${encodeBase64urlNoPadding(iv)}.${encodeBase64urlNoPadding(new Uint8Array(encrypted))}`;
+}
+/** @internal */
+async function decryptSecret(ciphertext) {
+	const [ivEncoded, payloadEncoded] = ciphertext.split(".");
+	if (!ivEncoded || !payloadEncoded) throw new ConvexError({
+		code: "INVALID_PARAMETERS",
+		message: "Stored group connection secret is malformed."
+	});
+	const key = await getSecretCryptoKey();
+	const decrypted = await crypto.subtle.decrypt({
+		name: "AES-GCM",
+		iv: toArrayBuffer(decodeBase64urlIgnorePadding(ivEncoded))
+	}, key, toArrayBuffer(decodeBase64urlIgnorePadding(payloadEncoded)));
+	return new TextDecoder().decode(decrypted);
+}
+
+//#endregion
+export { decryptSecret, encryptSecret };
+//# sourceMappingURL=secret.js.map

package/dist/server/services/config.js

@@ -0,0 +1,10 @@
+import { configDefaults } from "../config.js";
+
+//#region src/server/services/config.ts
+const createAuthConfig = (config_) => {
+	return { config: configDefaults(config_) };
+};
+
+//#endregion
+export { createAuthConfig };
+//# sourceMappingURL=config.js.map