@robelest/convex-auth 0.0.4-preview.25 → 0.0.4-preview.28

package/dist/server/services/group.js

@@ -0,0 +1,211 @@
+import { getGroup, getGroupConnection, getGroupConnectionSecret, getScimConfigByConnection, listWebhookEndpoints } from "../contract.js";
+import { isGroupSamlSourceActive } from "../sso/shared.js";
+import { normalizeGroupConnectionPolicy } from "../sso/policy.js";
+import { decryptSecret } from "../secret.js";
+import { getOidcConfig, getSamlConfig } from "../sso/config.js";
+import { parseScimPath } from "../sso/scim.js";
+import { ConvexError } from "convex/values";
+
+//#region src/server/services/group.ts
+function createGroupService(deps) {
+	const { config, sha256 } = deps;
+	const connectionNotFoundError = "Connection not found.";
+	const getPolicyFromGroup = (group) => normalizeGroupConnectionPolicy(group.policy);
+	const getGroupConnectionSecret$1 = async (ctx, connectionId, kind) => {
+		return await getGroupConnectionSecret(ctx, config.component.public, {
+			connectionId,
+			kind
+		});
+	};
+	const getGroupConnectionOidcConfigWithSecret = async (ctx, connection) => {
+		const oidc = getOidcConfig(connection.config);
+		const secret = await getGroupConnectionSecret$1(ctx, connection._id, "oidc_client_secret");
+		if (secret) {
+			const decrypted = await decryptSecret(secret.ciphertext);
+			const existingClient = typeof oidc.client === "object" && oidc.client !== null ? oidc.client : {};
+			return {
+				...oidc,
+				client: {
+					...existingClient,
+					secret: decrypted
+				}
+			};
+		}
+		return oidc;
+	};
+	const loadGroupPolicyOrThrow = async (ctx, groupId) => {
+		const group = await getGroup(ctx, config.component.public, groupId);
+		if (!group) throw convexError({
+			code: "INVALID_PARAMETERS",
+			message: "Group not found."
+		});
+		return getPolicyFromGroup(group);
+	};
+	const loadConnectionOrThrow = async (ctx, connectionId) => {
+		const connection = await getGroupConnection(ctx, config.component.public, connectionId);
+		if (!connection) throw convexError({
+			code: "INVALID_PARAMETERS",
+			message: connectionNotFoundError
+		});
+		return connection;
+	};
+	const loadActiveGroupConnectionOrThrow = async (ctx, connectionId) => {
+		const connection = await loadConnectionOrThrow(ctx, connectionId);
+		if (connection.status !== "active") throw convexError({
+			code: "INVALID_PARAMETERS",
+			message: "Group connection is not active."
+		});
+		return connection;
+	};
+	const loadActiveConnectionSamlOrThrow = async (ctx, connectionId) => {
+		const connection = await loadConnectionOrThrow(ctx, connectionId);
+		const loaded = {
+			source: {
+				kind: "connection",
+				id: connectionId
+			},
+			config: connection.config ?? {},
+			status: connection.status,
+			connection
+		};
+		if (!isGroupSamlSourceActive(loaded)) throw convexError({
+			code: "INVALID_PARAMETERS",
+			message: "Group connection is not active."
+		});
+		const saml = getSamlConfig(loaded.config);
+		if (!saml.idp?.metadataXml) throw convexError({
+			code: "PROVIDER_NOT_CONFIGURED",
+			message: "SAML is not configured for this connection."
+		});
+		return {
+			loaded,
+			connection,
+			saml
+		};
+	};
+	const loadConnectionOidcOrThrow = async (ctx, connectionId) => {
+		const connection = await loadActiveGroupConnectionOrThrow(ctx, connectionId);
+		const oidc = await getGroupConnectionOidcConfigWithSecret(ctx, connection);
+		if (oidc.enabled !== true) throw convexError({
+			code: "PROVIDER_NOT_CONFIGURED",
+			message: "OIDC is not configured for this connection."
+		});
+		return {
+			connection,
+			oidc
+		};
+	};
+	const resolveGroupConnectionSsoProtocolOrThrow = async (ctx, connectionId) => {
+		const connection = await loadActiveGroupConnectionOrThrow(ctx, connectionId);
+		if (connection.protocol === "oidc") return "oidc";
+		if (connection.protocol === "saml") return "saml";
+		throw convexError({
+			code: "PROVIDER_NOT_CONFIGURED",
+			message: "Group connection protocol is not configured."
+		});
+	};
+	const validateGroupConnectionPolicy = (policy) => {
+		const hasConfiguredRoles = Object.keys(config.authorization.roles).length > 0;
+		const checks = [];
+		checks.push({
+			name: "policy_version",
+			ok: policy.version === 1
+		});
+		if (hasConfiguredRoles) {
+			checks.push({
+				name: "jit_default_role_ids_known",
+				ok: policy.provisioning.jit.defaultRoleIds.every((roleId) => config.authorization.roles[roleId] !== void 0),
+				message: policy.provisioning.jit.defaultRoleIds.every((roleId) => config.authorization.roles[roleId] !== void 0) ? void 0 : "JIT defaultRoleIds contains unknown roleIds."
+			});
+			checks.push({
+				name: "provisioning_role_mapping_targets_known",
+				ok: Object.values(policy.provisioning.roles.mapping ?? {}).every((roleIds) => roleIds.every((roleId) => config.authorization.roles[roleId] !== void 0)),
+				message: Object.values(policy.provisioning.roles.mapping ?? {}).every((roleIds) => roleIds.every((roleId) => config.authorization.roles[roleId] !== void 0)) ? void 0 : "Provisioning role mappings contain unknown roleIds."
+			});
+			checks.push({
+				name: "provisioning_group_mapping_targets_known",
+				ok: Object.values(policy.provisioning.groups.mapping ?? {}).every((roleIds) => roleIds.every((roleId) => config.authorization.roles[roleId] !== void 0)),
+				message: Object.values(policy.provisioning.groups.mapping ?? {}).every((roleIds) => roleIds.every((roleId) => config.authorization.roles[roleId] !== void 0)) ? void 0 : "Provisioning group mappings contain unknown roleIds."
+			});
+		}
+		checks.push({
+			name: "scim_reuse_supported",
+			ok: policy.provisioning.scimReuse.user === "externalId" || policy.provisioning.scimReuse.user === "none"
+		});
+		return checks;
+	};
+	const recordGroupAuditEvent = async (ctx, data) => {
+		const { ok, ...rest } = data;
+		return await ctx.runMutation(config.component.public.groupAuditEventCreate, {
+			...rest,
+			status: ok ? "success" : "failure",
+			occurredAt: Date.now()
+		});
+	};
+	const emitGroupWebhookDeliveries = async (ctx, data) => {
+		const endpoints = await listWebhookEndpoints(ctx, config.component.public, data.connectionId);
+		for (const endpoint of endpoints) {
+			if (endpoint.status !== "active" || !endpoint.subscriptions.includes(data.eventType)) continue;
+			await ctx.runMutation(config.component.public.groupWebhookDeliveryEnqueue, {
+				connectionId: data.connectionId,
+				endpointId: endpoint._id,
+				auditEventId: data.auditEventId,
+				eventType: data.eventType,
+				payload: data.payload,
+				nextAttemptAt: Date.now()
+			});
+		}
+	};
+	const getGroupConnectionScimContext = async (ctx, request) => {
+		const authHeader = request.headers.get("Authorization");
+		if (!authHeader?.startsWith("Bearer ")) throw convexError({
+			code: "MISSING_BEARER_TOKEN",
+			message: "Missing or malformed Authorization: Bearer header."
+		});
+		const token = authHeader.slice(7);
+		const parsedPath = parseScimPath(new URL(request.url).pathname);
+		const scimConfig = await getScimConfigByConnection(ctx, config.component.public, parsedPath.connectionId);
+		const tokenHash = await sha256(token);
+		if (!scimConfig || scimConfig.status !== "active" || !scimConfig.tokenHash || !constantTimeEqualHex(tokenHash, scimConfig.tokenHash)) throw convexError({
+			code: "INVALID_API_KEY",
+			message: "Invalid SCIM token."
+		});
+		const connection = await getGroupConnection(ctx, config.component.public, scimConfig.connectionId);
+		if (connection === null) throw convexError({
+			code: "INVALID_PARAMETERS",
+			message: connectionNotFoundError
+		});
+		return {
+			scimConfig,
+			connection,
+			parsedPath
+		};
+	};
+	return {
+		getGroupConnectionSecret: getGroupConnectionSecret$1,
+		loadGroupPolicyOrThrow,
+		loadConnectionOrThrow,
+		loadActiveGroupConnectionOrThrow,
+		loadActiveConnectionSamlOrThrow,
+		loadConnectionOidcOrThrow,
+		resolveGroupConnectionSsoProtocolOrThrow,
+		validateGroupConnectionPolicy,
+		recordGroupAuditEvent,
+		emitGroupWebhookDeliveries,
+		getGroupConnectionScimContext
+	};
+}
+function convexError(data) {
+	return new ConvexError(data);
+}
+/** Constant-time comparison for hex-encoded strings (e.g. SHA-256 hashes). */
+function constantTimeEqualHex(a, b) {
+	if (a.length !== b.length) return false;
+	let diff = 0;
+	for (let i = 0; i < a.length; i++) diff |= a.charCodeAt(i) ^ b.charCodeAt(i);
+	return diff === 0;
+}
+
+//#endregion
+export { createGroupService };
+//# sourceMappingURL=group.js.map

package/dist/server/services/logger.js

@@ -0,0 +1,8 @@
+import { logMessage } from "../../shared/log.js";
+
+//#region src/server/services/logger.ts
+const createAuthLogger = () => ({ log: (level, ...args) => logMessage("convex-auth", level, args) });
+
+//#endregion
+export { createAuthLogger };
+//# sourceMappingURL=logger.js.map

package/dist/server/services/providers.js

@@ -0,0 +1,22 @@
+import { LOG_LEVELS } from "../../shared/log.js";
+import { listAvailableProviders } from "../config.js";
+import { ConvexError } from "convex/values";
+
+//#region src/server/services/providers.ts
+const createProviderRegistry = (config, logger) => ({ getProviderOrThrow: (id, allowExtraProviders = false) => {
+	const provider = config.providers.find((configuredProvider) => configuredProvider.id === id) ?? (allowExtraProviders ? config.extraProviders.find((configuredProvider) => configuredProvider.id === id) : void 0);
+	if (provider === void 0) {
+		const detail = `Provider \`${id}\` is not configured, available providers are ${listAvailableProviders(config, allowExtraProviders)}.`;
+		logger.log(LOG_LEVELS.ERROR, detail);
+		throw new ConvexError({
+			code: "PROVIDER_NOT_CONFIGURED",
+			message: detail,
+			provider: id
+		});
+	}
+	return provider;
+} });
+
+//#endregion
+export { createProviderRegistry };
+//# sourceMappingURL=providers.js.map

package/dist/server/services/refresh.js

@@ -0,0 +1,8 @@
+import { refreshSessionImpl } from "../mutations/refresh.js";
+
+//#region src/server/services/refresh.ts
+const createAuthRefresh = (config) => ({ refresh: (ctx, args) => refreshSessionImpl(ctx, args, config) });
+
+//#endregion
+export { createAuthRefresh };
+//# sourceMappingURL=refresh.js.map

package/dist/server/services/resolve.js

@@ -0,0 +1,27 @@
+import { configDefaults } from "../config.js";
+import { createAuthConfig } from "./config.js";
+import { createAuthLogger } from "./logger.js";
+import { createProviderRegistry } from "./providers.js";
+import { createAuthRefresh } from "./refresh.js";
+import { createAuthSignIn } from "./signin.js";
+
+//#region src/server/services/resolve.ts
+function resolveServerServices(config) {
+	const configValue = configDefaults(config);
+	const logger = createAuthLogger();
+	const authConfig = createAuthConfig(config);
+	const providerRegistry = createProviderRegistry(configValue, logger);
+	const signIn = createAuthSignIn(configValue);
+	const refresh = createAuthRefresh(configValue);
+	return {
+		config: authConfig.config,
+		logger,
+		providerRegistry,
+		signIn,
+		refresh
+	};
+}
+
+//#endregion
+export { resolveServerServices };
+//# sourceMappingURL=resolve.js.map

package/dist/server/services/signin.js

@@ -0,0 +1,8 @@
+import { signInImpl } from "../signin.js";
+
+//#region src/server/services/signin.ts
+const createAuthSignIn = (_config) => ({ signIn: (ctx, provider, args, options) => signInImpl(ctx, provider, args, options) });
+
+//#endregion
+export { createAuthSignIn };
+//# sourceMappingURL=signin.js.map

package/dist/server/sessions.js

@@ -1,52 +1,53 @@
-import { LOG_LEVELS, REFRESH_TOKEN_DIVIDER, TOKEN_SUB_CLAIM_DIVIDER, logWithLevel, maybeRedact } from "./utils.js";
+import { LOG_LEVELS } from "../shared/log.js";
 import { authDb } from "./db.js";
-import { createRefreshToken } from "./refresh.js";
-import { generateToken } from "./tokens.js";
+import { envOptionalNumber, readConfigSync } from "./env.js";
+import { log, maybeRedact } from "./log.js";
+import { REFRESH_TOKEN_DIVIDER, refreshTokenExpirationTime } from "./refresh.js";
+import { TOKEN_SUB_CLAIM_DIVIDER, generateToken } from "./tokens.js";
 
 //#region src/server/sessions.ts
 const DEFAULT_SESSION_TOTAL_DURATION_MS = 1e3 * 60 * 60 * 24 * 30;
+const sessionExpirationTime = (config, now = Date.now()) => now + (config.session?.totalDurationMs ?? readConfigSync(envOptionalNumber("AUTH_SESSION_TOTAL_DURATION_MS")) ?? DEFAULT_SESSION_TOTAL_DURATION_MS);
+const encodeRefreshToken = (refreshTokenId, sessionId) => `${refreshTokenId}${REFRESH_TOKEN_DIVIDER}${sessionId}`;
 /** @internal */
-async function maybeGenerateTokensForSession(ctx, config, userId, sessionId, generateTokens) {
+async function maybeGenerateTokensForSession(config, args, generateTokens) {
 	return {
-		userId,
-		sessionId,
-		tokens: generateTokens ? await generateTokensForSession(ctx, config, {
-			userId,
-			sessionId,
-			issuedRefreshTokenId: null,
-			parentRefreshTokenId: null
+		userId: args.userId,
+		sessionId: args.sessionId,
+		tokens: generateTokens && args.refreshTokenId !== void 0 ? await generateTokensForSession(config, {
+			userId: args.userId,
+			sessionId: args.sessionId,
+			refreshTokenId: args.refreshTokenId
 		}) : null
 	};
 }
 /** @internal */
-async function createNewAndDeleteExistingSession(ctx, config, userId) {
-	const db = authDb(ctx, config);
-	const existingSessionId = await getAuthSessionId(ctx);
-	if (existingSessionId !== null) {
-		const existingSession = await db.sessions.getById(existingSessionId);
-		if (existingSession !== null) await deleteSession(ctx, existingSession, config);
-	}
-	return await createSession(ctx, userId, config);
+async function issueSession(ctx, config, args) {
+	const issued = await authDb(ctx, config).sessions.issue({
+		userId: args.userId,
+		sessionId: args.existingSessionId,
+		replaceSessionId: args.replaceSessionId,
+		sessionExpirationTime: sessionExpirationTime(config),
+		refreshTokenExpirationTime: args.generateTokens ? refreshTokenExpirationTime(config) : void 0
+	});
+	return await maybeGenerateTokensForSession(config, {
+		userId: issued.userId,
+		sessionId: issued.sessionId,
+		refreshTokenId: issued.refreshTokenId
+	}, args.generateTokens);
 }
 /** @internal */
-async function generateTokensForSession(ctx, config, args) {
-	const ids = {
-		userId: args.userId,
-		sessionId: args.sessionId
-	};
-	const refreshTokenId = args.issuedRefreshTokenId ?? await createRefreshToken(ctx, config, args.sessionId, args.parentRefreshTokenId);
+async function generateTokensForSession(config, args) {
 	const result = {
-		token: await generateToken(ids, config),
-		refreshToken: `${refreshTokenId}${REFRESH_TOKEN_DIVIDER}${args.sessionId}`
+		token: await generateToken({
+			userId: args.userId,
+			sessionId: args.sessionId
+		}, config),
+		refreshToken: encodeRefreshToken(args.refreshTokenId, args.sessionId)
 	};
-	logWithLevel(LOG_LEVELS.DEBUG, `Generated token ${maybeRedact(result.token)} and refresh token ${maybeRedact(refreshTokenId)} for session ${maybeRedact(args.sessionId)}`);
+	log(LOG_LEVELS.DEBUG, `Generated token ${maybeRedact(result.token)} and refresh token ${maybeRedact(args.refreshTokenId)} for session ${maybeRedact(args.sessionId)}`);
 	return result;
 }
-async function createSession(ctx, userId, config) {
-	const db = authDb(ctx, config);
-	const expirationTime = Date.now() + (config.session?.totalDurationMs ?? (process.env.AUTH_SESSION_TOTAL_DURATION_MS !== void 0 ? Number(process.env.AUTH_SESSION_TOTAL_DURATION_MS) : void 0) ?? DEFAULT_SESSION_TOTAL_DURATION_MS);
-	return await db.sessions.create(userId, expirationTime);
-}
 /** @internal */
 async function deleteSession(ctx, session, config) {
 	const db = authDb(ctx, config);
@@ -67,5 +68,5 @@ async function getAuthSessionId(ctx) {
 }
 
 //#endregion
-export { createNewAndDeleteExistingSession, deleteSession, generateTokensForSession, getAuthSessionId, maybeGenerateTokensForSession };
+export { deleteSession, generateTokensForSession, getAuthSessionId, issueSession };
 //# sourceMappingURL=sessions.js.map