@robelest/convex-auth 0.0.4-preview.25 → 0.0.4-preview.28

package/dist/server/signin.js

@@ -1,35 +1,60 @@
-import { generateRandomString, requireEnv } from "./utils.js";
+import { generateRandomString } from "./random.js";
+import { envOptionalString, readConfigSync, requireEnv } from "./env.js";
+import { log } from "./log.js";
 import { callCreateVerificationCode } from "./mutations/code.js";
+import { withSpan } from "./utils/span.js";
 import { callRefreshSession } from "./mutations/refresh.js";
-import { callVerifierSignature } from "./mutations/signature.js";
 import { callSignIn } from "./mutations/signin.js";
 import { callVerifier } from "./mutations/verifier.js";
 import { callVerifyCodeAndSignIn } from "./mutations/verify.js";
+import { redirectAbsoluteUrl, setURLSearchParam } from "./redirects.js";
+import { authFlowError } from "../shared/errors.js";
+import { toConvexError } from "./errors.js";
 import { queryTotpVerifiedByUserId } from "./types.js";
 import { handleDevice } from "./device.js";
 import { handlePasskeyFx } from "./passkey.js";
-import { redirectAbsoluteUrl, setURLSearchParam } from "./redirects.js";
 import { handleTotp } from "./totp.js";
-import { Fx } from "@robelest/fx";
-import { Cv } from "@robelest/fx/convex";
+import { ConvexError } from "convex/values";
 
 //#region src/server/signin.ts
 const DEFAULT_EMAIL_VERIFICATION_CODE_DURATION_S = 3600 * 24;
-/** @internal */
+const normalizeVerificationParams = (params) => {
+	const value = params ?? {};
+	return {
+		email: typeof value.email === "string" ? value.email : void 0,
+		phone: typeof value.phone === "string" ? value.phone : void 0,
+		redirectTo: value.redirectTo,
+		connectionId: value.connectionId,
+		loginHint: value.loginHint,
+		protocol: value.protocol,
+		code: value.code
+	};
+};
+const describeUnknown = (value) => {
+	if (typeof value === "string") return JSON.stringify(value);
+	if (typeof value === "number" || typeof value === "boolean" || typeof value === "bigint" || value === null) return String(value);
+	return JSON.stringify(value) ?? Object.prototype.toString.call(value);
+};
+const asConvexError = (error, code, message) => error instanceof ConvexError ? error : toConvexError(authFlowError(code, message));
+const asCredentialsError = (error) => {
+	if (error instanceof ConvexError) return error;
+	if (error instanceof Error) return new ConvexError({
+		code: error.message.startsWith("Missing `") ? "INVALID_PARAMETERS" : "INVALID_CREDENTIALS",
+		message: error.message
+	});
+	return toConvexError(authFlowError("INTERNAL_ERROR", "Failed to authorize credentials."));
+};
 async function signInImpl(ctx, provider, args, options) {
-	const fx = signInFx(ctx, provider, args, options);
-	return Fx.run(fx.pipe(Fx.recover((e) => Fx.fatal(e))));
+	return signInFx(ctx, provider, args, options);
 }
-/**
-* Core sign-in pipeline as an Fx generator.
-*
-* Handles: refresh tokens, verification codes, then dispatches by
-* provider type using a dispatch map (no if-chain).
-*/
-function signInFx(ctx, provider, args, options) {
-	return Fx.gen(function* () {
-		if (provider === null && args.refreshToken) {
-			const tokens = yield* Fx.promise(() => callRefreshSession(ctx, { refreshToken: args.refreshToken }));
+async function signInFx(ctx, provider, args, options) {
+	return withSpan("convex-auth.signin", {
+		hasProvider: provider !== null,
+		hasCode: args.params?.code !== void 0,
+		hasRefreshToken: args.refreshToken !== void 0
+	}, async () => {
+		if (provider === null && args.refreshToken) try {
+			const tokens = await callRefreshSession(ctx, { refreshToken: args.refreshToken });
 			if (tokens === null) return {
 				kind: "signedIn",
 				signedIn: null
@@ -38,154 +63,201 @@ function signInFx(ctx, provider, args, options) {
 				kind: "refreshTokens",
 				signedIn: { tokens }
 			};
+		} catch (error) {
+			throw asConvexError(error, "INTERNAL_ERROR", "Failed to refresh session.");
 		}
-		if (provider === null && args.params?.code !== void 0) return {
-			kind: "signedIn",
-			signedIn: yield* Fx.promise(() => callVerifyCodeAndSignIn(ctx, {
-				params: args.params,
-				verifier: args.verifier,
-				generateTokens: true,
-				allowExtraProviders: options.allowExtraProviders
-			}))
-		};
-		const resolvedProvider = yield* provider != null ? Fx.succeed(provider) : Cv.fail({
-			code: "SIGN_IN_MISSING_PARAMS",
-			message: "Cannot sign in: missing provider, code, or refresh token."
-		});
-		return yield* Fx.match(resolvedProvider).on("type", {
-			email: (p) => handleEmailAndPhoneProviderFx(ctx, p, args, options),
-			phone: (p) => handleEmailAndPhoneProviderFx(ctx, p, args, options),
-			credentials: (p) => handleCredentialsFx(ctx, p, args, options),
-			oauth: (p) => handleOAuthProviderFx(ctx, p, args, options),
-			passkey: (p) => handlePasskeyFx(ctx, p, args),
-			totp: (p) => handleTotp(ctx, p, args),
-			device: (p) => handleDevice(ctx, p, args),
-			sso: (_p) => handleSsoProviderFx(ctx, args)
-		});
+		if (provider === null && args.params?.code !== void 0) try {
+			return {
+				kind: "signedIn",
+				signedIn: await callVerifyCodeAndSignIn(ctx, {
+					params: args.params,
+					verifier: args.verifier,
+					generateTokens: true,
+					allowExtraProviders: options.allowExtraProviders
+				})
+			};
+		} catch (error) {
+			throw asConvexError(error, "INTERNAL_ERROR", "Failed to verify sign-in code.");
+		}
+		const resolvedProvider = provider;
+		if (resolvedProvider === null) throw toConvexError(authFlowError("SIGN_IN_MISSING_PARAMS", "Cannot sign in: missing provider, code, or refresh token."));
+		const handler = {
+			email: () => handleEmailAndPhoneProviderFx(ctx, resolvedProvider, args, options),
+			phone: () => handleEmailAndPhoneProviderFx(ctx, resolvedProvider, args, options),
+			credentials: () => handleCredentialsFx(ctx, resolvedProvider, args, options),
+			oauth: () => handleOAuthProviderFx(ctx, resolvedProvider, args, options),
+			passkey: () => handlePasskeyFx(ctx, resolvedProvider, args),
+			totp: () => handleTotp(ctx, resolvedProvider, args),
+			device: () => handleDevice(ctx, resolvedProvider, args),
+			sso: () => handleSsoProviderFx(ctx, args, options)
+		}[resolvedProvider.type];
+		if (!handler) throw toConvexError(authFlowError("SIGN_IN_MISSING_PARAMS", `Unknown provider type: ${resolvedProvider.type}`));
+		return handler();
 	});
 }
-function handleEmailAndPhoneProviderFx(ctx, provider, args, options) {
-	return Fx.gen(function* () {
+async function handleEmailAndPhoneProviderFx(ctx, provider, args, options) {
+	return withSpan(`convex-auth.signin.${provider.type}`, {}, async () => {
+		const normalizedParams = normalizeVerificationParams(args.params);
 		if (args.params?.code !== void 0) {
-			const result = yield* Fx.promise(() => callVerifyCodeAndSignIn(ctx, {
-				params: args.params,
-				provider: provider.id,
-				generateTokens: options.generateTokens,
-				allowExtraProviders: options.allowExtraProviders
-			}));
+			let result;
+			try {
+				result = await callVerifyCodeAndSignIn(ctx, {
+					params: args.params,
+					provider: provider.id,
+					generateTokens: options.generateTokens,
+					allowExtraProviders: options.allowExtraProviders
+				});
+			} catch (error) {
+				throw asConvexError(error, "INTERNAL_ERROR", "Failed to verify email or phone code.");
+			}
+			if (result === null) throw toConvexError(authFlowError("INVALID_VERIFICATION_CODE", "Invalid or expired verification code."));
 			return {
 				kind: "signedIn",
-				signedIn: yield* result != null ? Fx.succeed(result) : Cv.fail({
-					code: "INVALID_VERIFICATION_CODE",
-					message: "Invalid or expired verification code."
-				})
+				signedIn: result
 			};
 		}
-		const code = provider.generateVerificationToken ? yield* Fx.from({
-			ok: async () => provider.generateVerificationToken(),
-			err: () => Cv.error({
-				code: "INTERNAL_ERROR",
-				message: "Failed to generate verification token"
-			})
-		}) : generateRandomString(32, "0123456789ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz");
+		const alphabet = "0123456789ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz";
+		let code;
+		if (provider.generateVerificationToken) try {
+			code = await provider.generateVerificationToken();
+		} catch {
+			throw toConvexError(authFlowError("INTERNAL_ERROR", "Failed to generate verification token"));
+		}
+		else code = generateRandomString(32, alphabet);
 		const expirationTime = Date.now() + (provider.maxAge ?? DEFAULT_EMAIL_VERIFICATION_CODE_DURATION_S) * 1e3;
-		const verificationArgs = {
-			identifier: yield* Fx.promise(() => callCreateVerificationCode(ctx, {
+		let identifier;
+		try {
+			identifier = await callCreateVerificationCode(ctx, {
 				provider: provider.id,
 				accountId: args.accountId,
-				email: args.params?.email,
-				phone: args.params?.phone,
+				email: normalizedParams.email,
+				phone: normalizedParams.phone,
 				code,
 				expirationTime,
 				allowExtraProviders: options.allowExtraProviders
-			})),
-			url: setURLSearchParam(yield* Fx.promise(() => redirectAbsoluteUrl(ctx.auth.config, args.params ?? {})), "code", code),
+			});
+		} catch (error) {
+			throw asConvexError(error, "INTERNAL_ERROR", "Failed to create verification code.");
+		}
+		let destination;
+		try {
+			destination = await redirectAbsoluteUrl(ctx.auth.config, args.params ?? {});
+		} catch (error) {
+			throw asConvexError(error, "INVALID_REDIRECT", "Failed to resolve redirect URL.");
+		}
+		const verificationArgs = {
+			identifier,
+			url: setURLSearchParam(destination, "code", code),
 			token: code,
 			expires: new Date(expirationTime)
 		};
-		yield* Fx.match(provider).on("type", {
-			email: (p) => Fx.from({
-				ok: async () => p.sendVerificationRequest({
-					...verificationArgs,
-					provider: p,
-					request: new Request("http://localhost")
-				}, ctx),
-				err: () => Cv.error({
-					code: "INTERNAL_ERROR",
-					message: "Failed to send email code"
-				})
-			}),
-			phone: (p) => Fx.from({
-				ok: async () => p.sendVerificationRequest({
-					...verificationArgs,
-					provider: p
-				}, ctx),
-				err: () => Cv.error({
-					code: "INTERNAL_ERROR",
-					message: "Failed to send phone code"
-				})
-			})
-		});
+		if (provider.type === "email") try {
+			await provider.sendVerificationRequest({
+				...verificationArgs,
+				provider,
+				request: new Request("http://localhost")
+			}, ctx);
+		} catch {
+			throw toConvexError(authFlowError("INTERNAL_ERROR", "Failed to send email code"));
+		}
+		else try {
+			await provider.sendVerificationRequest({
+				...verificationArgs,
+				provider
+			}, ctx);
+		} catch {
+			throw toConvexError(authFlowError("INTERNAL_ERROR", "Failed to send phone code"));
+		}
 		return {
 			kind: "started",
 			started: true
 		};
 	});
 }
-function handleCredentialsFx(ctx, provider, args, options) {
-	return Fx.gen(function* () {
-		const result = yield* Fx.promise(() => provider.authorize(args.params ?? {}, ctx));
+async function handleCredentialsFx(ctx, provider, args, options) {
+	return withSpan("convex-auth.signin.credentials", {}, async () => {
+		let result;
+		try {
+			result = await provider.authorize(args.params ?? {}, ctx);
+		} catch (error) {
+			throw asCredentialsError(error);
+		}
 		if (result === null) return {
 			kind: "signedIn",
 			signedIn: null
 		};
-		if (yield* Fx.promise(async () => {
-			return await queryTotpVerifiedByUserId(ctx, result.userId) !== null;
-		})) {
-			yield* Fx.promise(() => callSignIn(ctx, {
-				userId: result.userId,
-				sessionId: result.sessionId,
-				generateTokens: false
-			}));
-			const verifier = yield* Fx.promise(() => callVerifier(ctx));
-			yield* Fx.promise(() => callVerifierSignature(ctx, {
-				verifier,
-				signature: JSON.stringify({ userId: result.userId })
-			}));
+		let hasTotpEnrolled;
+		try {
+			hasTotpEnrolled = await queryTotpVerifiedByUserId(ctx, result.userId) !== null;
+		} catch (error) {
+			throw asConvexError(error, "INTERNAL_ERROR", "Failed to load TOTP enrollment.");
+		}
+		if (hasTotpEnrolled) {
+			try {
+				await callSignIn(ctx, {
+					userId: result.userId,
+					sessionId: result.sessionId,
+					generateTokens: false
+				});
+			} catch (error) {
+				throw asConvexError(error, "INTERNAL_ERROR", "Failed to start TOTP sign-in.");
+			}
+			let verifier;
+			try {
+				verifier = await callVerifier(ctx, JSON.stringify({ userId: result.userId }));
+			} catch (error) {
+				throw asConvexError(error, "INTERNAL_ERROR", "Failed to create verifier.");
+			}
 			return {
 				kind: "totpRequired",
 				verifier
 			};
 		}
-		return {
-			kind: "signedIn",
-			signedIn: yield* Fx.promise(() => callSignIn(ctx, {
+		let idsAndTokens;
+		try {
+			idsAndTokens = await callSignIn(ctx, {
 				userId: result.userId,
 				sessionId: result.sessionId,
 				generateTokens: options.generateTokens
-			}))
+			});
+		} catch (error) {
+			throw asConvexError(error, "INTERNAL_ERROR", "Failed to complete sign-in.");
+		}
+		return {
+			kind: "signedIn",
+			signedIn: idsAndTokens
 		};
 	});
 }
-function handleOAuthProviderFx(ctx, provider, args, options) {
-	return Fx.gen(function* () {
-		if (args.params?.code !== void 0) return {
-			kind: "signedIn",
-			signedIn: yield* Fx.promise(() => callVerifyCodeAndSignIn(ctx, {
-				params: args.params,
-				verifier: args.verifier,
-				generateTokens: true,
-				allowExtraProviders: options.allowExtraProviders
-			}))
-		};
-		const redirect = new URL((process.env.CUSTOM_AUTH_SITE_URL ?? requireEnv("CONVEX_SITE_URL")) + `/api/auth/signin/${provider.id}`);
-		const verifier = yield* Fx.promise(() => callVerifier(ctx));
+async function handleOAuthProviderFx(ctx, provider, args, options) {
+	return withSpan(`convex-auth.signin.oauth`, { provider: provider.id }, async () => {
+		if (args.params?.code !== void 0) {
+			let result;
+			try {
+				result = await callVerifyCodeAndSignIn(ctx, {
+					params: args.params,
+					verifier: args.verifier,
+					generateTokens: true,
+					allowExtraProviders: options.allowExtraProviders
+				});
+			} catch (error) {
+				throw asConvexError(error, "INTERNAL_ERROR", "Failed to verify OAuth sign-in.");
+			}
+			return {
+				kind: "signedIn",
+				signedIn: result
+			};
+		}
+		const redirect = new URL((readConfigSync(envOptionalString("CUSTOM_AUTH_SITE_URL")) ?? requireEnv("CONVEX_SITE_URL")) + `/api/auth/signin/${provider.id}`);
+		let verifier;
+		try {
+			verifier = await callVerifier(ctx);
+		} catch (error) {
+			throw asConvexError(error, "INTERNAL_ERROR", "Failed to create verifier.");
+		}
 		redirect.searchParams.set("code", verifier);
 		if (args.params?.redirectTo !== void 0) {
-			yield* Fx.guard(typeof args.params.redirectTo !== "string", Cv.fail({
-				code: "INVALID_REDIRECT",
-				message: `Expected \`redirectTo\` to be a string, got ${args.params.redirectTo}`
-			}));
+			if (typeof args.params.redirectTo !== "string") throw toConvexError(authFlowError("INVALID_REDIRECT", `Expected \`redirectTo\` to be a string, got ${describeUnknown(args.params.redirectTo)}`));
 			redirect.searchParams.set("redirectTo", args.params.redirectTo);
 		}
 		return {
@@ -195,23 +267,40 @@ function handleOAuthProviderFx(ctx, provider, args, options) {
 		};
 	});
 }
-function handleSsoProviderFx(ctx, args) {
-	return Fx.gen(function* () {
-		const enterpriseId = args.params?.enterpriseId;
-		if (!enterpriseId || typeof enterpriseId !== "string") return yield* Cv.fail({
-			code: "SIGN_IN_MISSING_PARAMS",
-			message: "enterpriseId is required for SSO sign-in."
-		});
-		const protocol = args.params?.protocol ?? "oidc";
-		if (protocol !== "oidc" && protocol !== "saml") return yield* Cv.fail({
-			code: "SIGN_IN_MISSING_PARAMS",
-			message: `Invalid SSO protocol: ${protocol}. Expected "oidc" or "saml".`
+async function handleSsoProviderFx(ctx, args, options) {
+	return withSpan("convex-auth.signin.sso", {}, async () => {
+		const normalizedParams = normalizeVerificationParams(args.params);
+		const connectionId = normalizedParams.connectionId;
+		if (!connectionId || typeof connectionId !== "string") throw toConvexError(authFlowError("SIGN_IN_MISSING_PARAMS", "connectionId is required for SSO sign-in."));
+		let protocol = (normalizedParams.protocol === "oidc" || normalizedParams.protocol === "saml" ? normalizedParams.protocol : void 0) ?? (options.resolveSsoProtocol ? await (async () => {
+			try {
+				return await options.resolveSsoProtocol(ctx, connectionId);
+			} catch (error) {
+				throw asConvexError(error, "INTERNAL_ERROR", "Failed to resolve SSO protocol.");
+			}
+		})() : "oidc");
+		log("DEBUG", "[group-sso] signin:resolved", {
+			connectionId,
+			protocol,
+			redirectTo: typeof args.params?.redirectTo === "string" ? args.params.redirectTo : void 0
 		});
-		const verifier = yield* Fx.promise(() => callVerifier(ctx));
-		const siteUrl = process.env.CUSTOM_AUTH_SITE_URL ?? requireEnv("CONVEX_SITE_URL");
-		const redirect = new URL(`${siteUrl}/api/auth/sso/${enterpriseId}/${protocol}/signin`);
+		if (protocol !== "oidc" && protocol !== "saml") throw toConvexError(authFlowError("SIGN_IN_MISSING_PARAMS", `Invalid SSO protocol: ${protocol}. Expected "oidc" or "saml".`));
+		let verifier;
+		try {
+			verifier = await callVerifier(ctx);
+		} catch (error) {
+			throw asConvexError(error, "INTERNAL_ERROR", "Failed to create verifier.");
+		}
+		const siteUrl = readConfigSync(envOptionalString("CUSTOM_AUTH_SITE_URL")) ?? requireEnv("CONVEX_SITE_URL");
+		const redirect = new URL(`${siteUrl}/api/auth/connections/${connectionId}/${protocol}/signin`);
 		redirect.searchParams.set("code", verifier);
 		if (typeof args.params?.redirectTo === "string") redirect.searchParams.set("redirectTo", args.params.redirectTo);
+		if (typeof normalizedParams.loginHint === "string") redirect.searchParams.set("loginHint", normalizedParams.loginHint);
+		log("DEBUG", "[group-sso] signin:redirect", {
+			connectionId,
+			protocol,
+			redirect: redirect.toString()
+		});
 		return {
 			kind: "redirect",
 			redirect: redirect.toString(),

package/dist/server/{enterprise → sso}/config.js

@@ -1,6 +1,6 @@
 import { asRecord } from "./shared.js";
 
-//#region src/server/enterprise/config.ts
+//#region src/server/sso/config.ts
 const getProtocolConfig = (config, protocol) => {
 	const base = asRecord(config);
 	const direct = base?.[protocol];
@@ -13,8 +13,15 @@ function getOidcConfig(config) {
 }
 /** @internal */
 function getPublicOidcConfig(config) {
-	const { clientSecret: _clientSecret, ...publicOidc } = getOidcConfig(config);
-	return publicOidc;
+	const oidc = getOidcConfig(config);
+	const client = typeof oidc.client === "object" && oidc.client !== null ? oidc.client : void 0;
+	return {
+		...oidc,
+		...client ? { client: {
+			...client,
+			secret: void 0
+		} } : {}
+	};
 }
 /** @internal */
 function withOidcSecretState(config, hasClientSecret) {