@robelest/convex-auth 0.0.4-preview.25 → 0.0.4-preview.28

package/dist/server/types.js

@@ -48,35 +48,6 @@ async function mutatePasskeyUpdateCounter(ctx, passkeyId, counter, lastUsedAt) {
 		lastUsedAt
 	});
 }
-async function mutateKeyInsert(ctx, args) {
-	return await ctx.runMutation(ctx.auth.config.component.public.keyInsert, args);
-}
-async function queryKeysByUserId(ctx, userId) {
-	const items = [];
-	let cursor = null;
-	do {
-		const page = await ctx.runQuery(ctx.auth.config.component.public.keyList, {
-			where: { userId },
-			limit: 100,
-			cursor
-		});
-		items.push(...page.items);
-		cursor = page.nextCursor;
-	} while (cursor !== null);
-	return items;
-}
-async function queryKeyById(ctx, keyId) {
-	return await ctx.runQuery(ctx.auth.config.component.public.keyGetById, { keyId });
-}
-async function mutateKeyPatch(ctx, keyId, data) {
-	await ctx.runMutation(ctx.auth.config.component.public.keyPatch, {
-		keyId,
-		data
-	});
-}
-async function mutateKeyDelete(ctx, keyId) {
-	await ctx.runMutation(ctx.auth.config.component.public.keyDelete, { keyId });
-}
 async function mutateDeviceInsert(ctx, args) {
 	return await ctx.runMutation(ctx.auth.config.component.public.deviceInsert, args);
 }
@@ -104,5 +75,5 @@ async function mutateDeviceDelete(ctx, deviceId) {
 }
 
 //#endregion
-export { mutateDeviceAuthorize, mutateDeviceDelete, mutateDeviceInsert, mutateDeviceUpdateLastPolled, mutateKeyDelete, mutateKeyInsert, mutateKeyPatch, mutatePasskeyInsert, mutatePasskeyUpdateCounter, mutateTotpInsert, mutateTotpMarkVerified, mutateTotpUpdateLastUsed, mutateVerifierDelete, queryDeviceByCodeHash, queryDeviceByUserCode, queryKeyById, queryKeysByUserId, queryPasskeyByCredentialId, queryPasskeysByUserId, queryTotpById, queryTotpVerifiedByUserId, queryUserById, queryUserByVerifiedEmail, queryVerifierById };
+export { mutateDeviceAuthorize, mutateDeviceDelete, mutateDeviceInsert, mutateDeviceUpdateLastPolled, mutatePasskeyInsert, mutatePasskeyUpdateCounter, mutateTotpInsert, mutateTotpMarkVerified, mutateTotpUpdateLastUsed, mutateVerifierDelete, queryDeviceByCodeHash, queryDeviceByUserCode, queryPasskeyByCredentialId, queryPasskeysByUserId, queryTotpById, queryTotpVerifiedByUserId, queryUserById, queryUserByVerifiedEmail, queryVerifierById };
 //# sourceMappingURL=types.js.map

package/dist/server/url.js

@@ -0,0 +1,32 @@
+import { envOptionalString, readConfigSync, requireEnv } from "./env.js";
+
+//#region src/server/url.ts
+/** @internal */
+function normalizeUrl(url) {
+	return url.replace(/\/$/, "");
+}
+/** @internal */
+function siteUrlsFromEnv() {
+	const primaryUrl = normalizeUrl(requireEnv("SITE_URL"));
+	const secondaryUrls = readConfigSync(envOptionalString("SECONDARY_URL"))?.split(",").map((url) => url.trim()).filter((url) => url.length > 0).map(normalizeUrl) ?? [];
+	return {
+		primaryUrl,
+		allowedUrls: [...new Set([primaryUrl, ...secondaryUrls])]
+	};
+}
+/** @internal */
+function isLocalHost(host) {
+	if (host === void 0) return false;
+	const raw = host.includes("://") ? host : `http://${host}`;
+	let url;
+	try {
+		url = new URL(raw);
+	} catch {
+		return false;
+	}
+	return url.hostname === "localhost" || url.hostname === "127.0.0.1" || url.hostname === "::1";
+}
+
+//#endregion
+export { isLocalHost, siteUrlsFromEnv };
+//# sourceMappingURL=url.js.map

package/dist/server/users.js

@@ -1,7 +1,7 @@
-import { LOG_LEVELS, logWithLevel } from "./utils.js";
+import { LOG_LEVELS } from "../shared/log.js";
 import { authDb } from "./db.js";
-import { Fx } from "@robelest/fx";
-import { Cv } from "@robelest/fx/convex";
+import { log } from "./log.js";
+import { ConvexError } from "convex/values";
 
 //#region src/server/users.ts
 function mergeExtend(existing, incoming) {
@@ -12,16 +12,35 @@ function mergeExtend(existing, incoming) {
 		...incoming
 	} : incoming;
 }
+function effectiveUserUpdateMode(source, policy) {
+	const authority = policy?.authority ?? "app";
+	let mode = source === "login" ? policy?.updateProfileOnLogin ?? "missing" : policy?.updateProfileFromScim ?? "always";
+	if (authority === "app") return mode === "never" ? "never" : "missing";
+	if (authority === "sso" && source === "scim") return mode === "never" ? "never" : "missing";
+	if (authority === "scim" && source === "login") return mode === "never" ? "never" : "missing";
+	return mode;
+}
+function isUserFieldMissing(value) {
+	return value === void 0 || value === null || value === "";
+}
+function buildUserPatchData(args) {
+	if (args.mode === "never") return {};
+	if (args.mode === "always") return args.nextUser;
+	return Object.fromEntries(Object.entries(args.nextUser).filter(([key, value]) => {
+		if (value === void 0) return false;
+		return isUserFieldMissing(args.currentUser[key]);
+	}));
+}
 /** @internal */
 async function upsertUserAndAccount(ctx, sessionId, account, args, config, opts) {
-	const userId = await defaultCreateOrUpdateUser(ctx, sessionId, "existingAccount" in account ? account.existingAccount : null, args, config, opts?.existingUserId ?? null);
+	const userId = await defaultCreateOrUpdateUser(ctx, sessionId, "existingAccount" in account ? account.existingAccount : null, args, config, opts?.existingUserId ?? null, opts?.provisioningUser, opts?.source ?? "login");
 	return {
 		userId,
 		accountId: await createOrUpdateAccount(ctx, userId, account, args, config)
 	};
 }
-async function defaultCreateOrUpdateUser(ctx, existingSessionId, existingAccount, args, config, existingUserIdOverride) {
-	logWithLevel(LOG_LEVELS.DEBUG, "defaultCreateOrUpdateUser args:", {
+async function defaultCreateOrUpdateUser(ctx, existingSessionId, existingAccount, args, config, existingUserIdOverride, provisioningUser, source) {
+	log(LOG_LEVELS.DEBUG, "defaultCreateOrUpdateUser args:", {
 		existingAccountId: existingAccount?._id,
 		existingSessionId,
 		args
@@ -29,7 +48,7 @@ async function defaultCreateOrUpdateUser(ctx, existingSessionId, existingAccount
 	const existingUserId = existingAccount?.userId ?? null;
 	const db = authDb(ctx, config);
 	if (config.callbacks?.createOrUpdateUser !== void 0) {
-		logWithLevel(LOG_LEVELS.DEBUG, "Using custom createOrUpdateUser callback");
+		log(LOG_LEVELS.DEBUG, "Using custom createOrUpdateUser callback");
 		return await config.callbacks.createOrUpdateUser(ctx, {
 			existingUserId,
 			...args
@@ -44,29 +63,27 @@ async function defaultCreateOrUpdateUser(ctx, existingSessionId, existingAccount
 	if (existingUserId === null) {
 		const existingUserWithVerifiedEmailId = typeof profile.email === "string" && shouldLinkViaEmail ? (await uniqueUserWithVerifiedEmail(ctx, profile.email, config))?._id ?? null : null;
 		const existingUserWithVerifiedPhoneId = typeof profile.phone === "string" && shouldLinkViaPhone ? (await uniqueUserWithVerifiedPhone(ctx, profile.phone, config))?._id ?? null : null;
-		const linkDispatch = {
-			tag: existingUserWithVerifiedEmailId !== null && existingUserWithVerifiedPhoneId !== null ? "both" : existingUserWithVerifiedEmailId !== null ? "email" : existingUserWithVerifiedPhoneId !== null ? "phone" : "none",
-			existingUserWithVerifiedEmailId,
-			existingUserWithVerifiedPhoneId
-		};
-		userId = await Fx.run({
-			both: () => Fx.sync(() => {
-				logWithLevel(LOG_LEVELS.DEBUG, `Found existing email and phone verified users, so not linking: email: ${linkDispatch.existingUserWithVerifiedEmailId}, phone: ${linkDispatch.existingUserWithVerifiedPhoneId}`);
-				return null;
-			}),
-			email: () => Fx.sync(() => {
-				logWithLevel(LOG_LEVELS.DEBUG, `Found existing email verified user, linking: ${linkDispatch.existingUserWithVerifiedEmailId}`);
-				return linkDispatch.existingUserWithVerifiedEmailId;
-			}),
-			phone: () => Fx.sync(() => {
-				logWithLevel(LOG_LEVELS.DEBUG, `Found existing phone verified user, linking: ${linkDispatch.existingUserWithVerifiedPhoneId}`);
-				return linkDispatch.existingUserWithVerifiedPhoneId;
-			}),
-			none: () => Fx.sync(() => {
-				logWithLevel(LOG_LEVELS.DEBUG, "No existing verified users found, creating new user");
-				return null;
-			})
-		}[linkDispatch.tag]());
+		if (existingUserWithVerifiedEmailId !== null && existingUserWithVerifiedPhoneId !== null) {
+			log(LOG_LEVELS.DEBUG, `Found existing email and phone verified users, so not linking: email: ${existingUserWithVerifiedEmailId}, phone: ${existingUserWithVerifiedPhoneId}`);
+			userId = null;
+		} else if (existingUserWithVerifiedEmailId !== null) {
+			log(LOG_LEVELS.DEBUG, `Found existing email verified user, linking: ${existingUserWithVerifiedEmailId}`);
+			userId = existingUserWithVerifiedEmailId;
+		} else if (existingUserWithVerifiedPhoneId !== null) {
+			log(LOG_LEVELS.DEBUG, `Found existing phone verified user, linking: ${existingUserWithVerifiedPhoneId}`);
+			userId = existingUserWithVerifiedPhoneId;
+		} else {
+			log(LOG_LEVELS.DEBUG, "No existing verified users found, creating new user");
+			userId = null;
+		}
+		if (userId !== null && config.sso?.hooks?.allowLink !== void 0 && (args.provider.type === "oauth" || args.provider.type === "sso")) {
+			if (await config.sso.hooks.allowLink({
+				protocol: args.provider.type === "oauth" && typeof args.accountExtend?.identity?.protocol === "string" ? args.accountExtend.identity.protocol : "oidc",
+				connectionId: typeof args.accountExtend?.identity?.connectionId === "string" ? args.accountExtend.identity.connectionId : void 0,
+				profile: args.profile,
+				userId
+			}) === false) userId = null;
+		}
 	}
 	const userData = {
 		...emailVerified ? { emailVerificationTime: Date.now() } : null,
@@ -74,23 +91,40 @@ async function defaultCreateOrUpdateUser(ctx, existingSessionId, existingAccount
 		...profile
 	};
 	const existingOrLinkedUserId = userId;
-	if (userId !== null) await Fx.run(Fx.from({
-		ok: () => db.users.patch(userId, userData),
-		err: (error) => Cv.error({
-			code: "USER_UPDATE_FAILED",
-			message: `Could not update user document with ID \`${userId}\`, either the user has been deleted but their account has not, or the profile data doesn't match the \`users\` table schema: ${error.message}`
-		})
-	}).pipe(Fx.recover((e) => Fx.fatal(e))));
-	else userId = await db.users.insert(userData);
+	if (userId !== null) {
+		const currentUserId = userId;
+		const currentUser = await db.users.getById(currentUserId);
+		const mode = effectiveUserUpdateMode(source, provisioningUser);
+		const patchData = buildUserPatchData({
+			currentUser: currentUser ?? {},
+			nextUser: userData,
+			mode
+		});
+		if (Object.keys(patchData).length === 0) return userId;
+		try {
+			await db.users.patch(currentUserId, patchData);
+		} catch (error) {
+			throw new ConvexError({
+				code: "USER_UPDATE_FAILED",
+				message: `Could not update user document with ID \`${currentUserId}\`, either the user has been deleted but their account has not, or the profile data doesn't match the \`users\` table schema: ${error instanceof Error ? error.message : String(error)}`
+			});
+		}
+	} else {
+		if (source === "login" && provisioningUser?.createOnSignIn === false) throw new ConvexError({
+			code: "NOT_AUTHORIZED",
+			message: "This SSO connection does not allow creating users on sign-in."
+		});
+		userId = await db.users.insert(userData);
+	}
 	const afterUserCreatedOrUpdated = config.callbacks?.afterUserCreatedOrUpdated;
 	if (afterUserCreatedOrUpdated !== void 0) {
-		logWithLevel(LOG_LEVELS.DEBUG, "Calling custom afterUserCreatedOrUpdated callback");
+		log(LOG_LEVELS.DEBUG, "Calling custom afterUserCreatedOrUpdated callback");
 		await afterUserCreatedOrUpdated(ctx, {
 			userId,
 			existingUserId: existingOrLinkedUserId,
 			...args
 		});
-	} else logWithLevel(LOG_LEVELS.DEBUG, "No custom afterUserCreatedOrUpdated callback, skipping");
+	} else log(LOG_LEVELS.DEBUG, "No custom afterUserCreatedOrUpdated callback, skipping");
 	return userId;
 }
 async function uniqueUserWithVerifiedEmail(ctx, email, config) {

package/dist/server/utils/cache.js

@@ -0,0 +1,51 @@
+//#region src/server/utils/cache.ts
+/**
+* Create a synchronous TTL cache.
+*
+* ```ts
+* const jwksCache = createCache({
+*   capacity: 128,
+*   timeToLiveMs: 60 * 60 * 1000,
+*   lookup: (url) => createRemoteJWKSet(new URL(url)),
+* });
+* const jwks = jwksCache.get(url);
+* ```
+*/
+function createCache(opts) {
+	const { capacity, timeToLiveMs, lookup } = opts;
+	const store = /* @__PURE__ */ new Map();
+	function evictExpired() {
+		const now = Date.now();
+		for (const [key, entry] of store) if (entry.expiresAt <= now) store.delete(key);
+	}
+	function evictOldest() {
+		if (store.size < capacity) return;
+		const firstKey = store.keys().next().value;
+		if (firstKey !== void 0) store.delete(firstKey);
+	}
+	return {
+		get(key) {
+			const existing = store.get(key);
+			if (existing && existing.expiresAt > Date.now()) return existing.value;
+			if (existing) store.delete(key);
+			evictExpired();
+			evictOldest();
+			const value = lookup(key);
+			store.set(key, {
+				value,
+				expiresAt: Date.now() + timeToLiveMs
+			});
+			return value;
+		},
+		invalidate(key) {
+			store.delete(key);
+		},
+		clear() {
+			store.clear();
+		}
+	};
+}
+
+//#endregion
+export { createCache };
+//# sourceMappingURL=cache.js.map

package/dist/server/utils/dispatch.js

@@ -0,0 +1,36 @@
+//#region src/server/utils/dispatch.ts
+/**
+* Build a dispatch function from a handler record.
+*
+* ```ts
+* const run = createDispatch({
+*   signIn:  (args) => handleSignIn(args),
+*   signOut: (args) => handleSignOut(args),
+* });
+* return await run("signIn", args);
+* ```
+*/
+function createDispatch(handlers) {
+	const map = new Map(Object.entries(handlers));
+	return ((key, ...args) => {
+		const handler = map.get(key);
+		if (!handler) throw new Error(`Unknown dispatch key: "${key}"`);
+		return handler(...args);
+	});
+}
+/**
+* Compose multiple dispatch tables into one.
+*
+* ```ts
+* const dispatch = composeDispatch(coreHandlers, ssoHandlers);
+* ```
+*/
+function composeDispatch(a, b) {
+	return {
+		...a,
+		...b
+	};
+}
+
+//#endregion
+export { composeDispatch, createDispatch };

package/dist/server/utils/retry.js

@@ -0,0 +1,24 @@
+//#region src/server/utils/retry.ts
+/**
+* Retry `fn` with exponential backoff until it succeeds or retries are
+* exhausted. On final failure the last error is re-thrown.
+*/
+async function retryWithBackoff(fn, opts = {}) {
+	const { maxRetries = 2, baseMs = 200, jitter = true } = opts;
+	let lastError;
+	for (let attempt = 0; attempt <= maxRetries; attempt++) try {
+		return await fn();
+	} catch (error) {
+		lastError = error;
+		if (attempt < maxRetries) {
+			const delay = baseMs * 2 ** attempt;
+			const jitterMs = jitter ? Math.random() * delay : 0;
+			await new Promise((resolve) => setTimeout(resolve, delay + jitterMs));
+		}
+	}
+	throw lastError;
+}
+
+//#endregion
+export { retryWithBackoff };
+//# sourceMappingURL=retry.js.map

package/dist/server/utils/span.js

@@ -0,0 +1,32 @@
+import { SpanStatusCode, trace } from "@opentelemetry/api";
+
+//#region src/server/utils/span.ts
+/**
+* Thin wrapper around `@opentelemetry/api` tracing.
+*
+* @module
+*/
+const tracer = trace.getTracer("convex-auth");
+/**
+* Run `fn` inside an OpenTelemetry span.
+*
+* If `fn` throws, the span is marked as errored and the exception is
+* recorded before re-throwing.
+*/
+async function withSpan(name, attributes, fn) {
+	return tracer.startActiveSpan(name, { attributes }, async (span) => {
+		try {
+			return await fn();
+		} catch (error) {
+			span.setStatus({ code: SpanStatusCode.ERROR });
+			if (error instanceof Error) span.recordException(error);
+			throw error;
+		} finally {
+			span.end();
+		}
+	});
+}
+
+//#endregion
+export { withSpan };
+//# sourceMappingURL=span.js.map

package/dist/shared/errors.js

@@ -0,0 +1,19 @@
+//#region src/shared/errors.ts
+var AuthFlowError = class extends Error {
+	_tag = "AuthFlowError";
+	code;
+	constructor({ code, message }) {
+		super(message);
+		this.code = code;
+		this.name = "AuthFlowError";
+	}
+};
+/** @internal */
+const authFlowError = (code, message) => new AuthFlowError({
+	code,
+	message
+});
+
+//#endregion
+export { AuthFlowError, authFlowError };
+//# sourceMappingURL=errors.js.map

package/dist/shared/log.js

@@ -0,0 +1,45 @@
+//#region src/shared/log.ts
+const LOG_LEVELS = {
+	ERROR: "ERROR",
+	WARN: "WARN",
+	INFO: "INFO",
+	DEBUG: "DEBUG"
+};
+function serialize(value) {
+	if (typeof value === "string") return value;
+	if (value instanceof Error) return `${value.message}${value.stack ? `\n${value.stack}` : ""}`;
+	try {
+		return JSON.stringify(value);
+	} catch {
+		return String(value);
+	}
+}
+function logMessage(module, level, args, configuredLogLevel = "INFO") {
+	const message = args.map(serialize).join(" ");
+	const meta = {
+		module,
+		level
+	};
+	const handler = {
+		ERROR: () => {
+			console.error(`[${meta.module}] [${meta.level}]`, message);
+		},
+		WARN: () => {
+			if (configuredLogLevel === "ERROR") return;
+			console.warn(`[${meta.module}] [${meta.level}]`, message);
+		},
+		INFO: () => {
+			if (configuredLogLevel !== "INFO" && configuredLogLevel !== "DEBUG") return;
+			console.info(`[${meta.module}] [${meta.level}]`, message);
+		},
+		DEBUG: () => {
+			if (configuredLogLevel !== "DEBUG") return;
+			console.debug(`[${meta.module}] [${meta.level}]`, message);
+		}
+	}[level];
+	if (handler) handler();
+}
+
+//#endregion
+export { LOG_LEVELS, logMessage };
+//# sourceMappingURL=log.js.map

package/{src/test.ts → dist/test.d.ts}

@@ -1,14 +1,7 @@
-import type { TestConvex } from "convex-test";
-import type { GenericSchema, SchemaDefinition } from "convex/server";
-
-import schema from "./component/schema";
-
-type ImportMetaWithGlob = ImportMeta & {
-  glob: (pattern: string) => Record<string, () => Promise<unknown>>;
-};
-
-const modules = (import.meta as ImportMetaWithGlob).glob("./component/**/*.ts");
+import { GenericSchema, SchemaDefinition } from "convex/server";
+import { TestConvex } from "convex-test";
 
+//#region src/test.d.ts
 /**
  * Register the Convex Auth component in a `convex-test` environment.
  *
@@ -28,21 +21,27 @@ const modules = (import.meta as ImportMetaWithGlob).glob("./component/**/*.ts");
  * register(t);
  * ```
  */
-export function register(
-  t: TestConvex<SchemaDefinition<GenericSchema, boolean>>,
-  name: string = "auth",
-) {
-  t.registerComponent(name, schema, modules);
-}
-
+declare function register(t: TestConvex<SchemaDefinition<GenericSchema, boolean>>, name?: string): void;
+declare const testHelpers: {
+  register: typeof register;
+  schema: SchemaDefinition<GenericSchema, boolean>;
+  modules: Record<string, () => Promise<unknown>>;
+};
 /**
  * Test helpers bundled for `convex-test` setups.
  *
  * Exposes the auth component `schema`, lazily discovered `modules`, and the
  * `register()` helper as a convenience default export.
+ *
+ * @example
+ * ```ts
+ * import authTest from "@robelest/convex-auth/test";
+ * import { convexTest } from "convex-test";
+ *
+ * const t = convexTest(schema);
+ * authTest.register(t);
+ * ```
  */
-export default {
-  register,
-  schema,
-  modules,
-};
+//#endregion
+export { testHelpers as default, register };
+//# sourceMappingURL=test.d.ts.map

package/dist/test.js

@@ -0,0 +1,51 @@
+import modules_default from "./component/modules.js";
+import schema_default from "./component/schema.js";
+
+//#region src/test.ts
+/**
+* Register the Convex Auth component in a `convex-test` environment.
+*
+* Use this in tests to mount the bundled auth component under a chosen
+* component name before invoking its functions.
+*
+* @param t - The `convex-test` test harness.
+* @param name - Component mount name. Defaults to `"auth"`.
+* @returns Nothing.
+*
+* @example
+* ```ts
+* import { convexTest } from "convex-test";
+* import { register } from "@robelest/convex-auth/test";
+*
+* const t = convexTest(schema);
+* register(t);
+* ```
+*/
+function register(t, name = "auth") {
+	t.registerComponent(name, schema_default, modules_default);
+}
+const testHelpers = {
+	register,
+	schema: schema_default,
+	modules: modules_default
+};
+/**
+* Test helpers bundled for `convex-test` setups.
+*
+* Exposes the auth component `schema`, lazily discovered `modules`, and the
+* `register()` helper as a convenience default export.
+*
+* @example
+* ```ts
+* import authTest from "@robelest/convex-auth/test";
+* import { convexTest } from "convex-test";
+*
+* const t = convexTest(schema);
+* authTest.register(t);
+* ```
+*/
+var test_default = testHelpers;
+
+//#endregion
+export { test_default as default, register };
+//# sourceMappingURL=test.js.map