@robelest/convex-auth 0.0.4-preview.25 → 0.0.4-preview.28

package/dist/component/server/core.js

@@ -1,576 +0,0 @@
-import { getSessionUserId } from "./context.js";
-import { materializeProvider } from "./config.js";
-import { TOKEN_SUB_CLAIM_DIVIDER, generateRandomString, sha256 } from "./utils.js";
-import { buildScopeChecker, checkKeyRateLimit, generateApiKey, hashApiKey } from "./keys.js";
-import { signInImpl } from "./signin.js";
-import { Cv } from "@robelest/fx/convex";
-
-//#region src/server/core.ts
-/**
-* Build the core auth domains that back the canonical app API surface.
-*
-* Creates the grouped `user`, `session`, `account`, `provider`, `group`,
-* `member`, `invite`, and `key` APIs used by the higher-level auth
-* factory. Each namespace wraps the underlying Convex component functions with
-* application-friendly helpers, result shaping, and documentation-friendly
-* method names.
-*
-* @param deps - Internal component wiring, provider config, and helper
-*   functions needed to construct the domain API surface.
-* @returns The core domain namespaces consumed by the auth factory.
-*/
-function createCoreDomains(deps) {
-	const { config, getAuth, callInvalidateSessions, callCreateAccountFromCredentials, callRetrieveAccountWithCredentials, callModifyAccount, getEnrichCtx, inviteTokenAlphabet, inviteTokenLength } = deps;
-	const roleDefinitions = config.authorization.roles;
-	const getRoleDefinition = (roleId) => {
-		return roleDefinitions[roleId] ?? null;
-	};
-	const normalizeRoleIds = (roleIds) => {
-		const normalized = Array.from(new Set(roleIds ?? []));
-		const invalid = normalized.filter((id) => getRoleDefinition(id) === null);
-		if (invalid.length > 0) throw Cv.error({
-			code: "INVALID_ROLE_IDS",
-			message: "One or more role IDs are invalid.",
-			invalidRoleIds: invalid
-		});
-		return normalized;
-	};
-	const listAllKeysByUser = async (ctx, userId) => {
-		const items = [];
-		let cursor = null;
-		do {
-			const page = await ctx.runQuery(config.component.public.keyList, {
-				where: { userId },
-				limit: 100,
-				cursor
-			});
-			items.push(...page.items);
-			cursor = page.nextCursor;
-		} while (cursor !== null);
-		return items;
-	};
-	const listAllMembersByUser = async (ctx, userId) => {
-		const items = [];
-		let cursor = null;
-		do {
-			const page = await ctx.runQuery(config.component.public.memberList, {
-				where: { userId },
-				limit: 100,
-				cursor
-			});
-			items.push(...page.items);
-			cursor = page.nextCursor;
-		} while (cursor !== null);
-		return items;
-	};
-	const resolveGrantedPermissions = (roleIds) => {
-		const grants = /* @__PURE__ */ new Set();
-		for (const roleId of roleIds ?? []) {
-			const role = getRoleDefinition(roleId);
-			if (role === null) continue;
-			for (const grant of role.grants) grants.add(grant);
-		}
-		return Array.from(grants).sort();
-	};
-	const AUTH_CACHE = Symbol("__convexAuthCache");
-	function cache(ctx) {
-		if (!ctx[AUTH_CACHE]) ctx[AUTH_CACHE] = {
-			users: /* @__PURE__ */ new Map(),
-			groups: /* @__PURE__ */ new Map()
-		};
-		return ctx[AUTH_CACHE];
-	}
-	const user = {
-		get: async (ctx, userId) => {
-			const c = cache(ctx);
-			if (c.users.has(userId)) return c.users.get(userId);
-			const result = await ctx.runQuery(config.component.public.userGetById, { userId });
-			c.users.set(userId, result);
-			return result;
-		},
-		list: async (ctx, opts = {}) => {
-			return await ctx.runQuery(config.component.public.userList, opts);
-		},
-		viewer: async (ctx) => {
-			const userId = await getSessionUserId(ctx);
-			if (userId === null) return null;
-			return await user.get(ctx, userId);
-		},
-		update: async (ctx, userId, data) => {
-			await ctx.runMutation(config.component.public.userPatch, {
-				userId,
-				data
-			});
-			return { userId };
-		},
-		setActiveGroup: async (ctx, opts) => {
-			const doc = await user.get(ctx, opts.userId);
-			const existingExtend = doc !== null && doc.extend !== null && typeof doc.extend === "object" && !Array.isArray(doc.extend) ? { ...doc.extend } : {};
-			if (opts.groupId === null) {
-				const { lastActiveGroup: _omit, ...rest } = existingExtend;
-				await user.update(ctx, opts.userId, { extend: rest });
-				return {
-					userId: opts.userId,
-					groupId: null
-				};
-			}
-			await user.update(ctx, opts.userId, { extend: {
-				...existingExtend,
-				lastActiveGroup: opts.groupId
-			} });
-			return {
-				userId: opts.userId,
-				groupId: opts.groupId
-			};
-		},
-		getActiveGroup: async (ctx, opts) => {
-			const doc = await user.get(ctx, opts.userId);
-			if (doc !== null && doc.extend !== null && typeof doc.extend === "object" && !Array.isArray(doc.extend)) {
-				const val = doc.extend.lastActiveGroup;
-				if (typeof val === "string") return val;
-			}
-			return null;
-		},
-		delete: async (ctx, userId, opts) => {
-			const cascade = opts?.cascade !== false;
-			const [sessions, accounts, keys, members, passkeys, totps] = await Promise.all([
-				ctx.runQuery(config.component.public.sessionListByUser, { userId }),
-				ctx.runQuery(config.component.public.accountListByUser, { userId }),
-				listAllKeysByUser(ctx, userId),
-				listAllMembersByUser(ctx, userId),
-				ctx.runQuery(config.component.public.passkeyListByUserId, { userId }),
-				ctx.runQuery(config.component.public.totpListByUserId, { userId })
-			]);
-			const totalLinked = sessions.length + accounts.length + keys.length + members.length + passkeys.length + totps.length;
-			if (!cascade && totalLinked > 0) throw Cv.error({
-				code: "INVALID_PARAMETERS",
-				message: "The provided parameters are invalid."
-			});
-			const deletions = [];
-			for (const s of sessions) deletions.push(ctx.runMutation(config.component.public.sessionDelete, { sessionId: s._id }));
-			for (const a of accounts) deletions.push(ctx.runMutation(config.component.public.accountDelete, { accountId: a._id }));
-			for (const k of keys) deletions.push(ctx.runMutation(config.component.public.keyDelete, { keyId: k._id }));
-			for (const m of members) deletions.push(ctx.runMutation(config.component.public.memberRemove, { memberId: m._id }));
-			for (const p of passkeys) deletions.push(ctx.runMutation(config.component.public.passkeyDelete, { passkeyId: p._id }));
-			for (const t of totps) deletions.push(ctx.runMutation(config.component.public.totpDelete, { totpId: t._id }));
-			await Promise.all(deletions);
-			await ctx.runMutation(config.component.public.userDelete, { userId });
-			return { userId };
-		}
-	};
-	const session = {
-		current: async (ctx) => {
-			const identity = await ctx.auth.getUserIdentity();
-			if (identity === null) return null;
-			const [, sessionId] = identity.subject.split(TOKEN_SUB_CLAIM_DIVIDER);
-			return sessionId;
-		},
-		invalidate: async (ctx, args) => {
-			await callInvalidateSessions(ctx, args);
-			return {
-				userId: args.userId,
-				except: args.except ?? []
-			};
-		},
-		get: async (ctx, sessionId) => {
-			return await ctx.runQuery(config.component.public.sessionGetById, { sessionId });
-		},
-		list: async (ctx, opts) => {
-			return await ctx.runQuery(config.component.public.sessionListByUser, { userId: opts.userId });
-		}
-	};
-	const account = {
-		create: async (ctx, args) => {
-			return { ...await callCreateAccountFromCredentials(ctx, args) };
-		},
-		get: async (ctx, args) => {
-			const result = await callRetrieveAccountWithCredentials(ctx, args);
-			if (typeof result === "string") return null;
-			return result;
-		},
-		update: async (ctx, args) => {
-			await callModifyAccount(ctx, args);
-			return { accountId: args.account.id };
-		},
-		delete: async (ctx, accountId) => {
-			const doc = await ctx.runQuery(config.component.public.accountGetById, { accountId });
-			if (doc === null) throw Cv.error({
-				code: "ACCOUNT_NOT_FOUND",
-				message: "Account not found."
-			});
-			if ((await ctx.runQuery(config.component.public.accountListByUser, { userId: doc.userId })).length <= 1) throw Cv.error({
-				code: "INVALID_PARAMETERS",
-				message: "The provided parameters are invalid."
-			});
-			await ctx.runMutation(config.component.public.accountDelete, { accountId });
-			return { accountId };
-		},
-		listPasskeys: async (ctx, opts) => {
-			return await ctx.runQuery(config.component.public.passkeyListByUserId, opts);
-		},
-		renamePasskey: async (ctx, passkeyId, name) => {
-			await ctx.runMutation(config.component.public.passkeyUpdateMeta, {
-				passkeyId,
-				data: { name }
-			});
-			return { passkeyId };
-		},
-		deletePasskey: async (ctx, passkeyId) => {
-			await ctx.runMutation(config.component.public.passkeyDelete, { passkeyId });
-			return { passkeyId };
-		},
-		listTotps: async (ctx, opts) => {
-			return await ctx.runQuery(config.component.public.totpListByUserId, opts);
-		},
-		deleteTotp: async (ctx, totpId) => {
-			await ctx.runMutation(config.component.public.totpDelete, { totpId });
-			return { totpId };
-		}
-	};
-	const provider = { signIn: async (ctx, providerConfig, args) => {
-		const result = await signInImpl(getEnrichCtx()(ctx), materializeProvider(providerConfig), args, {
-			generateTokens: false,
-			allowExtraProviders: true
-		});
-		return result.kind === "signedIn" ? result.signedIn !== null ? {
-			userId: result.signedIn.userId,
-			sessionId: result.signedIn.sessionId
-		} : null : null;
-	} };
-	const group = {
-		create: async (ctx, data) => {
-			return { groupId: await ctx.runMutation(config.component.public.groupCreate, data) };
-		},
-		get: async (ctx, groupId) => {
-			const c = cache(ctx);
-			if (c.groups.has(groupId)) return c.groups.get(groupId);
-			const result = await ctx.runQuery(config.component.public.groupGet, { groupId });
-			c.groups.set(groupId, result);
-			return result;
-		},
-		list: async (ctx, opts) => {
-			return await ctx.runQuery(config.component.public.groupList, {
-				where: opts?.where,
-				limit: opts?.limit,
-				cursor: opts?.cursor,
-				orderBy: opts?.orderBy,
-				order: opts?.order
-			});
-		},
-		update: async (ctx, groupId, data) => {
-			await ctx.runMutation(config.component.public.groupUpdate, {
-				groupId,
-				data
-			});
-			return { groupId };
-		},
-		delete: async (ctx, groupId) => {
-			await ctx.runMutation(config.component.public.groupDelete, { groupId });
-			return { groupId };
-		},
-		ancestors: async (ctx, opts) => {
-			const maxDepth = Math.max(0, Math.floor(opts.maxDepth ?? 32));
-			const visited = /* @__PURE__ */ new Set();
-			const ancestors = [];
-			let cycleDetected = false;
-			let maxDepthReached = false;
-			let currentGroupId = opts.groupId;
-			let depth = 0;
-			let isFirst = true;
-			while (currentGroupId !== void 0) {
-				if (depth > maxDepth) {
-					maxDepthReached = true;
-					break;
-				}
-				if (visited.has(currentGroupId)) {
-					cycleDetected = true;
-					break;
-				}
-				visited.add(currentGroupId);
-				const doc = await group.get(ctx, currentGroupId);
-				if (doc === null) break;
-				if (isFirst) {
-					isFirst = false;
-					if (opts.includeSelf) ancestors.push(doc);
-					currentGroupId = doc.parentGroupId;
-					depth += 1;
-					continue;
-				}
-				ancestors.push(doc);
-				currentGroupId = doc.parentGroupId;
-				depth += 1;
-			}
-			return {
-				ancestors,
-				cycleDetected,
-				maxDepthReached
-			};
-		}
-	};
-	const member = {
-		create: async (ctx, data) => {
-			const roleIds = normalizeRoleIds(data.roleIds);
-			return { memberId: await ctx.runMutation(config.component.public.memberAdd, {
-				...data,
-				roleIds
-			}) };
-		},
-		get: async (ctx, memberId) => {
-			return await ctx.runQuery(config.component.public.memberGet, { memberId });
-		},
-		list: async (ctx, opts) => {
-			return await ctx.runQuery(config.component.public.memberList, {
-				where: opts?.where,
-				limit: opts?.limit,
-				cursor: opts?.cursor,
-				orderBy: opts?.orderBy,
-				order: opts?.order
-			});
-		},
-		delete: async (ctx, memberId) => {
-			await ctx.runMutation(config.component.public.memberRemove, { memberId });
-			return { memberId };
-		},
-		update: async (ctx, memberId, data) => {
-			const nextData = { ...data };
-			if ("roleIds" in nextData) nextData.roleIds = normalizeRoleIds(Array.isArray(nextData.roleIds) ? nextData.roleIds : void 0);
-			await ctx.runMutation(config.component.public.memberUpdate, {
-				memberId,
-				data: nextData
-			});
-			return { memberId };
-		},
-		inspect: async (ctx, opts) => {
-			const useAncestry = opts.ancestry === true;
-			let membership = null;
-			if (useAncestry) {
-				const maxDepth = Math.max(0, Math.floor(opts.maxDepth ?? 32));
-				membership = (await ctx.runQuery(config.component.public.memberResolve, {
-					userId: opts.userId,
-					groupId: opts.groupId,
-					maxDepth,
-					ancestry: true
-				})).membership;
-			} else membership = await ctx.runQuery(config.component.public.memberGetByGroupAndUser, {
-				userId: opts.userId,
-				groupId: opts.groupId
-			});
-			if (membership === null) return {
-				membership: null,
-				roleIds: [],
-				grants: []
-			};
-			const membershipRoleIds = membership.roleIds ?? [];
-			const membershipGrants = resolveGrantedPermissions(membershipRoleIds);
-			return {
-				membership,
-				roleIds: membershipRoleIds,
-				grants: membershipGrants
-			};
-		},
-		require: async (ctx, opts) => {
-			const validatedRoleIds = normalizeRoleIds(opts.roleIds);
-			const requiredGrants = Array.from(new Set(opts.grants ?? []));
-			const roleFilter = validatedRoleIds.length > 0 ? new Set(validatedRoleIds) : null;
-			const result = await member.inspect(ctx, {
-				userId: opts.userId,
-				groupId: opts.groupId,
-				ancestry: opts.ancestry,
-				maxDepth: opts.maxDepth
-			});
-			if (result.membership === null) throw Cv.error({
-				code: "NOT_A_MEMBER",
-				message: "User is not a member of this group.",
-				groupId: opts.groupId
-			});
-			if (roleFilter !== null && !result.roleIds.some((roleId) => roleFilter.has(roleId))) throw Cv.error({
-				code: "NOT_A_MEMBER",
-				message: "User is not a member of this group.",
-				groupId: opts.groupId
-			});
-			const missingGrants = requiredGrants.filter((grant) => !result.grants.includes(grant));
-			if (missingGrants.length > 0) throw Cv.error({
-				code: "MISSING_GRANTS",
-				message: "User is missing required grants.",
-				groupId: opts.groupId,
-				missingGrants
-			});
-			return result;
-		}
-	};
-	const invite = {
-		create: async (ctx, data) => {
-			const roleIds = normalizeRoleIds(data.roleIds);
-			const token = generateRandomString(inviteTokenLength, inviteTokenAlphabet);
-			const tokenHash = await sha256(token);
-			return {
-				inviteId: await ctx.runMutation(config.component.public.inviteCreate, {
-					...data,
-					roleIds,
-					tokenHash,
-					status: "pending"
-				}),
-				token
-			};
-		},
-		get: async (ctx, inviteId) => {
-			return await ctx.runQuery(config.component.public.inviteGet, { inviteId });
-		},
-		token: {
-			get: async (ctx, token) => {
-				const tokenHash = await sha256(token);
-				return await ctx.runQuery(config.component.public.inviteGetByTokenHash, { tokenHash });
-			},
-			accept: async (ctx, args) => {
-				const tokenHash = await sha256(args.token);
-				return { ...await ctx.runMutation(config.component.public.inviteAcceptByToken, {
-					tokenHash,
-					acceptedByUserId: args.acceptedByUserId
-				}) };
-			}
-		},
-		list: async (ctx, opts) => {
-			return await ctx.runQuery(config.component.public.inviteList, {
-				where: opts?.where,
-				limit: opts?.limit,
-				cursor: opts?.cursor,
-				orderBy: opts?.orderBy,
-				order: opts?.order
-			});
-		},
-		accept: async (ctx, inviteId, acceptedByUserId) => {
-			await ctx.runMutation(config.component.public.inviteAccept, {
-				inviteId,
-				...acceptedByUserId ? { acceptedByUserId } : {}
-			});
-			return {
-				inviteId,
-				acceptedByUserId: acceptedByUserId ?? null
-			};
-		},
-		revoke: async (ctx, inviteId) => {
-			await ctx.runMutation(config.component.public.inviteRevoke, { inviteId });
-			return { inviteId };
-		}
-	};
-	const key = {
-		create: async (ctx, opts) => {
-			const { raw, hashedKey, displayPrefix } = await generateApiKey("sk_");
-			return {
-				keyId: await ctx.runMutation(config.component.public.keyInsert, {
-					userId: opts.userId,
-					prefix: displayPrefix,
-					hashedKey,
-					name: opts.name,
-					scopes: opts.scopes,
-					rateLimit: opts.rateLimit,
-					expiresAt: opts.expiresAt,
-					metadata: opts.metadata
-				}),
-				secret: raw
-			};
-		},
-		verify: async (ctx, rawKey) => {
-			const hashedKey = await hashApiKey(rawKey);
-			const doc = await ctx.runQuery(config.component.public.keyGetByHashedKey, { hashedKey });
-			if (!doc) throw Cv.error({
-				code: "INVALID_API_KEY",
-				message: "Invalid API key."
-			});
-			const k = doc;
-			if (k.revoked) throw Cv.error({
-				code: "API_KEY_REVOKED",
-				message: "This API key has been revoked."
-			});
-			if (k.expiresAt && k.expiresAt < Date.now()) throw Cv.error({
-				code: "API_KEY_EXPIRED",
-				message: "This API key has expired."
-			});
-			const patchData = { lastUsedAt: Date.now() };
-			if (k.rateLimit) {
-				const { limited, newState } = checkKeyRateLimit(k.rateLimit, k.rateLimitState ?? void 0);
-				if (limited) throw Cv.error({
-					code: "API_KEY_RATE_LIMITED",
-					message: "API key rate limit exceeded. Please try again later."
-				});
-				patchData.rateLimitState = newState;
-			}
-			await ctx.runMutation(config.component.public.keyPatch, {
-				keyId: k._id,
-				data: patchData
-			});
-			return {
-				userId: k.userId,
-				keyId: k._id,
-				scopes: buildScopeChecker(k.scopes)
-			};
-		},
-		list: async (ctx, opts) => {
-			return await ctx.runQuery(config.component.public.keyList, {
-				where: opts?.where,
-				limit: opts?.limit,
-				cursor: opts?.cursor,
-				orderBy: opts?.orderBy,
-				order: opts?.order
-			});
-		},
-		get: async (ctx, keyId) => {
-			return await ctx.runQuery(config.component.public.keyGetById, { keyId }) ?? null;
-		},
-		update: async (ctx, keyId, data) => {
-			await ctx.runMutation(config.component.public.keyPatch, {
-				keyId,
-				data
-			});
-			return { keyId };
-		},
-		revoke: async (ctx, keyId) => {
-			await ctx.runMutation(config.component.public.keyPatch, {
-				keyId,
-				data: { revoked: true }
-			});
-			return { keyId };
-		},
-		delete: async (ctx, keyId) => {
-			await ctx.runMutation(config.component.public.keyDelete, { keyId });
-			return { keyId };
-		},
-		rotate: async (ctx, keyId, opts) => {
-			const existing = await ctx.runQuery(config.component.public.keyGetById, { keyId });
-			if (!existing) throw Cv.error({
-				code: "INVALID_PARAMETERS",
-				message: "The provided parameters are invalid."
-			});
-			if (existing.revoked === true) throw Cv.error({
-				code: "API_KEY_REVOKED",
-				message: "This API key has been revoked."
-			});
-			await ctx.runMutation(config.component.public.keyPatch, {
-				keyId,
-				data: { revoked: true }
-			});
-			return await key.create(ctx, {
-				userId: existing.userId,
-				name: opts?.name ?? existing.name,
-				scopes: existing.scopes ?? [],
-				rateLimit: existing.rateLimit,
-				expiresAt: opts?.expiresAt,
-				metadata: existing.metadata
-			});
-		}
-	};
-	return {
-		user,
-		session,
-		account,
-		provider,
-		group,
-		member,
-		invite,
-		key
-	};
-}
-
-//#endregion
-export { createCoreDomains };
-//# sourceMappingURL=core.js.map