@robelest/convex-auth 0.0.4-preview.25 → 0.0.4-preview.28

package/dist/component/server/enterprise/scim.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"scim.js","names":[],"sources":["../../../../src/server/enterprise/scim.ts"],"sourcesContent":["import type { ScimListRequest } from \"./shared\";\nimport { SCIM_GROUP_SCHEMA_ID, SCIM_USER_SCHEMA_ID } from \"./shared\";\n\n/** @internal */\nexport function parseScimPath(pathname: string) {\n  const parts = pathname.split(\"/\").filter(Boolean);\n  const [api, auth, sso, enterpriseId, protocol, version, ...rest] = parts;\n\n  if (\n    api !== \"api\" ||\n    auth !== \"auth\" ||\n    sso !== \"sso\" ||\n    !enterpriseId ||\n    enterpriseId === \"setup\" ||\n    protocol !== \"scim\" ||\n    version !== \"v2\"\n  ) {\n    return {\n      enterpriseId: \"\",\n      resource: \"\",\n      resourceId: undefined,\n    };\n  }\n\n  return {\n    enterpriseId,\n    resource: rest[0] ?? \"\",\n    resourceId: rest[1],\n  };\n}\n\n/** @internal */\nexport function parseScimListRequest(url: URL): ScimListRequest {\n  const startIndex = Math.max(\n    1,\n    Number(url.searchParams.get(\"startIndex\") ?? \"1\"),\n  );\n  const count = Math.min(\n    100,\n    Math.max(1, Number(url.searchParams.get(\"count\") ?? \"100\")),\n  );\n  const filterParam = url.searchParams.get(\"filter\");\n  const filter = filterParam\n    ? (() => {\n        const match = filterParam.match(/^([A-Za-z0-9_.]+)\\s+eq\\s+\"([^\"]+)\"$/);\n        if (!match) {\n          throw new Error(\"Unsupported SCIM filter.\");\n        }\n        return { attribute: match[1]!, value: match[2]! };\n      })()\n    : undefined;\n  return { startIndex, count, filter };\n}\n\n/** @internal */\nexport function scimJson(data: unknown, status = 200, headers?: HeadersInit) {\n  const responseHeaders = new Headers({\n    \"Content-Type\": \"application/scim+json\",\n  });\n  if (headers) {\n    new Headers(headers).forEach((value, key) => {\n      responseHeaders.set(key, value);\n    });\n  }\n  return new Response(JSON.stringify(data), {\n    status,\n    headers: responseHeaders,\n  });\n}\n\n/** @internal */\nexport function scimError(status: number, scimType: string, detail: string) {\n  return scimJson(\n    {\n      schemas: [\"urn:ietf:params:scim:api:messages:2.0:Error\"],\n      status: String(status),\n      scimType,\n      detail,\n    },\n    status,\n  );\n}\n\n/** @internal */\nexport function serializeScimUser(args: {\n  id: string;\n  user: Record<string, any>;\n  externalId?: string;\n  active?: boolean;\n  location?: string;\n}) {\n  return {\n    schemas: [SCIM_USER_SCHEMA_ID],\n    id: args.id,\n    externalId: args.externalId,\n    meta: {\n      resourceType: \"User\",\n      location: args.location,\n    },\n    userName: args.user.email ?? args.user.phone ?? args.user.name ?? args.id,\n    active: args.active ?? true,\n    name:\n      args.user.name !== undefined ? { formatted: args.user.name } : undefined,\n    emails:\n      typeof args.user.email === \"string\"\n        ? [{ value: args.user.email, primary: true }]\n        : undefined,\n    phoneNumbers:\n      typeof args.user.phone === \"string\"\n        ? [{ value: args.user.phone, primary: true }]\n        : undefined,\n    displayName: args.user.name,\n  };\n}\n\n/** @internal */\nexport function serializeScimGroup(args: {\n  id: string;\n  group: Record<string, any>;\n  externalId?: string;\n  members?: Array<{ value: string; display?: string }>;\n  location?: string;\n}) {\n  return {\n    schemas: [SCIM_GROUP_SCHEMA_ID],\n    id: args.id,\n    externalId: args.externalId,\n    meta: {\n      resourceType: \"Group\",\n      location: args.location,\n    },\n    displayName: args.group.name ?? args.id,\n    members: args.members ?? [],\n  };\n}\n"],"mappings":";;;;AAIA,SAAgB,cAAc,UAAkB;CAE9C,MAAM,CAAC,KAAK,MAAM,KAAK,cAAc,UAAU,SAAS,GAAG,QAD7C,SAAS,MAAM,IAAI,CAAC,OAAO,QAAQ;AAGjD,KACE,QAAQ,SACR,SAAS,UACT,QAAQ,SACR,CAAC,gBACD,iBAAiB,WACjB,aAAa,UACb,YAAY,KAEZ,QAAO;EACL,cAAc;EACd,UAAU;EACV,YAAY;EACb;AAGH,QAAO;EACL;EACA,UAAU,KAAK,MAAM;EACrB,YAAY,KAAK;EAClB;;;AAIH,SAAgB,qBAAqB,KAA2B;CAC9D,MAAM,aAAa,KAAK,IACtB,GACA,OAAO,IAAI,aAAa,IAAI,aAAa,IAAI,IAAI,CAClD;CACD,MAAM,QAAQ,KAAK,IACjB,KACA,KAAK,IAAI,GAAG,OAAO,IAAI,aAAa,IAAI,QAAQ,IAAI,MAAM,CAAC,CAC5D;CACD,MAAM,cAAc,IAAI,aAAa,IAAI,SAAS;AAUlD,QAAO;EAAE;EAAY;EAAO,QATb,qBACJ;GACL,MAAM,QAAQ,YAAY,MAAM,sCAAsC;AACtE,OAAI,CAAC,MACH,OAAM,IAAI,MAAM,2BAA2B;AAE7C,UAAO;IAAE,WAAW,MAAM;IAAK,OAAO,MAAM;IAAK;MAC/C,GACJ;EACgC;;;AAItC,SAAgB,SAAS,MAAe,SAAS,KAAK,SAAuB;CAC3E,MAAM,kBAAkB,IAAI,QAAQ,EAClC,gBAAgB,yBACjB,CAAC;AACF,KAAI,QACF,KAAI,QAAQ,QAAQ,CAAC,SAAS,OAAO,QAAQ;AAC3C,kBAAgB,IAAI,KAAK,MAAM;GAC/B;AAEJ,QAAO,IAAI,SAAS,KAAK,UAAU,KAAK,EAAE;EACxC;EACA,SAAS;EACV,CAAC;;;AAIJ,SAAgB,UAAU,QAAgB,UAAkB,QAAgB;AAC1E,QAAO,SACL;EACE,SAAS,CAAC,8CAA8C;EACxD,QAAQ,OAAO,OAAO;EACtB;EACA;EACD,EACD,OACD;;;AAIH,SAAgB,kBAAkB,MAM/B;AACD,QAAO;EACL,SAAS,CAAC,oBAAoB;EAC9B,IAAI,KAAK;EACT,YAAY,KAAK;EACjB,MAAM;GACJ,cAAc;GACd,UAAU,KAAK;GAChB;EACD,UAAU,KAAK,KAAK,SAAS,KAAK,KAAK,SAAS,KAAK,KAAK,QAAQ,KAAK;EACvE,QAAQ,KAAK,UAAU;EACvB,MACE,KAAK,KAAK,SAAS,SAAY,EAAE,WAAW,KAAK,KAAK,MAAM,GAAG;EACjE,QACE,OAAO,KAAK,KAAK,UAAU,WACvB,CAAC;GAAE,OAAO,KAAK,KAAK;GAAO,SAAS;GAAM,CAAC,GAC3C;EACN,cACE,OAAO,KAAK,KAAK,UAAU,WACvB,CAAC;GAAE,OAAO,KAAK,KAAK;GAAO,SAAS;GAAM,CAAC,GAC3C;EACN,aAAa,KAAK,KAAK;EACxB;;;AAIH,SAAgB,mBAAmB,MAMhC;AACD,QAAO;EACL,SAAS,CAAC,qBAAqB;EAC/B,IAAI,KAAK;EACT,YAAY,KAAK;EACjB,MAAM;GACJ,cAAc;GACd,UAAU,KAAK;GAChB;EACD,aAAa,KAAK,MAAM,QAAQ,KAAK;EACrC,SAAS,KAAK,WAAW,EAAE;EAC5B"}

package/dist/component/server/enterprise/shared.js

@@ -1,51 +0,0 @@
-//#region src/server/enterprise/shared.ts
-/** @internal */
-const SCIM_USER_SCHEMA_ID = "urn:ietf:params:scim:schemas:core:2.0:User";
-/** @internal */
-const SCIM_GROUP_SCHEMA_ID = "urn:ietf:params:scim:schemas:core:2.0:Group";
-/** @internal */
-const ENTERPRISE_OIDC_PROVIDER_PREFIX = "enterprise:oidc:";
-/** @internal */
-const ENTERPRISE_SAML_PROVIDER_PREFIX = "enterprise:saml:";
-/** @internal */
-function normalizeDomain(domain) {
-	return domain.trim().toLowerCase().replace(/^@+/, "");
-}
-/** @internal */
-function enterpriseOidcProviderId(enterpriseId) {
-	return `${ENTERPRISE_OIDC_PROVIDER_PREFIX}${enterpriseId}`;
-}
-/** @internal */
-function enterpriseSamlProviderId(enterpriseId) {
-	return `${ENTERPRISE_SAML_PROVIDER_PREFIX}${enterpriseId}`;
-}
-/** @internal */
-function getEnterpriseSamlUrls(opts) {
-	const root = opts.rootUrl.replace(/\/$/, "");
-	return {
-		metadataUrl: `${root}/api/auth/sso/${opts.source.id}/saml/metadata`,
-		acsUrl: `${root}/api/auth/sso/${opts.source.id}/saml/acs`,
-		sloUrl: `${root}/api/auth/sso/${opts.source.id}/saml/slo`
-	};
-}
-/** @internal */
-function getEnterpriseOidcUrls(opts) {
-	const root = opts.rootUrl.replace(/\/$/, "");
-	return {
-		signInUrl: `${root}/api/auth/sso/${opts.enterpriseId}/oidc/signin`,
-		callbackUrl: `${root}/api/auth/sso/${opts.enterpriseId}/oidc/callback`
-	};
-}
-/** @internal */
-function isEnterpriseSamlSourceActive(source) {
-	return source.status === "active";
-}
-/** @internal */
-function isEnterpriseProviderId(providerId) {
-	return providerId.startsWith(ENTERPRISE_OIDC_PROVIDER_PREFIX) || providerId.startsWith(ENTERPRISE_SAML_PROVIDER_PREFIX);
-}
-const asRecord = (value) => typeof value === "object" && value !== null ? value : null;
-
-//#endregion
-export { ENTERPRISE_OIDC_PROVIDER_PREFIX, ENTERPRISE_SAML_PROVIDER_PREFIX, SCIM_GROUP_SCHEMA_ID, SCIM_USER_SCHEMA_ID, asRecord, enterpriseOidcProviderId, enterpriseSamlProviderId, getEnterpriseOidcUrls, getEnterpriseSamlUrls, isEnterpriseProviderId, isEnterpriseSamlSourceActive, normalizeDomain };
-//# sourceMappingURL=shared.js.map

package/dist/component/server/enterprise/shared.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"shared.js","names":[],"sources":["../../../../src/server/enterprise/shared.ts"],"sourcesContent":["/** @internal */\nexport type ParsedSamlMetadata = {\n  issuer: string;\n  sso: {\n    redirect?: string;\n    post?: string;\n  };\n  slo: {\n    redirect?: string;\n    post?: string;\n  };\n  signingCert: string | string[] | null;\n  encryptionCert: string | string[] | null;\n  nameIdFormats: string[];\n  wantsSignedAuthnRequests: boolean;\n};\n\n/** @internal */\nexport type EnterpriseSamlSource = { kind: \"enterprise\"; id: string };\n\n/** @internal */\nexport type EnterpriseSamlRelayState = {\n  source: EnterpriseSamlSource;\n  signature: string;\n  requestId: string;\n  state: string;\n  redirectTo?: string;\n};\n\n/** @internal */\nexport type EnterpriseSamlUrls = {\n  metadataUrl: string;\n  acsUrl: string;\n  sloUrl?: string;\n};\n\n/** @internal */\nexport type EnterpriseSamlLoadedSource = {\n  source: EnterpriseSamlSource;\n  config: unknown;\n  status?: string;\n};\n\n/** @internal */\nexport type EnterpriseSamlHttpRequest = {\n  url: URL;\n  body: Record<string, string>;\n  query: Record<string, string>;\n  binding: \"redirect\" | \"post\";\n  relayState?: string;\n  hasSamlRequest: boolean;\n  hasSamlResponse: boolean;\n};\n\n/** @internal */\nexport type ScimListRequest = {\n  startIndex: number;\n  count: number;\n  filter?: { attribute: string; value: string };\n};\n\n/** @internal */\nexport const SCIM_USER_SCHEMA_ID = \"urn:ietf:params:scim:schemas:core:2.0:User\";\n/** @internal */\nexport const SCIM_GROUP_SCHEMA_ID =\n  \"urn:ietf:params:scim:schemas:core:2.0:Group\";\n\n/** @internal */\nexport const ENTERPRISE_OIDC_PROVIDER_PREFIX = \"enterprise:oidc:\";\n/** @internal */\nexport const ENTERPRISE_SAML_PROVIDER_PREFIX = \"enterprise:saml:\";\n\n/** @internal */\nexport function normalizeDomain(domain: string): string {\n  return domain.trim().toLowerCase().replace(/^@+/, \"\");\n}\n\n/** @internal */\nexport function enterpriseOidcProviderId(enterpriseId: string): string {\n  return `${ENTERPRISE_OIDC_PROVIDER_PREFIX}${enterpriseId}`;\n}\n\n/** @internal */\nexport function enterpriseSamlProviderId(enterpriseId: string): string {\n  return `${ENTERPRISE_SAML_PROVIDER_PREFIX}${enterpriseId}`;\n}\n\n/** @internal */\nexport function getEnterpriseSamlUrls(opts: {\n  rootUrl: string;\n  source: EnterpriseSamlSource;\n}): EnterpriseSamlUrls {\n  const root = opts.rootUrl.replace(/\\/$/, \"\");\n  const metadataBase = `${root}/api/auth/sso/${opts.source.id}/saml/metadata`;\n  const acsBase = `${root}/api/auth/sso/${opts.source.id}/saml/acs`;\n  const sloBase = `${root}/api/auth/sso/${opts.source.id}/saml/slo`;\n  return {\n    metadataUrl: metadataBase,\n    acsUrl: acsBase,\n    sloUrl: sloBase,\n  };\n}\n\n/** @internal */\nexport function getEnterpriseOidcUrls(opts: {\n  rootUrl: string;\n  enterpriseId: string;\n}) {\n  const root = opts.rootUrl.replace(/\\/$/, \"\");\n  return {\n    signInUrl: `${root}/api/auth/sso/${opts.enterpriseId}/oidc/signin`,\n    callbackUrl: `${root}/api/auth/sso/${opts.enterpriseId}/oidc/callback`,\n  };\n}\n\n/** @internal */\nexport function isEnterpriseSamlSourceActive(\n  source: EnterpriseSamlLoadedSource,\n) {\n  return source.status === \"active\";\n}\n\n/** @internal */\nexport function isEnterpriseProviderId(providerId: string): boolean {\n  return (\n    providerId.startsWith(ENTERPRISE_OIDC_PROVIDER_PREFIX) ||\n    providerId.startsWith(ENTERPRISE_SAML_PROVIDER_PREFIX)\n  );\n}\n\nexport const asRecord = (value: unknown) =>\n  typeof value === \"object\" && value !== null\n    ? (value as Record<string, any>)\n    : null;\n"],"mappings":";;AA8DA,MAAa,sBAAsB;;AAEnC,MAAa,uBACX;;AAGF,MAAa,kCAAkC;;AAE/C,MAAa,kCAAkC;;AAG/C,SAAgB,gBAAgB,QAAwB;AACtD,QAAO,OAAO,MAAM,CAAC,aAAa,CAAC,QAAQ,OAAO,GAAG;;;AAIvD,SAAgB,yBAAyB,cAA8B;AACrE,QAAO,GAAG,kCAAkC;;;AAI9C,SAAgB,yBAAyB,cAA8B;AACrE,QAAO,GAAG,kCAAkC;;;AAI9C,SAAgB,sBAAsB,MAGf;CACrB,MAAM,OAAO,KAAK,QAAQ,QAAQ,OAAO,GAAG;AAI5C,QAAO;EACL,aAJmB,GAAG,KAAK,gBAAgB,KAAK,OAAO,GAAG;EAK1D,QAJc,GAAG,KAAK,gBAAgB,KAAK,OAAO,GAAG;EAKrD,QAJc,GAAG,KAAK,gBAAgB,KAAK,OAAO,GAAG;EAKtD;;;AAIH,SAAgB,sBAAsB,MAGnC;CACD,MAAM,OAAO,KAAK,QAAQ,QAAQ,OAAO,GAAG;AAC5C,QAAO;EACL,WAAW,GAAG,KAAK,gBAAgB,KAAK,aAAa;EACrD,aAAa,GAAG,KAAK,gBAAgB,KAAK,aAAa;EACxD;;;AAIH,SAAgB,6BACd,QACA;AACA,QAAO,OAAO,WAAW;;;AAI3B,SAAgB,uBAAuB,YAA6B;AAClE,QACE,WAAW,WAAW,gCAAgC,IACtD,WAAW,WAAW,gCAAgC;;AAI1D,MAAa,YAAY,UACvB,OAAO,UAAU,YAAY,UAAU,OAClC,QACD"}

package/dist/component/server/http.d.ts

@@ -1,85 +0,0 @@
-import { HttpKeyContext } from "./types.js";
-import { AuthContext, OptionalAuthContext, UserDoc } from "./auth.js";
-import { GenericActionCtx, GenericDataModel } from "convex/server";
-
-//#region src/server/http.d.ts
-/**
- * Auth context returned by `auth.http.context(ctx, request)`.
- *
- * This resolves raw HTTP authentication in two steps:
- * 1. session auth from `ctx.auth.getUserIdentity()`
- * 2. API key auth from `Authorization: Bearer sk_*`
- *
- * The `source` field tells you which authentication path succeeded.
- * When `source === "key"`, the verified API key metadata is available on
- * `key`.
- *
- * @example
- * ```ts
- * const authContext = await auth.http.context(ctx, request);
- * if (authContext.source === "key") {
- *   console.log(authContext.key.keyId);
- * }
- * ```
- */
-type HttpAuthContext = (AuthContext & {
-  /** The request authenticated through a browser or session token. */source: "session"; /** No API key was used for this request. */
-  key: null;
-}) | (AuthContext & {
-  /** The request authenticated through an API key. */source: "key"; /** Verified API key metadata for the request. */
-  key: HttpKeyContext["key"];
-});
-/**
- * Nullable HTTP auth context returned by
- * `auth.http.context(ctx, request, { optional: true })`.
- *
- * This preserves a stable auth-shaped object for raw `httpAction` handlers
- * that allow anonymous callers.
- */
-type OptionalHttpAuthContext = (OptionalAuthContext & {
-  /** No authentication source was resolved. */source: null; /** No API key metadata is available. */
-  key: null;
-}) | HttpAuthContext;
-/**
- * Configuration for {@link createAuth().http.context}.
- *
- * This mirrors {@link AuthContextConfig} for raw HTTP handlers and adds support
- * for enriching mixed session/API-key auth results.
- *
- * @typeParam TResolve - Extra fields returned from `resolve()` and merged into
- *   the resolved HTTP auth context.
- *
- * @example
- * ```ts
- * const authContext = await auth.http.context(ctx, request, {
- *   resolve: async (_ctx, user, authState) => ({
- *     email: user.email,
- *     isMachineRequest: authState.source === "key",
- *   }),
- * });
- * ```
- */
-type HttpAuthContextConfig<TResolve extends Record<string, unknown> = Record<string, never>> = {
-  /**
-   * Allow unauthenticated callers and return a null-shaped auth object instead
-   * of throwing `NOT_SIGNED_IN`.
-   */
-  optional?: boolean;
-  /**
-   * Attach additional derived fields to the resolved HTTP auth context.
-   *
-   * This callback runs only when authentication succeeds.
-   */
-  resolve?: (ctx: GenericActionCtx<any>, user: UserDoc, auth: HttpAuthContext) => Promise<TResolve> | TResolve;
-  /**
-   * Override or wrap HTTP auth resolution.
-   *
-   * Return `undefined` to use the built-in session-or-key resolver, `null` for
-   * an explicit unauthenticated state, or a fully resolved
-   * {@link HttpAuthContext}.
-   */
-  authResolve?: (ctx: GenericActionCtx<any>, fallback: () => Promise<HttpAuthContext | null>) => Promise<HttpAuthContext | null | undefined> | HttpAuthContext | null | undefined;
-};
-//#endregion
-export { HttpAuthContext, HttpAuthContextConfig, OptionalHttpAuthContext };
-//# sourceMappingURL=http.d.ts.map

package/dist/component/server/http.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"http.d.ts","names":[],"sources":["../../../src/server/http.ts"],"mappings":";;;;;;;AAsEA;;;;;;;;;;;;;;;;;KAAY,eAAA,IACP,WAAA;EAoB8B,oEAlB7B,MAAA,aAyBa;EAvBb,GAAA;AAAA,MAED,WAAA;EAmBC,oDAjBA,MAAA,SAmBa;EAjBb,GAAA,EAAK,cAAA;AAAA;;;;;;;;KAUC,uBAAA,IACP,mBAAA;EA4CE,6CA1CD,MAAA,QAmDG;EAjDH,GAAA;AAAA,KAEF,eAAA;;;;;;;;;;;;;;;;;;;;KAqBQ,qBAAA,kBACO,MAAA,oBAA0B,MAAA;EAyBpC;;;;EAnBP,QAAA;EAsBI;;;;;EAhBJ,OAAA,IACE,GAAA,EAAK,gBAAA,OACL,IAAA,EAAM,OAAA,EACN,IAAA,EAAM,eAAA,KACH,OAAA,CAAQ,QAAA,IAAY,QAAA;;;;;;;;EAQzB,WAAA,IACE,GAAA,EAAK,gBAAA,OACL,QAAA,QAAgB,OAAA,CAAQ,eAAA,aAEtB,OAAA,CAAQ,eAAA,uBACR,eAAA;AAAA"}

package/dist/component/server/http.js

@@ -1,351 +0,0 @@
-import { createUnauthenticatedAuthContext, getAuthContextForUser, getSessionUserId } from "./context.js";
-import { logError } from "./utils.js";
-import { httpActionGeneric } from "convex/server";
-import { Cv } from "@robelest/fx/convex";
-import { Fx } from "@robelest/fx";
-import { ConvexError } from "convex/values";
-import { parse } from "cookie";
-
-//#region src/server/http.ts
-function createNotSignedInError() {
-	return Cv.error({
-		code: "NOT_SIGNED_IN",
-		message: "Authentication required."
-	});
-}
-async function getHttpKeyContext(auth, ctx, request) {
-	const authHeader = request.headers.get("Authorization");
-	if (!authHeader?.startsWith("Bearer sk_")) return null;
-	try {
-		const verified = await auth.key.verify(ctx, authHeader.slice(7));
-		return {
-			...await getAuthContextForUser(auth, ctx, verified.userId),
-			source: "key",
-			key: {
-				userId: verified.userId,
-				keyId: verified.keyId,
-				scopes: verified.scopes
-			}
-		};
-	} catch {
-		return null;
-	}
-}
-async function resolveHttpAuthContext(auth, ctx, request) {
-	const sessionUserId = await getSessionUserId(ctx);
-	if (sessionUserId !== null) return {
-		...await getAuthContextForUser(auth, ctx, sessionUserId),
-		source: "session",
-		key: null
-	};
-	return await getHttpKeyContext(auth, ctx, request);
-}
-/**
-* @internal
-* Create the implementation behind `auth.http.context(...)`.
-*/
-function createHttpContext(auth) {
-	return (async (ctx, request, config) => {
-		const fallback = () => resolveHttpAuthContext(auth, ctx, request);
-		const authOverride = config?.authResolve ? await config.authResolve(ctx, fallback) : void 0;
-		const resolved = authOverride === void 0 ? await fallback() : authOverride;
-		if (resolved === null) {
-			if (config?.optional !== true) throw createNotSignedInError();
-			return {
-				...createUnauthenticatedAuthContext(),
-				source: null,
-				key: null
-			};
-		}
-		const extra = config?.resolve ? await config.resolve(ctx, resolved.user, resolved) : {};
-		return {
-			...resolved,
-			...extra
-		};
-	});
-}
-function createHttpAction(auth) {
-	return (handler, options) => {
-		const corsConfig = options?.cors ?? {};
-		const corsHeaders = {
-			"Access-Control-Allow-Origin": corsConfig.origin ?? "*",
-			"Access-Control-Allow-Methods": corsConfig.methods ?? "GET,POST,PUT,PATCH,DELETE,OPTIONS",
-			"Access-Control-Allow-Headers": corsConfig.headers ?? "Content-Type,Authorization"
-		};
-		return httpActionGeneric(async (genericCtx, request) => {
-			return Fx.run(Fx.from({
-				ok: async () => {
-					const authHeader = request.headers.get("Authorization");
-					if (!authHeader?.startsWith("Bearer ")) return new Response(JSON.stringify({
-						error: "Missing or malformed Authorization: Bearer header.",
-						code: "MISSING_BEARER_TOKEN"
-					}), {
-						status: 401,
-						headers: {
-							...corsHeaders,
-							"Content-Type": "application/json"
-						}
-					});
-					const rawKey = authHeader.slice(7);
-					const keyResult = await Fx.run(Fx.attempt(() => auth.key.verify(genericCtx, rawKey), (result$1) => ({
-						ok: true,
-						value: result$1
-					}), (error) => ({
-						ok: false,
-						error
-					})));
-					if (!keyResult.ok) {
-						if (keyResult.error instanceof ConvexError && typeof keyResult.error.data === "object" && keyResult.error.data !== null && "code" in keyResult.error.data && "message" in keyResult.error.data) {
-							const { code, message } = keyResult.error.data;
-							return new Response(JSON.stringify({
-								error: message,
-								code
-							}), {
-								status: 403,
-								headers: {
-									...corsHeaders,
-									"Content-Type": "application/json"
-								}
-							});
-						}
-						throw keyResult.error;
-					}
-					if (options?.scope && !keyResult.value.scopes.can(options.scope.resource, options.scope.action)) return new Response(JSON.stringify({
-						error: "This API key does not have the required permissions.",
-						code: "SCOPE_CHECK_FAILED"
-					}), {
-						status: 403,
-						headers: {
-							...corsHeaders,
-							"Content-Type": "application/json"
-						}
-					});
-					const result = await handler(Object.assign(genericCtx, { key: {
-						userId: keyResult.value.userId,
-						keyId: keyResult.value.keyId,
-						scopes: keyResult.value.scopes
-					} }), request);
-					if (result instanceof Response) {
-						const headers = new Headers(result.headers);
-						for (const [k, val] of Object.entries(corsHeaders)) if (!headers.has(k)) headers.set(k, val);
-						return new Response(result.body, {
-							status: result.status,
-							statusText: result.statusText,
-							headers
-						});
-					}
-					return new Response(JSON.stringify(result), {
-						status: 200,
-						headers: {
-							...corsHeaders,
-							"Content-Type": "application/json"
-						}
-					});
-				},
-				err: (error) => error
-			}).pipe(Fx.recover((error) => {
-				logError(error);
-				return Fx.succeed(new Response(JSON.stringify({
-					error: "An unexpected error occurred.",
-					code: "INTERNAL_ERROR"
-				}), {
-					status: 500,
-					headers: {
-						...corsHeaders,
-						"Content-Type": "application/json"
-					}
-				}));
-			})));
-		});
-	};
-}
-function createHttpRoute(wrapAction) {
-	return (http, routeConfig) => {
-		const corsConfig = routeConfig.cors ?? {};
-		const corsHeaders = {
-			"Access-Control-Allow-Origin": corsConfig.origin ?? "*",
-			"Access-Control-Allow-Methods": corsConfig.methods ?? "GET,POST,PUT,PATCH,DELETE,OPTIONS",
-			"Access-Control-Allow-Headers": corsConfig.headers ?? "Content-Type,Authorization"
-		};
-		http.route({
-			path: routeConfig.path,
-			method: "OPTIONS",
-			handler: httpActionGeneric(async () => {
-				return new Response(null, {
-					status: 204,
-					headers: corsHeaders
-				});
-			})
-		});
-		http.route({
-			path: routeConfig.path,
-			method: routeConfig.method,
-			handler: wrapAction(routeConfig.handler, {
-				scope: routeConfig.scope,
-				cors: routeConfig.cors
-			})
-		});
-	};
-}
-function convertErrorsToResponse(errorStatusCode, action) {
-	return async (ctx, request) => {
-		return Fx.run(Fx.from({
-			ok: () => action(ctx, request),
-			err: (error) => error
-		}).pipe(Fx.recover((error) => {
-			if (error instanceof ConvexError && typeof error.data === "object" && error.data !== null && "code" in error.data && "message" in error.data) return Fx.succeed(new Response(JSON.stringify({
-				code: error.data.code,
-				message: error.data.message
-			}), {
-				status: errorStatusCode,
-				headers: { "Content-Type": "application/json" }
-			}));
-			else if (error instanceof ConvexError) return Fx.succeed(new Response(null, {
-				status: errorStatusCode,
-				statusText: typeof error.data === "string" ? error.data : "Error"
-			}));
-			else {
-				logError(error);
-				return Fx.succeed(new Response(null, {
-					status: 500,
-					statusText: "Internal Server Error"
-				}));
-			}
-		})));
-	};
-}
-function getCookies(request) {
-	return parse(request.headers.get("Cookie") ?? "");
-}
-function parseEnterpriseRuntimeRoute(pathname, routeBase) {
-	const runtimePrefix = `${routeBase}/`;
-	const [runtimeEnterpriseId, protocol, ...rest] = pathname.startsWith(runtimePrefix) ? pathname.slice(runtimePrefix.length).split("/").filter(Boolean) : [];
-	if (runtimeEnterpriseId === void 0 || protocol !== "oidc" && protocol !== "saml" && protocol !== "scim" || rest.length === 0) return null;
-	return {
-		pathname,
-		enterpriseId: runtimeEnterpriseId,
-		protocol,
-		rest
-	};
-}
-function addOpenIdRoutes(http, deps) {
-	const cacheControl = "public, max-age=15, stale-while-revalidate=15, stale-if-error=86400";
-	http.route({
-		path: "/.well-known/openid-configuration",
-		method: "GET",
-		handler: httpActionGeneric(async () => {
-			const issuer = deps.getIssuer();
-			return new Response(JSON.stringify({
-				issuer,
-				jwks_uri: `${issuer}/.well-known/jwks.json`
-			}), {
-				status: 200,
-				headers: {
-					"Content-Type": "application/json",
-					"Cache-Control": cacheControl
-				}
-			});
-		})
-	});
-	http.route({
-		path: "/.well-known/jwks.json",
-		method: "GET",
-		handler: httpActionGeneric(async () => {
-			return new Response(deps.getJwks(), {
-				status: 200,
-				headers: {
-					"Content-Type": "application/json",
-					"Cache-Control": cacheControl
-				}
-			});
-		})
-	});
-}
-function addAuthRoutes(http, deps) {
-	http.route({
-		pathPrefix: "/api/auth/signin/",
-		method: "GET",
-		handler: httpActionGeneric(deps.handleSignIn)
-	});
-	const callbackHandler = httpActionGeneric(deps.handleCallback);
-	http.route({
-		pathPrefix: "/api/auth/callback/",
-		method: "GET",
-		handler: callbackHandler
-	});
-	http.route({
-		pathPrefix: "/api/auth/callback/",
-		method: "POST",
-		handler: callbackHandler
-	});
-}
-function addSSORoutes(http, deps) {
-	const routePrefix = `${deps.routeBase}/`;
-	http.route({
-		pathPrefix: routePrefix,
-		method: "GET",
-		handler: httpActionGeneric(deps.convertErrorsToResponse(400, async (ctx, request) => {
-			const route = parseEnterpriseRuntimeRoute(new URL(request.url).pathname, deps.routeBase);
-			if (!route) throw Cv.error({
-				code: "INVALID_PARAMETERS",
-				message: "Invalid enterprise runtime path."
-			});
-			if (route.protocol === "saml" && route.rest.length === 1) {
-				if (route.rest[0] === "metadata") return await deps.handleSamlMetadata(ctx, request, route);
-				if (route.rest[0] === "signin") return await deps.handleSamlSignIn(ctx, request, route);
-				if (route.rest[0] === "acs") return await deps.handleSamlAcs(ctx, request, route);
-				if (route.rest[0] === "slo") return await deps.handleSamlSlo(ctx, request, route);
-			}
-			if (route.protocol === "oidc" && route.rest.length === 1) {
-				if (route.rest[0] === "signin") return await deps.handleOidcSignIn(ctx, request, route);
-				if (route.rest[0] === "callback") return await deps.handleOidcCallback(ctx, request, route);
-			}
-			if (route.protocol === "scim" && route.rest[0] === "v2") return await deps.handleScimRequest(ctx, request);
-			throw Cv.error({
-				code: "INVALID_PARAMETERS",
-				message: "Invalid enterprise runtime path."
-			});
-		}))
-	});
-	http.route({
-		pathPrefix: routePrefix,
-		method: "POST",
-		handler: httpActionGeneric(deps.convertErrorsToResponse(400, async (ctx, request) => {
-			const route = parseEnterpriseRuntimeRoute(new URL(request.url).pathname, deps.routeBase);
-			if (route?.protocol === "saml" && route.rest.length === 1) {
-				if (route.rest[0] === "acs") return await deps.handleSamlAcs(ctx, request, route);
-				if (route.rest[0] === "slo") return await deps.handleSamlSlo(ctx, request, route);
-			}
-			if (route?.protocol === "scim" && route.rest[0] === "v2") return await deps.handleScimRequest(ctx, request);
-			throw Cv.error({
-				code: "INVALID_PARAMETERS",
-				message: "Invalid enterprise runtime path."
-			});
-		}))
-	});
-	http.route({
-		pathPrefix: routePrefix,
-		method: "PUT",
-		handler: httpActionGeneric(deps.convertErrorsToResponse(400, async (ctx, request) => {
-			const route = parseEnterpriseRuntimeRoute(new URL(request.url).pathname, deps.routeBase);
-			if (route?.protocol === "scim" && route.rest[0] === "v2") return await deps.handleScimRequest(ctx, request);
-			throw Cv.error({
-				code: "INVALID_PARAMETERS",
-				message: "Invalid enterprise runtime path."
-			});
-		}))
-	});
-	for (const method of ["PATCH", "DELETE"]) http.route({
-		pathPrefix: routePrefix,
-		method,
-		handler: httpActionGeneric(async (ctx, request) => {
-			const route = parseEnterpriseRuntimeRoute(new URL(request.url).pathname, deps.routeBase);
-			if (!route || route.protocol !== "scim" || route.rest[0] !== "v2") return deps.scimError(404, "notFound", "SCIM resource not found.");
-			return await deps.handleScimRequest(ctx, request);
-		})
-	});
-}
-
-//#endregion
-export { addAuthRoutes, addOpenIdRoutes, addSSORoutes, convertErrorsToResponse, createHttpAction, createHttpContext, createHttpRoute, getCookies };
-//# sourceMappingURL=http.js.map

package/dist/component/server/http.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"http.js","names":["result","parseCookies"],"sources":["../../../src/server/http.ts"],"sourcesContent":["import { Fx } from \"@robelest/fx\";\nimport { Cv } from \"@robelest/fx/convex\";\nimport {\n  GenericActionCtx,\n  GenericDataModel,\n  HttpRouter,\n  httpActionGeneric,\n} from \"convex/server\";\nimport { ConvexError } from \"convex/values\";\nimport { parse as parseCookies } from \"cookie\";\n\nimport type {\n  AuthContext,\n  OptionalAuthContext,\n  UserDoc,\n} from \"./auth\";\nimport {\n  createUnauthenticatedAuthContext,\n  getAuthContextForUser,\n  getSessionUserId,\n} from \"./context\";\nimport type { CorsConfig, HttpKeyContext } from \"./types\";\nimport { logError } from \"./utils\";\n\ntype HttpContextAuthLike = {\n  user: {\n    get: (ctx: any, userId: string) => Promise<UserDoc>;\n    getActiveGroup: (\n      ctx: any,\n      args: { userId: string },\n    ) => Promise<string | null>;\n  };\n  member: {\n    inspect: (\n      ctx: any,\n      args: { userId: string; groupId: string },\n    ) => Promise<{\n      membership: unknown;\n      roleIds: string[];\n      grants: string[];\n    }>;\n  };\n  key: {\n    verify: (ctx: GenericActionCtx<any>, rawKey: string) => Promise<{\n      userId: string;\n      keyId: string;\n      scopes: HttpKeyContext[\"key\"][\"scopes\"];\n    }>;\n  };\n};\n\n/**\n * Auth context returned by `auth.http.context(ctx, request)`.\n *\n * This resolves raw HTTP authentication in two steps:\n * 1. session auth from `ctx.auth.getUserIdentity()`\n * 2. API key auth from `Authorization: Bearer sk_*`\n *\n * The `source` field tells you which authentication path succeeded.\n * When `source === \"key\"`, the verified API key metadata is available on\n * `key`.\n *\n * @example\n * ```ts\n * const authContext = await auth.http.context(ctx, request);\n * if (authContext.source === \"key\") {\n *   console.log(authContext.key.keyId);\n * }\n * ```\n */\nexport type HttpAuthContext =\n  | (AuthContext & {\n      /** The request authenticated through a browser or session token. */\n      source: \"session\";\n      /** No API key was used for this request. */\n      key: null;\n    })\n  | (AuthContext & {\n      /** The request authenticated through an API key. */\n      source: \"key\";\n      /** Verified API key metadata for the request. */\n      key: HttpKeyContext[\"key\"];\n    });\n\n/**\n * Nullable HTTP auth context returned by\n * `auth.http.context(ctx, request, { optional: true })`.\n *\n * This preserves a stable auth-shaped object for raw `httpAction` handlers\n * that allow anonymous callers.\n */\nexport type OptionalHttpAuthContext =\n  | (OptionalAuthContext & {\n      /** No authentication source was resolved. */\n      source: null;\n      /** No API key metadata is available. */\n      key: null;\n    })\n  | HttpAuthContext;\n\n/**\n * Configuration for {@link createAuth().http.context}.\n *\n * This mirrors {@link AuthContextConfig} for raw HTTP handlers and adds support\n * for enriching mixed session/API-key auth results.\n *\n * @typeParam TResolve - Extra fields returned from `resolve()` and merged into\n *   the resolved HTTP auth context.\n *\n * @example\n * ```ts\n * const authContext = await auth.http.context(ctx, request, {\n *   resolve: async (_ctx, user, authState) => ({\n *     email: user.email,\n *     isMachineRequest: authState.source === \"key\",\n *   }),\n * });\n * ```\n */\nexport type HttpAuthContextConfig<\n  TResolve extends Record<string, unknown> = Record<string, never>,\n> = {\n  /**\n   * Allow unauthenticated callers and return a null-shaped auth object instead\n   * of throwing `NOT_SIGNED_IN`.\n   */\n  optional?: boolean;\n  /**\n   * Attach additional derived fields to the resolved HTTP auth context.\n   *\n   * This callback runs only when authentication succeeds.\n   */\n  resolve?: (\n    ctx: GenericActionCtx<any>,\n    user: UserDoc,\n    auth: HttpAuthContext,\n  ) => Promise<TResolve> | TResolve;\n  /**\n   * Override or wrap HTTP auth resolution.\n   *\n   * Return `undefined` to use the built-in session-or-key resolver, `null` for\n   * an explicit unauthenticated state, or a fully resolved\n   * {@link HttpAuthContext}.\n   */\n  authResolve?: (\n    ctx: GenericActionCtx<any>,\n    fallback: () => Promise<HttpAuthContext | null>,\n  ) =>\n    | Promise<HttpAuthContext | null | undefined>\n    | HttpAuthContext\n    | null\n    | undefined;\n};\n\nfunction createNotSignedInError() {\n  return Cv.error({\n    code: \"NOT_SIGNED_IN\",\n    message: \"Authentication required.\",\n  });\n}\n\nasync function getHttpKeyContext(\n  auth: HttpContextAuthLike,\n  ctx: GenericActionCtx<any>,\n  request: Request,\n): Promise<HttpAuthContext | null> {\n  const authHeader = request.headers.get(\"Authorization\");\n  if (!authHeader?.startsWith(\"Bearer sk_\")) {\n    return null;\n  }\n\n  try {\n    const verified = await auth.key.verify(ctx, authHeader.slice(7));\n    const authContext = await getAuthContextForUser(auth, ctx, verified.userId);\n    return {\n      ...authContext,\n      source: \"key\",\n      key: {\n        userId: verified.userId,\n        keyId: verified.keyId,\n        scopes: verified.scopes,\n      },\n    };\n  } catch {\n    return null;\n  }\n}\n\nasync function resolveHttpAuthContext(\n  auth: HttpContextAuthLike,\n  ctx: GenericActionCtx<any>,\n  request: Request,\n): Promise<HttpAuthContext | null> {\n  const sessionUserId = await getSessionUserId(ctx);\n  if (sessionUserId !== null) {\n    const authContext = await getAuthContextForUser(auth, ctx, sessionUserId);\n    return {\n      ...authContext,\n      source: \"session\",\n      key: null,\n    };\n  }\n\n  return await getHttpKeyContext(auth, ctx, request);\n}\n\n/**\n * @internal\n * Create the implementation behind `auth.http.context(...)`.\n */\nexport function createHttpContext(auth: HttpContextAuthLike): {\n  <TResolve extends Record<string, unknown> = Record<string, never>>(\n    ctx: GenericActionCtx<any>,\n    request: Request,\n    config: HttpAuthContextConfig<TResolve> & { optional: true },\n  ): Promise<OptionalHttpAuthContext & TResolve>;\n  <TResolve extends Record<string, unknown> = Record<string, never>>(\n    ctx: GenericActionCtx<any>,\n    request: Request,\n    config?: HttpAuthContextConfig<TResolve>,\n  ): Promise<HttpAuthContext & TResolve>;\n} {\n  return (async (\n    ctx: GenericActionCtx<any>,\n    request: Request,\n    config?: HttpAuthContextConfig<any>,\n  ) => {\n    const fallback = () => resolveHttpAuthContext(auth, ctx, request);\n    const authOverride = config?.authResolve\n      ? await config.authResolve(ctx, fallback)\n      : undefined;\n    const resolved =\n      authOverride === undefined ? await fallback() : authOverride;\n\n    if (resolved === null) {\n      if (config?.optional !== true) {\n        throw createNotSignedInError();\n      }\n      return {\n        ...createUnauthenticatedAuthContext(),\n        source: null,\n        key: null,\n      };\n    }\n\n    const extra = config?.resolve\n      ? await config.resolve(ctx, resolved.user, resolved)\n      : {};\n\n    return {\n      ...resolved,\n      ...extra,\n    };\n  }) as {\n    <TResolve extends Record<string, unknown> = Record<string, never>>(\n      ctx: GenericActionCtx<any>,\n      request: Request,\n      config: HttpAuthContextConfig<TResolve> & { optional: true },\n    ): Promise<OptionalHttpAuthContext & TResolve>;\n    <TResolve extends Record<string, unknown> = Record<string, never>>(\n      ctx: GenericActionCtx<any>,\n      request: Request,\n      config?: HttpAuthContextConfig<TResolve>,\n    ): Promise<HttpAuthContext & TResolve>;\n  };\n}\n\nexport function createHttpAction(auth: {\n  key: { verify: (ctx: GenericActionCtx<any>, rawKey: string) => Promise<any> };\n}) {\n  return (\n    handler: (\n      ctx: GenericActionCtx<GenericDataModel> & HttpKeyContext,\n      request: Request,\n    ) => Promise<Response | Record<string, unknown>>,\n    options?: {\n      scope?: { resource: string; action: string };\n      cors?: CorsConfig;\n    },\n  ) => {\n    const corsConfig = options?.cors ?? {};\n    const corsHeaders: Record<string, string> = {\n      \"Access-Control-Allow-Origin\": corsConfig.origin ?? \"*\",\n      \"Access-Control-Allow-Methods\":\n        corsConfig.methods ?? \"GET,POST,PUT,PATCH,DELETE,OPTIONS\",\n      \"Access-Control-Allow-Headers\":\n        corsConfig.headers ?? \"Content-Type,Authorization\",\n    };\n\n    return httpActionGeneric(async (genericCtx, request) => {\n      return Fx.run(\n        Fx.from({\n          ok: async () => {\n            const authHeader = request.headers.get(\"Authorization\");\n            if (!authHeader?.startsWith(\"Bearer \")) {\n              return new Response(\n                JSON.stringify({\n                  error: \"Missing or malformed Authorization: Bearer header.\",\n                  code: \"MISSING_BEARER_TOKEN\",\n                }),\n                {\n                  status: 401,\n                  headers: {\n                    ...corsHeaders,\n                    \"Content-Type\": \"application/json\",\n                  },\n                },\n              );\n            }\n            const rawKey = authHeader.slice(7);\n\n            const keyResult = await Fx.run(\n              Fx.attempt(\n                () => auth.key.verify(genericCtx, rawKey),\n                (result) => ({ ok: true, value: result }) as const,\n                (error) => ({ ok: false, error }) as const,\n              ),\n            );\n\n            if (!keyResult.ok) {\n              if (\n                keyResult.error instanceof ConvexError &&\n                typeof keyResult.error.data === \"object\" &&\n                keyResult.error.data !== null &&\n                \"code\" in keyResult.error.data &&\n                \"message\" in keyResult.error.data\n              ) {\n                const { code, message } = keyResult.error.data as {\n                  code: string;\n                  message: string;\n                };\n                return new Response(JSON.stringify({ error: message, code }), {\n                  status: 403,\n                  headers: {\n                    ...corsHeaders,\n                    \"Content-Type\": \"application/json\",\n                  },\n                });\n              }\n              throw keyResult.error;\n            }\n\n            if (\n              options?.scope &&\n              !keyResult.value.scopes.can(\n                options.scope.resource,\n                options.scope.action,\n              )\n            ) {\n              return new Response(\n                JSON.stringify({\n                  error: \"This API key does not have the required permissions.\",\n                  code: \"SCOPE_CHECK_FAILED\",\n                }),\n                {\n                  status: 403,\n                  headers: {\n                    ...corsHeaders,\n                    \"Content-Type\": \"application/json\",\n                  },\n                },\n              );\n            }\n\n            const enrichedCtx = Object.assign(genericCtx, {\n              key: {\n                userId: keyResult.value.userId,\n                keyId: keyResult.value.keyId,\n                scopes: keyResult.value.scopes,\n              },\n            });\n            const result = await handler(enrichedCtx, request);\n\n            if (result instanceof Response) {\n              const headers = new Headers(result.headers);\n              for (const [k, val] of Object.entries(corsHeaders)) {\n                if (!headers.has(k)) headers.set(k, val);\n              }\n              return new Response(result.body, {\n                status: result.status,\n                statusText: result.statusText,\n                headers,\n              });\n            }\n\n            return new Response(JSON.stringify(result), {\n              status: 200,\n              headers: {\n                ...corsHeaders,\n                \"Content-Type\": \"application/json\",\n              },\n            });\n          },\n          err: (error) => error,\n        }).pipe(\n          Fx.recover((error) => {\n            logError(error);\n            return Fx.succeed(\n              new Response(\n                JSON.stringify({\n                  error: \"An unexpected error occurred.\",\n                  code: \"INTERNAL_ERROR\",\n                }),\n                {\n                  status: 500,\n                  headers: {\n                    ...corsHeaders,\n                    \"Content-Type\": \"application/json\",\n                  },\n                },\n              ),\n            );\n          }),\n        ),\n      );\n    });\n  };\n}\n\nexport function createHttpRoute(\n  wrapAction: ReturnType<typeof createHttpAction>,\n) {\n  return (\n    http: { route: (config: any) => void },\n    routeConfig: {\n      path: string;\n      method: \"GET\" | \"POST\" | \"PUT\" | \"PATCH\" | \"DELETE\";\n      handler: (\n        ctx: GenericActionCtx<GenericDataModel> & HttpKeyContext,\n        request: Request,\n      ) => Promise<Response | Record<string, unknown>>;\n      scope?: { resource: string; action: string };\n      cors?: CorsConfig;\n    },\n  ) => {\n    const corsConfig = routeConfig.cors ?? {};\n    const corsHeaders: Record<string, string> = {\n      \"Access-Control-Allow-Origin\": corsConfig.origin ?? \"*\",\n      \"Access-Control-Allow-Methods\":\n        corsConfig.methods ?? \"GET,POST,PUT,PATCH,DELETE,OPTIONS\",\n      \"Access-Control-Allow-Headers\":\n        corsConfig.headers ?? \"Content-Type,Authorization\",\n    };\n\n    http.route({\n      path: routeConfig.path,\n      method: \"OPTIONS\",\n      handler: httpActionGeneric(async () => {\n        return new Response(null, { status: 204, headers: corsHeaders });\n      }),\n    });\n\n    http.route({\n      path: routeConfig.path,\n      method: routeConfig.method,\n      handler: wrapAction(routeConfig.handler, {\n        scope: routeConfig.scope,\n        cors: routeConfig.cors,\n      }),\n    });\n  };\n}\n\nexport function convertErrorsToResponse(\n  errorStatusCode: number,\n  action: (ctx: GenericActionCtx<any>, request: Request) => Promise<Response>,\n) {\n  return async (ctx: GenericActionCtx<any>, request: Request) => {\n    return Fx.run(\n      Fx.from({\n        ok: () => action(ctx, request),\n        err: (error) => error,\n      }).pipe(\n        Fx.recover((error) => {\n          if (\n            error instanceof ConvexError &&\n            typeof error.data === \"object\" &&\n            error.data !== null &&\n            \"code\" in error.data &&\n            \"message\" in error.data\n          ) {\n            return Fx.succeed(\n              new Response(\n                JSON.stringify({\n                  code: error.data.code,\n                  message: error.data.message,\n                }),\n                {\n                  status: errorStatusCode,\n                  headers: { \"Content-Type\": \"application/json\" },\n                },\n              ),\n            );\n          } else if (error instanceof ConvexError) {\n            return Fx.succeed(\n              new Response(null, {\n                status: errorStatusCode,\n                statusText:\n                  typeof error.data === \"string\" ? error.data : \"Error\",\n              }),\n            );\n          } else {\n            logError(error);\n            return Fx.succeed(\n              new Response(null, {\n                status: 500,\n                statusText: \"Internal Server Error\",\n              }),\n            );\n          }\n        }),\n      ),\n    );\n  };\n}\n\nexport function getCookies(\n  request: Request,\n): Record<string, string | undefined> {\n  return parseCookies(request.headers.get(\"Cookie\") ?? \"\");\n}\n\nexport type SSORuntimeRoute = {\n  pathname?: string;\n  enterpriseId: string;\n  protocol: \"oidc\" | \"saml\" | \"scim\";\n  rest: string[];\n};\n\nfunction parseEnterpriseRuntimeRoute(\n  pathname: string,\n  routeBase: string,\n): SSORuntimeRoute | null {\n  const runtimePrefix = `${routeBase}/`;\n  const runtimeParts = pathname.startsWith(runtimePrefix)\n    ? pathname.slice(runtimePrefix.length).split(\"/\").filter(Boolean)\n    : [];\n  const [runtimeEnterpriseId, protocol, ...rest] = runtimeParts;\n  if (\n    runtimeEnterpriseId === undefined ||\n    (protocol !== \"oidc\" && protocol !== \"saml\" && protocol !== \"scim\") ||\n    rest.length === 0\n  ) {\n    return null;\n  }\n  return {\n    pathname,\n    enterpriseId: runtimeEnterpriseId,\n    protocol,\n    rest,\n  };\n}\n\nexport function addOpenIdRoutes(\n  http: HttpRouter,\n  deps: {\n    getIssuer: () => string;\n    getJwks: () => string;\n  },\n) {\n  const cacheControl =\n    \"public, max-age=15, stale-while-revalidate=15, stale-if-error=86400\";\n\n  http.route({\n    path: \"/.well-known/openid-configuration\",\n    method: \"GET\",\n    handler: httpActionGeneric(async () => {\n      const issuer = deps.getIssuer();\n      return new Response(\n        JSON.stringify({\n          issuer,\n          jwks_uri: `${issuer}/.well-known/jwks.json`,\n        }),\n        {\n          status: 200,\n          headers: {\n            \"Content-Type\": \"application/json\",\n            \"Cache-Control\": cacheControl,\n          },\n        },\n      );\n    }),\n  });\n\n  http.route({\n    path: \"/.well-known/jwks.json\",\n    method: \"GET\",\n    handler: httpActionGeneric(async () => {\n      return new Response(deps.getJwks(), {\n        status: 200,\n        headers: {\n          \"Content-Type\": \"application/json\",\n          \"Cache-Control\": cacheControl,\n        },\n      });\n    }),\n  });\n}\n\nexport function addAuthRoutes(\n  http: HttpRouter,\n  deps: {\n    handleSignIn: (\n      ctx: GenericActionCtx<any>,\n      request: Request,\n    ) => Promise<Response>;\n    handleCallback: (\n      ctx: GenericActionCtx<any>,\n      request: Request,\n    ) => Promise<Response>;\n  },\n) {\n  http.route({\n    pathPrefix: \"/api/auth/signin/\",\n    method: \"GET\",\n    handler: httpActionGeneric(deps.handleSignIn),\n  });\n\n  const callbackHandler = httpActionGeneric(deps.handleCallback);\n\n  http.route({\n    pathPrefix: \"/api/auth/callback/\",\n    method: \"GET\",\n    handler: callbackHandler,\n  });\n\n  http.route({\n    pathPrefix: \"/api/auth/callback/\",\n    method: \"POST\",\n    handler: callbackHandler,\n  });\n}\n\nexport function addSSORoutes(\n  http: HttpRouter,\n  deps: {\n    routeBase: string;\n    convertErrorsToResponse: typeof convertErrorsToResponse;\n    handleSamlMetadata: (\n      ctx: GenericActionCtx<any>,\n      request: Request,\n      route: SSORuntimeRoute,\n    ) => Promise<Response>;\n    handleSamlSignIn: (\n      ctx: GenericActionCtx<any>,\n      request: Request,\n      route: SSORuntimeRoute,\n    ) => Promise<Response>;\n    handleOidcSignIn: (\n      ctx: GenericActionCtx<any>,\n      request: Request,\n      route: SSORuntimeRoute,\n    ) => Promise<Response>;\n    handleOidcCallback: (\n      ctx: GenericActionCtx<any>,\n      request: Request,\n      route: SSORuntimeRoute,\n    ) => Promise<Response>;\n    handleSamlAcs: (\n      ctx: GenericActionCtx<any>,\n      request: Request,\n      route: SSORuntimeRoute,\n    ) => Promise<Response>;\n    handleSamlSlo: (\n      ctx: GenericActionCtx<any>,\n      request: Request,\n      route: SSORuntimeRoute,\n    ) => Promise<Response>;\n    handleScimRequest: (\n      ctx: GenericActionCtx<any>,\n      request: Request,\n    ) => Promise<Response>;\n    scimError: (status: number, scimType: string, detail: string) => Response;\n  },\n) {\n  const routePrefix = `${deps.routeBase}/`;\n\n  http.route({\n    pathPrefix: routePrefix,\n    method: \"GET\",\n    handler: httpActionGeneric(\n      deps.convertErrorsToResponse(400, async (ctx, request) => {\n        const route = parseEnterpriseRuntimeRoute(\n          new URL(request.url).pathname,\n          deps.routeBase,\n        );\n        if (!route) {\n          throw Cv.error({\n            code: \"INVALID_PARAMETERS\",\n            message: \"Invalid enterprise runtime path.\",\n          });\n        }\n        if (route.protocol === \"saml\" && route.rest.length === 1) {\n          if (route.rest[0] === \"metadata\") {\n            return await deps.handleSamlMetadata(ctx, request, route);\n          }\n          if (route.rest[0] === \"signin\") {\n            return await deps.handleSamlSignIn(ctx, request, route);\n          }\n          if (route.rest[0] === \"acs\") {\n            return await deps.handleSamlAcs(ctx, request, route);\n          }\n          if (route.rest[0] === \"slo\") {\n            return await deps.handleSamlSlo(ctx, request, route);\n          }\n        }\n        if (route.protocol === \"oidc\" && route.rest.length === 1) {\n          if (route.rest[0] === \"signin\") {\n            return await deps.handleOidcSignIn(ctx, request, route);\n          }\n          if (route.rest[0] === \"callback\") {\n            return await deps.handleOidcCallback(ctx, request, route);\n          }\n        }\n        if (route.protocol === \"scim\" && route.rest[0] === \"v2\") {\n          return await deps.handleScimRequest(ctx, request);\n        }\n        throw Cv.error({\n          code: \"INVALID_PARAMETERS\",\n          message: \"Invalid enterprise runtime path.\",\n        });\n      }),\n    ),\n  });\n\n  http.route({\n    pathPrefix: routePrefix,\n    method: \"POST\",\n    handler: httpActionGeneric(\n      deps.convertErrorsToResponse(400, async (ctx, request) => {\n        const route = parseEnterpriseRuntimeRoute(\n          new URL(request.url).pathname,\n          deps.routeBase,\n        );\n        if (route?.protocol === \"saml\" && route.rest.length === 1) {\n          if (route.rest[0] === \"acs\") {\n            return await deps.handleSamlAcs(ctx, request, route);\n          }\n          if (route.rest[0] === \"slo\") {\n            return await deps.handleSamlSlo(ctx, request, route);\n          }\n        }\n        if (route?.protocol === \"scim\" && route.rest[0] === \"v2\") {\n          return await deps.handleScimRequest(ctx, request);\n        }\n        throw Cv.error({\n          code: \"INVALID_PARAMETERS\",\n          message: \"Invalid enterprise runtime path.\",\n        });\n      }),\n    ),\n  });\n\n  http.route({\n    pathPrefix: routePrefix,\n    method: \"PUT\",\n    handler: httpActionGeneric(\n      deps.convertErrorsToResponse(400, async (ctx, request) => {\n        const route = parseEnterpriseRuntimeRoute(\n          new URL(request.url).pathname,\n          deps.routeBase,\n        );\n        if (route?.protocol === \"scim\" && route.rest[0] === \"v2\") {\n          return await deps.handleScimRequest(ctx, request);\n        }\n        throw Cv.error({\n          code: \"INVALID_PARAMETERS\",\n          message: \"Invalid enterprise runtime path.\",\n        });\n      }),\n    ),\n  });\n\n  for (const method of [\"PATCH\", \"DELETE\"] as const) {\n    http.route({\n      pathPrefix: routePrefix,\n      method,\n      handler: httpActionGeneric(async (ctx, request) => {\n        const route = parseEnterpriseRuntimeRoute(\n          new URL(request.url).pathname,\n          deps.routeBase,\n        );\n        if (!route || route.protocol !== \"scim\" || route.rest[0] !== \"v2\") {\n          return deps.scimError(404, \"notFound\", \"SCIM resource not found.\");\n        }\n        return await deps.handleScimRequest(ctx, request);\n      }),\n    });\n  }\n}\n"],"mappings":";;;;;;;;;AA0JA,SAAS,yBAAyB;AAChC,QAAO,GAAG,MAAM;EACd,MAAM;EACN,SAAS;EACV,CAAC;;AAGJ,eAAe,kBACb,MACA,KACA,SACiC;CACjC,MAAM,aAAa,QAAQ,QAAQ,IAAI,gBAAgB;AACvD,KAAI,CAAC,YAAY,WAAW,aAAa,CACvC,QAAO;AAGT,KAAI;EACF,MAAM,WAAW,MAAM,KAAK,IAAI,OAAO,KAAK,WAAW,MAAM,EAAE,CAAC;AAEhE,SAAO;GACL,GAFkB,MAAM,sBAAsB,MAAM,KAAK,SAAS,OAAO;GAGzE,QAAQ;GACR,KAAK;IACH,QAAQ,SAAS;IACjB,OAAO,SAAS;IAChB,QAAQ,SAAS;IAClB;GACF;SACK;AACN,SAAO;;;AAIX,eAAe,uBACb,MACA,KACA,SACiC;CACjC,MAAM,gBAAgB,MAAM,iBAAiB,IAAI;AACjD,KAAI,kBAAkB,KAEpB,QAAO;EACL,GAFkB,MAAM,sBAAsB,MAAM,KAAK,cAAc;EAGvE,QAAQ;EACR,KAAK;EACN;AAGH,QAAO,MAAM,kBAAkB,MAAM,KAAK,QAAQ;;;;;;AAOpD,SAAgB,kBAAkB,MAWhC;AACA,SAAQ,OACN,KACA,SACA,WACG;EACH,MAAM,iBAAiB,uBAAuB,MAAM,KAAK,QAAQ;EACjE,MAAM,eAAe,QAAQ,cACzB,MAAM,OAAO,YAAY,KAAK,SAAS,GACvC;EACJ,MAAM,WACJ,iBAAiB,SAAY,MAAM,UAAU,GAAG;AAElD,MAAI,aAAa,MAAM;AACrB,OAAI,QAAQ,aAAa,KACvB,OAAM,wBAAwB;AAEhC,UAAO;IACL,GAAG,kCAAkC;IACrC,QAAQ;IACR,KAAK;IACN;;EAGH,MAAM,QAAQ,QAAQ,UAClB,MAAM,OAAO,QAAQ,KAAK,SAAS,MAAM,SAAS,GAClD,EAAE;AAEN,SAAO;GACL,GAAG;GACH,GAAG;GACJ;;;AAeL,SAAgB,iBAAiB,MAE9B;AACD,SACE,SAIA,YAIG;EACH,MAAM,aAAa,SAAS,QAAQ,EAAE;EACtC,MAAM,cAAsC;GAC1C,+BAA+B,WAAW,UAAU;GACpD,gCACE,WAAW,WAAW;GACxB,gCACE,WAAW,WAAW;GACzB;AAED,SAAO,kBAAkB,OAAO,YAAY,YAAY;AACtD,UAAO,GAAG,IACR,GAAG,KAAK;IACN,IAAI,YAAY;KACd,MAAM,aAAa,QAAQ,QAAQ,IAAI,gBAAgB;AACvD,SAAI,CAAC,YAAY,WAAW,UAAU,CACpC,QAAO,IAAI,SACT,KAAK,UAAU;MACb,OAAO;MACP,MAAM;MACP,CAAC,EACF;MACE,QAAQ;MACR,SAAS;OACP,GAAG;OACH,gBAAgB;OACjB;MACF,CACF;KAEH,MAAM,SAAS,WAAW,MAAM,EAAE;KAElC,MAAM,YAAY,MAAM,GAAG,IACzB,GAAG,cACK,KAAK,IAAI,OAAO,YAAY,OAAO,GACxC,cAAY;MAAE,IAAI;MAAM,OAAOA;MAAQ,IACvC,WAAW;MAAE,IAAI;MAAO;MAAO,EACjC,CACF;AAED,SAAI,CAAC,UAAU,IAAI;AACjB,UACE,UAAU,iBAAiB,eAC3B,OAAO,UAAU,MAAM,SAAS,YAChC,UAAU,MAAM,SAAS,QACzB,UAAU,UAAU,MAAM,QAC1B,aAAa,UAAU,MAAM,MAC7B;OACA,MAAM,EAAE,MAAM,YAAY,UAAU,MAAM;AAI1C,cAAO,IAAI,SAAS,KAAK,UAAU;QAAE,OAAO;QAAS;QAAM,CAAC,EAAE;QAC5D,QAAQ;QACR,SAAS;SACP,GAAG;SACH,gBAAgB;SACjB;QACF,CAAC;;AAEJ,YAAM,UAAU;;AAGlB,SACE,SAAS,SACT,CAAC,UAAU,MAAM,OAAO,IACtB,QAAQ,MAAM,UACd,QAAQ,MAAM,OACf,CAED,QAAO,IAAI,SACT,KAAK,UAAU;MACb,OAAO;MACP,MAAM;MACP,CAAC,EACF;MACE,QAAQ;MACR,SAAS;OACP,GAAG;OACH,gBAAgB;OACjB;MACF,CACF;KAUH,MAAM,SAAS,MAAM,QAPD,OAAO,OAAO,YAAY,EAC5C,KAAK;MACH,QAAQ,UAAU,MAAM;MACxB,OAAO,UAAU,MAAM;MACvB,QAAQ,UAAU,MAAM;MACzB,EACF,CAAC,EACwC,QAAQ;AAElD,SAAI,kBAAkB,UAAU;MAC9B,MAAM,UAAU,IAAI,QAAQ,OAAO,QAAQ;AAC3C,WAAK,MAAM,CAAC,GAAG,QAAQ,OAAO,QAAQ,YAAY,CAChD,KAAI,CAAC,QAAQ,IAAI,EAAE,CAAE,SAAQ,IAAI,GAAG,IAAI;AAE1C,aAAO,IAAI,SAAS,OAAO,MAAM;OAC/B,QAAQ,OAAO;OACf,YAAY,OAAO;OACnB;OACD,CAAC;;AAGJ,YAAO,IAAI,SAAS,KAAK,UAAU,OAAO,EAAE;MAC1C,QAAQ;MACR,SAAS;OACP,GAAG;OACH,gBAAgB;OACjB;MACF,CAAC;;IAEJ,MAAM,UAAU;IACjB,CAAC,CAAC,KACD,GAAG,SAAS,UAAU;AACpB,aAAS,MAAM;AACf,WAAO,GAAG,QACR,IAAI,SACF,KAAK,UAAU;KACb,OAAO;KACP,MAAM;KACP,CAAC,EACF;KACE,QAAQ;KACR,SAAS;MACP,GAAG;MACH,gBAAgB;MACjB;KACF,CACF,CACF;KACD,CACH,CACF;IACD;;;AAIN,SAAgB,gBACd,YACA;AACA,SACE,MACA,gBAUG;EACH,MAAM,aAAa,YAAY,QAAQ,EAAE;EACzC,MAAM,cAAsC;GAC1C,+BAA+B,WAAW,UAAU;GACpD,gCACE,WAAW,WAAW;GACxB,gCACE,WAAW,WAAW;GACzB;AAED,OAAK,MAAM;GACT,MAAM,YAAY;GAClB,QAAQ;GACR,SAAS,kBAAkB,YAAY;AACrC,WAAO,IAAI,SAAS,MAAM;KAAE,QAAQ;KAAK,SAAS;KAAa,CAAC;KAChE;GACH,CAAC;AAEF,OAAK,MAAM;GACT,MAAM,YAAY;GAClB,QAAQ,YAAY;GACpB,SAAS,WAAW,YAAY,SAAS;IACvC,OAAO,YAAY;IACnB,MAAM,YAAY;IACnB,CAAC;GACH,CAAC;;;AAIN,SAAgB,wBACd,iBACA,QACA;AACA,QAAO,OAAO,KAA4B,YAAqB;AAC7D,SAAO,GAAG,IACR,GAAG,KAAK;GACN,UAAU,OAAO,KAAK,QAAQ;GAC9B,MAAM,UAAU;GACjB,CAAC,CAAC,KACD,GAAG,SAAS,UAAU;AACpB,OACE,iBAAiB,eACjB,OAAO,MAAM,SAAS,YACtB,MAAM,SAAS,QACf,UAAU,MAAM,QAChB,aAAa,MAAM,KAEnB,QAAO,GAAG,QACR,IAAI,SACF,KAAK,UAAU;IACb,MAAM,MAAM,KAAK;IACjB,SAAS,MAAM,KAAK;IACrB,CAAC,EACF;IACE,QAAQ;IACR,SAAS,EAAE,gBAAgB,oBAAoB;IAChD,CACF,CACF;YACQ,iBAAiB,YAC1B,QAAO,GAAG,QACR,IAAI,SAAS,MAAM;IACjB,QAAQ;IACR,YACE,OAAO,MAAM,SAAS,WAAW,MAAM,OAAO;IACjD,CAAC,CACH;QACI;AACL,aAAS,MAAM;AACf,WAAO,GAAG,QACR,IAAI,SAAS,MAAM;KACjB,QAAQ;KACR,YAAY;KACb,CAAC,CACH;;IAEH,CACH,CACF;;;AAIL,SAAgB,WACd,SACoC;AACpC,QAAOC,MAAa,QAAQ,QAAQ,IAAI,SAAS,IAAI,GAAG;;AAU1D,SAAS,4BACP,UACA,WACwB;CACxB,MAAM,gBAAgB,GAAG,UAAU;CAInC,MAAM,CAAC,qBAAqB,UAAU,GAAG,QAHpB,SAAS,WAAW,cAAc,GACnD,SAAS,MAAM,cAAc,OAAO,CAAC,MAAM,IAAI,CAAC,OAAO,QAAQ,GAC/D,EAAE;AAEN,KACE,wBAAwB,UACvB,aAAa,UAAU,aAAa,UAAU,aAAa,UAC5D,KAAK,WAAW,EAEhB,QAAO;AAET,QAAO;EACL;EACA,cAAc;EACd;EACA;EACD;;AAGH,SAAgB,gBACd,MACA,MAIA;CACA,MAAM,eACJ;AAEF,MAAK,MAAM;EACT,MAAM;EACN,QAAQ;EACR,SAAS,kBAAkB,YAAY;GACrC,MAAM,SAAS,KAAK,WAAW;AAC/B,UAAO,IAAI,SACT,KAAK,UAAU;IACb;IACA,UAAU,GAAG,OAAO;IACrB,CAAC,EACF;IACE,QAAQ;IACR,SAAS;KACP,gBAAgB;KAChB,iBAAiB;KAClB;IACF,CACF;IACD;EACH,CAAC;AAEF,MAAK,MAAM;EACT,MAAM;EACN,QAAQ;EACR,SAAS,kBAAkB,YAAY;AACrC,UAAO,IAAI,SAAS,KAAK,SAAS,EAAE;IAClC,QAAQ;IACR,SAAS;KACP,gBAAgB;KAChB,iBAAiB;KAClB;IACF,CAAC;IACF;EACH,CAAC;;AAGJ,SAAgB,cACd,MACA,MAUA;AACA,MAAK,MAAM;EACT,YAAY;EACZ,QAAQ;EACR,SAAS,kBAAkB,KAAK,aAAa;EAC9C,CAAC;CAEF,MAAM,kBAAkB,kBAAkB,KAAK,eAAe;AAE9D,MAAK,MAAM;EACT,YAAY;EACZ,QAAQ;EACR,SAAS;EACV,CAAC;AAEF,MAAK,MAAM;EACT,YAAY;EACZ,QAAQ;EACR,SAAS;EACV,CAAC;;AAGJ,SAAgB,aACd,MACA,MAuCA;CACA,MAAM,cAAc,GAAG,KAAK,UAAU;AAEtC,MAAK,MAAM;EACT,YAAY;EACZ,QAAQ;EACR,SAAS,kBACP,KAAK,wBAAwB,KAAK,OAAO,KAAK,YAAY;GACxD,MAAM,QAAQ,4BACZ,IAAI,IAAI,QAAQ,IAAI,CAAC,UACrB,KAAK,UACN;AACD,OAAI,CAAC,MACH,OAAM,GAAG,MAAM;IACb,MAAM;IACN,SAAS;IACV,CAAC;AAEJ,OAAI,MAAM,aAAa,UAAU,MAAM,KAAK,WAAW,GAAG;AACxD,QAAI,MAAM,KAAK,OAAO,WACpB,QAAO,MAAM,KAAK,mBAAmB,KAAK,SAAS,MAAM;AAE3D,QAAI,MAAM,KAAK,OAAO,SACpB,QAAO,MAAM,KAAK,iBAAiB,KAAK,SAAS,MAAM;AAEzD,QAAI,MAAM,KAAK,OAAO,MACpB,QAAO,MAAM,KAAK,cAAc,KAAK,SAAS,MAAM;AAEtD,QAAI,MAAM,KAAK,OAAO,MACpB,QAAO,MAAM,KAAK,cAAc,KAAK,SAAS,MAAM;;AAGxD,OAAI,MAAM,aAAa,UAAU,MAAM,KAAK,WAAW,GAAG;AACxD,QAAI,MAAM,KAAK,OAAO,SACpB,QAAO,MAAM,KAAK,iBAAiB,KAAK,SAAS,MAAM;AAEzD,QAAI,MAAM,KAAK,OAAO,WACpB,QAAO,MAAM,KAAK,mBAAmB,KAAK,SAAS,MAAM;;AAG7D,OAAI,MAAM,aAAa,UAAU,MAAM,KAAK,OAAO,KACjD,QAAO,MAAM,KAAK,kBAAkB,KAAK,QAAQ;AAEnD,SAAM,GAAG,MAAM;IACb,MAAM;IACN,SAAS;IACV,CAAC;IACF,CACH;EACF,CAAC;AAEF,MAAK,MAAM;EACT,YAAY;EACZ,QAAQ;EACR,SAAS,kBACP,KAAK,wBAAwB,KAAK,OAAO,KAAK,YAAY;GACxD,MAAM,QAAQ,4BACZ,IAAI,IAAI,QAAQ,IAAI,CAAC,UACrB,KAAK,UACN;AACD,OAAI,OAAO,aAAa,UAAU,MAAM,KAAK,WAAW,GAAG;AACzD,QAAI,MAAM,KAAK,OAAO,MACpB,QAAO,MAAM,KAAK,cAAc,KAAK,SAAS,MAAM;AAEtD,QAAI,MAAM,KAAK,OAAO,MACpB,QAAO,MAAM,KAAK,cAAc,KAAK,SAAS,MAAM;;AAGxD,OAAI,OAAO,aAAa,UAAU,MAAM,KAAK,OAAO,KAClD,QAAO,MAAM,KAAK,kBAAkB,KAAK,QAAQ;AAEnD,SAAM,GAAG,MAAM;IACb,MAAM;IACN,SAAS;IACV,CAAC;IACF,CACH;EACF,CAAC;AAEF,MAAK,MAAM;EACT,YAAY;EACZ,QAAQ;EACR,SAAS,kBACP,KAAK,wBAAwB,KAAK,OAAO,KAAK,YAAY;GACxD,MAAM,QAAQ,4BACZ,IAAI,IAAI,QAAQ,IAAI,CAAC,UACrB,KAAK,UACN;AACD,OAAI,OAAO,aAAa,UAAU,MAAM,KAAK,OAAO,KAClD,QAAO,MAAM,KAAK,kBAAkB,KAAK,QAAQ;AAEnD,SAAM,GAAG,MAAM;IACb,MAAM;IACN,SAAS;IACV,CAAC;IACF,CACH;EACF,CAAC;AAEF,MAAK,MAAM,UAAU,CAAC,SAAS,SAAS,CACtC,MAAK,MAAM;EACT,YAAY;EACZ;EACA,SAAS,kBAAkB,OAAO,KAAK,YAAY;GACjD,MAAM,QAAQ,4BACZ,IAAI,IAAI,QAAQ,IAAI,CAAC,UACrB,KAAK,UACN;AACD,OAAI,CAAC,SAAS,MAAM,aAAa,UAAU,MAAM,KAAK,OAAO,KAC3D,QAAO,KAAK,UAAU,KAAK,YAAY,2BAA2B;AAEpE,UAAO,MAAM,KAAK,kBAAkB,KAAK,QAAQ;IACjD;EACH,CAAC"}

package/dist/component/server/identity.js

@@ -1,16 +0,0 @@
-import { Cv } from "@robelest/fx/convex";
-
-//#region src/server/identity.ts
-/** @internal */
-function userIdFromIdentitySubject(subject) {
-	const [userId, ...rest] = subject.split("|");
-	if (typeof userId !== "string" || userId.length === 0 || rest.length === 0 || rest.some((segment) => segment.length === 0)) throw Cv.error({
-		code: "INTERNAL_ERROR",
-		message: "Authenticated identity subject is malformed."
-	});
-	return userId;
-}
-
-//#endregion
-export { userIdFromIdentitySubject };
-//# sourceMappingURL=identity.js.map

package/dist/component/server/identity.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"identity.js","names":[],"sources":["../../../src/server/identity.ts"],"sourcesContent":["import { Cv } from \"@robelest/fx/convex\";\n\n/** @internal */\nexport function userIdFromIdentitySubject(subject: string): string {\n  const [userId, ...rest] = subject.split(\"|\");\n  if (\n    typeof userId !== \"string\" ||\n    userId.length === 0 ||\n    rest.length === 0 ||\n    rest.some((segment) => segment.length === 0)\n  ) {\n    throw Cv.error({\n      code: \"INTERNAL_ERROR\",\n      message: \"Authenticated identity subject is malformed.\",\n    });\n  }\n  return userId;\n}\n"],"mappings":";;;;AAGA,SAAgB,0BAA0B,SAAyB;CACjE,MAAM,CAAC,QAAQ,GAAG,QAAQ,QAAQ,MAAM,IAAI;AAC5C,KACE,OAAO,WAAW,YAClB,OAAO,WAAW,KAClB,KAAK,WAAW,KAChB,KAAK,MAAM,YAAY,QAAQ,WAAW,EAAE,CAE5C,OAAM,GAAG,MAAM;EACb,MAAM;EACN,SAAS;EACV,CAAC;AAEJ,QAAO"}