@robelest/convex-auth 0.0.4-preview.25 → 0.0.4-preview.28

package/dist/component/server/keys.js

@@ -1,96 +0,0 @@
-import { generateRandomString, sha256 } from "./utils.js";
-
-//#region src/server/keys.ts
-const DEFAULT_KEY_PREFIX = "sk_";
-const KEY_RANDOM_LENGTH = 32;
-const KEY_RANDOM_ALPHABET = "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789";
-/**
-* How many characters of the full key to store as the visible prefix.
-* Includes the prefix string (e.g. "sk_") plus a few random chars.
-*/
-const VISIBLE_PREFIX_EXTRA_CHARS = 4;
-/**
-* Generate a new API key.
-*
-* Returns the raw key (to be shown once to the user) and metadata for storage.
-* The raw key is `{prefix}{32 random alphanumeric chars}`.
-*
-* @param prefix - Key prefix, defaults to "sk_"
-* @returns `{ raw, hashedKey, displayPrefix }`
-*/
-/** @internal */
-async function generateApiKey(prefix = DEFAULT_KEY_PREFIX) {
-	const raw = `${prefix}${generateRandomString(KEY_RANDOM_LENGTH, KEY_RANDOM_ALPHABET)}`;
-	return {
-		raw,
-		hashedKey: await sha256(raw),
-		displayPrefix: `${raw.substring(0, prefix.length + VISIBLE_PREFIX_EXTRA_CHARS)}...`
-	};
-}
-/**
-* Hash a raw API key for lookup.
-*
-* Used during Bearer token verification to find the stored key record.
-*/
-/** @internal */
-async function hashApiKey(rawKey) {
-	return sha256(rawKey);
-}
-/**
-* Build a `ScopeChecker` from an array of `KeyScope` entries.
-*
-* The checker provides a `.can(resource, action)` method that returns `true`
-* if any scope entry grants the requested permission.
-*
-* A wildcard action `"*"` grants all actions on that resource.
-* A wildcard resource `"*"` grants the action on all resources.
-*/
-/** @internal */
-function buildScopeChecker(scopes) {
-	return {
-		scopes,
-		can(resource, action) {
-			return scopes.some((scope) => (scope.resource === resource || scope.resource === "*") && (scope.actions.includes(action) || scope.actions.includes("*")));
-		}
-	};
-}
-/**
-* Check whether a key is rate-limited based on its stored state.
-*
-* Uses the same token-bucket algorithm as sign-in rate limiting:
-* tokens refill linearly over the configured window.
-*
-* @returns `{ limited: boolean; newState: { attemptsLeft, lastAttemptTime } }`
-*/
-/** @internal */
-function checkKeyRateLimit(rateLimit, state) {
-	const now = Date.now();
-	if (!state) return {
-		limited: false,
-		newState: {
-			attemptsLeft: rateLimit.maxRequests - 1,
-			lastAttemptTime: now
-		}
-	};
-	const elapsed = now - state.lastAttemptTime;
-	const refillRate = rateLimit.maxRequests / rateLimit.windowMs;
-	const refilled = Math.min(rateLimit.maxRequests, state.attemptsLeft + elapsed * refillRate);
-	if (refilled < 1) return {
-		limited: true,
-		newState: {
-			attemptsLeft: refilled,
-			lastAttemptTime: now
-		}
-	};
-	return {
-		limited: false,
-		newState: {
-			attemptsLeft: refilled - 1,
-			lastAttemptTime: now
-		}
-	};
-}
-
-//#endregion
-export { buildScopeChecker, checkKeyRateLimit, generateApiKey, hashApiKey };
-//# sourceMappingURL=keys.js.map

package/dist/component/server/keys.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"keys.js","names":[],"sources":["../../../src/server/keys.ts"],"sourcesContent":["/**\n * API Key crypto utilities.\n *\n * Uses `@oslojs/crypto` primitives for key generation and hashing:\n * - SHA-256 for hashing keys (API keys have high entropy, no need for bcrypt)\n * - Cryptographically secure random generation for key material\n *\n * @module\n */\n\nimport type { KeyScope, ScopeChecker } from \"./types\";\nimport { sha256, generateRandomString } from \"./utils\";\n\n// ============================================================================\n// Constants\n// ============================================================================\n\nconst DEFAULT_KEY_PREFIX = \"sk_\";\nconst KEY_RANDOM_LENGTH = 32;\nconst KEY_RANDOM_ALPHABET =\n  \"ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789\";\n\n/**\n * How many characters of the full key to store as the visible prefix.\n * Includes the prefix string (e.g. \"sk_\") plus a few random chars.\n */\nconst VISIBLE_PREFIX_EXTRA_CHARS = 4;\n\n// ============================================================================\n// Key generation\n// ============================================================================\n\n/**\n * Generate a new API key.\n *\n * Returns the raw key (to be shown once to the user) and metadata for storage.\n * The raw key is `{prefix}{32 random alphanumeric chars}`.\n *\n * @param prefix - Key prefix, defaults to \"sk_\"\n * @returns `{ raw, hashedKey, displayPrefix }`\n */\n/** @internal */\nexport async function generateApiKey(\n  prefix: string = DEFAULT_KEY_PREFIX,\n): Promise<{\n  /** The full raw key — show to user once, never store. */\n  raw: string;\n  /** SHA-256 hex hash of the raw key — store this. */\n  hashedKey: string;\n  /** Truncated prefix for display (e.g. \"sk_aBc1...\"). */\n  displayPrefix: string;\n}> {\n  const randomPart = generateRandomString(\n    KEY_RANDOM_LENGTH,\n    KEY_RANDOM_ALPHABET,\n  );\n  const raw = `${prefix}${randomPart}`;\n  const hashedKey = await sha256(raw);\n  const displayPrefix = `${raw.substring(0, prefix.length + VISIBLE_PREFIX_EXTRA_CHARS)}...`;\n\n  return { raw, hashedKey, displayPrefix };\n}\n\n/**\n * Hash a raw API key for lookup.\n *\n * Used during Bearer token verification to find the stored key record.\n */\n/** @internal */\nexport async function hashApiKey(rawKey: string): Promise<string> {\n  return sha256(rawKey);\n}\n\n// ============================================================================\n// Scope checker\n// ============================================================================\n\n/**\n * Build a `ScopeChecker` from an array of `KeyScope` entries.\n *\n * The checker provides a `.can(resource, action)` method that returns `true`\n * if any scope entry grants the requested permission.\n *\n * A wildcard action `\"*\"` grants all actions on that resource.\n * A wildcard resource `\"*\"` grants the action on all resources.\n */\n/** @internal */\nexport function buildScopeChecker(scopes: KeyScope[]): ScopeChecker {\n  return {\n    scopes,\n    can(resource: string, action: string): boolean {\n      return scopes.some(\n        (scope) =>\n          (scope.resource === resource || scope.resource === \"*\") &&\n          (scope.actions.includes(action) || scope.actions.includes(\"*\")),\n      );\n    },\n  };\n}\n\n// ============================================================================\n// Per-key rate limiting (token-bucket)\n// ============================================================================\n\n/**\n * Check whether a key is rate-limited based on its stored state.\n *\n * Uses the same token-bucket algorithm as sign-in rate limiting:\n * tokens refill linearly over the configured window.\n *\n * @returns `{ limited: boolean; newState: { attemptsLeft, lastAttemptTime } }`\n */\n/** @internal */\nexport function checkKeyRateLimit(\n  rateLimit: { maxRequests: number; windowMs: number },\n  state: { attemptsLeft: number; lastAttemptTime: number } | undefined,\n): {\n  limited: boolean;\n  newState: { attemptsLeft: number; lastAttemptTime: number };\n} {\n  const now = Date.now();\n\n  if (!state) {\n    // First request — create initial state with one token consumed.\n    return {\n      limited: false,\n      newState: {\n        attemptsLeft: rateLimit.maxRequests - 1,\n        lastAttemptTime: now,\n      },\n    };\n  }\n\n  const elapsed = now - state.lastAttemptTime;\n  const refillRate = rateLimit.maxRequests / rateLimit.windowMs;\n  const refilled = Math.min(\n    rateLimit.maxRequests,\n    state.attemptsLeft + elapsed * refillRate,\n  );\n\n  if (refilled < 1) {\n    return {\n      limited: true,\n      newState: {\n        attemptsLeft: refilled,\n        lastAttemptTime: now,\n      },\n    };\n  }\n\n  return {\n    limited: false,\n    newState: {\n      attemptsLeft: refilled - 1,\n      lastAttemptTime: now,\n    },\n  };\n}\n"],"mappings":";;;AAiBA,MAAM,qBAAqB;AAC3B,MAAM,oBAAoB;AAC1B,MAAM,sBACJ;;;;;AAMF,MAAM,6BAA6B;;;;;;;;;;;AAgBnC,eAAsB,eACpB,SAAiB,oBAQhB;CAKD,MAAM,MAAM,GAAG,SAJI,qBACjB,mBACA,oBACD;AAKD,QAAO;EAAE;EAAK,WAHI,MAAM,OAAO,IAAI;EAGV,eAFH,GAAG,IAAI,UAAU,GAAG,OAAO,SAAS,2BAA2B,CAAC;EAE9C;;;;;;;;AAS1C,eAAsB,WAAW,QAAiC;AAChE,QAAO,OAAO,OAAO;;;;;;;;;;;;AAiBvB,SAAgB,kBAAkB,QAAkC;AAClE,QAAO;EACL;EACA,IAAI,UAAkB,QAAyB;AAC7C,UAAO,OAAO,MACX,WACE,MAAM,aAAa,YAAY,MAAM,aAAa,SAClD,MAAM,QAAQ,SAAS,OAAO,IAAI,MAAM,QAAQ,SAAS,IAAI,EACjE;;EAEJ;;;;;;;;;;;AAgBH,SAAgB,kBACd,WACA,OAIA;CACA,MAAM,MAAM,KAAK,KAAK;AAEtB,KAAI,CAAC,MAEH,QAAO;EACL,SAAS;EACT,UAAU;GACR,cAAc,UAAU,cAAc;GACtC,iBAAiB;GAClB;EACF;CAGH,MAAM,UAAU,MAAM,MAAM;CAC5B,MAAM,aAAa,UAAU,cAAc,UAAU;CACrD,MAAM,WAAW,KAAK,IACpB,UAAU,aACV,MAAM,eAAe,UAAU,WAChC;AAED,KAAI,WAAW,EACb,QAAO;EACL,SAAS;EACT,UAAU;GACR,cAAc;GACd,iBAAiB;GAClB;EACF;AAGH,QAAO;EACL,SAAS;EACT,UAAU;GACR,cAAc,WAAW;GACzB,iBAAiB;GAClB;EACF"}

package/dist/component/server/limits.js

@@ -1,52 +0,0 @@
-import { authDb } from "./db.js";
-import { Fx } from "@robelest/fx";
-
-//#region src/server/limits.ts
-const DEFAULT_MAX_SIGN_IN_ATTEMPTS_PER_HOUR = 10;
-/**
-* Check whether the given identifier is currently rate-limited.
-*/
-/** @internal */
-const isSignInRateLimited = (ctx, identifier, config) => getRateLimitState(ctx, identifier, config).pipe(Fx.map((state) => state !== null && state.attemptsLeft < 1));
-/**
-* Record a failed sign-in attempt for the given identifier.
-*
-* If a record exists, decrement; otherwise create.
-*/
-/** @internal */
-const recordFailedSignIn = (ctx, identifier, config) => Fx.gen(function* () {
-	const state = yield* getRateLimitState(ctx, identifier, config);
-	if (state !== null) yield* Fx.promise(() => authDb(ctx, config).rateLimits.patch(state.limit._id, {
-		attemptsLeft: state.attemptsLeft - 1,
-		lastAttemptTime: Date.now()
-	}));
-	else yield* Fx.promise(() => authDb(ctx, config).rateLimits.create({
-		identifier,
-		attemptsLeft: (config.signIn?.maxFailedAttemptsPerHour ?? DEFAULT_MAX_SIGN_IN_ATTEMPTS_PER_HOUR) - 1,
-		lastAttemptTime: Date.now()
-	}));
-});
-/**
-* Reset the rate limit for the given identifier (e.g. after successful sign-in).
-*/
-/** @internal */
-const resetSignInRateLimit = (ctx, identifier, config) => Fx.gen(function* () {
-	const state = yield* getRateLimitState(ctx, identifier, config);
-	if (state !== null) yield* Fx.promise(() => authDb(ctx, config).rateLimits.delete(state.limit._id));
-});
-const getRateLimitState = (ctx, identifier, config) => Fx.gen(function* () {
-	const now = Date.now();
-	const maxAttemptsPerHour = config.signIn?.maxFailedAttemptsPerHour ?? DEFAULT_MAX_SIGN_IN_ATTEMPTS_PER_HOUR;
-	const limit = yield* Fx.promise(() => authDb(ctx, config).rateLimits.get(identifier));
-	if (limit === null) return null;
-	const elapsed = now - limit.lastAttemptTime;
-	const maxAttemptsPerMs = maxAttemptsPerHour / (3600 * 1e3);
-	return {
-		limit,
-		attemptsLeft: Math.min(maxAttemptsPerHour, limit.attemptsLeft + elapsed * maxAttemptsPerMs)
-	};
-});
-
-//#endregion
-export { isSignInRateLimited, recordFailedSignIn, resetSignInRateLimit };
-//# sourceMappingURL=limits.js.map

package/dist/component/server/limits.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"limits.js","names":[],"sources":["../../../src/server/limits.ts"],"sourcesContent":["import { Fx } from \"@robelest/fx\";\nimport { ConvexError } from \"convex/values\";\n\nimport { authDb } from \"./db\";\nimport { Doc, MutationCtx } from \"./types\";\nimport { ConvexAuthConfig } from \"./types\";\n\nconst DEFAULT_MAX_SIGN_IN_ATTEMPTS_PER_HOUR = 10;\n\n/**\n * Check whether the given identifier is currently rate-limited.\n */\n/** @internal */\nexport const isSignInRateLimited = (\n  ctx: MutationCtx,\n  identifier: string,\n  config: ConvexAuthConfig,\n): Fx<boolean, ConvexError<any>> =>\n  getRateLimitState(ctx, identifier, config).pipe(\n    Fx.map((state) => state !== null && state.attemptsLeft < 1),\n  );\n\n/**\n * Record a failed sign-in attempt for the given identifier.\n *\n * If a record exists, decrement; otherwise create.\n */\n/** @internal */\nexport const recordFailedSignIn = (\n  ctx: MutationCtx,\n  identifier: string,\n  config: ConvexAuthConfig,\n): Fx<void, ConvexError<any>> =>\n  Fx.gen(function* () {\n    const state = yield* getRateLimitState(ctx, identifier, config);\n    if (state !== null) {\n      yield* Fx.promise(() =>\n        authDb(ctx, config).rateLimits.patch(state.limit._id, {\n          attemptsLeft: state.attemptsLeft - 1,\n          lastAttemptTime: Date.now(),\n        }),\n      );\n    } else {\n      yield* Fx.promise(() =>\n        authDb(ctx, config).rateLimits.create({\n          identifier,\n          attemptsLeft:\n            (config.signIn?.maxFailedAttemptsPerHour ??\n              DEFAULT_MAX_SIGN_IN_ATTEMPTS_PER_HOUR) - 1,\n          lastAttemptTime: Date.now(),\n        }),\n      );\n    }\n  });\n\n/**\n * Reset the rate limit for the given identifier (e.g. after successful sign-in).\n */\n/** @internal */\nexport const resetSignInRateLimit = (\n  ctx: MutationCtx,\n  identifier: string,\n  config: ConvexAuthConfig,\n): Fx<void, ConvexError<any>> =>\n  Fx.gen(function* () {\n    const state = yield* getRateLimitState(ctx, identifier, config);\n    if (state !== null) {\n      yield* Fx.promise(() =>\n        authDb(ctx, config).rateLimits.delete(state.limit._id),\n      );\n    }\n  });\n\n// ---------------------------------------------------------------------------\n// Internal\n// ---------------------------------------------------------------------------\n\ntype RateLimitState = {\n  limit: Doc<\"RateLimit\"> & { attemptsLeft: number; lastAttemptTime: number };\n  attemptsLeft: number;\n} | null;\n\nconst getRateLimitState = (\n  ctx: MutationCtx,\n  identifier: string,\n  config: ConvexAuthConfig,\n): Fx<RateLimitState, ConvexError<any>> =>\n  Fx.gen(function* () {\n    const now = Date.now();\n    const maxAttemptsPerHour =\n      config.signIn?.maxFailedAttemptsPerHour ??\n      DEFAULT_MAX_SIGN_IN_ATTEMPTS_PER_HOUR;\n\n    const limit = (yield* Fx.promise(() =>\n      authDb(ctx, config).rateLimits.get(identifier),\n    )) as\n      | (Doc<\"RateLimit\"> & { attemptsLeft: number; lastAttemptTime: number })\n      | null;\n    if (limit === null) return null;\n    const elapsed = now - limit.lastAttemptTime;\n    const maxAttemptsPerMs = maxAttemptsPerHour / (60 * 60 * 1000);\n    const attemptsLeft = Math.min(\n      maxAttemptsPerHour,\n      limit.attemptsLeft + elapsed * maxAttemptsPerMs,\n    );\n    return { limit, attemptsLeft };\n  });\n"],"mappings":";;;;AAOA,MAAM,wCAAwC;;;;;AAM9C,MAAa,uBACX,KACA,YACA,WAEA,kBAAkB,KAAK,YAAY,OAAO,CAAC,KACzC,GAAG,KAAK,UAAU,UAAU,QAAQ,MAAM,eAAe,EAAE,CAC5D;;;;;;;AAQH,MAAa,sBACX,KACA,YACA,WAEA,GAAG,IAAI,aAAa;CAClB,MAAM,QAAQ,OAAO,kBAAkB,KAAK,YAAY,OAAO;AAC/D,KAAI,UAAU,KACZ,QAAO,GAAG,cACR,OAAO,KAAK,OAAO,CAAC,WAAW,MAAM,MAAM,MAAM,KAAK;EACpD,cAAc,MAAM,eAAe;EACnC,iBAAiB,KAAK,KAAK;EAC5B,CAAC,CACH;KAED,QAAO,GAAG,cACR,OAAO,KAAK,OAAO,CAAC,WAAW,OAAO;EACpC;EACA,eACG,OAAO,QAAQ,4BACd,yCAAyC;EAC7C,iBAAiB,KAAK,KAAK;EAC5B,CAAC,CACH;EAEH;;;;;AAMJ,MAAa,wBACX,KACA,YACA,WAEA,GAAG,IAAI,aAAa;CAClB,MAAM,QAAQ,OAAO,kBAAkB,KAAK,YAAY,OAAO;AAC/D,KAAI,UAAU,KACZ,QAAO,GAAG,cACR,OAAO,KAAK,OAAO,CAAC,WAAW,OAAO,MAAM,MAAM,IAAI,CACvD;EAEH;AAWJ,MAAM,qBACJ,KACA,YACA,WAEA,GAAG,IAAI,aAAa;CAClB,MAAM,MAAM,KAAK,KAAK;CACtB,MAAM,qBACJ,OAAO,QAAQ,4BACf;CAEF,MAAM,QAAS,OAAO,GAAG,cACvB,OAAO,KAAK,OAAO,CAAC,WAAW,IAAI,WAAW,CAC/C;AAGD,KAAI,UAAU,KAAM,QAAO;CAC3B,MAAM,UAAU,MAAM,MAAM;CAC5B,MAAM,mBAAmB,sBAAsB,OAAU;AAKzD,QAAO;EAAE;EAAO,cAJK,KAAK,IACxB,oBACA,MAAM,eAAe,UAAU,iBAChC;EAC6B;EAC9B"}

package/dist/component/server/mutations/account.js

@@ -1,46 +0,0 @@
-import { LOG_LEVELS, logWithLevel, maybeRedact } from "../utils.js";
-import { hash } from "../crypto.js";
-import { authDb } from "../db.js";
-import { AUTH_STORE_REF } from "./store/refs.js";
-import { Cv } from "@robelest/fx/convex";
-import { Fx } from "@robelest/fx";
-import { v } from "convex/values";
-
-//#region src/server/mutations/account.ts
-const modifyAccountArgs = v.object({
-	provider: v.string(),
-	account: v.object({
-		id: v.string(),
-		secret: v.string()
-	})
-});
-function modifyAccountImpl(ctx, args, getProviderOrThrow, config) {
-	const { provider, account } = args;
-	const db = authDb(ctx, config);
-	logWithLevel(LOG_LEVELS.DEBUG, "modifyAccountImpl args:", {
-		provider,
-		account: {
-			id: account.id,
-			secret: maybeRedact(account.secret ?? "")
-		}
-	});
-	return Fx.gen(function* () {
-		const existingAccount = yield* Fx.promise(() => db.accounts.get(provider, account.id));
-		if (existingAccount === null) return yield* Cv.fail({
-			code: "ACCOUNT_NOT_FOUND",
-			message: `Cannot modify account with ID ${account.id} because it does not exist`
-		});
-		const hashedSecret = yield* hash(getProviderOrThrow(provider), account.secret);
-		yield* Fx.promise(() => db.accounts.patch(existingAccount._id, { secret: hashedSecret }));
-	});
-}
-const callModifyAccount = async (ctx, args) => {
-	return ctx.runMutation(AUTH_STORE_REF, { args: {
-		type: "modifyAccount",
-		...args
-	} });
-};
-
-//#endregion
-export { callModifyAccount, modifyAccountArgs, modifyAccountImpl };
-//# sourceMappingURL=account.js.map

package/dist/component/server/mutations/account.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"account.js","names":[],"sources":["../../../../src/server/mutations/account.ts"],"sourcesContent":["import { Fx } from \"@robelest/fx\";\nimport { Cv } from \"@robelest/fx/convex\";\nimport type { GenericActionCtx, GenericDataModel } from \"convex/server\";\nimport { ConvexError, Infer, v } from \"convex/values\";\n\nimport { GetProviderOrThrowFunc, hash } from \"../crypto\";\nimport * as Provider from \"../crypto\";\nimport { authDb } from \"../db\";\nimport { MutationCtx } from \"../types\";\nimport { LOG_LEVELS, logWithLevel, maybeRedact } from \"../utils\";\nimport { AUTH_STORE_REF } from \"./store/refs\";\n\nexport const modifyAccountArgs = v.object({\n  provider: v.string(),\n  account: v.object({ id: v.string(), secret: v.string() }),\n});\n\nexport function modifyAccountImpl(\n  ctx: MutationCtx,\n  args: Infer<typeof modifyAccountArgs>,\n  getProviderOrThrow: GetProviderOrThrowFunc,\n  config: Provider.Config,\n): Fx<void, ConvexError<any>> {\n  const { provider, account } = args;\n  const db = authDb(ctx, config);\n\n  logWithLevel(LOG_LEVELS.DEBUG, \"modifyAccountImpl args:\", {\n    provider,\n    account: { id: account.id, secret: maybeRedact(account.secret ?? \"\") },\n  });\n\n  return Fx.gen(function* () {\n    const existingAccount = yield* Fx.promise(() =>\n      db.accounts.get(provider, account.id),\n    );\n    if (existingAccount === null) {\n      return yield* Cv.fail({\n        code: \"ACCOUNT_NOT_FOUND\",\n        message: `Cannot modify account with ID ${account.id} because it does not exist`,\n      });\n    }\n    const hashedSecret = yield* hash(\n      getProviderOrThrow(provider),\n      account.secret,\n    );\n    yield* Fx.promise(() =>\n      db.accounts.patch(existingAccount._id, { secret: hashedSecret }),\n    );\n  });\n}\n\nexport const callModifyAccount = async <DataModel extends GenericDataModel>(\n  ctx: GenericActionCtx<DataModel>,\n  args: Infer<typeof modifyAccountArgs>,\n): Promise<void> => {\n  return ctx.runMutation(AUTH_STORE_REF, {\n    args: {\n      type: \"modifyAccount\",\n      ...args,\n    },\n  });\n};\n"],"mappings":";;;;;;;;;AAYA,MAAa,oBAAoB,EAAE,OAAO;CACxC,UAAU,EAAE,QAAQ;CACpB,SAAS,EAAE,OAAO;EAAE,IAAI,EAAE,QAAQ;EAAE,QAAQ,EAAE,QAAQ;EAAE,CAAC;CAC1D,CAAC;AAEF,SAAgB,kBACd,KACA,MACA,oBACA,QAC4B;CAC5B,MAAM,EAAE,UAAU,YAAY;CAC9B,MAAM,KAAK,OAAO,KAAK,OAAO;AAE9B,cAAa,WAAW,OAAO,2BAA2B;EACxD;EACA,SAAS;GAAE,IAAI,QAAQ;GAAI,QAAQ,YAAY,QAAQ,UAAU,GAAG;GAAE;EACvE,CAAC;AAEF,QAAO,GAAG,IAAI,aAAa;EACzB,MAAM,kBAAkB,OAAO,GAAG,cAChC,GAAG,SAAS,IAAI,UAAU,QAAQ,GAAG,CACtC;AACD,MAAI,oBAAoB,KACtB,QAAO,OAAO,GAAG,KAAK;GACpB,MAAM;GACN,SAAS,iCAAiC,QAAQ,GAAG;GACtD,CAAC;EAEJ,MAAM,eAAe,OAAO,KAC1B,mBAAmB,SAAS,EAC5B,QAAQ,OACT;AACD,SAAO,GAAG,cACR,GAAG,SAAS,MAAM,gBAAgB,KAAK,EAAE,QAAQ,cAAc,CAAC,CACjE;GACD;;AAGJ,MAAa,oBAAoB,OAC/B,KACA,SACkB;AAClB,QAAO,IAAI,YAAY,gBAAgB,EACrC,MAAM;EACJ,MAAM;EACN,GAAG;EACJ,EACF,CAAC"}

package/dist/component/server/mutations/code.js

@@ -1,68 +0,0 @@
-import { LOG_LEVELS, logWithLevel, sha256 } from "../utils.js";
-import { authDb } from "../db.js";
-import { AUTH_STORE_REF } from "./store/refs.js";
-import { getAuthSessionId } from "../sessions.js";
-import { upsertUserAndAccount } from "../users.js";
-import { Cv } from "@robelest/fx/convex";
-import { v } from "convex/values";
-
-//#region src/server/mutations/code.ts
-const createVerificationCodeArgs = v.object({
-	accountId: v.optional(v.string()),
-	provider: v.string(),
-	email: v.optional(v.string()),
-	phone: v.optional(v.string()),
-	code: v.string(),
-	expirationTime: v.number(),
-	allowExtraProviders: v.boolean()
-});
-async function createVerificationCodeImpl(ctx, args, getProviderOrThrow, config) {
-	logWithLevel(LOG_LEVELS.DEBUG, "createVerificationCodeImpl args:", args);
-	const { email, phone, code, expirationTime, provider: providerId, accountId: existingAccountId, allowExtraProviders } = args;
-	const db = authDb(ctx, config);
-	const typedExistingAccountId = existingAccountId;
-	const existingAccount = typedExistingAccountId !== void 0 ? await db.accounts.getById(typedExistingAccountId) ?? (() => {
-		throw Cv.error({
-			code: "ACCOUNT_NOT_FOUND",
-			message: `Expected an account to exist for ID "${typedExistingAccountId}"`
-		});
-	})() : await db.accounts.get(providerId, email ?? phone);
-	const provider = getProviderOrThrow(providerId, allowExtraProviders);
-	const { accountId } = await upsertUserAndAccount(ctx, await getAuthSessionId(ctx), existingAccount !== null ? { existingAccount } : { providerAccountId: email ?? phone }, provider.type === "email" ? {
-		type: "email",
-		provider,
-		profile: { email }
-	} : {
-		type: "phone",
-		provider,
-		profile: { phone }
-	}, config);
-	await generateUniqueVerificationCode(ctx, accountId, providerId, code, expirationTime, {
-		email,
-		phone
-	}, config);
-	return email ?? phone;
-}
-const callCreateVerificationCode = async (ctx, args) => {
-	return ctx.runMutation(AUTH_STORE_REF, { args: {
-		type: "createVerificationCode",
-		...args
-	} });
-};
-async function generateUniqueVerificationCode(ctx, accountId, provider, code, expirationTime, { email, phone }, config) {
-	const db = authDb(ctx, config);
-	const existingCode = await db.verificationCodes.getByAccountId(accountId);
-	if (existingCode !== null) await db.verificationCodes.delete(existingCode._id);
-	await db.verificationCodes.create({
-		accountId,
-		provider,
-		code: await sha256(code),
-		expirationTime,
-		emailVerified: email,
-		phoneVerified: phone
-	});
-}
-
-//#endregion
-export { callCreateVerificationCode, createVerificationCodeArgs, createVerificationCodeImpl };
-//# sourceMappingURL=code.js.map

package/dist/component/server/mutations/code.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"code.js","names":[],"sources":["../../../../src/server/mutations/code.ts"],"sourcesContent":["import { Cv } from \"@robelest/fx/convex\";\nimport type { GenericActionCtx, GenericDataModel } from \"convex/server\";\nimport { GenericId, Infer, v } from \"convex/values\";\n\nimport * as Provider from \"../crypto\";\nimport { authDb } from \"../db\";\nimport { getAuthSessionId } from \"../sessions\";\nimport { MutationCtx } from \"../types\";\nimport { EmailConfig, PhoneConfig } from \"../types\";\nimport { upsertUserAndAccount } from \"../users\";\nimport { LOG_LEVELS, logWithLevel, sha256 } from \"../utils\";\nimport { AUTH_STORE_REF } from \"./store/refs\";\n\nexport const createVerificationCodeArgs = v.object({\n  accountId: v.optional(v.string()),\n  provider: v.string(),\n  email: v.optional(v.string()),\n  phone: v.optional(v.string()),\n  code: v.string(),\n  expirationTime: v.number(),\n  allowExtraProviders: v.boolean(),\n});\n\ntype ReturnType = string;\n\nexport async function createVerificationCodeImpl(\n  ctx: MutationCtx,\n  args: Infer<typeof createVerificationCodeArgs>,\n  getProviderOrThrow: Provider.GetProviderOrThrowFunc,\n  config: Provider.Config,\n): Promise<ReturnType> {\n  logWithLevel(LOG_LEVELS.DEBUG, \"createVerificationCodeImpl args:\", args);\n  const {\n    email,\n    phone,\n    code,\n    expirationTime,\n    provider: providerId,\n    accountId: existingAccountId,\n    allowExtraProviders,\n  } = args;\n  const db = authDb(ctx, config);\n  const typedExistingAccountId = existingAccountId as\n    | GenericId<\"Account\">\n    | undefined;\n  const existingAccount =\n    typedExistingAccountId !== undefined\n      ? ((await db.accounts.getById(typedExistingAccountId)) ??\n        (() => {\n          throw Cv.error({\n            code: \"ACCOUNT_NOT_FOUND\",\n            message: `Expected an account to exist for ID \"${typedExistingAccountId}\"`,\n          });\n        })())\n      : await db.accounts.get(providerId, email ?? phone!);\n\n  const provider = getProviderOrThrow(providerId, allowExtraProviders) as\n    | EmailConfig\n    | PhoneConfig;\n  const { accountId } = await upsertUserAndAccount(\n    ctx,\n    await getAuthSessionId(ctx),\n    existingAccount !== null\n      ? { existingAccount }\n      : { providerAccountId: email ?? phone! },\n    provider.type === \"email\"\n      ? { type: \"email\", provider, profile: { email: email! } }\n      : { type: \"phone\", provider, profile: { phone: phone! } },\n    config,\n  );\n  await generateUniqueVerificationCode(\n    ctx,\n    accountId,\n    providerId,\n    code,\n    expirationTime,\n    { email, phone },\n    config,\n  );\n  return email ?? phone!;\n}\n\nexport const callCreateVerificationCode = async <\n  DataModel extends GenericDataModel,\n>(\n  ctx: GenericActionCtx<DataModel>,\n  args: Infer<typeof createVerificationCodeArgs>,\n): Promise<ReturnType> => {\n  return ctx.runMutation(AUTH_STORE_REF, {\n    args: {\n      type: \"createVerificationCode\",\n      ...args,\n    },\n  });\n};\n\nasync function generateUniqueVerificationCode(\n  ctx: MutationCtx,\n  accountId: GenericId<\"Account\">,\n  provider: string,\n  code: string,\n  expirationTime: number,\n  { email, phone }: { email?: string; phone?: string },\n  config: Provider.Config,\n) {\n  const db = authDb(ctx, config);\n  const existingCode = await db.verificationCodes.getByAccountId(accountId);\n  if (existingCode !== null) {\n    await db.verificationCodes.delete(existingCode._id);\n  }\n  await db.verificationCodes.create({\n    accountId,\n    provider,\n    code: await sha256(code),\n    expirationTime,\n    emailVerified: email,\n    phoneVerified: phone,\n  });\n}\n"],"mappings":";;;;;;;;;AAaA,MAAa,6BAA6B,EAAE,OAAO;CACjD,WAAW,EAAE,SAAS,EAAE,QAAQ,CAAC;CACjC,UAAU,EAAE,QAAQ;CACpB,OAAO,EAAE,SAAS,EAAE,QAAQ,CAAC;CAC7B,OAAO,EAAE,SAAS,EAAE,QAAQ,CAAC;CAC7B,MAAM,EAAE,QAAQ;CAChB,gBAAgB,EAAE,QAAQ;CAC1B,qBAAqB,EAAE,SAAS;CACjC,CAAC;AAIF,eAAsB,2BACpB,KACA,MACA,oBACA,QACqB;AACrB,cAAa,WAAW,OAAO,oCAAoC,KAAK;CACxE,MAAM,EACJ,OACA,OACA,MACA,gBACA,UAAU,YACV,WAAW,mBACX,wBACE;CACJ,MAAM,KAAK,OAAO,KAAK,OAAO;CAC9B,MAAM,yBAAyB;CAG/B,MAAM,kBACJ,2BAA2B,SACrB,MAAM,GAAG,SAAS,QAAQ,uBAAuB,WAC5C;AACL,QAAM,GAAG,MAAM;GACb,MAAM;GACN,SAAS,wCAAwC,uBAAuB;GACzE,CAAC;KACA,GACJ,MAAM,GAAG,SAAS,IAAI,YAAY,SAAS,MAAO;CAExD,MAAM,WAAW,mBAAmB,YAAY,oBAAoB;CAGpE,MAAM,EAAE,cAAc,MAAM,qBAC1B,KACA,MAAM,iBAAiB,IAAI,EAC3B,oBAAoB,OAChB,EAAE,iBAAiB,GACnB,EAAE,mBAAmB,SAAS,OAAQ,EAC1C,SAAS,SAAS,UACd;EAAE,MAAM;EAAS;EAAU,SAAS,EAAS,OAAQ;EAAE,GACvD;EAAE,MAAM;EAAS;EAAU,SAAS,EAAS,OAAQ;EAAE,EAC3D,OACD;AACD,OAAM,+BACJ,KACA,WACA,YACA,MACA,gBACA;EAAE;EAAO;EAAO,EAChB,OACD;AACD,QAAO,SAAS;;AAGlB,MAAa,6BAA6B,OAGxC,KACA,SACwB;AACxB,QAAO,IAAI,YAAY,gBAAgB,EACrC,MAAM;EACJ,MAAM;EACN,GAAG;EACJ,EACF,CAAC;;AAGJ,eAAe,+BACb,KACA,WACA,UACA,MACA,gBACA,EAAE,OAAO,SACT,QACA;CACA,MAAM,KAAK,OAAO,KAAK,OAAO;CAC9B,MAAM,eAAe,MAAM,GAAG,kBAAkB,eAAe,UAAU;AACzE,KAAI,iBAAiB,KACnB,OAAM,GAAG,kBAAkB,OAAO,aAAa,IAAI;AAErD,OAAM,GAAG,kBAAkB,OAAO;EAChC;EACA;EACA,MAAM,MAAM,OAAO,KAAK;EACxB;EACA,eAAe;EACf,eAAe;EAChB,CAAC"}

package/dist/component/server/mutations/invalidate.js

@@ -1,32 +0,0 @@
-import { LOG_LEVELS, logWithLevel } from "../utils.js";
-import { authDb } from "../db.js";
-import { AUTH_STORE_REF } from "./store/refs.js";
-import { deleteSession } from "../sessions.js";
-import { Fx } from "@robelest/fx";
-import { v } from "convex/values";
-
-//#region src/server/mutations/invalidate.ts
-const invalidateSessionsArgs = v.object({
-	userId: v.string(),
-	except: v.optional(v.array(v.string()))
-});
-const callInvalidateSessions = async (ctx, args) => {
-	return ctx.runMutation(AUTH_STORE_REF, { args: {
-		type: "invalidateSessions",
-		...args
-	} });
-};
-function invalidateSessionsImpl(ctx, args, config) {
-	return Fx.gen(function* () {
-		logWithLevel(LOG_LEVELS.DEBUG, "invalidateSessionsImpl args:", args);
-		const { userId, except } = args;
-		const exceptSet = new Set(except ?? []);
-		const typedUserId = userId;
-		const sessions = yield* Fx.promise(() => authDb(ctx, config).sessions.listByUser(typedUserId));
-		yield* Fx.each(sessions, (session) => exceptSet.has(session._id) ? Fx.unit : Fx.promise(() => deleteSession(ctx, session, config)));
-	});
-}
-
-//#endregion
-export { callInvalidateSessions, invalidateSessionsArgs, invalidateSessionsImpl };
-//# sourceMappingURL=invalidate.js.map

package/dist/component/server/mutations/invalidate.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"invalidate.js","names":[],"sources":["../../../../src/server/mutations/invalidate.ts"],"sourcesContent":["import { Fx } from \"@robelest/fx\";\nimport type { GenericActionCtx, GenericDataModel } from \"convex/server\";\nimport { GenericId, Infer, v } from \"convex/values\";\n\nimport * as Provider from \"../crypto\";\nimport { authDb } from \"../db\";\nimport { deleteSession } from \"../sessions\";\nimport { Doc, MutationCtx } from \"../types\";\nimport { LOG_LEVELS, logWithLevel } from \"../utils\";\nimport { AUTH_STORE_REF } from \"./store/refs\";\n\nexport const invalidateSessionsArgs = v.object({\n  userId: v.string(),\n  except: v.optional(v.array(v.string())),\n});\n\nexport const callInvalidateSessions = async <\n  DataModel extends GenericDataModel,\n>(\n  ctx: GenericActionCtx<DataModel>,\n  args: Infer<typeof invalidateSessionsArgs>,\n): Promise<void> => {\n  return ctx.runMutation(AUTH_STORE_REF, {\n    args: {\n      type: \"invalidateSessions\",\n      ...args,\n    },\n  });\n};\n\nexport function invalidateSessionsImpl(\n  ctx: MutationCtx,\n  args: Infer<typeof invalidateSessionsArgs>,\n  config: Provider.Config,\n): Fx<void, never> {\n  return Fx.gen(function* () {\n    logWithLevel(LOG_LEVELS.DEBUG, \"invalidateSessionsImpl args:\", args);\n    const { userId, except } = args;\n    const exceptSet = new Set(except ?? []);\n    const typedUserId = userId as GenericId<\"User\">;\n    const sessions = (yield* Fx.promise(() =>\n      authDb(ctx, config).sessions.listByUser(typedUserId),\n    )) as Doc<\"Session\">[];\n    yield* Fx.each(sessions, (session: Doc<\"Session\">) =>\n      exceptSet.has(session._id)\n        ? Fx.unit\n        : Fx.promise(() => deleteSession(ctx, session, config)),\n    );\n  });\n}\n"],"mappings":";;;;;;;;AAWA,MAAa,yBAAyB,EAAE,OAAO;CAC7C,QAAQ,EAAE,QAAQ;CAClB,QAAQ,EAAE,SAAS,EAAE,MAAM,EAAE,QAAQ,CAAC,CAAC;CACxC,CAAC;AAEF,MAAa,yBAAyB,OAGpC,KACA,SACkB;AAClB,QAAO,IAAI,YAAY,gBAAgB,EACrC,MAAM;EACJ,MAAM;EACN,GAAG;EACJ,EACF,CAAC;;AAGJ,SAAgB,uBACd,KACA,MACA,QACiB;AACjB,QAAO,GAAG,IAAI,aAAa;AACzB,eAAa,WAAW,OAAO,gCAAgC,KAAK;EACpE,MAAM,EAAE,QAAQ,WAAW;EAC3B,MAAM,YAAY,IAAI,IAAI,UAAU,EAAE,CAAC;EACvC,MAAM,cAAc;EACpB,MAAM,WAAY,OAAO,GAAG,cAC1B,OAAO,KAAK,OAAO,CAAC,SAAS,WAAW,YAAY,CACrD;AACD,SAAO,GAAG,KAAK,WAAW,YACxB,UAAU,IAAI,QAAQ,IAAI,GACtB,GAAG,OACH,GAAG,cAAc,cAAc,KAAK,SAAS,OAAO,CAAC,CAC1D;GACD"}

package/dist/component/server/mutations/oauth.js

@@ -1,116 +0,0 @@
-import { generateRandomString, logWithLevel, sha256 } from "../utils.js";
-import { authDb } from "../db.js";
-import { AUTH_STORE_REF } from "./store/refs.js";
-import { upsertUserAndAccount } from "../users.js";
-import { ENTERPRISE_OIDC_PROVIDER_PREFIX, ENTERPRISE_SAML_PROVIDER_PREFIX, isEnterpriseProviderId } from "../enterprise/shared.js";
-import { createSyntheticOAuthMaterializedConfig } from "../enterprise/oidc.js";
-import { normalizeEnterprisePolicy } from "../enterprise/policy.js";
-import { Cv } from "@robelest/fx/convex";
-import { Fx } from "@robelest/fx";
-import { v } from "convex/values";
-
-//#region src/server/mutations/oauth.ts
-const OAUTH_SIGN_IN_EXPIRATION_MS = 1e3 * 60 * 2;
-const userOAuthArgs = v.object({
-	provider: v.string(),
-	providerAccountId: v.string(),
-	profile: v.any(),
-	signature: v.string(),
-	accountExtend: v.optional(v.any())
-});
-function normalizeAccountExtend(provider, providerAccountId, accountExtend) {
-	const baseIdentity = {
-		type: "oauth",
-		provider,
-		providerAccountId
-	};
-	if (provider.startsWith(ENTERPRISE_OIDC_PROVIDER_PREFIX)) {
-		baseIdentity.type = "enterprise-oidc";
-		baseIdentity.enterpriseId = provider.slice(ENTERPRISE_OIDC_PROVIDER_PREFIX.length);
-	}
-	if (provider.startsWith(ENTERPRISE_SAML_PROVIDER_PREFIX)) {
-		baseIdentity.type = "enterprise-saml";
-		baseIdentity.enterpriseId = provider.slice(ENTERPRISE_SAML_PROVIDER_PREFIX.length);
-	}
-	const provided = typeof accountExtend === "object" && accountExtend !== null && !Array.isArray(accountExtend) ? accountExtend : void 0;
-	const providedIdentity = provided && typeof provided.identity === "object" && provided.identity !== null && !Array.isArray(provided.identity) ? provided.identity : void 0;
-	return {
-		...provided,
-		identity: {
-			...baseIdentity,
-			...providedIdentity
-		}
-	};
-}
-function userOAuthImpl(ctx, args, getProviderOrThrow, config) {
-	return Fx.gen(function* () {
-		logWithLevel("DEBUG", "userOAuthImpl args:", args);
-		const { profile, provider, providerAccountId, signature, accountExtend } = args;
-		const db = authDb(ctx, config);
-		const existingAccount = yield* Fx.promise(() => db.accounts.get(provider, providerAccountId));
-		const enterpriseId = provider.startsWith(ENTERPRISE_OIDC_PROVIDER_PREFIX) ? provider.slice(ENTERPRISE_OIDC_PROVIDER_PREFIX.length) : provider.startsWith(ENTERPRISE_SAML_PROVIDER_PREFIX) ? provider.slice(ENTERPRISE_SAML_PROVIDER_PREFIX.length) : null;
-		const enterprise = enterpriseId !== null ? yield* Fx.promise(() => ctx.runQuery(config.component.public.enterpriseGet, { enterpriseId })) : null;
-		const enterprisePolicy = enterprise ? normalizeEnterprisePolicy(enterprise.policy) : null;
-		const enterpriseProtocol = provider.startsWith(ENTERPRISE_OIDC_PROVIDER_PREFIX) ? "oidc" : provider.startsWith(ENTERPRISE_SAML_PROVIDER_PREFIX) ? "saml" : null;
-		const existingScimIdentity = enterpriseId !== null && existingAccount === null && enterprisePolicy?.provisioning.scimReuse.user === "externalId" ? yield* Fx.promise(() => ctx.runQuery(config.component.public.enterpriseScimIdentityGet, {
-			enterpriseId,
-			resourceType: "user",
-			externalId: providerAccountId
-		})) : null;
-		const verifier = yield* Fx.from({
-			ok: () => db.verifiers.getBySignature(signature),
-			err: () => Cv.error({
-				code: "OAUTH_INVALID_STATE",
-				message: "Invalid OAuth state. Please try signing in again."
-			})
-		}).pipe(Fx.chain((doc) => doc === null ? Cv.fail({
-			code: "OAUTH_INVALID_STATE",
-			message: "Invalid OAuth state. Please try signing in again."
-		}) : Fx.succeed(doc)));
-		const { accountId } = yield* Fx.promise(() => upsertUserAndAccount(ctx, verifier.sessionId ?? null, existingAccount !== null ? { existingAccount } : { providerAccountId }, {
-			type: "oauth",
-			provider: isEnterpriseProviderId(provider) ? createSyntheticOAuthMaterializedConfig(provider, { accountLinking: enterpriseProtocol === "oidc" ? enterprisePolicy?.identity.accountLinking.oidc : enterpriseProtocol === "saml" ? enterprisePolicy?.identity.accountLinking.saml : void 0 }) : getProviderOrThrow(provider),
-			profile,
-			accountExtend: normalizeAccountExtend(provider, providerAccountId, accountExtend)
-		}, config, existingScimIdentity?.userId ? { existingUserId: existingScimIdentity.userId } : void 0));
-		if (enterpriseId !== null && enterprisePolicy?.provisioning.jit.mode === "createUserAndMembership") {
-			const userId = (yield* Fx.promise(() => db.accounts.getById(accountId)))?.userId;
-			if (userId) {
-				const groupId = enterprise?.groupId;
-				if (groupId) {
-					if ((yield* Fx.promise(() => ctx.runQuery(config.component.public.memberGetByGroupAndUser, {
-						userId,
-						groupId
-					}))) === null) yield* Fx.promise(() => ctx.runMutation(config.component.public.memberAdd, {
-						groupId,
-						userId,
-						roleIds: enterprisePolicy.provisioning.jit.defaultRoleIds,
-						status: "active"
-					}));
-				}
-			}
-		}
-		const code = generateRandomString(8, "0123456789");
-		yield* Fx.promise(() => db.verifiers.delete(verifier._id));
-		const existingVerificationCode = yield* Fx.promise(() => db.verificationCodes.getByAccountId(accountId));
-		if (existingVerificationCode !== null) yield* Fx.promise(() => db.verificationCodes.delete(existingVerificationCode._id));
-		yield* Fx.promise(async () => db.verificationCodes.create({
-			code: await sha256(code),
-			accountId,
-			provider,
-			expirationTime: Date.now() + OAUTH_SIGN_IN_EXPIRATION_MS,
-			verifier: verifier._id
-		}));
-		return code;
-	});
-}
-const callUserOAuth = async (ctx, args) => {
-	return ctx.runMutation(AUTH_STORE_REF, { args: {
-		type: "userOAuth",
-		...args
-	} });
-};
-
-//#endregion
-export { callUserOAuth, userOAuthArgs, userOAuthImpl };
-//# sourceMappingURL=oauth.js.map

package/dist/component/server/mutations/oauth.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"oauth.js","names":[],"sources":["../../../../src/server/mutations/oauth.ts"],"sourcesContent":["import { Fx } from \"@robelest/fx\";\nimport { Cv } from \"@robelest/fx/convex\";\nimport type { GenericActionCtx, GenericDataModel } from \"convex/server\";\nimport type { ConvexError } from \"convex/values\";\nimport { Infer, v } from \"convex/values\";\n\nimport * as Provider from \"../crypto\";\nimport { authDb } from \"../db\";\nimport { createSyntheticOAuthMaterializedConfig } from \"../enterprise/oidc\";\nimport { normalizeEnterprisePolicy } from \"../enterprise/policy\";\nimport {\n  ENTERPRISE_OIDC_PROVIDER_PREFIX,\n  ENTERPRISE_SAML_PROVIDER_PREFIX,\n  isEnterpriseProviderId,\n} from \"../enterprise/shared\";\nimport { MutationCtx } from \"../types\";\nimport type { AuthProviderMaterializedConfig } from \"../types\";\nimport { upsertUserAndAccount } from \"../users\";\nimport { generateRandomString, logWithLevel, sha256 } from \"../utils\";\nimport { AUTH_STORE_REF } from \"./store/refs\";\n\nconst OAUTH_SIGN_IN_EXPIRATION_MS = 1000 * 60 * 2; // 2 minutes\n\nexport const userOAuthArgs = v.object({\n  provider: v.string(),\n  providerAccountId: v.string(),\n  profile: v.any(),\n  signature: v.string(),\n  accountExtend: v.optional(v.any()),\n});\n\nfunction normalizeAccountExtend(\n  provider: string,\n  providerAccountId: string,\n  accountExtend: unknown,\n) {\n  const baseIdentity: Record<string, unknown> = {\n    type: \"oauth\",\n    provider,\n    providerAccountId,\n  };\n  if (provider.startsWith(ENTERPRISE_OIDC_PROVIDER_PREFIX)) {\n    baseIdentity.type = \"enterprise-oidc\";\n    baseIdentity.enterpriseId = provider.slice(\n      ENTERPRISE_OIDC_PROVIDER_PREFIX.length,\n    );\n  }\n  if (provider.startsWith(ENTERPRISE_SAML_PROVIDER_PREFIX)) {\n    baseIdentity.type = \"enterprise-saml\";\n    baseIdentity.enterpriseId = provider.slice(\n      ENTERPRISE_SAML_PROVIDER_PREFIX.length,\n    );\n  }\n  const provided =\n    typeof accountExtend === \"object\" &&\n    accountExtend !== null &&\n    !Array.isArray(accountExtend)\n      ? (accountExtend as Record<string, unknown>)\n      : undefined;\n  const providedIdentity =\n    provided &&\n    typeof provided.identity === \"object\" &&\n    provided.identity !== null &&\n    !Array.isArray(provided.identity)\n      ? (provided.identity as Record<string, unknown>)\n      : undefined;\n  return {\n    ...provided,\n    identity: {\n      ...baseIdentity,\n      ...providedIdentity,\n    },\n  };\n}\n\ntype ReturnType = string;\n\nexport function userOAuthImpl(\n  ctx: MutationCtx,\n  args: Infer<typeof userOAuthArgs>,\n  getProviderOrThrow: Provider.GetProviderOrThrowFunc,\n  config: Provider.Config,\n): Fx<ReturnType, ConvexError<{ code: string; message: string }>> {\n  return Fx.gen(function* () {\n    logWithLevel(\"DEBUG\", \"userOAuthImpl args:\", args);\n    const { profile, provider, providerAccountId, signature, accountExtend } =\n      args;\n    const db = authDb(ctx, config);\n    const existingAccount = yield* Fx.promise(() =>\n      db.accounts.get(provider, providerAccountId),\n    );\n    const enterpriseId = provider.startsWith(ENTERPRISE_OIDC_PROVIDER_PREFIX)\n      ? provider.slice(ENTERPRISE_OIDC_PROVIDER_PREFIX.length)\n      : provider.startsWith(ENTERPRISE_SAML_PROVIDER_PREFIX)\n        ? provider.slice(ENTERPRISE_SAML_PROVIDER_PREFIX.length)\n        : null;\n    const enterprise =\n      enterpriseId !== null\n        ? yield* Fx.promise(() =>\n            ctx.runQuery(config.component.public.enterpriseGet, {\n              enterpriseId,\n            }),\n          )\n        : null;\n    const enterprisePolicy = enterprise\n      ? normalizeEnterprisePolicy(enterprise.policy)\n      : null;\n    const enterpriseProtocol = provider.startsWith(\n      ENTERPRISE_OIDC_PROVIDER_PREFIX,\n    )\n      ? \"oidc\"\n      : provider.startsWith(ENTERPRISE_SAML_PROVIDER_PREFIX)\n        ? \"saml\"\n        : null;\n\n    const existingScimIdentity =\n      enterpriseId !== null &&\n      existingAccount === null &&\n      enterprisePolicy?.provisioning.scimReuse.user === \"externalId\"\n        ? yield* Fx.promise(() =>\n            ctx.runQuery(config.component.public.enterpriseScimIdentityGet, {\n              enterpriseId,\n              resourceType: \"user\",\n              externalId: providerAccountId,\n            }),\n          )\n        : null;\n\n    const verifier = yield* Fx.from({\n      ok: () => db.verifiers.getBySignature(signature),\n      err: () =>\n        Cv.error({\n          code: \"OAUTH_INVALID_STATE\",\n          message: \"Invalid OAuth state. Please try signing in again.\",\n        }),\n    }).pipe(\n      Fx.chain((doc) =>\n        doc === null\n          ? Cv.fail({\n              code: \"OAUTH_INVALID_STATE\",\n              message: \"Invalid OAuth state. Please try signing in again.\",\n            })\n          : Fx.succeed(doc),\n      ),\n    );\n\n    const { accountId } = yield* Fx.promise(() =>\n      upsertUserAndAccount(\n        ctx,\n        verifier.sessionId ?? null,\n        existingAccount !== null ? { existingAccount } : { providerAccountId },\n        {\n          type: \"oauth\",\n          provider: (isEnterpriseProviderId(provider)\n            ? createSyntheticOAuthMaterializedConfig(provider, {\n                accountLinking:\n                  enterpriseProtocol === \"oidc\"\n                    ? enterprisePolicy?.identity.accountLinking.oidc\n                    : enterpriseProtocol === \"saml\"\n                      ? enterprisePolicy?.identity.accountLinking.saml\n                      : undefined,\n              })\n            : getProviderOrThrow(provider)) as AuthProviderMaterializedConfig,\n          profile,\n          accountExtend: normalizeAccountExtend(\n            provider,\n            providerAccountId,\n            accountExtend,\n          ),\n        },\n        config,\n        existingScimIdentity?.userId\n          ? { existingUserId: existingScimIdentity.userId }\n          : undefined,\n      ),\n    );\n\n    // JIT group provisioning: if this is an enterprise SSO sign-in and the\n    // enterprise connection has a groupId, auto-add the user as a member of\n    // that group if they aren't already a member.\n    if (\n      enterpriseId !== null &&\n      enterprisePolicy?.provisioning.jit.mode === \"createUserAndMembership\"\n    ) {\n      const account = yield* Fx.promise(() => db.accounts.getById(accountId));\n      const userId = account?.userId;\n      if (userId) {\n        const groupId = (enterprise as any)?.groupId as string | undefined;\n        if (groupId) {\n          const existingMembership = yield* Fx.promise(() =>\n            ctx.runQuery(config.component.public.memberGetByGroupAndUser, {\n              userId,\n              groupId,\n            }),\n          );\n          if (existingMembership === null) {\n            yield* Fx.promise(() =>\n              ctx.runMutation(config.component.public.memberAdd, {\n                groupId,\n                userId,\n                roleIds: enterprisePolicy.provisioning.jit.defaultRoleIds,\n                status: \"active\",\n              }),\n            );\n          }\n        }\n      }\n    }\n\n    const code = generateRandomString(8, \"0123456789\");\n    yield* Fx.promise(() => db.verifiers.delete(verifier._id));\n    const existingVerificationCode = yield* Fx.promise(() =>\n      db.verificationCodes.getByAccountId(accountId),\n    );\n    if (existingVerificationCode !== null) {\n      yield* Fx.promise(() =>\n        db.verificationCodes.delete(existingVerificationCode._id),\n      );\n    }\n    yield* Fx.promise(async () =>\n      db.verificationCodes.create({\n        code: await sha256(code),\n        accountId,\n        provider,\n        expirationTime: Date.now() + OAUTH_SIGN_IN_EXPIRATION_MS,\n        verifier: verifier._id,\n      }),\n    );\n    return code;\n  });\n}\n\nexport const callUserOAuth = async <DataModel extends GenericDataModel>(\n  ctx: GenericActionCtx<DataModel>,\n  args: Infer<typeof userOAuthArgs>,\n): Promise<ReturnType> => {\n  return ctx.runMutation(AUTH_STORE_REF, {\n    args: {\n      type: \"userOAuth\",\n      ...args,\n    },\n  });\n};\n"],"mappings":";;;;;;;;;;;;AAqBA,MAAM,8BAA8B,MAAO,KAAK;AAEhD,MAAa,gBAAgB,EAAE,OAAO;CACpC,UAAU,EAAE,QAAQ;CACpB,mBAAmB,EAAE,QAAQ;CAC7B,SAAS,EAAE,KAAK;CAChB,WAAW,EAAE,QAAQ;CACrB,eAAe,EAAE,SAAS,EAAE,KAAK,CAAC;CACnC,CAAC;AAEF,SAAS,uBACP,UACA,mBACA,eACA;CACA,MAAM,eAAwC;EAC5C,MAAM;EACN;EACA;EACD;AACD,KAAI,SAAS,WAAW,gCAAgC,EAAE;AACxD,eAAa,OAAO;AACpB,eAAa,eAAe,SAAS,MACnC,gCAAgC,OACjC;;AAEH,KAAI,SAAS,WAAW,gCAAgC,EAAE;AACxD,eAAa,OAAO;AACpB,eAAa,eAAe,SAAS,MACnC,gCAAgC,OACjC;;CAEH,MAAM,WACJ,OAAO,kBAAkB,YACzB,kBAAkB,QAClB,CAAC,MAAM,QAAQ,cAAc,GACxB,gBACD;CACN,MAAM,mBACJ,YACA,OAAO,SAAS,aAAa,YAC7B,SAAS,aAAa,QACtB,CAAC,MAAM,QAAQ,SAAS,SAAS,GAC5B,SAAS,WACV;AACN,QAAO;EACL,GAAG;EACH,UAAU;GACR,GAAG;GACH,GAAG;GACJ;EACF;;AAKH,SAAgB,cACd,KACA,MACA,oBACA,QACgE;AAChE,QAAO,GAAG,IAAI,aAAa;AACzB,eAAa,SAAS,uBAAuB,KAAK;EAClD,MAAM,EAAE,SAAS,UAAU,mBAAmB,WAAW,kBACvD;EACF,MAAM,KAAK,OAAO,KAAK,OAAO;EAC9B,MAAM,kBAAkB,OAAO,GAAG,cAChC,GAAG,SAAS,IAAI,UAAU,kBAAkB,CAC7C;EACD,MAAM,eAAe,SAAS,WAAW,gCAAgC,GACrE,SAAS,MAAM,gCAAgC,OAAO,GACtD,SAAS,WAAW,gCAAgC,GAClD,SAAS,MAAM,gCAAgC,OAAO,GACtD;EACN,MAAM,aACJ,iBAAiB,OACb,OAAO,GAAG,cACR,IAAI,SAAS,OAAO,UAAU,OAAO,eAAe,EAClD,cACD,CAAC,CACH,GACD;EACN,MAAM,mBAAmB,aACrB,0BAA0B,WAAW,OAAO,GAC5C;EACJ,MAAM,qBAAqB,SAAS,WAClC,gCACD,GACG,SACA,SAAS,WAAW,gCAAgC,GAClD,SACA;EAEN,MAAM,uBACJ,iBAAiB,QACjB,oBAAoB,QACpB,kBAAkB,aAAa,UAAU,SAAS,eAC9C,OAAO,GAAG,cACR,IAAI,SAAS,OAAO,UAAU,OAAO,2BAA2B;GAC9D;GACA,cAAc;GACd,YAAY;GACb,CAAC,CACH,GACD;EAEN,MAAM,WAAW,OAAO,GAAG,KAAK;GAC9B,UAAU,GAAG,UAAU,eAAe,UAAU;GAChD,WACE,GAAG,MAAM;IACP,MAAM;IACN,SAAS;IACV,CAAC;GACL,CAAC,CAAC,KACD,GAAG,OAAO,QACR,QAAQ,OACJ,GAAG,KAAK;GACN,MAAM;GACN,SAAS;GACV,CAAC,GACF,GAAG,QAAQ,IAAI,CACpB,CACF;EAED,MAAM,EAAE,cAAc,OAAO,GAAG,cAC9B,qBACE,KACA,SAAS,aAAa,MACtB,oBAAoB,OAAO,EAAE,iBAAiB,GAAG,EAAE,mBAAmB,EACtE;GACE,MAAM;GACN,UAAW,uBAAuB,SAAS,GACvC,uCAAuC,UAAU,EAC/C,gBACE,uBAAuB,SACnB,kBAAkB,SAAS,eAAe,OAC1C,uBAAuB,SACrB,kBAAkB,SAAS,eAAe,OAC1C,QACT,CAAC,GACF,mBAAmB,SAAS;GAChC;GACA,eAAe,uBACb,UACA,mBACA,cACD;GACF,EACD,QACA,sBAAsB,SAClB,EAAE,gBAAgB,qBAAqB,QAAQ,GAC/C,OACL,CACF;AAKD,MACE,iBAAiB,QACjB,kBAAkB,aAAa,IAAI,SAAS,2BAC5C;GAEA,MAAM,UADU,OAAO,GAAG,cAAc,GAAG,SAAS,QAAQ,UAAU,CAAC,GAC/C;AACxB,OAAI,QAAQ;IACV,MAAM,UAAW,YAAoB;AACrC,QAAI,SAOF;UAN2B,OAAO,GAAG,cACnC,IAAI,SAAS,OAAO,UAAU,OAAO,yBAAyB;MAC5D;MACA;MACD,CAAC,CACH,MAC0B,KACzB,QAAO,GAAG,cACR,IAAI,YAAY,OAAO,UAAU,OAAO,WAAW;MACjD;MACA;MACA,SAAS,iBAAiB,aAAa,IAAI;MAC3C,QAAQ;MACT,CAAC,CACH;;;;EAMT,MAAM,OAAO,qBAAqB,GAAG,aAAa;AAClD,SAAO,GAAG,cAAc,GAAG,UAAU,OAAO,SAAS,IAAI,CAAC;EAC1D,MAAM,2BAA2B,OAAO,GAAG,cACzC,GAAG,kBAAkB,eAAe,UAAU,CAC/C;AACD,MAAI,6BAA6B,KAC/B,QAAO,GAAG,cACR,GAAG,kBAAkB,OAAO,yBAAyB,IAAI,CAC1D;AAEH,SAAO,GAAG,QAAQ,YAChB,GAAG,kBAAkB,OAAO;GAC1B,MAAM,MAAM,OAAO,KAAK;GACxB;GACA;GACA,gBAAgB,KAAK,KAAK,GAAG;GAC7B,UAAU,SAAS;GACpB,CAAC,CACH;AACD,SAAO;GACP;;AAGJ,MAAa,gBAAgB,OAC3B,KACA,SACwB;AACxB,QAAO,IAAI,YAAY,gBAAgB,EACrC,MAAM;EACJ,MAAM;EACN,GAAG;EACJ,EACF,CAAC"}

package/dist/component/server/mutations/refresh.js

@@ -1,119 +0,0 @@
-import { logWithLevel, maybeRedact } from "../utils.js";
-import { authDb } from "../db.js";
-import { AUTH_STORE_REF } from "./store/refs.js";
-import { REFRESH_TOKEN_REUSE_WINDOW_MS, invalidateRefreshTokensInSubtree, parseRefreshToken, refreshTokenIfValid } from "../refresh.js";
-import { generateTokensForSession } from "../sessions.js";
-import { Fx } from "@robelest/fx";
-import { v } from "convex/values";
-
-//#region src/server/mutations/refresh.ts
-const refreshSessionArgs = v.object({ refreshToken: v.string() });
-/** A soft refresh failure — logged and collapsed to null at the boundary. */
-var RefreshFailure = class {
-	_tag = "RefreshFailure";
-	constructor(reason) {
-		this.reason = reason;
-	}
-};
-async function refreshSessionImpl(ctx, args, _getProviderOrThrow, config) {
-	const db = authDb(ctx, config);
-	const { refreshToken } = args;
-	return Fx.run(parseRefreshToken(refreshToken).pipe(Fx.recover((err) => Fx.fail(new RefreshFailure(err.data.message))), Fx.tap(({ refreshTokenId, sessionId: tokenSessionId }) => Fx.sync(() => logWithLevel("DEBUG", `refreshSessionImpl args: Token ID: ${maybeRedact(refreshTokenId)} Session ID: ${maybeRedact(tokenSessionId)}`))), Fx.chain(({ refreshTokenId, sessionId: tokenSessionId }) => refreshTokenIfValid(ctx, refreshTokenId, tokenSessionId, config).pipe(Fx.chain((validationResult) => validationResult === null ? Fx.gen(function* () {
-		yield* Fx.from({
-			ok: async () => {
-				const session = await db.sessions.getById(tokenSessionId);
-				if (session !== null) await db.sessions.delete(session._id);
-			},
-			err: () => new RefreshFailure("Skipping invalid session id during refresh cleanup")
-		}).pipe(Fx.recover((f) => {
-			logWithLevel("DEBUG", f.reason);
-			return Fx.succeed(void 0);
-		}));
-		yield* Fx.from({
-			ok: () => authDb(ctx, config).refreshTokens.deleteAll(tokenSessionId),
-			err: () => new RefreshFailure("Skipping invalid token session id during refresh token cleanup")
-		}).pipe(Fx.recover((f) => {
-			logWithLevel("DEBUG", f.reason);
-			return Fx.succeed(void 0);
-		}));
-		return null;
-	}) : (() => {
-		const { session } = validationResult;
-		const sessionId = session._id;
-		const userId = session.userId;
-		const tokenFirstUsed = validationResult.refreshTokenDoc.firstUsedTime;
-		return tokenFirstUsed === void 0 ? Fx.from({
-			ok: async () => {
-				await db.refreshTokens.patch(refreshTokenId, { firstUsedTime: Date.now() });
-				const result = await generateTokensForSession(ctx, config, {
-					userId,
-					sessionId,
-					issuedRefreshTokenId: null,
-					parentRefreshTokenId: refreshTokenId
-				});
-				const { refreshTokenId: newRefreshTokenId } = await Fx.run(parseRefreshToken(result.refreshToken));
-				logWithLevel("DEBUG", `Exchanged ${maybeRedact(validationResult.refreshTokenDoc._id)} (first use) for new refresh token ${maybeRedact(newRefreshTokenId)}`);
-				return result;
-			},
-			err: () => new RefreshFailure("Failed during first-use token exchange")
-		}) : Fx.from({
-			ok: () => authDb(ctx, config).refreshTokens.getActive(tokenSessionId),
-			err: () => new RefreshFailure("Failed to load active refresh token")
-		}).pipe(Fx.chain((activeRefreshToken) => {
-			logWithLevel("DEBUG", `Active refresh token: ${maybeRedact(activeRefreshToken?._id ?? "(none)")}, parent ${maybeRedact(activeRefreshToken?.parentRefreshTokenId ?? "(none)")}`);
-			const reuseDispatch = activeRefreshToken !== null && activeRefreshToken.parentRefreshTokenId === refreshTokenId ? {
-				tag: "parentOfActive",
-				activeRefreshToken
-			} : tokenFirstUsed + REFRESH_TOKEN_REUSE_WINDOW_MS > Date.now() ? { tag: "withinReuseWindow" } : { tag: "outsideReuseWindow" };
-			if (reuseDispatch.tag === "parentOfActive") return Fx.from({
-				ok: () => generateTokensForSession(ctx, config, {
-					userId,
-					sessionId,
-					issuedRefreshTokenId: reuseDispatch.activeRefreshToken._id,
-					parentRefreshTokenId: refreshTokenId
-				}),
-				err: () => new RefreshFailure("Failed to generate tokens for parent reuse")
-			}).pipe(Fx.tap(() => Fx.sync(() => logWithLevel("DEBUG", `Token ${maybeRedact(validationResult.refreshTokenDoc._id)} is parent of active refresh token ${maybeRedact(reuseDispatch.activeRefreshToken._id)}, so returning that token`))));
-			if (reuseDispatch.tag === "withinReuseWindow") return Fx.from({
-				ok: async () => {
-					const result = await generateTokensForSession(ctx, config, {
-						userId,
-						sessionId,
-						issuedRefreshTokenId: null,
-						parentRefreshTokenId: refreshTokenId
-					});
-					const { refreshTokenId: newRefreshTokenId } = await Fx.run(parseRefreshToken(result.refreshToken));
-					logWithLevel("DEBUG", `Exchanged ${maybeRedact(validationResult.refreshTokenDoc._id)} (reuse) for new refresh token ${maybeRedact(newRefreshTokenId)}`);
-					return result;
-				},
-				err: () => new RefreshFailure("Failed to generate tokens for reuse window")
-			});
-			logWithLevel("ERROR", "Refresh token used outside of reuse window");
-			logWithLevel("DEBUG", `Token ${maybeRedact(validationResult.refreshTokenDoc._id)} being used outside of reuse window, so invalidating all refresh tokens in subtree`);
-			return Fx.from({
-				ok: async () => {
-					const tokensToInvalidate = await invalidateRefreshTokensInSubtree(ctx, validationResult.refreshTokenDoc, config);
-					logWithLevel("DEBUG", `Invalidated ${tokensToInvalidate.length} refresh tokens in subtree: ${tokensToInvalidate.map((token) => maybeRedact(token._id)).join(", ")}`);
-					return null;
-				},
-				err: () => new RefreshFailure("Failed to invalidate refresh tokens in subtree")
-			});
-		}));
-	})()))), Fx.fold({
-		ok: (result) => result,
-		err: (failure) => {
-			logWithLevel("DEBUG", failure.reason);
-			return null;
-		}
-	})));
-}
-const callRefreshSession = async (ctx, args) => {
-	return ctx.runMutation(AUTH_STORE_REF, { args: {
-		type: "refreshSession",
-		...args
-	} });
-};
-
-//#endregion
-export { callRefreshSession, refreshSessionArgs, refreshSessionImpl };
-//# sourceMappingURL=refresh.js.map