@robelest/convex-auth 0.0.4-preview.25 → 0.0.4-preview.28

package/dist/component/server/mutations/refresh.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"refresh.js","names":[],"sources":["../../../../src/server/mutations/refresh.ts"],"sourcesContent":["import { Fx } from \"@robelest/fx\";\nimport type { GenericActionCtx, GenericDataModel } from \"convex/server\";\nimport { ConvexError, Infer, v } from \"convex/values\";\n\nimport * as Provider from \"../crypto\";\nimport { authDb } from \"../db\";\nimport {\n  invalidateRefreshTokensInSubtree,\n  parseRefreshToken,\n  REFRESH_TOKEN_REUSE_WINDOW_MS,\n  refreshTokenIfValid,\n} from \"../refresh\";\nimport { generateTokensForSession } from \"../sessions\";\nimport { MutationCtx } from \"../types\";\nimport { logWithLevel, maybeRedact } from \"../utils\";\nimport { AUTH_STORE_REF } from \"./store/refs\";\n\nexport const refreshSessionArgs = v.object({\n  refreshToken: v.string(),\n});\n\ntype RefreshResult = null | {\n  token: string;\n  refreshToken: string;\n};\n\n// ============================================================================\n// Small helpers for the refresh pipeline\n// ============================================================================\n\n/** A soft refresh failure — logged and collapsed to null at the boundary. */\nclass RefreshFailure {\n  readonly _tag = \"RefreshFailure\" as const;\n  constructor(readonly reason: string) {}\n}\n\n// ============================================================================\n// Main exported function\n// ============================================================================\n\nexport async function refreshSessionImpl(\n  ctx: MutationCtx,\n  args: Infer<typeof refreshSessionArgs>,\n  _getProviderOrThrow: Provider.GetProviderOrThrowFunc,\n  config: Provider.Config,\n): Promise<RefreshResult> {\n  const db = authDb(ctx, config);\n  const { refreshToken } = args;\n\n  return Fx.run(\n    parseRefreshToken(refreshToken).pipe(\n      Fx.recover((err: ConvexError<any>) =>\n        Fx.fail(new RefreshFailure(err.data.message)),\n      ),\n      Fx.tap(({ refreshTokenId, sessionId: tokenSessionId }) =>\n        Fx.sync(() =>\n          logWithLevel(\n            \"DEBUG\",\n            `refreshSessionImpl args: Token ID: ${maybeRedact(refreshTokenId)} Session ID: ${maybeRedact(tokenSessionId)}`,\n          ),\n        ),\n      ),\n      Fx.chain(({ refreshTokenId, sessionId: tokenSessionId }) =>\n        refreshTokenIfValid(ctx, refreshTokenId, tokenSessionId, config).pipe(\n          Fx.chain((validationResult) =>\n            validationResult === null\n              ? Fx.gen(function* () {\n                  yield* Fx.from({\n                    ok: async () => {\n                      const session = await (db as any).sessions.getById(\n                        tokenSessionId,\n                      );\n                      if (session !== null) {\n                        await (db as any).sessions.delete(session._id);\n                      }\n                    },\n                    err: () =>\n                      new RefreshFailure(\n                        \"Skipping invalid session id during refresh cleanup\",\n                      ),\n                  }).pipe(\n                    Fx.recover((f) => {\n                      logWithLevel(\"DEBUG\", f.reason);\n                      return Fx.succeed(undefined as void);\n                    }),\n                  );\n\n                  yield* Fx.from({\n                    ok: () =>\n                      authDb(ctx, config).refreshTokens.deleteAll(\n                        tokenSessionId as any,\n                      ),\n                    err: () =>\n                      new RefreshFailure(\n                        \"Skipping invalid token session id during refresh token cleanup\",\n                      ),\n                  }).pipe(\n                    Fx.recover((f) => {\n                      logWithLevel(\"DEBUG\", f.reason);\n                      return Fx.succeed(undefined as void);\n                    }),\n                  );\n\n                  return null;\n                })\n              : (() => {\n                  const { session } = validationResult;\n                  const sessionId = session._id;\n                  const userId = session.userId;\n                  const tokenFirstUsed =\n                    validationResult.refreshTokenDoc.firstUsedTime;\n                  return tokenFirstUsed === undefined\n                    ? Fx.from({\n                        ok: async () => {\n                          await (db as any).refreshTokens.patch(\n                            refreshTokenId,\n                            {\n                              firstUsedTime: Date.now(),\n                            },\n                          );\n                          const result = await generateTokensForSession(\n                            ctx,\n                            config,\n                            {\n                              userId,\n                              sessionId,\n                              issuedRefreshTokenId: null,\n                              parentRefreshTokenId: refreshTokenId as any,\n                            },\n                          );\n                          const { refreshTokenId: newRefreshTokenId } =\n                            await Fx.run(\n                              parseRefreshToken(result.refreshToken),\n                            );\n                          logWithLevel(\n                            \"DEBUG\",\n                            `Exchanged ${maybeRedact(validationResult.refreshTokenDoc._id)} (first use) for new refresh token ${maybeRedact(newRefreshTokenId)}`,\n                          );\n                          return result;\n                        },\n                        err: () =>\n                          new RefreshFailure(\n                            \"Failed during first-use token exchange\",\n                          ),\n                      })\n                    : Fx.from({\n                        ok: () =>\n                          authDb(ctx, config).refreshTokens.getActive(\n                            tokenSessionId as any,\n                          ),\n                        err: () =>\n                          new RefreshFailure(\n                            \"Failed to load active refresh token\",\n                          ),\n                      }).pipe(\n                        Fx.chain((activeRefreshToken) => {\n                          logWithLevel(\n                            \"DEBUG\",\n                            `Active refresh token: ${maybeRedact(activeRefreshToken?._id ?? \"(none)\")}, parent ${maybeRedact(activeRefreshToken?.parentRefreshTokenId ?? \"(none)\")}`,\n                          );\n\n                          const reuseDispatch =\n                            activeRefreshToken !== null &&\n                            activeRefreshToken.parentRefreshTokenId ===\n                              refreshTokenId\n                              ? ({\n                                  tag: \"parentOfActive\",\n                                  activeRefreshToken,\n                                } as const)\n                              : tokenFirstUsed + REFRESH_TOKEN_REUSE_WINDOW_MS >\n                                  Date.now()\n                                ? ({ tag: \"withinReuseWindow\" } as const)\n                                : ({ tag: \"outsideReuseWindow\" } as const);\n\n                          if (reuseDispatch.tag === \"parentOfActive\") {\n                            return Fx.from({\n                              ok: () =>\n                                generateTokensForSession(ctx, config, {\n                                  userId,\n                                  sessionId,\n                                  issuedRefreshTokenId:\n                                    reuseDispatch.activeRefreshToken._id,\n                                  parentRefreshTokenId: refreshTokenId as any,\n                                }),\n                              err: () =>\n                                new RefreshFailure(\n                                  \"Failed to generate tokens for parent reuse\",\n                                ),\n                            }).pipe(\n                              Fx.tap(() =>\n                                Fx.sync(() =>\n                                  logWithLevel(\n                                    \"DEBUG\",\n                                    `Token ${maybeRedact(validationResult.refreshTokenDoc._id)} is parent of active refresh token ${maybeRedact(reuseDispatch.activeRefreshToken._id)}, so returning that token`,\n                                  ),\n                                ),\n                              ),\n                            );\n                          }\n\n                          if (reuseDispatch.tag === \"withinReuseWindow\") {\n                            return Fx.from({\n                              ok: async () => {\n                                const result = await generateTokensForSession(\n                                  ctx,\n                                  config,\n                                  {\n                                    userId,\n                                    sessionId,\n                                    issuedRefreshTokenId: null,\n                                    parentRefreshTokenId: refreshTokenId as any,\n                                  },\n                                );\n                                const { refreshTokenId: newRefreshTokenId } =\n                                  await Fx.run(\n                                    parseRefreshToken(result.refreshToken),\n                                  );\n                                logWithLevel(\n                                  \"DEBUG\",\n                                  `Exchanged ${maybeRedact(validationResult.refreshTokenDoc._id)} (reuse) for new refresh token ${maybeRedact(newRefreshTokenId)}`,\n                                );\n                                return result;\n                              },\n                              err: () =>\n                                new RefreshFailure(\n                                  \"Failed to generate tokens for reuse window\",\n                                ),\n                            });\n                          }\n\n                          logWithLevel(\n                            \"ERROR\",\n                            \"Refresh token used outside of reuse window\",\n                          );\n                          logWithLevel(\n                            \"DEBUG\",\n                            `Token ${maybeRedact(validationResult.refreshTokenDoc._id)} being used outside of reuse window, so invalidating all refresh tokens in subtree`,\n                          );\n                          return Fx.from({\n                            ok: async () => {\n                              const tokensToInvalidate =\n                                await invalidateRefreshTokensInSubtree(\n                                  ctx,\n                                  validationResult.refreshTokenDoc,\n                                  config,\n                                );\n                              logWithLevel(\n                                \"DEBUG\",\n                                `Invalidated ${tokensToInvalidate.length} refresh tokens in subtree: ${tokensToInvalidate\n                                  .map((token) => maybeRedact(token._id))\n                                  .join(\", \")}`,\n                              );\n                              return null;\n                            },\n                            err: () =>\n                              new RefreshFailure(\n                                \"Failed to invalidate refresh tokens in subtree\",\n                              ),\n                          });\n                        }),\n                      );\n                })(),\n          ),\n        ),\n      ),\n      Fx.fold({\n        ok: (result) => result,\n        err: (failure) => {\n          logWithLevel(\"DEBUG\", failure.reason);\n          return null;\n        },\n      }),\n    ),\n  );\n}\n\n// ============================================================================\n// Invalid token path — cleanup session and refresh tokens\n// ============================================================================\n\n// ============================================================================\n// Valid token path — dispatch on first-use / parent / reuse-window / stale\n// ============================================================================\n\n// ============================================================================\n// Action-level caller (unchanged — just forwards to mutation)\n// ============================================================================\n\nexport const callRefreshSession = async <DataModel extends GenericDataModel>(\n  ctx: GenericActionCtx<DataModel>,\n  args: Infer<typeof refreshSessionArgs>,\n): Promise<RefreshResult> => {\n  return ctx.runMutation(AUTH_STORE_REF, {\n    args: {\n      type: \"refreshSession\",\n      ...args,\n    },\n  });\n};\n"],"mappings":";;;;;;;;;AAiBA,MAAa,qBAAqB,EAAE,OAAO,EACzC,cAAc,EAAE,QAAQ,EACzB,CAAC;;AAYF,IAAM,iBAAN,MAAqB;CACnB,AAAS,OAAO;CAChB,YAAY,AAAS,QAAgB;EAAhB;;;AAOvB,eAAsB,mBACpB,KACA,MACA,qBACA,QACwB;CACxB,MAAM,KAAK,OAAO,KAAK,OAAO;CAC9B,MAAM,EAAE,iBAAiB;AAEzB,QAAO,GAAG,IACR,kBAAkB,aAAa,CAAC,KAC9B,GAAG,SAAS,QACV,GAAG,KAAK,IAAI,eAAe,IAAI,KAAK,QAAQ,CAAC,CAC9C,EACD,GAAG,KAAK,EAAE,gBAAgB,WAAW,qBACnC,GAAG,WACD,aACE,SACA,sCAAsC,YAAY,eAAe,CAAC,eAAe,YAAY,eAAe,GAC7G,CACF,CACF,EACD,GAAG,OAAO,EAAE,gBAAgB,WAAW,qBACrC,oBAAoB,KAAK,gBAAgB,gBAAgB,OAAO,CAAC,KAC/D,GAAG,OAAO,qBACR,qBAAqB,OACjB,GAAG,IAAI,aAAa;AAClB,SAAO,GAAG,KAAK;GACb,IAAI,YAAY;IACd,MAAM,UAAU,MAAO,GAAW,SAAS,QACzC,eACD;AACD,QAAI,YAAY,KACd,OAAO,GAAW,SAAS,OAAO,QAAQ,IAAI;;GAGlD,WACE,IAAI,eACF,qDACD;GACJ,CAAC,CAAC,KACD,GAAG,SAAS,MAAM;AAChB,gBAAa,SAAS,EAAE,OAAO;AAC/B,UAAO,GAAG,QAAQ,OAAkB;IACpC,CACH;AAED,SAAO,GAAG,KAAK;GACb,UACE,OAAO,KAAK,OAAO,CAAC,cAAc,UAChC,eACD;GACH,WACE,IAAI,eACF,iEACD;GACJ,CAAC,CAAC,KACD,GAAG,SAAS,MAAM;AAChB,gBAAa,SAAS,EAAE,OAAO;AAC/B,UAAO,GAAG,QAAQ,OAAkB;IACpC,CACH;AAED,SAAO;GACP,UACK;EACL,MAAM,EAAE,YAAY;EACpB,MAAM,YAAY,QAAQ;EAC1B,MAAM,SAAS,QAAQ;EACvB,MAAM,iBACJ,iBAAiB,gBAAgB;AACnC,SAAO,mBAAmB,SACtB,GAAG,KAAK;GACN,IAAI,YAAY;AACd,UAAO,GAAW,cAAc,MAC9B,gBACA,EACE,eAAe,KAAK,KAAK,EAC1B,CACF;IACD,MAAM,SAAS,MAAM,yBACnB,KACA,QACA;KACE;KACA;KACA,sBAAsB;KACtB,sBAAsB;KACvB,CACF;IACD,MAAM,EAAE,gBAAgB,sBACtB,MAAM,GAAG,IACP,kBAAkB,OAAO,aAAa,CACvC;AACH,iBACE,SACA,aAAa,YAAY,iBAAiB,gBAAgB,IAAI,CAAC,qCAAqC,YAAY,kBAAkB,GACnI;AACD,WAAO;;GAET,WACE,IAAI,eACF,yCACD;GACJ,CAAC,GACF,GAAG,KAAK;GACN,UACE,OAAO,KAAK,OAAO,CAAC,cAAc,UAChC,eACD;GACH,WACE,IAAI,eACF,sCACD;GACJ,CAAC,CAAC,KACD,GAAG,OAAO,uBAAuB;AAC/B,gBACE,SACA,yBAAyB,YAAY,oBAAoB,OAAO,SAAS,CAAC,WAAW,YAAY,oBAAoB,wBAAwB,SAAS,GACvJ;GAED,MAAM,gBACJ,uBAAuB,QACvB,mBAAmB,yBACjB,iBACG;IACC,KAAK;IACL;IACD,GACD,iBAAiB,gCACf,KAAK,KAAK,GACT,EAAE,KAAK,qBAAqB,GAC5B,EAAE,KAAK,sBAAsB;AAEtC,OAAI,cAAc,QAAQ,iBACxB,QAAO,GAAG,KAAK;IACb,UACE,yBAAyB,KAAK,QAAQ;KACpC;KACA;KACA,sBACE,cAAc,mBAAmB;KACnC,sBAAsB;KACvB,CAAC;IACJ,WACE,IAAI,eACF,6CACD;IACJ,CAAC,CAAC,KACD,GAAG,UACD,GAAG,WACD,aACE,SACA,SAAS,YAAY,iBAAiB,gBAAgB,IAAI,CAAC,qCAAqC,YAAY,cAAc,mBAAmB,IAAI,CAAC,2BACnJ,CACF,CACF,CACF;AAGH,OAAI,cAAc,QAAQ,oBACxB,QAAO,GAAG,KAAK;IACb,IAAI,YAAY;KACd,MAAM,SAAS,MAAM,yBACnB,KACA,QACA;MACE;MACA;MACA,sBAAsB;MACtB,sBAAsB;MACvB,CACF;KACD,MAAM,EAAE,gBAAgB,sBACtB,MAAM,GAAG,IACP,kBAAkB,OAAO,aAAa,CACvC;AACH,kBACE,SACA,aAAa,YAAY,iBAAiB,gBAAgB,IAAI,CAAC,iCAAiC,YAAY,kBAAkB,GAC/H;AACD,YAAO;;IAET,WACE,IAAI,eACF,6CACD;IACJ,CAAC;AAGJ,gBACE,SACA,6CACD;AACD,gBACE,SACA,SAAS,YAAY,iBAAiB,gBAAgB,IAAI,CAAC,oFAC5D;AACD,UAAO,GAAG,KAAK;IACb,IAAI,YAAY;KACd,MAAM,qBACJ,MAAM,iCACJ,KACA,iBAAiB,iBACjB,OACD;AACH,kBACE,SACA,eAAe,mBAAmB,OAAO,8BAA8B,mBACpE,KAAK,UAAU,YAAY,MAAM,IAAI,CAAC,CACtC,KAAK,KAAK,GACd;AACD,YAAO;;IAET,WACE,IAAI,eACF,iDACD;IACJ,CAAC;IACF,CACH;KACH,CACT,CACF,CACF,EACD,GAAG,KAAK;EACN,KAAK,WAAW;EAChB,MAAM,YAAY;AAChB,gBAAa,SAAS,QAAQ,OAAO;AACrC,UAAO;;EAEV,CAAC,CACH,CACF;;AAeH,MAAa,qBAAqB,OAChC,KACA,SAC2B;AAC3B,QAAO,IAAI,YAAY,gBAAgB,EACrC,MAAM;EACJ,MAAM;EACN,GAAG;EACJ,EACF,CAAC"}

package/dist/component/server/mutations/register.js

@@ -1,87 +0,0 @@
-import { LOG_LEVELS, logWithLevel, maybeRedact } from "../utils.js";
-import { hash, verify } from "../crypto.js";
-import { authDb } from "../db.js";
-import { AUTH_STORE_REF } from "./store/refs.js";
-import { getAuthSessionId } from "../sessions.js";
-import { upsertUserAndAccount } from "../users.js";
-import { Cv } from "@robelest/fx/convex";
-import { Fx } from "@robelest/fx";
-import { v } from "convex/values";
-
-//#region src/server/mutations/register.ts
-const createAccountFromCredentialsArgs = v.object({
-	provider: v.string(),
-	account: v.object({
-		id: v.string(),
-		secret: v.optional(v.string())
-	}),
-	profile: v.any(),
-	shouldLinkViaEmail: v.optional(v.boolean()),
-	shouldLinkViaPhone: v.optional(v.boolean())
-});
-async function createAccountFromCredentialsImpl(ctx, args, getProviderOrThrow, config) {
-	logWithLevel(LOG_LEVELS.DEBUG, "createAccountFromCredentialsImpl args:", {
-		provider: args.provider,
-		account: {
-			id: args.account.id,
-			secret: maybeRedact(args.account.secret ?? "")
-		}
-	});
-	const { provider: providerId, account, profile, shouldLinkViaEmail, shouldLinkViaPhone } = args;
-	const db = authDb(ctx, config);
-	const provider = getProviderOrThrow(providerId);
-	return Fx.run(Fx.gen(function* () {
-		const existingAccount = yield* Fx.promise(() => db.accounts.get(provider.id, account.id));
-		if (existingAccount !== null) {
-			if (account.secret !== void 0) {
-				if (!(yield* verify(provider, account.secret, existingAccount.secret ?? ""))) return yield* Cv.fail({
-					code: "ACCOUNT_ALREADY_EXISTS",
-					message: `Account ${account.id} already exists`
-				});
-			}
-			const user = yield* Fx.promise(() => db.users.getById(existingAccount.userId));
-			if (user === null) return yield* Cv.fail({
-				code: "ACCOUNT_NOT_FOUND",
-				message: `Linked user for account ${account.id} was not found.`
-			});
-			return {
-				account: existingAccount,
-				user
-			};
-		}
-		const secret = account.secret !== void 0 ? yield* hash(provider, account.secret) : void 0;
-		const { userId, accountId } = yield* Fx.promise(async () => upsertUserAndAccount(ctx, await getAuthSessionId(ctx), {
-			providerAccountId: account.id,
-			secret
-		}, {
-			type: "credentials",
-			provider,
-			profile,
-			shouldLinkViaEmail,
-			shouldLinkViaPhone
-		}, config));
-		const [createdAccount, createdUser] = yield* Fx.zip(Fx.promise(() => db.accounts.getById(accountId)), Fx.promise(() => db.users.getById(userId)));
-		if (createdAccount === null) return yield* Cv.fail({
-			code: "ACCOUNT_NOT_FOUND",
-			message: `Created account was not found.`
-		});
-		if (createdUser === null) return yield* Cv.fail({
-			code: "USER_UPDATE_FAILED",
-			message: `Created user was not found.`
-		});
-		return {
-			account: createdAccount,
-			user: createdUser
-		};
-	}));
-}
-const callCreateAccountFromCredentials = async (ctx, args) => {
-	return ctx.runMutation(AUTH_STORE_REF, { args: {
-		type: "createAccountFromCredentials",
-		...args
-	} });
-};
-
-//#endregion
-export { callCreateAccountFromCredentials, createAccountFromCredentialsArgs, createAccountFromCredentialsImpl };
-//# sourceMappingURL=register.js.map

package/dist/component/server/mutations/register.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"register.js","names":["Provider.verify","Provider.hash"],"sources":["../../../../src/server/mutations/register.ts"],"sourcesContent":["import { Fx } from \"@robelest/fx\";\nimport { Cv } from \"@robelest/fx/convex\";\nimport type { GenericActionCtx, GenericDataModel } from \"convex/server\";\nimport { Infer, v } from \"convex/values\";\n\nimport * as Provider from \"../crypto\";\nimport { authDb } from \"../db\";\nimport { getAuthSessionId } from \"../sessions\";\nimport { Doc, MutationCtx } from \"../types\";\nimport { ConvexCredentialsConfig } from \"../types\";\nimport { upsertUserAndAccount } from \"../users\";\nimport { LOG_LEVELS, logWithLevel, maybeRedact } from \"../utils\";\nimport { AUTH_STORE_REF } from \"./store/refs\";\n\nexport const createAccountFromCredentialsArgs = v.object({\n  provider: v.string(),\n  account: v.object({ id: v.string(), secret: v.optional(v.string()) }),\n  profile: v.any(),\n  shouldLinkViaEmail: v.optional(v.boolean()),\n  shouldLinkViaPhone: v.optional(v.boolean()),\n});\n\ntype ReturnType = { account: Doc<\"Account\">; user: Doc<\"User\"> };\n\nexport async function createAccountFromCredentialsImpl(\n  ctx: MutationCtx,\n  args: Infer<typeof createAccountFromCredentialsArgs>,\n  getProviderOrThrow: Provider.GetProviderOrThrowFunc,\n  config: Provider.Config,\n): Promise<ReturnType> {\n  logWithLevel(LOG_LEVELS.DEBUG, \"createAccountFromCredentialsImpl args:\", {\n    provider: args.provider,\n    account: {\n      id: args.account.id,\n      secret: maybeRedact(args.account.secret ?? \"\"),\n    },\n  });\n\n  const {\n    provider: providerId,\n    account,\n    profile,\n    shouldLinkViaEmail,\n    shouldLinkViaPhone,\n  } = args;\n  const db = authDb(ctx, config);\n  const provider = getProviderOrThrow(providerId) as ConvexCredentialsConfig;\n\n  return Fx.run(\n    Fx.gen(function* () {\n      const existingAccount = yield* Fx.promise(\n        () =>\n          db.accounts.get(\n            provider.id,\n            account.id,\n          ) as Promise<Doc<\"Account\"> | null>,\n      );\n\n      if (existingAccount !== null) {\n        if (account.secret !== undefined) {\n          const valid = yield* Provider.verify(\n            provider,\n            account.secret,\n            existingAccount.secret ?? \"\",\n          );\n          if (!valid) {\n            return yield* Cv.fail({\n              code: \"ACCOUNT_ALREADY_EXISTS\",\n              message: `Account ${account.id} already exists`,\n            });\n          }\n        }\n\n        const user = yield* Fx.promise(\n          () =>\n            db.users.getById(\n              existingAccount.userId,\n            ) as Promise<Doc<\"User\"> | null>,\n        );\n        if (user === null) {\n          return yield* Cv.fail({\n            code: \"ACCOUNT_NOT_FOUND\",\n            message: `Linked user for account ${account.id} was not found.`,\n          });\n        }\n\n        return { account: existingAccount, user };\n      }\n\n      const secret =\n        account.secret !== undefined\n          ? yield* Provider.hash(provider, account.secret)\n          : undefined;\n\n      const result = yield* Fx.promise(async () =>\n        upsertUserAndAccount(\n          ctx,\n          await getAuthSessionId(ctx),\n          { providerAccountId: account.id, secret },\n          {\n            type: \"credentials\",\n            provider,\n            profile,\n            shouldLinkViaEmail,\n            shouldLinkViaPhone,\n          },\n          config,\n        ),\n      );\n\n      const { userId, accountId } = result as {\n        userId: string;\n        accountId: string;\n      };\n      const [createdAccount, createdUser] = yield* Fx.zip(\n        Fx.promise(\n          () =>\n            db.accounts.getById(accountId) as Promise<Doc<\"Account\"> | null>,\n        ),\n        Fx.promise(\n          () => db.users.getById(userId) as Promise<Doc<\"User\"> | null>,\n        ),\n      );\n\n      if (createdAccount === null) {\n        return yield* Cv.fail({\n          code: \"ACCOUNT_NOT_FOUND\",\n          message: `Created account was not found.`,\n        });\n      }\n      if (createdUser === null) {\n        return yield* Cv.fail({\n          code: \"USER_UPDATE_FAILED\",\n          message: `Created user was not found.`,\n        });\n      }\n\n      return { account: createdAccount, user: createdUser };\n    }),\n  ) as Promise<ReturnType>;\n}\n\nexport const callCreateAccountFromCredentials = async <\n  DataModel extends GenericDataModel,\n>(\n  ctx: GenericActionCtx<DataModel>,\n  args: Infer<typeof createAccountFromCredentialsArgs>,\n): Promise<ReturnType> => {\n  return ctx.runMutation(AUTH_STORE_REF, {\n    args: {\n      type: \"createAccountFromCredentials\",\n      ...args,\n    },\n  });\n};\n"],"mappings":";;;;;;;;;;;AAcA,MAAa,mCAAmC,EAAE,OAAO;CACvD,UAAU,EAAE,QAAQ;CACpB,SAAS,EAAE,OAAO;EAAE,IAAI,EAAE,QAAQ;EAAE,QAAQ,EAAE,SAAS,EAAE,QAAQ,CAAC;EAAE,CAAC;CACrE,SAAS,EAAE,KAAK;CAChB,oBAAoB,EAAE,SAAS,EAAE,SAAS,CAAC;CAC3C,oBAAoB,EAAE,SAAS,EAAE,SAAS,CAAC;CAC5C,CAAC;AAIF,eAAsB,iCACpB,KACA,MACA,oBACA,QACqB;AACrB,cAAa,WAAW,OAAO,0CAA0C;EACvE,UAAU,KAAK;EACf,SAAS;GACP,IAAI,KAAK,QAAQ;GACjB,QAAQ,YAAY,KAAK,QAAQ,UAAU,GAAG;GAC/C;EACF,CAAC;CAEF,MAAM,EACJ,UAAU,YACV,SACA,SACA,oBACA,uBACE;CACJ,MAAM,KAAK,OAAO,KAAK,OAAO;CAC9B,MAAM,WAAW,mBAAmB,WAAW;AAE/C,QAAO,GAAG,IACR,GAAG,IAAI,aAAa;EAClB,MAAM,kBAAkB,OAAO,GAAG,cAE9B,GAAG,SAAS,IACV,SAAS,IACT,QAAQ,GACT,CACJ;AAED,MAAI,oBAAoB,MAAM;AAC5B,OAAI,QAAQ,WAAW,QAMrB;QAAI,EALU,OAAOA,OACnB,UACA,QAAQ,QACR,gBAAgB,UAAU,GAC3B,EAEC,QAAO,OAAO,GAAG,KAAK;KACpB,MAAM;KACN,SAAS,WAAW,QAAQ,GAAG;KAChC,CAAC;;GAIN,MAAM,OAAO,OAAO,GAAG,cAEnB,GAAG,MAAM,QACP,gBAAgB,OACjB,CACJ;AACD,OAAI,SAAS,KACX,QAAO,OAAO,GAAG,KAAK;IACpB,MAAM;IACN,SAAS,2BAA2B,QAAQ,GAAG;IAChD,CAAC;AAGJ,UAAO;IAAE,SAAS;IAAiB;IAAM;;EAG3C,MAAM,SACJ,QAAQ,WAAW,SACf,OAAOC,KAAc,UAAU,QAAQ,OAAO,GAC9C;EAkBN,MAAM,EAAE,QAAQ,cAhBD,OAAO,GAAG,QAAQ,YAC/B,qBACE,KACA,MAAM,iBAAiB,IAAI,EAC3B;GAAE,mBAAmB,QAAQ;GAAI;GAAQ,EACzC;GACE,MAAM;GACN;GACA;GACA;GACA;GACD,EACD,OACD,CACF;EAMD,MAAM,CAAC,gBAAgB,eAAe,OAAO,GAAG,IAC9C,GAAG,cAEC,GAAG,SAAS,QAAQ,UAAU,CACjC,EACD,GAAG,cACK,GAAG,MAAM,QAAQ,OAAO,CAC/B,CACF;AAED,MAAI,mBAAmB,KACrB,QAAO,OAAO,GAAG,KAAK;GACpB,MAAM;GACN,SAAS;GACV,CAAC;AAEJ,MAAI,gBAAgB,KAClB,QAAO,OAAO,GAAG,KAAK;GACpB,MAAM;GACN,SAAS;GACV,CAAC;AAGJ,SAAO;GAAE,SAAS;GAAgB,MAAM;GAAa;GACrD,CACH;;AAGH,MAAa,mCAAmC,OAG9C,KACA,SACwB;AACxB,QAAO,IAAI,YAAY,gBAAgB,EACrC,MAAM;EACJ,MAAM;EACN,GAAG;EACJ,EACF,CAAC"}

package/dist/component/server/mutations/retrieve.js

@@ -1,61 +0,0 @@
-import { LOG_LEVELS, logWithLevel, maybeRedact } from "../utils.js";
-import { verify } from "../crypto.js";
-import { authDb } from "../db.js";
-import { AUTH_STORE_REF } from "./store/refs.js";
-import { isSignInRateLimited, recordFailedSignIn, resetSignInRateLimit } from "../limits.js";
-import { Fx } from "@robelest/fx";
-import { v } from "convex/values";
-
-//#region src/server/mutations/retrieve.ts
-const retrieveAccountWithCredentialsArgs = v.object({
-	provider: v.string(),
-	account: v.object({
-		id: v.string(),
-		secret: v.optional(v.string())
-	})
-});
-function retrieveAccountWithCredentialsImpl(ctx, args, getProviderOrThrow, config) {
-	const { provider: providerId, account } = args;
-	const db = authDb(ctx, config);
-	logWithLevel(LOG_LEVELS.DEBUG, "retrieveAccountWithCredentialsImpl args:", {
-		provider: providerId,
-		account: {
-			id: account.id,
-			secret: maybeRedact(account.secret ?? "")
-		}
-	});
-	return Fx.gen(function* () {
-		const existingAccount = yield* Fx.promise(() => db.accounts.get(providerId, account.id));
-		if (existingAccount === null) return "InvalidAccountId";
-		if (account.secret !== void 0) {
-			if (yield* isSignInRateLimited(ctx, existingAccount._id, config)) return "TooManyFailedAttempts";
-			if (!(yield* verify(getProviderOrThrow(providerId), account.secret, existingAccount.secret ?? ""))) {
-				yield* recordFailedSignIn(ctx, existingAccount._id, config);
-				return "InvalidSecret";
-			}
-			yield* resetSignInRateLimit(ctx, existingAccount._id, config);
-		}
-		const user = yield* Fx.promise(() => db.users.getById(existingAccount.userId));
-		if (user === null) {
-			logWithLevel(LOG_LEVELS.ERROR, `Account ${existingAccount._id} is linked to missing user ${existingAccount.userId}`);
-			return "InvalidAccountId";
-		}
-		return {
-			account: existingAccount,
-			user
-		};
-	}).pipe(Fx.fold({
-		ok: (v$1) => v$1,
-		err: () => "InvalidAccountId"
-	}));
-}
-const callRetrieveAccountWithCredentials = async (ctx, args) => {
-	return ctx.runMutation(AUTH_STORE_REF, { args: {
-		type: "retrieveAccountWithCredentials",
-		...args
-	} });
-};
-
-//#endregion
-export { callRetrieveAccountWithCredentials, retrieveAccountWithCredentialsArgs, retrieveAccountWithCredentialsImpl };
-//# sourceMappingURL=retrieve.js.map

package/dist/component/server/mutations/retrieve.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"retrieve.js","names":["Provider.verify","v"],"sources":["../../../../src/server/mutations/retrieve.ts"],"sourcesContent":["import { Fx } from \"@robelest/fx\";\nimport type { GenericActionCtx, GenericDataModel } from \"convex/server\";\nimport { Infer, v } from \"convex/values\";\n\nimport * as Provider from \"../crypto\";\nimport { authDb } from \"../db\";\nimport {\n  isSignInRateLimited,\n  recordFailedSignIn,\n  resetSignInRateLimit,\n} from \"../limits\";\nimport { Doc, MutationCtx } from \"../types\";\nimport { LOG_LEVELS, logWithLevel, maybeRedact } from \"../utils\";\nimport { AUTH_STORE_REF } from \"./store/refs\";\n\nexport const retrieveAccountWithCredentialsArgs = v.object({\n  provider: v.string(),\n  account: v.object({ id: v.string(), secret: v.optional(v.string()) }),\n});\n\ntype ReturnType =\n  | \"InvalidAccountId\"\n  | \"TooManyFailedAttempts\"\n  | \"InvalidSecret\"\n  | { account: Doc<\"Account\">; user: Doc<\"User\"> };\n\nexport function retrieveAccountWithCredentialsImpl(\n  ctx: MutationCtx,\n  args: Infer<typeof retrieveAccountWithCredentialsArgs>,\n  getProviderOrThrow: Provider.GetProviderOrThrowFunc,\n  config: Provider.Config,\n): Fx<ReturnType> {\n  const { provider: providerId, account } = args;\n  const db = authDb(ctx, config);\n\n  logWithLevel(LOG_LEVELS.DEBUG, \"retrieveAccountWithCredentialsImpl args:\", {\n    provider: providerId,\n    account: { id: account.id, secret: maybeRedact(account.secret ?? \"\") },\n  });\n\n  return Fx.gen(function* () {\n    const existingAccount = yield* Fx.promise(\n      () =>\n        db.accounts.get(\n          providerId,\n          account.id,\n        ) as Promise<Doc<\"Account\"> | null>,\n    );\n    if (existingAccount === null) {\n      return \"InvalidAccountId\" as const;\n    }\n\n    if (account.secret !== undefined) {\n      const limited = yield* isSignInRateLimited(\n        ctx,\n        existingAccount._id,\n        config,\n      );\n      if (limited) {\n        return \"TooManyFailedAttempts\" as const;\n      }\n\n      const valid = yield* Provider.verify(\n        getProviderOrThrow(providerId),\n        account.secret,\n        existingAccount.secret ?? \"\",\n      );\n      if (!valid) {\n        yield* recordFailedSignIn(ctx, existingAccount._id, config);\n        return \"InvalidSecret\" as const;\n      }\n\n      yield* resetSignInRateLimit(ctx, existingAccount._id, config);\n    }\n\n    const user = yield* Fx.promise(\n      () =>\n        db.users.getById(existingAccount.userId) as Promise<Doc<\"User\"> | null>,\n    );\n    if (user === null) {\n      logWithLevel(\n        LOG_LEVELS.ERROR,\n        `Account ${existingAccount._id} is linked to missing user ${existingAccount.userId}`,\n      );\n      return \"InvalidAccountId\" as const;\n    }\n\n    return { account: existingAccount, user } as ReturnType;\n  }).pipe(\n    Fx.fold({\n      ok: (v) => v as ReturnType,\n      err: () => \"InvalidAccountId\" as ReturnType,\n    }),\n  );\n}\n\nexport const callRetrieveAccountWithCredentials = async <\n  DataModel extends GenericDataModel,\n>(\n  ctx: GenericActionCtx<DataModel>,\n  args: Infer<typeof retrieveAccountWithCredentialsArgs>,\n): Promise<ReturnType> => {\n  return ctx.runMutation(AUTH_STORE_REF, {\n    args: {\n      type: \"retrieveAccountWithCredentials\",\n      ...args,\n    },\n  });\n};\n"],"mappings":";;;;;;;;;AAeA,MAAa,qCAAqC,EAAE,OAAO;CACzD,UAAU,EAAE,QAAQ;CACpB,SAAS,EAAE,OAAO;EAAE,IAAI,EAAE,QAAQ;EAAE,QAAQ,EAAE,SAAS,EAAE,QAAQ,CAAC;EAAE,CAAC;CACtE,CAAC;AAQF,SAAgB,mCACd,KACA,MACA,oBACA,QACgB;CAChB,MAAM,EAAE,UAAU,YAAY,YAAY;CAC1C,MAAM,KAAK,OAAO,KAAK,OAAO;AAE9B,cAAa,WAAW,OAAO,4CAA4C;EACzE,UAAU;EACV,SAAS;GAAE,IAAI,QAAQ;GAAI,QAAQ,YAAY,QAAQ,UAAU,GAAG;GAAE;EACvE,CAAC;AAEF,QAAO,GAAG,IAAI,aAAa;EACzB,MAAM,kBAAkB,OAAO,GAAG,cAE9B,GAAG,SAAS,IACV,YACA,QAAQ,GACT,CACJ;AACD,MAAI,oBAAoB,KACtB,QAAO;AAGT,MAAI,QAAQ,WAAW,QAAW;AAMhC,OALgB,OAAO,oBACrB,KACA,gBAAgB,KAChB,OACD,CAEC,QAAO;AAQT,OAAI,EALU,OAAOA,OACnB,mBAAmB,WAAW,EAC9B,QAAQ,QACR,gBAAgB,UAAU,GAC3B,GACW;AACV,WAAO,mBAAmB,KAAK,gBAAgB,KAAK,OAAO;AAC3D,WAAO;;AAGT,UAAO,qBAAqB,KAAK,gBAAgB,KAAK,OAAO;;EAG/D,MAAM,OAAO,OAAO,GAAG,cAEnB,GAAG,MAAM,QAAQ,gBAAgB,OAAO,CAC3C;AACD,MAAI,SAAS,MAAM;AACjB,gBACE,WAAW,OACX,WAAW,gBAAgB,IAAI,6BAA6B,gBAAgB,SAC7E;AACD,UAAO;;AAGT,SAAO;GAAE,SAAS;GAAiB;GAAM;GACzC,CAAC,KACD,GAAG,KAAK;EACN,KAAK,QAAMC;EACX,WAAW;EACZ,CAAC,CACH;;AAGH,MAAa,qCAAqC,OAGhD,KACA,SACwB;AACxB,QAAO,IAAI,YAAY,gBAAgB,EACrC,MAAM;EACJ,MAAM;EACN,GAAG;EACJ,EACF,CAAC"}

package/dist/component/server/mutations/signature.js

@@ -1,38 +0,0 @@
-import { authDb } from "../db.js";
-import { AUTH_STORE_REF } from "./store/refs.js";
-import { Cv } from "@robelest/fx/convex";
-import { Fx } from "@robelest/fx";
-import { v } from "convex/values";
-
-//#region src/server/mutations/signature.ts
-const verifierSignatureArgs = v.object({
-	verifier: v.string(),
-	signature: v.string()
-});
-function verifierSignatureImpl(ctx, args, config) {
-	return Fx.gen(function* () {
-		const { verifier, signature } = args;
-		const db = authDb(ctx, config);
-		const verifierDoc = yield* Fx.from({
-			ok: () => db.verifiers.getById(verifier),
-			err: () => Cv.error({
-				code: "INVALID_VERIFIER",
-				message: "Invalid or expired verifier."
-			})
-		}).pipe(Fx.chain((doc) => doc === null ? Cv.fail({
-			code: "INVALID_VERIFIER",
-			message: "Invalid or expired verifier."
-		}) : Fx.succeed(doc)));
-		yield* Fx.promise(() => db.verifiers.patch(verifierDoc._id, { signature }));
-	});
-}
-const callVerifierSignature = async (ctx, args) => {
-	return ctx.runMutation(AUTH_STORE_REF, { args: {
-		type: "verifierSignature",
-		...args
-	} });
-};
-
-//#endregion
-export { callVerifierSignature, verifierSignatureArgs, verifierSignatureImpl };
-//# sourceMappingURL=signature.js.map

package/dist/component/server/mutations/signature.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"signature.js","names":[],"sources":["../../../../src/server/mutations/signature.ts"],"sourcesContent":["import { Fx } from \"@robelest/fx\";\nimport { Cv } from \"@robelest/fx/convex\";\nimport type { GenericActionCtx, GenericDataModel } from \"convex/server\";\nimport { ConvexError, GenericId, Infer, v } from \"convex/values\";\n\nimport * as Provider from \"../crypto\";\nimport { authDb } from \"../db\";\nimport { MutationCtx } from \"../types\";\nimport { AUTH_STORE_REF } from \"./store/refs\";\n\nexport const verifierSignatureArgs = v.object({\n  verifier: v.string(),\n  signature: v.string(),\n});\n\ntype ReturnType = void;\n\nexport function verifierSignatureImpl(\n  ctx: MutationCtx,\n  args: Infer<typeof verifierSignatureArgs>,\n  config: Provider.Config,\n): Fx<ReturnType, ConvexError<any>> {\n  return Fx.gen(function* () {\n    const { verifier, signature } = args;\n    const db = authDb(ctx, config);\n    const verifierDoc = yield* Fx.from({\n      ok: () => db.verifiers.getById(verifier as GenericId<\"AuthVerifier\">),\n      err: () =>\n        Cv.error({\n          code: \"INVALID_VERIFIER\",\n          message: \"Invalid or expired verifier.\",\n        }),\n    }).pipe(\n      Fx.chain((doc) =>\n        doc === null\n          ? Cv.fail({\n              code: \"INVALID_VERIFIER\",\n              message: \"Invalid or expired verifier.\",\n            })\n          : Fx.succeed(doc),\n      ),\n    );\n    yield* Fx.promise(() => db.verifiers.patch(verifierDoc._id, { signature }));\n  });\n}\n\nexport const callVerifierSignature = async <DataModel extends GenericDataModel>(\n  ctx: GenericActionCtx<DataModel>,\n  args: Infer<typeof verifierSignatureArgs>,\n): Promise<void> => {\n  return ctx.runMutation(AUTH_STORE_REF, {\n    args: {\n      type: \"verifierSignature\",\n      ...args,\n    },\n  });\n};\n"],"mappings":";;;;;;;AAUA,MAAa,wBAAwB,EAAE,OAAO;CAC5C,UAAU,EAAE,QAAQ;CACpB,WAAW,EAAE,QAAQ;CACtB,CAAC;AAIF,SAAgB,sBACd,KACA,MACA,QACkC;AAClC,QAAO,GAAG,IAAI,aAAa;EACzB,MAAM,EAAE,UAAU,cAAc;EAChC,MAAM,KAAK,OAAO,KAAK,OAAO;EAC9B,MAAM,cAAc,OAAO,GAAG,KAAK;GACjC,UAAU,GAAG,UAAU,QAAQ,SAAsC;GACrE,WACE,GAAG,MAAM;IACP,MAAM;IACN,SAAS;IACV,CAAC;GACL,CAAC,CAAC,KACD,GAAG,OAAO,QACR,QAAQ,OACJ,GAAG,KAAK;GACN,MAAM;GACN,SAAS;GACV,CAAC,GACF,GAAG,QAAQ,IAAI,CACpB,CACF;AACD,SAAO,GAAG,cAAc,GAAG,UAAU,MAAM,YAAY,KAAK,EAAE,WAAW,CAAC,CAAC;GAC3E;;AAGJ,MAAa,wBAAwB,OACnC,KACA,SACkB;AAClB,QAAO,IAAI,YAAY,gBAAgB,EACrC,MAAM;EACJ,MAAM;EACN,GAAG;EACJ,EACF,CAAC"}

package/dist/component/server/mutations/signin.js

@@ -1,27 +0,0 @@
-import { LOG_LEVELS, logWithLevel } from "../utils.js";
-import { AUTH_STORE_REF } from "./store/refs.js";
-import { createNewAndDeleteExistingSession, maybeGenerateTokensForSession } from "../sessions.js";
-import { v } from "convex/values";
-
-//#region src/server/mutations/signin.ts
-const signInArgs = v.object({
-	userId: v.string(),
-	sessionId: v.optional(v.string()),
-	generateTokens: v.boolean()
-});
-async function signInImpl(ctx, args, config) {
-	logWithLevel(LOG_LEVELS.DEBUG, "signInImpl args:", args);
-	const { userId, sessionId: existingSessionId, generateTokens } = args;
-	const typedUserId = userId;
-	return await maybeGenerateTokensForSession(ctx, config, typedUserId, existingSessionId ?? await createNewAndDeleteExistingSession(ctx, config, typedUserId), generateTokens);
-}
-const callSignIn = async (ctx, args) => {
-	return ctx.runMutation(AUTH_STORE_REF, { args: {
-		type: "signIn",
-		...args
-	} });
-};
-
-//#endregion
-export { callSignIn, signInArgs, signInImpl };
-//# sourceMappingURL=signin.js.map

package/dist/component/server/mutations/signin.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"signin.js","names":[],"sources":["../../../../src/server/mutations/signin.ts"],"sourcesContent":["import type { GenericActionCtx, GenericDataModel } from \"convex/server\";\nimport { GenericId, Infer, v } from \"convex/values\";\n\nimport * as Provider from \"../crypto\";\nimport {\n  createNewAndDeleteExistingSession,\n  maybeGenerateTokensForSession,\n} from \"../sessions\";\nimport { MutationCtx, SessionInfo } from \"../types\";\nimport { LOG_LEVELS, logWithLevel } from \"../utils\";\nimport { AUTH_STORE_REF } from \"./store/refs\";\n\nexport const signInArgs = v.object({\n  userId: v.string(),\n  sessionId: v.optional(v.string()),\n  generateTokens: v.boolean(),\n});\n\ntype ReturnType = SessionInfo;\n\nexport async function signInImpl(\n  ctx: MutationCtx,\n  args: Infer<typeof signInArgs>,\n  config: Provider.Config,\n): Promise<ReturnType> {\n  logWithLevel(LOG_LEVELS.DEBUG, \"signInImpl args:\", args);\n  const { userId, sessionId: existingSessionId, generateTokens } = args;\n  const typedUserId = userId as GenericId<\"User\">;\n  const typedExistingSessionId = existingSessionId as\n    | GenericId<\"Session\">\n    | undefined;\n  const sessionId =\n    typedExistingSessionId ??\n    (await createNewAndDeleteExistingSession(ctx, config, typedUserId));\n  return await maybeGenerateTokensForSession(\n    ctx,\n    config,\n    typedUserId,\n    sessionId,\n    generateTokens,\n  );\n}\n\nexport const callSignIn = async <DataModel extends GenericDataModel>(\n  ctx: GenericActionCtx<DataModel>,\n  args: Infer<typeof signInArgs>,\n): Promise<ReturnType> => {\n  return ctx.runMutation(AUTH_STORE_REF, {\n    args: {\n      type: \"signIn\",\n      ...args,\n    },\n  });\n};\n"],"mappings":";;;;;;AAYA,MAAa,aAAa,EAAE,OAAO;CACjC,QAAQ,EAAE,QAAQ;CAClB,WAAW,EAAE,SAAS,EAAE,QAAQ,CAAC;CACjC,gBAAgB,EAAE,SAAS;CAC5B,CAAC;AAIF,eAAsB,WACpB,KACA,MACA,QACqB;AACrB,cAAa,WAAW,OAAO,oBAAoB,KAAK;CACxD,MAAM,EAAE,QAAQ,WAAW,mBAAmB,mBAAmB;CACjE,MAAM,cAAc;AAOpB,QAAO,MAAM,8BACX,KACA,QACA,aAT6B,qBAK5B,MAAM,kCAAkC,KAAK,QAAQ,YAAY,EAMlE,eACD;;AAGH,MAAa,aAAa,OACxB,KACA,SACwB;AACxB,QAAO,IAAI,YAAY,gBAAgB,EACrC,MAAM;EACJ,MAAM;EACN,GAAG;EACJ,EACF,CAAC"}

package/dist/component/server/mutations/signout.js

@@ -1,27 +0,0 @@
-import { authDb } from "../db.js";
-import { AUTH_STORE_REF } from "./store/refs.js";
-import { deleteSession, getAuthSessionId } from "../sessions.js";
-import { Fx } from "@robelest/fx";
-
-//#region src/server/mutations/signout.ts
-function signOutImpl(ctx, config) {
-	return Fx.gen(function* () {
-		const db = authDb(ctx, config);
-		const sessionId = yield* Fx.promise(() => getAuthSessionId(ctx));
-		if (sessionId === null) return null;
-		const session = yield* Fx.promise(() => db.sessions.getById(sessionId));
-		if (session === null) return null;
-		yield* Fx.promise(() => deleteSession(ctx, session, config));
-		return {
-			userId: session.userId,
-			sessionId: session._id
-		};
-	});
-}
-const callSignOut = async (ctx) => {
-	return ctx.runMutation(AUTH_STORE_REF, { args: { type: "signOut" } });
-};
-
-//#endregion
-export { callSignOut, signOutImpl };
-//# sourceMappingURL=signout.js.map

package/dist/component/server/mutations/signout.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"signout.js","names":[],"sources":["../../../../src/server/mutations/signout.ts"],"sourcesContent":["import { Fx } from \"@robelest/fx\";\nimport type { GenericActionCtx, GenericDataModel } from \"convex/server\";\nimport { GenericId } from \"convex/values\";\n\nimport * as Provider from \"../crypto\";\nimport { authDb } from \"../db\";\nimport { deleteSession, getAuthSessionId } from \"../sessions\";\nimport { MutationCtx } from \"../types\";\nimport { AUTH_STORE_REF } from \"./store/refs\";\n\ntype ReturnType = {\n  userId: GenericId<\"User\">;\n  sessionId: GenericId<\"Session\">;\n} | null;\n\nexport function signOutImpl(\n  ctx: MutationCtx,\n  config: Provider.Config,\n): Fx<ReturnType, never> {\n  return Fx.gen(function* () {\n    const db = authDb(ctx, config);\n    const sessionId = yield* Fx.promise(() => getAuthSessionId(ctx));\n    if (sessionId === null) {\n      return null;\n    }\n    const session = yield* Fx.promise(() => db.sessions.getById(sessionId));\n    if (session === null) {\n      return null;\n    }\n    yield* Fx.promise(() => deleteSession(ctx, session, config));\n    return { userId: session.userId, sessionId: session._id };\n  });\n}\n\nexport const callSignOut = async <DataModel extends GenericDataModel>(\n  ctx: GenericActionCtx<DataModel>,\n): Promise<void> => {\n  return ctx.runMutation(AUTH_STORE_REF, {\n    args: {\n      type: \"signOut\",\n    },\n  });\n};\n"],"mappings":";;;;;;AAeA,SAAgB,YACd,KACA,QACuB;AACvB,QAAO,GAAG,IAAI,aAAa;EACzB,MAAM,KAAK,OAAO,KAAK,OAAO;EAC9B,MAAM,YAAY,OAAO,GAAG,cAAc,iBAAiB,IAAI,CAAC;AAChE,MAAI,cAAc,KAChB,QAAO;EAET,MAAM,UAAU,OAAO,GAAG,cAAc,GAAG,SAAS,QAAQ,UAAU,CAAC;AACvE,MAAI,YAAY,KACd,QAAO;AAET,SAAO,GAAG,cAAc,cAAc,KAAK,SAAS,OAAO,CAAC;AAC5D,SAAO;GAAE,QAAQ,QAAQ;GAAQ,WAAW,QAAQ;GAAK;GACzD;;AAGJ,MAAa,cAAc,OACzB,QACkB;AAClB,QAAO,IAAI,YAAY,gBAAgB,EACrC,MAAM,EACJ,MAAM,WACP,EACF,CAAC"}

package/dist/component/server/mutations/store/refs.js

@@ -1,15 +0,0 @@
-import { makeFunctionReference } from "convex/server";
-
-//#region src/server/mutations/store/refs.ts
-/**
-* Internal function reference for the library's store dispatch mutation.
-*
-* The package cannot import the consumer app's generated `api` module,
-* so it uses a canonical function reference name that matches the app-level
-* `export const { store } = auth` surface.
-*/
-const AUTH_STORE_REF = makeFunctionReference("auth:store");
-
-//#endregion
-export { AUTH_STORE_REF };
-//# sourceMappingURL=refs.js.map

package/dist/component/server/mutations/store/refs.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"refs.js","names":[],"sources":["../../../../../src/server/mutations/store/refs.ts"],"sourcesContent":["import { makeFunctionReference } from \"convex/server\";\n\n/**\n * Internal function reference for the library's store dispatch mutation.\n *\n * The package cannot import the consumer app's generated `api` module,\n * so it uses a canonical function reference name that matches the app-level\n * `export const { store } = auth` surface.\n */\nexport const AUTH_STORE_REF = makeFunctionReference(\"auth:store\") as any;\n"],"mappings":";;;;;;;;;;AASA,MAAa,iBAAiB,sBAAsB,aAAa"}

package/dist/component/server/mutations/store.js

@@ -1,70 +0,0 @@
-import { LOG_LEVELS, logWithLevel } from "../utils.js";
-import { modifyAccountArgs, modifyAccountImpl } from "./account.js";
-import { createVerificationCodeArgs, createVerificationCodeImpl } from "./code.js";
-import { invalidateSessionsArgs, invalidateSessionsImpl } from "./invalidate.js";
-import { userOAuthArgs, userOAuthImpl } from "./oauth.js";
-import { refreshSessionArgs, refreshSessionImpl } from "./refresh.js";
-import { createAccountFromCredentialsArgs, createAccountFromCredentialsImpl } from "./register.js";
-import { retrieveAccountWithCredentialsArgs, retrieveAccountWithCredentialsImpl } from "./retrieve.js";
-import { verifierSignatureArgs, verifierSignatureImpl } from "./signature.js";
-import { signInArgs, signInImpl } from "./signin.js";
-import { signOutImpl } from "./signout.js";
-import { verifierImpl } from "./verifier.js";
-import { verifyCodeAndSignInArgs, verifyCodeAndSignInImpl } from "./verify.js";
-import { Fx } from "@robelest/fx";
-import { v } from "convex/values";
-
-//#region src/server/mutations/store.ts
-const storeArgs = v.object({ args: v.union(v.object({
-	type: v.literal("signIn"),
-	...signInArgs.fields
-}), v.object({ type: v.literal("signOut") }), v.object({
-	type: v.literal("refreshSession"),
-	...refreshSessionArgs.fields
-}), v.object({
-	type: v.literal("verifyCodeAndSignIn"),
-	...verifyCodeAndSignInArgs.fields
-}), v.object({ type: v.literal("verifier") }), v.object({
-	type: v.literal("verifierSignature"),
-	...verifierSignatureArgs.fields
-}), v.object({
-	type: v.literal("userOAuth"),
-	...userOAuthArgs.fields
-}), v.object({
-	type: v.literal("createVerificationCode"),
-	...createVerificationCodeArgs.fields
-}), v.object({
-	type: v.literal("createAccountFromCredentials"),
-	...createAccountFromCredentialsArgs.fields
-}), v.object({
-	type: v.literal("retrieveAccountWithCredentials"),
-	...retrieveAccountWithCredentialsArgs.fields
-}), v.object({
-	type: v.literal("modifyAccount"),
-	...modifyAccountArgs.fields
-}), v.object({
-	type: v.literal("invalidateSessions"),
-	...invalidateSessionsArgs.fields
-})) });
-const storeImpl = async (ctx, fnArgs, getProviderOrThrow, config) => {
-	const args = fnArgs.args;
-	logWithLevel(LOG_LEVELS.INFO, `\`auth:store\` type: ${args.type}`);
-	return Fx.run(Fx.match(args, args.type, {
-		signIn: (a) => Fx.promise(() => signInImpl(ctx, a, config)),
-		signOut: () => signOutImpl(ctx, config),
-		refreshSession: (a) => Fx.promise(() => refreshSessionImpl(ctx, a, getProviderOrThrow, config)),
-		verifyCodeAndSignIn: (a) => Fx.promise(() => verifyCodeAndSignInImpl(ctx, a, getProviderOrThrow, config)),
-		verifier: () => verifierImpl(ctx, config),
-		verifierSignature: (a) => verifierSignatureImpl(ctx, a, config).pipe(Fx.recover((e) => Fx.fatal(e))),
-		userOAuth: (a) => userOAuthImpl(ctx, a, getProviderOrThrow, config).pipe(Fx.recover((e) => Fx.fatal(e))),
-		createVerificationCode: (a) => Fx.promise(() => createVerificationCodeImpl(ctx, a, getProviderOrThrow, config)),
-		createAccountFromCredentials: (a) => Fx.promise(() => createAccountFromCredentialsImpl(ctx, a, getProviderOrThrow, config)),
-		retrieveAccountWithCredentials: (a) => retrieveAccountWithCredentialsImpl(ctx, a, getProviderOrThrow, config),
-		modifyAccount: (a) => modifyAccountImpl(ctx, a, getProviderOrThrow, config).pipe(Fx.recover((e) => Fx.fatal(e))),
-		invalidateSessions: (a) => invalidateSessionsImpl(ctx, a, config)
-	}));
-};
-
-//#endregion
-export { storeArgs, storeImpl };
-//# sourceMappingURL=store.js.map

package/dist/component/server/mutations/store.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"store.js","names":[],"sources":["../../../../src/server/mutations/store.ts"],"sourcesContent":["import { Fx } from \"@robelest/fx\";\nimport { Infer, v } from \"convex/values\";\n\nimport * as Provider from \"../crypto\";\nimport { MutationCtx } from \"../types\";\nimport { LOG_LEVELS, logWithLevel } from \"../utils\";\nimport { modifyAccountArgs, modifyAccountImpl } from \"./account\";\nimport { createVerificationCodeArgs, createVerificationCodeImpl } from \"./code\";\nimport { invalidateSessionsArgs, invalidateSessionsImpl } from \"./invalidate\";\nimport { userOAuthArgs, userOAuthImpl } from \"./oauth\";\nimport { refreshSessionArgs, refreshSessionImpl } from \"./refresh\";\nimport {\n  createAccountFromCredentialsArgs,\n  createAccountFromCredentialsImpl,\n} from \"./register\";\nimport {\n  retrieveAccountWithCredentialsArgs,\n  retrieveAccountWithCredentialsImpl,\n} from \"./retrieve\";\nimport { verifierSignatureArgs, verifierSignatureImpl } from \"./signature\";\nimport { signInArgs, signInImpl } from \"./signin\";\nimport { signOutImpl } from \"./signout\";\nimport { verifierImpl } from \"./verifier\";\nimport { verifyCodeAndSignInArgs, verifyCodeAndSignInImpl } from \"./verify\";\n\nexport const storeArgs = v.object({\n  args: v.union(\n    v.object({\n      type: v.literal(\"signIn\"),\n      ...signInArgs.fields,\n    }),\n    v.object({\n      type: v.literal(\"signOut\"),\n    }),\n    v.object({\n      type: v.literal(\"refreshSession\"),\n      ...refreshSessionArgs.fields,\n    }),\n    v.object({\n      type: v.literal(\"verifyCodeAndSignIn\"),\n      ...verifyCodeAndSignInArgs.fields,\n    }),\n    v.object({\n      type: v.literal(\"verifier\"),\n    }),\n    v.object({\n      type: v.literal(\"verifierSignature\"),\n      ...verifierSignatureArgs.fields,\n    }),\n    v.object({\n      type: v.literal(\"userOAuth\"),\n      ...userOAuthArgs.fields,\n    }),\n    v.object({\n      type: v.literal(\"createVerificationCode\"),\n      ...createVerificationCodeArgs.fields,\n    }),\n    v.object({\n      type: v.literal(\"createAccountFromCredentials\"),\n      ...createAccountFromCredentialsArgs.fields,\n    }),\n    v.object({\n      type: v.literal(\"retrieveAccountWithCredentials\"),\n      ...retrieveAccountWithCredentialsArgs.fields,\n    }),\n    v.object({\n      type: v.literal(\"modifyAccount\"),\n      ...modifyAccountArgs.fields,\n    }),\n    v.object({\n      type: v.literal(\"invalidateSessions\"),\n      ...invalidateSessionsArgs.fields,\n    }),\n  ),\n});\n\nexport const storeImpl = async (\n  ctx: MutationCtx,\n  fnArgs: Infer<typeof storeArgs>,\n  getProviderOrThrow: Provider.GetProviderOrThrowFunc,\n  config: Provider.Config,\n) => {\n  const args = fnArgs.args;\n  logWithLevel(LOG_LEVELS.INFO, `\\`auth:store\\` type: ${args.type}`);\n  return Fx.run(\n    Fx.match(args, args.type, {\n      signIn: (a) => Fx.promise(() => signInImpl(ctx, a, config)),\n      signOut: () => signOutImpl(ctx, config),\n      refreshSession: (a) =>\n        Fx.promise(() =>\n          refreshSessionImpl(ctx, a, getProviderOrThrow, config),\n        ),\n      verifyCodeAndSignIn: (a) =>\n        Fx.promise(() =>\n          verifyCodeAndSignInImpl(ctx, a, getProviderOrThrow, config),\n        ),\n      verifier: () => verifierImpl(ctx, config),\n      verifierSignature: (a) =>\n        verifierSignatureImpl(ctx, a, config).pipe(\n          Fx.recover((e) => Fx.fatal(e)),\n        ),\n      userOAuth: (a) =>\n        userOAuthImpl(ctx, a, getProviderOrThrow, config).pipe(\n          Fx.recover((e) => Fx.fatal(e)),\n        ),\n      createVerificationCode: (a) =>\n        Fx.promise(() =>\n          createVerificationCodeImpl(ctx, a, getProviderOrThrow, config),\n        ),\n      createAccountFromCredentials: (a) =>\n        Fx.promise(() =>\n          createAccountFromCredentialsImpl(ctx, a, getProviderOrThrow, config),\n        ),\n      retrieveAccountWithCredentials: (a) =>\n        retrieveAccountWithCredentialsImpl(ctx, a, getProviderOrThrow, config),\n      modifyAccount: (a) =>\n        modifyAccountImpl(ctx, a, getProviderOrThrow, config).pipe(\n          Fx.recover((e) => Fx.fatal(e)),\n        ),\n      invalidateSessions: (a) => invalidateSessionsImpl(ctx, a, config),\n    }),\n  );\n};\n"],"mappings":";;;;;;;;;;;;;;;;;AAyBA,MAAa,YAAY,EAAE,OAAO,EAChC,MAAM,EAAE,MACN,EAAE,OAAO;CACP,MAAM,EAAE,QAAQ,SAAS;CACzB,GAAG,WAAW;CACf,CAAC,EACF,EAAE,OAAO,EACP,MAAM,EAAE,QAAQ,UAAU,EAC3B,CAAC,EACF,EAAE,OAAO;CACP,MAAM,EAAE,QAAQ,iBAAiB;CACjC,GAAG,mBAAmB;CACvB,CAAC,EACF,EAAE,OAAO;CACP,MAAM,EAAE,QAAQ,sBAAsB;CACtC,GAAG,wBAAwB;CAC5B,CAAC,EACF,EAAE,OAAO,EACP,MAAM,EAAE,QAAQ,WAAW,EAC5B,CAAC,EACF,EAAE,OAAO;CACP,MAAM,EAAE,QAAQ,oBAAoB;CACpC,GAAG,sBAAsB;CAC1B,CAAC,EACF,EAAE,OAAO;CACP,MAAM,EAAE,QAAQ,YAAY;CAC5B,GAAG,cAAc;CAClB,CAAC,EACF,EAAE,OAAO;CACP,MAAM,EAAE,QAAQ,yBAAyB;CACzC,GAAG,2BAA2B;CAC/B,CAAC,EACF,EAAE,OAAO;CACP,MAAM,EAAE,QAAQ,+BAA+B;CAC/C,GAAG,iCAAiC;CACrC,CAAC,EACF,EAAE,OAAO;CACP,MAAM,EAAE,QAAQ,iCAAiC;CACjD,GAAG,mCAAmC;CACvC,CAAC,EACF,EAAE,OAAO;CACP,MAAM,EAAE,QAAQ,gBAAgB;CAChC,GAAG,kBAAkB;CACtB,CAAC,EACF,EAAE,OAAO;CACP,MAAM,EAAE,QAAQ,qBAAqB;CACrC,GAAG,uBAAuB;CAC3B,CAAC,CACH,EACF,CAAC;AAEF,MAAa,YAAY,OACvB,KACA,QACA,oBACA,WACG;CACH,MAAM,OAAO,OAAO;AACpB,cAAa,WAAW,MAAM,wBAAwB,KAAK,OAAO;AAClE,QAAO,GAAG,IACR,GAAG,MAAM,MAAM,KAAK,MAAM;EACxB,SAAS,MAAM,GAAG,cAAc,WAAW,KAAK,GAAG,OAAO,CAAC;EAC3D,eAAe,YAAY,KAAK,OAAO;EACvC,iBAAiB,MACf,GAAG,cACD,mBAAmB,KAAK,GAAG,oBAAoB,OAAO,CACvD;EACH,sBAAsB,MACpB,GAAG,cACD,wBAAwB,KAAK,GAAG,oBAAoB,OAAO,CAC5D;EACH,gBAAgB,aAAa,KAAK,OAAO;EACzC,oBAAoB,MAClB,sBAAsB,KAAK,GAAG,OAAO,CAAC,KACpC,GAAG,SAAS,MAAM,GAAG,MAAM,EAAE,CAAC,CAC/B;EACH,YAAY,MACV,cAAc,KAAK,GAAG,oBAAoB,OAAO,CAAC,KAChD,GAAG,SAAS,MAAM,GAAG,MAAM,EAAE,CAAC,CAC/B;EACH,yBAAyB,MACvB,GAAG,cACD,2BAA2B,KAAK,GAAG,oBAAoB,OAAO,CAC/D;EACH,+BAA+B,MAC7B,GAAG,cACD,iCAAiC,KAAK,GAAG,oBAAoB,OAAO,CACrE;EACH,iCAAiC,MAC/B,mCAAmC,KAAK,GAAG,oBAAoB,OAAO;EACxE,gBAAgB,MACd,kBAAkB,KAAK,GAAG,oBAAoB,OAAO,CAAC,KACpD,GAAG,SAAS,MAAM,GAAG,MAAM,EAAE,CAAC,CAC/B;EACH,qBAAqB,MAAM,uBAAuB,KAAK,GAAG,OAAO;EAClE,CAAC,CACH"}

package/dist/component/server/mutations/verifier.js

@@ -1,18 +0,0 @@
-import { authDb } from "../db.js";
-import { AUTH_STORE_REF } from "./store/refs.js";
-import { getAuthSessionId } from "../sessions.js";
-import { Fx } from "@robelest/fx";
-
-//#region src/server/mutations/verifier.ts
-function verifierImpl(ctx, config) {
-	return Fx.gen(function* () {
-		return yield* Fx.promise(async () => authDb(ctx, config).verifiers.create(await getAuthSessionId(ctx) ?? void 0));
-	});
-}
-const callVerifier = async (ctx) => {
-	return ctx.runMutation(AUTH_STORE_REF, { args: { type: "verifier" } });
-};
-
-//#endregion
-export { callVerifier, verifierImpl };
-//# sourceMappingURL=verifier.js.map

package/dist/component/server/mutations/verifier.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"verifier.js","names":[],"sources":["../../../../src/server/mutations/verifier.ts"],"sourcesContent":["import { Fx } from \"@robelest/fx\";\nimport type { GenericActionCtx, GenericDataModel } from \"convex/server\";\nimport { GenericId } from \"convex/values\";\n\nimport * as Provider from \"../crypto\";\nimport { authDb } from \"../db\";\nimport { getAuthSessionId } from \"../sessions\";\nimport { MutationCtx } from \"../types\";\nimport { AUTH_STORE_REF } from \"./store/refs\";\n\ntype ReturnType = GenericId<\"AuthVerifier\">;\n\nexport function verifierImpl(\n  ctx: MutationCtx,\n  config: Provider.Config,\n): Fx<ReturnType, never> {\n  return Fx.gen(function* () {\n    return (yield* Fx.promise(async () =>\n      authDb(ctx, config).verifiers.create(\n        (await getAuthSessionId(ctx)) ?? undefined,\n      ),\n    )) as ReturnType;\n  });\n}\n\nexport const callVerifier = async <DataModel extends GenericDataModel>(\n  ctx: GenericActionCtx<DataModel>,\n): Promise<ReturnType> => {\n  return ctx.runMutation(AUTH_STORE_REF, {\n    args: {\n      type: \"verifier\",\n    },\n  });\n};\n"],"mappings":";;;;;;AAYA,SAAgB,aACd,KACA,QACuB;AACvB,QAAO,GAAG,IAAI,aAAa;AACzB,SAAQ,OAAO,GAAG,QAAQ,YACxB,OAAO,KAAK,OAAO,CAAC,UAAU,OAC3B,MAAM,iBAAiB,IAAI,IAAK,OAClC,CACF;GACD;;AAGJ,MAAa,eAAe,OAC1B,QACwB;AACxB,QAAO,IAAI,YAAY,gBAAgB,EACrC,MAAM,EACJ,MAAM,YACP,EACF,CAAC"}

package/dist/component/server/mutations/verify.js

@@ -1,98 +0,0 @@
-import { LOG_LEVELS, logWithLevel, requireEnv, sha256 } from "../utils.js";
-import { authDb } from "../db.js";
-import { AUTH_STORE_REF } from "./store/refs.js";
-import { createNewAndDeleteExistingSession, getAuthSessionId, maybeGenerateTokensForSession } from "../sessions.js";
-import { upsertUserAndAccount } from "../users.js";
-import { isEnterpriseProviderId } from "../enterprise/shared.js";
-import { createSyntheticOAuthMaterializedConfig } from "../enterprise/oidc.js";
-import { isSignInRateLimited, recordFailedSignIn, resetSignInRateLimit } from "../limits.js";
-import { Fx } from "@robelest/fx";
-import { v } from "convex/values";
-
-//#region src/server/mutations/verify.ts
-const verifyCodeAndSignInArgs = v.object({
-	params: v.any(),
-	provider: v.optional(v.string()),
-	verifier: v.optional(v.string()),
-	generateTokens: v.boolean(),
-	allowExtraProviders: v.boolean()
-});
-/** A soft verification failure — logged and collapsed to null at the boundary. */
-var VerifyFailure = class {
-	_tag = "VerifyFailure";
-	constructor(reason) {
-		this.reason = reason;
-	}
-};
-async function verifyCodeAndSignInImpl(ctx, args, getProviderOrThrow, config) {
-	logWithLevel(LOG_LEVELS.DEBUG, "verifyCodeAndSignInImpl args:", {
-		params: {
-			email: args.params.email,
-			phone: args.params.phone
-		},
-		provider: args.provider,
-		verifier: args.verifier,
-		generateTokens: args.generateTokens,
-		allowExtraProviders: args.allowExtraProviders
-	});
-	const { generateTokens, provider, allowExtraProviders } = args;
-	if (generateTokens) {
-		requireEnv("JWT_PRIVATE_KEY");
-		requireEnv("JWKS");
-		requireEnv("CONVEX_SITE_URL");
-	}
-	const identifier = args.params.email ?? args.params.phone;
-	try {
-		if (identifier !== void 0) {
-			if (await Fx.run(isSignInRateLimited(ctx, identifier, config))) throw new VerifyFailure("Too many failed attempts to verify code for this email");
-		}
-		const db = authDb(ctx, config);
-		const { params, verifier } = args;
-		const hash = await sha256(params.code);
-		const code = await db.verificationCodes.getByCode(hash);
-		if (code === null) throw new VerifyFailure("Invalid verification code");
-		await db.verificationCodes.delete(code._id);
-		if (code.verifier !== verifier) throw new VerifyFailure("Invalid verifier");
-		if (code.expirationTime < Date.now()) throw new VerifyFailure("Expired verification code");
-		if (provider !== void 0 && code.provider !== provider) throw new VerifyFailure(`Invalid provider "${provider}" for given \`code\``);
-		const account = await db.accounts.getById(code.accountId);
-		if (account === null) throw new VerifyFailure("Account associated with this email has been deleted");
-		const codeProvider = isEnterpriseProviderId(code.provider) ? createSyntheticOAuthMaterializedConfig(code.provider) : getProviderOrThrow(code.provider, allowExtraProviders);
-		if (codeProvider !== null && (codeProvider.type === "email" || codeProvider.type === "phone") && codeProvider.authorize !== void 0) await codeProvider.authorize(args.params, account);
-		const methodProvider = isEnterpriseProviderId(account.provider) ? createSyntheticOAuthMaterializedConfig(account.provider) : getProviderOrThrow(account.provider);
-		const userId = methodProvider.type === "oauth" ? account.userId : (await upsertUserAndAccount(ctx, await getAuthSessionId(ctx), { existingAccount: account }, {
-			type: "verification",
-			provider: methodProvider,
-			profile: {
-				...code.emailVerified !== void 0 ? {
-					email: code.emailVerified,
-					emailVerified: true
-				} : {},
-				...code.phoneVerified !== void 0 ? {
-					phone: code.phoneVerified,
-					phoneVerified: true
-				} : {}
-			}
-		}, config)).userId;
-		if (identifier !== void 0) await Fx.run(resetSignInRateLimit(ctx, identifier, config));
-		return await maybeGenerateTokensForSession(ctx, config, userId, await createNewAndDeleteExistingSession(ctx, config, userId), generateTokens);
-	} catch (error) {
-		if (error instanceof VerifyFailure) {
-			logWithLevel(LOG_LEVELS.ERROR, error.reason);
-			if (identifier !== void 0) await Fx.run(recordFailedSignIn(ctx, identifier, config));
-			return null;
-		}
-		logWithLevel(LOG_LEVELS.ERROR, `verifyCodeAndSignInImpl failed: ${String(error)}`);
-		return null;
-	}
-}
-const callVerifyCodeAndSignIn = async (ctx, args) => {
-	return ctx.runMutation(AUTH_STORE_REF, { args: {
-		type: "verifyCodeAndSignIn",
-		...args
-	} });
-};
-
-//#endregion
-export { callVerifyCodeAndSignIn, verifyCodeAndSignInArgs, verifyCodeAndSignInImpl };
-//# sourceMappingURL=verify.js.map

package/dist/component/server/mutations/verify.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"verify.js","names":[],"sources":["../../../../src/server/mutations/verify.ts"],"sourcesContent":["import { Fx } from \"@robelest/fx\";\nimport type { GenericActionCtx, GenericDataModel } from \"convex/server\";\nimport { Infer, v } from \"convex/values\";\n\nimport * as Provider from \"../crypto\";\nimport { authDb } from \"../db\";\nimport { createSyntheticOAuthMaterializedConfig } from \"../enterprise/oidc\";\nimport { isEnterpriseProviderId } from \"../enterprise/shared\";\nimport {\n  isSignInRateLimited,\n  recordFailedSignIn,\n  resetSignInRateLimit,\n} from \"../limits\";\nimport {\n  createNewAndDeleteExistingSession,\n  getAuthSessionId,\n  maybeGenerateTokensForSession,\n} from \"../sessions\";\nimport { MutationCtx, SessionInfo } from \"../types\";\nimport { upsertUserAndAccount } from \"../users\";\nimport { LOG_LEVELS, logWithLevel, sha256 } from \"../utils\";\nimport { requireEnv } from \"../utils\";\nimport { AUTH_STORE_REF } from \"./store/refs\";\n\nexport const verifyCodeAndSignInArgs = v.object({\n  params: v.any(),\n  provider: v.optional(v.string()),\n  verifier: v.optional(v.string()),\n  generateTokens: v.boolean(),\n  allowExtraProviders: v.boolean(),\n});\n\ntype ReturnType = null | SessionInfo;\n\n// ============================================================================\n// Small validators for the verification pipeline\n// ============================================================================\n\n/** A soft verification failure — logged and collapsed to null at the boundary. */\nclass VerifyFailure {\n  readonly _tag = \"VerifyFailure\" as const;\n  constructor(readonly reason: string) {}\n}\n\n// ============================================================================\n// Main exported function\n// ============================================================================\n\nexport async function verifyCodeAndSignInImpl(\n  ctx: MutationCtx,\n  args: Infer<typeof verifyCodeAndSignInArgs>,\n  getProviderOrThrow: Provider.GetProviderOrThrowFunc,\n  config: Provider.Config,\n): Promise<ReturnType> {\n  logWithLevel(LOG_LEVELS.DEBUG, \"verifyCodeAndSignInImpl args:\", {\n    params: { email: args.params.email, phone: args.params.phone },\n    provider: args.provider,\n    verifier: args.verifier,\n    generateTokens: args.generateTokens,\n    allowExtraProviders: args.allowExtraProviders,\n  });\n\n  const { generateTokens, provider, allowExtraProviders } = args;\n  if (generateTokens) {\n    requireEnv(\"JWT_PRIVATE_KEY\");\n    requireEnv(\"JWKS\");\n    requireEnv(\"CONVEX_SITE_URL\");\n  }\n  const identifier: string | undefined = args.params.email ?? args.params.phone;\n\n  try {\n    if (identifier !== undefined) {\n      const limited = await Fx.run(\n        isSignInRateLimited(ctx, identifier, config),\n      );\n      if (limited) {\n        throw new VerifyFailure(\n          \"Too many failed attempts to verify code for this email\",\n        );\n      }\n    }\n\n    const db = authDb(ctx, config);\n    const { params, verifier } = args;\n    const hash = await sha256(params.code);\n    const code = await db.verificationCodes.getByCode(hash);\n    if (code === null) {\n      throw new VerifyFailure(\"Invalid verification code\");\n    }\n\n    await db.verificationCodes.delete(code._id);\n\n    if (code.verifier !== verifier) {\n      throw new VerifyFailure(\"Invalid verifier\");\n    }\n    if (code.expirationTime < Date.now()) {\n      throw new VerifyFailure(\"Expired verification code\");\n    }\n    if (provider !== undefined && code.provider !== provider) {\n      throw new VerifyFailure(\n        `Invalid provider \"${provider}\" for given \\`code\\``,\n      );\n    }\n\n    const account = await db.accounts.getById(code.accountId);\n    if (account === null) {\n      throw new VerifyFailure(\n        \"Account associated with this email has been deleted\",\n      );\n    }\n\n    const codeProvider = isEnterpriseProviderId(code.provider)\n      ? createSyntheticOAuthMaterializedConfig(code.provider)\n      : getProviderOrThrow(code.provider, allowExtraProviders);\n\n    if (\n      codeProvider !== null &&\n      (codeProvider.type === \"email\" || codeProvider.type === \"phone\") &&\n      codeProvider.authorize !== undefined\n    ) {\n      await codeProvider.authorize(args.params, account);\n    }\n\n    const methodProvider = isEnterpriseProviderId(account.provider)\n      ? createSyntheticOAuthMaterializedConfig(account.provider)\n      : getProviderOrThrow(account.provider);\n\n    const userId =\n      methodProvider.type === \"oauth\"\n        ? account.userId\n        : (\n            await upsertUserAndAccount(\n              ctx,\n              await getAuthSessionId(ctx),\n              { existingAccount: account },\n              {\n                type: \"verification\",\n                provider: methodProvider,\n                profile: {\n                  ...(code.emailVerified !== undefined\n                    ? { email: code.emailVerified, emailVerified: true }\n                    : {}),\n                  ...(code.phoneVerified !== undefined\n                    ? { phone: code.phoneVerified, phoneVerified: true }\n                    : {}),\n                },\n              },\n              config,\n            )\n          ).userId;\n\n    if (identifier !== undefined) {\n      await Fx.run(resetSignInRateLimit(ctx, identifier, config));\n    }\n\n    const sessionId = await createNewAndDeleteExistingSession(\n      ctx,\n      config,\n      userId,\n    );\n    return await maybeGenerateTokensForSession(\n      ctx,\n      config,\n      userId,\n      sessionId,\n      generateTokens,\n    );\n  } catch (error) {\n    if (error instanceof VerifyFailure) {\n      logWithLevel(LOG_LEVELS.ERROR, error.reason);\n      if (identifier !== undefined) {\n        await Fx.run(recordFailedSignIn(ctx, identifier, config));\n      }\n      return null;\n    }\n    logWithLevel(\n      LOG_LEVELS.ERROR,\n      `verifyCodeAndSignInImpl failed: ${String(error)}`,\n    );\n    return null;\n  }\n}\n\n// ============================================================================\n// Action-level caller (unchanged — just forwards to mutation)\n// ============================================================================\n\nexport const callVerifyCodeAndSignIn = async <\n  DataModel extends GenericDataModel,\n>(\n  ctx: GenericActionCtx<DataModel>,\n  args: Infer<typeof verifyCodeAndSignInArgs>,\n): Promise<ReturnType> => {\n  return ctx.runMutation(AUTH_STORE_REF, {\n    args: {\n      type: \"verifyCodeAndSignIn\",\n      ...args,\n    },\n  });\n};\n"],"mappings":";;;;;;;;;;;;AAwBA,MAAa,0BAA0B,EAAE,OAAO;CAC9C,QAAQ,EAAE,KAAK;CACf,UAAU,EAAE,SAAS,EAAE,QAAQ,CAAC;CAChC,UAAU,EAAE,SAAS,EAAE,QAAQ,CAAC;CAChC,gBAAgB,EAAE,SAAS;CAC3B,qBAAqB,EAAE,SAAS;CACjC,CAAC;;AASF,IAAM,gBAAN,MAAoB;CAClB,AAAS,OAAO;CAChB,YAAY,AAAS,QAAgB;EAAhB;;;AAOvB,eAAsB,wBACpB,KACA,MACA,oBACA,QACqB;AACrB,cAAa,WAAW,OAAO,iCAAiC;EAC9D,QAAQ;GAAE,OAAO,KAAK,OAAO;GAAO,OAAO,KAAK,OAAO;GAAO;EAC9D,UAAU,KAAK;EACf,UAAU,KAAK;EACf,gBAAgB,KAAK;EACrB,qBAAqB,KAAK;EAC3B,CAAC;CAEF,MAAM,EAAE,gBAAgB,UAAU,wBAAwB;AAC1D,KAAI,gBAAgB;AAClB,aAAW,kBAAkB;AAC7B,aAAW,OAAO;AAClB,aAAW,kBAAkB;;CAE/B,MAAM,aAAiC,KAAK,OAAO,SAAS,KAAK,OAAO;AAExE,KAAI;AACF,MAAI,eAAe,QAIjB;OAHgB,MAAM,GAAG,IACvB,oBAAoB,KAAK,YAAY,OAAO,CAC7C,CAEC,OAAM,IAAI,cACR,yDACD;;EAIL,MAAM,KAAK,OAAO,KAAK,OAAO;EAC9B,MAAM,EAAE,QAAQ,aAAa;EAC7B,MAAM,OAAO,MAAM,OAAO,OAAO,KAAK;EACtC,MAAM,OAAO,MAAM,GAAG,kBAAkB,UAAU,KAAK;AACvD,MAAI,SAAS,KACX,OAAM,IAAI,cAAc,4BAA4B;AAGtD,QAAM,GAAG,kBAAkB,OAAO,KAAK,IAAI;AAE3C,MAAI,KAAK,aAAa,SACpB,OAAM,IAAI,cAAc,mBAAmB;AAE7C,MAAI,KAAK,iBAAiB,KAAK,KAAK,CAClC,OAAM,IAAI,cAAc,4BAA4B;AAEtD,MAAI,aAAa,UAAa,KAAK,aAAa,SAC9C,OAAM,IAAI,cACR,qBAAqB,SAAS,sBAC/B;EAGH,MAAM,UAAU,MAAM,GAAG,SAAS,QAAQ,KAAK,UAAU;AACzD,MAAI,YAAY,KACd,OAAM,IAAI,cACR,sDACD;EAGH,MAAM,eAAe,uBAAuB,KAAK,SAAS,GACtD,uCAAuC,KAAK,SAAS,GACrD,mBAAmB,KAAK,UAAU,oBAAoB;AAE1D,MACE,iBAAiB,SAChB,aAAa,SAAS,WAAW,aAAa,SAAS,YACxD,aAAa,cAAc,OAE3B,OAAM,aAAa,UAAU,KAAK,QAAQ,QAAQ;EAGpD,MAAM,iBAAiB,uBAAuB,QAAQ,SAAS,GAC3D,uCAAuC,QAAQ,SAAS,GACxD,mBAAmB,QAAQ,SAAS;EAExC,MAAM,SACJ,eAAe,SAAS,UACpB,QAAQ,UAEN,MAAM,qBACJ,KACA,MAAM,iBAAiB,IAAI,EAC3B,EAAE,iBAAiB,SAAS,EAC5B;GACE,MAAM;GACN,UAAU;GACV,SAAS;IACP,GAAI,KAAK,kBAAkB,SACvB;KAAE,OAAO,KAAK;KAAe,eAAe;KAAM,GAClD,EAAE;IACN,GAAI,KAAK,kBAAkB,SACvB;KAAE,OAAO,KAAK;KAAe,eAAe;KAAM,GAClD,EAAE;IACP;GACF,EACD,OACD,EACD;AAER,MAAI,eAAe,OACjB,OAAM,GAAG,IAAI,qBAAqB,KAAK,YAAY,OAAO,CAAC;AAQ7D,SAAO,MAAM,8BACX,KACA,QACA,QARgB,MAAM,kCACtB,KACA,QACA,OACD,EAMC,eACD;UACM,OAAO;AACd,MAAI,iBAAiB,eAAe;AAClC,gBAAa,WAAW,OAAO,MAAM,OAAO;AAC5C,OAAI,eAAe,OACjB,OAAM,GAAG,IAAI,mBAAmB,KAAK,YAAY,OAAO,CAAC;AAE3D,UAAO;;AAET,eACE,WAAW,OACX,mCAAmC,OAAO,MAAM,GACjD;AACD,SAAO;;;AAQX,MAAa,0BAA0B,OAGrC,KACA,SACwB;AACxB,QAAO,IAAI,YAAY,gBAAgB,EACrC,MAAM;EACJ,MAAM;EACN,GAAG;EACJ,EACF,CAAC"}