@robelest/convex-auth 0.0.4-preview.25 → 0.0.4-preview.28

package/dist/component/server/refresh.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"refresh.js","names":[],"sources":["../../../src/server/refresh.ts"],"sourcesContent":["import { Fx } from \"@robelest/fx\";\nimport { Cv } from \"@robelest/fx/convex\";\nimport { ConvexError, GenericId } from \"convex/values\";\n\nimport { authDb } from \"./db\";\nimport { Doc, MutationCtx } from \"./types\";\nimport { ConvexAuthConfig } from \"./types\";\nimport {\n  LOG_LEVELS,\n  REFRESH_TOKEN_DIVIDER,\n  logWithLevel,\n  maybeRedact,\n} from \"./utils\";\n\nconst DEFAULT_SESSION_INACTIVE_DURATION_MS = 1000 * 60 * 60 * 24 * 30; // 30 days\n/** @internal */\nexport const REFRESH_TOKEN_REUSE_WINDOW_MS = 10 * 1000; // 10 seconds\n\n// ---------------------------------------------------------------------------\n// Refresh token CRUD\n// ---------------------------------------------------------------------------\n\n/**\n * Create a new refresh token for the given session.\n */\n/** @internal */\nexport async function createRefreshToken(\n  ctx: MutationCtx,\n  config: ConvexAuthConfig,\n  sessionId: GenericId<\"Session\">,\n  parentRefreshTokenId: GenericId<\"RefreshToken\"> | null,\n): Promise<GenericId<\"RefreshToken\">> {\n  const expirationTime =\n    Date.now() +\n    (config.session?.inactiveDurationMs ??\n      (process.env.AUTH_SESSION_INACTIVE_DURATION_MS !== undefined\n        ? Number(process.env.AUTH_SESSION_INACTIVE_DURATION_MS)\n        : undefined) ??\n      DEFAULT_SESSION_INACTIVE_DURATION_MS);\n\n  return authDb(ctx, config).refreshTokens.create({\n    sessionId,\n    expirationTime,\n    parentRefreshTokenId: parentRefreshTokenId ?? undefined,\n  }) as Promise<GenericId<\"RefreshToken\">>;\n}\n\n/**\n * Parse a compound refresh token string into its constituent IDs.\n */\n/** @internal */\nexport const parseRefreshToken = (\n  refreshToken: string,\n): Fx<\n  {\n    refreshTokenId: GenericId<\"RefreshToken\">;\n    sessionId: GenericId<\"Session\">;\n  },\n  ConvexError<any>\n> => {\n  const [refreshTokenId, sessionId] = refreshToken.split(REFRESH_TOKEN_DIVIDER);\n  const msg = `Can't parse refresh token: ${maybeRedact(refreshToken)}`;\n  const refreshTokenIdFx: Fx<string, ConvexError<any>> = refreshTokenId != null\n    ? Fx.succeed(refreshTokenId)\n    : Cv.fail({ code: \"INVALID_REFRESH_TOKEN\", message: msg });\n\n  return refreshTokenIdFx.pipe(\n    Fx.chain((rtId) => {\n      const sessionIdFx: Fx<string, ConvexError<any>> = sessionId != null\n        ? Fx.succeed(sessionId)\n        : Cv.fail({ code: \"INVALID_REFRESH_TOKEN\", message: msg });\n      return sessionIdFx.pipe(\n        Fx.map((sId) => ({\n          refreshTokenId: rtId as GenericId<\"RefreshToken\">,\n          sessionId: sId as GenericId<\"Session\">,\n        })),\n      );\n    }),\n  );\n};\n\n/**\n * Mark all refresh tokens descending from the given refresh token as invalid\n * immediately. Used when we detect token reuse — revoke the entire tree.\n */\n/** @internal */\nexport async function invalidateRefreshTokensInSubtree(\n  ctx: MutationCtx,\n  refreshToken: Doc<\"RefreshToken\">,\n  config: ConvexAuthConfig,\n) {\n  const db = authDb(ctx, config);\n  const tokensToInvalidate = [refreshToken];\n  const visited = new Set<GenericId<\"RefreshToken\">>([refreshToken._id]);\n  let frontier: GenericId<\"RefreshToken\">[] = [refreshToken._id];\n  while (frontier.length > 0) {\n    const nextFrontier: GenericId<\"RefreshToken\">[] = [];\n    for (const currentTokenId of frontier) {\n      const children = (await db.refreshTokens.getChildren(\n        refreshToken.sessionId,\n        currentTokenId,\n      )) as Doc<\"RefreshToken\">[];\n      for (const child of children) {\n        if (visited.has(child._id)) continue;\n        visited.add(child._id);\n        tokensToInvalidate.push(child);\n        nextFrontier.push(child._id);\n      }\n    }\n    frontier = nextFrontier;\n  }\n  await Fx.run(\n    Fx.each(tokensToInvalidate, (token) =>\n      token.firstUsedTime === undefined ||\n      token.firstUsedTime > Date.now() - REFRESH_TOKEN_REUSE_WINDOW_MS\n        ? Fx.promise(() =>\n            db.refreshTokens.patch(token._id, {\n              firstUsedTime: Date.now() - REFRESH_TOKEN_REUSE_WINDOW_MS,\n            }),\n          )\n        : Fx.unit,\n    ),\n  );\n  return tokensToInvalidate;\n}\n\n// ---------------------------------------------------------------------------\n// Validation pipeline — the core of refresh token handling\n// ---------------------------------------------------------------------------\n\n/**\n * Validate a refresh token and its associated session.\n *\n * Returns `null` on any validation failure (matching original semantics).\n * Each validation step is a small composable function chained with `Fx.chain`.\n * On failure, the error message is logged and the pipeline folds to `null`.\n */\n/** @internal */\nexport const refreshTokenIfValid = (\n  ctx: MutationCtx,\n  refreshTokenId: string,\n  tokenSessionId: string,\n  config: ConvexAuthConfig,\n): Fx<\n  { session: Doc<\"Session\">; refreshTokenDoc: Doc<\"RefreshToken\"> } | null,\n  never\n> => {\n  const db = authDb(ctx, config);\n\n  const fetchDoc = <T>(\n    promise: () => Promise<T | null>,\n    failMsg: string,\n  ): Fx<T | null, never> =>\n    Fx.from({ ok: promise, err: () => failMsg }).pipe(\n      Fx.recover((msg) => {\n        logWithLevel(LOG_LEVELS.ERROR, msg);\n        return Fx.succeed(null as T | null);\n      }),\n    );\n\n  // The entire validation is a single pipeline:\n  // fetch token → not null → not expired → session matches → fetch session → not null → not expired → combine\n  return fetchDoc(\n    () =>\n      db.refreshTokens.getById(\n        refreshTokenId as GenericId<\"RefreshToken\">,\n      ) as Promise<Doc<\"RefreshToken\"> | null>,\n    \"Invalid refresh token format\",\n  )\n    .pipe(\n      Fx.chain((doc) =>\n        doc !== null ? Fx.succeed(doc) : Fx.fail(\"Invalid refresh token\"),\n      ),\n      Fx.chain((doc) =>\n        doc.expirationTime >= Date.now()\n          ? Fx.succeed(doc)\n          : Fx.fail(\"Expired refresh token\"),\n      ),\n      Fx.chain((doc) =>\n        doc.sessionId === tokenSessionId\n          ? Fx.succeed(doc)\n          : Fx.fail(\"Invalid refresh token session ID\"),\n      ),\n    )\n    .pipe(\n      Fx.chain((doc: Doc<\"RefreshToken\">) =>\n        fetchDoc(\n          () =>\n            db.sessions.getById(\n              doc.sessionId,\n            ) as Promise<Doc<\"Session\"> | null>,\n          \"Invalid refresh token session format\",\n        ).pipe(\n          Fx.chain((session) =>\n            session !== null\n              ? Fx.succeed(session)\n              : Fx.fail(\"Invalid refresh token session\"),\n          ),\n          Fx.chain((session) =>\n            session.expirationTime >= Date.now()\n              ? Fx.succeed(session)\n              : Fx.fail(\"Expired refresh token session\"),\n          ),\n          Fx.map((session) => ({\n            session,\n            refreshTokenDoc: doc,\n          })),\n        ),\n      ),\n      Fx.fold({\n        ok: (result) => result,\n        err: (msg) => {\n          logWithLevel(LOG_LEVELS.ERROR, msg);\n          return null;\n        },\n      }),\n    );\n};\n"],"mappings":";;;;;;AAcA,MAAM,uCAAuC,MAAO,KAAK,KAAK,KAAK;;AAEnE,MAAa,gCAAgC,KAAK;;;;;AAUlD,eAAsB,mBACpB,KACA,QACA,WACA,sBACoC;CACpC,MAAM,iBACJ,KAAK,KAAK,IACT,OAAO,SAAS,uBACd,QAAQ,IAAI,sCAAsC,SAC/C,OAAO,QAAQ,IAAI,kCAAkC,GACrD,WACJ;AAEJ,QAAO,OAAO,KAAK,OAAO,CAAC,cAAc,OAAO;EAC9C;EACA;EACA,sBAAsB,wBAAwB;EAC/C,CAAC;;;;;;AAOJ,MAAa,qBACX,iBAOG;CACH,MAAM,CAAC,gBAAgB,aAAa,aAAa,MAAM,sBAAsB;CAC7E,MAAM,MAAM,8BAA8B,YAAY,aAAa;AAKnE,SAJuD,kBAAkB,OACrE,GAAG,QAAQ,eAAe,GAC1B,GAAG,KAAK;EAAE,MAAM;EAAyB,SAAS;EAAK,CAAC,EAEpC,KACtB,GAAG,OAAO,SAAS;AAIjB,UAHkD,aAAa,OAC3D,GAAG,QAAQ,UAAU,GACrB,GAAG,KAAK;GAAE,MAAM;GAAyB,SAAS;GAAK,CAAC,EACzC,KACjB,GAAG,KAAK,SAAS;GACf,gBAAgB;GAChB,WAAW;GACZ,EAAE,CACJ;GACD,CACH;;;;;;;AAQH,eAAsB,iCACpB,KACA,cACA,QACA;CACA,MAAM,KAAK,OAAO,KAAK,OAAO;CAC9B,MAAM,qBAAqB,CAAC,aAAa;CACzC,MAAM,UAAU,IAAI,IAA+B,CAAC,aAAa,IAAI,CAAC;CACtE,IAAI,WAAwC,CAAC,aAAa,IAAI;AAC9D,QAAO,SAAS,SAAS,GAAG;EAC1B,MAAM,eAA4C,EAAE;AACpD,OAAK,MAAM,kBAAkB,UAAU;GACrC,MAAM,WAAY,MAAM,GAAG,cAAc,YACvC,aAAa,WACb,eACD;AACD,QAAK,MAAM,SAAS,UAAU;AAC5B,QAAI,QAAQ,IAAI,MAAM,IAAI,CAAE;AAC5B,YAAQ,IAAI,MAAM,IAAI;AACtB,uBAAmB,KAAK,MAAM;AAC9B,iBAAa,KAAK,MAAM,IAAI;;;AAGhC,aAAW;;AAEb,OAAM,GAAG,IACP,GAAG,KAAK,qBAAqB,UAC3B,MAAM,kBAAkB,UACxB,MAAM,gBAAgB,KAAK,KAAK,GAAG,gCAC/B,GAAG,cACD,GAAG,cAAc,MAAM,MAAM,KAAK,EAChC,eAAe,KAAK,KAAK,GAAG,+BAC7B,CAAC,CACH,GACD,GAAG,KACR,CACF;AACD,QAAO;;;;;;;;;;AAeT,MAAa,uBACX,KACA,gBACA,gBACA,WAIG;CACH,MAAM,KAAK,OAAO,KAAK,OAAO;CAE9B,MAAM,YACJ,SACA,YAEA,GAAG,KAAK;EAAE,IAAI;EAAS,WAAW;EAAS,CAAC,CAAC,KAC3C,GAAG,SAAS,QAAQ;AAClB,eAAa,WAAW,OAAO,IAAI;AACnC,SAAO,GAAG,QAAQ,KAAiB;GACnC,CACH;AAIH,QAAO,eAEH,GAAG,cAAc,QACf,eACD,EACH,+BACD,CACE,KACC,GAAG,OAAO,QACR,QAAQ,OAAO,GAAG,QAAQ,IAAI,GAAG,GAAG,KAAK,wBAAwB,CAClE,EACD,GAAG,OAAO,QACR,IAAI,kBAAkB,KAAK,KAAK,GAC5B,GAAG,QAAQ,IAAI,GACf,GAAG,KAAK,wBAAwB,CACrC,EACD,GAAG,OAAO,QACR,IAAI,cAAc,iBACd,GAAG,QAAQ,IAAI,GACf,GAAG,KAAK,mCAAmC,CAChD,CACF,CACA,KACC,GAAG,OAAO,QACR,eAEI,GAAG,SAAS,QACV,IAAI,UACL,EACH,uCACD,CAAC,KACA,GAAG,OAAO,YACR,YAAY,OACR,GAAG,QAAQ,QAAQ,GACnB,GAAG,KAAK,gCAAgC,CAC7C,EACD,GAAG,OAAO,YACR,QAAQ,kBAAkB,KAAK,KAAK,GAChC,GAAG,QAAQ,QAAQ,GACnB,GAAG,KAAK,gCAAgC,CAC7C,EACD,GAAG,KAAK,aAAa;EACnB;EACA,iBAAiB;EAClB,EAAE,CACJ,CACF,EACD,GAAG,KAAK;EACN,KAAK,WAAW;EAChB,MAAM,QAAQ;AACZ,gBAAa,WAAW,OAAO,IAAI;AACnC,UAAO;;EAEV,CAAC,CACH"}

package/dist/component/server/runtime.d.ts

@@ -1,136 +0,0 @@
-import { ConvexAuthConfig, Doc, SessionInfo } from "./types.js";
-import * as convex_server26 from "convex/server";
-import * as convex_values926 from "convex/values";
-
-//#region src/server/runtime.d.ts
-/**
- * Configure the Convex Auth library. Returns an object with
- * functions and `auth` helper. You must export the functions
- * from `convex/auth.ts` to make them callable:
- *
- * ```ts filename="convex/auth.ts"
- * import { createAuth } from "@robelest/convex-auth/component";
- * import { components } from "./_generated/api";
- *
- * export const auth = createAuth(components.auth, {
- *   providers: [],
- * });
- * export const { signIn, signOut, store } = auth;
- * ```
- *
- * @returns An object with fields you should reexport from your
- *          `convex/auth.ts` file.
- */
-declare function Auth(config_: ConvexAuthConfig): {
-  /**
-   * Helper for configuring HTTP actions.
-   */
-  auth: any;
-  /**
-   * Action called by the client to sign the user in.
-   *
-   * Also used for refreshing the session.
-   */
-  signIn: convex_server26.RegisteredAction<"public", {
-    provider?: string | undefined;
-    verifier?: string | undefined;
-    params?: any;
-    refreshToken?: string | undefined;
-    calledBy?: string | undefined;
-  }, Promise<SignInActionResult>>;
-  /**
-   * Action called by the client to invalidate the current session.
-   */
-  signOut: convex_server26.RegisteredAction<"public", {}, Promise<void>>;
-  /**
-   * Internal mutation used by the library to read and write
-   * to the database during signin and signout.
-   */
-  store: convex_server26.RegisteredMutation<"internal", {
-    args: {
-      sessionId?: string | undefined;
-      type: "signIn";
-      userId: string;
-      generateTokens: boolean;
-    } | {
-      type: "signOut";
-    } | {
-      type: "refreshSession";
-      refreshToken: string;
-    } | {
-      provider?: string | undefined;
-      verifier?: string | undefined;
-      type: "verifyCodeAndSignIn";
-      params: any;
-      generateTokens: boolean;
-      allowExtraProviders: boolean;
-    } | {
-      type: "verifier";
-    } | {
-      type: "verifierSignature";
-      signature: string;
-      verifier: string;
-    } | {
-      accountExtend?: any;
-      type: "userOAuth";
-      provider: string;
-      providerAccountId: string;
-      signature: string;
-      profile: any;
-    } | {
-      email?: string | undefined;
-      phone?: string | undefined;
-      accountId?: string | undefined;
-      type: "createVerificationCode";
-      expirationTime: number;
-      provider: string;
-      code: string;
-      allowExtraProviders: boolean;
-    } | {
-      shouldLinkViaEmail?: boolean | undefined;
-      shouldLinkViaPhone?: boolean | undefined;
-      type: "createAccountFromCredentials";
-      provider: string;
-      profile: any;
-      account: {
-        secret?: string | undefined;
-        id: string;
-      };
-    } | {
-      type: "retrieveAccountWithCredentials";
-      provider: string;
-      account: {
-        secret?: string | undefined;
-        id: string;
-      };
-    } | {
-      type: "modifyAccount";
-      provider: string;
-      account: {
-        id: string;
-        secret: string;
-      };
-    } | {
-      except?: string[] | undefined;
-      type: "invalidateSessions";
-      userId: string;
-    };
-  }, Promise<string | void | {
-    userId: convex_values926.GenericId<"User">;
-    sessionId: convex_values926.GenericId<"Session">;
-  } | (string & {
-    __tableName: "AuthVerifier";
-  }) | SessionInfo | {
-    token: string;
-    refreshToken: string;
-  } | {
-    account: Doc<"Account">;
-    user: Doc<"User">;
-  } | {
-    account: Doc<"Account">;
-    user: Doc<"User">;
-  } | null>>;
-};
-//#endregion
-export { Auth };
-//# sourceMappingURL=runtime.d.ts.map

package/dist/component/server/runtime.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"runtime.d.ts","names":[],"sources":["../../../src/server/runtime.ts"],"mappings":";;;;;;;;;AAqJA;;;;;;;;;;;;;;iBAAgB,IAAA,CAAK,OAAA,EAAS,gBAAA"}

package/dist/component/server/runtime.js

@@ -1,456 +0,0 @@
-import { configDefaults, listAvailableProviders } from "./config.js";
-import { LOG_LEVELS, decryptSecret, encryptSecret, generateRandomString, logError, logWithLevel, requireEnv, sha256 } from "./utils.js";
-import { redirectToParamCookie, useRedirectToParam } from "./cookies.js";
-import { callModifyAccount } from "./mutations/account.js";
-import { callInvalidateSessions } from "./mutations/invalidate.js";
-import { enterpriseOidcProviderId, getEnterpriseOidcUrls, isEnterpriseSamlSourceActive, normalizeDomain } from "./enterprise/shared.js";
-import { normalizeEnterprisePolicy, patchEnterprisePolicy } from "./enterprise/policy.js";
-import { callUserOAuth } from "./mutations/oauth.js";
-import { callCreateAccountFromCredentials } from "./mutations/register.js";
-import { callRetrieveAccountWithCredentials } from "./mutations/retrieve.js";
-import { callVerifierSignature } from "./mutations/signature.js";
-import { callSignOut } from "./mutations/signout.js";
-import { storeArgs, storeImpl } from "./mutations/store.js";
-import { redirectAbsoluteUrl, setURLSearchParam } from "./redirects.js";
-import { signInImpl } from "./signin.js";
-import { createCoreDomains } from "./core.js";
-import { getOidcConfig, getPublicOidcConfig, getSamlConfig, upsertProtocolConfig, withOidcSecretState } from "./enterprise/config.js";
-import { createEnterpriseDomain } from "./enterprise/domain.js";
-import { addAuthRoutes, addOpenIdRoutes, convertErrorsToResponse, createHttpAction, createHttpContext, createHttpRoute, getCookies } from "./http.js";
-import { createOAuthAuthorizationURL, handleOAuthCallback } from "./oauth.js";
-import { createServiceProviderMetadata, getSamlServiceProviderOptions, parseSamlIdpMetadata } from "./enterprise/saml.js";
-import { parseScimPath } from "./enterprise/scim.js";
-import { addEnterpriseHttpRuntime } from "./enterprise/http.js";
-import { actionGeneric, internalMutationGeneric } from "convex/server";
-import { Cv } from "@robelest/fx/convex";
-import { Fx } from "@robelest/fx";
-import { v } from "convex/values";
-import { serialize } from "cookie";
-
-//#region src/server/runtime.ts
-const ENTERPRISE_OIDC_CLIENT_SECRET_KIND = "oidc_client_secret";
-/**
-* Configure the Convex Auth library. Returns an object with
-* functions and `auth` helper. You must export the functions
-* from `convex/auth.ts` to make them callable:
-*
-* ```ts filename="convex/auth.ts"
-* import { createAuth } from "@robelest/convex-auth/component";
-* import { components } from "./_generated/api";
-*
-* export const auth = createAuth(components.auth, {
-*   providers: [],
-* });
-* export const { signIn, signOut, store } = auth;
-* ```
-*
-* @returns An object with fields you should reexport from your
-*          `convex/auth.ts` file.
-*/
-function Auth(config_) {
-	const config = configDefaults(config_);
-	const hasOAuth = config.providers.some((provider) => provider.type === "oauth");
-	const hasSSO = config.providers.some((provider) => provider.type === "sso");
-	const getProviderOrThrow = (id, allowExtraProviders = false) => {
-		const provider = config.providers.find((configuredProvider) => configuredProvider.id === id) ?? (allowExtraProviders ? config.extraProviders.find((configuredProvider) => configuredProvider.id === id) : void 0);
-		if (provider === void 0) {
-			const detail = `Provider \`${id}\` is not configured, available providers are ${listAvailableProviders(config, allowExtraProviders)}.`;
-			logWithLevel(LOG_LEVELS.ERROR, detail);
-			throw Cv.error({
-				code: "PROVIDER_NOT_CONFIGURED",
-				message: detail,
-				provider: id
-			});
-		}
-		return provider;
-	};
-	const getEnterpriseSecret = async (ctx, enterpriseId, kind) => {
-		return await ctx.runQuery(config.component.public.enterpriseSecretGet, {
-			enterpriseId,
-			kind
-		});
-	};
-	const getEnterpriseOidcConfigWithSecret = async (ctx, enterprise) => {
-		const oidc = getOidcConfig(enterprise.config);
-		const secret = await getEnterpriseSecret(ctx, enterprise._id, ENTERPRISE_OIDC_CLIENT_SECRET_KIND);
-		return {
-			...oidc,
-			...secret ? { clientSecret: await decryptSecret(secret.ciphertext) } : {}
-		};
-	};
-	const INVITE_TOKEN_ALPHABET = "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789";
-	const INVITE_TOKEN_LENGTH = 48;
-	const enterpriseNotFoundError = "Enterprise not found.";
-	const ENTERPRISE_CONTROL_ROUTE_BASE = "/api/auth/sso";
-	const getPolicyFromEnterprise = (enterprise) => normalizeEnterprisePolicy(enterprise.policy);
-	const loadEnterpriseOrThrow = async (ctx, enterpriseId) => {
-		const enterprise = await ctx.runQuery(config.component.public.enterpriseGet, { enterpriseId });
-		if (!enterprise) throw Cv.error({
-			code: "INVALID_PARAMETERS",
-			message: enterpriseNotFoundError
-		});
-		return enterprise;
-	};
-	const loadActiveEnterpriseOrThrow = async (ctx, enterpriseId) => {
-		const enterprise = await loadEnterpriseOrThrow(ctx, enterpriseId);
-		if (enterprise.status !== "active") throw Cv.error({
-			code: "INVALID_PARAMETERS",
-			message: "Enterprise connection is not active."
-		});
-		return enterprise;
-	};
-	const loadActiveEnterpriseSamlOrThrow = async (ctx, enterpriseId) => {
-		const enterprise = await loadEnterpriseOrThrow(ctx, enterpriseId);
-		const loaded = {
-			source: {
-				kind: "enterprise",
-				id: enterpriseId
-			},
-			config: enterprise.config,
-			status: enterprise.status,
-			enterprise
-		};
-		if (!isEnterpriseSamlSourceActive(loaded)) throw Cv.error({
-			code: "INVALID_PARAMETERS",
-			message: "Enterprise connection is not active."
-		});
-		const saml = getSamlConfig(loaded.config);
-		if (!saml.idp?.metadataXml) throw Cv.error({
-			code: "PROVIDER_NOT_CONFIGURED",
-			message: "SAML is not configured for this enterprise."
-		});
-		return {
-			loaded,
-			enterprise,
-			saml
-		};
-	};
-	const loadEnterpriseOidcOrThrow = async (ctx, enterpriseId) => {
-		const enterprise = await loadActiveEnterpriseOrThrow(ctx, enterpriseId);
-		const oidc = await getEnterpriseOidcConfigWithSecret(ctx, enterprise);
-		if (oidc.enabled !== true) throw Cv.error({
-			code: "PROVIDER_NOT_CONFIGURED",
-			message: "OIDC is not configured for this enterprise."
-		});
-		return {
-			enterprise,
-			oidc
-		};
-	};
-	const validateEnterprisePolicy = (policy) => {
-		const checks = [];
-		checks.push({
-			name: "policy_version",
-			ok: policy.version === 1
-		});
-		checks.push({
-			name: "jit_default_role_ids_present",
-			ok: policy.provisioning.jit.mode !== "createUserAndMembership" || policy.provisioning.jit.defaultRoleIds.length > 0,
-			message: policy.provisioning.jit.mode === "createUserAndMembership" && policy.provisioning.jit.defaultRoleIds.length === 0 ? "At least one default roleId is required when JIT membership provisioning is enabled." : void 0
-		});
-		checks.push({
-			name: "jit_default_role_ids_known",
-			ok: policy.provisioning.jit.defaultRoleIds.every((roleId) => config.authorization.roles[roleId] !== void 0),
-			message: policy.provisioning.jit.defaultRoleIds.every((roleId) => config.authorization.roles[roleId] !== void 0) ? void 0 : "JIT defaultRoleIds contains unknown roleIds."
-		});
-		checks.push({
-			name: "scim_reuse_supported",
-			ok: policy.provisioning.scimReuse.user === "externalId" || policy.provisioning.scimReuse.user === "none"
-		});
-		return checks;
-	};
-	const recordEnterpriseAuditEvent = async (ctx, data) => {
-		const { ok, ...rest } = data;
-		return await ctx.runMutation(config.component.public.enterpriseAuditEventCreate, {
-			...rest,
-			status: ok ? "success" : "failure",
-			occurredAt: Date.now()
-		});
-	};
-	const emitEnterpriseWebhookDeliveries = async (ctx, data) => {
-		const endpoints = await ctx.runQuery(config.component.public.enterpriseWebhookEndpointList, { enterpriseId: data.enterpriseId });
-		for (const endpoint of endpoints) {
-			if (endpoint.status !== "active" || !endpoint.subscriptions.includes(data.eventType)) continue;
-			await ctx.runMutation(config.component.public.enterpriseWebhookDeliveryEnqueue, {
-				enterpriseId: data.enterpriseId,
-				endpointId: endpoint._id,
-				auditEventId: data.auditEventId,
-				eventType: data.eventType,
-				payload: data.payload,
-				nextAttemptAt: Date.now()
-			});
-		}
-	};
-	const getEnterpriseScimContext = async (ctx, request) => {
-		const authHeader = request.headers.get("Authorization");
-		if (!authHeader?.startsWith("Bearer ")) throw Cv.error({
-			code: "MISSING_BEARER_TOKEN",
-			message: "Missing or malformed Authorization: Bearer header."
-		});
-		const token = authHeader.slice(7);
-		const scimConfig = await ctx.runQuery(config.component.public.enterpriseScimConfigGetByTokenHash, { tokenHash: await sha256(token) });
-		if (!scimConfig || scimConfig.status !== "active") throw Cv.error({
-			code: "INVALID_API_KEY",
-			message: "Invalid SCIM token."
-		});
-		const parsedPath = parseScimPath(new URL(request.url).pathname);
-		if (parsedPath.enterpriseId !== scimConfig.enterpriseId) throw Cv.error({
-			code: "INVALID_API_KEY",
-			message: "SCIM token/tenant mismatch."
-		});
-		const enterprise = await ctx.runQuery(config.component.public.enterpriseGet, { enterpriseId: scimConfig.enterpriseId });
-		if (enterprise === null) throw Cv.error({
-			code: "INVALID_PARAMETERS",
-			message: "Enterprise not found."
-		});
-		return {
-			scimConfig,
-			enterprise,
-			parsedPath
-		};
-	};
-	let auth;
-	auth = {
-		...createCoreDomains({
-			config,
-			getAuth: () => auth,
-			callInvalidateSessions,
-			callCreateAccountFromCredentials,
-			callRetrieveAccountWithCredentials,
-			callModifyAccount,
-			getEnrichCtx: () => enrichCtx,
-			inviteTokenAlphabet: INVITE_TOKEN_ALPHABET,
-			inviteTokenLength: INVITE_TOKEN_LENGTH
-		}),
-		sso: createEnterpriseDomain({
-			config,
-			getAuth: () => auth,
-			normalizeEnterprisePolicy,
-			normalizeDomain,
-			getEnterpriseSecret,
-			loadEnterpriseOrThrow,
-			validateEnterprisePolicy,
-			recordEnterpriseAuditEvent,
-			emitEnterpriseWebhookDeliveries,
-			enterpriseNotFoundError,
-			ENTERPRISE_OIDC_CLIENT_SECRET_KIND,
-			requireEnv,
-			generateRandomString,
-			INVITE_TOKEN_ALPHABET,
-			sha256,
-			encryptSecret,
-			upsertProtocolConfig,
-			parseSamlIdpMetadata,
-			createServiceProviderMetadata,
-			getSamlServiceProviderOptions,
-			getPublicOidcConfig,
-			withOidcSecretState,
-			getOidcConfig,
-			getEnterpriseOidcUrls,
-			enterpriseOidcProviderId,
-			getPolicyFromEnterprise,
-			patchEnterprisePolicy
-		})
-	};
-	auth.http = {
-		add: (http) => {
-			addOpenIdRoutes(http, {
-				getIssuer: () => requireEnv("CONVEX_SITE_URL"),
-				getJwks: () => requireEnv("JWKS")
-			});
-			addEnterpriseHttpRuntime({
-				http,
-				hasSSO,
-				auth,
-				config,
-				routeBase: ENTERPRISE_CONTROL_ROUTE_BASE,
-				requireEnv,
-				loadActiveEnterpriseSamlOrThrow,
-				loadEnterpriseOidcOrThrow,
-				getEnterpriseScimContext,
-				getPolicyFromEnterprise,
-				normalizeEnterprisePolicy,
-				recordEnterpriseAuditEvent,
-				emitEnterpriseWebhookDeliveries,
-				generateRandomString,
-				inviteTokenAlphabet: INVITE_TOKEN_ALPHABET,
-				callUserOAuth,
-				callVerifierSignature
-			});
-			if (hasOAuth) addAuthRoutes(http, {
-				handleSignIn: convertErrorsToResponse(400, async (ctx, request) => {
-					const url = new URL(request.url);
-					const pathParts = url.pathname.split("/");
-					const providerId = pathParts[pathParts.length - 1];
-					if (providerId === null) throw Cv.error({
-						code: "OAUTH_MISSING_PROVIDER",
-						message: "Missing OAuth provider ID."
-					});
-					const verifier = url.searchParams.get("code");
-					if (verifier === null) throw Cv.error({
-						code: "OAUTH_MISSING_VERIFIER",
-						message: "Missing sign-in verifier."
-					});
-					const oauthConfig = getProviderOrThrow(providerId);
-					const { redirect, cookies, signature } = await createOAuthAuthorizationURL(providerId, oauthConfig.provider, oauthConfig);
-					await callVerifierSignature(ctx, {
-						verifier,
-						signature
-					});
-					const redirectTo = url.searchParams.get("redirectTo");
-					if (redirectTo !== null) cookies.push(redirectToParamCookie(providerId, redirectTo));
-					const headers = new Headers({ Location: redirect });
-					for (const { name, value, options } of cookies) headers.append("Set-Cookie", serialize(name, value, options));
-					return new Response(null, {
-						status: 302,
-						headers
-					});
-				}),
-				handleCallback: async (ctx, request) => {
-					const url = new URL(request.url);
-					const callbackPathParts = new URL(request.url).pathname.split("/");
-					const providerId = callbackPathParts[callbackPathParts.length - 1];
-					if (!providerId) throw Cv.error({
-						code: "OAUTH_MISSING_PROVIDER",
-						message: "Missing OAuth provider ID."
-					});
-					logWithLevel(LOG_LEVELS.DEBUG, "Handling OAuth callback for provider:", providerId);
-					const provider = getProviderOrThrow(providerId);
-					const cookies = getCookies(request);
-					const maybeRedirectTo = useRedirectToParam(provider.id, cookies);
-					const destinationUrl = await redirectAbsoluteUrl(config, { redirectTo: maybeRedirectTo?.redirectTo });
-					const params = url.searchParams;
-					if (request.headers.get("Content-Type") === "application/x-www-form-urlencoded") (await request.formData()).forEach((value, key) => {
-						if (typeof value === "string") params.append(key, value);
-					});
-					return Fx.run(Fx.from({
-						ok: async () => {
-							const oauthConfig = provider;
-							const result = await Fx.run(handleOAuthCallback(providerId, oauthConfig.provider, oauthConfig, Object.fromEntries(params.entries()), cookies));
-							const oauthCookies = result.cookies;
-							const { id: profileId, ...profileData } = result.profile;
-							const { signature } = result;
-							const redirUrl = setURLSearchParam(destinationUrl, "code", await callUserOAuth(ctx, {
-								provider: providerId,
-								providerAccountId: profileId,
-								profile: profileData,
-								signature
-							}));
-							const redirHeaders = new Headers({ Location: redirUrl });
-							redirHeaders.set("Cache-Control", "must-revalidate");
-							for (const { name, value, options } of [...oauthCookies, ...maybeRedirectTo !== null ? [maybeRedirectTo.updatedCookie] : []]) redirHeaders.append("Set-Cookie", serialize(name, value, options));
-							return new Response(null, {
-								status: 302,
-								headers: redirHeaders
-							});
-						},
-						err: (error) => error
-					}).pipe(Fx.recover((error) => {
-						logError(error);
-						const respHeaders = new Headers({ Location: destinationUrl });
-						for (const { name, value, options } of maybeRedirectTo !== null ? [maybeRedirectTo.updatedCookie] : []) respHeaders.append("Set-Cookie", serialize(name, value, options));
-						return Fx.succeed(new Response(null, {
-							status: 302,
-							headers: respHeaders
-						}));
-					})));
-				}
-			});
-		},
-		context: createHttpContext(auth),
-		action: createHttpAction(auth),
-		route: createHttpRoute(createHttpAction(auth))
-	};
-	const enrichCtx = (ctx) => ({
-		...ctx,
-		auth: {
-			...ctx.auth,
-			config,
-			account: auth.account,
-			session: auth.session,
-			member: auth.member,
-			provider: auth.provider
-		}
-	});
-	return {
-		auth,
-		signIn: actionGeneric({
-			args: {
-				provider: v.optional(v.string()),
-				params: v.optional(v.any()),
-				verifier: v.optional(v.string()),
-				refreshToken: v.optional(v.string()),
-				calledBy: v.optional(v.string())
-			},
-			handler: async (ctx, args) => {
-				if (args.calledBy !== void 0) logWithLevel("INFO", `\`auth:signIn\` called by ${args.calledBy}`);
-				const provider = args.provider !== void 0 ? getProviderOrThrow(args.provider) : null;
-				const result = await signInImpl(enrichCtx(ctx), provider, args, {
-					generateTokens: true,
-					allowExtraProviders: false
-				});
-				return Fx.run(Fx.match(result, result.kind, {
-					redirect: (r) => Fx.succeed({
-						kind: "redirect",
-						redirect: r.redirect,
-						verifier: r.verifier
-					}),
-					signedIn: (r) => Fx.succeed({
-						kind: "signedIn",
-						tokens: r.signedIn?.tokens ?? null
-					}),
-					refreshTokens: (r) => Fx.succeed({
-						kind: "signedIn",
-						tokens: r.signedIn?.tokens ?? null
-					}),
-					started: () => Fx.succeed({ kind: "started" }),
-					passkeyOptions: (r) => Fx.succeed({
-						kind: "passkeyOptions",
-						options: r.options,
-						verifier: r.verifier
-					}),
-					totpRequired: (r) => Fx.succeed({
-						kind: "totpRequired",
-						verifier: r.verifier
-					}),
-					totpSetup: (r) => Fx.succeed({
-						kind: "totpSetup",
-						totpSetup: {
-							uri: r.uri,
-							secret: r.secret,
-							totpId: r.totpId
-						},
-						verifier: r.verifier
-					}),
-					deviceCode: (r) => Fx.succeed({
-						kind: "deviceCode",
-						deviceCode: {
-							deviceCode: r.deviceCode,
-							userCode: r.userCode,
-							verificationUri: r.verificationUri,
-							verificationUriComplete: r.verificationUriComplete,
-							expiresIn: r.expiresIn,
-							interval: r.interval
-						}
-					})
-				}));
-			}
-		}),
-		signOut: actionGeneric({
-			args: {},
-			handler: async (ctx) => {
-				await callSignOut(ctx);
-			}
-		}),
-		store: internalMutationGeneric({
-			args: storeArgs,
-			handler: async (ctx, args) => {
-				return storeImpl(ctx, args, getProviderOrThrow, config);
-			}
-		})
-	};
-}
-
-//#endregion
-export { Auth };
-//# sourceMappingURL=runtime.js.map