@robelest/convex-auth 0.0.4-preview.27 → 0.0.4-preview.28

package/dist/server/sso/http.js

@@ -1,16 +1,15 @@
-import { redirectToParamCookie, useRedirectToParam } from "../cookies.js";
 import { deleteScimIdentity, getScimIdentity, getScimIdentityByConnectionAndUser, getScimIdentityByMappedGroup, insertAccount, insertUser, listScimIdentitiesByConnection, patchUser, upsertScimIdentity } from "../contract.js";
 import { finalizeNormalizedProfile, normalizeStringArray } from "./profile.js";
 import { SCIM_GROUP_SCHEMA_ID, SCIM_USER_SCHEMA_ID, decodeGroupOidcState, encodeGroupOidcState, groupOidcProviderId, groupSamlProviderId } from "./shared.js";
 import { createGroupConnectionOidcRuntime } from "./oidc.js";
 import { resolveProvisionedRoleIds } from "./policy.js";
-import { redirectAbsoluteUrl, setURLSearchParam } from "../redirects.js";
+import { redirectToParamCookie, useRedirectToParam } from "../cookies.js";
 import { addSSORoutes, convertErrorsToResponse, getCookies } from "../http.js";
 import { createOAuthAuthorizationURL, handleOAuthCallback } from "../oauth/runtime.js";
+import { redirectAbsoluteUrl, setURLSearchParam } from "../redirects.js";
 import { parseScimListRequest, scimError, scimJson, serializeScimGroup, serializeScimUser } from "./scim.js";
 import { createGroupConnectionSamlMetadataXml, createGroupConnectionSamlSignInRequest, createSamlPostBindingResponse, encodeGroupSamlRelayState, enforceGroupConnectionSamlSecurity, parseGroupConnectionSamlLoginResponse, parseGroupConnectionSamlLogoutMessage, profileFromSamlExtract, validateGroupConnectionSamlLoginRelayState } from "./saml.js";
 import { ConvexError } from "convex/values";
-import { Effect, Match } from "effect";
 import { serialize } from "cookie";
 
 //#region src/server/sso/http.ts
@@ -189,15 +188,13 @@ function addGroupHttpRuntime(deps) {
 		return null;
 	};
 	const readScimJson = async (request) => await request.json();
-	const handleSamlAcs = async (ctx, request, runtimeRoute) => Effect.runPromise(Effect.gen(function* () {
-		if (runtimeRoute.protocol !== "saml" || runtimeRoute.rest.length !== 1 || runtimeRoute.rest[0] !== "acs") return yield* Effect.fail(convexError("INVALID_PARAMETERS", "Invalid connection runtime path."));
+	const handleSamlAcs = async (ctx, request, runtimeRoute) => {
+		if (runtimeRoute.protocol !== "saml" || runtimeRoute.rest.length !== 1 || runtimeRoute.rest[0] !== "acs") throw convexError("INVALID_PARAMETERS", "Invalid connection runtime path.");
 		const connectionId = runtimeRoute.connectionId;
-		const { loaded, connection, saml } = yield* Effect.tryPromise({
-			try: () => loadActiveConnectionSamlOrThrow(ctx, connectionId),
-			catch: (error) => error
-		});
-		const parsedResponse = yield* Effect.tryPromise({
-			try: () => parseGroupConnectionSamlLoginResponse({
+		const { loaded, connection, saml } = await loadActiveConnectionSamlOrThrow(ctx, connectionId);
+		let parsedResponse;
+		try {
+			parsedResponse = await parseGroupConnectionSamlLoginResponse({
 				request,
 				rootUrl: requireEnv("CONVEX_SITE_URL"),
 				source: {
@@ -205,27 +202,30 @@ function addGroupHttpRuntime(deps) {
 					id: connection._id
 				},
 				config: loaded.config
-			}),
-			catch: (error) => convexError("OAUTH_PROVIDER_ERROR", `SAML response parse failed: ${error instanceof Error ? error.message : String(error)}`)
-		});
-		yield* Effect.try({
-			try: () => enforceGroupConnectionSamlSecurity({
+			});
+		} catch (error) {
+			throw convexError("OAUTH_PROVIDER_ERROR", `SAML response parse failed: ${error instanceof Error ? error.message : String(error)}`);
+		}
+		try {
+			enforceGroupConnectionSamlSecurity({
 				extract: parsedResponse.parsed.extract,
 				config: loaded.config
-			}),
-			catch: (error) => convexError("OAUTH_PROVIDER_ERROR", error instanceof Error ? error.message : "SAML assertion failed security validation.")
-		});
-		yield* Effect.try({
-			try: () => validateGroupConnectionSamlLoginRelayState({
+			});
+		} catch (error) {
+			throw convexError("OAUTH_PROVIDER_ERROR", error instanceof Error ? error.message : "SAML assertion failed security validation.");
+		}
+		try {
+			validateGroupConnectionSamlLoginRelayState({
 				relayState: parsedResponse.relayState,
 				source: {
 					kind: "connection",
 					id: connection._id
 				},
 				inResponseTo: parsedResponse.parsed.extract?.response?.inResponseTo
-			}),
-			catch: () => convexError("OAUTH_INVALID_STATE", "SAML RelayState did not match the pending login request.")
-		});
+			});
+		} catch {
+			throw convexError("OAUTH_INVALID_STATE", "SAML RelayState did not match the pending login request.");
+		}
 		const { samlAttributes, samlSessionIndex, ...userProfile } = profileFromSamlExtract(parsedResponse.parsed.extract, saml.profile?.mapping ?? {});
 		const profile = userProfile;
 		const extraFields = typeof saml.profile === "object" && saml.profile !== null ? saml.profile.extraFields : void 0;
@@ -238,31 +238,25 @@ function addGroupHttpRuntime(deps) {
 			if (Object.keys(extend).length > 0) profile.extend = extend;
 		}
 		const maybeRedirectTo = useRedirectToParam(groupSamlProviderId(connection._id), getCookies(request));
-		const verificationCode = yield* Effect.tryPromise({
-			try: () => callUserOAuth(ctx, {
-				provider: groupSamlProviderId(connection._id),
-				providerAccountId: profile.id,
-				profile,
-				signature: parsedResponse.relayState.signature,
-				accountExtend: {
-					identity: {
-						protocol: "saml",
-						connectionId: connection._id,
-						subject: profile.id,
-						entityId: typeof saml.entityId === "string" ? saml.entityId : void 0
-					},
-					saml: {
-						attributes: samlAttributes,
-						sessionIndex: samlSessionIndex
-					}
+		const verificationCode = await callUserOAuth(ctx, {
+			provider: groupSamlProviderId(connection._id),
+			providerAccountId: profile.id,
+			profile,
+			signature: parsedResponse.relayState.signature,
+			accountExtend: {
+				identity: {
+					protocol: "saml",
+					connectionId: connection._id,
+					subject: profile.id,
+					entityId: typeof saml.entityId === "string" ? saml.entityId : void 0
+				},
+				saml: {
+					attributes: samlAttributes,
+					sessionIndex: samlSessionIndex
 				}
-			}),
-			catch: (error) => error
+			}
 		});
-		const vurl = setURLSearchParam(yield* Effect.tryPromise({
-			try: () => redirectAbsoluteUrl(config, { redirectTo: maybeRedirectTo?.redirectTo ?? (typeof parsedResponse.relayState.redirectTo === "string" ? parsedResponse.relayState.redirectTo : void 0) }),
-			catch: (error) => error
-		}), "code", verificationCode);
+		const vurl = setURLSearchParam(await redirectAbsoluteUrl(config, { redirectTo: maybeRedirectTo?.redirectTo ?? (typeof parsedResponse.relayState.redirectTo === "string" ? parsedResponse.relayState.redirectTo : void 0) }), "code", verificationCode);
 		const vheaders = new Headers({ Location: vurl });
 		vheaders.set("Cache-Control", "must-revalidate");
 		for (const { name, value, options } of maybeRedirectTo !== null ? [maybeRedirectTo.updatedCookie] : []) vheaders.append("Set-Cookie", serialize(name, value, options));
@@ -270,7 +264,7 @@ function addGroupHttpRuntime(deps) {
 			status: 302,
 			headers: vheaders
 		});
-	}));
+	};
 	const handleSamlSlo = async (ctx, request, runtimeRoute) => {
 		if (runtimeRoute.protocol !== "saml" || runtimeRoute.rest.length !== 1 || runtimeRoute.rest[0] !== "slo") throw convexError("INVALID_PARAMETERS", "Invalid connection runtime path.");
 		const { loaded, connection } = await loadActiveConnectionSamlOrThrow(ctx, runtimeRoute.connectionId);
@@ -283,21 +277,21 @@ function addGroupHttpRuntime(deps) {
 			},
 			config: loaded.config
 		});
-		return Match.value(parsedMessage).pipe(Match.when({ hasSamlRequest: true }, (parsedMessage$1) => {
-			if (!parsedMessage$1.parsedRequest) throw convexError("INVALID_PARAMETERS", "Missing SAML logout payload.");
-			const responseContext = parsedMessage$1.runtime.sp.createLogoutResponse(parsedMessage$1.runtime.idp, parsedMessage$1.parsedRequest.extract, parsedMessage$1.binding, parsedMessage$1.relayState ?? "");
-			return parsedMessage$1.binding === "redirect" ? new Response(null, {
+		if (parsedMessage.hasSamlRequest) {
+			if (!parsedMessage.parsedRequest) throw convexError("INVALID_PARAMETERS", "Missing SAML logout payload.");
+			const responseContext = parsedMessage.runtime.sp.createLogoutResponse(parsedMessage.runtime.idp, parsedMessage.parsedRequest.extract, parsedMessage.binding, parsedMessage.relayState ?? "");
+			if (parsedMessage.binding === "redirect") return new Response(null, {
 				status: 302,
 				headers: { Location: responseContext.context }
-			}) : createSamlPostBindingResponse({
+			});
+			return createSamlPostBindingResponse({
 				endpoint: responseContext.entityEndpoint,
 				parameter: "SAMLResponse",
 				value: responseContext.context,
-				relayState: parsedMessage$1.relayState
+				relayState: parsedMessage.relayState
 			});
-		}), Match.when({ hasSamlResponse: true }, () => new Response(null, { status: 204 })), Match.orElse(() => {
-			throw convexError("INVALID_PARAMETERS", "Missing SAML logout payload.");
-		}));
+		} else if (parsedMessage.hasSamlResponse) return new Response(null, { status: 204 });
+		else throw convexError("INVALID_PARAMETERS", "Missing SAML logout payload.");
 	};
 	const handleScimRequest = async (ctx, request) => {
 		try {
@@ -907,10 +901,10 @@ function addGroupHttpRuntime(deps) {
 		const cookies = getCookies(request);
 		const maybeRedirectTo = useRedirectToParam(providerId, cookies);
 		const destinationUrl = await redirectAbsoluteUrl(config, { redirectTo: maybeRedirectTo?.redirectTo });
-		const result = await Effect.runPromise(handleOAuthCallback(providerId, {
+		const result = await handleOAuthCallback(providerId, {
 			...oauthConfig,
 			provider
-		}, Object.fromEntries(url.searchParams.entries()), cookies));
+		}, Object.fromEntries(url.searchParams.entries()), cookies);
 		const extraFields = typeof oidc.profile === "object" && oidc.profile !== null ? oidc.profile.extraFields : void 0;
 		let profile = result.profile;
 		if (extraFields && typeof profile === "object" && profile) {

package/dist/server/sso/oidc.js

@@ -1,39 +1,52 @@
 import { log } from "../log.js";
+import { createCache } from "../utils/cache.js";
+import { retryWithBackoff } from "../utils/retry.js";
+import { withSpan } from "../utils/span.js";
 import { finalizeNormalizedProfile, normalizeStringArray } from "./profile.js";
 import { getGroupOidcUrls, groupOidcProviderId } from "./shared.js";
-import { Cache, Duration, Effect, Match, Schedule, Schema } from "effect";
 import { sha256 } from "@oslojs/crypto/sha2";
 import { encodeBase64urlNoPadding } from "@oslojs/encoding";
 import { createRemoteJWKSet, customFetch, decodeProtectedHeader, jwtVerify } from "jose";
 import { decodeIdToken } from "arctic";
 
 //#region src/server/sso/oidc.ts
-const OIDC_JWKS_CACHE = Effect.runSync(Cache.make({
+const OIDC_JWKS_CACHE = createCache({
 	capacity: 128,
-	timeToLive: Duration.hours(1),
-	lookup: (cacheKey) => Effect.sync(() => {
+	timeToLiveMs: 3600 * 1e3,
+	lookup: (cacheKey) => {
 		const key = JSON.parse(cacheKey);
 		const fetchImpl = key.runtimeOrigin !== void 0 || key.externalHost !== void 0 ? createGroupConnectionOidcFetchFromParts(key.runtimeOrigin, key.externalHost) : void 0;
 		return fetchImpl ? createRemoteJWKSet(new URL(key.url), { [customFetch]: fetchImpl }) : createRemoteJWKSet(new URL(key.url));
-	})
-}));
-const NETWORK_RETRY_SCHEDULE = Schedule.both(Schedule.jittered(Schedule.exponential("200 millis")), Schedule.recurs(2));
-const OidcDiscoverySchema = Schema.Struct({
-	issuer: Schema.String,
-	authorization_endpoint: Schema.String,
-	token_endpoint: Schema.String,
-	jwks_uri: Schema.String,
-	userinfo_endpoint: Schema.optional(Schema.String),
-	token_endpoint_auth_methods_supported: Schema.optional(Schema.Array(Schema.String)),
-	id_token_signing_alg_values_supported: Schema.optional(Schema.Array(Schema.String))
-});
-const OidcUserInfoSchema = Schema.Struct({
-	sub: Schema.optional(Schema.String),
-	email: Schema.optional(Schema.String),
-	email_verified: Schema.optional(Schema.Boolean),
-	name: Schema.optional(Schema.String),
-	picture: Schema.optional(Schema.String)
+	}
 });
+function validateOidcDiscovery(data) {
+	if (typeof data !== "object" || data === null) throw new Error("OIDC discovery response is not an object.");
+	const obj = data;
+	if (typeof obj.issuer !== "string") throw new Error("OIDC discovery is missing 'issuer'.");
+	if (typeof obj.authorization_endpoint !== "string") throw new Error("OIDC discovery is missing 'authorization_endpoint'.");
+	if (typeof obj.token_endpoint !== "string") throw new Error("OIDC discovery is missing 'token_endpoint'.");
+	if (typeof obj.jwks_uri !== "string") throw new Error("OIDC discovery is missing 'jwks_uri'.");
+	return {
+		issuer: obj.issuer,
+		authorization_endpoint: obj.authorization_endpoint,
+		token_endpoint: obj.token_endpoint,
+		jwks_uri: obj.jwks_uri,
+		userinfo_endpoint: typeof obj.userinfo_endpoint === "string" ? obj.userinfo_endpoint : void 0,
+		token_endpoint_auth_methods_supported: Array.isArray(obj.token_endpoint_auth_methods_supported) ? obj.token_endpoint_auth_methods_supported.filter((v) => typeof v === "string") : void 0,
+		id_token_signing_alg_values_supported: Array.isArray(obj.id_token_signing_alg_values_supported) ? obj.id_token_signing_alg_values_supported.filter((v) => typeof v === "string") : void 0
+	};
+}
+function validateOidcUserInfo(data) {
+	if (typeof data !== "object" || data === null) return {};
+	const obj = data;
+	return {
+		sub: typeof obj.sub === "string" ? obj.sub : void 0,
+		email: typeof obj.email === "string" ? obj.email : void 0,
+		email_verified: typeof obj.email_verified === "boolean" ? obj.email_verified : void 0,
+		name: typeof obj.name === "string" ? obj.name : void 0,
+		picture: typeof obj.picture === "string" ? obj.picture : void 0
+	};
+}
 const asError = (error) => error instanceof Error ? error : new Error(String(error));
 function getOidcSections(config) {
 	return {
@@ -44,19 +57,21 @@ function getOidcSections(config) {
 		profile: typeof config.profile === "object" && config.profile !== null ? config.profile : {}
 	};
 }
-function discoverOidcConfiguration(config) {
+async function discoverOidcConfiguration(config) {
 	const { discovery } = getOidcSections(config);
 	const discoveryUrl = typeof discovery.discoveryUrl === "string" ? discovery.discoveryUrl : typeof discovery.issuer === "string" ? `${discovery.issuer.replace(/\/$/, "")}/.well-known/openid-configuration` : null;
 	if (!discoveryUrl) throw new Error("Group connection OIDC requires an issuer or discoveryUrl.");
 	const oidcFetch = createGroupConnectionOidcFetch(config, typeof discovery.issuer === "string" ? discovery.issuer : void 0);
-	return Effect.tryPromise({
-		try: async () => {
+	return withSpan("convex-auth.sso.oidc.discovery", {}, async () => {
+		return retryWithBackoff(async () => {
 			const response = await oidcFetch(discoveryUrl, { signal: AbortSignal.timeout(1e4) });
 			if (!response.ok) throw new Error(`Failed to discover OIDC configuration: ${response.status}`);
-			return Schema.decodeUnknownSync(OidcDiscoverySchema)(await response.json());
-		},
-		catch: asError
-	}).pipe(Effect.retry({ schedule: NETWORK_RETRY_SCHEDULE }), Effect.withSpan("convex-auth.sso.oidc.discovery"));
+			return validateOidcDiscovery(await response.json());
+		}, {
+			maxRetries: 2,
+			baseMs: 200
+		});
+	});
 }
 function createGroupConnectionOidcFetch(config, discoveredIssuer) {
 	const { discovery } = getOidcSections(config);
@@ -92,35 +107,34 @@ function getOidcJwks(url, runtimeOrigin, externalHost, fetchImpl) {
 		runtimeOrigin: fetchImpl ? runtimeOrigin : void 0,
 		externalHost: fetchImpl ? externalHost : void 0
 	});
-	return Effect.runSync(Cache.get(OIDC_JWKS_CACHE, cacheKey));
+	return OIDC_JWKS_CACHE.get(cacheKey);
 }
-function userInfoProfileFx(opts) {
-	return Effect.tryPromise({
-		try: async () => {
+async function userInfoProfileFx(opts) {
+	return withSpan("convex-auth.sso.oidc.userinfo", {}, async () => {
+		let userInfo;
+		try {
 			const response = await (opts.fetchImpl ?? fetch)(opts.endpoint, { headers: { Authorization: `Bearer ${opts.accessToken}` } });
 			if (!response.ok) throw new Error(`OIDC userinfo request failed: ${response.status}`);
-			return Schema.decodeUnknownSync(OidcUserInfoSchema)(await response.json());
-		},
-		catch: (error) => ({
-			kind: "transport",
-			error
-		})
-	}).pipe(Effect.flatMap((userInfo) => {
+			userInfo = validateOidcUserInfo(await response.json());
+		} catch {
+			return null;
+		}
 		const userInfoSubject = typeof userInfo.sub === "string" ? userInfo.sub : void 0;
 		const tokenSubject = typeof opts.verifiedClaims.sub === "string" ? opts.verifiedClaims.sub : void 0;
-		return userInfoSubject !== void 0 && tokenSubject !== void 0 && userInfoSubject !== tokenSubject ? Effect.fail({ kind: "subject-mismatch" }) : Effect.succeed({
+		if (userInfoSubject !== void 0 && tokenSubject !== void 0 && userInfoSubject !== tokenSubject) throw new Error("OIDC userinfo subject does not match ID token subject.");
+		return {
 			id: userInfoSubject ?? (typeof opts.verifiedClaims.sub === "string" ? opts.verifiedClaims.sub : void 0) ?? crypto.randomUUID(),
 			email: typeof userInfo.email === "string" ? userInfo.email : opts.verifiedProfile.email,
 			emailVerified: typeof userInfo.email_verified === "boolean" ? userInfo.email_verified : opts.verifiedProfile.emailVerified,
 			name: typeof userInfo.name === "string" ? userInfo.name : opts.verifiedProfile.name,
 			image: typeof userInfo.picture === "string" ? userInfo.picture : opts.verifiedProfile.image
-		});
-	}), Effect.catch((failure) => Match.value(failure).pipe(Match.when({ kind: "transport" }, () => Effect.succeed(null)), Match.orElse(() => Effect.fail(/* @__PURE__ */ new Error("OIDC userinfo subject does not match ID token subject."))))), Effect.withSpan("convex-auth.sso.oidc.userinfo"));
+		};
+	});
 }
 /** @internal */
 async function createGroupConnectionOidcProvider(config, redirectUri) {
 	const { discovery: discoveryConfig, client, request, security, profile } = getOidcSections(config);
-	const discovery = await Effect.runPromise(discoverOidcConfiguration(config));
+	const discovery = await discoverOidcConfiguration(config);
 	const discoveredIssuer = typeof discovery.issuer === "string" ? discovery.issuer.replace(/\/$/, "") : "";
 	const expectedIssuer = typeof discoveryConfig.issuer === "string" ? discoveryConfig.issuer.replace(/\/$/, "") : discoveredIssuer;
 	const strictIssuer = security.strictIssuer === true;
@@ -218,40 +232,40 @@ async function createGroupConnectionOidcProvider(config, redirectUri) {
 			scopes,
 			nonce: true,
 			validateTokens: async (tokens, ctx) => {
-				const verified = await Effect.runPromise(Effect.gen(function* () {
-					if (ctx.nonce === void 0) return yield* Effect.fail(/* @__PURE__ */ new Error("OIDC nonce is required."));
-					const idToken = tokens.idToken;
-					if (idToken === void 0) return yield* Effect.fail(/* @__PURE__ */ new Error("OIDC response is missing id_token."));
-					const verifiedIdToken = idToken;
-					const tokenAlg = decodeProtectedHeader(verifiedIdToken).alg;
-					const useSymmetricValidation = typeof tokenAlg === "string" && (tokenAlg === "HS256" || tokenAlg === "HS384" || tokenAlg === "HS512") && supportedIdTokenSigningAlgs.includes(tokenAlg);
-					const verificationOptions = {
-						audience: expectedAudience,
-						requiredClaims: [
-							"iss",
-							"sub",
-							"aud",
-							"exp",
-							"iat"
-						],
-						clockTolerance: clockToleranceSeconds
-					};
-					const payload = (yield* Effect.tryPromise({
-						try: () => useSymmetricValidation ? jwtVerify(verifiedIdToken, (() => {
-							if (typeof client.secret !== "string") throw new Error("OIDC provider uses symmetric ID token signatures but clientSecret is missing.");
-							return new TextEncoder().encode(client.secret);
-						})(), verificationOptions) : jwtVerify(verifiedIdToken, jwks, verificationOptions),
-						catch: asError
-					})).payload;
-					const tokenIssuerRaw = typeof payload.iss === "string" ? payload.iss : void 0;
-					const tokenIssuer = typeof tokenIssuerRaw === "string" ? tokenIssuerRaw.replace(/\/$/, "") : void 0;
-					if (!tokenIssuer || !expectedIssuers.includes(tokenIssuer)) return yield* Effect.fail(/* @__PURE__ */ new Error(`OIDC token issuer mismatch. Received: ${tokenIssuer ?? "<missing>"}. Expected one of: ${expectedIssuers.join(", ")}`));
-					if (payload.nonce !== ctx.nonce) return yield* Effect.fail(/* @__PURE__ */ new Error("OIDC nonce mismatch."));
-					if (Array.isArray(payload.aud) && payload.aud.length > 1 && payload.azp !== String(client.id)) return yield* Effect.fail(/* @__PURE__ */ new Error("OIDC authorized party does not match client ID."));
-					return payload;
-				}));
-				verifiedClaims = verified;
-				verifiedProfile = normalizeProfile(verified);
+				if (ctx.nonce === void 0) throw new Error("OIDC nonce is required.");
+				const idToken = tokens.idToken;
+				if (idToken === void 0) throw new Error("OIDC response is missing id_token.");
+				const verifiedIdToken = idToken;
+				const tokenAlg = decodeProtectedHeader(verifiedIdToken).alg;
+				const useSymmetricValidation = typeof tokenAlg === "string" && (tokenAlg === "HS256" || tokenAlg === "HS384" || tokenAlg === "HS512") && supportedIdTokenSigningAlgs.includes(tokenAlg);
+				const verificationOptions = {
+					audience: expectedAudience,
+					requiredClaims: [
+						"iss",
+						"sub",
+						"aud",
+						"exp",
+						"iat"
+					],
+					clockTolerance: clockToleranceSeconds
+				};
+				let verification;
+				try {
+					verification = await (useSymmetricValidation ? jwtVerify(verifiedIdToken, (() => {
+						if (typeof client.secret !== "string") throw new Error("OIDC provider uses symmetric ID token signatures but clientSecret is missing.");
+						return new TextEncoder().encode(client.secret);
+					})(), verificationOptions) : jwtVerify(verifiedIdToken, jwks, verificationOptions));
+				} catch (error) {
+					throw asError(error);
+				}
+				const payload = verification.payload;
+				const tokenIssuerRaw = typeof payload.iss === "string" ? payload.iss : void 0;
+				const tokenIssuer = typeof tokenIssuerRaw === "string" ? tokenIssuerRaw.replace(/\/$/, "") : void 0;
+				if (!tokenIssuer || !expectedIssuers.includes(tokenIssuer)) throw new Error(`OIDC token issuer mismatch. Received: ${tokenIssuer ?? "<missing>"}. Expected one of: ${expectedIssuers.join(", ")}`);
+				if (payload.nonce !== ctx.nonce) throw new Error("OIDC nonce mismatch.");
+				if (Array.isArray(payload.aud) && payload.aud.length > 1 && payload.azp !== String(client.id)) throw new Error("OIDC authorized party does not match client ID.");
+				verifiedClaims = payload;
+				verifiedProfile = normalizeProfile(payload);
 			},
 			accountLinking: config.accountLinking,
 			profile: async (tokens) => {
@@ -262,13 +276,13 @@ async function createGroupConnectionOidcProvider(config, redirectUri) {
 					verifiedProfile = normalizeProfile(claims);
 				}
 				if (userinfoEndpoint && typeof tokens.accessToken === "string") {
-					const userInfoProfile = await Effect.runPromise(userInfoProfileFx({
+					const userInfoProfile = await userInfoProfileFx({
 						endpoint: userinfoEndpoint,
 						accessToken: tokens.accessToken,
 						verifiedClaims,
 						verifiedProfile,
 						fetchImpl: oidcFetch
-					}));
+					});
 					if (userInfoProfile !== null) return userInfoProfile;
 				}
 				return verifiedProfile;

package/dist/server/tokens.js

@@ -1,5 +1,5 @@
-import { requireEnv } from "./env.js";
 import { generateRandomString } from "./random.js";
+import { requireEnv } from "./env.js";
 import { SignJWT, importPKCS8 } from "jose";
 
 //#region src/server/tokens.ts
@@ -7,11 +7,21 @@ const TOKEN_SUB_CLAIM_DIVIDER = "|";
 const DEFAULT_JWT_DURATION_MS = 1e3 * 60 * 60;
 const TOKEN_JTI_LENGTH = 24;
 const TOKEN_JTI_ALPHABET = "abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789";
+let cachedPrivateKeyPromise = null;
+let cachedIssuer = null;
+const getPrivateKey = () => {
+	if (cachedPrivateKeyPromise === null) cachedPrivateKeyPromise = importPKCS8(requireEnv("JWT_PRIVATE_KEY"), "RS256");
+	return cachedPrivateKeyPromise;
+};
+const getIssuer = () => {
+	if (cachedIssuer === null) cachedIssuer = requireEnv("CONVEX_SITE_URL");
+	return cachedIssuer;
+};
 /** @internal */
 async function generateToken(args, config) {
-	const privateKey = await importPKCS8(requireEnv("JWT_PRIVATE_KEY"), "RS256");
+	const privateKey = await getPrivateKey();
 	const expirationTime = new Date(Date.now() + (config.jwt?.durationMs ?? DEFAULT_JWT_DURATION_MS));
-	return await new SignJWT({ sub: args.userId + TOKEN_SUB_CLAIM_DIVIDER + args.sessionId }).setProtectedHeader({ alg: "RS256" }).setIssuedAt().setJti(generateRandomString(TOKEN_JTI_LENGTH, TOKEN_JTI_ALPHABET)).setIssuer(requireEnv("CONVEX_SITE_URL")).setAudience("convex").setExpirationTime(expirationTime).sign(privateKey);
+	return await new SignJWT({ sub: args.userId + TOKEN_SUB_CLAIM_DIVIDER + args.sessionId }).setProtectedHeader({ alg: "RS256" }).setIssuedAt().setJti(generateRandomString(TOKEN_JTI_LENGTH, TOKEN_JTI_ALPHABET)).setIssuer(getIssuer()).setAudience("convex").setExpirationTime(expirationTime).sign(privateKey);
 }
 
 //#endregion