@robelest/convex-auth 0.0.4-preview.28 → 0.0.4-preview.29

package/dist/component/schema.js

@@ -19,6 +19,7 @@ var schema_default = defineSchema({
 		phone: v.optional(v.string()),
 		phoneVerificationTime: v.optional(v.number()),
 		isAnonymous: v.optional(v.boolean()),
+		hasTotp: v.optional(v.boolean()),
 		extend: v.optional(v.any())
 	}).index("email", ["email"]).index("email_verified", ["email", "emailVerificationTime"]).index("phone", ["phone"]).index("phone_verified", ["phone", "phoneVerificationTime"]),
 	Session: defineTable({
@@ -136,7 +137,7 @@ var schema_default = defineSchema({
 		status: vGroupConnectionStatus,
 		config: v.optional(v.any()),
 		extend: v.optional(v.any())
-	}).index("group_id", ["groupId"]).index("slug", ["slug"]).index("status", ["status"]),
+	}).index("group_id", ["groupId"]).index("slug", ["slug"]).index("status", ["status"]).index("group_id_status", ["groupId", "status"]).index("group_id_slug", ["groupId", "slug"]),
 	GroupConnectionDomain: defineTable({
 		connectionId: v.id("GroupConnection"),
 		groupId: v.id("Group"),

package/dist/core/index.d.ts

@@ -1,5 +1,5 @@
 import { ComponentCtx, ComponentReadCtx } from "../server/componentContext.js";
-import { AuthAuthorizationConfig, ConvexAuthConfig, KeyDoc, KeyScope, ScopeChecker, UserOrderBy, UserWhere } from "../server/types.js";
+import { AuthAuthorizationConfig, ConvexAuthConfig, Doc, KeyDoc, KeyScope, ScopeChecker, UserOrderBy, UserWhere } from "../server/types.js";
 import { AuthProfile } from "../server/payloads.js";
 import { AuthConfig, AuthContext, AuthContextConfig, AuthContextFactory as AuthContextFactory$1, AuthContextResolver as AuthContextResolver$1, OptionalAuthContext, UserDoc } from "../server/auth-context.js";
 import "../component/index.js";
@@ -37,7 +37,10 @@ declare function createAuthContext(component: ConvexAuthConfig["component"], con
   authorization?: AuthAuthorizationConfig;
 }): {
   user: {
-    get: (ctx: ComponentReadCtx, userId: string) => Promise<any>;
+    get: {
+      (ctx: ComponentReadCtx, userId: string): Promise<Doc<"User"> | null>;
+      (ctx: ComponentReadCtx, userIds: readonly string[]): Promise<Array<Doc<"User"> | null>>;
+    };
     list: (ctx: ComponentReadCtx, opts?: {
       where?: UserWhere;
       limit?: number;
@@ -47,7 +50,7 @@ declare function createAuthContext(component: ConvexAuthConfig["component"], con
     }) => Promise<any>;
     viewer: (ctx: ComponentReadCtx & {
       auth: convex_server0.Auth;
-    }) => Promise<any>;
+    }) => Promise<Doc<"User"> | null>;
     update: (ctx: ComponentCtx, userId: string, data: Record<string, unknown>) => Promise<{
       userId: string;
     }>;
@@ -74,6 +77,9 @@ declare function createAuthContext(component: ConvexAuthConfig["component"], con
     current: (ctx: {
       auth: convex_server0.Auth;
     }) => Promise<convex_values0.GenericId<"Session"> | null>;
+    userId: (ctx: {
+      auth: convex_server0.Auth;
+    }) => Promise<convex_values0.GenericId<"User"> | null>;
     invalidate: <DataModel extends fluent_convex0.GenericDataModel>(ctx: convex_server0.GenericActionCtx<DataModel>, args: {
       userId: convex_values0.GenericId<"User">;
       except?: convex_values0.GenericId<"Session">[];
@@ -160,7 +166,10 @@ declare function createAuthContext(component: ConvexAuthConfig["component"], con
     }) => Promise<{
       groupId: string;
     }>;
-    get: (ctx: ComponentReadCtx, groupId: string) => Promise<any>;
+    get: {
+      (ctx: ComponentReadCtx, groupId: string): Promise<Doc<"Group"> | null>;
+      (ctx: ComponentReadCtx, groupIds: readonly string[]): Promise<Array<Doc<"Group"> | null>>;
+    };
     list: (ctx: ComponentReadCtx, opts?: {
       where?: {
         slug?: string;
@@ -193,7 +202,7 @@ declare function createAuthContext(component: ConvexAuthConfig["component"], con
       maxDepth?: number;
       includeSelf?: boolean;
     }) => Promise<{
-      ancestors: Record<string, unknown>[];
+      ancestors: Array<Exclude<Doc<"Group"> | null, null>>;
       cycleDetected: boolean;
       maxDepthReached: boolean;
     }>;
@@ -227,29 +236,44 @@ declare function createAuthContext(component: ConvexAuthConfig["component"], con
     update: (ctx: ComponentCtx, memberId: string, data: Record<string, unknown>) => Promise<{
       memberId: string;
     }>;
-    inspect: (ctx: ComponentReadCtx, opts: {
-      userId: string;
-      groupId: string;
-      ancestry?: boolean;
-      maxDepth?: number;
-    }) => Promise<{
-      membership: null;
-      roleIds: string[];
-      grants: string[];
-    } | {
-      membership: {
-        _id: string;
-        _creationTime: number;
+    inspect: {
+      (ctx: ComponentReadCtx, opts: {
+        userId: string;
         groupId: string;
+        ancestry?: boolean;
+        maxDepth?: number;
+      }): Promise<{
+        membership: {
+          _id: string;
+          _creationTime: number;
+          groupId: string;
+          userId: string;
+          role?: string;
+          roleIds?: string[];
+          status?: string;
+          extend?: Record<string, unknown>;
+        } | null;
+        roleIds: string[];
+        grants: string[];
+      }>;
+      (ctx: ComponentReadCtx, opts: {
         userId: string;
-        role?: string;
-        roleIds?: string[];
-        status?: string;
-        extend?: Record<string, unknown>;
-      };
-      roleIds: string[];
-      grants: string[];
-    }>;
+        groupIds: readonly string[];
+      }): Promise<Array<{
+        membership: {
+          _id: string;
+          _creationTime: number;
+          groupId: string;
+          userId: string;
+          role?: string;
+          roleIds?: string[];
+          status?: string;
+          extend?: Record<string, unknown>;
+        } | null;
+        roleIds: string[];
+        grants: string[];
+      }>>;
+    };
     require: (ctx: ComponentReadCtx, opts: {
       userId: string;
       groupId: string;
@@ -267,7 +291,7 @@ declare function createAuthContext(component: ConvexAuthConfig["component"], con
         roleIds?: string[];
         status?: string;
         extend?: Record<string, unknown>;
-      };
+      } | null;
       roleIds: string[];
       grants: string[];
     }>;
@@ -372,6 +396,18 @@ declare function createAuthContext(component: ConvexAuthConfig["component"], con
       secret: string;
     }>;
   };
+  /**
+   * Zero-round-trip helper: parse the current user id straight from the
+   * JWT subject claim. No component read, no cache lookup — just the
+   * identity token. Returns `null` when unauthenticated.
+   *
+   * Prefer this over `auth.context(ctx)` when you only need the user's
+   * id (e.g. early guards, routing decisions, audit logging). For the
+   * full user document, follow up with `auth.user.get(ctx, userId)`.
+   */
+  getUserId: (ctx: {
+    auth: convex_server0.Auth;
+  }) => Promise<convex_values0.GenericId<"User"> | null>;
   context: AuthContextResolver;
   ctx: AuthContextFactory;
 };

package/dist/core/index.js

@@ -70,6 +70,7 @@ function createAuthContext(component, config) {
 		member: domains.member,
 		invite: domains.invite,
 		key: domains.key,
+		getUserId: domains.session.userId,
 		context: ((ctx, config$1) => {
 			assertAuthResolverContext(ctx);
 			return createPublicAuthContext(authLike, ctx, config$1);

package/dist/providers/credentials.d.ts

@@ -1,3 +1,4 @@
+import { SessionIssuance } from "../server/sessions.js";
 import { AuthProviderConfig, ConvexCredentialsConfig, GenericActionCtxWithAuthConfig } from "../server/types.js";
 import { GenericId, Value } from "convex/values";
 import { GenericDataModel } from "convex/server";
@@ -14,6 +15,17 @@ interface CredentialsConfig<DataModel extends GenericDataModel = GenericDataMode
   authorize: (credentials: Partial<Record<string, Value | undefined>>, ctx: GenericActionCtxWithAuthConfig<DataModel>) => Promise<{
     userId: GenericId<"User">;
     sessionId?: GenericId<"Session">;
+    /**
+     * TOTP step-up hint. `false` skips the `totpGetVerifiedByUserId` query;
+     * `true`/`undefined` falls back to it.
+     */
+    hasTotp?: boolean;
+    /**
+     * Pre-issued session from a combined verify+issue mutation. When set,
+     * the framework skips the second `callSignIn` mutation and finalizes
+     * the issuance directly on the action side.
+     */
+    issuance?: SessionIssuance;
   } | null>;
   /** Optional hashing helpers for password-style credential verification. */
   crypto?: {

package/dist/providers/password.js

@@ -1,4 +1,6 @@
+import { callCredentialsSignIn } from "../server/mutations/credentialsSignIn.js";
 import { credentials } from "./credentials.js";
+import { ConvexError } from "convex/values";
 import { scryptAsync } from "@noble/hashes/scrypt.js";
 import { bytesToHex } from "@noble/hashes/utils.js";
 
@@ -92,7 +94,11 @@ function password(config = {}) {
 					accountId: account._id,
 					params
 				});
-				return { userId: user._id };
+				const hasTotp = user.hasTotp;
+				return {
+					userId: user._id,
+					hasTotp
+				};
 			};
 			if (flowDispatch.tag === "signUp") {
 				const secret = requirePasswordParam(params.password, "signUp");
@@ -108,16 +114,31 @@ function password(config = {}) {
 				});
 				return await finalizeCredentialsResult(created.account, created.user);
 			} else if (flowDispatch.tag === "signIn") {
-				const secret = requirePasswordParam(params.password, "signIn");
-				const retrieved = await ctx.auth.account.get(ctx, {
+				const result = await callCredentialsSignIn(ctx, {
 					provider,
 					account: {
 						id: email,
-						secret
-					}
+						secret: requirePasswordParam(params.password, "signIn")
+					},
+					generateTokens: true,
+					requireVerifiedEmail: verifyProvider !== void 0,
+					enforceTotp: true
 				});
-				if (retrieved === null) throw new Error("Invalid credentials");
-				return await finalizeCredentialsResult(retrieved.account, retrieved.user);
+				if (result.kind === "invalidAccount" || result.kind === "invalidSecret") throw new Error("Invalid credentials");
+				if (result.kind === "tooManyAttempts") throw new ConvexError({
+					code: "RATE_LIMITED",
+					message: "Too many failed sign-in attempts. Please try again later."
+				});
+				if (result.kind === "emailVerificationRequired") return await ctx.auth.provider.signIn(ctx, verifyProvider, {
+					accountId: result.account._id,
+					params
+				});
+				const hasTotp = result.kind === "signedIn" ? result.user.hasTotp : true;
+				return {
+					userId: result.user._id,
+					hasTotp,
+					issuance: result.issuance
+				};
 			} else if (flowDispatch.tag === "reset") {
 				if (!resetProvider) throw new Error(`Password reset is not enabled for ${provider}`);
 				const { account } = await ctx.auth.account.get(ctx, {

package/dist/server/auth-context.d.ts

@@ -139,6 +139,23 @@ type AuthContextConfig<TResolve extends Record<string, unknown> = Record<string,
    * of throwing `NOT_SIGNED_IN`.
    */
   optional?: boolean;
+  /**
+   * Resolve the active group + membership when building `ctx.auth`.
+   *
+   * The full resolver fires three sequential component reads on every
+   * call: `user.get`, `user.getActiveGroup`, `member.inspect`. For
+   * handlers that only need `userId` / `user` (e.g. `account:listPasskeys`,
+   * profile reads, self-service settings), the second and third reads are
+   * pure overhead.
+   *
+   * Set `group: false` to skip them. `ctx.auth.groupId`, `ctx.auth.role`,
+   * and `ctx.auth.grants` come back as `null` / `[]` without any
+   * component round-trip. Saves ~10–30ms per auth-gated call on the
+   * lightweight path.
+   *
+   * @defaultValue true
+   */
+  group?: boolean;
   /**
    * Attach additional derived fields to the auth context after the base auth
    * context is resolved.

package/dist/server/auth-context.js

@@ -3,7 +3,7 @@ import { ConvexError } from "convex/values";
 
 //#region src/server/auth-context.ts
 async function resolveConfiguredAuthContext(auth, ctx, config) {
-	const fallback = () => getAuthContext(auth, ctx);
+	const fallback = () => getAuthContext(auth, ctx, { group: config?.group !== false });
 	const authOverride = config?.authResolve ? await config.authResolve(ctx, fallback) : void 0;
 	return authOverride === void 0 ? await fallback() : authOverride;
 }

package/dist/server/auth.d.ts

@@ -34,12 +34,7 @@ type MemberApiWithAuthorization<TAuthorization extends AuthAuthorizationConfig |
   }) => Promise<{
     memberId: string;
   }>;
-  inspect: (ctx: Parameters<ReturnType<typeof Auth>["auth"]["member"]["inspect"]>[0], opts: {
-    userId: string;
-    groupId: string;
-    ancestry?: boolean;
-    maxDepth?: number;
-  }) => ReturnType<ReturnType<typeof Auth>["auth"]["member"]["inspect"]>;
+  inspect: ReturnType<typeof Auth>["auth"]["member"]["inspect"];
   require: (ctx: Parameters<ReturnType<typeof Auth>["auth"]["member"]["require"]>[0], opts: {
     userId: string;
     groupId: string;
@@ -77,6 +72,23 @@ type AuthApiBase<TAuthorization extends AuthAuthorizationConfig | undefined = un
   invite: ReturnType<typeof Auth>["auth"]["invite"];
   key: ReturnType<typeof Auth>["auth"]["key"];
   http: ReturnType<typeof Auth>["auth"]["http"];
+  /**
+   * Zero-round-trip helper: parse the current user id from the JWT subject
+   * claim. No component read, no cache lookup. Returns `null` when
+   * unauthenticated.
+   *
+   * Prefer this over `auth.context(ctx)` when a handler only needs the
+   * user's id (audit logging, early guards, routing). For the full user
+   * document, follow up with `auth.user.get(ctx, userId)` — cached per
+   * request.
+   *
+   * @example
+   * ```ts
+   * const userId = await auth.getUserId(ctx);
+   * if (!userId) throw new Error("Not signed in");
+   * ```
+   */
+  getUserId: ReturnType<typeof Auth>["auth"]["session"]["userId"];
   /**
    * Resolve the current request's auth context. Framework-agnostic — use
    * this in fluent-convex middleware, custom wrappers, or anywhere you

package/dist/server/auth.js

@@ -145,6 +145,7 @@ function createAuth(component, config) {
 		invite: authResult.auth.invite,
 		key: authResult.auth.key,
 		http: authResult.auth.http,
+		getUserId: authResult.auth.session.userId,
 		context: ((ctx, config$1) => {
 			assertAuthResolverContext(ctx);
 			return createPublicAuthContext(authResult.auth, ctx, config$1);

package/dist/server/context.js

@@ -8,9 +8,15 @@ async function getSessionUserId(ctx) {
 	return userIdFromIdentitySubject(identity.subject);
 }
 /** @internal */
-async function getAuthContextForUser(auth, ctx, userId) {
-	const user = await auth.user.get(ctx, userId);
-	const groupId = await auth.user.getActiveGroup(ctx, { userId });
+async function getAuthContextForUser(auth, ctx, userId, opts) {
+	if (opts?.group === false) return {
+		userId,
+		user: await auth.user.get(ctx, userId),
+		groupId: null,
+		role: null,
+		grants: []
+	};
+	const [user, groupId] = await Promise.all([auth.user.get(ctx, userId), auth.user.getActiveGroup(ctx, { userId })]);
 	let role = null;
 	let grants = [];
 	if (groupId) {
@@ -32,10 +38,10 @@ async function getAuthContextForUser(auth, ctx, userId) {
 	};
 }
 /** @internal */
-async function getAuthContext(auth, ctx) {
+async function getAuthContext(auth, ctx, opts) {
 	const userId = await getSessionUserId(ctx);
 	if (userId === null) return null;
-	return await getAuthContextForUser(auth, ctx, userId);
+	return await getAuthContextForUser(auth, ctx, userId, opts);
 }
 /** @internal */
 function createUnauthenticatedAuthContext() {

package/dist/server/contract.js

@@ -1,25 +1,57 @@
+import { cached, invalidateCtxCache } from "./ctxCache.js";
+
 //#region src/server/contract.ts
 const query = (ctx, ref, args) => ctx.runQuery(ref, args);
 const mutate = (ctx, ref, args) => ctx.runMutation(ref, args);
-const getGroupConnection = (ctx, componentPublic, connectionId) => query(ctx, componentPublic.groupConnectionGet, { connectionId });
-const getGroupConnectionByDomain = (ctx, componentPublic, domain) => query(ctx, componentPublic.groupConnectionGetByDomain, { domain });
+const getGroupConnection = (ctx, componentPublic, connectionId) => cached(ctx, `group-connection:${connectionId}`, () => query(ctx, componentPublic.groupConnectionGet, { connectionId }));
+const getGroupConnectionByDomain = (ctx, componentPublic, domain) => cached(ctx, `group-connection-domain:${domain}`, () => query(ctx, componentPublic.groupConnectionGetByDomain, { domain }));
 const listGroupConnections = (ctx, componentPublic, args) => query(ctx, componentPublic.groupConnectionList, args);
 const createGroupConnection = (ctx, componentPublic, args) => mutate(ctx, componentPublic.groupConnectionCreate, args);
-const updateGroupConnection = (ctx, componentPublic, args) => mutate(ctx, componentPublic.groupConnectionUpdate, args);
-const deleteGroupConnection = (ctx, componentPublic, connectionId) => mutate(ctx, componentPublic.groupConnectionDelete, { connectionId });
-const getGroup = (ctx, componentPublic, groupId) => query(ctx, componentPublic.groupGet, { groupId });
-const listConnectionDomains = (ctx, componentPublic, connectionId) => query(ctx, componentPublic.groupConnectionDomainList, { connectionId });
-const addConnectionDomain = (ctx, componentPublic, args) => mutate(ctx, componentPublic.groupConnectionDomainAdd, args);
-const deleteConnectionDomain = (ctx, componentPublic, domainId) => mutate(ctx, componentPublic.groupConnectionDomainDelete, { domainId });
-const getScimConfigByConnection = (ctx, componentPublic, connectionId) => query(ctx, componentPublic.groupConnectionScimConfigGetByGroupConnection, { connectionId });
+const updateGroupConnection = async (ctx, componentPublic, args) => {
+	const result = await mutate(ctx, componentPublic.groupConnectionUpdate, args);
+	invalidateCtxCache(ctx, `group-connection:${args.connectionId}`);
+	invalidateCtxCache(ctx, "group-connection-domain");
+	return result;
+};
+const deleteGroupConnection = async (ctx, componentPublic, connectionId) => {
+	const result = await mutate(ctx, componentPublic.groupConnectionDelete, { connectionId });
+	invalidateCtxCache(ctx, `group-connection:${connectionId}`);
+	invalidateCtxCache(ctx, "group-connection-domain");
+	invalidateCtxCache(ctx, `connection-domains:${connectionId}`);
+	invalidateCtxCache(ctx, "group-connection-secret");
+	return result;
+};
+const getGroup = (ctx, componentPublic, groupId) => cached(ctx, `group-record:${groupId}`, () => query(ctx, componentPublic.groupGet, { groupId }));
+const listConnectionDomains = (ctx, componentPublic, connectionId) => cached(ctx, `connection-domains:${connectionId}`, () => query(ctx, componentPublic.groupConnectionDomainList, { connectionId }));
+const addConnectionDomain = async (ctx, componentPublic, args) => {
+	const result = await mutate(ctx, componentPublic.groupConnectionDomainAdd, args);
+	invalidateCtxCache(ctx, `connection-domains:${args.connectionId}`);
+	invalidateCtxCache(ctx, "group-connection-domain");
+	return result;
+};
+const deleteConnectionDomain = async (ctx, componentPublic, domainId) => {
+	const result = await mutate(ctx, componentPublic.groupConnectionDomainDelete, { domainId });
+	invalidateCtxCache(ctx, "connection-domains");
+	invalidateCtxCache(ctx, "group-connection-domain");
+	return result;
+};
+const getScimConfigByConnection = (ctx, componentPublic, connectionId) => cached(ctx, `scim-config-by-connection:${connectionId}`, () => query(ctx, componentPublic.groupConnectionScimConfigGetByGroupConnection, { connectionId }));
 const getScimConfigByTokenHash = (ctx, componentPublic, tokenHash) => query(ctx, componentPublic.groupConnectionScimConfigGetByTokenHash, { tokenHash });
-const upsertScimConfig = (ctx, componentPublic, args) => mutate(ctx, componentPublic.groupConnectionScimConfigUpsert, args);
+const upsertScimConfig = async (ctx, componentPublic, args) => {
+	const result = await mutate(ctx, componentPublic.groupConnectionScimConfigUpsert, args);
+	invalidateCtxCache(ctx, `scim-config-by-connection:${args.connectionId}`);
+	return result;
+};
 const getConnectionDomainVerification = (ctx, componentPublic, domainId) => query(ctx, componentPublic.groupConnectionDomainVerificationGet, { domainId });
 const upsertConnectionDomainVerification = (ctx, componentPublic, args) => mutate(ctx, componentPublic.groupConnectionDomainVerificationUpsert, args);
 const deleteConnectionDomainVerification = (ctx, componentPublic, domainId) => mutate(ctx, componentPublic.groupConnectionDomainVerificationDelete, { domainId });
 const verifyConnectionDomain = (ctx, componentPublic, args) => mutate(ctx, componentPublic.groupConnectionDomainVerify, args);
-const getGroupConnectionSecret = (ctx, componentPublic, args) => query(ctx, componentPublic.groupConnectionSecretGet, args);
-const upsertGroupConnectionSecret = (ctx, componentPublic, args) => mutate(ctx, componentPublic.groupConnectionSecretUpsert, args);
+const getGroupConnectionSecret = (ctx, componentPublic, args) => cached(ctx, `group-connection-secret:${args.connectionId}:${args.kind}`, () => query(ctx, componentPublic.groupConnectionSecretGet, args));
+const upsertGroupConnectionSecret = async (ctx, componentPublic, args) => {
+	const result = await mutate(ctx, componentPublic.groupConnectionSecretUpsert, args);
+	invalidateCtxCache(ctx, `group-connection-secret:${args.connectionId}:${args.kind}`);
+	return result;
+};
 const listWebhookEndpoints = (ctx, componentPublic, connectionId) => query(ctx, componentPublic.groupWebhookEndpointList, { connectionId });
 const listWebhookDeliveries = (ctx, componentPublic, args) => query(ctx, componentPublic["groupWebhookDeliveryList"], args);
 const listScimIdentitiesByConnection = (ctx, componentPublic, connectionId) => query(ctx, componentPublic.groupConnectionScimIdentityListByGroupConnection, { connectionId });