@robelest/convex-auth 0.0.4-preview.28 → 0.0.4-preview.29

package/dist/server/core.js

@@ -1,4 +1,5 @@
 import { getSessionUserId } from "./context.js";
+import { cached, ctxCacheHas, invalidateCtxCache } from "./ctxCache.js";
 import { generateRandomString, sha256 } from "./random.js";
 import { buildScopeChecker, checkKeyRateLimit, generateApiKey, hashApiKey } from "./keys.js";
 import { TOKEN_SUB_CLAIM_DIVIDER } from "./constants.js";
@@ -34,34 +35,6 @@ function createCoreDomains(deps) {
 		});
 		return normalized;
 	};
-	const listAllKeysByUser = async (ctx, userId) => {
-		const items = [];
-		let cursor = null;
-		do {
-			const page = await ctx.runQuery(config.component.public.keyList, {
-				where: { userId },
-				limit: 100,
-				cursor
-			});
-			items.push(...page.items);
-			cursor = page.nextCursor;
-		} while (cursor !== null);
-		return items;
-	};
-	const listAllMembersByUser = async (ctx, userId) => {
-		const items = [];
-		let cursor = null;
-		do {
-			const page = await ctx.runQuery(config.component.public.memberList, {
-				where: { userId },
-				limit: 100,
-				cursor
-			});
-			items.push(...page.items);
-			cursor = page.nextCursor;
-		} while (cursor !== null);
-		return items;
-	};
 	const resolveGrantedPermissions = (roleIds) => {
 		const grants = /* @__PURE__ */ new Set();
 		for (const roleId of roleIds ?? []) {
@@ -71,23 +44,27 @@ function createCoreDomains(deps) {
 		}
 		return Array.from(grants).sort();
 	};
-	const AUTH_CACHE = Symbol("__convexAuthCache");
-	function cache(ctx) {
-		const cachedCtx = ctx;
-		if (!cachedCtx[AUTH_CACHE]) cachedCtx[AUTH_CACHE] = {
-			users: /* @__PURE__ */ new Map(),
-			groups: /* @__PURE__ */ new Map()
-		};
-		return cachedCtx[AUTH_CACHE];
+	async function userGet(ctx, input) {
+		if (typeof input === "string") return await cached(ctx, `user:${input}`, () => ctx.runQuery(config.component.public.userGetById, { userId: input }));
+		const userIds = input;
+		if (userIds.length === 0) return [];
+		const unique = Array.from(new Set(userIds));
+		const toFetch = [];
+		for (const id of unique) if (!ctxCacheHas(ctx, `user:${id}`)) toFetch.push(id);
+		if (toFetch.length > 0) {
+			const sharedFetch = ctx.runQuery(config.component.public["userGetMany"], { userIds: toFetch });
+			for (let i = 0; i < toFetch.length; i += 1) {
+				const id = toFetch[i];
+				const indexInBatch = i;
+				cached(ctx, `user:${id}`, async () => {
+					return (await sharedFetch)[indexInBatch] ?? null;
+				});
+			}
+		}
+		return await Promise.all(userIds.map((id) => cached(ctx, `user:${id}`, () => ctx.runQuery(config.component.public.userGetById, { userId: id }))));
 	}
 	const user = {
-		get: async (ctx, userId) => {
-			const c = cache(ctx);
-			if (c.users.has(userId)) return c.users.get(userId);
-			const result = await ctx.runQuery(config.component.public.userGetById, { userId });
-			c.users.set(userId, result);
-			return result;
-		},
+		get: userGet,
 		list: async (ctx, opts = {}) => {
 			return await ctx.runQuery(config.component.public.userList, opts);
 		},
@@ -101,6 +78,7 @@ function createCoreDomains(deps) {
 				userId,
 				data
 			});
+			invalidateCtxCache(ctx, `user:${userId}`);
 			return { userId };
 		},
 		setActiveGroup: async (ctx, opts) => {
@@ -132,29 +110,11 @@ function createCoreDomains(deps) {
 			return null;
 		},
 		delete: async (ctx, userId, opts) => {
-			const cascade = opts?.cascade !== false;
-			const [sessions, accounts, keys, members, passkeys, totps] = await Promise.all([
-				ctx.runQuery(config.component.public.sessionListByUser, { userId }),
-				ctx.runQuery(config.component.public.accountListByUser, { userId }),
-				listAllKeysByUser(ctx, userId),
-				listAllMembersByUser(ctx, userId),
-				ctx.runQuery(config.component.public.passkeyListByUserId, { userId }),
-				ctx.runQuery(config.component.public.totpListByUserId, { userId })
-			]);
-			const totalLinked = sessions.length + accounts.length + keys.length + members.length + passkeys.length + totps.length;
-			if (!cascade && totalLinked > 0) throw new ConvexError({
-				code: "INVALID_PARAMETERS",
-				message: "The provided parameters are invalid."
+			await ctx.runMutation(config.component.public.userDelete, {
+				userId,
+				cascade: opts?.cascade !== false
 			});
-			const deletions = [];
-			for (const s of sessions) deletions.push(ctx.runMutation(config.component.public.sessionDelete, { sessionId: s._id }));
-			for (const a of accounts) deletions.push(ctx.runMutation(config.component.public.accountDelete, { accountId: a._id }));
-			for (const k of keys) deletions.push(ctx.runMutation(config.component.public.keyDelete, { keyId: k._id }));
-			for (const m of members) deletions.push(ctx.runMutation(config.component.public.memberRemove, { memberId: m._id }));
-			for (const p of passkeys) deletions.push(ctx.runMutation(config.component.public.passkeyDelete, { passkeyId: p._id }));
-			for (const t of totps) deletions.push(ctx.runMutation(config.component.public.totpDelete, { totpId: t._id }));
-			await Promise.all(deletions);
-			await ctx.runMutation(config.component.public.userDelete, { userId });
+			invalidateCtxCache(ctx);
 			return { userId };
 		}
 	};
@@ -165,6 +125,12 @@ function createCoreDomains(deps) {
 			const [, sessionId] = identity.subject.split(TOKEN_SUB_CLAIM_DIVIDER);
 			return sessionId;
 		},
+		userId: async (ctx) => {
+			const identity = await ctx.auth.getUserIdentity();
+			if (identity === null) return null;
+			const [userId] = identity.subject.split(TOKEN_SUB_CLAIM_DIVIDER);
+			return userId ?? null;
+		},
 		invalidate: async (ctx, args) => {
 			await callInvalidateSessions(ctx, args);
 			return {
@@ -173,7 +139,7 @@ function createCoreDomains(deps) {
 			};
 		},
 		get: async (ctx, sessionId) => {
-			return await ctx.runQuery(config.component.public.sessionGetById, { sessionId });
+			return await cached(ctx, `session:${sessionId}`, () => ctx.runQuery(config.component.public.sessionGetById, { sessionId }));
 		},
 		list: async (ctx, opts) => {
 			return await ctx.runQuery(config.component.public.sessionListByUser, { userId: opts.userId });
@@ -193,16 +159,10 @@ function createCoreDomains(deps) {
 			return { accountId: args.account.id };
 		},
 		delete: async (ctx, accountId) => {
-			const doc = await ctx.runQuery(config.component.public.accountGetById, { accountId });
-			if (doc === null) throw new ConvexError({
-				code: "ACCOUNT_NOT_FOUND",
-				message: "Account not found."
+			await ctx.runMutation(config.component.public.accountDelete, {
+				accountId,
+				requireOtherAccount: true
 			});
-			if ((await ctx.runQuery(config.component.public.accountListByUser, { userId: doc.userId })).length <= 1) throw new ConvexError({
-				code: "INVALID_PARAMETERS",
-				message: "The provided parameters are invalid."
-			});
-			await ctx.runMutation(config.component.public.accountDelete, { accountId });
 			return { accountId };
 		},
 		listPasskeys: async (ctx, opts) => {
@@ -230,17 +190,30 @@ function createCoreDomains(deps) {
 	const provider = { signIn: deps.signInForProvider ? async (ctx, providerConfig, args) => {
 		return deps.signInForProvider(ctx, providerConfig, args);
 	} : void 0 };
+	async function groupGet(ctx, input) {
+		if (typeof input === "string") return await cached(ctx, `group:${input}`, () => ctx.runQuery(config.component.public.groupGet, { groupId: input }));
+		const groupIds = input;
+		if (groupIds.length === 0) return [];
+		const unique = Array.from(new Set(groupIds));
+		const toFetch = [];
+		for (const id of unique) if (!ctxCacheHas(ctx, `group:${id}`)) toFetch.push(id);
+		if (toFetch.length > 0) {
+			const sharedFetch = ctx.runQuery(config.component.public["groupGetMany"], { groupIds: toFetch });
+			for (let i = 0; i < toFetch.length; i += 1) {
+				const id = toFetch[i];
+				const indexInBatch = i;
+				cached(ctx, `group:${id}`, async () => {
+					return (await sharedFetch)[indexInBatch] ?? null;
+				});
+			}
+		}
+		return await Promise.all(groupIds.map((id) => cached(ctx, `group:${id}`, () => ctx.runQuery(config.component.public.groupGet, { groupId: id }))));
+	}
 	const group = {
 		create: async (ctx, data) => {
 			return { groupId: await ctx.runMutation(config.component.public.groupCreate, data) };
 		},
-		get: async (ctx, groupId) => {
-			const c = cache(ctx);
-			if (c.groups.has(groupId)) return c.groups.get(groupId);
-			const result = await ctx.runQuery(config.component.public.groupGet, { groupId });
-			c.groups.set(groupId, result);
-			return result;
-		},
+		get: groupGet,
 		list: async (ctx, opts) => {
 			return await ctx.runQuery(config.component.public.groupList, {
 				where: opts?.where,
@@ -255,61 +228,109 @@ function createCoreDomains(deps) {
 				groupId,
 				data
 			});
+			invalidateCtxCache(ctx, `group:${groupId}`);
 			return { groupId };
 		},
 		delete: async (ctx, groupId) => {
 			await ctx.runMutation(config.component.public.groupDelete, { groupId });
+			invalidateCtxCache(ctx, `group:${groupId}`);
+			invalidateCtxCache(ctx, "member");
+			invalidateCtxCache(ctx, "member-inspect");
 			return { groupId };
 		},
 		ancestors: async (ctx, opts) => {
-			const maxDepth = Math.max(0, Math.floor(opts.maxDepth ?? 32));
-			const visited = /* @__PURE__ */ new Set();
-			const ancestors = [];
-			let cycleDetected = false;
-			let maxDepthReached = false;
-			let currentGroupId = opts.groupId;
-			let depth = 0;
-			let isFirst = true;
-			while (currentGroupId !== void 0) {
-				if (depth > maxDepth) {
-					maxDepthReached = true;
-					break;
-				}
-				if (visited.has(currentGroupId)) {
-					cycleDetected = true;
-					break;
-				}
-				visited.add(currentGroupId);
-				const doc = await group.get(ctx, currentGroupId);
-				if (doc === null) break;
-				if (isFirst) {
-					isFirst = false;
-					if (opts.includeSelf) ancestors.push(doc);
-					currentGroupId = doc.parentGroupId;
-					depth += 1;
-					continue;
-				}
-				ancestors.push(doc);
-				currentGroupId = doc.parentGroupId;
-				depth += 1;
+			const ancestorsRef = config.component.public["groupAncestors"];
+			const result = await ctx.runQuery(ancestorsRef, {
+				groupId: opts.groupId,
+				maxDepth: opts.maxDepth,
+				includeSelf: opts.includeSelf
+			});
+			for (const ancestor of result.ancestors) {
+				const id = ancestor._id;
+				cached(ctx, `group:${id}`, () => Promise.resolve(ancestor));
 			}
-			return {
-				ancestors,
-				cycleDetected,
-				maxDepthReached
-			};
+			return result;
 		}
 	};
+	async function memberInspect(ctx, opts) {
+		if ("groupIds" in opts) {
+			const { userId, groupIds } = opts;
+			if (groupIds.length === 0) return [];
+			const unique = Array.from(new Set(groupIds));
+			const toFetch = [];
+			for (const groupId of unique) if (!ctxCacheHas(ctx, `member-inspect:${userId}:${groupId}:n`)) toFetch.push(groupId);
+			if (toFetch.length > 0) {
+				const sharedFetch = ctx.runQuery(config.component.public["memberGetByGroupAndUserMany"], {
+					userId,
+					groupIds: toFetch
+				});
+				for (let i = 0; i < toFetch.length; i += 1) {
+					const groupId = toFetch[i];
+					const indexInBatch = i;
+					cached(ctx, `member-inspect:${userId}:${groupId}:n`, async () => {
+						return (await sharedFetch)[indexInBatch] ?? null;
+					});
+				}
+			}
+			return await Promise.all(groupIds.map(async (groupId) => {
+				const membership$1 = await cached(ctx, `member-inspect:${userId}:${groupId}:n`, () => ctx.runQuery(config.component.public.memberGetByGroupAndUser, {
+					userId,
+					groupId
+				}));
+				if (membership$1 === null) return {
+					membership: null,
+					roleIds: [],
+					grants: []
+				};
+				const membershipRoleIds$1 = membership$1.roleIds ?? [];
+				return {
+					membership: membership$1,
+					roleIds: membershipRoleIds$1,
+					grants: resolveGrantedPermissions(membershipRoleIds$1)
+				};
+			}));
+		}
+		const useAncestry = opts.ancestry === true;
+		const maxDepth = useAncestry ? Math.max(0, Math.floor(opts.maxDepth ?? 32)) : 0;
+		const cacheKey = `member-inspect:${opts.userId}:${opts.groupId}:${useAncestry ? `a${maxDepth}` : "n"}`;
+		let membership = null;
+		if (useAncestry) {
+			const memberResolveRef = config.component.public["memberResolve"];
+			membership = (await cached(ctx, cacheKey, () => ctx.runQuery(memberResolveRef, {
+				userId: opts.userId,
+				groupId: opts.groupId,
+				maxDepth,
+				ancestry: true
+			}))).membership;
+		} else membership = await cached(ctx, cacheKey, () => ctx.runQuery(config.component.public.memberGetByGroupAndUser, {
+			userId: opts.userId,
+			groupId: opts.groupId
+		}));
+		if (membership === null) return {
+			membership: null,
+			roleIds: [],
+			grants: []
+		};
+		const membershipRoleIds = membership.roleIds ?? [];
+		const membershipGrants = resolveGrantedPermissions(membershipRoleIds);
+		return {
+			membership,
+			roleIds: membershipRoleIds,
+			grants: membershipGrants
+		};
+	}
 	const member = {
 		create: async (ctx, data) => {
 			const roleIds = normalizeRoleIds(data.roleIds);
-			return { memberId: await ctx.runMutation(config.component.public.memberAdd, {
+			const memberId = await ctx.runMutation(config.component.public.memberAdd, {
 				...data,
 				roleIds
-			}) };
+			});
+			invalidateCtxCache(ctx, `member-inspect:${data.userId}:${data.groupId}`);
+			return { memberId };
 		},
 		get: async (ctx, memberId) => {
-			return await ctx.runQuery(config.component.public.memberGet, { memberId });
+			return await cached(ctx, `member:${memberId}`, () => ctx.runQuery(config.component.public.memberGet, { memberId }));
 		},
 		list: async (ctx, opts) => {
 			return await ctx.runQuery(config.component.public.memberList, {
@@ -322,6 +343,8 @@ function createCoreDomains(deps) {
 		},
 		delete: async (ctx, memberId) => {
 			await ctx.runMutation(config.component.public.memberRemove, { memberId });
+			invalidateCtxCache(ctx, "member");
+			invalidateCtxCache(ctx, "member-inspect");
 			return { memberId };
 		},
 		update: async (ctx, memberId, data) => {
@@ -331,37 +354,11 @@ function createCoreDomains(deps) {
 				memberId,
 				data: nextData
 			});
+			invalidateCtxCache(ctx, `member:${memberId}`);
+			invalidateCtxCache(ctx, "member-inspect");
 			return { memberId };
 		},
-		inspect: async (ctx, opts) => {
-			const useAncestry = opts.ancestry === true;
-			let membership = null;
-			if (useAncestry) {
-				const maxDepth = Math.max(0, Math.floor(opts.maxDepth ?? 32));
-				const memberResolveRef = config.component.public["memberResolve"];
-				membership = (await ctx.runQuery(memberResolveRef, {
-					userId: opts.userId,
-					groupId: opts.groupId,
-					maxDepth,
-					ancestry: true
-				})).membership;
-			} else membership = await ctx.runQuery(config.component.public.memberGetByGroupAndUser, {
-				userId: opts.userId,
-				groupId: opts.groupId
-			});
-			if (membership === null) return {
-				membership: null,
-				roleIds: [],
-				grants: []
-			};
-			const membershipRoleIds = membership.roleIds ?? [];
-			const membershipGrants = resolveGrantedPermissions(membershipRoleIds);
-			return {
-				membership,
-				roleIds: membershipRoleIds,
-				grants: membershipGrants
-			};
-		},
+		inspect: memberInspect,
 		require: async (ctx, opts) => {
 			const validatedRoleIds = normalizeRoleIds(opts.roleIds);
 			const requiredGrants = Array.from(new Set(opts.grants ?? []));

package/dist/server/ctxCache.js

@@ -0,0 +1,94 @@
+//#region src/server/ctxCache.ts
+/**
+* Per-execution cache for Convex auth component reads.
+*
+* Convex components are invoked across a function boundary — every
+* `auth.user.get`, `auth.member.inspect`, `getGroupConnection`, etc. is
+* `ctx.runQuery(components.auth.…)`. Each crossing costs ~10–30ms.
+* Inside a single handler we often fetch the same entity several times
+* (outer `auth.ctx()` resolver + inner `auth.member.require` calls +
+* SSO admin authorizer target resolution + the handler body itself).
+*
+* This module attaches a `Map<string, Promise<unknown>>` to the ctx via
+* a Symbol so that concurrent and repeated reads of the same key within
+* a single function invocation share one component round-trip. The cache
+* lives for the lifetime of the ctx object and dies with it.
+*
+* Semantics:
+* - Keys are namespaced strings (`user:abc`, `group:xyz`, etc.).
+* - Promises are stored — two concurrent callers dedup correctly.
+* - Rejected promises are evicted so a retry can succeed.
+* - Writes do **not** automatically invalidate reads; this matches the
+*   Convex transactional model where a mutation sees its own writes only
+*   on subsequent calls. If a handler writes and then re-reads an entity
+*   expecting fresh data, it must call {@link invalidateCtxCache} with the
+*   appropriate key (or key prefix).
+*
+* @module
+* @internal
+*/
+const CACHE_SYMBOL = Symbol.for("@robelest/convex-auth/ctxCache");
+/**
+* Get (or lazily create) the cache store attached to a Convex ctx.
+* @internal
+*/
+function getCtxCache(ctx) {
+	const c = ctx;
+	let store = c[CACHE_SYMBOL];
+	if (store === void 0) {
+		store = /* @__PURE__ */ new Map();
+		c[CACHE_SYMBOL] = store;
+	}
+	return store;
+}
+/**
+* Check whether the ctx cache already holds an entry under `key`.
+*
+* Useful before a batched fetch: callers can short-circuit the RPC if every
+* needed ID is already cached, or compute the exact subset to request.
+*
+* @internal
+*/
+function ctxCacheHas(ctx, key) {
+	return getCtxCache(ctx).has(key);
+}
+/**
+* Memoize an async read against the ctx cache.
+*
+* The returned promise is cached under `key`; concurrent callers get the
+* same in-flight promise. If the promise rejects, the entry is removed so a
+* later retry can succeed.
+*
+* @internal
+*/
+function cached(ctx, key, fn) {
+	const store = getCtxCache(ctx);
+	const hit = store.get(key);
+	if (hit !== void 0) return hit;
+	const promise = fn().catch((err) => {
+		if (store.get(key) === promise) store.delete(key);
+		throw err;
+	});
+	store.set(key, promise);
+	return promise;
+}
+/**
+* Drop a single cache entry (or all entries matching a prefix).
+*
+* Use this from mutations that write to an entity the cache already holds.
+* Passing no prefix clears the entire cache.
+*
+* @internal
+*/
+function invalidateCtxCache(ctx, keyPrefix) {
+	const store = getCtxCache(ctx);
+	if (keyPrefix === void 0 || keyPrefix === "") {
+		store.clear();
+		return;
+	}
+	for (const key of store.keys()) if (key === keyPrefix || key.startsWith(`${keyPrefix}:`)) store.delete(key);
+}
+
+//#endregion
+export { cached, ctxCacheHas, invalidateCtxCache };
+//# sourceMappingURL=ctxCache.js.map

package/dist/server/limits.js

@@ -3,21 +3,45 @@ import { authDb } from "./db.js";
 //#region src/server/limits.ts
 const DEFAULT_MAX_SIGN_IN_ATTEMPTS_PER_HOUR = 10;
 /**
+* Fetch and compute the live rate-limit state for a sign-in identifier.
+*
+* Returns `null` when no rate-limit document exists yet (the identifier
+* has never seen a failed attempt). The returned `limit` document carries
+* the `_id` needed for any subsequent `patch`/`delete` — letting the
+* caller reuse the same fetch instead of refetching inside each mutator.
+*
+* @internal
+*/
+async function getSignInRateLimitState(ctx, identifier, config) {
+	return await getRateLimitState(ctx, identifier, config);
+}
+/**
 * Check whether the given identifier is currently rate-limited.
 * @internal
 */
 async function isSignInRateLimited(ctx, identifier, config) {
-	const state = await getRateLimitState(ctx, identifier, config);
+	return isStateRateLimited(await getRateLimitState(ctx, identifier, config));
+}
+/**
+* Test a previously-loaded rate-limit state without re-reading the doc.
+* @internal
+*/
+function isStateRateLimited(state) {
 	return state !== null && state.attemptsLeft < 1;
 }
 /**
 * Record a failed sign-in attempt for the given identifier.
+*
+* Accepts an optional pre-loaded `state` so callers that already fetched
+* the rate-limit doc (typically via {@link getSignInRateLimitState}) can
+* avoid a second component round-trip.
+*
 * @internal
 */
-async function recordFailedSignIn(ctx, identifier, config) {
-	const state = await getRateLimitState(ctx, identifier, config);
-	if (state !== null) await authDb(ctx, config).rateLimits.patch(state.limit._id, {
-		attemptsLeft: state.attemptsLeft - 1,
+async function recordFailedSignIn(ctx, identifier, config, state) {
+	const resolved = state !== void 0 ? state : await getRateLimitState(ctx, identifier, config);
+	if (resolved !== null) await authDb(ctx, config).rateLimits.patch(resolved.limit._id, {
+		attemptsLeft: resolved.attemptsLeft - 1,
 		lastAttemptTime: Date.now()
 	});
 	else await authDb(ctx, config).rateLimits.create({
@@ -28,11 +52,17 @@ async function recordFailedSignIn(ctx, identifier, config) {
 }
 /**
 * Reset the rate limit for the given identifier.
+*
+* Accepts an optional pre-loaded `state` so callers with a cached state
+* (e.g. from an earlier {@link isSignInRateLimited} / {@link getSignInRateLimitState}
+* call) can skip the redundant read. Previously, the verify flow was loading
+* the same rate-limit doc twice per successful sign-in.
+*
 * @internal
 */
-async function resetSignInRateLimit(ctx, identifier, config) {
-	const state = await getRateLimitState(ctx, identifier, config);
-	if (state !== null) await authDb(ctx, config).rateLimits.delete(state.limit._id);
+async function resetSignInRateLimit(ctx, identifier, config, state) {
+	const resolved = state !== void 0 ? state : await getRateLimitState(ctx, identifier, config);
+	if (resolved !== null) await authDb(ctx, config).rateLimits.delete(resolved.limit._id);
 }
 async function getRateLimitState(ctx, identifier, config) {
 	const typedLimit = await authDb(ctx, config).rateLimits.get(identifier);
@@ -48,5 +78,5 @@ async function getRateLimitState(ctx, identifier, config) {
 }
 
 //#endregion
-export { isSignInRateLimited, recordFailedSignIn, resetSignInRateLimit };
+export { getSignInRateLimitState, isSignInRateLimited, isStateRateLimited, recordFailedSignIn, resetSignInRateLimit };
 //# sourceMappingURL=limits.js.map