@robelest/convex-auth 0.0.4-preview.29 → 0.0.4-preview.30

package/dist/core/index.d.ts

@@ -1,15 +1,14 @@
-import { ComponentCtx, ComponentReadCtx } from "../server/componentContext.js";
 import { AuthAuthorizationConfig, ConvexAuthConfig, Doc, KeyDoc, KeyScope, ScopeChecker, UserOrderBy, UserWhere } from "../server/types.js";
+import { AuthConfig, AuthContext, AuthContextConfig, AuthContextFactory, AuthContextResolver, OptionalAuthContext, UserDoc } from "../server/auth-context.js";
+import { ComponentCtx, ComponentReadCtx } from "../server/componentContext.js";
 import { AuthProfile } from "../server/payloads.js";
-import { AuthConfig, AuthContext, AuthContextConfig, AuthContextFactory as AuthContextFactory$1, AuthContextResolver as AuthContextResolver$1, OptionalAuthContext, UserDoc } from "../server/auth-context.js";
 import "../component/index.js";
+import "../server/convexIdentity.js";
 import * as convex_values0 from "convex/values";
 import * as convex_server0 from "convex/server";
 import * as fluent_convex0 from "fluent-convex";
 
 //#region src/core/index.d.ts
-type AuthContextResolver = AuthContextResolver$1;
-type AuthContextFactory = AuthContextFactory$1;
 /**
  * Create a lightweight auth context object.
  *
@@ -36,6 +35,8 @@ type AuthContextFactory = AuthContextFactory$1;
 declare function createAuthContext(component: ConvexAuthConfig["component"], config?: Omit<AuthConfig, "providers"> & {
   authorization?: AuthAuthorizationConfig;
 }): {
+  context: AuthContextResolver;
+  ctx: AuthContextFactory;
   user: {
     get: {
       (ctx: ComponentReadCtx, userId: string): Promise<Doc<"User"> | null>;
@@ -74,12 +75,6 @@ declare function createAuthContext(component: ConvexAuthConfig["component"], con
     }>;
   };
   session: {
-    current: (ctx: {
-      auth: convex_server0.Auth;
-    }) => Promise<convex_values0.GenericId<"Session"> | null>;
-    userId: (ctx: {
-      auth: convex_server0.Auth;
-    }) => Promise<convex_values0.GenericId<"User"> | null>;
     invalidate: <DataModel extends fluent_convex0.GenericDataModel>(ctx: convex_server0.GenericActionCtx<DataModel>, args: {
       userId: convex_values0.GenericId<"User">;
       except?: convex_values0.GenericId<"Session">[];
@@ -396,20 +391,6 @@ declare function createAuthContext(component: ConvexAuthConfig["component"], con
       secret: string;
     }>;
   };
-  /**
-   * Zero-round-trip helper: parse the current user id straight from the
-   * JWT subject claim. No component read, no cache lookup — just the
-   * identity token. Returns `null` when unauthenticated.
-   *
-   * Prefer this over `auth.context(ctx)` when you only need the user's
-   * id (e.g. early guards, routing decisions, audit logging). For the
-   * full user document, follow up with `auth.user.get(ctx, userId)`.
-   */
-  getUserId: (ctx: {
-    auth: convex_server0.Auth;
-  }) => Promise<convex_values0.GenericId<"User"> | null>;
-  context: AuthContextResolver;
-  ctx: AuthContextFactory;
 };
 //#endregion
 export { type AuthContext, type AuthContextConfig, type OptionalAuthContext, type UserDoc, createAuthContext };

package/dist/core/index.js

@@ -1,4 +1,5 @@
-import { assertAuthResolverContext, createAuthContextCustomization, createPublicAuthContext } from "../server/auth-context.js";
+import "../server/convexIdentity.js";
+import { createAuthContextFacade } from "../server/auth-context.js";
 import { configDefaults } from "../server/config.js";
 import { createCoreDomains } from "../server/core.js";
 import { callModifyAccount } from "../server/mutations/account.js";
@@ -8,15 +9,6 @@ import { callRetrieveAccountWithCredentials } from "../server/mutations/retrieve
 
 //#region src/core/index.ts
 /**
-* Lightweight auth context entry point for `@robelest/convex-auth/core`.
-*
-* Provides auth context resolution, user/session/member/group lookups,
-* and authorization helpers without pulling in provider implementations,
-* OAuth, crypto, or sign-in logic.
-*
-* @module
-*/
-/**
 * Create a lightweight auth context object.
 *
 * Returns the same `user`, `session`, `member`, `group`, `account`,
@@ -70,12 +62,7 @@ function createAuthContext(component, config) {
 		member: domains.member,
 		invite: domains.invite,
 		key: domains.key,
-		getUserId: domains.session.userId,
-		context: ((ctx, config$1) => {
-			assertAuthResolverContext(ctx);
-			return createPublicAuthContext(authLike, ctx, config$1);
-		}),
-		ctx: ((config$1) => createAuthContextCustomization(authLike, config$1))
+		...createAuthContextFacade(authLike)
 	};
 }
 

package/dist/server/auth-context.d.ts

@@ -160,7 +160,7 @@ type AuthContextConfig<TResolve extends Record<string, unknown> = Record<string,
    * Attach additional derived fields to the auth context after the base auth
    * context is resolved.
    *
-   * This callback runs only when a user is authenticated.
+   * This callback runs only when an authenticated user context is available.
    */
   resolve?: (ctx: TCtx, user: UserDoc, auth: AuthContext) => Promise<TResolve> | TResolve;
   /**

package/dist/server/auth-context.js

@@ -70,7 +70,20 @@ function createAuthContextCustomization(auth, config) {
 		}
 	};
 }
+/**
+* Build the shared public auth-context facade used by both `createAuth()` and
+* `createAuthContext()`.
+*/
+function createAuthContextFacade(auth) {
+	return {
+		context: ((ctx, config) => {
+			assertAuthResolverContext(ctx);
+			return createPublicAuthContext(auth, ctx, config);
+		}),
+		ctx: ((config) => createAuthContextCustomization(auth, config))
+	};
+}
 
 //#endregion
-export { assertAuthResolverContext, createAuthContextCustomization, createPublicAuthContext };
+export { createAuthContextCustomization, createAuthContextFacade, createPublicAuthContext };
 //# sourceMappingURL=auth-context.js.map

package/dist/server/auth.d.ts

@@ -72,28 +72,14 @@ type AuthApiBase<TAuthorization extends AuthAuthorizationConfig | undefined = un
   invite: ReturnType<typeof Auth>["auth"]["invite"];
   key: ReturnType<typeof Auth>["auth"]["key"];
   http: ReturnType<typeof Auth>["auth"]["http"];
-  /**
-   * Zero-round-trip helper: parse the current user id from the JWT subject
-   * claim. No component read, no cache lookup. Returns `null` when
-   * unauthenticated.
-   *
-   * Prefer this over `auth.context(ctx)` when a handler only needs the
-   * user's id (audit logging, early guards, routing). For the full user
-   * document, follow up with `auth.user.get(ctx, userId)` — cached per
-   * request.
-   *
-   * @example
-   * ```ts
-   * const userId = await auth.getUserId(ctx);
-   * if (!userId) throw new Error("Not signed in");
-   * ```
-   */
-  getUserId: ReturnType<typeof Auth>["auth"]["session"]["userId"];
   /**
    * Resolve the current request's auth context. Framework-agnostic — use
    * this in fluent-convex middleware, custom wrappers, or anywhere you
    * need the current `{ userId, user, groupId, role, grants }` object.
    *
+   * This is the authorization-enrichment path. For native identity claims
+   * already present on the JWT, prefer `ctx.auth.getUserIdentity()`.
+   *
    * Throws a structured `ConvexError` when unauthenticated by default.
    * Pass `{ optional: true }` to get a null-shaped auth object instead.
    *

package/dist/server/auth.js

@@ -1,4 +1,4 @@
-import { assertAuthResolverContext, createAuthContextCustomization, createPublicAuthContext } from "./auth-context.js";
+import { createAuthContextCustomization, createAuthContextFacade, createPublicAuthContext } from "./auth-context.js";
 import { Auth } from "./runtime.js";
 import { ConvexError } from "convex/values";
 
@@ -145,12 +145,7 @@ function createAuth(component, config) {
 		invite: authResult.auth.invite,
 		key: authResult.auth.key,
 		http: authResult.auth.http,
-		getUserId: authResult.auth.session.userId,
-		context: ((ctx, config$1) => {
-			assertAuthResolverContext(ctx);
-			return createPublicAuthContext(authResult.auth, ctx, config$1);
-		}),
-		ctx: ((config$1) => createAuthContextCustomization(authResult.auth, config$1))
+		...createAuthContextFacade(authResult.auth)
 	};
 }
 

package/dist/server/config.js

@@ -8,6 +8,7 @@ function configDefaults(config_) {
 	return {
 		...config,
 		authorization: normalizeAuthorizationConfig(config.authorization),
+		telemetry: normalizeTelemetryConfig(config.telemetry),
 		extraProviders: materializeProviders(extraProviders)
 	};
 }
@@ -54,6 +55,15 @@ function normalizeAuthorizationConfig(authorization) {
 		grants: Array.from(new Set(role.grants)).sort()
 	}])) };
 }
+function normalizeTelemetryConfig(telemetry) {
+	const normalized = {
+		includeIdentity: telemetry?.includeIdentity ?? "none",
+		identityFields: telemetry?.identityFields ?? {},
+		...telemetry?.hashIdentity ? { hashIdentity: telemetry.hashIdentity } : {}
+	};
+	if (normalized.includeIdentity === "hashed" && normalized.hashIdentity === void 0) throw new Error("Convex Auth telemetry with `includeIdentity: \"hashed\"` requires a `hashIdentity` function.");
+	return normalized;
+}
 
 //#endregion
 export { configDefaults, listAvailableProviders };

package/dist/server/context.js

@@ -1,11 +1,9 @@
-import { userIdFromIdentitySubject } from "./identity.js";
+import { getAuthenticatedUserIdOrNull } from "./identity.js";
 
 //#region src/server/context.ts
 /** @internal */
 async function getSessionUserId(ctx) {
-	const identity = await ctx.auth.getUserIdentity();
-	if (identity === null) return null;
-	return userIdFromIdentitySubject(identity.subject);
+	return await getAuthenticatedUserIdOrNull(ctx);
 }
 /** @internal */
 async function getAuthContextForUser(auth, ctx, userId, opts) {

package/dist/server/contract.d.ts

@@ -1,5 +1,5 @@
-import "./componentContext.js";
 import "./types.js";
+import "./componentContext.js";
 
 //#region src/server/contract.d.ts
 type GroupConnectionRecord = {

package/dist/server/convexIdentity.d.ts

@@ -0,0 +1,15 @@
+import { GenericId } from "convex/values";
+
+//#region src/server/convexIdentity.d.ts
+declare module "convex/server" {
+  interface UserIdentity {
+    /**
+     * Current session id issued by convex-auth.
+     *
+     * This is a custom JWT claim mirrored into Convex's identity object so
+     * native identity access can read `identity.sid` directly.
+     */
+    readonly sid?: GenericId<"Session">;
+  }
+} //# sourceMappingURL=convexIdentity.d.ts.map
+//# sourceMappingURL=convexIdentity.d.ts.map

package/dist/server/convexIdentity.js

@@ -0,0 +1 @@
+export {  };

package/dist/server/core.js

@@ -2,7 +2,6 @@ import { getSessionUserId } from "./context.js";
 import { cached, ctxCacheHas, invalidateCtxCache } from "./ctxCache.js";
 import { generateRandomString, sha256 } from "./random.js";
 import { buildScopeChecker, checkKeyRateLimit, generateApiKey, hashApiKey } from "./keys.js";
-import { TOKEN_SUB_CLAIM_DIVIDER } from "./constants.js";
 import { ConvexError } from "convex/values";
 
 //#region src/server/core.ts
@@ -119,18 +118,6 @@ function createCoreDomains(deps) {
 		}
 	};
 	const session = {
-		current: async (ctx) => {
-			const identity = await ctx.auth.getUserIdentity();
-			if (identity === null) return null;
-			const [, sessionId] = identity.subject.split(TOKEN_SUB_CLAIM_DIVIDER);
-			return sessionId;
-		},
-		userId: async (ctx) => {
-			const identity = await ctx.auth.getUserIdentity();
-			if (identity === null) return null;
-			const [userId] = identity.subject.split(TOKEN_SUB_CLAIM_DIVIDER);
-			return userId ?? null;
-		},
 		invalidate: async (ctx, args) => {
 			await callInvalidateSessions(ctx, args);
 			return {

package/dist/server/device.js

@@ -1,4 +1,4 @@
-import { userIdFromIdentitySubject } from "./identity.js";
+import { getAuthenticatedUserIdOrNull } from "./identity.js";
 import { generateRandomString, sha256 } from "./random.js";
 import { requireEnv } from "./env.js";
 import { callSignIn } from "./mutations/signin.js";
@@ -39,12 +39,14 @@ async function handleCreate(ctx, provider) {
 	const verificationUri = provider.verificationUri ?? `${process.env.SITE_URL ?? requireEnv("SITE_URL")}/device`;
 	return {
 		kind: "deviceCode",
-		deviceCode,
-		userCode,
-		verificationUri,
-		verificationUriComplete: `${verificationUri}?code=${encodeURIComponent(userCode)}`,
-		expiresIn: provider.expiresIn,
-		interval: provider.interval
+		deviceCode: {
+			deviceCode,
+			userCode,
+			verificationUri,
+			verificationUriComplete: `${verificationUri}?code=${encodeURIComponent(userCode)}`,
+			expiresIn: provider.expiresIn,
+			interval: provider.interval
+		}
 	};
 }
 async function handlePoll(ctx, params) {
@@ -66,7 +68,7 @@ async function handlePoll(ctx, params) {
 	await mutateDeviceDelete(ctx, doc._id);
 	return {
 		kind: "signedIn",
-		signedIn: await callSignIn(ctx, {
+		session: await callSignIn(ctx, {
 			userId: doc.userId,
 			sessionId: doc.sessionId,
 			generateTokens: true
@@ -75,9 +77,8 @@ async function handlePoll(ctx, params) {
 }
 async function handleDeviceVerify(ctx, params) {
 	if (typeof params.userCode !== "string") throw deviceError("DEVICE_INVALID_USER_CODE", "Missing `userCode` parameter for verify flow.");
-	const identity = await ctx.auth.getUserIdentity();
-	if (identity === null) throw deviceError("NOT_SIGNED_IN", "You must be signed in to authorize a device.");
-	const userId = userIdFromIdentitySubject(identity.subject);
+	const userId = await getAuthenticatedUserIdOrNull(ctx);
+	if (userId === null) throw deviceError("NOT_SIGNED_IN", "You must be signed in to authorize a device.");
 	const doc = await queryDeviceByUserCode(ctx, params.userCode);
 	if (doc === null) throw deviceError("DEVICE_INVALID_USER_CODE", "Invalid or expired user code.");
 	if (Date.now() > doc.expiresAt) {
@@ -92,7 +93,7 @@ async function handleDeviceVerify(ctx, params) {
 	await mutateDeviceAuthorize(ctx, doc._id, signInResult.userId, signInResult.sessionId);
 	return {
 		kind: "signedIn",
-		signedIn: null
+		session: null
 	};
 }
 /** @internal */

package/dist/server/env.js

@@ -5,12 +5,20 @@ function readEnv(name) {
 	const value = typeof process === "undefined" ? void 0 : process.env?.[name];
 	return typeof value === "string" && value.length > 0 ? value : void 0;
 }
+function missingEnvMessage(name) {
+	switch (name) {
+		case "JWT_PRIVATE_KEY":
+		case "JWKS":
+		case "AUTH_SECRET_ENCRYPTION_KEY": return `Missing environment variable \`${name}\`. Run the convex-auth setup wizard to generate and configure auth keys.`;
+		default: return `Missing environment variable \`${name}\``;
+	}
+}
 /** @internal */
 const readConfigSync = (value) => value;
 /** @internal */
 const envString = (name) => {
 	const value = readEnv(name);
-	if (value === void 0) throw new Error(`Missing environment variable \`${name}\``);
+	if (value === void 0) throw new Error(missingEnvMessage(name));
 	return value;
 };
 /** @internal */
@@ -38,7 +46,7 @@ function requireEnv(name) {
 	} catch {
 		throw new ConvexError({
 			code: "MISSING_ENV_VAR",
-			message: `Missing environment variable \`${name}\``
+			message: missingEnvMessage(name)
 		});
 	}
 }

package/dist/server/http.d.ts

@@ -1,6 +1,6 @@
-import { ComponentReadCtx } from "./componentContext.js";
 import { HttpKeyContext } from "./types.js";
 import { AuthContext, OptionalAuthContext, UserDoc } from "./auth-context.js";
+import { ComponentReadCtx } from "./componentContext.js";
 import "./auth.js";
 import { GenericActionCtx, GenericDataModel, HttpRouter, UserIdentity } from "convex/server";
 

package/dist/server/identity.js

@@ -3,14 +3,40 @@ import { ConvexError } from "convex/values";
 //#region src/server/identity.ts
 /** @internal */
 function userIdFromIdentitySubject(subject) {
-	const [userId, ...rest] = subject.split("|");
-	if (typeof userId !== "string" || userId.length === 0 || rest.length === 0 || rest.some((segment) => segment.length === 0)) throw new ConvexError({
+	if (typeof subject !== "string" || subject.length === 0) throw new ConvexError({
 		code: "INTERNAL_ERROR",
 		message: "Authenticated identity subject is malformed."
 	});
-	return userId;
+	return subject;
+}
+/** @internal */
+function userIdFromIdentity(identity) {
+	return userIdFromIdentitySubject(identity.subject);
+}
+/** @internal */
+function sessionIdFromIdentity(identity) {
+	const sessionId = identity.sid;
+	if (typeof sessionId !== "string" || sessionId.length === 0) throw new ConvexError({
+		code: "INTERNAL_ERROR",
+		message: "Authenticated identity is missing a session id claim."
+	});
+	return sessionId;
+}
+/** @internal */
+async function getUserIdentityOrNull(ctx) {
+	return await ctx.auth.getUserIdentity();
+}
+/** @internal */
+async function getAuthenticatedUserIdOrNull(ctx) {
+	const identity = await getUserIdentityOrNull(ctx);
+	return identity === null ? null : userIdFromIdentity(identity);
+}
+/** @internal */
+async function getAuthenticatedSessionIdOrNull(ctx) {
+	const identity = await getUserIdentityOrNull(ctx);
+	return identity === null ? null : sessionIdFromIdentity(identity);
 }
 
 //#endregion
-export { userIdFromIdentitySubject };
+export { getAuthenticatedSessionIdOrNull, getAuthenticatedUserIdOrNull };
 //# sourceMappingURL=identity.js.map

package/dist/server/index.d.ts

@@ -1,6 +1,7 @@
 import { AuthConfig, AuthContext, AuthContextConfig, InferAuth, OptionalAuthContext, UserDoc } from "./auth-context.js";
 import { HttpAuthContext, HttpAuthContextConfig, OptionalHttpAuthContext } from "./http.js";
 import { AuthApi, AuthApiBase, ConvexAuthResult, InferClientApi, createAuth } from "./auth.js";
+import "./convexIdentity.js";
 import { CreateAuthGroupSsoOptions, GroupSsoAccessHandler, GroupSsoAccessInput, GroupSsoAccessPermissions, GroupSsoPermission, GroupSsoResolvedAccessHandler, createAuthGroupSso, scim, sso } from "./mounts.js";
 import { AuthCookie, AuthCookieConfig, AuthCookies, RefreshResult, ServerOptions, authCookieNames, parseAuthCookies, serializeAuthCookies, server, shouldProxyAuthAction, structuredAuthCookies } from "./prefetch.js";
 export { type AuthApi, type AuthApiBase, type AuthConfig, type AuthContext, type AuthContextConfig, type AuthCookie, type AuthCookieConfig, type AuthCookies, type ConvexAuthResult, type CreateAuthGroupSsoOptions, type GroupSsoAccessHandler, type GroupSsoAccessInput, type GroupSsoAccessPermissions, type GroupSsoPermission, type GroupSsoResolvedAccessHandler, type HttpAuthContext, type HttpAuthContextConfig, type InferAuth, type InferClientApi, type OptionalAuthContext, type OptionalHttpAuthContext, type RefreshResult, type ServerOptions, type UserDoc, authCookieNames, createAuth, createAuthGroupSso, parseAuthCookies, scim, serializeAuthCookies, server, shouldProxyAuthAction, sso, structuredAuthCookies };

package/dist/server/index.js

@@ -1,3 +1,4 @@
+import "./convexIdentity.js";
 import { createAuth } from "./auth.js";
 import { createAuthGroupSso, scim, sso } from "./mounts.js";
 import { authCookieNames, parseAuthCookies, serializeAuthCookies, server, shouldProxyAuthAction, structuredAuthCookies } from "./prefetch.js";