@robelest/convex-auth 0.0.4-preview.29 → 0.0.4-preview.30

package/dist/server/mutations/refresh.js

@@ -2,8 +2,9 @@ import { authDb } from "../db.js";
 import { log, maybeRedact } from "../log.js";
 import { AUTH_STORE_REF } from "./store/refs.js";
 import { REFRESH_TOKEN_DIVIDER, REFRESH_TOKEN_REUSE_WINDOW_MS, parseRefreshToken, refreshTokenExpirationTime } from "../refresh.js";
-import { withSpan } from "../utils/span.js";
+import { setActiveSpanAttributes, withSpan } from "../utils/span.js";
 import { finalizeSessionIssuance } from "../sessions.js";
+import { buildRefreshIdentityAttributes } from "../telemetry.js";
 import { v } from "convex/values";
 
 //#region src/server/mutations/refresh.ts
@@ -18,14 +19,17 @@ const refreshSessionArgs = v.object({ refreshToken: v.string() });
 */
 async function refreshSessionImpl(ctx, args, config) {
 	const db = authDb(ctx, config);
-	return withSpan("convex-auth.refresh.session", { hasRefreshToken: true }, async () => {
+	return withSpan("convex-auth.refresh.session", {
+		hasRefreshToken: true,
+		"auth.flow": "refresh"
+	}, async () => {
 		try {
 			let refreshTokenId;
 			let sessionId;
 			try {
 				({refreshTokenId, sessionId} = parseRefreshToken(args.refreshToken));
 			} catch {
-				throw new RefreshFailure("Failed to parse refresh token");
+				throw new RefreshFailure("parse_failure", "Failed to parse refresh token");
 			}
 			log("DEBUG", `refreshSessionImpl args: Token ID: ${maybeRedact(refreshTokenId)} Session ID: ${maybeRedact(sessionId)}`);
 			let exchanged;
@@ -38,16 +42,42 @@ async function refreshSessionImpl(ctx, args, config) {
 					reuseWindowMs: REFRESH_TOKEN_REUSE_WINDOW_MS
 				});
 			} catch {
-				throw new RefreshFailure("Failed to exchange refresh token");
+				throw new RefreshFailure("exchange_failure", "Failed to exchange refresh token");
 			}
-			if (exchanged === null) return null;
+			if (exchanged === null) {
+				setActiveSpanAttributes({ "auth.refresh.result": "null" });
+				return null;
+			}
+			setActiveSpanAttributes({
+				"auth.refresh.result": "success",
+				...await buildRefreshIdentityAttributes(ctx, config, {
+					userId: exchanged.userId,
+					sessionId: exchanged.sessionId,
+					refreshTokenId: exchanged.refreshTokenId
+				})
+			});
+			const user = await db.users.getById(exchanged.userId);
 			return {
 				userId: exchanged.userId,
 				sessionId: exchanged.sessionId,
+				identity: {
+					subject: exchanged.userId,
+					sessionId: exchanged.sessionId,
+					...typeof user?.name === "string" ? { name: user.name } : null,
+					...typeof user?.email === "string" ? { email: user.email } : null,
+					...user?.emailVerificationTime !== void 0 ? { emailVerified: true } : user?.email !== void 0 ? { emailVerified: false } : null,
+					...typeof user?.image === "string" ? { picture: user.image } : null,
+					...typeof user?.phone === "string" ? { phoneNumber: user.phone } : null,
+					...user?.phoneVerificationTime !== void 0 ? { phoneNumberVerified: true } : user?.phone !== void 0 ? { phoneNumberVerified: false } : null
+				},
 				refreshToken: `${exchanged.refreshTokenId}${REFRESH_TOKEN_DIVIDER}${exchanged.sessionId}`
 			};
 		} catch (e) {
 			if (e instanceof RefreshFailure) {
+				setActiveSpanAttributes({
+					"auth.refresh.result": e.code,
+					"auth.refresh.failure_reason": e.reason
+				});
 				log("DEBUG", e.reason);
 				return null;
 			}
@@ -56,8 +86,9 @@ async function refreshSessionImpl(ctx, args, config) {
 	});
 }
 var RefreshFailure = class extends Error {
-	constructor(reason) {
+	constructor(code, reason) {
 		super(reason);
+		this.code = code;
 		this.reason = reason;
 	}
 };
@@ -74,7 +105,7 @@ const callRefreshSession = async (ctx, args) => {
 		...args
 	} });
 	if (issuance === null || issuance.refreshToken === null) return null;
-	return (await finalizeSessionIssuance(ctx.auth.config, issuance)).tokens;
+	return await finalizeSessionIssuance(ctx.auth.config, issuance);
 };
 
 //#endregion

package/dist/server/mutations/signin.js

@@ -1,8 +1,9 @@
 import { LOG_LEVELS } from "../../shared/log.js";
 import { log } from "../log.js";
 import { AUTH_STORE_REF } from "./store/refs.js";
-import { withSpan } from "../utils/span.js";
+import { setActiveSpanAttributes, withSpan } from "../utils/span.js";
 import { finalizeSessionIssuance, getAuthSessionId, issueSession } from "../sessions.js";
+import { buildSignInIdentityAttributes } from "../telemetry.js";
 import { v } from "convex/values";
 
 //#region src/server/mutations/signin.ts
@@ -13,17 +14,26 @@ const signInArgs = v.object({
 });
 async function signInImpl(ctx, args, config) {
 	return withSpan("convex-auth.mutations.signIn", {
+		"auth.flow": "signIn",
 		hasExistingSession: args.sessionId !== void 0,
 		generateTokens: args.generateTokens
 	}, async () => {
 		log(LOG_LEVELS.DEBUG, "signInImpl args:", args);
 		const { userId, sessionId: existingSessionId, generateTokens } = args;
-		return await issueSession(ctx, config, {
+		const issuance = await issueSession(ctx, config, {
 			userId,
 			existingSessionId,
 			replaceSessionId: existingSessionId === void 0 ? await getAuthSessionId(ctx) ?? void 0 : void 0,
 			generateTokens
 		});
+		setActiveSpanAttributes({
+			"auth.signin.result": "success",
+			...await buildSignInIdentityAttributes(ctx, config, {
+				userId: issuance.userId,
+				sessionId: issuance.sessionId
+			})
+		});
+		return issuance;
 	});
 }
 /**

package/dist/server/mutations/signout.js

@@ -1,19 +1,36 @@
 import { authDb } from "../db.js";
 import { AUTH_STORE_REF } from "./store/refs.js";
+import { setActiveSpanAttributes, withSpan } from "../utils/span.js";
 import { deleteSession, getAuthSessionId } from "../sessions.js";
+import { buildSignOutIdentityAttributes } from "../telemetry.js";
 
 //#region src/server/mutations/signout.ts
 async function signOutImpl(ctx, config) {
-	const db = authDb(ctx, config);
-	const sessionId = await getAuthSessionId(ctx);
-	if (sessionId == null) return null;
-	const session = await db.sessions.getById(sessionId);
-	if (session == null) return null;
-	await deleteSession(ctx, session, config);
-	return {
-		userId: session.userId,
-		sessionId: session._id
-	};
+	return withSpan("convex-auth.mutations.signOut", { "auth.flow": "signOut" }, async () => {
+		const db = authDb(ctx, config);
+		const sessionId = await getAuthSessionId(ctx);
+		if (sessionId == null) {
+			setActiveSpanAttributes({ "auth.signout.result": "no_session" });
+			return null;
+		}
+		const session = await db.sessions.getById(sessionId);
+		if (session == null) {
+			setActiveSpanAttributes({ "auth.signout.result": "session_missing" });
+			return null;
+		}
+		await deleteSession(ctx, session, config);
+		setActiveSpanAttributes({
+			"auth.signout.result": "success",
+			...await buildSignOutIdentityAttributes(ctx, config, {
+				userId: session.userId,
+				sessionId: session._id
+			})
+		});
+		return {
+			userId: session.userId,
+			sessionId: session._id
+		};
+	});
 }
 const callSignOut = async (ctx) => {
 	return ctx.runMutation(AUTH_STORE_REF, { args: { type: "signOut" } });

package/dist/server/mutations/store.js

@@ -57,7 +57,7 @@ const storeImpl = async (ctx, fnArgs, services) => {
 	const args = fnArgs.args;
 	const config = services.config;
 	const getProviderOrThrow = services.providerRegistry.getProviderOrThrow;
-	log(LOG_LEVELS.DEBUG, `\`auth:store\` type: ${args.type}`);
+	if (args.type !== "refreshSession") log(LOG_LEVELS.DEBUG, `\`auth:store\` type: ${args.type}`);
 	const handler = {
 		signIn: (a) => signInImpl(ctx, a, config),
 		signOut: () => signOutImpl(ctx, config),

package/dist/server/oauth/factory.js

@@ -2,11 +2,12 @@
 function normalizeTokens(tokens) {
 	const raw = tokens.data;
 	const rawScopes = typeof raw.scope === "string" ? raw.scope : void 0;
+	const expiresInSeconds = typeof raw.expires_in === "number" ? raw.expires_in : void 0;
 	return {
 		accessToken: typeof raw.access_token === "string" ? raw.access_token : void 0,
 		refreshToken: typeof raw.refresh_token === "string" ? raw.refresh_token : void 0,
 		idToken: typeof raw.id_token === "string" ? raw.id_token : void 0,
-		accessTokenExpiresAt: typeof tokens.accessTokenExpiresAt === "function" ? tokens.accessTokenExpiresAt() : typeof raw.expires_in === "number" ? new Date(Date.now() + raw.expires_in * 1e3) : void 0,
+		accessTokenExpiresAt: expiresInSeconds === void 0 ? void 0 : new Date(Date.now() + expiresInSeconds * 1e3),
 		scopes: rawScopes ? rawScopes.split(/[,\s]+/).map((scope) => scope.trim()).filter((scope) => scope.length > 0) : void 0,
 		raw: tokens.data
 	};

package/dist/server/passkey.js

@@ -1,4 +1,4 @@
-import { userIdFromIdentitySubject } from "./identity.js";
+import { getAuthenticatedUserIdOrNull } from "./identity.js";
 import { authDb } from "./db.js";
 import { callSignIn } from "./mutations/signin.js";
 import { callVerifier } from "./mutations/verifier.js";
@@ -114,14 +114,13 @@ function requirePasskeyVerifier(verifier) {
 	throw convexError("PASSKEY_MISSING_VERIFIER", "Missing verifier for passkey operation.");
 }
 async function requireAuthenticatedUserId(ctx) {
-	let identity;
 	try {
-		identity = await ctx.auth.getUserIdentity();
+		const userId = await getAuthenticatedUserIdOrNull(ctx);
+		if (userId === null) throw convexError("PASSKEY_AUTH_REQUIRED", "Sign in first, then add a passkey to your account.");
+		return userId;
 	} catch {
 		throw convexError("PASSKEY_AUTH_REQUIRED", "Sign in first, then add a passkey to your account.");
 	}
-	if (identity === null) throw convexError("PASSKEY_AUTH_REQUIRED", "Sign in first, then add a passkey to your account.");
-	return userIdFromIdentitySubject(identity.subject);
 }
 function resolveRegistrationPublicKeyBytes(publicKey, algorithm) {
 	if (algorithm === coseAlgorithmES256) {
@@ -272,12 +271,12 @@ async function handlePasskeyFx(ctx, provider, args) {
 					userId,
 					generateTokens: true
 				});
-			} catch {
-				throw convexError("INTERNAL_ERROR", "An unexpected error occurred.");
+			} catch (error) {
+				throw asConvexError(error, "INTERNAL_ERROR", "Failed to finalize passkey registration.");
 			}
 			return {
 				kind: "signedIn",
-				signedIn: signInResult
+				session: signInResult
 			};
 		},
 		authOptions: async () => {
@@ -354,8 +353,8 @@ async function handlePasskeyFx(ctx, provider, args) {
 			if (passkey.counter !== 0 && authenticatorData.signatureCounter !== 0 && authenticatorData.signatureCounter <= passkey.counter) throw convexError("PASSKEY_COUNTER_ERROR", "Authenticator counter did not increase — possible credential cloning detected.");
 			try {
 				await mutatePasskeyUpdateCounter(ctx, passkey._id, authenticatorData.signatureCounter, Date.now());
-			} catch {
-				throw convexError("INTERNAL_ERROR", "An unexpected error occurred.");
+			} catch (error) {
+				throw asConvexError(error, "INTERNAL_ERROR", "Failed to update passkey counter.");
 			}
 			let signInResult;
 			try {
@@ -363,12 +362,12 @@ async function handlePasskeyFx(ctx, provider, args) {
 					userId: passkey.userId,
 					generateTokens: true
 				});
-			} catch {
-				throw convexError("INTERNAL_ERROR", "An unexpected error occurred.");
+			} catch (error) {
+				throw asConvexError(error, "INTERNAL_ERROR", "Failed to finalize passkey sign-in.");
 			}
 			return {
 				kind: "signedIn",
-				signedIn: signInResult
+				session: signInResult
 			};
 		}
 	}[dispatch.flow];

package/dist/server/prefetch.js

@@ -185,7 +185,7 @@ function getProxyErrorBody(error) {
 	} : { error: error instanceof Error ? error.message : String(error) };
 }
 function extractSignedInTokens(result, context) {
-	if (result.kind === "signedIn") return result.tokens;
+	if (result.kind === "signedIn") return result.session;
 	throw new Error(`Invalid \`auth:signIn\` result for ${context}`);
 }
 function normalizeCookieNamespace(cookieNamespace) {
@@ -360,19 +360,19 @@ function server(options) {
 					verifier: result.verifier
 				}, host$1, cookieConfig, cookieNamespace));
 				if (result.kind === "signedIn") {
-					const nextCookies = result.tokens === null ? {
+					const nextCookies = result.session === null ? {
 						token: currentCookies$1.token,
 						refreshToken: currentCookies$1.refreshToken,
 						verifier: null
 					} : {
-						token: result.tokens.token,
-						refreshToken: result.tokens.refreshToken,
+						token: result.session.token,
+						refreshToken: result.session.refreshToken,
 						verifier: null
 					};
 					return appendCookieHeaders(jsonResponse({
 						kind: "signedIn",
-						tokens: result.tokens === null ? null : {
-							token: result.tokens.token,
+						session: result.session === null ? null : {
+							token: result.session.token,
 							refreshToken: "dummy"
 						}
 					}), serializeAuthCookies(nextCookies, host$1, cookieConfig, cookieNamespace));
@@ -416,11 +416,11 @@ function server(options) {
 			const action = body.action;
 			const args = typeof body.args === "object" && body.args !== null ? { ...body.args } : {};
 			if (args.refreshToken === null) args.refreshToken = void 0;
-			const actionDispatch = action === "auth:signIn" ? { action: "sessionStart" } : action === "auth:signOut" ? { action: "sessionStop" } : null;
+			const actionDispatch = action === "auth:signIn" ? { action: "signInStart" } : action === "auth:signOut" ? { action: "sessionStop" } : null;
 			if (actionDispatch === null) return new Response("Invalid action", { status: 400 });
 			const host = request.headers.get("host") ?? new URL(request.url).host;
 			const currentCookies = parseAuthCookies(request.headers.get("cookie"), host, cookieNamespace);
-			if (actionDispatch.action === "sessionStart") {
+			if (actionDispatch.action === "signInStart") {
 				let refreshResponse = null;
 				if (args.refreshToken === void 0) refreshResponse = null;
 				else if (currentCookies.refreshToken === null) {

package/dist/server/runtime.d.ts

@@ -1,10 +1,10 @@
-import { ComponentCtx, ComponentReadCtx } from "./componentContext.js";
 import { AuthProviderConfig, ConvexAuthConfig, CorsConfig, Doc, HttpKeyContext, KeyDoc, KeyScope, ScopeChecker, UserOrderBy, UserWhere } from "./types.js";
+import { ComponentCtx, ComponentReadCtx } from "./componentContext.js";
 import { AuthProfile, SignInParams } from "./payloads.js";
 import { HttpAuthContext, HttpAuthContextConfig, OptionalHttpAuthContext } from "./http.js";
 import { createGroupConnectionDomain } from "./sso/domain.js";
-import * as convex_values1137 from "convex/values";
-import * as convex_server108 from "convex/server";
+import * as convex_values86 from "convex/values";
+import * as convex_server80 from "convex/server";
 import { GenericActionCtx, GenericDataModel, HttpRouter } from "convex/server";
 
 //#region src/server/runtime.d.ts
@@ -44,7 +44,7 @@ declare function Auth(config_: ConvexAuthConfig): {
         order?: "asc" | "desc";
       }) => Promise<any>;
       viewer: (ctx: ComponentReadCtx & {
-        auth: convex_server108.Auth;
+        auth: convex_server80.Auth;
       }) => Promise<Doc<"User"> | null>;
       update: (ctx: ComponentCtx, userId: string, data: Record<string, unknown>) => Promise<{
         userId: string;
@@ -69,18 +69,12 @@ declare function Auth(config_: ConvexAuthConfig): {
       }>;
     };
     session: {
-      current: (ctx: {
-        auth: convex_server108.Auth;
-      }) => Promise<convex_values1137.GenericId<"Session"> | null>;
-      userId: (ctx: {
-        auth: convex_server108.Auth;
-      }) => Promise<convex_values1137.GenericId<"User"> | null>;
       invalidate: <DataModel extends GenericDataModel>(ctx: GenericActionCtx<DataModel>, args: {
-        userId: convex_values1137.GenericId<"User">;
-        except?: convex_values1137.GenericId<"Session">[];
+        userId: convex_values86.GenericId<"User">;
+        except?: convex_values86.GenericId<"Session">[];
       }) => Promise<{
-        userId: convex_values1137.GenericId<"User">;
-        except: convex_values1137.GenericId<"Session">[];
+        userId: convex_values86.GenericId<"User">;
+        except: convex_values86.GenericId<"Session">[];
       }>;
       get: (ctx: ComponentReadCtx, sessionId: string) => Promise<any>;
       list: (ctx: ComponentReadCtx, opts: {
@@ -149,7 +143,7 @@ declare function Auth(config_: ConvexAuthConfig): {
     };
     provider: {
       signIn: (<DataModel extends GenericDataModel>(ctx: GenericActionCtx<DataModel>, providerConfig: AuthProviderConfig, args: {
-        accountId?: convex_values1137.GenericId<"Account">;
+        accountId?: convex_values86.GenericId<"Account">;
         params?: SignInParams;
       }) => Promise<{
         userId: string;
@@ -457,22 +451,22 @@ declare function Auth(config_: ConvexAuthConfig): {
       context: {
         <TResolve extends Record<string, unknown> = Record<string, never>, TCtx extends {
           auth: {
-            getUserIdentity: () => Promise<convex_server108.UserIdentity | null>;
+            getUserIdentity: () => Promise<convex_server80.UserIdentity | null>;
           };
         } & ComponentReadCtx = {
           auth: {
-            getUserIdentity: () => Promise<convex_server108.UserIdentity | null>;
+            getUserIdentity: () => Promise<convex_server80.UserIdentity | null>;
           };
         } & ComponentReadCtx>(ctx: TCtx, request: Request, config: HttpAuthContextConfig<TResolve, TCtx> & {
           optional: true;
         }): Promise<OptionalHttpAuthContext & TResolve>;
         <TResolve extends Record<string, unknown> = Record<string, never>, TCtx extends {
           auth: {
-            getUserIdentity: () => Promise<convex_server108.UserIdentity | null>;
+            getUserIdentity: () => Promise<convex_server80.UserIdentity | null>;
           };
         } & ComponentReadCtx = {
           auth: {
-            getUserIdentity: () => Promise<convex_server108.UserIdentity | null>;
+            getUserIdentity: () => Promise<convex_server80.UserIdentity | null>;
           };
         } & ComponentReadCtx>(ctx: TCtx, request: Request, config?: HttpAuthContextConfig<TResolve, TCtx>): Promise<HttpAuthContext & TResolve>;
       };
@@ -506,7 +500,7 @@ declare function Auth(config_: ConvexAuthConfig): {
           action: string;
         };
         cors?: CorsConfig;
-      }) => convex_server108.PublicHttpAction;
+      }) => convex_server80.PublicHttpAction;
       /**
        * Register a Bearer-authenticated route **and** its OPTIONS preflight
        * in a single call.
@@ -552,7 +546,7 @@ declare function Auth(config_: ConvexAuthConfig): {
    *
    * Also used for refreshing the session.
    */
-  signIn: convex_server108.RegisteredAction<"public", {
+  signIn: convex_server80.RegisteredAction<"public", {
     provider?: string | undefined;
     verifier?: string | undefined;
     params?: Record<string, string | number | boolean | (string | number | boolean | null)[] | Record<string, string | number | boolean | (string | number | boolean | null)[] | null> | null> | undefined;
@@ -562,12 +556,12 @@ declare function Auth(config_: ConvexAuthConfig): {
   /**
    * Action called by the client to invalidate the current session.
    */
-  signOut: convex_server108.RegisteredAction<"public", {}, Promise<void>>;
+  signOut: convex_server80.RegisteredAction<"public", {}, Promise<void>>;
   /**
    * Internal mutation used by the library to read and write
    * to the database during signin and signout.
    */
-  store: convex_server108.RegisteredMutation<"internal", {
+  store: convex_server80.RegisteredMutation<"internal", {
     args: {
       sessionId?: string | undefined;
       type: "signIn";
@@ -610,11 +604,11 @@ declare function Auth(config_: ConvexAuthConfig): {
           sessionIndex?: string | undefined;
         } | undefined;
       } | undefined;
+      profile: Record<string, string | number | boolean | (string | number | boolean | null)[] | Record<string, string | number | boolean | (string | number | boolean | null)[] | null> | null>;
       type: "userOAuth";
       provider: string;
       providerAccountId: string;
       signature: string;
-      profile: Record<string, string | number | boolean | (string | number | boolean | null)[] | Record<string, string | number | boolean | (string | number | boolean | null)[] | null> | null>;
     } | {
       email?: string | undefined;
       phone?: string | undefined;
@@ -627,9 +621,9 @@ declare function Auth(config_: ConvexAuthConfig): {
     } | {
       shouldLinkViaEmail?: boolean | undefined;
       shouldLinkViaPhone?: boolean | undefined;
+      profile: Record<string, string | number | boolean | (string | number | boolean | null)[] | Record<string, string | number | boolean | (string | number | boolean | null)[] | null> | null>;
       type: "createAccountFromCredentials";
       provider: string;
-      profile: Record<string, string | number | boolean | (string | number | boolean | null)[] | Record<string, string | number | boolean | (string | number | boolean | null)[] | null> | null>;
       account: {
         secret?: string | undefined;
         id: string;

package/dist/server/runtime.js

@@ -227,49 +227,16 @@ function Auth(config_) {
 					resolveSsoProtocol: group.resolveGroupConnectionSsoProtocolOrThrow
 				});
 				const handler = {
-					redirect: (r) => ({
-						kind: "redirect",
-						redirect: r.redirect,
-						verifier: r.verifier
-					}),
+					redirect: (r) => r,
 					signedIn: (r) => ({
 						kind: "signedIn",
-						tokens: r.signedIn?.tokens ?? null
-					}),
-					refreshTokens: (r) => ({
-						kind: "signedIn",
-						tokens: r.signedIn?.tokens ?? null
-					}),
-					started: () => ({ kind: "started" }),
-					passkeyOptions: (r) => ({
-						kind: "passkeyOptions",
-						options: r.options,
-						verifier: r.verifier
-					}),
-					totpRequired: (r) => ({
-						kind: "totpRequired",
-						verifier: r.verifier
-					}),
-					totpSetup: (r) => ({
-						kind: "totpSetup",
-						totpSetup: {
-							uri: r.uri,
-							secret: r.secret,
-							totpId: r.totpId
-						},
-						verifier: r.verifier
+						session: r.session?.tokens ?? null
 					}),
-					deviceCode: (r) => ({
-						kind: "deviceCode",
-						deviceCode: {
-							deviceCode: r.deviceCode,
-							userCode: r.userCode,
-							verificationUri: r.verificationUri,
-							verificationUriComplete: r.verificationUriComplete,
-							expiresIn: r.expiresIn,
-							interval: r.interval
-						}
-					})
+					started: (r) => r,
+					passkeyOptions: (r) => r,
+					totpRequired: (r) => r,
+					totpSetup: (r) => r,
+					deviceCode: (r) => r
 				}[result.kind];
 				if (!handler) throw new Error(`Unexpected sign-in result kind: ${result.kind}`);
 				return handler(result);

package/dist/server/sessions.d.ts

@@ -1,4 +1,4 @@
-import "./types.js";
+import { SessionTokenIdentityClaims } from "./types.js";
 import { GenericId } from "convex/values";
 
 //#region src/server/sessions.d.ts
@@ -10,6 +10,7 @@ import { GenericId } from "convex/values";
 type SessionIssuance = {
   userId: GenericId<"User">;
   sessionId: GenericId<"Session">;
+  identity: SessionTokenIdentityClaims;
   /**
    * Encoded refresh token (`${refreshTokenId}|${sessionId}`), or `null` when
    * the caller opted out of refresh-token issuance (e.g. TOTP step-up).

package/dist/server/sessions.js

@@ -1,15 +1,28 @@
 import { LOG_LEVELS } from "../shared/log.js";
+import { getAuthenticatedSessionIdOrNull } from "./identity.js";
 import { authDb } from "./db.js";
 import { envOptionalNumber, readConfigSync } from "./env.js";
 import { log, maybeRedact } from "./log.js";
 import { REFRESH_TOKEN_DIVIDER, refreshTokenExpirationTime } from "./refresh.js";
 import { withSpan } from "./utils/span.js";
-import { TOKEN_SUB_CLAIM_DIVIDER, generateToken } from "./tokens.js";
+import { generateToken } from "./tokens.js";
 
 //#region src/server/sessions.ts
 const DEFAULT_SESSION_TOTAL_DURATION_MS = 1e3 * 60 * 60 * 24 * 30;
 const sessionExpirationTime = (config, now = Date.now()) => now + (config.session?.totalDurationMs ?? readConfigSync(envOptionalNumber("AUTH_SESSION_TOTAL_DURATION_MS")) ?? DEFAULT_SESSION_TOTAL_DURATION_MS);
 const encodeRefreshToken = (refreshTokenId, sessionId) => `${refreshTokenId}${REFRESH_TOKEN_DIVIDER}${sessionId}`;
+function buildSessionIdentity(userId, sessionId, user) {
+	return {
+		subject: userId,
+		sessionId,
+		...typeof user?.name === "string" ? { name: user.name } : null,
+		...typeof user?.email === "string" ? { email: user.email } : null,
+		...user?.emailVerificationTime !== void 0 ? { emailVerified: true } : user?.email !== void 0 ? { emailVerified: false } : null,
+		...typeof user?.image === "string" ? { picture: user.image } : null,
+		...typeof user?.phone === "string" ? { phoneNumber: user.phone } : null,
+		...user?.phoneVerificationTime !== void 0 ? { phoneNumberVerified: true } : user?.phone !== void 0 ? { phoneNumberVerified: false } : null
+	};
+}
 /**
 * Convert a {@link SessionIssuance} returned from a mutation into the
 * external `SessionInfo` shape by signing the JWT on the action side.
@@ -26,10 +39,7 @@ async function finalizeSessionIssuance(config, issuance) {
 			sessionId: issuance.sessionId,
 			tokens: null
 		};
-		const token = await generateToken({
-			userId: issuance.userId,
-			sessionId: issuance.sessionId
-		}, config);
+		const token = await generateToken({ identity: issuance.identity }, config);
 		log(LOG_LEVELS.DEBUG, `Generated token ${maybeRedact(token)} and refresh token ${maybeRedact(issuance.refreshToken)} for session ${maybeRedact(issuance.sessionId)}`);
 		return {
 			userId: issuance.userId,
@@ -43,7 +53,8 @@ async function finalizeSessionIssuance(config, issuance) {
 }
 /** @internal */
 async function issueSession(ctx, config, args) {
-	const issued = await authDb(ctx, config).sessions.issue({
+	const db = authDb(ctx, config);
+	const issued = await db.sessions.issue({
 		userId: args.userId,
 		sessionId: args.existingSessionId,
 		replaceSessionId: args.replaceSessionId,
@@ -52,9 +63,11 @@ async function issueSession(ctx, config, args) {
 	});
 	const sessionId = issued.sessionId;
 	const refreshTokenId = issued.refreshTokenId;
+	const user = await db.users.getById(issued.userId);
 	return {
 		userId: issued.userId,
 		sessionId,
+		identity: buildSessionIdentity(issued.userId, sessionId, user),
 		refreshToken: args.generateTokens && refreshTokenId !== void 0 ? encodeRefreshToken(refreshTokenId, sessionId) : null
 	};
 }
@@ -67,14 +80,11 @@ async function deleteSession(ctx, session, config) {
 /**
 * Return the current session ID from the auth identity subject.
 *
-* Internal helper used by auth runtime internals and `auth.session.current`.
+* Internal helper used by auth runtime internals.
 */
 /** @internal */
 async function getAuthSessionId(ctx) {
-	const identity = await ctx.auth.getUserIdentity();
-	if (identity === null) return null;
-	const [, sessionId] = identity.subject.split(TOKEN_SUB_CLAIM_DIVIDER);
-	return sessionId;
+	return await getAuthenticatedSessionIdOrNull(ctx);
 }
 
 //#endregion