@robelest/convex-auth 0.0.4-preview.30 → 0.0.4-preview.31

package/dist/server/runtime.js

@@ -1,7 +1,7 @@
 import { LOG_LEVELS } from "../shared/log.js";
 import { generateRandomString, sha256 } from "./random.js";
 import { createCoreDomains } from "./core.js";
-import { requireEnv } from "./env.js";
+import { envOptionalString, readConfigSync, requireEnv } from "./env.js";
 import { log, logError } from "./log.js";
 import { callModifyAccount } from "./mutations/account.js";
 import { callInvalidateSessions } from "./mutations/invalidate.js";
@@ -14,8 +14,10 @@ import { callVerifierSignature } from "./mutations/signature.js";
 import { callSignOut } from "./mutations/signout.js";
 import { storeArgs, storeImpl } from "./mutations/store.js";
 import { siteUrlsFromEnv } from "./url.js";
-import { redirectToParamCookie, useRedirectToParam } from "./cookies.js";
-import { addAuthRoutes, addOpenIdRoutes, convertErrorsToResponse, createHttpAction, createHttpContext, createHttpRoute, getCookies } from "./http.js";
+import { decodeOAuthState, encodeOAuthState } from "./cookies.js";
+import { FlowSignal } from "./errors.js";
+import { addAuthRoutes, addOpenIdRoutes, addWebAuthnRoute, convertErrorsToResponse, createHttpAction, createHttpContext, createHttpRoute, getCookies } from "./http.js";
+import { generateWebAuthnConfig } from "./wellknown.js";
 import { createOAuthAuthorizationURL, handleOAuthCallback } from "./oauth/runtime.js";
 import { redirectAbsoluteUrl, setURLSearchParam } from "./redirects.js";
 import { encryptSecret } from "./secret.js";
@@ -24,11 +26,61 @@ import { resolveServerServices } from "./services/resolve.js";
 import { createGroupConnectionDomain } from "./sso/domain.js";
 import { addGroupHttpRuntime } from "./sso/http.js";
 import { ConvexError, v } from "convex/values";
-import { actionGeneric, internalMutationGeneric } from "convex/server";
+import { actionGeneric, httpRouter, internalMutationGeneric } from "convex/server";
 import { serialize } from "cookie";
 
 //#region src/server/runtime.ts
 const GROUP_CONNECTION_OIDC_CLIENT_SECRET_KIND = "oidc_client_secret";
+const vHeaderPairs = v.array(v.array(v.string()));
+function formDataEntries(formData) {
+	return formData;
+}
+const vHttpDelegateResponse = v.object({
+	status: v.number(),
+	statusText: v.string(),
+	headers: vHeaderPairs,
+	body: v.string()
+});
+function normalizeRoutePrefix(prefix) {
+	if (prefix === void 0 || prefix === "" || prefix === "/") return "";
+	return (prefix.startsWith("/") ? prefix : `/${prefix}`).replace(/\/$/, "");
+}
+function appendRoutePrefix(siteUrl, prefix) {
+	return `${siteUrl.replace(/\/$/, "")}${prefix}`;
+}
+function authSiteUrlFromEnv() {
+	return appendRoutePrefix(readConfigSync(envOptionalString("CONVEX_AUTH_SITE_URL")) ?? requireEnv("CONVEX_SITE_URL"), normalizeRoutePrefix(readConfigSync(envOptionalString("CONVEX_AUTH_HTTP_PREFIX")) ?? "/auth"));
+}
+function createInMemoryHttpRouter() {
+	const routes = [];
+	return {
+		route: (spec) => {
+			routes.push(spec);
+		},
+		lookup(pathname, method) {
+			const exact = routes.find((route) => route.method === method && route.path === pathname);
+			if (exact) return exact;
+			return routes.filter((route) => route.method === method && route.pathPrefix !== void 0 && pathname.startsWith(route.pathPrefix)).sort((a, b) => (b.pathPrefix?.length ?? 0) - (a.pathPrefix?.length ?? 0))[0] ?? null;
+		}
+	};
+}
+async function invokeHttpHandler(handler, ctx, request) {
+	const maybeHandler = handler;
+	if (typeof maybeHandler._handler === "function") return await maybeHandler._handler(ctx, request);
+	throw new Error("Invalid HTTP action handler.");
+}
+async function serializeHttpResponse(response) {
+	const headers = [];
+	response.headers.forEach((value, name) => headers.push([name, value]));
+	const setCookies = response.headers.getSetCookie?.();
+	if (setCookies !== void 0) for (const cookie of setCookies) headers.push(["set-cookie", cookie]);
+	return {
+		status: response.status,
+		statusText: response.statusText,
+		headers,
+		body: await response.text()
+	};
+}
 const convexError = (data) => new ConvexError(data);
 /**
 * Configure the Convex Auth library. Returns an object with
@@ -42,7 +94,10 @@ const convexError = (data) => new ConvexError(data);
 * export const auth = createAuth(components.auth, {
 *   providers: [],
 * });
-* export const { signIn, signOut, store } = auth;
+* export const signIn = auth.signIn;
+* export const signOut = auth.signOut;
+* export const store = auth.store;
+* export const http = auth.http;
 * ```
 *
 * @returns An object with fields you should reexport from your
@@ -57,11 +112,12 @@ function Auth(config_) {
 	const getProviderOrThrow = services.providerRegistry.getProviderOrThrow;
 	const INVITE_TOKEN_ALPHABET = "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789";
 	const INVITE_TOKEN_LENGTH = 48;
-	const GROUP_CONNECTION_ROUTE_BASE = "/api/auth/connections";
+	const GROUP_CONNECTION_ROUTE_BASE = "/connections";
 	const group = createGroupService({
 		config,
 		sha256
 	});
+	const authRequireEnv = (name) => name === "CONVEX_SITE_URL" ? authSiteUrlFromEnv() : requireEnv(name);
 	const authBase = {
 		...createCoreDomains({
 			config,
@@ -71,7 +127,26 @@ function Auth(config_) {
 			callModifyAccount,
 			getEnrichCtx: () => enrichCtx,
 			inviteTokenAlphabet: INVITE_TOKEN_ALPHABET,
-			inviteTokenLength: INVITE_TOKEN_LENGTH
+			inviteTokenLength: INVITE_TOKEN_LENGTH,
+			signInForProvider: async (ctx, providerConfig, args) => {
+				const materialized = typeof providerConfig === "function" ? providerConfig() : providerConfig;
+				const result = await services.signIn.signIn(enrichCtx(ctx), materialized, args, {
+					generateTokens: false,
+					allowExtraProviders: true
+				});
+				if (result.kind === "signedIn") {
+					const session = result.session;
+					if (session === null || session === void 0) return null;
+					const userId = session.userId;
+					const sessionId = session.sessionId ?? session._id;
+					if (userId === void 0 || sessionId === void 0) return null;
+					return {
+						userId,
+						sessionId
+					};
+				}
+				throw new FlowSignal(result);
+			}
 		}),
 		sso: createGroupConnectionDomain({
 			config,
@@ -82,7 +157,7 @@ function Auth(config_) {
 			emitGroupWebhookDeliveries: group.emitGroupWebhookDeliveries,
 			connectionNotFoundError: "Connection not found.",
 			GROUP_CONNECTION_OIDC_CLIENT_SECRET_KIND,
-			requireEnv,
+			requireEnv: authRequireEnv,
 			generateRandomString,
 			INVITE_TOKEN_ALPHABET,
 			sha256,
@@ -91,19 +166,144 @@ function Auth(config_) {
 		})
 	};
 	const getDefaultCorsOrigins = () => siteUrlsFromEnv().allowedUrls.map((u) => new URL(u).origin);
-	const http = {
-		add: (http$1) => {
+	const getAuthSiteUrl = (_ctx) => authSiteUrlFromEnv();
+	const createProtocolRouter = (authSiteUrl) => {
+		const protocolHttp = createInMemoryHttpRouter();
+		const protocolRequireEnv = (name) => name === "CONVEX_SITE_URL" ? authSiteUrl : requireEnv(name);
+		addOpenIdRoutes(protocolHttp, {
+			getIssuer: () => authSiteUrl,
+			getJwks: () => requireEnv("JWKS")
+		});
+		addWebAuthnRoute(protocolHttp, { getResponse: () => {
+			const r = generateWebAuthnConfig();
+			return r === null ? null : {
+				body: r.body,
+				headers: r.headers
+			};
+		} });
+		addGroupHttpRuntime({
+			http: protocolHttp,
+			hasSSO,
+			auth: authBase,
+			config,
+			routeBase: "/connections",
+			requireEnv: protocolRequireEnv,
+			loadActiveConnectionSamlOrThrow: group.loadActiveConnectionSamlOrThrow,
+			loadConnectionOidcOrThrow: group.loadConnectionOidcOrThrow,
+			getGroupConnectionScimContext: group.getGroupConnectionScimContext,
+			loadGroupPolicyOrThrow: group.loadGroupPolicyOrThrow,
+			normalizeGroupConnectionPolicy,
+			recordGroupAuditEvent: group.recordGroupAuditEvent,
+			emitGroupWebhookDeliveries: group.emitGroupWebhookDeliveries,
+			generateRandomString,
+			inviteTokenAlphabet: INVITE_TOKEN_ALPHABET,
+			callUserOAuth,
+			callVerifierSignature,
+			sharedOidcRedirectURI: ssoProvider?.redirectURI
+		});
+		if (hasOAuth) addAuthRoutes(protocolHttp, {
+			routeBase: "",
+			handleSignIn: convertErrorsToResponse(400, async (ctx, request$1) => {
+				const url = new URL(request$1.url);
+				const pathParts = url.pathname.split("/");
+				const providerId = pathParts[pathParts.length - 1];
+				if (providerId === null) throw convexError({
+					code: "OAUTH_MISSING_PROVIDER",
+					message: "Missing OAuth provider ID."
+				});
+				const verifier = url.searchParams.get("code");
+				if (verifier === null) throw convexError({
+					code: "OAUTH_MISSING_VERIFIER",
+					message: "Missing sign-in verifier."
+				});
+				const oauthConfig = getProviderOrThrow(providerId);
+				const redirectTo = url.searchParams.get("redirectTo");
+				const { redirect, cookies, signature } = await createOAuthAuthorizationURL(providerId, oauthConfig, { stateTransform: (state) => encodeOAuthState(state, redirectTo) });
+				await callVerifierSignature(ctx, {
+					verifier,
+					signature
+				});
+				const headers = new Headers({ Location: redirect });
+				for (const { name, value, options } of cookies) headers.append("Set-Cookie", serialize(name, value, options));
+				return new Response(null, {
+					status: 302,
+					headers
+				});
+			}),
+			handleCallback: async (ctx, request$1) => {
+				const url = new URL(request$1.url);
+				const callbackPathParts = new URL(request$1.url).pathname.split("/");
+				const providerId = callbackPathParts[callbackPathParts.length - 1];
+				if (!providerId) throw convexError({
+					code: "OAUTH_MISSING_PROVIDER",
+					message: "Missing OAuth provider ID."
+				});
+				log(LOG_LEVELS.DEBUG, "Handling OAuth callback for provider:", providerId);
+				const provider = getProviderOrThrow(providerId);
+				const cookies = getCookies(request$1);
+				const params = url.searchParams;
+				if (request$1.headers.get("Content-Type")?.includes("application/x-www-form-urlencoded")) {
+					const formData = await request$1.formData();
+					for (const [key, value] of formDataEntries(formData)) if (typeof value === "string") params.append(key, value);
+				}
+				const fallbackDestinationUrl = await redirectAbsoluteUrl(ctx, config, { redirectTo: void 0 });
+				try {
+					const result = await handleOAuthCallback(providerId, provider, Object.fromEntries(params.entries()), cookies);
+					const oauthCookies = result.cookies;
+					const { id: profileId, ...profileData } = result.profile;
+					const { signature } = result;
+					const { redirectTo: stateRedirectTo } = decodeOAuthState(params.get("state") ?? "");
+					const redirUrl = setURLSearchParam(await redirectAbsoluteUrl(ctx, config, { redirectTo: stateRedirectTo ?? void 0 }), "code", await callUserOAuth(ctx, {
+						provider: providerId,
+						providerAccountId: profileId,
+						profile: profileData,
+						signature
+					}));
+					const redirHeaders = new Headers({ Location: redirUrl });
+					redirHeaders.set("Cache-Control", "must-revalidate");
+					for (const { name, value, options } of oauthCookies) redirHeaders.append("Set-Cookie", serialize(name, value, options));
+					return new Response(null, {
+						status: 302,
+						headers: redirHeaders
+					});
+				} catch (error) {
+					logError(error);
+					return new Response(null, {
+						status: 302,
+						headers: { Location: fallbackDestinationUrl }
+					});
+				}
+			}
+		});
+		return protocolHttp;
+	};
+	const request = {
+		add: (http$1, options) => {
+			const routePrefix = normalizeRoutePrefix(options?.prefix);
+			const authSiteUrl = () => appendRoutePrefix(requireEnv("CONVEX_SITE_URL"), routePrefix);
+			const protocolRequireEnv = (name) => name === "CONVEX_SITE_URL" ? authSiteUrl() : requireEnv(name);
 			addOpenIdRoutes(http$1, {
-				getIssuer: () => requireEnv("CONVEX_SITE_URL"),
+				routeBase: routePrefix,
+				getIssuer: authSiteUrl,
 				getJwks: () => requireEnv("JWKS")
 			});
+			addWebAuthnRoute(http$1, {
+				routeBase: routePrefix,
+				getResponse: () => {
+					const r = generateWebAuthnConfig();
+					return r === null ? null : {
+						body: r.body,
+						headers: r.headers
+					};
+				}
+			});
 			addGroupHttpRuntime({
 				http: http$1,
 				hasSSO,
 				auth: authBase,
 				config,
-				routeBase: GROUP_CONNECTION_ROUTE_BASE,
-				requireEnv,
+				routeBase: `${routePrefix}${GROUP_CONNECTION_ROUTE_BASE}`,
+				requireEnv: protocolRequireEnv,
 				loadActiveConnectionSamlOrThrow: group.loadActiveConnectionSamlOrThrow,
 				loadConnectionOidcOrThrow: group.loadConnectionOidcOrThrow,
 				getGroupConnectionScimContext: group.getGroupConnectionScimContext,
@@ -118,8 +318,9 @@ function Auth(config_) {
 				sharedOidcRedirectURI: ssoProvider?.redirectURI
 			});
 			if (hasOAuth) addAuthRoutes(http$1, {
-				handleSignIn: convertErrorsToResponse(400, async (ctx, request) => {
-					const url = new URL(request.url);
+				routeBase: routePrefix,
+				handleSignIn: convertErrorsToResponse(400, async (ctx, request$1) => {
+					const url = new URL(request$1.url);
 					const pathParts = url.pathname.split("/");
 					const providerId = pathParts[pathParts.length - 1];
 					if (providerId === null) throw convexError({
@@ -131,23 +332,23 @@ function Auth(config_) {
 						code: "OAUTH_MISSING_VERIFIER",
 						message: "Missing sign-in verifier."
 					});
-					const { redirect, cookies, signature } = await createOAuthAuthorizationURL(providerId, getProviderOrThrow(providerId));
+					const oauthConfig = getProviderOrThrow(providerId);
+					const redirectTo = url.searchParams.get("redirectTo");
+					const { redirect, cookies, signature } = await createOAuthAuthorizationURL(providerId, oauthConfig, { stateTransform: (state) => encodeOAuthState(state, redirectTo) });
 					await callVerifierSignature(ctx, {
 						verifier,
 						signature
 					});
-					const redirectTo = url.searchParams.get("redirectTo");
-					if (redirectTo !== null) cookies.push(redirectToParamCookie(providerId, redirectTo));
 					const headers = new Headers({ Location: redirect });
-					for (const { name, value, options } of cookies) headers.append("Set-Cookie", serialize(name, value, options));
+					for (const { name, value, options: options$1 } of cookies) headers.append("Set-Cookie", serialize(name, value, options$1));
 					return new Response(null, {
 						status: 302,
 						headers
 					});
 				}),
-				handleCallback: async (ctx, request) => {
-					const url = new URL(request.url);
-					const callbackPathParts = new URL(request.url).pathname.split("/");
+				handleCallback: async (ctx, request$1) => {
+					const url = new URL(request$1.url);
+					const callbackPathParts = new URL(request$1.url).pathname.split("/");
 					const providerId = callbackPathParts[callbackPathParts.length - 1];
 					if (!providerId) throw convexError({
 						code: "OAUTH_MISSING_PROVIDER",
@@ -155,19 +356,20 @@ function Auth(config_) {
 					});
 					log(LOG_LEVELS.DEBUG, "Handling OAuth callback for provider:", providerId);
 					const provider = getProviderOrThrow(providerId);
-					const cookies = getCookies(request);
-					const maybeRedirectTo = useRedirectToParam(provider.id, cookies);
-					const destinationUrl = await redirectAbsoluteUrl(config, { redirectTo: maybeRedirectTo?.redirectTo });
+					const cookies = getCookies(request$1);
 					const params = url.searchParams;
-					if (request.headers.get("Content-Type")?.includes("application/x-www-form-urlencoded")) (await request.formData()).forEach((value, key) => {
-						if (typeof value === "string") params.append(key, value);
-					});
+					if (request$1.headers.get("Content-Type")?.includes("application/x-www-form-urlencoded")) {
+						const formData = await request$1.formData();
+						for (const [key, value] of formDataEntries(formData)) if (typeof value === "string") params.append(key, value);
+					}
+					const fallbackDestinationUrl = await redirectAbsoluteUrl(ctx, config, { redirectTo: void 0 });
 					try {
 						const result = await handleOAuthCallback(providerId, provider, Object.fromEntries(params.entries()), cookies);
 						const oauthCookies = result.cookies;
 						const { id: profileId, ...profileData } = result.profile;
 						const { signature } = result;
-						const redirUrl = setURLSearchParam(destinationUrl, "code", await callUserOAuth(ctx, {
+						const { redirectTo: stateRedirectTo } = decodeOAuthState(params.get("state") ?? "");
+						const redirUrl = setURLSearchParam(await redirectAbsoluteUrl(ctx, config, { redirectTo: stateRedirectTo ?? void 0 }), "code", await callUserOAuth(ctx, {
 							provider: providerId,
 							providerAccountId: profileId,
 							profile: profileData,
@@ -175,34 +377,126 @@ function Auth(config_) {
 						}));
 						const redirHeaders = new Headers({ Location: redirUrl });
 						redirHeaders.set("Cache-Control", "must-revalidate");
-						for (const { name, value, options } of [...oauthCookies, ...maybeRedirectTo !== null ? [maybeRedirectTo.updatedCookie] : []]) redirHeaders.append("Set-Cookie", serialize(name, value, options));
+						for (const { name, value, options: options$1 } of oauthCookies) redirHeaders.append("Set-Cookie", serialize(name, value, options$1));
 						return new Response(null, {
 							status: 302,
 							headers: redirHeaders
 						});
 					} catch (error) {
 						logError(error);
-						const respHeaders = new Headers({ Location: destinationUrl });
-						for (const { name, value, options } of maybeRedirectTo !== null ? [maybeRedirectTo.updatedCookie] : []) respHeaders.append("Set-Cookie", serialize(name, value, options));
 						return new Response(null, {
 							status: 302,
-							headers: respHeaders
+							headers: { Location: fallbackDestinationUrl }
 						});
 					}
 				}
 			});
 		},
+		router: (options) => {
+			const http$1 = httpRouter();
+			request.add(http$1, options ?? { prefix: "/auth" });
+			return http$1;
+		},
 		context: createHttpContext(authBase),
 		action: createHttpAction(authBase, getDefaultCorsOrigins),
 		route: createHttpRoute(createHttpAction(authBase, getDefaultCorsOrigins), getDefaultCorsOrigins)
 	};
-	const auth = Object.assign(authBase, { http });
+	const auth = Object.assign(authBase, { request });
+	const httpDelegate = actionGeneric({
+		args: {
+			authSiteUrl: v.string(),
+			routePath: v.string(),
+			url: v.string(),
+			method: v.string(),
+			headers: vHeaderPairs,
+			body: v.optional(v.string())
+		},
+		returns: vHttpDelegateResponse,
+		handler: async (ctx, args) => {
+			const incomingUrl = new URL(args.url);
+			const requestUrl = new URL(args.authSiteUrl.replace(/\/$/, "") + args.routePath);
+			requestUrl.search = incomingUrl.search;
+			const method = args.method.toUpperCase();
+			const request$1 = new Request(requestUrl, {
+				method,
+				headers: new Headers(args.headers),
+				body: method === "GET" || method === "HEAD" ? void 0 : args.body ?? ""
+			});
+			const route = createProtocolRouter(args.authSiteUrl.replace(/\/$/, "")).lookup(args.routePath, method);
+			if (!route) return await serializeHttpResponse(new Response(null, { status: 404 }));
+			return await serializeHttpResponse(await invokeHttpHandler(route.handler, ctx, request$1));
+		}
+	});
+	const http = Object.assign((options) => request.router(options), httpDelegate);
+	const accountUnlink = async (ctx, args) => {
+		const accountDoc = await ctx.runQuery(config.component.public.accountGetById, { accountId: args.accountId });
+		if (accountDoc === null) throw convexError({
+			code: "ACCOUNT_NOT_FOUND",
+			message: "Account not found."
+		});
+		await ctx.runMutation(config.component.public.accountDelete, { accountId: args.accountId });
+		const userId = accountDoc.userId;
+		const provider = accountDoc.provider;
+		await config.callbacks?.after?.(ctx, {
+			kind: "accountUnlinked",
+			userId,
+			accountId: args.accountId,
+			provider
+		});
+		return {
+			accountId: args.accountId,
+			userId,
+			provider
+		};
+	};
+	const passkeyDelete = async (ctx, args) => {
+		const passkeyDoc = await ctx.runQuery(config.component.public.passkeyGetById, { passkeyId: args.passkeyId });
+		if (passkeyDoc === null) throw convexError({
+			code: "PASSKEY_NOT_FOUND",
+			message: "Passkey not found."
+		});
+		await ctx.runMutation(config.component.public.passkeyDelete, { passkeyId: args.passkeyId });
+		const userId = passkeyDoc.userId;
+		await config.callbacks?.after?.(ctx, {
+			kind: "passkeyRemoved",
+			userId,
+			passkeyId: args.passkeyId
+		});
+		return {
+			passkeyId: args.passkeyId,
+			userId
+		};
+	};
+	const totpDelete = async (ctx, args) => {
+		const totpDoc = await ctx.runQuery(config.component.public.totpGetById, { totpId: args.totpId });
+		if (totpDoc === null) throw convexError({
+			code: "TOTP_NOT_FOUND",
+			message: "TOTP factor not found."
+		});
+		await ctx.runMutation(config.component.public.totpDelete, { totpId: args.totpId });
+		const userId = totpDoc.userId;
+		await config.callbacks?.after?.(ctx, {
+			kind: "totpRemoved",
+			userId,
+			totpId: args.totpId
+		});
+		return {
+			totpId: args.totpId,
+			userId
+		};
+	};
+	const enrichedAccount = Object.assign({}, auth.account, { unlink: accountUnlink });
+	const passkeyHelpers = { delete: passkeyDelete };
+	const totpHelpers = { delete: totpDelete };
 	const enrichCtx = (ctx) => ({
 		...ctx,
 		auth: {
 			...ctx.auth,
+			getUserIdentity: ctx.auth.getUserIdentity.bind(ctx.auth),
 			config,
-			account: auth.account,
+			account: enrichedAccount,
+			passkey: passkeyHelpers,
+			totp: totpHelpers,
 			session: auth.session,
 			member: auth.member,
 			provider: auth.provider
@@ -221,9 +515,11 @@ function Auth(config_) {
 			handler: async (ctx, args) => {
 				if (args.calledBy !== void 0) log("INFO", `\`auth:signIn\` called by ${args.calledBy}`);
 				const provider = args.provider !== void 0 ? getProviderOrThrow(args.provider) : null;
+				const authSiteUrl = provider?.type === "oauth" || provider?.type === "sso" ? getAuthSiteUrl(ctx) : void 0;
 				const result = await services.signIn.signIn(enrichCtx(ctx), provider, args, {
 					generateTokens: true,
 					allowExtraProviders: false,
+					authSiteUrl,
 					resolveSsoProtocol: group.resolveGroupConnectionSsoProtocolOrThrow
 				});
 				const handler = {
@@ -253,7 +549,8 @@ function Auth(config_) {
 			handler: async (ctx, args) => {
 				return storeImpl(ctx, args, services);
 			}
-		})
+		}),
+		http
 	};
 }
 

package/dist/server/services/group.js

@@ -182,6 +182,10 @@ function createGroupService(deps) {
 			code: "INVALID_PARAMETERS",
 			message: connectionNotFoundError
 		});
+		if (connection.status !== "active") throw convexError({
+			code: "INVALID_PARAMETERS",
+			message: "Connection is not active."
+		});
 		return {
 			scimConfig,
 			connection,

package/dist/server/sessions.js

@@ -9,6 +9,7 @@ import { generateToken } from "./tokens.js";
 
 //#region src/server/sessions.ts
 const DEFAULT_SESSION_TOTAL_DURATION_MS = 1e3 * 60 * 60 * 24 * 30;
+/** @internal */
 const sessionExpirationTime = (config, now = Date.now()) => now + (config.session?.totalDurationMs ?? readConfigSync(envOptionalNumber("AUTH_SESSION_TOTAL_DURATION_MS")) ?? DEFAULT_SESSION_TOTAL_DURATION_MS);
 const encodeRefreshToken = (refreshTokenId, sessionId) => `${refreshTokenId}${REFRESH_TOKEN_DIVIDER}${sessionId}`;
 function buildSessionIdentity(userId, sessionId, user) {

package/dist/server/signin.js

@@ -8,9 +8,9 @@ import { callRefreshSession } from "./mutations/refresh.js";
 import { callSignIn } from "./mutations/signin.js";
 import { callVerifier } from "./mutations/verifier.js";
 import { callVerifyCodeAndSignIn } from "./mutations/verify.js";
-import { redirectAbsoluteUrl, setURLSearchParam } from "./redirects.js";
 import { authFlowError } from "../shared/errors.js";
-import { toConvexError } from "./errors.js";
+import { FlowSignal, toConvexError } from "./errors.js";
+import { redirectAbsoluteUrl, setURLSearchParam } from "./redirects.js";
 import { queryTotpVerifiedByUserId } from "./types.js";
 import { handleDevice } from "./device.js";
 import { handlePasskeyFx } from "./passkey.js";
@@ -146,7 +146,7 @@ async function handleEmailAndPhoneProviderFx(ctx, provider, args, options) {
 		}
 		let destination;
 		try {
-			destination = await redirectAbsoluteUrl(ctx.auth.config, args.params ?? {});
+			destination = await redirectAbsoluteUrl(ctx, ctx.auth.config, args.params ?? {});
 		} catch (error) {
 			throw asConvexError(error, "INVALID_REDIRECT", "Failed to resolve redirect URL.");
 		}
@@ -182,6 +182,7 @@ async function handleCredentialsFx(ctx, provider, args, options) {
 		try {
 			result = await withSpan("convex-auth.signin.credentials.authorize", { providerId: provider.id }, () => provider.authorize(args.params ?? {}, ctx));
 		} catch (error) {
+			if (error instanceof FlowSignal) return error.result;
 			throw asCredentialsError(error);
 		}
 		if (result === null) return {
@@ -272,7 +273,8 @@ async function handleOAuthProviderFx(ctx, provider, args, options) {
 				session: result
 			};
 		}
-		const redirect = new URL((readConfigSync(envOptionalString("CUSTOM_AUTH_SITE_URL")) ?? requireEnv("CONVEX_SITE_URL")) + `/api/auth/signin/${provider.id}`);
+		const authSiteUrl = options.authSiteUrl ?? readConfigSync(envOptionalString("CUSTOM_AUTH_SITE_URL")) ?? requireEnv("CONVEX_SITE_URL");
+		const redirect = new URL(`${authSiteUrl.replace(/\/$/, "")}/signin/${provider.id}`);
 		let verifier;
 		try {
 			verifier = await callVerifier(ctx);
@@ -315,8 +317,8 @@ async function handleSsoProviderFx(ctx, args, options) {
 		} catch (error) {
 			throw asConvexError(error, "INTERNAL_ERROR", "Failed to create verifier.");
 		}
-		const siteUrl = readConfigSync(envOptionalString("CUSTOM_AUTH_SITE_URL")) ?? requireEnv("CONVEX_SITE_URL");
-		const redirect = new URL(`${siteUrl}/api/auth/connections/${connectionId}/${protocol}/signin`);
+		const siteUrl = options.authSiteUrl ?? readConfigSync(envOptionalString("CUSTOM_AUTH_SITE_URL")) ?? requireEnv("CONVEX_SITE_URL");
+		const redirect = new URL(`${siteUrl.replace(/\/$/, "")}/connections/${connectionId}/${protocol}/signin`);
 		redirect.searchParams.set("code", verifier);
 		if (typeof args.params?.redirectTo === "string") redirect.searchParams.set("redirectTo", args.params.redirectTo);
 		if (typeof normalizedParams.loginHint === "string") redirect.searchParams.set("loginHint", normalizedParams.loginHint);