@robelest/convex-auth 0.0.4-preview.30 → 0.0.4-preview.31

package/dist/server/sso/oidc.js

@@ -44,7 +44,9 @@ function validateOidcUserInfo(data) {
 		email: typeof obj.email === "string" ? obj.email : void 0,
 		email_verified: typeof obj.email_verified === "boolean" ? obj.email_verified : void 0,
 		name: typeof obj.name === "string" ? obj.name : void 0,
-		picture: typeof obj.picture === "string" ? obj.picture : void 0
+		picture: typeof obj.picture === "string" ? obj.picture : void 0,
+		groups: obj.groups,
+		roles: obj.roles
 	};
 }
 const asError = (error) => error instanceof Error ? error : new Error(String(error));
@@ -127,7 +129,9 @@ async function userInfoProfileFx(opts) {
 			email: typeof userInfo.email === "string" ? userInfo.email : opts.verifiedProfile.email,
 			emailVerified: typeof userInfo.email_verified === "boolean" ? userInfo.email_verified : opts.verifiedProfile.emailVerified,
 			name: typeof userInfo.name === "string" ? userInfo.name : opts.verifiedProfile.name,
-			image: typeof userInfo.picture === "string" ? userInfo.picture : opts.verifiedProfile.image
+			image: typeof userInfo.picture === "string" ? userInfo.picture : opts.verifiedProfile.image,
+			groups: normalizeStringArray(userInfo.groups) ?? opts.verifiedProfile.groups,
+			roles: normalizeStringArray(userInfo.roles) ?? opts.verifiedProfile.roles
 		};
 	});
 }
@@ -151,6 +155,7 @@ async function createGroupConnectionOidcProvider(config, redirectUri) {
 	const supportedIdTokenSigningAlgs = Array.isArray(discovery.id_token_signing_alg_values_supported) ? discovery.id_token_signing_alg_values_supported.filter((value) => typeof value === "string") : [];
 	const discoveredTokenEndpointAuthMethods = Array.isArray(discovery.token_endpoint_auth_methods_supported) ? discovery.token_endpoint_auth_methods_supported.filter((value) => typeof value === "string") : [];
 	const tokenEndpointAuthMethod = client.authMethod === "client_secret_basic" || client.authMethod === "client_secret_post" ? client.authMethod : discoveredTokenEndpointAuthMethods.includes("client_secret_basic") ? "client_secret_basic" : "client_secret_post";
+	if (typeof client.authMethod === "string" && discoveredTokenEndpointAuthMethods.length > 0 && !discoveredTokenEndpointAuthMethods.includes(tokenEndpointAuthMethod)) throw new Error(`OIDC token endpoint auth method ${tokenEndpointAuthMethod} is not advertised by discovery.`);
 	const userinfoEndpoint = discovery.userinfo_endpoint ?? void 0;
 	const claimMapping = typeof profile.mapping === "object" && profile.mapping !== null ? profile.mapping : void 0;
 	const oidcFetch = createGroupConnectionOidcFetch(config, discovery.issuer);
@@ -163,13 +168,8 @@ async function createGroupConnectionOidcProvider(config, redirectUri) {
 	];
 	const expectedAudience = Array.isArray(discoveryConfig.audience) ? discoveryConfig.audience.filter((value) => typeof value === "string") : typeof discoveryConfig.audience === "string" ? discoveryConfig.audience : String(client.id);
 	const clockToleranceSeconds = typeof security.clockToleranceSeconds === "number" ? security.clockToleranceSeconds : 10;
-	const getIssuerCandidates = (issuer) => {
-		const candidates = [issuer];
-		if (issuer.startsWith("https://")) candidates.push(`http://${issuer.slice(8)}`);
-		else if (issuer.startsWith("http://")) candidates.push(`https://${issuer.slice(7)}`);
-		return candidates;
-	};
-	const expectedIssuers = strictIssuer ? [expectedIssuer] : Array.from(new Set([...getIssuerCandidates(expectedIssuer), ...getIssuerCandidates(discoveredIssuer)]));
+	if (clockToleranceSeconds < 0 || clockToleranceSeconds > 300) throw new Error("OIDC clockToleranceSeconds must be between 0 and 300.");
+	const expectedIssuers = strictIssuer ? [expectedIssuer] : Array.from(new Set([expectedIssuer, discoveredIssuer]));
 	const jwks = getOidcJwks(jwksUri, runtimeOrigin, externalHost, oidcFetch);
 	let verifiedClaims = null;
 	let verifiedProfile = null;
@@ -190,7 +190,21 @@ async function createGroupConnectionOidcProvider(config, redirectUri) {
 				if (nonce !== void 0) url.searchParams.set("nonce", nonce);
 				if (typeof loginHint === "string") url.searchParams.set("login_hint", loginHint);
 				const authorizationParams = typeof request.authorizationParams === "object" && request.authorizationParams !== null ? request.authorizationParams : {};
-				for (const [key, value] of Object.entries(authorizationParams)) if (typeof value === "string") url.searchParams.set(key, value);
+				const reservedAuthorizationParams = new Set([
+					"response_type",
+					"client_id",
+					"redirect_uri",
+					"scope",
+					"state",
+					"code_challenge",
+					"code_challenge_method",
+					"nonce",
+					"login_hint"
+				]);
+				for (const [key, value] of Object.entries(authorizationParams)) {
+					if (reservedAuthorizationParams.has(key)) throw new Error(`OIDC authorizationParams cannot override reserved parameter: ${key}`);
+					if (typeof value === "string") url.searchParams.set(key, value);
+				}
 				return url;
 			},
 			async validateAuthorizationCode({ code, codeVerifier }) {
@@ -201,7 +215,9 @@ async function createGroupConnectionOidcProvider(config, redirectUri) {
 				});
 				const headers = new Headers({ "Content-Type": "application/x-www-form-urlencoded" });
 				if (typeof client.secret === "string" && tokenEndpointAuthMethod === "client_secret_basic") {
-					const basicAuth = typeof btoa === "function" ? btoa(`${String(client.id)}:${client.secret}`) : Buffer.from(`${String(client.id)}:${client.secret}`).toString("base64");
+					const encodeCredential = (value) => encodeURIComponent(value).replace(/%20/g, "+");
+					const credentials = `${encodeCredential(String(client.id))}:${encodeCredential(client.secret)}`;
+					const basicAuth = typeof btoa === "function" ? btoa(credentials) : Buffer.from(credentials).toString("base64");
 					headers.set("Authorization", `Basic ${basicAuth}`);
 				} else {
 					body.set("client_id", String(client.id));
@@ -263,7 +279,7 @@ async function createGroupConnectionOidcProvider(config, redirectUri) {
 				const tokenIssuer = typeof tokenIssuerRaw === "string" ? tokenIssuerRaw.replace(/\/$/, "") : void 0;
 				if (!tokenIssuer || !expectedIssuers.includes(tokenIssuer)) throw new Error(`OIDC token issuer mismatch. Received: ${tokenIssuer ?? "<missing>"}. Expected one of: ${expectedIssuers.join(", ")}`);
 				if (payload.nonce !== ctx.nonce) throw new Error("OIDC nonce mismatch.");
-				if (Array.isArray(payload.aud) && payload.aud.length > 1 && payload.azp !== String(client.id)) throw new Error("OIDC authorized party does not match client ID.");
+				if (payload.azp !== void 0 && payload.azp !== String(client.id)) throw new Error("OIDC authorized party does not match client ID.");
 				verifiedClaims = payload;
 				verifiedProfile = normalizeProfile(payload);
 			},

package/dist/server/sso/policy.js

@@ -30,7 +30,17 @@ const DEFAULT_GROUP_CONNECTION_POLICY = {
 		}
 	}
 };
+/** Accept a value only if it's one of the allowed options, otherwise return the fallback. */
+function oneOf(value, allowed, fallback) {
+	return allowed.includes(value) ? value : fallback;
+}
+/** Parse an object whose values are string arrays (e.g. group→roleIds mapping). */
+function parseStringArrayMapping(raw) {
+	if (typeof raw !== "object" || raw === null) return void 0;
+	return Object.fromEntries(Object.entries(raw).filter(([key, value]) => typeof key === "string" && Array.isArray(value)).map(([key, value]) => [key, Array.from(new Set(value.filter((item) => typeof item === "string" && item.length > 0)))]));
+}
 function normalizeGroupConnectionPolicy(policy) {
+	const d = DEFAULT_GROUP_CONNECTION_POLICY;
 	const input = asRecord(policy) ?? {};
 	const accountLinking = asRecord((asRecord(input.identity) ?? {}).accountLinking) ?? {};
 	const provisioning = asRecord(input.provisioning) ?? {};
@@ -41,34 +51,40 @@ function normalizeGroupConnectionPolicy(policy) {
 	const groups = asRecord(provisioning.groups) ?? {};
 	const roles = asRecord(provisioning.roles) ?? {};
 	const extend = asRecord(input.extend) ?? void 0;
+	const groupsMapping = parseStringArrayMapping(groups.mapping);
+	const rolesMapping = parseStringArrayMapping(roles.mapping);
 	return {
 		version: 1,
 		identity: { accountLinking: {
-			oidc: accountLinking.oidc === "none" ? "none" : DEFAULT_GROUP_CONNECTION_POLICY.identity.accountLinking.oidc,
-			saml: accountLinking.saml === "none" ? "none" : DEFAULT_GROUP_CONNECTION_POLICY.identity.accountLinking.saml
+			oidc: oneOf(accountLinking.oidc, ["none"], d.identity.accountLinking.oidc),
+			saml: oneOf(accountLinking.saml, ["none"], d.identity.accountLinking.saml)
 		} },
 		provisioning: {
 			user: {
-				createOnSignIn: typeof user.createOnSignIn === "boolean" ? user.createOnSignIn : DEFAULT_GROUP_CONNECTION_POLICY.provisioning.user.createOnSignIn,
-				updateProfileOnLogin: user.updateProfileOnLogin === "never" || user.updateProfileOnLogin === "always" ? user.updateProfileOnLogin : DEFAULT_GROUP_CONNECTION_POLICY.provisioning.user.updateProfileOnLogin,
-				updateProfileFromScim: user.updateProfileFromScim === "never" || user.updateProfileFromScim === "missing" ? user.updateProfileFromScim : DEFAULT_GROUP_CONNECTION_POLICY.provisioning.user.updateProfileFromScim,
-				authority: user.authority === "sso" || user.authority === "scim" ? user.authority : DEFAULT_GROUP_CONNECTION_POLICY.provisioning.user.authority
+				createOnSignIn: typeof user.createOnSignIn === "boolean" ? user.createOnSignIn : d.provisioning.user.createOnSignIn,
+				updateProfileOnLogin: oneOf(user.updateProfileOnLogin, ["never", "always"], d.provisioning.user.updateProfileOnLogin),
+				updateProfileFromScim: oneOf(user.updateProfileFromScim, ["never", "missing"], d.provisioning.user.updateProfileFromScim),
+				authority: oneOf(user.authority, ["sso", "scim"], d.provisioning.user.authority)
 			},
-			scimReuse: { user: scimReuse.user === "none" ? "none" : DEFAULT_GROUP_CONNECTION_POLICY.provisioning.scimReuse.user },
+			scimReuse: { user: oneOf(scimReuse.user, ["none"], d.provisioning.scimReuse.user) },
 			jit: {
-				mode: jit.mode === "off" || jit.mode === "createUser" || jit.mode === "createUserAndMembership" ? jit.mode : DEFAULT_GROUP_CONNECTION_POLICY.provisioning.jit.mode,
-				defaultRoleIds: Array.isArray(jit.defaultRoleIds) ? Array.from(new Set(jit.defaultRoleIds.filter((value) => typeof value === "string" && value.length > 0))) : typeof jit.defaultRole === "string" && jit.defaultRole.length > 0 ? [jit.defaultRole] : DEFAULT_GROUP_CONNECTION_POLICY.provisioning.jit.defaultRoleIds
+				mode: oneOf(jit.mode, [
+					"off",
+					"createUser",
+					"createUserAndMembership"
+				], d.provisioning.jit.mode),
+				defaultRoleIds: Array.isArray(jit.defaultRoleIds) ? Array.from(new Set(jit.defaultRoleIds.filter((value) => typeof value === "string" && value.length > 0))) : typeof jit.defaultRole === "string" && jit.defaultRole.length > 0 ? [jit.defaultRole] : d.provisioning.jit.defaultRoleIds
 			},
-			deprovision: { mode: deprovision.mode === "hard" ? "hard" : DEFAULT_GROUP_CONNECTION_POLICY.provisioning.deprovision.mode },
+			deprovision: { mode: oneOf(deprovision.mode, ["hard"], d.provisioning.deprovision.mode) },
 			groups: {
-				mode: groups.mode === "sync" ? "sync" : DEFAULT_GROUP_CONNECTION_POLICY.provisioning.groups.mode,
+				mode: oneOf(groups.mode, ["sync"], d.provisioning.groups.mode),
 				source: "protocol",
-				...typeof groups.mapping === "object" && groups.mapping !== null ? { mapping: Object.fromEntries(Object.entries(groups.mapping).filter(([key, value]) => typeof key === "string" && Array.isArray(value)).map(([key, value]) => [key, Array.from(new Set(value.filter((item) => typeof item === "string" && item.length > 0)))])) } : {}
+				...groupsMapping ? { mapping: groupsMapping } : {}
 			},
 			roles: {
-				mode: roles.mode === "map" ? "map" : DEFAULT_GROUP_CONNECTION_POLICY.provisioning.roles.mode,
+				mode: oneOf(roles.mode, ["map"], d.provisioning.roles.mode),
 				source: "protocol",
-				...typeof roles.mapping === "object" && roles.mapping !== null ? { mapping: Object.fromEntries(Object.entries(roles.mapping).filter(([key, value]) => typeof key === "string" && Array.isArray(value)).map(([key, value]) => [key, Array.from(new Set(value.filter((item) => typeof item === "string" && item.length > 0)))])) } : {}
+				...rolesMapping ? { mapping: rolesMapping } : {}
 			}
 		},
 		...extend ? { extend } : {}

package/dist/server/sso/provision.js

@@ -8,7 +8,7 @@ function getScimConfigShape(scimConfig) {
 const convexError = (data) => new ConvexError(data);
 function createGroupScimDomain(deps) {
 	const { config, requireEnv, generateRandomString, INVITE_TOKEN_ALPHABET, sha256, loadGroupPolicyOrThrow, recordGroupAuditEvent, emitGroupWebhookDeliveries } = deps;
-	const getScimBasePath = (connectionId) => `${requireEnv("CONVEX_SITE_URL")}/api/auth/connections/${connectionId}/scim/v2`;
+	const getScimBasePath = (connectionId) => `${requireEnv("CONVEX_SITE_URL")}/connections/${connectionId}/scim/v2`;
 	const validateScim = async (ctx, connectionId) => {
 		const checks = [];
 		const connection = await getGroupConnection(ctx, config.component.public, connectionId);

package/dist/server/sso/saml.js

@@ -6,14 +6,20 @@ import { decodeBase64urlIgnorePadding, encodeBase64urlNoPadding } from "@oslojs/
 import { Constants, IdentityProvider, ServiceProvider, setSchemaValidator } from "@robelest/samlify";
 
 //#region src/server/sso/saml.ts
+function formDataEntries(formData) {
+	return formData;
+}
 const _samlifyPermissiveValidator = { validate: (_xml) => Promise.resolve("OK") };
 function ensureSamlifyValidator() {
 	setSchemaValidator(_samlifyPermissiveValidator);
 }
+function escapeHtmlAttribute(value) {
+	return value.replace(/&/g, "&amp;").replace(/"/g, "&quot;").replace(/</g, "&lt;").replace(/>/g, "&gt;");
+}
 /** @internal */
 function createSamlPostBindingResponse(opts) {
-	const fields = [`<input type="hidden" name="${opts.parameter}" value="${opts.value.replace(/"/g, "&quot;")}" />`, opts.relayState ? `<input type="hidden" name="RelayState" value="${opts.relayState.replace(/"/g, "&quot;")}" />` : ""].join("");
-	return new Response(`<!doctype html><html><body><form method="POST" action="${opts.endpoint}">${fields}</form><script>document.forms[0].submit();<\/script></body></html>`, {
+	const fields = [`<input type="hidden" name="${opts.parameter}" value="${escapeHtmlAttribute(opts.value)}" />`, opts.relayState ? `<input type="hidden" name="RelayState" value="${escapeHtmlAttribute(opts.relayState)}" />` : ""].join("");
+	return new Response(`<!doctype html><html><body><form method="POST" action="${escapeHtmlAttribute(opts.endpoint)}">${fields}</form><script>document.forms[0].submit();<\/script></body></html>`, {
 		status: 200,
 		headers: { "Content-Type": "text/html; charset=utf-8" }
 	});
@@ -62,9 +68,7 @@ async function readRequestBody(request) {
 	if (contentType.includes("application/x-www-form-urlencoded") || contentType.includes("multipart/form-data")) {
 		const form = await request.formData();
 		const body = {};
-		form.forEach((value, key) => {
-			body[key] = typeof value === "string" ? value : value.name;
-		});
+		for (const [key, value] of formDataEntries(form)) body[key] = typeof value === "string" ? value : value.name;
 		return body;
 	}
 	return {};
@@ -89,6 +93,7 @@ function getSamlSecurityConfig(config) {
 /** @internal */
 function parseSamlIdpMetadata(metadata) {
 	const source = typeof metadata === "string" ? metadata : String(metadata);
+	if (/<!DOCTYPE|<!ENTITY/i.test(source)) throw new Error("SAML metadata must not contain DTD or entity declarations.");
 	const entityId = source.match(/<[^>]*EntityDescriptor\b[^>]*\bentityID="([^"]+)"/i)?.[1] ?? null;
 	if (!entityId) throw new Error("SAML metadata is missing EntityDescriptor@entityID.");
 	const parseAttributes = (source$1) => {
@@ -259,11 +264,13 @@ function verifySamlTimeWindow(notBefore, notOnOrAfter, clockSkewSeconds) {
 	const drift = clockSkewSeconds * 1e3;
 	if (notBefore) {
 		const notBeforeTime = new Date(notBefore).getTime();
-		if (Number.isFinite(notBeforeTime) && now < notBeforeTime - drift) throw new Error("SAML assertion is not yet valid.");
+		if (!Number.isFinite(notBeforeTime)) throw new Error("SAML assertion has an invalid NotBefore timestamp.");
+		if (now < notBeforeTime - drift) throw new Error("SAML assertion is not yet valid.");
 	}
 	if (notOnOrAfter) {
 		const notOnOrAfterTime = new Date(notOnOrAfter).getTime();
-		if (Number.isFinite(notOnOrAfterTime) && now >= notOnOrAfterTime + drift) throw new Error("SAML assertion has expired.");
+		if (!Number.isFinite(notOnOrAfterTime)) throw new Error("SAML assertion has an invalid NotOnOrAfter timestamp.");
+		if (now >= notOnOrAfterTime + drift) throw new Error("SAML assertion has expired.");
 	}
 }
 /** @internal */
@@ -273,7 +280,7 @@ function enforceGroupConnectionSamlSecurity(opts) {
 	const conditions = opts.extract?.conditions;
 	if (security.requireSignedAssertions === true && typeof opts.extract?.signature?.signatureAlgorithm !== "string") throw new Error("SAML assertion must be signed.");
 	if (security.requireTimestamps === true) {
-		if (!conditions?.notBefore && !conditions?.notOnOrAfter) throw new Error("SAML assertion missing required timestamp conditions.");
+		if (!conditions?.notBefore || !conditions?.notOnOrAfter) throw new Error("SAML assertion missing required timestamp conditions.");
 	}
 	if (conditions?.notBefore || conditions?.notOnOrAfter) verifySamlTimeWindow(conditions.notBefore, conditions.notOnOrAfter, security.clockSkewSeconds ?? 300);
 }
@@ -377,10 +384,12 @@ async function parseGroupConnectionSamlLogoutMessage(opts) {
 		relayState: httpRequest.relayState
 	});
 	const parsedRequest = httpRequest.hasSamlRequest ? await runtime.sp.parseLogoutRequest(runtime.idp, httpRequest.binding, toSamlHttpRequest(httpRequest)) : void 0;
+	const parsedResponse = httpRequest.hasSamlResponse ? await runtime.sp.parseLogoutResponse(runtime.idp, httpRequest.binding, toSamlHttpRequest(httpRequest)) : void 0;
 	return {
 		...httpRequest,
 		runtime,
-		parsedRequest
+		parsedRequest,
+		parsedResponse
 	};
 }
 /** @internal */

package/dist/server/sso/scim.js

@@ -3,8 +3,10 @@ import { SCIM_GROUP_SCHEMA_ID, SCIM_USER_SCHEMA_ID } from "./shared.js";
 //#region src/server/sso/scim.ts
 /** @internal */
 function parseScimPath(pathname) {
-	const [api, auth, connections, connectionId, protocol, version, ...rest] = pathname.split("/").filter(Boolean);
-	if (api !== "api" || auth !== "auth" || connections !== "connections" || !connectionId || connectionId === "setup" || protocol !== "scim" || version !== "v2") return {
+	const parts = pathname.split("/").filter(Boolean);
+	const connectionsIndex = parts.lastIndexOf("connections");
+	const [connectionId, protocol, version, ...rest] = connectionsIndex >= 0 ? parts.slice(connectionsIndex + 1) : [];
+	if (connectionsIndex < 0 || !connectionId || connectionId === "setup" || protocol !== "scim" || version !== "v2" || rest.length > 2) return {
 		connectionId: "",
 		resource: "",
 		resourceId: void 0
@@ -17,8 +19,14 @@ function parseScimPath(pathname) {
 }
 /** @internal */
 function parseScimListRequest(url) {
-	const startIndex = Math.max(1, Number(url.searchParams.get("startIndex") ?? "1"));
-	const count = Math.min(100, Math.max(1, Number(url.searchParams.get("count") ?? "100")));
+	const rawStartIndex = url.searchParams.get("startIndex") ?? "1";
+	const rawCount = url.searchParams.get("count") ?? "100";
+	const parsedStartIndex = Number(rawStartIndex);
+	const parsedCount = Number(rawCount);
+	if (!Number.isInteger(parsedStartIndex) || parsedStartIndex < 1) throw new Error("Invalid SCIM pagination.");
+	if (!Number.isInteger(parsedCount) || parsedCount < 0) throw new Error("Invalid SCIM pagination.");
+	const startIndex = parsedStartIndex;
+	const count = Math.min(100, parsedCount);
 	const filterParam = url.searchParams.get("filter");
 	return {
 		startIndex,

package/dist/server/sso/shared.js

@@ -23,21 +23,21 @@ function groupSamlProviderId(connectionId) {
 function getGroupSamlUrls(opts) {
 	const root = opts.rootUrl.replace(/\/$/, "");
 	return {
-		metadataUrl: `${root}/api/auth/connections/${opts.source.id}/saml/metadata`,
-		acsUrl: `${root}/api/auth/connections/${opts.source.id}/saml/acs`,
-		sloUrl: `${root}/api/auth/connections/${opts.source.id}/saml/slo`
+		metadataUrl: `${root}/connections/${opts.source.id}/saml/metadata`,
+		acsUrl: `${root}/connections/${opts.source.id}/saml/acs`,
+		sloUrl: `${root}/connections/${opts.source.id}/saml/slo`
 	};
 }
 /** @internal */
 function getGroupOidcUrls(opts) {
 	const root = opts.rootUrl.replace(/\/$/, "");
 	const callbackUrl = (() => {
-		if (typeof opts.sharedRedirectURI !== "string") return `${root}/api/auth/connections/${opts.connectionId}/oidc/callback`;
+		if (typeof opts.sharedRedirectURI !== "string") return `${root}/connections/${opts.connectionId}/oidc/callback`;
 		if (/^https?:\/\//.test(opts.sharedRedirectURI)) return opts.sharedRedirectURI;
 		return `${root}${opts.sharedRedirectURI.startsWith("/") ? "" : "/"}${opts.sharedRedirectURI}`;
 	})();
 	return {
-		signInUrl: `${root}/api/auth/connections/${opts.connectionId}/oidc/signin`,
+		signInUrl: `${root}/connections/${opts.connectionId}/oidc/signin`,
 		callbackUrl
 	};
 }

package/dist/server/telemetry.js

@@ -43,12 +43,15 @@ async function buildAuthIdentityAttributes(ctx, config, args) {
 	if (Object.keys(attributes).length > 0) attributes["auth.identity.mode"] = mode;
 	return attributes;
 }
+/** @internal */
 async function buildRefreshIdentityAttributes(ctx, config, args) {
 	return await buildAuthIdentityAttributes(ctx, config, args);
 }
+/** @internal */
 async function buildSignInIdentityAttributes(ctx, config, args) {
 	return await buildAuthIdentityAttributes(ctx, config, args);
 }
+/** @internal */
 async function buildSignOutIdentityAttributes(ctx, config, args) {
 	return await buildAuthIdentityAttributes(ctx, config, args);
 }

package/dist/server/tokens.js

@@ -1,5 +1,5 @@
 import { generateRandomString } from "./random.js";
-import { requireEnv } from "./env.js";
+import { envOptionalString, readConfigSync, requireEnv } from "./env.js";
 import { withSpan } from "./utils/span.js";
 import { SignJWT, importPKCS8 } from "jose";
 
@@ -34,9 +34,17 @@ const getPrivateKey = () => {
 	return cachedPrivateKeyPromise;
 };
 const getIssuer = () => {
-	if (cachedIssuer === null) cachedIssuer = requireEnv("CONVEX_SITE_URL");
+	if (cachedIssuer === null) cachedIssuer = appendAuthPrefix(requireEnv("CONVEX_SITE_URL"), readConfigSync(envOptionalString("CONVEX_AUTH_HTTP_PREFIX")) ?? "/auth");
 	return cachedIssuer;
 };
+function appendAuthPrefix(siteUrl, prefix) {
+	return `${siteUrl.replace(/\/$/, "")}${normalizeAuthPrefix(prefix)}`;
+}
+function normalizeAuthPrefix(prefix) {
+	const trimmed = prefix.trim();
+	if (trimmed === "" || trimmed === "/") return "";
+	return `/${trimmed.replace(/^\/+|\/+$/g, "")}`;
+}
 try {
 	getPrivateKey().catch(() => {});
 } catch {}

package/dist/server/totp.js

@@ -12,22 +12,20 @@ import { createTOTPKeyURI, verifyTOTPWithGracePeriod } from "@oslojs/otp";
 /**
 * Server-side TOTP ceremony logic for two-factor authentication.
 *
-* Handles the three phases of the TOTP flow:
-* 1. setup   — generate a TOTP secret and `otpauth://` URI for enrollment
-* 2. confirm — verify the first code from the authenticator app
-* 3. verify  — verify a TOTP code during sign-in (2FA challenge)
+* Two single-word flows:
+*
+* - `setup`  — generate a TOTP secret and `otpauth://` URI for enrollment.
+* - `verify` — consume a TOTP code. Auto-detects:
+*     - first-time enrollment confirmation (caller passes `totpId`), or
+*     - 2FA sign-in challenge (no `totpId`).
 */
-const TOTP_FLOWS = [
-	"setup",
-	"confirm",
-	"verify"
-];
+const TOTP_FLOWS = ["setup", "verify"];
 const convexError = (code, message) => toConvexError(authFlowError(code, message));
 const asConvexError = (error, code, message) => error instanceof ConvexError ? error : error instanceof Error ? toConvexError(authFlowError(code, error.message || message)) : convexError(code, message);
 function resolveTotpFlow(params) {
 	const flow = params.flow;
 	if (typeof flow === "string" && TOTP_FLOWS.includes(flow)) return flow;
-	throw convexError("TOTP_MISSING_FLOW", "Missing `flow` parameter. Expected one of: setup, confirm, verify");
+	throw convexError("TOTP_MISSING_FLOW", "Missing `flow` parameter. Expected one of: " + TOTP_FLOWS.join(", "));
 }
 function requireTotpVerifier(verifier) {
 	if (verifier != null) return verifier;
@@ -37,30 +35,25 @@ function requireTotpCode(params) {
 	if (typeof params.code === "string") return params.code;
 	throw convexError("TOTP_MISSING_CODE", "Missing TOTP code.");
 }
-function requireTotpId(params) {
-	if (typeof params.totpId === "string") return params.totpId;
-	throw convexError("TOTP_MISSING_ID", "Missing TOTP enrollment ID.");
-}
 function resolveTotpDispatch(params, verifier) {
-	const flow = resolveTotpFlow(params);
-	if (flow === "setup") return {
+	if (resolveTotpFlow(params) === "setup") return {
 		flow: "setup",
 		params
 	};
-	if (flow === "confirm") {
-		const resolvedVerifier$1 = requireTotpVerifier(verifier);
-		return {
-			flow: "confirm",
-			code: requireTotpCode(params),
-			totpId: requireTotpId(params),
-			verifier: resolvedVerifier$1
-		};
-	}
 	const resolvedVerifier = requireTotpVerifier(verifier);
+	const code = requireTotpCode(params);
+	if (typeof params.totpId === "string" && params.totpId.length > 0) return {
+		flow: "verify",
+		code,
+		totpId: params.totpId,
+		verifier: resolvedVerifier,
+		intent: "enrollment"
+	};
 	return {
 		flow: "verify",
-		code: requireTotpCode(params),
-		verifier: resolvedVerifier
+		code,
+		verifier: resolvedVerifier,
+		intent: "challenge"
 	};
 }
 async function requireAuthenticatedUserId(ctx) {
@@ -76,7 +69,7 @@ async function requireAuthenticatedUserId(ctx) {
 /** @internal */
 const handleTotp = async (ctx, provider, args) => {
 	const dispatch = resolveTotpDispatch(args.params ?? {}, args.verifier);
-	const handler = {
+	const flowHandlers = {
 		setup: async () => {
 			const { params: setupParams } = dispatch;
 			const userId = await requireAuthenticatedUserId(ctx);
@@ -94,17 +87,6 @@ const handleTotp = async (ctx, provider, args) => {
 			}
 			const uri = createTOTPKeyURI(provider.options.issuer, accountName, secret, provider.options.period, provider.options.digits);
 			const base32Secret = encodeBase32LowerCaseNoPadding(secret);
-			let verifier;
-			try {
-				verifier = await callVerifier(ctx, JSON.stringify({
-					secret: Array.from(secret),
-					userId,
-					digits: provider.options.digits,
-					period: provider.options.period
-				}));
-			} catch (error) {
-				throw asConvexError(error, "INTERNAL_ERROR", `TOTP setup failed: ${String(error)}`);
-			}
 			let totpId;
 			try {
 				totpId = await mutateTotpInsert(ctx, {
@@ -119,6 +101,19 @@ const handleTotp = async (ctx, provider, args) => {
 			} catch (error) {
 				throw asConvexError(error, "INTERNAL_ERROR", `TOTP setup failed: ${String(error)}`);
 			}
+			let verifier;
+			try {
+				verifier = await callVerifier(ctx, JSON.stringify({
+					purpose: "totp.setup",
+					secret: Array.from(secret),
+					userId,
+					totpId,
+					digits: provider.options.digits,
+					period: provider.options.period
+				}));
+			} catch (error) {
+				throw asConvexError(error, "INTERNAL_ERROR", `TOTP setup failed: ${String(error)}`);
+			}
 			return {
 				kind: "totpSetup",
 				totpSetup: {
@@ -129,69 +124,101 @@ const handleTotp = async (ctx, provider, args) => {
 				verifier
 			};
 		},
-		confirm: async () => {
-			const { code, totpId, verifier } = dispatch;
-			const userId = await requireAuthenticatedUserId(ctx);
-			let doc;
-			try {
-				doc = await queryTotpById(ctx, totpId);
-			} catch {
-				throw convexError("TOTP_NOT_FOUND", "TOTP enrollment not found.");
-			}
-			if (doc === null) throw convexError("TOTP_NOT_FOUND", "TOTP enrollment not found.");
-			if (doc.verified) throw convexError("TOTP_ALREADY_VERIFIED", "TOTP enrollment is already verified.");
-			if (!verifyTOTPWithGracePeriod(new Uint8Array(doc.secret), provider.options.period, provider.options.digits, code, 30)) throw convexError("TOTP_INVALID_CODE", "Invalid TOTP code.");
-			let signInResult;
-			try {
-				await mutateTotpMarkVerified(ctx, totpId, Date.now());
-				await mutateVerifierDelete(ctx, verifier);
-				signInResult = await callSignIn(ctx, {
-					userId,
-					generateTokens: true
-				});
-			} catch (error) {
-				throw asConvexError(error, "INTERNAL_ERROR", String(error));
-			}
-			return {
-				kind: "signedIn",
-				session: signInResult
-			};
-		},
 		verify: async () => {
-			const { code, verifier } = dispatch;
-			let doc;
-			try {
-				doc = await queryVerifierById(ctx, verifier);
-			} catch {
-				throw convexError("TOTP_INVALID_VERIFIER", "Invalid or expired TOTP verifier.");
-			}
-			if (doc === null) throw convexError("TOTP_INVALID_VERIFIER", "Invalid or expired TOTP verifier.");
-			const userId = JSON.parse(doc.signature).userId;
-			let totp;
-			try {
-				totp = await queryTotpVerifiedByUserId(ctx, userId);
-			} catch {
-				throw convexError("TOTP_NO_ENROLLMENT", "No verified TOTP enrollment found.");
-			}
-			if (totp === null) throw convexError("TOTP_NO_ENROLLMENT", "No verified TOTP enrollment found.");
-			if (!verifyTOTPWithGracePeriod(new Uint8Array(totp.secret), totp.period, totp.digits, code, 30)) throw convexError("TOTP_INVALID_CODE", "Invalid TOTP code.");
-			let signInResult;
-			try {
-				await mutateTotpUpdateLastUsed(ctx, totp._id, Date.now());
-				await mutateVerifierDelete(ctx, verifier);
-				signInResult = await callSignIn(ctx, {
-					userId,
-					generateTokens: true
-				});
-			} catch (error) {
-				throw asConvexError(error, "INTERNAL_ERROR", String(error));
-			}
-			return {
-				kind: "signedIn",
-				session: signInResult
-			};
+			if (dispatch.flow !== "verify") throw convexError("TOTP_MISSING_FLOW", `Unexpected dispatch: ${dispatch.flow}`);
+			if (dispatch.intent === "enrollment") return await confirmEnrollment(dispatch.code, dispatch.totpId, dispatch.verifier);
+			return await verifyChallenge(dispatch.code, dispatch.verifier);
+		}
+	};
+	/**
+	* `verify` with `totpId`: completes a first-time enrollment after `setup`.
+	* Marks the TOTP factor as verified and signs the user in.
+	*/
+	async function confirmEnrollment(code, totpId, verifier) {
+		const userId = await requireAuthenticatedUserId(ctx);
+		let verifierDoc;
+		try {
+			verifierDoc = await queryVerifierById(ctx, verifier);
+		} catch {
+			throw convexError("TOTP_INVALID_VERIFIER", "Invalid or expired TOTP verifier.");
+		}
+		if (verifierDoc === null) throw convexError("TOTP_INVALID_VERIFIER", "Invalid or expired TOTP verifier.");
+		let verifierData;
+		try {
+			verifierData = JSON.parse(verifierDoc.signature);
+		} catch {
+			throw convexError("TOTP_INVALID_VERIFIER", "Invalid or expired TOTP verifier.");
+		}
+		if (verifierData.purpose !== "totp.setup" || verifierData.userId !== userId || verifierData.totpId !== totpId) throw convexError("TOTP_INVALID_VERIFIER", "Invalid or expired TOTP verifier.");
+		let doc;
+		try {
+			doc = await queryTotpById(ctx, totpId);
+		} catch {
+			throw convexError("TOTP_NOT_FOUND", "TOTP enrollment not found.");
+		}
+		if (doc === null) throw convexError("TOTP_NOT_FOUND", "TOTP enrollment not found.");
+		if (doc.userId !== userId) throw convexError("TOTP_NOT_FOUND", "TOTP enrollment not found.");
+		if (doc.verified) throw convexError("TOTP_ALREADY_VERIFIED", "TOTP enrollment is already verified.");
+		if (!verifyTOTPWithGracePeriod(new Uint8Array(doc.secret), provider.options.period, provider.options.digits, code, 30)) throw convexError("TOTP_INVALID_CODE", "Invalid TOTP code.");
+		let signInResult;
+		try {
+			await mutateTotpMarkVerified(ctx, totpId, Date.now());
+			await mutateVerifierDelete(ctx, verifier);
+			signInResult = await callSignIn(ctx, {
+				userId,
+				generateTokens: true
+			});
+		} catch (error) {
+			throw asConvexError(error, "INTERNAL_ERROR", String(error));
+		}
+		await ctx.auth.config.callbacks?.after?.(ctx, {
+			kind: "totpEnrolled",
+			userId,
+			totpId
+		});
+		return {
+			kind: "signedIn",
+			session: signInResult
+		};
+	}
+	/**
+	* `verify` without `totpId`: completes a 2FA challenge during sign-in.
+	* Looks up the user's verified TOTP factor, validates the code, signs in.
+	*/
+	async function verifyChallenge(code, verifier) {
+		let doc;
+		try {
+			doc = await queryVerifierById(ctx, verifier);
+		} catch {
+			throw convexError("TOTP_INVALID_VERIFIER", "Invalid or expired TOTP verifier.");
+		}
+		if (doc === null) throw convexError("TOTP_INVALID_VERIFIER", "Invalid or expired TOTP verifier.");
+		const userId = JSON.parse(doc.signature).userId;
+		let totp;
+		try {
+			totp = await queryTotpVerifiedByUserId(ctx, userId);
+		} catch {
+			throw convexError("TOTP_NO_ENROLLMENT", "No verified TOTP enrollment found.");
 		}
-	}[dispatch.flow];
+		if (totp === null) throw convexError("TOTP_NO_ENROLLMENT", "No verified TOTP enrollment found.");
+		if (!verifyTOTPWithGracePeriod(new Uint8Array(totp.secret), totp.period, totp.digits, code, 30)) throw convexError("TOTP_INVALID_CODE", "Invalid TOTP code.");
+		let signInResult;
+		try {
+			await mutateTotpUpdateLastUsed(ctx, totp._id, Date.now());
+			await mutateVerifierDelete(ctx, verifier);
+			signInResult = await callSignIn(ctx, {
+				userId,
+				generateTokens: true
+			});
+		} catch (error) {
+			throw asConvexError(error, "INTERNAL_ERROR", String(error));
+		}
+		return {
+			kind: "signedIn",
+			session: signInResult
+		};
+	}
+	const handler = flowHandlers[dispatch.flow];
 	if (!handler) throw convexError("TOTP_MISSING_FLOW", `Unknown TOTP flow: ${dispatch.flow}`);
 	return handler();
 };