@samebase/identity-broker 0.0.0-stage → 0.1.0

package/dist/client/html.d.ts

@@ -0,0 +1,30 @@
+/** The few pages the broker renders itself. Plain HTML, one stylesheet, no script. */
+export declare function page(title: string, body: string): Response;
+/**
+ * The connector choice. A third-party app gets the consent wording and a deny link; a first-party
+ * app only sees the buttons.
+ */
+export declare function chooserPage(args: {
+    appName: string;
+    firstParty: boolean;
+    connectors: Array<{
+        name: string;
+        label: string;
+        href: string;
+    }>;
+    denyHref: string;
+}): Response;
+export declare function emailAddressPage(args: {
+    appName: string;
+    action: string;
+    requestId: string;
+    error?: string;
+}): Response;
+export declare function emailCodePage(args: {
+    appName: string;
+    action: string;
+    requestId: string;
+    email: string;
+    error?: string;
+}): Response;
+export declare function errorPage(title: string, message: string, status?: number): Response;

package/dist/client/html.js

@@ -0,0 +1,84 @@
+/** The few pages the broker renders itself. Plain HTML, one stylesheet, no script. */
+function escape(value) {
+    return value
+        .replace(/&/g, "&")
+        .replace(/</g, "&lt;")
+        .replace(/>/g, "&gt;")
+        .replace(/"/g, "&quot;");
+}
+const STYLE = `
+  body { margin: 0; font: 16px/1.5 system-ui, sans-serif; color: #111; background: #fff; }
+  main { max-width: 24rem; margin: 10vh auto; padding: 0 1rem; }
+  h1 { font-size: 1.25rem; font-weight: 600; }
+  p { margin: 0.5rem 0; }
+  .list { display: grid; gap: 0.5rem; margin: 1.5rem 0; }
+  a.button, button { display: block; width: 100%; box-sizing: border-box; padding: 0.75rem 1rem;
+    font: inherit; color: #111; background: #fff; border: 1px solid #111; text-align: center;
+    text-decoration: none; cursor: pointer; }
+  input { display: block; width: 100%; box-sizing: border-box; padding: 0.75rem 1rem; font: inherit;
+    border: 1px solid #111; margin: 1rem 0; }
+  .error { color: #b00020; }
+  .muted { color: #555; }
+`;
+export function page(title, body) {
+    const html = `<!doctype html>
+<html lang="en">
+<head>
+<meta charset="utf-8">
+<meta name="viewport" content="width=device-width, initial-scale=1">
+<meta name="robots" content="noindex">
+<title>${escape(title)}</title>
+<style>${STYLE}</style>
+</head>
+<body><main>${body}</main></body>
+</html>`;
+    return new Response(html, {
+        status: 200,
+        headers: {
+            "Content-Type": "text/html; charset=utf-8",
+            "Cache-Control": "no-store",
+            "Referrer-Policy": "no-referrer",
+        },
+    });
+}
+/**
+ * The connector choice. A third-party app gets the consent wording and a deny link; a first-party
+ * app only sees the buttons.
+ */
+export function chooserPage(args) {
+    const buttons = args.connectors
+        .map((connector) => `<a class="button" href="${escape(connector.href)}">Continue with ${escape(connector.label)}</a>`)
+        .join("\n");
+    const consent = args.firstParty
+        ? ""
+        : `<p class="muted">${escape(args.appName)} will receive your identity from the provider you choose: a stable id, your name, and your verified email address.</p>`;
+    const deny = args.firstParty
+        ? ""
+        : `<p><a href="${escape(args.denyHref)}">Cancel and return to ${escape(args.appName)}</a></p>`;
+    return page(`Sign in to ${args.appName}`, `<h1>Sign in to ${escape(args.appName)}</h1>${consent}<div class="list">${buttons}</div>${deny}`);
+}
+export function emailAddressPage(args) {
+    const error = args.error === undefined ? "" : `<p class="error">${escape(args.error)}</p>`;
+    return page(`Sign in to ${args.appName}`, `<h1>Sign in to ${escape(args.appName)}</h1><p>Enter your email address. A six-digit code is sent to it.</p>${error}
+<form method="post" action="${escape(args.action)}">
+<input type="hidden" name="request" value="${escape(args.requestId)}">
+<input type="hidden" name="step" value="send">
+<input type="email" name="email" required autocomplete="email" autofocus placeholder="you@example.com">
+<button type="submit">Send code</button>
+</form>`);
+}
+export function emailCodePage(args) {
+    const error = args.error === undefined ? "" : `<p class="error">${escape(args.error)}</p>`;
+    return page(`Sign in to ${args.appName}`, `<h1>Check your email</h1><p>Enter the six-digit code sent to ${escape(args.email)}.</p>${error}
+<form method="post" action="${escape(args.action)}">
+<input type="hidden" name="request" value="${escape(args.requestId)}">
+<input type="hidden" name="step" value="verify">
+<input type="text" name="code" inputmode="numeric" pattern="[0-9]{6}" required autocomplete="one-time-code" autofocus placeholder="000000">
+<button type="submit">Continue</button>
+</form>`);
+}
+export function errorPage(title, message, status = 400) {
+    const response = page(title, `<h1>${escape(title)}</h1><p>${escape(message)}</p>`);
+    return new Response(response.body, { status, headers: response.headers });
+}
+//# sourceMappingURL=html.js.map

package/dist/client/html.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"html.js","sourceRoot":"","sources":["../../src/client/html.ts"],"names":[],"mappings":"AAAA,sFAAsF;AAEtF,SAAS,MAAM,CAAC,KAAa;IAC3B,OAAO,KAAK;SACT,OAAO,CAAC,IAAI,EAAE,OAAO,CAAC;SACtB,OAAO,CAAC,IAAI,EAAE,MAAM,CAAC;SACrB,OAAO,CAAC,IAAI,EAAE,MAAM,CAAC;SACrB,OAAO,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC;AAC7B,CAAC;AAED,MAAM,KAAK,GAAG;;;;;;;;;;;;;CAab,CAAC;AAEF,MAAM,UAAU,IAAI,CAAC,KAAa,EAAE,IAAY;IAC9C,MAAM,IAAI,GAAG;;;;;;SAMN,MAAM,CAAC,KAAK,CAAC;SACb,KAAK;;cAEA,IAAI;QACV,CAAC;IACP,OAAO,IAAI,QAAQ,CAAC,IAAI,EAAE;QACxB,MAAM,EAAE,GAAG;QACX,OAAO,EAAE;YACP,cAAc,EAAE,0BAA0B;YAC1C,eAAe,EAAE,UAAU;YAC3B,iBAAiB,EAAE,aAAa;SACjC;KACF,CAAC,CAAC;AACL,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,WAAW,CAAC,IAK3B;IACC,MAAM,OAAO,GAAG,IAAI,CAAC,UAAU;SAC5B,GAAG,CACF,CAAC,SAAS,EAAE,EAAE,CACZ,2BAA2B,MAAM,CAAC,SAAS,CAAC,IAAI,CAAC,mBAAmB,MAAM,CAAC,SAAS,CAAC,KAAK,CAAC,MAAM,CACpG;SACA,IAAI,CAAC,IAAI,CAAC,CAAC;IACd,MAAM,OAAO,GAAG,IAAI,CAAC,UAAU;QAC7B,CAAC,CAAC,EAAE;QACJ,CAAC,CAAC,oBAAoB,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,wHAAwH,CAAC;IACrK,MAAM,IAAI,GAAG,IAAI,CAAC,UAAU;QAC1B,CAAC,CAAC,EAAE;QACJ,CAAC,CAAC,eAAe,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,0BAA0B,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,UAAU,CAAC;IACjG,OAAO,IAAI,CACT,cAAc,IAAI,CAAC,OAAO,EAAE,EAC5B,kBAAkB,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,QAAQ,OAAO,qBAAqB,OAAO,SAAS,IAAI,EAAE,CACjG,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,gBAAgB,CAAC,IAKhC;IACC,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,oBAAoB,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC;IAC3F,OAAO,IAAI,CACT,cAAc,IAAI,CAAC,OAAO,EAAE,EAC5B,kBAAkB,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,wEAAwE,KAAK;8BACzF,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC;6CACJ,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC;;;;QAI3D,CACL,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,aAAa,CAAC,IAM7B;IACC,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,oBAAoB,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC;IAC3F,OAAO,IAAI,CACT,cAAc,IAAI,CAAC,OAAO,EAAE,EAC5B,gEAAgE,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,QAAQ,KAAK;8BACrE,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC;6CACJ,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC;;;;QAI3D,CACL,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,SAAS,CAAC,KAAa,EAAE,OAAe,EAAE,MAAM,GAAG,GAAG;IACpE,MAAM,QAAQ,GAAG,IAAI,CAAC,KAAK,EAAE,OAAO,MAAM,CAAC,KAAK,CAAC,WAAW,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;IACnF,OAAO,IAAI,QAAQ,CAAC,QAAQ,CAAC,IAAI,EAAE,EAAE,MAAM,EAAE,OAAO,EAAE,QAAQ,CAAC,OAAO,EAAE,CAAC,CAAC;AAC5E,CAAC"}

package/dist/client/index.d.ts

@@ -0,0 +1,78 @@
+import { type HttpRouter } from "convex/server";
+import type { ComponentApi } from "../component/_generated/component.js";
+import type { Connector } from "./connectors/types.js";
+export type { Connector, EmailConnector, OauthConnector, OidcConnector, SendEmailCode, UpstreamIdentity, } from "./connectors/types.js";
+export { github } from "./connectors/github.js";
+export { google } from "./connectors/google.js";
+export { email } from "./connectors/email.js";
+export { createKeySet, rotateKeySet, type KeySet } from "./keys.js";
+export type IdentityBrokerConfig = {
+    /** `components.identityBroker` of the host app. */
+    component: ComponentApi;
+    /** The issuer URL, host-only or with a path, e.g. `https://auth.example.com`. */
+    issuer: string;
+    /** The content of `IDENTITY_BROKER_KEYS`, read in the request. */
+    keys: () => string | undefined;
+    connectors: Connector[];
+};
+/** Lifecycle values the host's cron passes to `cleanup`. */
+export declare const PREVIEW_CLIENT_MAX_AGE_MS: number;
+export declare const SIGN_IN_RETENTION_MS: number;
+export declare function defineIdentityBroker(config: IdentityBrokerConfig): {
+    /** Mounts every endpoint on the host's router. */
+    addHttpRoutes(http: HttpRouter): void;
+    /**
+     * Administration as internal functions of the host, for `npx convex run`: export them from a
+     * host module such as `convex/identityBroker.ts`.
+     */
+    admin(): {
+        createApp: import("convex/server").RegisteredMutation<"internal", {
+            allowedCallbackHosts: string[];
+            firstParty: boolean;
+            name: string;
+        }, Promise<{
+            appId: string;
+        }>>;
+        mintRegistrationToken: import("convex/server").RegisteredMutation<"internal", {
+            appId: string;
+            expiresInDays?: number;
+        }, Promise<{
+            token: string;
+            expiresAt: number;
+        }>>;
+        setAllowedCallbackHosts: import("convex/server").RegisteredMutation<"internal", {
+            allowedCallbackHosts: string[];
+            appId: string;
+        }, Promise<null>>;
+        deleteApp: import("convex/server").RegisteredMutation<"internal", {
+            appId: string;
+        }, Promise<null>>;
+        listApps: import("convex/server").RegisteredQuery<"internal", {}, Promise<{
+            allowedCallbackHosts: Array<string>;
+            appId: string;
+            createdAt: number;
+            firstParty: boolean;
+            name: string;
+        }[]>>;
+        listClients: import("convex/server").RegisteredQuery<"internal", {
+            appId: string;
+        }, Promise<{
+            appId: string;
+            clientId: string;
+            clientName: string;
+            createdAt: number;
+            deploymentType: "production" | "development" | "preview";
+            lastSignInAt?: number;
+            redirectUri: string;
+            secretHash: string;
+            softwareVersion: string;
+            tokenEndpointAuthMethod: "client_secret_post" | "client_secret_basic";
+        }[]>>;
+        cleanup: import("convex/server").RegisteredMutation<"internal", {}, Promise<{
+            authRequests: number;
+            authorizationCodes: number;
+            previewClients: number;
+            signIns: number;
+        }>>;
+    };
+};