@samebase/identity-broker 0.0.0-stage → 0.1.0

package/dist/component/apps.d.ts

@@ -0,0 +1,36 @@
+/** Registers an app. Its clients come later, one per deployment, through registration tokens. */
+export declare const create: import("convex/server").RegisteredMutation<"public", {
+    allowedCallbackHosts: string[];
+    appId: string;
+    createdAt: number;
+    firstParty: boolean;
+    name: string;
+}, Promise<null>>;
+export declare const get: import("convex/server").RegisteredQuery<"public", {
+    appId: string;
+}, Promise<{
+    appId: string;
+    name: string;
+    firstParty: boolean;
+    allowedCallbackHosts: string[];
+    createdAt: number;
+} | null>>;
+export declare const list: import("convex/server").RegisteredQuery<"public", {}, Promise<{
+    appId: string;
+    name: string;
+    firstParty: boolean;
+    allowedCallbackHosts: string[];
+    createdAt: number;
+}[]>>;
+/** Replaces the hosts a client callback may use, for example when an app gets a custom domain. */
+export declare const setAllowedCallbackHosts: import("convex/server").RegisteredMutation<"public", {
+    allowedCallbackHosts: string[];
+    appId: string;
+}, Promise<null>>;
+/**
+ * Deletes an app with its registration tokens and clients. This is the emergency revocation:
+ * every deployment of the app stops being able to start or finish a sign-in at once.
+ */
+export declare const remove: import("convex/server").RegisteredMutation<"public", {
+    appId: string;
+}, Promise<null>>;

package/dist/component/apps.js

@@ -0,0 +1,124 @@
+import { v } from "convex/values";
+import { mutation, query } from "./_generated/server";
+const { array, boolean, number, object, string } = v;
+const vApp = object({
+    appId: string(),
+    name: string(),
+    firstParty: boolean(),
+    allowedCallbackHosts: array(string()),
+    createdAt: number(),
+});
+/** Registers an app. Its clients come later, one per deployment, through registration tokens. */
+export const create = mutation({
+    args: {
+        appId: string(),
+        name: string(),
+        firstParty: boolean(),
+        allowedCallbackHosts: array(string()),
+        createdAt: number(),
+    },
+    returns: v.null(),
+    handler: async (ctx, args) => {
+        const existing = await ctx.db
+            .query("apps")
+            .withIndex("by_app_id", (q) => q.eq("appId", args.appId))
+            .unique();
+        if (existing !== null) {
+            throw new Error(`An app with id "${args.appId}" already exists`);
+        }
+        await ctx.db.insert("apps", {
+            appId: args.appId,
+            name: args.name,
+            firstParty: args.firstParty,
+            allowedCallbackHosts: args.allowedCallbackHosts,
+            createdAt: args.createdAt,
+        });
+        return null;
+    },
+});
+export const get = query({
+    args: { appId: string() },
+    returns: v.union(vApp, v.null()),
+    handler: async (ctx, args) => {
+        const app = await ctx.db
+            .query("apps")
+            .withIndex("by_app_id", (q) => q.eq("appId", args.appId))
+            .unique();
+        if (app === null) {
+            return null;
+        }
+        return {
+            appId: app.appId,
+            name: app.name,
+            firstParty: app.firstParty,
+            allowedCallbackHosts: app.allowedCallbackHosts,
+            createdAt: app.createdAt,
+        };
+    },
+});
+export const list = query({
+    args: {},
+    returns: array(vApp),
+    handler: async (ctx) => {
+        const apps = await ctx.db.query("apps").collect();
+        return apps
+            .map((app) => ({
+            appId: app.appId,
+            name: app.name,
+            firstParty: app.firstParty,
+            allowedCallbackHosts: app.allowedCallbackHosts,
+            createdAt: app.createdAt,
+        }))
+            .sort((a, b) => a.createdAt - b.createdAt || a.appId.localeCompare(b.appId));
+    },
+});
+/** Replaces the hosts a client callback may use, for example when an app gets a custom domain. */
+export const setAllowedCallbackHosts = mutation({
+    args: { appId: string(), allowedCallbackHosts: array(string()) },
+    returns: v.null(),
+    handler: async (ctx, args) => {
+        const app = await ctx.db
+            .query("apps")
+            .withIndex("by_app_id", (q) => q.eq("appId", args.appId))
+            .unique();
+        if (app === null) {
+            throw new Error(`Unknown app "${args.appId}"`);
+        }
+        await ctx.db.patch("apps", app._id, { allowedCallbackHosts: args.allowedCallbackHosts });
+        return null;
+    },
+});
+/**
+ * Deletes an app with its registration tokens and clients. This is the emergency revocation:
+ * every deployment of the app stops being able to start or finish a sign-in at once.
+ */
+export const remove = mutation({
+    args: { appId: string() },
+    returns: v.null(),
+    handler: async (ctx, args) => {
+        const app = await ctx.db
+            .query("apps")
+            .withIndex("by_app_id", (q) => q.eq("appId", args.appId))
+            .unique();
+        if (app === null) {
+            return null;
+        }
+        const tokens = await ctx.db
+            .query("registrationTokens")
+            .withIndex("by_app_id", (q) => q.eq("appId", args.appId))
+            .collect();
+        for (const token of tokens) {
+            await ctx.db.delete("registrationTokens", token._id);
+        }
+        const clients = await ctx.db
+            .query("clients")
+            .withIndex("by_app_id", (q) => q.eq("appId", args.appId))
+            .collect();
+        for (const client of clients) {
+            await ctx.db.delete("clients", client._id);
+        }
+        await ctx.db.delete("apps", app._id);
+        return null;
+    },
+});
+//# sourceMappingURL=apps.js.map

package/dist/component/apps.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"apps.js","sourceRoot":"","sources":["../../src/component/apps.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,eAAe,CAAC;AAClC,OAAO,EAAE,QAAQ,EAAE,KAAK,EAAE,MAAM,qBAAqB,CAAC;AAEtD,MAAM,EAAE,KAAK,EAAE,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,GAAG,CAAC,CAAC;AAErD,MAAM,IAAI,GAAG,MAAM,CAAC;IAClB,KAAK,EAAE,MAAM,EAAE;IACf,IAAI,EAAE,MAAM,EAAE;IACd,UAAU,EAAE,OAAO,EAAE;IACrB,oBAAoB,EAAE,KAAK,CAAC,MAAM,EAAE,CAAC;IACrC,SAAS,EAAE,MAAM,EAAE;CACpB,CAAC,CAAC;AAEH,iGAAiG;AACjG,MAAM,CAAC,MAAM,MAAM,GAAG,QAAQ,CAAC;IAC7B,IAAI,EAAE;QACJ,KAAK,EAAE,MAAM,EAAE;QACf,IAAI,EAAE,MAAM,EAAE;QACd,UAAU,EAAE,OAAO,EAAE;QACrB,oBAAoB,EAAE,KAAK,CAAC,MAAM,EAAE,CAAC;QACrC,SAAS,EAAE,MAAM,EAAE;KACpB;IACD,OAAO,EAAE,CAAC,CAAC,IAAI,EAAE;IACjB,OAAO,EAAE,KAAK,EAAE,GAAG,EAAE,IAAI,EAAE,EAAE;QAC3B,MAAM,QAAQ,GAAG,MAAM,GAAG,CAAC,EAAE;aAC1B,KAAK,CAAC,MAAM,CAAC;aACb,SAAS,CAAC,WAAW,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,OAAO,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC;aACxD,MAAM,EAAE,CAAC;QACZ,IAAI,QAAQ,KAAK,IAAI,EAAE,CAAC;YACtB,MAAM,IAAI,KAAK,CAAC,mBAAmB,IAAI,CAAC,KAAK,kBAAkB,CAAC,CAAC;QACnE,CAAC;QACD,MAAM,GAAG,CAAC,EAAE,CAAC,MAAM,CAAC,MAAM,EAAE;YAC1B,KAAK,EAAE,IAAI,CAAC,KAAK;YACjB,IAAI,EAAE,IAAI,CAAC,IAAI;YACf,UAAU,EAAE,IAAI,CAAC,UAAU;YAC3B,oBAAoB,EAAE,IAAI,CAAC,oBAAoB;YAC/C,SAAS,EAAE,IAAI,CAAC,SAAS;SAC1B,CAAC,CAAC;QACH,OAAO,IAAI,CAAC;IACd,CAAC;CACF,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,GAAG,GAAG,KAAK,CAAC;IACvB,IAAI,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,EAAE;IACzB,OAAO,EAAE,CAAC,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;IAChC,OAAO,EAAE,KAAK,EAAE,GAAG,EAAE,IAAI,EAAE,EAAE;QAC3B,MAAM,GAAG,GAAG,MAAM,GAAG,CAAC,EAAE;aACrB,KAAK,CAAC,MAAM,CAAC;aACb,SAAS,CAAC,WAAW,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,OAAO,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC;aACxD,MAAM,EAAE,CAAC;QACZ,IAAI,GAAG,KAAK,IAAI,EAAE,CAAC;YACjB,OAAO,IAAI,CAAC;QACd,CAAC;QACD,OAAO;YACL,KAAK,EAAE,GAAG,CAAC,KAAK;YAChB,IAAI,EAAE,GAAG,CAAC,IAAI;YACd,UAAU,EAAE,GAAG,CAAC,UAAU;YAC1B,oBAAoB,EAAE,GAAG,CAAC,oBAAoB;YAC9C,SAAS,EAAE,GAAG,CAAC,SAAS;SACzB,CAAC;IACJ,CAAC;CACF,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,IAAI,GAAG,KAAK,CAAC;IACxB,IAAI,EAAE,EAAE;IACR,OAAO,EAAE,KAAK,CAAC,IAAI,CAAC;IACpB,OAAO,EAAE,KAAK,EAAE,GAAG,EAAE,EAAE;QACrB,MAAM,IAAI,GAAG,MAAM,GAAG,CAAC,EAAE,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,OAAO,EAAE,CAAC;QAClD,OAAO,IAAI;aACR,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC;YACb,KAAK,EAAE,GAAG,CAAC,KAAK;YAChB,IAAI,EAAE,GAAG,CAAC,IAAI;YACd,UAAU,EAAE,GAAG,CAAC,UAAU;YAC1B,oBAAoB,EAAE,GAAG,CAAC,oBAAoB;YAC9C,SAAS,EAAE,GAAG,CAAC,SAAS;SACzB,CAAC,CAAC;aACF,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,SAAS,GAAG,CAAC,CAAC,SAAS,IAAI,CAAC,CAAC,KAAK,CAAC,aAAa,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC;IACjF,CAAC;CACF,CAAC,CAAC;AAEH,kGAAkG;AAClG,MAAM,CAAC,MAAM,uBAAuB,GAAG,QAAQ,CAAC;IAC9C,IAAI,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,EAAE,oBAAoB,EAAE,KAAK,CAAC,MAAM,EAAE,CAAC,EAAE;IAChE,OAAO,EAAE,CAAC,CAAC,IAAI,EAAE;IACjB,OAAO,EAAE,KAAK,EAAE,GAAG,EAAE,IAAI,EAAE,EAAE;QAC3B,MAAM,GAAG,GAAG,MAAM,GAAG,CAAC,EAAE;aACrB,KAAK,CAAC,MAAM,CAAC;aACb,SAAS,CAAC,WAAW,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,OAAO,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC;aACxD,MAAM,EAAE,CAAC;QACZ,IAAI,GAAG,KAAK,IAAI,EAAE,CAAC;YACjB,MAAM,IAAI,KAAK,CAAC,gBAAgB,IAAI,CAAC,KAAK,GAAG,CAAC,CAAC;QACjD,CAAC;QACD,MAAM,GAAG,CAAC,EAAE,CAAC,KAAK,CAAC,MAAM,EAAE,GAAG,CAAC,GAAG,EAAE,EAAE,oBAAoB,EAAE,IAAI,CAAC,oBAAoB,EAAE,CAAC,CAAC;QACzF,OAAO,IAAI,CAAC;IACd,CAAC;CACF,CAAC,CAAC;AAEH;;;GAGG;AACH,MAAM,CAAC,MAAM,MAAM,GAAG,QAAQ,CAAC;IAC7B,IAAI,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,EAAE;IACzB,OAAO,EAAE,CAAC,CAAC,IAAI,EAAE;IACjB,OAAO,EAAE,KAAK,EAAE,GAAG,EAAE,IAAI,EAAE,EAAE;QAC3B,MAAM,GAAG,GAAG,MAAM,GAAG,CAAC,EAAE;aACrB,KAAK,CAAC,MAAM,CAAC;aACb,SAAS,CAAC,WAAW,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,OAAO,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC;aACxD,MAAM,EAAE,CAAC;QACZ,IAAI,GAAG,KAAK,IAAI,EAAE,CAAC;YACjB,OAAO,IAAI,CAAC;QACd,CAAC;QACD,MAAM,MAAM,GAAG,MAAM,GAAG,CAAC,EAAE;aACxB,KAAK,CAAC,oBAAoB,CAAC;aAC3B,SAAS,CAAC,WAAW,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,OAAO,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC;aACxD,OAAO,EAAE,CAAC;QACb,KAAK,MAAM,KAAK,IAAI,MAAM,EAAE,CAAC;YAC3B,MAAM,GAAG,CAAC,EAAE,CAAC,MAAM,CAAC,oBAAoB,EAAE,KAAK,CAAC,GAAG,CAAC,CAAC;QACvD,CAAC;QACD,MAAM,OAAO,GAAG,MAAM,GAAG,CAAC,EAAE;aACzB,KAAK,CAAC,SAAS,CAAC;aAChB,SAAS,CAAC,WAAW,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,OAAO,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC;aACxD,OAAO,EAAE,CAAC;QACb,KAAK,MAAM,MAAM,IAAI,OAAO,EAAE,CAAC;YAC7B,MAAM,GAAG,CAAC,EAAE,CAAC,MAAM,CAAC,SAAS,EAAE,MAAM,CAAC,GAAG,CAAC,CAAC;QAC7C,CAAC;QACD,MAAM,GAAG,CAAC,EAAE,CAAC,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,GAAG,CAAC,CAAC;QACrC,OAAO,IAAI,CAAC;IACd,CAAC;CACF,CAAC,CAAC"}

package/dist/component/authRequests.d.ts

@@ -0,0 +1,254 @@
+/** Stores a validated /authorize request. The caller has already checked the client and redirect URI. */
+export declare const create: import("convex/server").RegisteredMutation<"public", {
+    appId: string;
+    clientId: string;
+    codeChallenge: string;
+    createdAt: number;
+    expiresAt: number;
+    freshLogin: boolean;
+    nonce?: string;
+    redirectUri: string;
+    requestId: string;
+    scope: string;
+    state?: string;
+}, Promise<null>>;
+export declare const get: import("convex/server").RegisteredQuery<"public", {
+    requestId: string;
+}, Promise<{
+    appId: string;
+    clientId: string;
+    codeChallenge: string;
+    createdAt: number;
+    expiresAt: number;
+    freshLogin: boolean;
+    nonce?: string;
+    redirectUri: string;
+    requestId: string;
+    scope: string;
+    state?: string;
+    status: "pending";
+} | {
+    appId: string;
+    clientId: string;
+    codeChallenge: string;
+    connector: string;
+    createdAt: number;
+    expiresAt: number;
+    freshLogin: boolean;
+    nonce?: string;
+    redirectUri: string;
+    requestId: string;
+    scope: string;
+    state?: string;
+    status: "upstream";
+    upstreamCodeVerifier: string;
+    upstreamNonce?: string;
+    upstreamStateHash: string;
+} | {
+    appId: string;
+    clientId: string;
+    codeChallenge: string;
+    connector: string;
+    createdAt: number;
+    expiresAt: number;
+    freshLogin: boolean;
+    nonce?: string;
+    redirectUri: string;
+    requestId: string;
+    scope: string;
+    state?: string;
+    status: "claimed";
+} | {
+    appId: string;
+    clientId: string;
+    codeChallenge: string;
+    connector: string;
+    createdAt: number;
+    email: string;
+    emailAttempts: number;
+    emailCodeExpiresAt: number;
+    emailCodeHash: string;
+    expiresAt: number;
+    freshLogin: boolean;
+    nonce?: string;
+    redirectUri: string;
+    requestId: string;
+    scope: string;
+    state?: string;
+    status: "emailSent";
+} | {
+    appId: string;
+    authTime: number;
+    clientId: string;
+    codeChallenge: string;
+    createdAt: number;
+    expiresAt: number;
+    freshLogin: boolean;
+    identity: {
+        connector: string;
+        email?: string;
+        emailVerified?: boolean;
+        name?: string;
+        picture?: string;
+        upstreamId: string;
+    };
+    nonce?: string;
+    redirectUri: string;
+    requestId: string;
+    scope: string;
+    state?: string;
+    status: "completed";
+} | null>>;
+/** The user chose an OAuth or OIDC connector; the request now waits for that connector's callback. */
+export declare const startUpstream: import("convex/server").RegisteredMutation<"public", {
+    connector: string;
+    now: number;
+    requestId: string;
+    upstreamCodeVerifier: string;
+    upstreamNonce?: string;
+    upstreamStateHash: string;
+}, Promise<{
+    ok: true;
+    redirectUri: string;
+    state?: string;
+} | {
+    error: "expired" | "wrong_status";
+    ok: false;
+    redirectUri: string;
+    state?: string;
+} | {
+    error: "not_found";
+    ok: false;
+}>>;
+/**
+ * The connector callback arrived with its state. Claiming moves the request to `claimed` in the
+ * same mutation that finds it, so a replayed or raced callback finds nothing to claim.
+ */
+export declare const claimUpstream: import("convex/server").RegisteredMutation<"public", {
+    now: number;
+    upstreamStateHash: string;
+}, Promise<{
+    connector: string;
+    freshLogin: boolean;
+    redirectUri: string;
+    requestId: string;
+    state?: string;
+    status: "claimed";
+    upstreamCodeVerifier: string;
+    upstreamNonce?: string;
+} | {
+    redirectUri: string;
+    state?: string;
+    status: "expired";
+} | {
+    status: "missing";
+}>>;
+/** The user chose the email connector and typed an address; a code was sent to it. */
+export declare const startEmail: import("convex/server").RegisteredMutation<"public", {
+    connector: string;
+    email: string;
+    emailCodeExpiresAt: number;
+    emailCodeHash: string;
+    now: number;
+    requestId: string;
+}, Promise<{
+    ok: true;
+    redirectUri: string;
+    state?: string;
+} | {
+    error: "expired" | "wrong_status";
+    ok: false;
+    redirectUri: string;
+    state?: string;
+} | {
+    error: "not_found";
+    ok: false;
+}>>;
+/**
+ * Checks a typed email code. A match completes the request with the canonical address as the
+ * upstream identity and issues the authorization code; a miss counts an attempt, and the request
+ * locks at `maxAttempts`.
+ */
+export declare const verifyEmailCode: import("convex/server").RegisteredMutation<"public", {
+    codeExpiresAt: number;
+    codeHash: string;
+    emailCodeHash: string;
+    maxAttempts: number;
+    now: number;
+    requestId: string;
+}, Promise<{
+    ok: true;
+    redirectUri: string;
+    state?: string;
+} | {
+    error: "code_expired" | "expired" | "locked" | "wrong_code" | "wrong_status";
+    ok: false;
+    redirectUri: string;
+    state?: string;
+} | {
+    error: "not_found";
+    ok: false;
+}>>;
+/** The connector attested the identity after a claim; the authorization code can be handed out. */
+export declare const complete: import("convex/server").RegisteredMutation<"public", {
+    authTime: number;
+    codeExpiresAt: number;
+    codeHash: string;
+    identity: {
+        connector: string;
+        email?: string;
+        emailVerified?: boolean;
+        name?: string;
+        picture?: string;
+        upstreamId: string;
+    };
+    now: number;
+    requestId: string;
+}, Promise<{
+    ok: true;
+    redirectUri: string;
+    state?: string;
+} | {
+    error: "expired" | "wrong_status";
+    ok: false;
+    redirectUri: string;
+    state?: string;
+} | {
+    error: "not_found";
+    ok: false;
+}>>;
+/** Deletes a request the user abandoned at the hub, such as a declined consent. */
+export declare const abandon: import("convex/server").RegisteredMutation<"public", {
+    requestId: string;
+}, Promise<{
+    redirectUri: string;
+} | null>>;
+/**
+ * Redeems an authorization code: single use, bound to the client, the redirect URI and the PKCE
+ * challenge of its request (OAuth 2.1 section 4.1.3). On success the code and the request are gone.
+ */
+export declare const exchangeCode: import("convex/server").RegisteredMutation<"public", {
+    clientId: string;
+    codeHash: string;
+    codeVerifier: string;
+    now: number;
+    redirectUri?: string;
+}, Promise<{
+    appId: string;
+    authTime: number;
+    clientId: string;
+    identity: {
+        connector: string;
+        email?: string;
+        emailVerified?: boolean;
+        name?: string;
+        picture?: string;
+        upstreamId: string;
+    };
+    nonce?: string;
+    ok: true;
+    scope: string;
+} | {
+    description: string;
+    ok: false;
+}>>;