@samebase/identity-broker 0.0.0-stage → 0.1.0

package/dist/component/lifecycle.js

@@ -0,0 +1,59 @@
+import { v } from "convex/values";
+import { mutation } from "./_generated/server";
+const { number, object } = v;
+/** How many documents one run deletes per table, so a run stays well inside one transaction. */
+const BATCH = 200;
+/**
+ * Deletes what has run out: expired requests and codes, preview clients nobody used for
+ * `previewClientMaxAgeMs`, and audit rows older than `signInRetentionMs`. The host calls this from a
+ * cron; production and development clients are never touched.
+ */
+export const cleanup = mutation({
+    args: { now: number(), previewClientMaxAgeMs: number(), signInRetentionMs: number() },
+    returns: object({
+        authRequests: number(),
+        authorizationCodes: number(),
+        previewClients: number(),
+        signIns: number(),
+    }),
+    handler: async (ctx, args) => {
+        const requests = await ctx.db
+            .query("authRequests")
+            .withIndex("by_expires_at", (q) => q.lt("expiresAt", args.now))
+            .take(BATCH);
+        for (const request of requests) {
+            await ctx.db.delete("authRequests", request._id);
+        }
+        const codes = await ctx.db
+            .query("authorizationCodes")
+            .withIndex("by_expires_at", (q) => q.lt("expiresAt", args.now))
+            .take(BATCH);
+        for (const code of codes) {
+            await ctx.db.delete("authorizationCodes", code._id);
+        }
+        const previewCutoff = args.now - args.previewClientMaxAgeMs;
+        const previewClients = (await ctx.db
+            .query("clients")
+            .withIndex("by_deployment_type", (q) => q.eq("deploymentType", "preview"))
+            .collect())
+            .filter((client) => (client.lastSignInAt ?? client.createdAt) < previewCutoff)
+            .slice(0, BATCH);
+        for (const client of previewClients) {
+            await ctx.db.delete("clients", client._id);
+        }
+        const signIns = await ctx.db
+            .query("signIns")
+            .withIndex("by_at", (q) => q.lt("at", args.now - args.signInRetentionMs))
+            .take(BATCH);
+        for (const signIn of signIns) {
+            await ctx.db.delete("signIns", signIn._id);
+        }
+        return {
+            authRequests: requests.length,
+            authorizationCodes: codes.length,
+            previewClients: previewClients.length,
+            signIns: signIns.length,
+        };
+    },
+});
+//# sourceMappingURL=lifecycle.js.map

package/dist/component/lifecycle.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"lifecycle.js","sourceRoot":"","sources":["../../src/component/lifecycle.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,eAAe,CAAC;AAClC,OAAO,EAAE,QAAQ,EAAE,MAAM,qBAAqB,CAAC;AAE/C,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,GAAG,CAAC,CAAC;AAE7B,gGAAgG;AAChG,MAAM,KAAK,GAAG,GAAG,CAAC;AAElB;;;;GAIG;AACH,MAAM,CAAC,MAAM,OAAO,GAAG,QAAQ,CAAC;IAC9B,IAAI,EAAE,EAAE,GAAG,EAAE,MAAM,EAAE,EAAE,qBAAqB,EAAE,MAAM,EAAE,EAAE,iBAAiB,EAAE,MAAM,EAAE,EAAE;IACrF,OAAO,EAAE,MAAM,CAAC;QACd,YAAY,EAAE,MAAM,EAAE;QACtB,kBAAkB,EAAE,MAAM,EAAE;QAC5B,cAAc,EAAE,MAAM,EAAE;QACxB,OAAO,EAAE,MAAM,EAAE;KAClB,CAAC;IACF,OAAO,EAAE,KAAK,EAAE,GAAG,EAAE,IAAI,EAAE,EAAE;QAC3B,MAAM,QAAQ,GAAG,MAAM,GAAG,CAAC,EAAE;aAC1B,KAAK,CAAC,cAAc,CAAC;aACrB,SAAS,CAAC,eAAe,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,WAAW,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC;aAC9D,IAAI,CAAC,KAAK,CAAC,CAAC;QACf,KAAK,MAAM,OAAO,IAAI,QAAQ,EAAE,CAAC;YAC/B,MAAM,GAAG,CAAC,EAAE,CAAC,MAAM,CAAC,cAAc,EAAE,OAAO,CAAC,GAAG,CAAC,CAAC;QACnD,CAAC;QAED,MAAM,KAAK,GAAG,MAAM,GAAG,CAAC,EAAE;aACvB,KAAK,CAAC,oBAAoB,CAAC;aAC3B,SAAS,CAAC,eAAe,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,WAAW,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC;aAC9D,IAAI,CAAC,KAAK,CAAC,CAAC;QACf,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;YACzB,MAAM,GAAG,CAAC,EAAE,CAAC,MAAM,CAAC,oBAAoB,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC;QACtD,CAAC;QAED,MAAM,aAAa,GAAG,IAAI,CAAC,GAAG,GAAG,IAAI,CAAC,qBAAqB,CAAC;QAC5D,MAAM,cAAc,GAAG,CACrB,MAAM,GAAG,CAAC,EAAE;aACT,KAAK,CAAC,SAAS,CAAC;aAChB,SAAS,CAAC,oBAAoB,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,gBAAgB,EAAE,SAAS,CAAC,CAAC;aACzE,OAAO,EAAE,CACb;aACE,MAAM,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,MAAM,CAAC,YAAY,IAAI,MAAM,CAAC,SAAS,CAAC,GAAG,aAAa,CAAC;aAC7E,KAAK,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC;QACnB,KAAK,MAAM,MAAM,IAAI,cAAc,EAAE,CAAC;YACpC,MAAM,GAAG,CAAC,EAAE,CAAC,MAAM,CAAC,SAAS,EAAE,MAAM,CAAC,GAAG,CAAC,CAAC;QAC7C,CAAC;QAED,MAAM,OAAO,GAAG,MAAM,GAAG,CAAC,EAAE;aACzB,KAAK,CAAC,SAAS,CAAC;aAChB,SAAS,CAAC,OAAO,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,IAAI,EAAE,IAAI,CAAC,GAAG,GAAG,IAAI,CAAC,iBAAiB,CAAC,CAAC;aACxE,IAAI,CAAC,KAAK,CAAC,CAAC;QACf,KAAK,MAAM,MAAM,IAAI,OAAO,EAAE,CAAC;YAC7B,MAAM,GAAG,CAAC,EAAE,CAAC,MAAM,CAAC,SAAS,EAAE,MAAM,CAAC,GAAG,CAAC,CAAC;QAC7C,CAAC;QAED,OAAO;YACL,YAAY,EAAE,QAAQ,CAAC,MAAM;YAC7B,kBAAkB,EAAE,KAAK,CAAC,MAAM;YAChC,cAAc,EAAE,cAAc,CAAC,MAAM;YACrC,OAAO,EAAE,OAAO,CAAC,MAAM;SACxB,CAAC;IACJ,CAAC;CACF,CAAC,CAAC"}

package/dist/component/registration.d.ts

@@ -0,0 +1,17 @@
+/** Stores the hash of an initial access token (RFC 7591 section 3) that registers clients of one app. */
+export declare const mintToken: import("convex/server").RegisteredMutation<"public", {
+    appId: string;
+    createdAt: number;
+    expiresAt: number;
+    tokenHash: string;
+}, Promise<null>>;
+/** The app a live registration token belongs to, or null for an unknown or expired token. */
+export declare const readToken: import("convex/server").RegisteredQuery<"public", {
+    now: number;
+    tokenHash: string;
+}, Promise<{
+    appId: string;
+    name: string;
+    firstParty: boolean;
+    allowedCallbackHosts: string[];
+} | null>>;

package/dist/component/registration.js

@@ -0,0 +1,57 @@
+import { v } from "convex/values";
+import { mutation, query } from "./_generated/server";
+const { array, boolean, number, object, string } = v;
+/** Stores the hash of an initial access token (RFC 7591 section 3) that registers clients of one app. */
+export const mintToken = mutation({
+    args: { tokenHash: string(), appId: string(), expiresAt: number(), createdAt: number() },
+    returns: v.null(),
+    handler: async (ctx, args) => {
+        const app = await ctx.db
+            .query("apps")
+            .withIndex("by_app_id", (q) => q.eq("appId", args.appId))
+            .unique();
+        if (app === null) {
+            throw new Error(`Unknown app "${args.appId}"`);
+        }
+        await ctx.db.insert("registrationTokens", {
+            tokenHash: args.tokenHash,
+            appId: args.appId,
+            expiresAt: args.expiresAt,
+            createdAt: args.createdAt,
+        });
+        return null;
+    },
+});
+/** The app a live registration token belongs to, or null for an unknown or expired token. */
+export const readToken = query({
+    args: { tokenHash: string(), now: number() },
+    returns: v.union(object({
+        appId: string(),
+        name: string(),
+        firstParty: boolean(),
+        allowedCallbackHosts: array(string()),
+    }), v.null()),
+    handler: async (ctx, args) => {
+        const token = await ctx.db
+            .query("registrationTokens")
+            .withIndex("by_token_hash", (q) => q.eq("tokenHash", args.tokenHash))
+            .unique();
+        if (token === null || token.expiresAt <= args.now) {
+            return null;
+        }
+        const app = await ctx.db
+            .query("apps")
+            .withIndex("by_app_id", (q) => q.eq("appId", token.appId))
+            .unique();
+        if (app === null) {
+            return null;
+        }
+        return {
+            appId: app.appId,
+            name: app.name,
+            firstParty: app.firstParty,
+            allowedCallbackHosts: app.allowedCallbackHosts,
+        };
+    },
+});
+//# sourceMappingURL=registration.js.map

package/dist/component/registration.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"registration.js","sourceRoot":"","sources":["../../src/component/registration.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,eAAe,CAAC;AAClC,OAAO,EAAE,QAAQ,EAAE,KAAK,EAAE,MAAM,qBAAqB,CAAC;AAEtD,MAAM,EAAE,KAAK,EAAE,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,GAAG,CAAC,CAAC;AAErD,yGAAyG;AACzG,MAAM,CAAC,MAAM,SAAS,GAAG,QAAQ,CAAC;IAChC,IAAI,EAAE,EAAE,SAAS,EAAE,MAAM,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,EAAE,SAAS,EAAE,MAAM,EAAE,EAAE,SAAS,EAAE,MAAM,EAAE,EAAE;IACxF,OAAO,EAAE,CAAC,CAAC,IAAI,EAAE;IACjB,OAAO,EAAE,KAAK,EAAE,GAAG,EAAE,IAAI,EAAE,EAAE;QAC3B,MAAM,GAAG,GAAG,MAAM,GAAG,CAAC,EAAE;aACrB,KAAK,CAAC,MAAM,CAAC;aACb,SAAS,CAAC,WAAW,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,OAAO,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC;aACxD,MAAM,EAAE,CAAC;QACZ,IAAI,GAAG,KAAK,IAAI,EAAE,CAAC;YACjB,MAAM,IAAI,KAAK,CAAC,gBAAgB,IAAI,CAAC,KAAK,GAAG,CAAC,CAAC;QACjD,CAAC;QACD,MAAM,GAAG,CAAC,EAAE,CAAC,MAAM,CAAC,oBAAoB,EAAE;YACxC,SAAS,EAAE,IAAI,CAAC,SAAS;YACzB,KAAK,EAAE,IAAI,CAAC,KAAK;YACjB,SAAS,EAAE,IAAI,CAAC,SAAS;YACzB,SAAS,EAAE,IAAI,CAAC,SAAS;SAC1B,CAAC,CAAC;QACH,OAAO,IAAI,CAAC;IACd,CAAC;CACF,CAAC,CAAC;AAEH,6FAA6F;AAC7F,MAAM,CAAC,MAAM,SAAS,GAAG,KAAK,CAAC;IAC7B,IAAI,EAAE,EAAE,SAAS,EAAE,MAAM,EAAE,EAAE,GAAG,EAAE,MAAM,EAAE,EAAE;IAC5C,OAAO,EAAE,CAAC,CAAC,KAAK,CACd,MAAM,CAAC;QACL,KAAK,EAAE,MAAM,EAAE;QACf,IAAI,EAAE,MAAM,EAAE;QACd,UAAU,EAAE,OAAO,EAAE;QACrB,oBAAoB,EAAE,KAAK,CAAC,MAAM,EAAE,CAAC;KACtC,CAAC,EACF,CAAC,CAAC,IAAI,EAAE,CACT;IACD,OAAO,EAAE,KAAK,EAAE,GAAG,EAAE,IAAI,EAAE,EAAE;QAC3B,MAAM,KAAK,GAAG,MAAM,GAAG,CAAC,EAAE;aACvB,KAAK,CAAC,oBAAoB,CAAC;aAC3B,SAAS,CAAC,eAAe,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,WAAW,EAAE,IAAI,CAAC,SAAS,CAAC,CAAC;aACpE,MAAM,EAAE,CAAC;QACZ,IAAI,KAAK,KAAK,IAAI,IAAI,KAAK,CAAC,SAAS,IAAI,IAAI,CAAC,GAAG,EAAE,CAAC;YAClD,OAAO,IAAI,CAAC;QACd,CAAC;QACD,MAAM,GAAG,GAAG,MAAM,GAAG,CAAC,EAAE;aACrB,KAAK,CAAC,MAAM,CAAC;aACb,SAAS,CAAC,WAAW,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,OAAO,EAAE,KAAK,CAAC,KAAK,CAAC,CAAC;aACzD,MAAM,EAAE,CAAC;QACZ,IAAI,GAAG,KAAK,IAAI,EAAE,CAAC;YACjB,OAAO,IAAI,CAAC;QACd,CAAC;QACD,OAAO;YACL,KAAK,EAAE,GAAG,CAAC,KAAK;YAChB,IAAI,EAAE,GAAG,CAAC,IAAI;YACd,UAAU,EAAE,GAAG,CAAC,UAAU;YAC1B,oBAAoB,EAAE,GAAG,CAAC,oBAAoB;SAC/C,CAAC;IACJ,CAAC;CACF,CAAC,CAAC"}