@samebase/identity-broker 0.0.0-stage → 0.2.0

package/LICENSE

@@ -0,0 +1,201 @@
+                                 Apache License
+                           Version 2.0, January 2004
+                        http://www.apache.org/licenses/
+
+TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION
+
+1.  Definitions.
+
+    "License" shall mean the terms and conditions for use, reproduction,
+    and distribution as defined by Sections 1 through 9 of this document.
+
+    "Licensor" shall mean the copyright owner or entity authorized by
+    the copyright owner that is granting the License.
+
+    "Legal Entity" shall mean the union of the acting entity and all
+    other entities that control, are controlled by, or are under common
+    control with that entity. For the purposes of this definition,
+    "control" means (i) the power, direct or indirect, to cause the
+    direction or management of such entity, whether by contract or
+    otherwise, or (ii) ownership of fifty percent (50%) or more of the
+    outstanding shares, or (iii) beneficial ownership of such entity.
+
+    "You" (or "Your") shall mean an individual or Legal Entity
+    exercising permissions granted by this License.
+
+    "Source" form shall mean the preferred form for making modifications,
+    including but not limited to software source code, documentation
+    source, and configuration files.
+
+    "Object" form shall mean any form resulting from mechanical
+    transformation or translation of a Source form, including but
+    not limited to compiled object code, generated documentation,
+    and conversions to other media types.
+
+    "Work" shall mean the work of authorship, whether in Source or
+    Object form, made available under the License, as indicated by a
+    copyright notice that is included in or attached to the work
+    (an example is provided in the Appendix below).
+
+    "Derivative Works" shall mean any work, whether in Source or Object
+    form, that is based on (or derived from) the Work and for which the
+    editorial revisions, annotations, elaborations, or other modifications
+    represent, as a whole, an original work of authorship. For the purposes
+    of this License, Derivative Works shall not include works that remain
+    separable from, or merely link (or bind by name) to the interfaces of,
+    the Work and Derivative Works thereof.
+
+    "Contribution" shall mean any work of authorship, including
+    the original version of the Work and any modifications or additions
+    to that Work or Derivative Works thereof, that is intentionally
+    submitted to Licensor for inclusion in the Work by the copyright owner
+    or by an individual or Legal Entity authorized to submit on behalf of
+    the copyright owner. For the purposes of this definition, "submitted"
+    means any form of electronic, verbal, or written communication sent
+    to the Licensor or its representatives, including but not limited to
+    communication on electronic mailing lists, source code control systems,
+    and issue tracking systems that are managed by, or on behalf of, the
+    Licensor for the purpose of discussing and improving the Work, but
+    excluding communication that is conspicuously marked or otherwise
+    designated in writing by the copyright owner as "Not a Contribution."
+
+    "Contributor" shall mean Licensor and any individual or Legal Entity
+    on behalf of whom a Contribution has been received by Licensor and
+    subsequently incorporated within the Work.
+
+2.  Grant of Copyright License. Subject to the terms and conditions of
+    this License, each Contributor hereby grants to You a perpetual,
+    worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+    copyright license to reproduce, prepare Derivative Works of,
+    publicly display, publicly perform, sublicense, and distribute the
+    Work and such Derivative Works in Source or Object form.
+
+3.  Grant of Patent License. Subject to the terms and conditions of
+    this License, each Contributor hereby grants to You a perpetual,
+    worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+    (except as stated in this section) patent license to make, have made,
+    use, offer to sell, sell, import, and otherwise transfer the Work,
+    where such license applies only to those patent claims licensable
+    by such Contributor that are necessarily infringed by their
+    Contribution(s) alone or by combination of their Contribution(s)
+    with the Work to which such Contribution(s) was submitted. If You
+    institute patent litigation against any entity (including a
+    cross-claim or counterclaim in a lawsuit) alleging that the Work
+    or a Contribution incorporated within the Work constitutes direct
+    or contributory patent infringement, then any patent licenses
+    granted to You under this License for that Work shall terminate
+    as of the date such litigation is filed.
+
+4.  Redistribution. You may reproduce and distribute copies of the
+    Work or Derivative Works thereof in any medium, with or without
+    modifications, and in Source or Object form, provided that You
+    meet the following conditions:
+
+    (a) You must give any other recipients of the Work or
+    Derivative Works a copy of this License; and
+
+    (b) You must cause any modified files to carry prominent notices
+    stating that You changed the files; and
+
+    (c) You must retain, in the Source form of any Derivative Works
+    that You distribute, all copyright, patent, trademark, and
+    attribution notices from the Source form of the Work,
+    excluding those notices that do not pertain to any part of
+    the Derivative Works; and
+
+    (d) If the Work includes a "NOTICE" text file as part of its
+    distribution, then any Derivative Works that You distribute must
+    include a readable copy of the attribution notices contained
+    within such NOTICE file, excluding those notices that do not
+    pertain to any part of the Derivative Works, in at least one
+    of the following places: within a NOTICE text file distributed
+    as part of the Derivative Works; within the Source form or
+    documentation, if provided along with the Derivative Works; or,
+    within a display generated by the Derivative Works, if and
+    wherever such third-party notices normally appear. The contents
+    of the NOTICE file are for informational purposes only and
+    do not modify the License. You may add Your own attribution
+    notices within Derivative Works that You distribute, alongside
+    or as an addendum to the NOTICE text from the Work, provided
+    that such additional attribution notices cannot be construed
+    as modifying the License.
+
+    You may add Your own copyright statement to Your modifications and
+    may provide additional or different license terms and conditions
+    for use, reproduction, or distribution of Your modifications, or
+    for any such Derivative Works as a whole, provided Your use,
+    reproduction, and distribution of the Work otherwise complies with
+    the conditions stated in this License.
+
+5.  Submission of Contributions. Unless You explicitly state otherwise,
+    any Contribution intentionally submitted for inclusion in the Work
+    by You to the Licensor shall be under the terms and conditions of
+    this License, without any additional terms or conditions.
+    Notwithstanding the above, nothing herein shall supersede or modify
+    the terms of any separate license agreement you may have executed
+    with Licensor regarding such Contributions.
+
+6.  Trademarks. This License does not grant permission to use the trade
+    names, trademarks, service marks, or product names of the Licensor,
+    except as required for reasonable and customary use in describing the
+    origin of the Work and reproducing the content of the NOTICE file.
+
+7.  Disclaimer of Warranty. Unless required by applicable law or
+    agreed to in writing, Licensor provides the Work (and each
+    Contributor provides its Contributions) on an "AS IS" BASIS,
+    WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or
+    implied, including, without limitation, any warranties or conditions
+    of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A
+    PARTICULAR PURPOSE. You are solely responsible for determining the
+    appropriateness of using or redistributing the Work and assume any
+    risks associated with Your exercise of permissions under this License.
+
+8.  Limitation of Liability. In no event and under no legal theory,
+    whether in tort (including negligence), contract, or otherwise,
+    unless required by applicable law (such as deliberate and grossly
+    negligent acts) or agreed to in writing, shall any Contributor be
+    liable to You for damages, including any direct, indirect, special,
+    incidental, or consequential damages of any character arising as a
+    result of this License or out of the use or inability to use the
+    Work (including but not limited to damages for loss of goodwill,
+    work stoppage, computer failure or malfunction, or any and all
+    other commercial damages or losses), even if such Contributor
+    has been advised of the possibility of such damages.
+
+9.  Accepting Warranty or Additional Liability. While redistributing
+    the Work or Derivative Works thereof, You may choose to offer,
+    and charge a fee for, acceptance of support, warranty, indemnity,
+    or other liability obligations and/or rights consistent with this
+    License. However, in accepting such obligations, You may act only
+    on Your own behalf and on Your sole responsibility, not on behalf
+    of any other Contributor, and only if You agree to indemnify,
+    defend, and hold each Contributor harmless for any liability
+    incurred by, or claims asserted against, such Contributor by reason
+    of your accepting any such warranty or additional liability.
+
+END OF TERMS AND CONDITIONS
+
+APPENDIX: How to apply the Apache License to your work.
+
+      To apply the Apache License to your work, attach the following
+      boilerplate notice, with the fields enclosed by brackets "[]"
+      replaced with your own identifying information. (Don't include
+      the brackets!)  The text should be enclosed in the appropriate
+      comment syntax for the file format. We also recommend that a
+      file or class name and description of purpose be included on the
+      same "printed page" as the copyright notice for easier
+      identification within third-party archives.
+
+Copyright [yyyy] [name of copyright owner]
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+       http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.

package/NOTICE

@@ -0,0 +1,4 @@
+identity-broker
+Copyright 2026 Nicușor Chiciuc
+
+Licensed under the Apache License, Version 2.0.

package/README.md

@@ -1,3 +1,105 @@
-# Temporary Holding Version
+# identity-broker
 
-This version is a temporary placeholder for this package. An operational version to replace this has been submitted for review and is awaiting a staged release.
+An OpenID Provider that runs on [Convex](https://convex.dev). One deployment holds a team's sign-in
+connections once, such as GitHub, Google and email codes, and signs users in to many small apps. The
+broker keeps no user accounts and no sessions: every sign-in goes upstream again, and each app
+creates its own user from the `id_token` it receives.
+
+Why: every new app otherwise needs its own OAuth app registrations and its own email sender, and a
+preview deployment with a fresh callback URL cannot have them at all. With the broker, an app
+registers each deployment as a client at deploy time and never touches GitHub or Google.
+
+## What it is
+
+- `@samebase/identity-broker`: a Convex component plus the host-side endpoints. Authorization code
+  flow with PKCE, discovery, JWKS, dynamic client registration (RFC 7591) gated by per-app tokens,
+  userinfo. RS256 `id_token`s with pairwise subjects per app.
+- Connectors are configuration: any OAuth 2.0 or OpenID Connect provider, and an email code sent by
+  your own action. `github()`, `google()` and `email()` are included.
+- A hub is a small Convex app that mounts the component. Fork
+  [samebase/identity-hub](https://github.com/samebase/identity-hub) for one.
+- `@samebase/alchemy-identity-hub`: an Alchemy v2 resource, `IdentityHub.Client`, that registers a
+  deployment as a client at deploy time. See
+  [packages/alchemy-identity-hub](https://github.com/samebase/identity-broker/tree/main/packages/alchemy-identity-hub).
+
+## Mount it
+
+```ts
+// convex/convex.config.ts
+import { defineApp } from "convex/server";
+import identityBroker from "@samebase/identity-broker/convex.config";
+
+const app = defineApp();
+app.use(identityBroker);
+export default app;
+```
+
+```ts
+// convex/http.ts
+import { httpRouter } from "convex/server";
+import { defineIdentityBroker, email, github, google } from "@samebase/identity-broker";
+import { components, internal } from "./_generated/api";
+
+export const broker = defineIdentityBroker({
+  component: components.identityBroker,
+  issuer: process.env.ISSUER ?? process.env.CONVEX_SITE_URL!,
+  keys: () => process.env.IDENTITY_BROKER_KEYS,
+  connectors: [
+    github({
+      clientId: () => process.env.GITHUB_CLIENT_ID!,
+      clientSecret: () => process.env.GITHUB_CLIENT_SECRET!,
+    }),
+    google({
+      clientId: () => process.env.GOOGLE_CLIENT_ID!,
+      clientSecret: () => process.env.GOOGLE_CLIENT_SECRET!,
+    }),
+    email({ send: internal.email.sendCode }),
+  ],
+});
+
+const http = httpRouter();
+broker.addHttpRoutes(http);
+export default http;
+```
+
+```ts
+// convex/identityBroker.ts: administration for `npx convex run`
+import { broker } from "./http";
+export const {
+  createApp,
+  mintRegistrationToken,
+  listRegistrationTokens,
+  revokeRegistrationToken,
+  setAllowedCallbackHosts,
+  deleteClient,
+  deleteApp,
+  listApps,
+  listClients,
+  cleanup,
+} = broker.admin();
+```
+
+Keys: `npx identity-broker keys` prints the value for `IDENTITY_BROKER_KEYS`; `keys --rotate`
+advances it, and `keys --rotate --no-overlap` replaces a compromised key at once. Back up the key
+set: its salt makes every `sub`. `parseKeySet` checks a value before a deploy.
+
+## Register an app's deployments
+
+```sh
+npx convex run identityBroker:createApp '{"name":"Bristol","firstParty":true,"allowedCallbackHosts":["*.convex.site","127.0.0.1"]}'
+npx convex run identityBroker:mintRegistrationToken '{"appId":"bristol-ab12c"}'
+```
+
+Each deployment then posts its callback URL to `/register` with that token as a Bearer token and
+gets a `client_id` and `client_secret`. A Convex Auth v2 app points its generic OAuth method at
+`<issuer>/authorize` and `<issuer>/token`; see the [docs](docs/consumers.md).
+
+## Standards
+
+OAuth 2.1 (code flow, PKCE S256, exact redirect URIs, `iss` on responses), OpenID Connect Core and
+Discovery, RFC 7591, RFC 8414, RFC 9207, RFC 9700. Departures are named in
+[docs/design.md](docs/design.md).
+
+## License
+
+Apache-2.0.

package/dist/cli/index.d.ts

@@ -0,0 +1,2 @@
+#!/usr/bin/env node
+export {};

package/dist/cli/index.js

@@ -0,0 +1,39 @@
+#!/usr/bin/env node
+import { createKeySet, parseKeySet, rotateKeySet, rotateKeySetWithoutOverlap, } from "../client/keys.js";
+const USAGE = `identity-broker keys                         print a new key set for IDENTITY_BROKER_KEYS
+identity-broker keys --rotate                read the current key set on stdin, print the rotated
+                                             one; the retired public key stays for 14 days
+identity-broker keys --rotate --no-overlap   the same after a key compromise: retired keys are
+                                             dropped at once; the salt is kept`;
+async function readStdin() {
+    const chunks = [];
+    for await (const chunk of process.stdin) {
+        chunks.push(typeof chunk === "string" ? Buffer.from(chunk) : chunk);
+    }
+    return Buffer.concat(chunks).toString("utf8");
+}
+async function main(argv) {
+    if (argv[0] !== "keys") {
+        console.error(USAGE);
+        return 2;
+    }
+    const rotate = argv.includes("--rotate");
+    const noOverlap = argv.includes("--no-overlap");
+    // Without --rotate, --no-overlap would print a new key set with a new salt: every sub changes.
+    if (noOverlap && !rotate) {
+        console.error(USAGE);
+        return 2;
+    }
+    if (rotate) {
+        const current = parseKeySet(await readStdin());
+        const rotated = noOverlap
+            ? await rotateKeySetWithoutOverlap(current)
+            : await rotateKeySet(current);
+        process.stdout.write(`${JSON.stringify(rotated)}\n`);
+        return 0;
+    }
+    process.stdout.write(`${JSON.stringify(await createKeySet())}\n`);
+    return 0;
+}
+process.exitCode = await main(process.argv.slice(2));
+//# sourceMappingURL=index.js.map

package/dist/cli/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/cli/index.ts"],"names":[],"mappings":";AACA,OAAO,EACL,YAAY,EACZ,WAAW,EACX,YAAY,EACZ,0BAA0B,GAC3B,MAAM,mBAAmB,CAAC;AAE3B,MAAM,KAAK,GAAG;;;;+EAIiE,CAAC;AAEhF,KAAK,UAAU,SAAS;IACtB,MAAM,MAAM,GAAa,EAAE,CAAC;IAC5B,IAAI,KAAK,EAAE,MAAM,KAAK,IAAI,OAAO,CAAC,KAAK,EAAE,CAAC;QACxC,MAAM,CAAC,IAAI,CAAC,OAAO,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC;IACtE,CAAC;IACD,OAAO,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;AAChD,CAAC;AAED,KAAK,UAAU,IAAI,CAAC,IAAc;IAChC,IAAI,IAAI,CAAC,CAAC,CAAC,KAAK,MAAM,EAAE,CAAC;QACvB,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;QACrB,OAAO,CAAC,CAAC;IACX,CAAC;IACD,MAAM,MAAM,GAAG,IAAI,CAAC,QAAQ,CAAC,UAAU,CAAC,CAAC;IACzC,MAAM,SAAS,GAAG,IAAI,CAAC,QAAQ,CAAC,cAAc,CAAC,CAAC;IAChD,+FAA+F;IAC/F,IAAI,SAAS,IAAI,CAAC,MAAM,EAAE,CAAC;QACzB,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;QACrB,OAAO,CAAC,CAAC;IACX,CAAC;IACD,IAAI,MAAM,EAAE,CAAC;QACX,MAAM,OAAO,GAAG,WAAW,CAAC,MAAM,SAAS,EAAE,CAAC,CAAC;QAC/C,MAAM,OAAO,GAAG,SAAS;YACvB,CAAC,CAAC,MAAM,0BAA0B,CAAC,OAAO,CAAC;YAC3C,CAAC,CAAC,MAAM,YAAY,CAAC,OAAO,CAAC,CAAC;QAChC,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;QACrD,OAAO,CAAC,CAAC;IACX,CAAC;IACD,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,IAAI,CAAC,SAAS,CAAC,MAAM,YAAY,EAAE,CAAC,IAAI,CAAC,CAAC;IAClE,OAAO,CAAC,CAAC;AACX,CAAC;AAED,OAAO,CAAC,QAAQ,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC"}

package/dist/client/connectors/email.d.ts

@@ -0,0 +1,6 @@
+import type { EmailConnector, SendEmailCode } from "./types.js";
+/** A six-digit code sent by the host's action. The canonical address is the identity. */
+export declare function email(options: {
+    send: SendEmailCode;
+    name?: string;
+}): EmailConnector;

package/dist/client/connectors/email.js

@@ -0,0 +1,5 @@
+/** A six-digit code sent by the host's action. The canonical address is the identity. */
+export function email(options) {
+    return { kind: "email", name: options.name ?? "email", label: "Email", send: options.send };
+}
+//# sourceMappingURL=email.js.map

package/dist/client/connectors/email.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"email.js","sourceRoot":"","sources":["../../../src/client/connectors/email.ts"],"names":[],"mappings":"AAEA,yFAAyF;AACzF,MAAM,UAAU,KAAK,CAAC,OAA+C;IACnE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,OAAO,CAAC,IAAI,IAAI,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,IAAI,EAAE,OAAO,CAAC,IAAI,EAAE,CAAC;AAC9F,CAAC"}

package/dist/client/connectors/github.d.ts

@@ -0,0 +1,7 @@
+import type { OauthConnector } from "./types.js";
+/** GitHub as an OAuth connector. The callback must be registered on the OAuth App or GitHub App. */
+export declare function github(credentials: {
+    clientId: () => string;
+    clientSecret: () => string;
+    name?: string;
+}): OauthConnector;

package/dist/client/connectors/github.js

@@ -0,0 +1,57 @@
+import * as oauth from "oauth4webapi";
+import { asRecord } from "../protocol.js";
+const USER_URL = "https://api.github.com/user";
+const EMAILS_URL = "https://api.github.com/user/emails";
+async function githubJson(accessToken, url) {
+    const response = await oauth.protectedResourceRequest(accessToken, "GET", new URL(url), new Headers({ Accept: "application/vnd.github+json", "User-Agent": "identity-broker" }));
+    if (!response.ok) {
+        throw new Error(`GitHub ${url} answered ${response.status}`);
+    }
+    return await response.json();
+}
+/**
+ * The GitHub user and a verified email. GitHub's `/user` email is whatever the user made public,
+ * so the verified primary address from `/user/emails` is used instead; a user with no verified
+ * address gets no email claim.
+ */
+async function githubIdentity(accessToken) {
+    const user = asRecord(await githubJson(accessToken, USER_URL));
+    const id = user["id"];
+    if (typeof id !== "number" && typeof id !== "string") {
+        throw new Error("GitHub /user returned no id");
+    }
+    const identity = { upstreamId: String(id) };
+    const name = user["name"] ?? user["login"];
+    if (typeof name === "string" && name.length > 0) {
+        identity.name = name;
+    }
+    if (typeof user["avatar_url"] === "string") {
+        identity.picture = user["avatar_url"];
+    }
+    const emails = await githubJson(accessToken, EMAILS_URL);
+    if (Array.isArray(emails)) {
+        const entries = emails.map((entry) => asRecord(entry));
+        const verified = entries.filter((entry) => entry["verified"] === true);
+        const primary = verified.find((entry) => entry["primary"] === true) ?? verified[0];
+        if (primary !== undefined && typeof primary["email"] === "string") {
+            identity.email = primary["email"];
+            identity.emailVerified = true;
+        }
+    }
+    return identity;
+}
+/** GitHub as an OAuth connector. The callback must be registered on the OAuth App or GitHub App. */
+export function github(credentials) {
+    return {
+        kind: "oauth",
+        name: credentials.name ?? "github",
+        label: "GitHub",
+        authorizationEndpoint: "https://github.com/login/oauth/authorize",
+        tokenEndpoint: "https://github.com/login/oauth/access_token",
+        scopes: ["read:user", "user:email"],
+        clientId: credentials.clientId,
+        clientSecret: credentials.clientSecret,
+        identity: githubIdentity,
+    };
+}
+//# sourceMappingURL=github.js.map

package/dist/client/connectors/github.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"github.js","sourceRoot":"","sources":["../../../src/client/connectors/github.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,KAAK,MAAM,cAAc,CAAC;AACtC,OAAO,EAAE,QAAQ,EAAE,MAAM,gBAAgB,CAAC;AAG1C,MAAM,QAAQ,GAAG,6BAA6B,CAAC;AAC/C,MAAM,UAAU,GAAG,oCAAoC,CAAC;AAExD,KAAK,UAAU,UAAU,CAAC,WAAmB,EAAE,GAAW;IACxD,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,wBAAwB,CACnD,WAAW,EACX,KAAK,EACL,IAAI,GAAG,CAAC,GAAG,CAAC,EACZ,IAAI,OAAO,CAAC,EAAE,MAAM,EAAE,6BAA6B,EAAE,YAAY,EAAE,iBAAiB,EAAE,CAAC,CACxF,CAAC;IACF,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;QACjB,MAAM,IAAI,KAAK,CAAC,UAAU,GAAG,aAAa,QAAQ,CAAC,MAAM,EAAE,CAAC,CAAC;IAC/D,CAAC;IACD,OAAO,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC;AAC/B,CAAC;AAED;;;;GAIG;AACH,KAAK,UAAU,cAAc,CAAC,WAAmB;IAC/C,MAAM,IAAI,GAAG,QAAQ,CAAC,MAAM,UAAU,CAAC,WAAW,EAAE,QAAQ,CAAC,CAAC,CAAC;IAC/D,MAAM,EAAE,GAAG,IAAI,CAAC,IAAI,CAAC,CAAC;IACtB,IAAI,OAAO,EAAE,KAAK,QAAQ,IAAI,OAAO,EAAE,KAAK,QAAQ,EAAE,CAAC;QACrD,MAAM,IAAI,KAAK,CAAC,6BAA6B,CAAC,CAAC;IACjD,CAAC;IACD,MAAM,QAAQ,GAAqB,EAAE,UAAU,EAAE,MAAM,CAAC,EAAE,CAAC,EAAE,CAAC;IAC9D,MAAM,IAAI,GAAG,IAAI,CAAC,MAAM,CAAC,IAAI,IAAI,CAAC,OAAO,CAAC,CAAC;IAC3C,IAAI,OAAO,IAAI,KAAK,QAAQ,IAAI,IAAI,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAChD,QAAQ,CAAC,IAAI,GAAG,IAAI,CAAC;IACvB,CAAC;IACD,IAAI,OAAO,IAAI,CAAC,YAAY,CAAC,KAAK,QAAQ,EAAE,CAAC;QAC3C,QAAQ,CAAC,OAAO,GAAG,IAAI,CAAC,YAAY,CAAC,CAAC;IACxC,CAAC;IACD,MAAM,MAAM,GAAG,MAAM,UAAU,CAAC,WAAW,EAAE,UAAU,CAAC,CAAC;IACzD,IAAI,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;QAC1B,MAAM,OAAO,GAAG,MAAM,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC;QACvD,MAAM,QAAQ,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,UAAU,CAAC,KAAK,IAAI,CAAC,CAAC;QACvE,MAAM,OAAO,GAAG,QAAQ,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,SAAS,CAAC,KAAK,IAAI,CAAC,IAAI,QAAQ,CAAC,CAAC,CAAC,CAAC;QACnF,IAAI,OAAO,KAAK,SAAS,IAAI,OAAO,OAAO,CAAC,OAAO,CAAC,KAAK,QAAQ,EAAE,CAAC;YAClE,QAAQ,CAAC,KAAK,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;YAClC,QAAQ,CAAC,aAAa,GAAG,IAAI,CAAC;QAChC,CAAC;IACH,CAAC;IACD,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED,oGAAoG;AACpG,MAAM,UAAU,MAAM,CAAC,WAItB;IACC,OAAO;QACL,IAAI,EAAE,OAAO;QACb,IAAI,EAAE,WAAW,CAAC,IAAI,IAAI,QAAQ;QAClC,KAAK,EAAE,QAAQ;QACf,qBAAqB,EAAE,0CAA0C;QACjE,aAAa,EAAE,6CAA6C;QAC5D,MAAM,EAAE,CAAC,WAAW,EAAE,YAAY,CAAC;QACnC,QAAQ,EAAE,WAAW,CAAC,QAAQ;QAC9B,YAAY,EAAE,WAAW,CAAC,YAAY;QACtC,QAAQ,EAAE,cAAc;KACzB,CAAC;AACJ,CAAC"}

package/dist/client/connectors/google.d.ts

@@ -0,0 +1,7 @@
+import type { OidcConnector } from "./types.js";
+/** Google as an OIDC connector: discovery, id_token claims, `prompt=login` for fresh logins. */
+export declare function google(credentials: {
+    clientId: () => string;
+    clientSecret: () => string;
+    name?: string;
+}): OidcConnector;

package/dist/client/connectors/google.js

@@ -0,0 +1,13 @@
+/** Google as an OIDC connector: discovery, id_token claims, `prompt=login` for fresh logins. */
+export function google(credentials) {
+    return {
+        kind: "oidc",
+        name: credentials.name ?? "google",
+        label: "Google",
+        issuer: "https://accounts.google.com",
+        scopes: ["openid", "email", "profile"],
+        clientId: credentials.clientId,
+        clientSecret: credentials.clientSecret,
+    };
+}
+//# sourceMappingURL=google.js.map

package/dist/client/connectors/google.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"google.js","sourceRoot":"","sources":["../../../src/client/connectors/google.ts"],"names":[],"mappings":"AAEA,gGAAgG;AAChG,MAAM,UAAU,MAAM,CAAC,WAItB;IACC,OAAO;QACL,IAAI,EAAE,MAAM;QACZ,IAAI,EAAE,WAAW,CAAC,IAAI,IAAI,QAAQ;QAClC,KAAK,EAAE,QAAQ;QACf,MAAM,EAAE,6BAA6B;QACrC,MAAM,EAAE,CAAC,QAAQ,EAAE,OAAO,EAAE,SAAS,CAAC;QACtC,QAAQ,EAAE,WAAW,CAAC,QAAQ;QAC9B,YAAY,EAAE,WAAW,CAAC,YAAY;KACvC,CAAC;AACJ,CAAC"}

package/dist/client/connectors/types.d.ts

@@ -0,0 +1,47 @@
+import type { FunctionReference } from "convex/server";
+/** What a connector attested about the user. `upstreamId` is the connector's stable account id. */
+export type UpstreamIdentity = {
+    upstreamId: string;
+    email?: string;
+    emailVerified?: boolean;
+    name?: string;
+    picture?: string;
+};
+type Credentials = {
+    /** Read lazily, in the request, so a missing env var fails that request and not the deploy. */
+    clientId: () => string;
+    clientSecret: () => string;
+};
+/** A plain OAuth 2.0 provider: identity comes from an API call with the access token. */
+export type OauthConnector = Credentials & {
+    kind: "oauth";
+    name: string;
+    /** Shown on the chooser button, e.g. "GitHub". */
+    label: string;
+    authorizationEndpoint: string;
+    tokenEndpoint: string;
+    scopes: string[];
+    identity: (accessToken: string) => Promise<UpstreamIdentity>;
+};
+/** An OpenID Connect provider found through discovery: identity comes from the id_token. */
+export type OidcConnector = Credentials & {
+    kind: "oidc";
+    name: string;
+    label: string;
+    issuer: string;
+    scopes: string[];
+};
+/** The host action that delivers a code. The broker never sees how. */
+export type SendEmailCode = FunctionReference<"action", "internal", {
+    to: string;
+    code: string;
+    appName: string;
+}, null>;
+export type EmailConnector = {
+    kind: "email";
+    name: string;
+    label: string;
+    send: SendEmailCode;
+};
+export type Connector = OauthConnector | OidcConnector | EmailConnector;
+export {};

package/dist/client/connectors/types.js

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=types.js.map

package/dist/client/connectors/types.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.js","sourceRoot":"","sources":["../../../src/client/connectors/types.ts"],"names":[],"mappings":""}

package/dist/client/connectors/upstream.d.ts

@@ -0,0 +1,25 @@
+import type { OauthConnector, OidcConnector, UpstreamIdentity } from "./types.js";
+export type UpstreamStart = {
+    url: string;
+    state: string;
+    codeVerifier: string;
+    nonce: string | undefined;
+};
+/** The authorization URL for a connector, with fresh state, PKCE pair and, for OIDC, a nonce. */
+export declare function startUpstream(args: {
+    connector: OauthConnector | OidcConnector;
+    callbackUrl: string;
+    freshLogin: boolean;
+}): Promise<UpstreamStart>;
+/**
+ * The connector callback: validate the response, exchange the code, and read the identity. Errors
+ * propagate; the caller turns them into a redirect back to the client.
+ */
+export declare function finishUpstream(args: {
+    connector: OauthConnector | OidcConnector;
+    callbackUrl: string;
+    currentUrl: URL;
+    state: string;
+    codeVerifier: string;
+    nonce: string | undefined;
+}): Promise<UpstreamIdentity>;

package/dist/client/connectors/upstream.js

@@ -0,0 +1,86 @@
+import * as oauth from "oauth4webapi";
+const discovered = new Map();
+/** OIDC discovery, once per issuer per isolate. */
+function authorizationServer(connector) {
+    if (connector.kind === "oauth") {
+        return Promise.resolve({
+            issuer: connector.authorizationEndpoint,
+            authorization_endpoint: connector.authorizationEndpoint,
+            token_endpoint: connector.tokenEndpoint,
+        });
+    }
+    const cached = discovered.get(connector.issuer);
+    if (cached !== undefined) {
+        return cached;
+    }
+    const issuer = new URL(connector.issuer);
+    const pending = oauth
+        .discoveryRequest(issuer, { algorithm: "oidc" })
+        .then((response) => oauth.processDiscoveryResponse(issuer, response));
+    discovered.set(connector.issuer, pending);
+    pending.catch(() => discovered.delete(connector.issuer));
+    return pending;
+}
+/** The authorization URL for a connector, with fresh state, PKCE pair and, for OIDC, a nonce. */
+export async function startUpstream(args) {
+    const as = await authorizationServer(args.connector);
+    if (as.authorization_endpoint === undefined) {
+        throw new Error(`Connector "${args.connector.name}" has no authorization endpoint`);
+    }
+    const state = oauth.generateRandomState();
+    const codeVerifier = oauth.generateRandomCodeVerifier();
+    const nonce = args.connector.kind === "oidc" ? oauth.generateRandomNonce() : undefined;
+    const url = new URL(as.authorization_endpoint);
+    url.searchParams.set("client_id", args.connector.clientId());
+    url.searchParams.set("redirect_uri", args.callbackUrl);
+    url.searchParams.set("response_type", "code");
+    url.searchParams.set("scope", args.connector.scopes.join(" "));
+    url.searchParams.set("code_challenge", await oauth.calculatePKCECodeChallenge(codeVerifier));
+    url.searchParams.set("code_challenge_method", "S256");
+    url.searchParams.set("state", state);
+    if (nonce !== undefined) {
+        url.searchParams.set("nonce", nonce);
+    }
+    if (args.freshLogin && args.connector.kind === "oidc") {
+        url.searchParams.set("prompt", "login");
+    }
+    return { url: url.toString(), state, codeVerifier, nonce };
+}
+/**
+ * The connector callback: validate the response, exchange the code, and read the identity. Errors
+ * propagate; the caller turns them into a redirect back to the client.
+ */
+export async function finishUpstream(args) {
+    const as = await authorizationServer(args.connector);
+    const client = { client_id: args.connector.clientId() };
+    const clientAuth = oauth.ClientSecretPost(args.connector.clientSecret());
+    const params = oauth.validateAuthResponse(as, client, args.currentUrl, args.state);
+    const response = await oauth.authorizationCodeGrantRequest(as, client, clientAuth, params, args.callbackUrl, args.codeVerifier);
+    if (args.connector.kind === "oauth") {
+        const tokens = await oauth.processAuthorizationCodeResponse(as, client, response);
+        return await args.connector.identity(tokens.access_token);
+    }
+    const tokens = await oauth.processAuthorizationCodeResponse(as, client, response, {
+        requireIdToken: true,
+        ...(args.nonce === undefined ? {} : { expectedNonce: args.nonce }),
+    });
+    const claims = oauth.getValidatedIdTokenClaims(tokens);
+    if (claims === undefined) {
+        throw new Error(`Connector "${args.connector.name}" returned no id_token`);
+    }
+    const identity = { upstreamId: claims.sub };
+    if (typeof claims["email"] === "string") {
+        identity.email = claims["email"];
+    }
+    if (typeof claims["email_verified"] === "boolean") {
+        identity.emailVerified = claims["email_verified"];
+    }
+    if (typeof claims["name"] === "string") {
+        identity.name = claims["name"];
+    }
+    if (typeof claims["picture"] === "string") {
+        identity.picture = claims["picture"];
+    }
+    return identity;
+}
+//# sourceMappingURL=upstream.js.map