@samebase/identity-broker 0.0.0-stage → 0.2.0

package/dist/component/schema.js

@@ -0,0 +1,140 @@
+import { defineSchema, defineTable } from "convex/server";
+import { v } from "convex/values";
+const { array, boolean, literal, number, object, optional, string, union } = v;
+/** How a client authenticates at the token endpoint. Public clients are not supported yet. */
+export const vTokenEndpointAuthMethod = union(literal("client_secret_post"), literal("client_secret_basic"));
+/** The deployment a client stands for. Preview clients are pruned; the others are deleted by hand. */
+export const vDeploymentType = union(literal("production"), literal("development"), literal("preview"));
+/**
+ * What a connector attested about the user. `upstreamId` is the connector's own stable id for the
+ * account (the GitHub user id, the OIDC `sub`, the canonical email address). The pairwise subject
+ * is derived from it on the host, where the salt lives.
+ */
+export const vUpstreamIdentity = object({
+    connector: string(),
+    upstreamId: string(),
+    email: optional(string()),
+    emailVerified: optional(boolean()),
+    name: optional(string()),
+    picture: optional(string()),
+});
+/** The fields every authorization request carries from `/authorize` until it is deleted. */
+const authRequestFields = {
+    requestId: string(),
+    appId: string(),
+    clientId: string(),
+    redirectUri: string(),
+    scope: string(),
+    state: optional(string()),
+    nonce: optional(string()),
+    codeChallenge: string(),
+    /** `prompt=login` or `max_age` was sent: the connector must reauthenticate or refuse. */
+    freshLogin: boolean(),
+    /**
+     * SHA-256 hex of the `broker_txn` cookie set with the chooser page: `/continue` needs the cookie,
+     * so only the browser that saw the chooser can continue. Absent when /authorize skipped the chooser.
+     */
+    txnCookieHash: optional(string()),
+    createdAt: number(),
+    expiresAt: number(),
+};
+export const vAuthRequest = union(
+// Stored by /authorize; the user has not chosen a connector yet.
+object({ status: literal("pending"), ...authRequestFields }), 
+// Redirected to an OAuth or OIDC connector; its callback claims the request by the state hash.
+object({
+    status: literal("upstream"),
+    ...authRequestFields,
+    connector: string(),
+    upstreamStateHash: string(),
+    upstreamCodeVerifier: string(),
+    upstreamNonce: optional(string()),
+}), 
+// The connector callback arrived and the code exchange is running; a replay finds this and stops.
+object({ status: literal("claimed"), ...authRequestFields, connector: string() }), 
+// An email code was sent; the user types it. A resend replaces the code and keeps the counts.
+object({
+    status: literal("emailSent"),
+    ...authRequestFields,
+    connector: string(),
+    email: string(),
+    emailCodeHash: string(),
+    emailCodeExpiresAt: number(),
+    /** Wrong codes typed, across every code sent for this request. */
+    emailAttempts: number(),
+    /** Codes sent for this request. */
+    emailSends: number(),
+    emailLastSentAt: number(),
+}), 
+// The connector attested the identity; the authorization code points here until it is exchanged.
+object({
+    status: literal("completed"),
+    ...authRequestFields,
+    identity: vUpstreamIdentity,
+    authTime: number(),
+}));
+export default defineSchema({
+    apps: defineTable({
+        appId: string(),
+        name: string(),
+        firstParty: boolean(),
+        /** Exact hosts or `*.suffix` patterns a client callback may use, e.g. `*.convex.site`. */
+        allowedCallbackHosts: array(string()),
+        createdAt: number(),
+    }).index("by_app_id", ["appId"]),
+    registrationTokens: defineTable({
+        tokenHash: string(),
+        appId: string(),
+        expiresAt: number(),
+        createdAt: number(),
+    })
+        .index("by_token_hash", ["tokenHash"])
+        .index("by_app_id", ["appId"])
+        .index("by_expires_at", ["expiresAt"]),
+    clients: defineTable({
+        clientId: string(),
+        appId: string(),
+        secretHash: string(),
+        tokenEndpointAuthMethod: vTokenEndpointAuthMethod,
+        redirectUri: string(),
+        deploymentType: vDeploymentType,
+        clientName: string(),
+        softwareVersion: string(),
+        createdAt: number(),
+        lastSignInAt: optional(number()),
+    })
+        .index("by_client_id", ["clientId"])
+        .index("by_app_id", ["appId"])
+        .index("by_deployment_type", ["deploymentType"]),
+    authRequests: defineTable(vAuthRequest)
+        .index("by_request_id", ["requestId"])
+        .index("by_upstream_state_hash", ["upstreamStateHash"])
+        .index("by_expires_at", ["expiresAt"]),
+    authorizationCodes: defineTable({
+        codeHash: string(),
+        authRequestId: v.id("authRequests"),
+        clientId: string(),
+        expiresAt: number(),
+        usedAt: optional(number()),
+    })
+        .index("by_code_hash", ["codeHash"])
+        .index("by_expires_at", ["expiresAt"]),
+    /** One row per email code sent, kept for the rolling send window; no address, only its hash. */
+    emailSends: defineTable({
+        /** SHA-256 hex of the canonical address. */
+        emailHash: string(),
+        at: number(),
+    })
+        .index("by_email_hash_and_at", ["emailHash", "at"])
+        .index("by_at", ["at"]),
+    signIns: defineTable({
+        appId: string(),
+        clientId: string(),
+        connector: string(),
+        sub: string(),
+        at: number(),
+    })
+        .index("by_app_id_and_at", ["appId", "at"])
+        .index("by_at", ["at"]),
+});
+//# sourceMappingURL=schema.js.map

package/dist/component/schema.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"schema.js","sourceRoot":"","sources":["../../src/component/schema.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAE,WAAW,EAAE,MAAM,eAAe,CAAC;AAC1D,OAAO,EAAE,CAAC,EAAE,MAAM,eAAe,CAAC;AAElC,MAAM,EAAE,KAAK,EAAE,OAAO,EAAE,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,KAAK,EAAE,GAAG,CAAC,CAAC;AAE/E,8FAA8F;AAC9F,MAAM,CAAC,MAAM,wBAAwB,GAAG,KAAK,CAC3C,OAAO,CAAC,oBAAoB,CAAC,EAC7B,OAAO,CAAC,qBAAqB,CAAC,CAC/B,CAAC;AAEF,sGAAsG;AACtG,MAAM,CAAC,MAAM,eAAe,GAAG,KAAK,CAClC,OAAO,CAAC,YAAY,CAAC,EACrB,OAAO,CAAC,aAAa,CAAC,EACtB,OAAO,CAAC,SAAS,CAAC,CACnB,CAAC;AAEF;;;;GAIG;AACH,MAAM,CAAC,MAAM,iBAAiB,GAAG,MAAM,CAAC;IACtC,SAAS,EAAE,MAAM,EAAE;IACnB,UAAU,EAAE,MAAM,EAAE;IACpB,KAAK,EAAE,QAAQ,CAAC,MAAM,EAAE,CAAC;IACzB,aAAa,EAAE,QAAQ,CAAC,OAAO,EAAE,CAAC;IAClC,IAAI,EAAE,QAAQ,CAAC,MAAM,EAAE,CAAC;IACxB,OAAO,EAAE,QAAQ,CAAC,MAAM,EAAE,CAAC;CAC5B,CAAC,CAAC;AAEH,4FAA4F;AAC5F,MAAM,iBAAiB,GAAG;IACxB,SAAS,EAAE,MAAM,EAAE;IACnB,KAAK,EAAE,MAAM,EAAE;IACf,QAAQ,EAAE,MAAM,EAAE;IAClB,WAAW,EAAE,MAAM,EAAE;IACrB,KAAK,EAAE,MAAM,EAAE;IACf,KAAK,EAAE,QAAQ,CAAC,MAAM,EAAE,CAAC;IACzB,KAAK,EAAE,QAAQ,CAAC,MAAM,EAAE,CAAC;IACzB,aAAa,EAAE,MAAM,EAAE;IACvB,yFAAyF;IACzF,UAAU,EAAE,OAAO,EAAE;IACrB;;;OAGG;IACH,aAAa,EAAE,QAAQ,CAAC,MAAM,EAAE,CAAC;IACjC,SAAS,EAAE,MAAM,EAAE;IACnB,SAAS,EAAE,MAAM,EAAE;CACpB,CAAC;AAEF,MAAM,CAAC,MAAM,YAAY,GAAG,KAAK;AAC/B,iEAAiE;AACjE,MAAM,CAAC,EAAE,MAAM,EAAE,OAAO,CAAC,SAAS,CAAC,EAAE,GAAG,iBAAiB,EAAE,CAAC;AAC5D,+FAA+F;AAC/F,MAAM,CAAC;IACL,MAAM,EAAE,OAAO,CAAC,UAAU,CAAC;IAC3B,GAAG,iBAAiB;IACpB,SAAS,EAAE,MAAM,EAAE;IACnB,iBAAiB,EAAE,MAAM,EAAE;IAC3B,oBAAoB,EAAE,MAAM,EAAE;IAC9B,aAAa,EAAE,QAAQ,CAAC,MAAM,EAAE,CAAC;CAClC,CAAC;AACF,kGAAkG;AAClG,MAAM,CAAC,EAAE,MAAM,EAAE,OAAO,CAAC,SAAS,CAAC,EAAE,GAAG,iBAAiB,EAAE,SAAS,EAAE,MAAM,EAAE,EAAE,CAAC;AACjF,8FAA8F;AAC9F,MAAM,CAAC;IACL,MAAM,EAAE,OAAO,CAAC,WAAW,CAAC;IAC5B,GAAG,iBAAiB;IACpB,SAAS,EAAE,MAAM,EAAE;IACnB,KAAK,EAAE,MAAM,EAAE;IACf,aAAa,EAAE,MAAM,EAAE;IACvB,kBAAkB,EAAE,MAAM,EAAE;IAC5B,kEAAkE;IAClE,aAAa,EAAE,MAAM,EAAE;IACvB,mCAAmC;IACnC,UAAU,EAAE,MAAM,EAAE;IACpB,eAAe,EAAE,MAAM,EAAE;CAC1B,CAAC;AACF,iGAAiG;AACjG,MAAM,CAAC;IACL,MAAM,EAAE,OAAO,CAAC,WAAW,CAAC;IAC5B,GAAG,iBAAiB;IACpB,QAAQ,EAAE,iBAAiB;IAC3B,QAAQ,EAAE,MAAM,EAAE;CACnB,CAAC,CACH,CAAC;AAEF,eAAe,YAAY,CAAC;IAC1B,IAAI,EAAE,WAAW,CAAC;QAChB,KAAK,EAAE,MAAM,EAAE;QACf,IAAI,EAAE,MAAM,EAAE;QACd,UAAU,EAAE,OAAO,EAAE;QACrB,0FAA0F;QAC1F,oBAAoB,EAAE,KAAK,CAAC,MAAM,EAAE,CAAC;QACrC,SAAS,EAAE,MAAM,EAAE;KACpB,CAAC,CAAC,KAAK,CAAC,WAAW,EAAE,CAAC,OAAO,CAAC,CAAC;IAEhC,kBAAkB,EAAE,WAAW,CAAC;QAC9B,SAAS,EAAE,MAAM,EAAE;QACnB,KAAK,EAAE,MAAM,EAAE;QACf,SAAS,EAAE,MAAM,EAAE;QACnB,SAAS,EAAE,MAAM,EAAE;KACpB,CAAC;SACC,KAAK,CAAC,eAAe,EAAE,CAAC,WAAW,CAAC,CAAC;SACrC,KAAK,CAAC,WAAW,EAAE,CAAC,OAAO,CAAC,CAAC;SAC7B,KAAK,CAAC,eAAe,EAAE,CAAC,WAAW,CAAC,CAAC;IAExC,OAAO,EAAE,WAAW,CAAC;QACnB,QAAQ,EAAE,MAAM,EAAE;QAClB,KAAK,EAAE,MAAM,EAAE;QACf,UAAU,EAAE,MAAM,EAAE;QACpB,uBAAuB,EAAE,wBAAwB;QACjD,WAAW,EAAE,MAAM,EAAE;QACrB,cAAc,EAAE,eAAe;QAC/B,UAAU,EAAE,MAAM,EAAE;QACpB,eAAe,EAAE,MAAM,EAAE;QACzB,SAAS,EAAE,MAAM,EAAE;QACnB,YAAY,EAAE,QAAQ,CAAC,MAAM,EAAE,CAAC;KACjC,CAAC;SACC,KAAK,CAAC,cAAc,EAAE,CAAC,UAAU,CAAC,CAAC;SACnC,KAAK,CAAC,WAAW,EAAE,CAAC,OAAO,CAAC,CAAC;SAC7B,KAAK,CAAC,oBAAoB,EAAE,CAAC,gBAAgB,CAAC,CAAC;IAElD,YAAY,EAAE,WAAW,CAAC,YAAY,CAAC;SACpC,KAAK,CAAC,eAAe,EAAE,CAAC,WAAW,CAAC,CAAC;SACrC,KAAK,CAAC,wBAAwB,EAAE,CAAC,mBAAmB,CAAC,CAAC;SACtD,KAAK,CAAC,eAAe,EAAE,CAAC,WAAW,CAAC,CAAC;IAExC,kBAAkB,EAAE,WAAW,CAAC;QAC9B,QAAQ,EAAE,MAAM,EAAE;QAClB,aAAa,EAAE,CAAC,CAAC,EAAE,CAAC,cAAc,CAAC;QACnC,QAAQ,EAAE,MAAM,EAAE;QAClB,SAAS,EAAE,MAAM,EAAE;QACnB,MAAM,EAAE,QAAQ,CAAC,MAAM,EAAE,CAAC;KAC3B,CAAC;SACC,KAAK,CAAC,cAAc,EAAE,CAAC,UAAU,CAAC,CAAC;SACnC,KAAK,CAAC,eAAe,EAAE,CAAC,WAAW,CAAC,CAAC;IAExC,gGAAgG;IAChG,UAAU,EAAE,WAAW,CAAC;QACtB,4CAA4C;QAC5C,SAAS,EAAE,MAAM,EAAE;QACnB,EAAE,EAAE,MAAM,EAAE;KACb,CAAC;SACC,KAAK,CAAC,sBAAsB,EAAE,CAAC,WAAW,EAAE,IAAI,CAAC,CAAC;SAClD,KAAK,CAAC,OAAO,EAAE,CAAC,IAAI,CAAC,CAAC;IAEzB,OAAO,EAAE,WAAW,CAAC;QACnB,KAAK,EAAE,MAAM,EAAE;QACf,QAAQ,EAAE,MAAM,EAAE;QAClB,SAAS,EAAE,MAAM,EAAE;QACnB,GAAG,EAAE,MAAM,EAAE;QACb,EAAE,EAAE,MAAM,EAAE;KACb,CAAC;SACC,KAAK,CAAC,kBAAkB,EAAE,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC;SAC1C,KAAK,CAAC,OAAO,EAAE,CAAC,IAAI,CAAC,CAAC;CAC1B,CAAC,CAAC"}

package/dist/component/signIns.d.ts

@@ -0,0 +1,8 @@
+/** One audit row per issued id_token: no email, no name, no token. Also marks the client as used. */
+export declare const record: import("convex/server").RegisteredMutation<"public", {
+    appId: string;
+    at: number;
+    clientId: string;
+    connector: string;
+    sub: string;
+}, Promise<null>>;

package/dist/component/signIns.js

@@ -0,0 +1,26 @@
+import { v } from "convex/values";
+import { mutation } from "./_generated/server";
+const { number, string } = v;
+/** One audit row per issued id_token: no email, no name, no token. Also marks the client as used. */
+export const record = mutation({
+    args: { appId: string(), clientId: string(), connector: string(), sub: string(), at: number() },
+    returns: v.null(),
+    handler: async (ctx, args) => {
+        await ctx.db.insert("signIns", {
+            appId: args.appId,
+            clientId: args.clientId,
+            connector: args.connector,
+            sub: args.sub,
+            at: args.at,
+        });
+        const client = await ctx.db
+            .query("clients")
+            .withIndex("by_client_id", (q) => q.eq("clientId", args.clientId))
+            .unique();
+        if (client !== null) {
+            await ctx.db.patch("clients", client._id, { lastSignInAt: args.at });
+        }
+        return null;
+    },
+});
+//# sourceMappingURL=signIns.js.map

package/dist/component/signIns.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"signIns.js","sourceRoot":"","sources":["../../src/component/signIns.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,eAAe,CAAC;AAClC,OAAO,EAAE,QAAQ,EAAE,MAAM,qBAAqB,CAAC;AAE/C,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,GAAG,CAAC,CAAC;AAE7B,qGAAqG;AACrG,MAAM,CAAC,MAAM,MAAM,GAAG,QAAQ,CAAC;IAC7B,IAAI,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,EAAE,QAAQ,EAAE,MAAM,EAAE,EAAE,SAAS,EAAE,MAAM,EAAE,EAAE,GAAG,EAAE,MAAM,EAAE,EAAE,EAAE,EAAE,MAAM,EAAE,EAAE;IAC/F,OAAO,EAAE,CAAC,CAAC,IAAI,EAAE;IACjB,OAAO,EAAE,KAAK,EAAE,GAAG,EAAE,IAAI,EAAE,EAAE;QAC3B,MAAM,GAAG,CAAC,EAAE,CAAC,MAAM,CAAC,SAAS,EAAE;YAC7B,KAAK,EAAE,IAAI,CAAC,KAAK;YACjB,QAAQ,EAAE,IAAI,CAAC,QAAQ;YACvB,SAAS,EAAE,IAAI,CAAC,SAAS;YACzB,GAAG,EAAE,IAAI,CAAC,GAAG;YACb,EAAE,EAAE,IAAI,CAAC,EAAE;SACZ,CAAC,CAAC;QACH,MAAM,MAAM,GAAG,MAAM,GAAG,CAAC,EAAE;aACxB,KAAK,CAAC,SAAS,CAAC;aAChB,SAAS,CAAC,cAAc,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,UAAU,EAAE,IAAI,CAAC,QAAQ,CAAC,CAAC;aACjE,MAAM,EAAE,CAAC;QACZ,IAAI,MAAM,KAAK,IAAI,EAAE,CAAC;YACpB,MAAM,GAAG,CAAC,EAAE,CAAC,KAAK,CAAC,SAAS,EAAE,MAAM,CAAC,GAAG,EAAE,EAAE,YAAY,EAAE,IAAI,CAAC,EAAE,EAAE,CAAC,CAAC;QACvE,CAAC;QACD,OAAO,IAAI,CAAC;IACd,CAAC;CACF,CAAC,CAAC"}

package/package.json

@@ -1,6 +1,54 @@
 {
   "name": "@samebase/identity-broker",
-  "version": "0.0.0-stage",
-  "stub": true,
-  "description": "Temporary package placeholder for staged publishing"
+  "version": "0.2.0",
+  "description": "An OpenID Provider for Convex that holds a team's upstream sign-in connections once and keeps no user accounts.",
+  "license": "Apache-2.0",
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/samebase/identity-broker.git",
+    "directory": "packages/identity-broker"
+  },
+  "bin": {
+    "identity-broker": "./dist/cli/index.js"
+  },
+  "files": [
+    "dist",
+    "LICENSE",
+    "NOTICE",
+    "README.md"
+  ],
+  "type": "module",
+  "exports": {
+    ".": {
+      "types": "./dist/client/index.d.ts",
+      "default": "./dist/client/index.js"
+    },
+    "./convex.config": {
+      "types": "./dist/component/convex.config.d.ts",
+      "default": "./dist/component/convex.config.js"
+    },
+    "./_generated/component.js": {
+      "types": "./dist/component/_generated/component.d.ts"
+    }
+  },
+  "dependencies": {
+    "jose": "6.2.13",
+    "oauth4webapi": "3.8.8"
+  },
+  "devDependencies": {
+    "@types/node": "24.19.2",
+    "convex": "1.47.0",
+    "convex-test": "0.0.61",
+    "openid-client": "6.8.8",
+    "typescript": "7.0.2",
+    "vite-plus": "1.3.0"
+  },
+  "peerDependencies": {
+    "convex": "^1.47.0"
+  },
+  "scripts": {
+    "build": "tsc --build ./tsconfig.build.json --force",
+    "codegen": "convex codegen --component-dir ./src/component",
+    "typecheck": "tsc --noEmit"
+  }
 }