@samebase/identity-broker 0.1.0 → 0.3.0

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (36) hide show
  1. package/README.md +17 -3
  2. package/dist/cli/index.js +18 -5
  3. package/dist/cli/index.js.map +1 -1
  4. package/dist/client/connectors/google.d.ts +5 -1
  5. package/dist/client/connectors/google.js +6 -1
  6. package/dist/client/connectors/google.js.map +1 -1
  7. package/dist/client/connectors/types.d.ts +5 -0
  8. package/dist/client/html.d.ts +5 -1
  9. package/dist/client/html.js +17 -7
  10. package/dist/client/html.js.map +1 -1
  11. package/dist/client/index.d.ts +16 -1
  12. package/dist/client/index.js +201 -43
  13. package/dist/client/index.js.map +1 -1
  14. package/dist/client/keys.d.ts +5 -0
  15. package/dist/client/keys.js +8 -0
  16. package/dist/client/keys.js.map +1 -1
  17. package/dist/client/protocol.d.ts +7 -2
  18. package/dist/client/protocol.js +39 -11
  19. package/dist/client/protocol.js.map +1 -1
  20. package/dist/client/responses.d.ts +7 -1
  21. package/dist/client/responses.js +8 -3
  22. package/dist/client/responses.js.map +1 -1
  23. package/dist/component/_generated/component.d.ts +28 -1
  24. package/dist/component/authRequests.d.ts +30 -4
  25. package/dist/component/authRequests.js +92 -11
  26. package/dist/component/authRequests.js.map +1 -1
  27. package/dist/component/lifecycle.d.ts +14 -3
  28. package/dist/component/lifecycle.js +106 -49
  29. package/dist/component/lifecycle.js.map +1 -1
  30. package/dist/component/registration.d.ts +12 -0
  31. package/dist/component/registration.js +33 -0
  32. package/dist/component/registration.js.map +1 -1
  33. package/dist/component/schema.d.ts +119 -10
  34. package/dist/component/schema.js +21 -2
  35. package/dist/component/schema.js.map +1 -1
  36. package/package.json +1 -1
package/dist/component/schema.d.ts CHANGED
@@ -35,6 +35,7 @@ export declare const vAuthRequest: import("convex/values").VUnion<{
35
35
  scope: string;
36
36
  state?: string;
37
37
  status: "pending";
38
+ txnCookieHash?: string;
38
39
  } | {
39
40
  appId: string;
40
41
  clientId: string;
@@ -49,6 +50,7 @@ export declare const vAuthRequest: import("convex/values").VUnion<{
49
50
  scope: string;
50
51
  state?: string;
51
52
  status: "upstream";
53
+ txnCookieHash?: string;
52
54
  upstreamCodeVerifier: string;
53
55
  upstreamNonce?: string;
54
56
  upstreamStateHash: string;
@@ -66,6 +68,7 @@ export declare const vAuthRequest: import("convex/values").VUnion<{
66
68
  scope: string;
67
69
  state?: string;
68
70
  status: "claimed";
71
+ txnCookieHash?: string;
69
72
  } | {
70
73
  appId: string;
71
74
  clientId: string;
@@ -76,6 +79,8 @@ export declare const vAuthRequest: import("convex/values").VUnion<{
76
79
  emailAttempts: number;
77
80
  emailCodeExpiresAt: number;
78
81
  emailCodeHash: string;
82
+ emailLastSentAt: number;
83
+ emailSends: number;
79
84
  expiresAt: number;
80
85
  freshLogin: boolean;
81
86
  nonce?: string;
@@ -84,6 +89,7 @@ export declare const vAuthRequest: import("convex/values").VUnion<{
84
89
  scope: string;
85
90
  state?: string;
86
91
  status: "emailSent";
92
+ txnCookieHash?: string;
87
93
  } | {
88
94
  appId: string;
89
95
  authTime: number;
@@ -106,6 +112,7 @@ export declare const vAuthRequest: import("convex/values").VUnion<{
106
112
  scope: string;
107
113
  state?: string;
108
114
  status: "completed";
115
+ txnCookieHash?: string;
109
116
  }, [import("convex/values").VObject<{
110
117
  appId: string;
111
118
  clientId: string;
@@ -119,6 +126,7 @@ export declare const vAuthRequest: import("convex/values").VUnion<{
119
126
  scope: string;
120
127
  state?: string;
121
128
  status: "pending";
129
+ txnCookieHash?: string;
122
130
  }, {
123
131
  requestId: import("convex/values").VString<string, "required">;
124
132
  appId: import("convex/values").VString<string, "required">;
@@ -130,10 +138,16 @@ export declare const vAuthRequest: import("convex/values").VUnion<{
130
138
  codeChallenge: import("convex/values").VString<string, "required">;
131
139
  /** `prompt=login` or `max_age` was sent: the connector must reauthenticate or refuse. */
132
140
  freshLogin: import("convex/values").VBoolean<boolean, "required">;
141
+ /**
142
+ * SHA-256 hex of the request's transaction cookie, set with the chooser page. `/continue`, the
143
+ * connector callback, and the email steps need the cookie, so only the browser that saw the
144
+ * chooser can move the request on. Absent when /authorize skipped the chooser.
145
+ */
146
+ txnCookieHash: import("convex/values").VString<string | undefined, "optional">;
133
147
  createdAt: import("convex/values").VFloat64<number, "required">;
134
148
  expiresAt: import("convex/values").VFloat64<number, "required">;
135
149
  status: import("convex/values").VLiteral<"pending", "required">;
136
- }, "required", "appId" | "clientId" | "codeChallenge" | "createdAt" | "expiresAt" | "freshLogin" | "nonce" | "redirectUri" | "requestId" | "scope" | "state" | "status">, import("convex/values").VObject<{
150
+ }, "required", "appId" | "clientId" | "codeChallenge" | "createdAt" | "expiresAt" | "freshLogin" | "nonce" | "redirectUri" | "requestId" | "scope" | "state" | "status" | "txnCookieHash">, import("convex/values").VObject<{
137
151
  appId: string;
138
152
  clientId: string;
139
153
  codeChallenge: string;
@@ -147,6 +161,7 @@ export declare const vAuthRequest: import("convex/values").VUnion<{
147
161
  scope: string;
148
162
  state?: string;
149
163
  status: "upstream";
164
+ txnCookieHash?: string;
150
165
  upstreamCodeVerifier: string;
151
166
  upstreamNonce?: string;
152
167
  upstreamStateHash: string;
@@ -161,6 +176,12 @@ export declare const vAuthRequest: import("convex/values").VUnion<{
161
176
  codeChallenge: import("convex/values").VString<string, "required">;
162
177
  /** `prompt=login` or `max_age` was sent: the connector must reauthenticate or refuse. */
163
178
  freshLogin: import("convex/values").VBoolean<boolean, "required">;
179
+ /**
180
+ * SHA-256 hex of the request's transaction cookie, set with the chooser page. `/continue`, the
181
+ * connector callback, and the email steps need the cookie, so only the browser that saw the
182
+ * chooser can move the request on. Absent when /authorize skipped the chooser.
183
+ */
184
+ txnCookieHash: import("convex/values").VString<string | undefined, "optional">;
164
185
  createdAt: import("convex/values").VFloat64<number, "required">;
165
186
  expiresAt: import("convex/values").VFloat64<number, "required">;
166
187
  status: import("convex/values").VLiteral<"upstream", "required">;
@@ -168,7 +189,7 @@ export declare const vAuthRequest: import("convex/values").VUnion<{
168
189
  upstreamStateHash: import("convex/values").VString<string, "required">;
169
190
  upstreamCodeVerifier: import("convex/values").VString<string, "required">;
170
191
  upstreamNonce: import("convex/values").VString<string | undefined, "optional">;
171
- }, "required", "appId" | "clientId" | "codeChallenge" | "connector" | "createdAt" | "expiresAt" | "freshLogin" | "nonce" | "redirectUri" | "requestId" | "scope" | "state" | "status" | "upstreamCodeVerifier" | "upstreamNonce" | "upstreamStateHash">, import("convex/values").VObject<{
192
+ }, "required", "appId" | "clientId" | "codeChallenge" | "connector" | "createdAt" | "expiresAt" | "freshLogin" | "nonce" | "redirectUri" | "requestId" | "scope" | "state" | "status" | "txnCookieHash" | "upstreamCodeVerifier" | "upstreamNonce" | "upstreamStateHash">, import("convex/values").VObject<{
172
193
  appId: string;
173
194
  clientId: string;
174
195
  codeChallenge: string;
@@ -182,6 +203,7 @@ export declare const vAuthRequest: import("convex/values").VUnion<{
182
203
  scope: string;
183
204
  state?: string;
184
205
  status: "claimed";
206
+ txnCookieHash?: string;
185
207
  }, {
186
208
  requestId: import("convex/values").VString<string, "required">;
187
209
  appId: import("convex/values").VString<string, "required">;
@@ -193,11 +215,17 @@ export declare const vAuthRequest: import("convex/values").VUnion<{
193
215
  codeChallenge: import("convex/values").VString<string, "required">;
194
216
  /** `prompt=login` or `max_age` was sent: the connector must reauthenticate or refuse. */
195
217
  freshLogin: import("convex/values").VBoolean<boolean, "required">;
218
+ /**
219
+ * SHA-256 hex of the request's transaction cookie, set with the chooser page. `/continue`, the
220
+ * connector callback, and the email steps need the cookie, so only the browser that saw the
221
+ * chooser can move the request on. Absent when /authorize skipped the chooser.
222
+ */
223
+ txnCookieHash: import("convex/values").VString<string | undefined, "optional">;
196
224
  createdAt: import("convex/values").VFloat64<number, "required">;
197
225
  expiresAt: import("convex/values").VFloat64<number, "required">;
198
226
  status: import("convex/values").VLiteral<"claimed", "required">;
199
227
  connector: import("convex/values").VString<string, "required">;
200
- }, "required", "appId" | "clientId" | "codeChallenge" | "connector" | "createdAt" | "expiresAt" | "freshLogin" | "nonce" | "redirectUri" | "requestId" | "scope" | "state" | "status">, import("convex/values").VObject<{
228
+ }, "required", "appId" | "clientId" | "codeChallenge" | "connector" | "createdAt" | "expiresAt" | "freshLogin" | "nonce" | "redirectUri" | "requestId" | "scope" | "state" | "status" | "txnCookieHash">, import("convex/values").VObject<{
201
229
  appId: string;
202
230
  clientId: string;
203
231
  codeChallenge: string;
@@ -207,6 +235,8 @@ export declare const vAuthRequest: import("convex/values").VUnion<{
207
235
  emailAttempts: number;
208
236
  emailCodeExpiresAt: number;
209
237
  emailCodeHash: string;
238
+ emailLastSentAt: number;
239
+ emailSends: number;
210
240
  expiresAt: number;
211
241
  freshLogin: boolean;
212
242
  nonce?: string;
@@ -215,6 +245,7 @@ export declare const vAuthRequest: import("convex/values").VUnion<{
215
245
  scope: string;
216
246
  state?: string;
217
247
  status: "emailSent";
248
+ txnCookieHash?: string;
218
249
  }, {
219
250
  requestId: import("convex/values").VString<string, "required">;
220
251
  appId: import("convex/values").VString<string, "required">;
@@ -226,6 +257,12 @@ export declare const vAuthRequest: import("convex/values").VUnion<{
226
257
  codeChallenge: import("convex/values").VString<string, "required">;
227
258
  /** `prompt=login` or `max_age` was sent: the connector must reauthenticate or refuse. */
228
259
  freshLogin: import("convex/values").VBoolean<boolean, "required">;
260
+ /**
261
+ * SHA-256 hex of the request's transaction cookie, set with the chooser page. `/continue`, the
262
+ * connector callback, and the email steps need the cookie, so only the browser that saw the
263
+ * chooser can move the request on. Absent when /authorize skipped the chooser.
264
+ */
265
+ txnCookieHash: import("convex/values").VString<string | undefined, "optional">;
229
266
  createdAt: import("convex/values").VFloat64<number, "required">;
230
267
  expiresAt: import("convex/values").VFloat64<number, "required">;
231
268
  status: import("convex/values").VLiteral<"emailSent", "required">;
@@ -233,8 +270,12 @@ export declare const vAuthRequest: import("convex/values").VUnion<{
233
270
  email: import("convex/values").VString<string, "required">;
234
271
  emailCodeHash: import("convex/values").VString<string, "required">;
235
272
  emailCodeExpiresAt: import("convex/values").VFloat64<number, "required">;
273
+ /** Wrong codes typed, across every code sent for this request. */
236
274
  emailAttempts: import("convex/values").VFloat64<number, "required">;
237
- }, "required", "appId" | "clientId" | "codeChallenge" | "connector" | "createdAt" | "email" | "emailAttempts" | "emailCodeExpiresAt" | "emailCodeHash" | "expiresAt" | "freshLogin" | "nonce" | "redirectUri" | "requestId" | "scope" | "state" | "status">, import("convex/values").VObject<{
275
+ /** Codes sent for this request. */
276
+ emailSends: import("convex/values").VFloat64<number, "required">;
277
+ emailLastSentAt: import("convex/values").VFloat64<number, "required">;
278
+ }, "required", "appId" | "clientId" | "codeChallenge" | "connector" | "createdAt" | "email" | "emailAttempts" | "emailCodeExpiresAt" | "emailCodeHash" | "emailLastSentAt" | "emailSends" | "expiresAt" | "freshLogin" | "nonce" | "redirectUri" | "requestId" | "scope" | "state" | "status" | "txnCookieHash">, import("convex/values").VObject<{
238
279
  appId: string;
239
280
  authTime: number;
240
281
  clientId: string;
@@ -256,6 +297,7 @@ export declare const vAuthRequest: import("convex/values").VUnion<{
256
297
  scope: string;
257
298
  state?: string;
258
299
  status: "completed";
300
+ txnCookieHash?: string;
259
301
  }, {
260
302
  requestId: import("convex/values").VString<string, "required">;
261
303
  appId: import("convex/values").VString<string, "required">;
@@ -267,6 +309,12 @@ export declare const vAuthRequest: import("convex/values").VUnion<{
267
309
  codeChallenge: import("convex/values").VString<string, "required">;
268
310
  /** `prompt=login` or `max_age` was sent: the connector must reauthenticate or refuse. */
269
311
  freshLogin: import("convex/values").VBoolean<boolean, "required">;
312
+ /**
313
+ * SHA-256 hex of the request's transaction cookie, set with the chooser page. `/continue`, the
314
+ * connector callback, and the email steps need the cookie, so only the browser that saw the
315
+ * chooser can move the request on. Absent when /authorize skipped the chooser.
316
+ */
317
+ txnCookieHash: import("convex/values").VString<string | undefined, "optional">;
270
318
  createdAt: import("convex/values").VFloat64<number, "required">;
271
319
  expiresAt: import("convex/values").VFloat64<number, "required">;
272
320
  status: import("convex/values").VLiteral<"completed", "required">;
@@ -286,7 +334,7 @@ export declare const vAuthRequest: import("convex/values").VUnion<{
286
334
  picture: import("convex/values").VString<string | undefined, "optional">;
287
335
  }, "required", "connector" | "email" | "emailVerified" | "name" | "picture" | "upstreamId">;
288
336
  authTime: import("convex/values").VFloat64<number, "required">;
289
- }, "required", "appId" | "authTime" | "clientId" | "codeChallenge" | "createdAt" | "expiresAt" | "freshLogin" | "identity" | "identity.connector" | "identity.email" | "identity.emailVerified" | "identity.name" | "identity.picture" | "identity.upstreamId" | "nonce" | "redirectUri" | "requestId" | "scope" | "state" | "status">], "required", "appId" | "authTime" | "clientId" | "codeChallenge" | "connector" | "createdAt" | "email" | "emailAttempts" | "emailCodeExpiresAt" | "emailCodeHash" | "expiresAt" | "freshLogin" | "identity" | "identity.connector" | "identity.email" | "identity.emailVerified" | "identity.name" | "identity.picture" | "identity.upstreamId" | "nonce" | "redirectUri" | "requestId" | "scope" | "state" | "status" | "upstreamCodeVerifier" | "upstreamNonce" | "upstreamStateHash">;
337
+ }, "required", "appId" | "authTime" | "clientId" | "codeChallenge" | "createdAt" | "expiresAt" | "freshLogin" | "identity" | "identity.connector" | "identity.email" | "identity.emailVerified" | "identity.name" | "identity.picture" | "identity.upstreamId" | "nonce" | "redirectUri" | "requestId" | "scope" | "state" | "status" | "txnCookieHash">], "required", "appId" | "authTime" | "clientId" | "codeChallenge" | "connector" | "createdAt" | "email" | "emailAttempts" | "emailCodeExpiresAt" | "emailCodeHash" | "emailLastSentAt" | "emailSends" | "expiresAt" | "freshLogin" | "identity" | "identity.connector" | "identity.email" | "identity.emailVerified" | "identity.name" | "identity.picture" | "identity.upstreamId" | "nonce" | "redirectUri" | "requestId" | "scope" | "state" | "status" | "txnCookieHash" | "upstreamCodeVerifier" | "upstreamNonce" | "upstreamStateHash">;
290
338
  declare const _default: import("convex/server").SchemaDefinition<{
291
339
  apps: import("convex/server").TableDefinition<import("convex/values").VObject<{
292
340
  allowedCallbackHosts: string[];
@@ -316,6 +364,7 @@ declare const _default: import("convex/server").SchemaDefinition<{
316
364
  createdAt: import("convex/values").VFloat64<number, "required">;
317
365
  }, "required", "appId" | "createdAt" | "expiresAt" | "tokenHash">, {
318
366
  by_app_id: ["appId", "_creationTime"];
367
+ by_expires_at: ["expiresAt", "_creationTime"];
319
368
  by_token_hash: ["tokenHash", "_creationTime"];
320
369
  }, {}, {}>;
321
370
  clients: import("convex/server").TableDefinition<import("convex/values").VObject<{
@@ -358,6 +407,7 @@ declare const _default: import("convex/server").SchemaDefinition<{
358
407
  scope: string;
359
408
  state?: string;
360
409
  status: "pending";
410
+ txnCookieHash?: string;
361
411
  } | {
362
412
  appId: string;
363
413
  clientId: string;
@@ -372,6 +422,7 @@ declare const _default: import("convex/server").SchemaDefinition<{
372
422
  scope: string;
373
423
  state?: string;
374
424
  status: "upstream";
425
+ txnCookieHash?: string;
375
426
  upstreamCodeVerifier: string;
376
427
  upstreamNonce?: string;
377
428
  upstreamStateHash: string;
@@ -389,6 +440,7 @@ declare const _default: import("convex/server").SchemaDefinition<{
389
440
  scope: string;
390
441
  state?: string;
391
442
  status: "claimed";
443
+ txnCookieHash?: string;
392
444
  } | {
393
445
  appId: string;
394
446
  clientId: string;
@@ -399,6 +451,8 @@ declare const _default: import("convex/server").SchemaDefinition<{
399
451
  emailAttempts: number;
400
452
  emailCodeExpiresAt: number;
401
453
  emailCodeHash: string;
454
+ emailLastSentAt: number;
455
+ emailSends: number;
402
456
  expiresAt: number;
403
457
  freshLogin: boolean;
404
458
  nonce?: string;
@@ -407,6 +461,7 @@ declare const _default: import("convex/server").SchemaDefinition<{
407
461
  scope: string;
408
462
  state?: string;
409
463
  status: "emailSent";
464
+ txnCookieHash?: string;
410
465
  } | {
411
466
  appId: string;
412
467
  authTime: number;
@@ -429,6 +484,7 @@ declare const _default: import("convex/server").SchemaDefinition<{
429
484
  scope: string;
430
485
  state?: string;
431
486
  status: "completed";
487
+ txnCookieHash?: string;
432
488
  }, [import("convex/values").VObject<{
433
489
  appId: string;
434
490
  clientId: string;
@@ -442,6 +498,7 @@ declare const _default: import("convex/server").SchemaDefinition<{
442
498
  scope: string;
443
499
  state?: string;
444
500
  status: "pending";
501
+ txnCookieHash?: string;
445
502
  }, {
446
503
  requestId: import("convex/values").VString<string, "required">;
447
504
  appId: import("convex/values").VString<string, "required">;
@@ -453,10 +510,16 @@ declare const _default: import("convex/server").SchemaDefinition<{
453
510
  codeChallenge: import("convex/values").VString<string, "required">;
454
511
  /** `prompt=login` or `max_age` was sent: the connector must reauthenticate or refuse. */
455
512
  freshLogin: import("convex/values").VBoolean<boolean, "required">;
513
+ /**
514
+ * SHA-256 hex of the request's transaction cookie, set with the chooser page. `/continue`, the
515
+ * connector callback, and the email steps need the cookie, so only the browser that saw the
516
+ * chooser can move the request on. Absent when /authorize skipped the chooser.
517
+ */
518
+ txnCookieHash: import("convex/values").VString<string | undefined, "optional">;
456
519
  createdAt: import("convex/values").VFloat64<number, "required">;
457
520
  expiresAt: import("convex/values").VFloat64<number, "required">;
458
521
  status: import("convex/values").VLiteral<"pending", "required">;
459
- }, "required", "appId" | "clientId" | "codeChallenge" | "createdAt" | "expiresAt" | "freshLogin" | "nonce" | "redirectUri" | "requestId" | "scope" | "state" | "status">, import("convex/values").VObject<{
522
+ }, "required", "appId" | "clientId" | "codeChallenge" | "createdAt" | "expiresAt" | "freshLogin" | "nonce" | "redirectUri" | "requestId" | "scope" | "state" | "status" | "txnCookieHash">, import("convex/values").VObject<{
460
523
  appId: string;
461
524
  clientId: string;
462
525
  codeChallenge: string;
@@ -470,6 +533,7 @@ declare const _default: import("convex/server").SchemaDefinition<{
470
533
  scope: string;
471
534
  state?: string;
472
535
  status: "upstream";
536
+ txnCookieHash?: string;
473
537
  upstreamCodeVerifier: string;
474
538
  upstreamNonce?: string;
475
539
  upstreamStateHash: string;
@@ -484,6 +548,12 @@ declare const _default: import("convex/server").SchemaDefinition<{
484
548
  codeChallenge: import("convex/values").VString<string, "required">;
485
549
  /** `prompt=login` or `max_age` was sent: the connector must reauthenticate or refuse. */
486
550
  freshLogin: import("convex/values").VBoolean<boolean, "required">;
551
+ /**
552
+ * SHA-256 hex of the request's transaction cookie, set with the chooser page. `/continue`, the
553
+ * connector callback, and the email steps need the cookie, so only the browser that saw the
554
+ * chooser can move the request on. Absent when /authorize skipped the chooser.
555
+ */
556
+ txnCookieHash: import("convex/values").VString<string | undefined, "optional">;
487
557
  createdAt: import("convex/values").VFloat64<number, "required">;
488
558
  expiresAt: import("convex/values").VFloat64<number, "required">;
489
559
  status: import("convex/values").VLiteral<"upstream", "required">;
@@ -491,7 +561,7 @@ declare const _default: import("convex/server").SchemaDefinition<{
491
561
  upstreamStateHash: import("convex/values").VString<string, "required">;
492
562
  upstreamCodeVerifier: import("convex/values").VString<string, "required">;
493
563
  upstreamNonce: import("convex/values").VString<string | undefined, "optional">;
494
- }, "required", "appId" | "clientId" | "codeChallenge" | "connector" | "createdAt" | "expiresAt" | "freshLogin" | "nonce" | "redirectUri" | "requestId" | "scope" | "state" | "status" | "upstreamCodeVerifier" | "upstreamNonce" | "upstreamStateHash">, import("convex/values").VObject<{
564
+ }, "required", "appId" | "clientId" | "codeChallenge" | "connector" | "createdAt" | "expiresAt" | "freshLogin" | "nonce" | "redirectUri" | "requestId" | "scope" | "state" | "status" | "txnCookieHash" | "upstreamCodeVerifier" | "upstreamNonce" | "upstreamStateHash">, import("convex/values").VObject<{
495
565
  appId: string;
496
566
  clientId: string;
497
567
  codeChallenge: string;
@@ -505,6 +575,7 @@ declare const _default: import("convex/server").SchemaDefinition<{
505
575
  scope: string;
506
576
  state?: string;
507
577
  status: "claimed";
578
+ txnCookieHash?: string;
508
579
  }, {
509
580
  requestId: import("convex/values").VString<string, "required">;
510
581
  appId: import("convex/values").VString<string, "required">;
@@ -516,11 +587,17 @@ declare const _default: import("convex/server").SchemaDefinition<{
516
587
  codeChallenge: import("convex/values").VString<string, "required">;
517
588
  /** `prompt=login` or `max_age` was sent: the connector must reauthenticate or refuse. */
518
589
  freshLogin: import("convex/values").VBoolean<boolean, "required">;
590
+ /**
591
+ * SHA-256 hex of the request's transaction cookie, set with the chooser page. `/continue`, the
592
+ * connector callback, and the email steps need the cookie, so only the browser that saw the
593
+ * chooser can move the request on. Absent when /authorize skipped the chooser.
594
+ */
595
+ txnCookieHash: import("convex/values").VString<string | undefined, "optional">;
519
596
  createdAt: import("convex/values").VFloat64<number, "required">;
520
597
  expiresAt: import("convex/values").VFloat64<number, "required">;
521
598
  status: import("convex/values").VLiteral<"claimed", "required">;
522
599
  connector: import("convex/values").VString<string, "required">;
523
- }, "required", "appId" | "clientId" | "codeChallenge" | "connector" | "createdAt" | "expiresAt" | "freshLogin" | "nonce" | "redirectUri" | "requestId" | "scope" | "state" | "status">, import("convex/values").VObject<{
600
+ }, "required", "appId" | "clientId" | "codeChallenge" | "connector" | "createdAt" | "expiresAt" | "freshLogin" | "nonce" | "redirectUri" | "requestId" | "scope" | "state" | "status" | "txnCookieHash">, import("convex/values").VObject<{
524
601
  appId: string;
525
602
  clientId: string;
526
603
  codeChallenge: string;
@@ -530,6 +607,8 @@ declare const _default: import("convex/server").SchemaDefinition<{
530
607
  emailAttempts: number;
531
608
  emailCodeExpiresAt: number;
532
609
  emailCodeHash: string;
610
+ emailLastSentAt: number;
611
+ emailSends: number;
533
612
  expiresAt: number;
534
613
  freshLogin: boolean;
535
614
  nonce?: string;
@@ -538,6 +617,7 @@ declare const _default: import("convex/server").SchemaDefinition<{
538
617
  scope: string;
539
618
  state?: string;
540
619
  status: "emailSent";
620
+ txnCookieHash?: string;
541
621
  }, {
542
622
  requestId: import("convex/values").VString<string, "required">;
543
623
  appId: import("convex/values").VString<string, "required">;
@@ -549,6 +629,12 @@ declare const _default: import("convex/server").SchemaDefinition<{
549
629
  codeChallenge: import("convex/values").VString<string, "required">;
550
630
  /** `prompt=login` or `max_age` was sent: the connector must reauthenticate or refuse. */
551
631
  freshLogin: import("convex/values").VBoolean<boolean, "required">;
632
+ /**
633
+ * SHA-256 hex of the request's transaction cookie, set with the chooser page. `/continue`, the
634
+ * connector callback, and the email steps need the cookie, so only the browser that saw the
635
+ * chooser can move the request on. Absent when /authorize skipped the chooser.
636
+ */
637
+ txnCookieHash: import("convex/values").VString<string | undefined, "optional">;
552
638
  createdAt: import("convex/values").VFloat64<number, "required">;
553
639
  expiresAt: import("convex/values").VFloat64<number, "required">;
554
640
  status: import("convex/values").VLiteral<"emailSent", "required">;
@@ -556,8 +642,12 @@ declare const _default: import("convex/server").SchemaDefinition<{
556
642
  email: import("convex/values").VString<string, "required">;
557
643
  emailCodeHash: import("convex/values").VString<string, "required">;
558
644
  emailCodeExpiresAt: import("convex/values").VFloat64<number, "required">;
645
+ /** Wrong codes typed, across every code sent for this request. */
559
646
  emailAttempts: import("convex/values").VFloat64<number, "required">;
560
- }, "required", "appId" | "clientId" | "codeChallenge" | "connector" | "createdAt" | "email" | "emailAttempts" | "emailCodeExpiresAt" | "emailCodeHash" | "expiresAt" | "freshLogin" | "nonce" | "redirectUri" | "requestId" | "scope" | "state" | "status">, import("convex/values").VObject<{
647
+ /** Codes sent for this request. */
648
+ emailSends: import("convex/values").VFloat64<number, "required">;
649
+ emailLastSentAt: import("convex/values").VFloat64<number, "required">;
650
+ }, "required", "appId" | "clientId" | "codeChallenge" | "connector" | "createdAt" | "email" | "emailAttempts" | "emailCodeExpiresAt" | "emailCodeHash" | "emailLastSentAt" | "emailSends" | "expiresAt" | "freshLogin" | "nonce" | "redirectUri" | "requestId" | "scope" | "state" | "status" | "txnCookieHash">, import("convex/values").VObject<{
561
651
  appId: string;
562
652
  authTime: number;
563
653
  clientId: string;
@@ -579,6 +669,7 @@ declare const _default: import("convex/server").SchemaDefinition<{
579
669
  scope: string;
580
670
  state?: string;
581
671
  status: "completed";
672
+ txnCookieHash?: string;
582
673
  }, {
583
674
  requestId: import("convex/values").VString<string, "required">;
584
675
  appId: import("convex/values").VString<string, "required">;
@@ -590,6 +681,12 @@ declare const _default: import("convex/server").SchemaDefinition<{
590
681
  codeChallenge: import("convex/values").VString<string, "required">;
591
682
  /** `prompt=login` or `max_age` was sent: the connector must reauthenticate or refuse. */
592
683
  freshLogin: import("convex/values").VBoolean<boolean, "required">;
684
+ /**
685
+ * SHA-256 hex of the request's transaction cookie, set with the chooser page. `/continue`, the
686
+ * connector callback, and the email steps need the cookie, so only the browser that saw the
687
+ * chooser can move the request on. Absent when /authorize skipped the chooser.
688
+ */
689
+ txnCookieHash: import("convex/values").VString<string | undefined, "optional">;
593
690
  createdAt: import("convex/values").VFloat64<number, "required">;
594
691
  expiresAt: import("convex/values").VFloat64<number, "required">;
595
692
  status: import("convex/values").VLiteral<"completed", "required">;
@@ -609,7 +706,7 @@ declare const _default: import("convex/server").SchemaDefinition<{
609
706
  picture: import("convex/values").VString<string | undefined, "optional">;
610
707
  }, "required", "connector" | "email" | "emailVerified" | "name" | "picture" | "upstreamId">;
611
708
  authTime: import("convex/values").VFloat64<number, "required">;
612
- }, "required", "appId" | "authTime" | "clientId" | "codeChallenge" | "createdAt" | "expiresAt" | "freshLogin" | "identity" | "identity.connector" | "identity.email" | "identity.emailVerified" | "identity.name" | "identity.picture" | "identity.upstreamId" | "nonce" | "redirectUri" | "requestId" | "scope" | "state" | "status">], "required", "appId" | "authTime" | "clientId" | "codeChallenge" | "connector" | "createdAt" | "email" | "emailAttempts" | "emailCodeExpiresAt" | "emailCodeHash" | "expiresAt" | "freshLogin" | "identity" | "identity.connector" | "identity.email" | "identity.emailVerified" | "identity.name" | "identity.picture" | "identity.upstreamId" | "nonce" | "redirectUri" | "requestId" | "scope" | "state" | "status" | "upstreamCodeVerifier" | "upstreamNonce" | "upstreamStateHash">, {
709
+ }, "required", "appId" | "authTime" | "clientId" | "codeChallenge" | "createdAt" | "expiresAt" | "freshLogin" | "identity" | "identity.connector" | "identity.email" | "identity.emailVerified" | "identity.name" | "identity.picture" | "identity.upstreamId" | "nonce" | "redirectUri" | "requestId" | "scope" | "state" | "status" | "txnCookieHash">], "required", "appId" | "authTime" | "clientId" | "codeChallenge" | "connector" | "createdAt" | "email" | "emailAttempts" | "emailCodeExpiresAt" | "emailCodeHash" | "emailLastSentAt" | "emailSends" | "expiresAt" | "freshLogin" | "identity" | "identity.connector" | "identity.email" | "identity.emailVerified" | "identity.name" | "identity.picture" | "identity.upstreamId" | "nonce" | "redirectUri" | "requestId" | "scope" | "state" | "status" | "txnCookieHash" | "upstreamCodeVerifier" | "upstreamNonce" | "upstreamStateHash">, {
613
710
  by_expires_at: ["expiresAt", "_creationTime"];
614
711
  by_request_id: ["requestId", "_creationTime"];
615
712
  by_upstream_state_hash: ["upstreamStateHash", "_creationTime"];
@@ -630,6 +727,18 @@ declare const _default: import("convex/server").SchemaDefinition<{
630
727
  by_code_hash: ["codeHash", "_creationTime"];
631
728
  by_expires_at: ["expiresAt", "_creationTime"];
632
729
  }, {}, {}>;
730
+ /** One row per email code sent, kept for the rolling send window; no address, only its hash. */
731
+ emailSends: import("convex/server").TableDefinition<import("convex/values").VObject<{
732
+ at: number;
733
+ emailHash: string;
734
+ }, {
735
+ /** SHA-256 hex of the canonical address. */
736
+ emailHash: import("convex/values").VString<string, "required">;
737
+ at: import("convex/values").VFloat64<number, "required">;
738
+ }, "required", "at" | "emailHash">, {
739
+ by_at: ["at", "_creationTime"];
740
+ by_email_hash_and_at: ["emailHash", "at", "_creationTime"];
741
+ }, {}, {}>;
633
742
  signIns: import("convex/server").TableDefinition<import("convex/values").VObject<{
634
743
  appId: string;
635
744
  at: number;
package/dist/component/schema.js CHANGED
@@ -30,6 +30,12 @@ const authRequestFields = {
30
30
  codeChallenge: string(),
31
31
  /** `prompt=login` or `max_age` was sent: the connector must reauthenticate or refuse. */
32
32
  freshLogin: boolean(),
33
+ /**
34
+ * SHA-256 hex of the request's transaction cookie, set with the chooser page. `/continue`, the
35
+ * connector callback, and the email steps need the cookie, so only the browser that saw the
36
+ * chooser can move the request on. Absent when /authorize skipped the chooser.
37
+ */
38
+ txnCookieHash: optional(string()),
33
39
  createdAt: number(),
34
40
  expiresAt: number(),
35
41
  };
@@ -47,7 +53,7 @@ object({
47
53
  }),
48
54
  // The connector callback arrived and the code exchange is running; a replay finds this and stops.
49
55
  object({ status: literal("claimed"), ...authRequestFields, connector: string() }),
50
- // An email code was sent; the user types it.
56
+ // An email code was sent; the user types it. A resend replaces the code and keeps the counts.
51
57
  object({
52
58
  status: literal("emailSent"),
53
59
  ...authRequestFields,
@@ -55,7 +61,11 @@ object({
55
61
  email: string(),
56
62
  emailCodeHash: string(),
57
63
  emailCodeExpiresAt: number(),
64
+ /** Wrong codes typed, across every code sent for this request. */
58
65
  emailAttempts: number(),
66
+ /** Codes sent for this request. */
67
+ emailSends: number(),
68
+ emailLastSentAt: number(),
59
69
  }),
60
70
  // The connector attested the identity; the authorization code points here until it is exchanged.
61
71
  object({
@@ -80,7 +90,8 @@ export default defineSchema({
80
90
  createdAt: number(),
81
91
  })
82
92
  .index("by_token_hash", ["tokenHash"])
83
- .index("by_app_id", ["appId"]),
93
+ .index("by_app_id", ["appId"])
94
+ .index("by_expires_at", ["expiresAt"]),
84
95
  clients: defineTable({
85
96
  clientId: string(),
86
97
  appId: string(),
@@ -109,6 +120,14 @@ export default defineSchema({
109
120
  })
110
121
  .index("by_code_hash", ["codeHash"])
111
122
  .index("by_expires_at", ["expiresAt"]),
123
+ /** One row per email code sent, kept for the rolling send window; no address, only its hash. */
124
+ emailSends: defineTable({
125
+ /** SHA-256 hex of the canonical address. */
126
+ emailHash: string(),
127
+ at: number(),
128
+ })
129
+ .index("by_email_hash_and_at", ["emailHash", "at"])
130
+ .index("by_at", ["at"]),
112
131
  signIns: defineTable({
113
132
  appId: string(),
114
133
  clientId: string(),
package/dist/component/schema.js.map CHANGED
@@ -1 +1 @@
1
- {"version":3,"file":"schema.js","sourceRoot":"","sources":["../../src/component/schema.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAE,WAAW,EAAE,MAAM,eAAe,CAAC;AAC1D,OAAO,EAAE,CAAC,EAAE,MAAM,eAAe,CAAC;AAElC,MAAM,EAAE,KAAK,EAAE,OAAO,EAAE,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,KAAK,EAAE,GAAG,CAAC,CAAC;AAE/E,8FAA8F;AAC9F,MAAM,CAAC,MAAM,wBAAwB,GAAG,KAAK,CAC3C,OAAO,CAAC,oBAAoB,CAAC,EAC7B,OAAO,CAAC,qBAAqB,CAAC,CAC/B,CAAC;AAEF,sGAAsG;AACtG,MAAM,CAAC,MAAM,eAAe,GAAG,KAAK,CAClC,OAAO,CAAC,YAAY,CAAC,EACrB,OAAO,CAAC,aAAa,CAAC,EACtB,OAAO,CAAC,SAAS,CAAC,CACnB,CAAC;AAEF;;;;GAIG;AACH,MAAM,CAAC,MAAM,iBAAiB,GAAG,MAAM,CAAC;IACtC,SAAS,EAAE,MAAM,EAAE;IACnB,UAAU,EAAE,MAAM,EAAE;IACpB,KAAK,EAAE,QAAQ,CAAC,MAAM,EAAE,CAAC;IACzB,aAAa,EAAE,QAAQ,CAAC,OAAO,EAAE,CAAC;IAClC,IAAI,EAAE,QAAQ,CAAC,MAAM,EAAE,CAAC;IACxB,OAAO,EAAE,QAAQ,CAAC,MAAM,EAAE,CAAC;CAC5B,CAAC,CAAC;AAEH,4FAA4F;AAC5F,MAAM,iBAAiB,GAAG;IACxB,SAAS,EAAE,MAAM,EAAE;IACnB,KAAK,EAAE,MAAM,EAAE;IACf,QAAQ,EAAE,MAAM,EAAE;IAClB,WAAW,EAAE,MAAM,EAAE;IACrB,KAAK,EAAE,MAAM,EAAE;IACf,KAAK,EAAE,QAAQ,CAAC,MAAM,EAAE,CAAC;IACzB,KAAK,EAAE,QAAQ,CAAC,MAAM,EAAE,CAAC;IACzB,aAAa,EAAE,MAAM,EAAE;IACvB,yFAAyF;IACzF,UAAU,EAAE,OAAO,EAAE;IACrB,SAAS,EAAE,MAAM,EAAE;IACnB,SAAS,EAAE,MAAM,EAAE;CACpB,CAAC;AAEF,MAAM,CAAC,MAAM,YAAY,GAAG,KAAK;AAC/B,iEAAiE;AACjE,MAAM,CAAC,EAAE,MAAM,EAAE,OAAO,CAAC,SAAS,CAAC,EAAE,GAAG,iBAAiB,EAAE,CAAC;AAC5D,+FAA+F;AAC/F,MAAM,CAAC;IACL,MAAM,EAAE,OAAO,CAAC,UAAU,CAAC;IAC3B,GAAG,iBAAiB;IACpB,SAAS,EAAE,MAAM,EAAE;IACnB,iBAAiB,EAAE,MAAM,EAAE;IAC3B,oBAAoB,EAAE,MAAM,EAAE;IAC9B,aAAa,EAAE,QAAQ,CAAC,MAAM,EAAE,CAAC;CAClC,CAAC;AACF,kGAAkG;AAClG,MAAM,CAAC,EAAE,MAAM,EAAE,OAAO,CAAC,SAAS,CAAC,EAAE,GAAG,iBAAiB,EAAE,SAAS,EAAE,MAAM,EAAE,EAAE,CAAC;AACjF,6CAA6C;AAC7C,MAAM,CAAC;IACL,MAAM,EAAE,OAAO,CAAC,WAAW,CAAC;IAC5B,GAAG,iBAAiB;IACpB,SAAS,EAAE,MAAM,EAAE;IACnB,KAAK,EAAE,MAAM,EAAE;IACf,aAAa,EAAE,MAAM,EAAE;IACvB,kBAAkB,EAAE,MAAM,EAAE;IAC5B,aAAa,EAAE,MAAM,EAAE;CACxB,CAAC;AACF,iGAAiG;AACjG,MAAM,CAAC;IACL,MAAM,EAAE,OAAO,CAAC,WAAW,CAAC;IAC5B,GAAG,iBAAiB;IACpB,QAAQ,EAAE,iBAAiB;IAC3B,QAAQ,EAAE,MAAM,EAAE;CACnB,CAAC,CACH,CAAC;AAEF,eAAe,YAAY,CAAC;IAC1B,IAAI,EAAE,WAAW,CAAC;QAChB,KAAK,EAAE,MAAM,EAAE;QACf,IAAI,EAAE,MAAM,EAAE;QACd,UAAU,EAAE,OAAO,EAAE;QACrB,0FAA0F;QAC1F,oBAAoB,EAAE,KAAK,CAAC,MAAM,EAAE,CAAC;QACrC,SAAS,EAAE,MAAM,EAAE;KACpB,CAAC,CAAC,KAAK,CAAC,WAAW,EAAE,CAAC,OAAO,CAAC,CAAC;IAEhC,kBAAkB,EAAE,WAAW,CAAC;QAC9B,SAAS,EAAE,MAAM,EAAE;QACnB,KAAK,EAAE,MAAM,EAAE;QACf,SAAS,EAAE,MAAM,EAAE;QACnB,SAAS,EAAE,MAAM,EAAE;KACpB,CAAC;SACC,KAAK,CAAC,eAAe,EAAE,CAAC,WAAW,CAAC,CAAC;SACrC,KAAK,CAAC,WAAW,EAAE,CAAC,OAAO,CAAC,CAAC;IAEhC,OAAO,EAAE,WAAW,CAAC;QACnB,QAAQ,EAAE,MAAM,EAAE;QAClB,KAAK,EAAE,MAAM,EAAE;QACf,UAAU,EAAE,MAAM,EAAE;QACpB,uBAAuB,EAAE,wBAAwB;QACjD,WAAW,EAAE,MAAM,EAAE;QACrB,cAAc,EAAE,eAAe;QAC/B,UAAU,EAAE,MAAM,EAAE;QACpB,eAAe,EAAE,MAAM,EAAE;QACzB,SAAS,EAAE,MAAM,EAAE;QACnB,YAAY,EAAE,QAAQ,CAAC,MAAM,EAAE,CAAC;KACjC,CAAC;SACC,KAAK,CAAC,cAAc,EAAE,CAAC,UAAU,CAAC,CAAC;SACnC,KAAK,CAAC,WAAW,EAAE,CAAC,OAAO,CAAC,CAAC;SAC7B,KAAK,CAAC,oBAAoB,EAAE,CAAC,gBAAgB,CAAC,CAAC;IAElD,YAAY,EAAE,WAAW,CAAC,YAAY,CAAC;SACpC,KAAK,CAAC,eAAe,EAAE,CAAC,WAAW,CAAC,CAAC;SACrC,KAAK,CAAC,wBAAwB,EAAE,CAAC,mBAAmB,CAAC,CAAC;SACtD,KAAK,CAAC,eAAe,EAAE,CAAC,WAAW,CAAC,CAAC;IAExC,kBAAkB,EAAE,WAAW,CAAC;QAC9B,QAAQ,EAAE,MAAM,EAAE;QAClB,aAAa,EAAE,CAAC,CAAC,EAAE,CAAC,cAAc,CAAC;QACnC,QAAQ,EAAE,MAAM,EAAE;QAClB,SAAS,EAAE,MAAM,EAAE;QACnB,MAAM,EAAE,QAAQ,CAAC,MAAM,EAAE,CAAC;KAC3B,CAAC;SACC,KAAK,CAAC,cAAc,EAAE,CAAC,UAAU,CAAC,CAAC;SACnC,KAAK,CAAC,eAAe,EAAE,CAAC,WAAW,CAAC,CAAC;IAExC,OAAO,EAAE,WAAW,CAAC;QACnB,KAAK,EAAE,MAAM,EAAE;QACf,QAAQ,EAAE,MAAM,EAAE;QAClB,SAAS,EAAE,MAAM,EAAE;QACnB,GAAG,EAAE,MAAM,EAAE;QACb,EAAE,EAAE,MAAM,EAAE;KACb,CAAC;SACC,KAAK,CAAC,kBAAkB,EAAE,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC;SAC1C,KAAK,CAAC,OAAO,EAAE,CAAC,IAAI,CAAC,CAAC;CAC1B,CAAC,CAAC"}
1
+ {"version":3,"file":"schema.js","sourceRoot":"","sources":["../../src/component/schema.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAE,WAAW,EAAE,MAAM,eAAe,CAAC;AAC1D,OAAO,EAAE,CAAC,EAAE,MAAM,eAAe,CAAC;AAElC,MAAM,EAAE,KAAK,EAAE,OAAO,EAAE,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,KAAK,EAAE,GAAG,CAAC,CAAC;AAE/E,8FAA8F;AAC9F,MAAM,CAAC,MAAM,wBAAwB,GAAG,KAAK,CAC3C,OAAO,CAAC,oBAAoB,CAAC,EAC7B,OAAO,CAAC,qBAAqB,CAAC,CAC/B,CAAC;AAEF,sGAAsG;AACtG,MAAM,CAAC,MAAM,eAAe,GAAG,KAAK,CAClC,OAAO,CAAC,YAAY,CAAC,EACrB,OAAO,CAAC,aAAa,CAAC,EACtB,OAAO,CAAC,SAAS,CAAC,CACnB,CAAC;AAEF;;;;GAIG;AACH,MAAM,CAAC,MAAM,iBAAiB,GAAG,MAAM,CAAC;IACtC,SAAS,EAAE,MAAM,EAAE;IACnB,UAAU,EAAE,MAAM,EAAE;IACpB,KAAK,EAAE,QAAQ,CAAC,MAAM,EAAE,CAAC;IACzB,aAAa,EAAE,QAAQ,CAAC,OAAO,EAAE,CAAC;IAClC,IAAI,EAAE,QAAQ,CAAC,MAAM,EAAE,CAAC;IACxB,OAAO,EAAE,QAAQ,CAAC,MAAM,EAAE,CAAC;CAC5B,CAAC,CAAC;AAEH,4FAA4F;AAC5F,MAAM,iBAAiB,GAAG;IACxB,SAAS,EAAE,MAAM,EAAE;IACnB,KAAK,EAAE,MAAM,EAAE;IACf,QAAQ,EAAE,MAAM,EAAE;IAClB,WAAW,EAAE,MAAM,EAAE;IACrB,KAAK,EAAE,MAAM,EAAE;IACf,KAAK,EAAE,QAAQ,CAAC,MAAM,EAAE,CAAC;IACzB,KAAK,EAAE,QAAQ,CAAC,MAAM,EAAE,CAAC;IACzB,aAAa,EAAE,MAAM,EAAE;IACvB,yFAAyF;IACzF,UAAU,EAAE,OAAO,EAAE;IACrB;;;;OAIG;IACH,aAAa,EAAE,QAAQ,CAAC,MAAM,EAAE,CAAC;IACjC,SAAS,EAAE,MAAM,EAAE;IACnB,SAAS,EAAE,MAAM,EAAE;CACpB,CAAC;AAEF,MAAM,CAAC,MAAM,YAAY,GAAG,KAAK;AAC/B,iEAAiE;AACjE,MAAM,CAAC,EAAE,MAAM,EAAE,OAAO,CAAC,SAAS,CAAC,EAAE,GAAG,iBAAiB,EAAE,CAAC;AAC5D,+FAA+F;AAC/F,MAAM,CAAC;IACL,MAAM,EAAE,OAAO,CAAC,UAAU,CAAC;IAC3B,GAAG,iBAAiB;IACpB,SAAS,EAAE,MAAM,EAAE;IACnB,iBAAiB,EAAE,MAAM,EAAE;IAC3B,oBAAoB,EAAE,MAAM,EAAE;IAC9B,aAAa,EAAE,QAAQ,CAAC,MAAM,EAAE,CAAC;CAClC,CAAC;AACF,kGAAkG;AAClG,MAAM,CAAC,EAAE,MAAM,EAAE,OAAO,CAAC,SAAS,CAAC,EAAE,GAAG,iBAAiB,EAAE,SAAS,EAAE,MAAM,EAAE,EAAE,CAAC;AACjF,8FAA8F;AAC9F,MAAM,CAAC;IACL,MAAM,EAAE,OAAO,CAAC,WAAW,CAAC;IAC5B,GAAG,iBAAiB;IACpB,SAAS,EAAE,MAAM,EAAE;IACnB,KAAK,EAAE,MAAM,EAAE;IACf,aAAa,EAAE,MAAM,EAAE;IACvB,kBAAkB,EAAE,MAAM,EAAE;IAC5B,kEAAkE;IAClE,aAAa,EAAE,MAAM,EAAE;IACvB,mCAAmC;IACnC,UAAU,EAAE,MAAM,EAAE;IACpB,eAAe,EAAE,MAAM,EAAE;CAC1B,CAAC;AACF,iGAAiG;AACjG,MAAM,CAAC;IACL,MAAM,EAAE,OAAO,CAAC,WAAW,CAAC;IAC5B,GAAG,iBAAiB;IACpB,QAAQ,EAAE,iBAAiB;IAC3B,QAAQ,EAAE,MAAM,EAAE;CACnB,CAAC,CACH,CAAC;AAEF,eAAe,YAAY,CAAC;IAC1B,IAAI,EAAE,WAAW,CAAC;QAChB,KAAK,EAAE,MAAM,EAAE;QACf,IAAI,EAAE,MAAM,EAAE;QACd,UAAU,EAAE,OAAO,EAAE;QACrB,0FAA0F;QAC1F,oBAAoB,EAAE,KAAK,CAAC,MAAM,EAAE,CAAC;QACrC,SAAS,EAAE,MAAM,EAAE;KACpB,CAAC,CAAC,KAAK,CAAC,WAAW,EAAE,CAAC,OAAO,CAAC,CAAC;IAEhC,kBAAkB,EAAE,WAAW,CAAC;QAC9B,SAAS,EAAE,MAAM,EAAE;QACnB,KAAK,EAAE,MAAM,EAAE;QACf,SAAS,EAAE,MAAM,EAAE;QACnB,SAAS,EAAE,MAAM,EAAE;KACpB,CAAC;SACC,KAAK,CAAC,eAAe,EAAE,CAAC,WAAW,CAAC,CAAC;SACrC,KAAK,CAAC,WAAW,EAAE,CAAC,OAAO,CAAC,CAAC;SAC7B,KAAK,CAAC,eAAe,EAAE,CAAC,WAAW,CAAC,CAAC;IAExC,OAAO,EAAE,WAAW,CAAC;QACnB,QAAQ,EAAE,MAAM,EAAE;QAClB,KAAK,EAAE,MAAM,EAAE;QACf,UAAU,EAAE,MAAM,EAAE;QACpB,uBAAuB,EAAE,wBAAwB;QACjD,WAAW,EAAE,MAAM,EAAE;QACrB,cAAc,EAAE,eAAe;QAC/B,UAAU,EAAE,MAAM,EAAE;QACpB,eAAe,EAAE,MAAM,EAAE;QACzB,SAAS,EAAE,MAAM,EAAE;QACnB,YAAY,EAAE,QAAQ,CAAC,MAAM,EAAE,CAAC;KACjC,CAAC;SACC,KAAK,CAAC,cAAc,EAAE,CAAC,UAAU,CAAC,CAAC;SACnC,KAAK,CAAC,WAAW,EAAE,CAAC,OAAO,CAAC,CAAC;SAC7B,KAAK,CAAC,oBAAoB,EAAE,CAAC,gBAAgB,CAAC,CAAC;IAElD,YAAY,EAAE,WAAW,CAAC,YAAY,CAAC;SACpC,KAAK,CAAC,eAAe,EAAE,CAAC,WAAW,CAAC,CAAC;SACrC,KAAK,CAAC,wBAAwB,EAAE,CAAC,mBAAmB,CAAC,CAAC;SACtD,KAAK,CAAC,eAAe,EAAE,CAAC,WAAW,CAAC,CAAC;IAExC,kBAAkB,EAAE,WAAW,CAAC;QAC9B,QAAQ,EAAE,MAAM,EAAE;QAClB,aAAa,EAAE,CAAC,CAAC,EAAE,CAAC,cAAc,CAAC;QACnC,QAAQ,EAAE,MAAM,EAAE;QAClB,SAAS,EAAE,MAAM,EAAE;QACnB,MAAM,EAAE,QAAQ,CAAC,MAAM,EAAE,CAAC;KAC3B,CAAC;SACC,KAAK,CAAC,cAAc,EAAE,CAAC,UAAU,CAAC,CAAC;SACnC,KAAK,CAAC,eAAe,EAAE,CAAC,WAAW,CAAC,CAAC;IAExC,gGAAgG;IAChG,UAAU,EAAE,WAAW,CAAC;QACtB,4CAA4C;QAC5C,SAAS,EAAE,MAAM,EAAE;QACnB,EAAE,EAAE,MAAM,EAAE;KACb,CAAC;SACC,KAAK,CAAC,sBAAsB,EAAE,CAAC,WAAW,EAAE,IAAI,CAAC,CAAC;SAClD,KAAK,CAAC,OAAO,EAAE,CAAC,IAAI,CAAC,CAAC;IAEzB,OAAO,EAAE,WAAW,CAAC;QACnB,KAAK,EAAE,MAAM,EAAE;QACf,QAAQ,EAAE,MAAM,EAAE;QAClB,SAAS,EAAE,MAAM,EAAE;QACnB,GAAG,EAAE,MAAM,EAAE;QACb,EAAE,EAAE,MAAM,EAAE;KACb,CAAC;SACC,KAAK,CAAC,kBAAkB,EAAE,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC;SAC1C,KAAK,CAAC,OAAO,EAAE,CAAC,IAAI,CAAC,CAAC;CAC1B,CAAC,CAAC"}
package/package.json CHANGED
@@ -1,6 +1,6 @@
1
1
  {
2
2
  "name": "@samebase/identity-broker",
3
- "version": "0.1.0",
3
+ "version": "0.3.0",
4
4
  "description": "An OpenID Provider for Convex that holds a team's upstream sign-in connections once and keeps no user accounts.",
5
5
  "license": "Apache-2.0",
6
6
  "repository": {