lens-convex-auth 0.1.0

package/dist/cli/index.js

@@ -0,0 +1,36 @@
+#!/usr/bin/env node
+
+// src/cli/index.ts
+import { exportJWK, exportPKCS8, generateKeyPair } from "jose";
+
+// src/core/constants.ts
+var LENS_TOKEN_LIFETIME_MS = 10 * 60 * 1e3;
+var DEFAULT_CONVEX_TOKEN_KEY_ID = "convex-auth-1";
+
+// src/cli/index.ts
+var USAGE = `Usage: npx lens-convex-auth keys [--kid <key id>]
+
+Generates the key pair Convex auth tokens are signed with, and prints:
+  CONVEX_AUTH_PRIVATE_KEY  set on your server (.env.local, Vercel). Keep it secret.
+  CONVEX_AUTH_JWKS         set on your Convex deployment:
+                           npx convex env set CONVEX_AUTH_JWKS '<value>'
+
+Generate one pair per environment (dev, prod) and set both halves of a pair together.
+Pass --kid only if you also pass the same keyId to createConvexTokenHandler.`;
+async function keys(kid) {
+  const { publicKey, privateKey } = await generateKeyPair("RS256", { extractable: true });
+  const pem = await exportPKCS8(privateKey);
+  const jwk = { ...await exportJWK(publicKey), kid, alg: "RS256", use: "sig" };
+  const jwks = JSON.stringify({ keys: [jwk] });
+  console.log(`CONVEX_AUTH_PRIVATE_KEY="${pem.trim().replace(/\n/g, "\\n")}"`);
+  console.log(`CONVEX_AUTH_JWKS=data:text/plain;charset=utf-8;base64,${Buffer.from(jwks).toString("base64")}`);
+}
+var [command, ...args] = process.argv.slice(2);
+if (command === "keys") {
+  const kidIndex = args.indexOf("--kid");
+  await keys(kidIndex >= 0 && args[kidIndex + 1] ? args[kidIndex + 1] : DEFAULT_CONVEX_TOKEN_KEY_ID);
+} else {
+  console.log(USAGE);
+  process.exit(command ? 1 : 0);
+}
+//# sourceMappingURL=index.js.map

package/dist/cli/index.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../src/cli/index.ts","../../src/core/constants.ts"],"sourcesContent":["import { exportJWK, exportPKCS8, generateKeyPair } from \"jose\"\nimport { DEFAULT_CONVEX_TOKEN_KEY_ID } from \"../core/constants\"\n\nconst USAGE = `Usage: npx lens-convex-auth keys [--kid <key id>]\n\nGenerates the key pair Convex auth tokens are signed with, and prints:\n  CONVEX_AUTH_PRIVATE_KEY  set on your server (.env.local, Vercel). Keep it secret.\n  CONVEX_AUTH_JWKS         set on your Convex deployment:\n                           npx convex env set CONVEX_AUTH_JWKS '<value>'\n\nGenerate one pair per environment (dev, prod) and set both halves of a pair together.\nPass --kid only if you also pass the same keyId to createConvexTokenHandler.`\n\nasync function keys(kid: string) {\n  const { publicKey, privateKey } = await generateKeyPair(\"RS256\", { extractable: true })\n  const pem = await exportPKCS8(privateKey)\n  const jwk = { ...(await exportJWK(publicKey)), kid, alg: \"RS256\", use: \"sig\" }\n  const jwks = JSON.stringify({ keys: [jwk] })\n  console.log(`CONVEX_AUTH_PRIVATE_KEY=\"${pem.trim().replace(/\\n/g, \"\\\\n\")}\"`)\n  console.log(`CONVEX_AUTH_JWKS=data:text/plain;charset=utf-8;base64,${Buffer.from(jwks).toString(\"base64\")}`)\n}\n\nconst [command, ...args] = process.argv.slice(2)\nif (command === \"keys\") {\n  const kidIndex = args.indexOf(\"--kid\")\n  await keys(kidIndex >= 0 && args[kidIndex + 1] ? args[kidIndex + 1] : DEFAULT_CONVEX_TOKEN_KEY_ID)\n} else {\n  console.log(USAGE)\n  process.exit(command ? 1 : 0)\n}\n","// Dependency-free values shared by every entry point, including the server and Convex ones.\n\nexport type LensEnvironmentName = \"mainnet\" | \"testnet\"\n\nconst LENS_API_ORIGINS: Record<LensEnvironmentName, string> = {\n  mainnet: \"https://api.lens.xyz\",\n  testnet: \"https://api.testnet.lens.xyz\",\n}\n\n// Lens signs its tokens as the API origin, and publishes its keys under it.\nexport function lensApiOrigin(environment: LensEnvironmentName = \"mainnet\"): string {\n  return LENS_API_ORIGINS[environment]\n}\n\nexport const LENS_CHAIN_IDS: Record<LensEnvironmentName, number> = {\n  mainnet: 232,\n  testnet: 37111,\n}\n\n// Lens access and ID tokens are valid for 10 minutes.\nexport const LENS_TOKEN_LIFETIME_MS = 10 * 60 * 1000\n\nexport const ADDRESS_RE = /^0x[0-9a-fA-F]{40}$/\n\n// The token the server issues for Convex (server/, convex/, cli/). Both sides must agree on these.\nexport const DEFAULT_CONVEX_TOKEN_ISSUER = \"https://lens-convex-auth.local\"\nexport const DEFAULT_CONVEX_TOKEN_AUDIENCE = \"convex\"\nexport const DEFAULT_CONVEX_TOKEN_KEY_ID = \"convex-auth-1\"\nexport const DEFAULT_CONVEX_TOKEN_ENDPOINT = \"/api/convex-token\"\n"],"mappings":";;;AAAA,SAAS,WAAW,aAAa,uBAAuB;;;ACoBjD,IAAM,yBAAyB,KAAK,KAAK;AAOzC,IAAM,8BAA8B;;;ADxB3C,IAAM,QAAQ;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAUd,eAAe,KAAK,KAAa;AAC/B,QAAM,EAAE,WAAW,WAAW,IAAI,MAAM,gBAAgB,SAAS,EAAE,aAAa,KAAK,CAAC;AACtF,QAAM,MAAM,MAAM,YAAY,UAAU;AACxC,QAAM,MAAM,EAAE,GAAI,MAAM,UAAU,SAAS,GAAI,KAAK,KAAK,SAAS,KAAK,MAAM;AAC7E,QAAM,OAAO,KAAK,UAAU,EAAE,MAAM,CAAC,GAAG,EAAE,CAAC;AAC3C,UAAQ,IAAI,4BAA4B,IAAI,KAAK,EAAE,QAAQ,OAAO,KAAK,CAAC,GAAG;AAC3E,UAAQ,IAAI,yDAAyD,OAAO,KAAK,IAAI,EAAE,SAAS,QAAQ,CAAC,EAAE;AAC7G;AAEA,IAAM,CAAC,SAAS,GAAG,IAAI,IAAI,QAAQ,KAAK,MAAM,CAAC;AAC/C,IAAI,YAAY,QAAQ;AACtB,QAAM,WAAW,KAAK,QAAQ,OAAO;AACrC,QAAM,KAAK,YAAY,KAAK,KAAK,WAAW,CAAC,IAAI,KAAK,WAAW,CAAC,IAAI,2BAA2B;AACnG,OAAO;AACL,UAAQ,IAAI,KAAK;AACjB,UAAQ,KAAK,UAAU,IAAI,CAAC;AAC9B;","names":[]}

package/dist/convex/index.d.ts

@@ -0,0 +1,25 @@
+import { Auth } from 'convex/server';
+
+type LensAuthProviderOptions = {
+    /** Public key from `npx lens-convex-auth keys`. Defaults to process.env.CONVEX_AUTH_JWKS */
+    jwks?: string;
+    /** Must match the server's `issuer` option */
+    issuer?: string;
+    /** Must match the server's `audience` option */
+    audience?: string;
+};
+declare function lensAuthProvider(options?: LensAuthProviderOptions): {
+    type: "customJwt";
+    applicationID: string;
+    issuer: string;
+    jwks: string;
+    algorithm: "RS256";
+};
+declare function getLensAccount(ctx: {
+    auth: Auth;
+}): Promise<string | null>;
+declare function requireLensAccount(ctx: {
+    auth: Auth;
+}, message?: string): Promise<string>;
+
+export { type LensAuthProviderOptions, getLensAccount, lensAuthProvider, requireLensAccount };

package/dist/convex/index.js

@@ -0,0 +1,35 @@
+import {
+  ADDRESS_RE,
+  DEFAULT_CONVEX_TOKEN_AUDIENCE,
+  DEFAULT_CONVEX_TOKEN_ISSUER
+} from "../chunk-CDAKZCYM.js";
+
+// src/convex/index.ts
+import { ConvexError } from "convex/values";
+function lensAuthProvider(options = {}) {
+  const jwks = options.jwks ?? process.env.CONVEX_AUTH_JWKS;
+  if (!jwks) throw new Error("lens-convex-auth: set CONVEX_AUTH_JWKS on your Convex deployment");
+  return {
+    type: "customJwt",
+    applicationID: options.audience ?? DEFAULT_CONVEX_TOKEN_AUDIENCE,
+    issuer: options.issuer ?? DEFAULT_CONVEX_TOKEN_ISSUER,
+    jwks,
+    algorithm: "RS256"
+  };
+}
+async function getLensAccount(ctx) {
+  const identity = await ctx.auth.getUserIdentity();
+  const address = identity?.subject;
+  return address && ADDRESS_RE.test(address) ? address.toLowerCase() : null;
+}
+async function requireLensAccount(ctx, message = "Sign in with Lens to continue") {
+  const account = await getLensAccount(ctx);
+  if (!account) throw new ConvexError(message);
+  return account;
+}
+export {
+  getLensAccount,
+  lensAuthProvider,
+  requireLensAccount
+};
+//# sourceMappingURL=index.js.map

package/dist/convex/index.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../src/convex/index.ts"],"sourcesContent":["import { ConvexError } from \"convex/values\"\nimport type { Auth } from \"convex/server\"\nimport { ADDRESS_RE, DEFAULT_CONVEX_TOKEN_AUDIENCE, DEFAULT_CONVEX_TOKEN_ISSUER } from \"../core/constants\"\n\nexport type LensAuthProviderOptions = {\n  /** Public key from `npx lens-convex-auth keys`. Defaults to process.env.CONVEX_AUTH_JWKS */\n  jwks?: string\n  /** Must match the server's `issuer` option */\n  issuer?: string\n  /** Must match the server's `audience` option */\n  audience?: string\n}\n\n// The auth provider for convex/auth.config.ts. Convex then trusts the tokens your server issues after\n// verifying the caller's Lens ID token (createConvexTokenHandler); their subject is the Lens account.\n//   export default { providers: [lensAuthProvider({ jwks: process.env.CONVEX_AUTH_JWKS })] }\nexport function lensAuthProvider(options: LensAuthProviderOptions = {}) {\n  const jwks = options.jwks ?? process.env.CONVEX_AUTH_JWKS\n  if (!jwks) throw new Error(\"lens-convex-auth: set CONVEX_AUTH_JWKS on your Convex deployment\")\n  return {\n    type: \"customJwt\" as const,\n    applicationID: options.audience ?? DEFAULT_CONVEX_TOKEN_AUDIENCE,\n    issuer: options.issuer ?? DEFAULT_CONVEX_TOKEN_ISSUER,\n    jwks,\n    algorithm: \"RS256\" as const,\n  }\n}\n\n// The Lens account the caller signed in as (lowercased address), or null when signed out.\nexport async function getLensAccount(ctx: { auth: Auth }): Promise<string | null> {\n  const identity = await ctx.auth.getUserIdentity()\n  const address = identity?.subject\n  return address && ADDRESS_RE.test(address) ? address.toLowerCase() : null\n}\n\n// Like getLensAccount, but throws a ConvexError when the caller isn't signed in with Lens.\nexport async function requireLensAccount(ctx: { auth: Auth }, message = \"Sign in with Lens to continue\"): Promise<string> {\n  const account = await getLensAccount(ctx)\n  if (!account) throw new ConvexError(message)\n  return account\n}\n"],"mappings":";;;;;;;AAAA,SAAS,mBAAmB;AAgBrB,SAAS,iBAAiB,UAAmC,CAAC,GAAG;AACtE,QAAM,OAAO,QAAQ,QAAQ,QAAQ,IAAI;AACzC,MAAI,CAAC,KAAM,OAAM,IAAI,MAAM,kEAAkE;AAC7F,SAAO;AAAA,IACL,MAAM;AAAA,IACN,eAAe,QAAQ,YAAY;AAAA,IACnC,QAAQ,QAAQ,UAAU;AAAA,IAC1B;AAAA,IACA,WAAW;AAAA,EACb;AACF;AAGA,eAAsB,eAAe,KAA6C;AAChF,QAAM,WAAW,MAAM,IAAI,KAAK,gBAAgB;AAChD,QAAM,UAAU,UAAU;AAC1B,SAAO,WAAW,WAAW,KAAK,OAAO,IAAI,QAAQ,YAAY,IAAI;AACvE;AAGA,eAAsB,mBAAmB,KAAqB,UAAU,iCAAkD;AACxH,QAAM,UAAU,MAAM,eAAe,GAAG;AACxC,MAAI,CAAC,QAAS,OAAM,IAAI,YAAY,OAAO;AAC3C,SAAO;AACT;","names":[]}

package/dist/index.d.ts

@@ -0,0 +1,58 @@
+import { L as LensChallenge, a as LensAuth, T as TokenService, b as LensEnvironmentName } from './auth-Baitf7Ze.js';
+export { C as CHALLENGE_MAX_AGE_MS, c as CHALLENGE_REFRESH_MS, d as LENS_CHAIN_IDS, e as LensAuthOptions, f as LensCredentials, g as LensLoginRole, h as LensSessionInfo, M as MessageSigner, i as TOKENS_CHANGED_EVENT, j as TokenData, k as createLensAuth, l as lensApiOrigin, o as opensWalletWithDeepLink, s as signLensChallenge } from './auth-Baitf7Ze.js';
+import * as _lens_protocol_client from '@lens-protocol/client';
+import { PublicClient, SessionClient, Account, IStorageProvider } from '@lens-protocol/client';
+import { Wallet } from 'thirdweb/wallets';
+import { Chain as Chain$1, WalletClient, Transport, Account as Account$1 } from 'viem';
+import { Chain } from 'thirdweb/chains';
+import { ThirdwebClient } from 'thirdweb';
+
+declare class OnboardingError extends Error {
+    name: string;
+}
+declare function createOnboardingClient(auth: LensAuth): PublicClient<_lens_protocol_client.Context>;
+declare function requestOnboardingChallenge(auth: LensAuth, client: PublicClient, walletAddress: string): Promise<LensChallenge>;
+declare function authenticateOnboarding(client: PublicClient, challenge: LensChallenge, signature: string): Promise<SessionClient>;
+declare function usernameFormatError(localName: string): string | null;
+declare function isUsernameTaken(auth: LensAuth, localName: string): Promise<boolean>;
+declare function checkUsername(session: SessionClient, localName: string): Promise<string | null>;
+type AccountProfile = {
+    name?: string;
+    bio?: string;
+    picture?: File | null;
+};
+declare function uploadAccountMetadata(auth: LensAuth, profile: AccountProfile): Promise<string>;
+declare function createLensAccount(auth: LensAuth, session: SessionClient, wallet: Wallet, request: {
+    localName: string;
+    metadataUri: string;
+}): Promise<Account>;
+declare function signInToCreatedAccount(auth: LensAuth, session: SessionClient, accountAddress: string): Promise<void>;
+
+declare class LensTokenStorage implements IStorageProvider {
+    private tokens;
+    private prefix;
+    constructor(tokens: TokenService, prefix: string);
+    private isCredentials;
+    private metadataKey;
+    private credentialsMetadata;
+    getItem(key: string): string | null;
+    setItem(key: string, value: string): void;
+    removeItem(key: string): void;
+}
+
+declare function decodeJwtPayload(token: string): Record<string, unknown> | null;
+declare function lensSessionFromIdToken(idToken: string): {
+    account: string;
+    sessionId: string;
+} | null;
+
+declare function lensThirdwebChain(environment: LensEnvironmentName, rpcUrl?: string): Chain;
+declare function lensViemChain(environment: LensEnvironmentName): Chain$1;
+declare function createLensWalletClient(opts: {
+    wallet: Wallet;
+    client: ThirdwebClient;
+    chain: Chain;
+    viemChain: Chain$1;
+}): WalletClient<Transport, Chain$1, Account$1>;
+
+export { type AccountProfile, LensAuth, LensChallenge, LensEnvironmentName, LensTokenStorage, OnboardingError, TokenService, authenticateOnboarding, checkUsername, createLensAccount, createLensWalletClient, createOnboardingClient, decodeJwtPayload, isUsernameTaken, lensSessionFromIdToken, lensThirdwebChain, lensViemChain, requestOnboardingChallenge, signInToCreatedAccount, uploadAccountMetadata, usernameFormatError };

package/dist/index.js

@@ -0,0 +1,56 @@
+"use client";
+import {
+  CHALLENGE_MAX_AGE_MS,
+  CHALLENGE_REFRESH_MS,
+  LENS_CHAIN_IDS,
+  LensTokenStorage,
+  OnboardingError,
+  TOKENS_CHANGED_EVENT,
+  TokenService,
+  authenticateOnboarding,
+  checkUsername,
+  createLensAccount,
+  createLensAuth,
+  createLensWalletClient,
+  createOnboardingClient,
+  decodeJwtPayload,
+  isUsernameTaken,
+  lensApiOrigin,
+  lensSessionFromIdToken,
+  lensThirdwebChain,
+  lensViemChain,
+  opensWalletWithDeepLink,
+  requestOnboardingChallenge,
+  signInToCreatedAccount,
+  signLensChallenge,
+  uploadAccountMetadata,
+  usernameFormatError
+} from "./chunk-2UCSL2CL.js";
+export {
+  CHALLENGE_MAX_AGE_MS,
+  CHALLENGE_REFRESH_MS,
+  LENS_CHAIN_IDS,
+  LensTokenStorage,
+  OnboardingError,
+  TOKENS_CHANGED_EVENT,
+  TokenService,
+  authenticateOnboarding,
+  checkUsername,
+  createLensAccount,
+  createLensAuth,
+  createLensWalletClient,
+  createOnboardingClient,
+  decodeJwtPayload,
+  isUsernameTaken,
+  lensApiOrigin,
+  lensSessionFromIdToken,
+  lensThirdwebChain,
+  lensViemChain,
+  opensWalletWithDeepLink,
+  requestOnboardingChallenge,
+  signInToCreatedAccount,
+  signLensChallenge,
+  uploadAccountMetadata,
+  usernameFormatError
+};
+//# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":[],"sourcesContent":[],"mappings":"","names":[]}

package/dist/react/index.d.ts

@@ -0,0 +1,83 @@
+import * as React from 'react';
+import { Account } from 'thirdweb/wallets';
+import { ConvexReactClient } from 'convex/react';
+import { a as LensAuth } from '../auth-Baitf7Ze.js';
+import { ConnectButtonProps } from 'thirdweb/react';
+import '@lens-protocol/client';
+import 'thirdweb/chains';
+import 'thirdweb';
+import 'viem';
+
+type SignedInAccount = {
+    /** Lens account address, lowercased */
+    address: string;
+    /** Lens username (local name), when known */
+    username: string | null;
+};
+type LensAuthStatus = 
+/** Reading the stored session (first render, and during SSR) */
+"loading"
+/** No wallet and no Lens session */
+ | "signed-out"
+/** Wallet connected, no Lens account signed in yet: the account dialog is open */
+ | "choosing-account"
+/** Signed in to a Lens account (Convex is authenticated as it too) */
+ | "signed-in";
+type LensAuthContextValue = {
+    auth: LensAuth;
+    status: LensAuthStatus;
+    isLoading: boolean;
+    isSignedIn: boolean;
+    /** The connected thirdweb wallet account */
+    wallet: Account | undefined;
+    /** The signed-in Lens account */
+    account: SignedInAccount | null;
+    /** Ends the Lens session and disconnects the wallet */
+    signOut: () => Promise<void>;
+    /** Opens the account dialog, e.g. to switch to another account */
+    openAccountDialog: () => void;
+};
+declare function useLensAuth(): LensAuthContextValue;
+type LensAuthProviderProps = {
+    /** From createLensAuth(), created once at module level */
+    auth: LensAuth;
+    /** Your ConvexReactClient. Omit to use the package without Convex. */
+    convex?: ConvexReactClient;
+    /**
+     * Called after the user signs in from the account dialog (picking an account or creating one), once
+     * Convex accepts the session. A good place to create the user's row: `convex.mutation(api.users.ensure)`
+     */
+    onSignIn?: (account: SignedInAccount) => void | Promise<void>;
+    /** Render the account dialog. Set to false to render <AccountDialog /> yourself. Defaults to true. */
+    accountDialog?: boolean;
+    children: React.ReactNode;
+};
+declare function LensAuthProvider({ auth, convex, onSignIn, accountDialog, children }: LensAuthProviderProps): React.JSX.Element;
+
+type SignInButtonProps = {
+    /** Defaults to "Sign in" */
+    label?: React.ReactNode;
+    /** Defaults to "Logout" */
+    signOutLabel?: React.ReactNode;
+    /** thirdweb modal theme. Defaults to the page's theme (a `dark` class on <html>, or the system's). */
+    theme?: "light" | "dark";
+    /** Classes for the placeholder and sign-out buttons. Size the button's wrapper to size them all alike. */
+    className?: string;
+    /** Extra props for thirdweb's ConnectButton (wallets, connectModal, ...) */
+    connectButtonProps?: Partial<Omit<ConnectButtonProps, "client" | "chain" | "theme">>;
+};
+declare function SignInButton({ label, signOutLabel, theme, className, connectButtonProps }: SignInButtonProps): React.JSX.Element;
+
+declare function AccountDialog(): React.JSX.Element;
+
+type CreatedAccount = {
+    address: string;
+    localName: string;
+};
+declare function CreateAccountForm({ ownerAddress, onCreated, onBack }: {
+    ownerAddress: string;
+    onCreated: (account: CreatedAccount) => Promise<void>;
+    onBack?: () => void;
+}): React.JSX.Element;
+
+export { AccountDialog, CreateAccountForm, type CreatedAccount, type LensAuthContextValue, LensAuthProvider, type LensAuthProviderProps, type LensAuthStatus, SignInButton, type SignInButtonProps, type SignedInAccount, useLensAuth };