use-convex 1.2.0 → 2.0.0

package/dist/runtime/server/api/convex/auth/session.d.ts

@@ -1,36 +0,0 @@
-/**
- * Persist / read / refresh HttpOnly auth cookies.
- *
- * - GET → `{ hasSession }` only (no JWT in the response body)
- * - POST `{ getToken: true }` → `{ hasSession, token }` for ConvexClient.setAuth
- * - POST `{ refresh: true }` → refresh cookies, return `{ token }`
- * - POST `{ token, refreshToken }` → set cookies
- * - DELETE → clear cookies
- *
- * All methods require same-origin (fail-closed). Returning the JWT only via
- * POST reduces accidental leakage via prefetch/logs; XSS can still obtain a
- * token once ConvexClient needs it in memory — HttpOnly mitigates cookie theft,
- * not XSS session theft.
- */
-declare const _default: import("h3").EventHandler<import("h3").EventHandlerRequest, Promise<{
-    hasSession: boolean;
-    ok?: undefined;
-    token?: undefined;
-} | {
-    ok: boolean;
-    hasSession?: undefined;
-    token?: undefined;
-} | {
-    hasSession: boolean;
-    token: string | null;
-    ok?: undefined;
-} | {
-    token: null;
-    hasSession?: undefined;
-    ok?: undefined;
-} | {
-    token: string;
-    hasSession?: undefined;
-    ok?: undefined;
-}>>;
-export default _default;

package/dist/runtime/server/api/convex/auth/session.js

@@ -1,90 +0,0 @@
-import { ConvexHttpClient } from "convex/browser";
-import { makeFunctionReference } from "convex/server";
-import { createError, defineEventHandler, readBody } from "h3";
-import { useRuntimeConfig } from "nitropack/runtime";
-import { readHttpOnlyJwt, readHttpOnlyRefresh, setAuthCookies } from "../../../authCookies.js";
-import { isHttpOnlyAuth } from "../../../../utils/authStorage.js";
-import { assertSameOrigin } from "../../../sameOrigin.js";
-import { MISSING_URL_HINT } from "../../../../utils/errors.js";
-const authSignIn = makeFunctionReference(
-  "auth:signIn"
-);
-function convexUrl(event) {
-  const config = useRuntimeConfig(event);
-  const url = config.public?.convex?.url ?? process.env.NUXT_PUBLIC_CONVEX_URL;
-  if (!url) {
-    throw createError({
-      statusCode: 500,
-      message: MISSING_URL_HINT
-    });
-  }
-  return url;
-}
-function requireHttpOnly(event) {
-  const config = useRuntimeConfig(event);
-  const auth = config.public?.convex?.auth;
-  if (!isHttpOnlyAuth(auth)) {
-    throw createError({
-      statusCode: 404,
-      message: "HttpOnly auth is not enabled"
-    });
-  }
-}
-export default defineEventHandler(async (event) => {
-  requireHttpOnly(event);
-  assertSameOrigin(event);
-  if (event.method === "GET") {
-    const token = readHttpOnlyJwt(event);
-    return {
-      hasSession: !!token
-    };
-  }
-  if (event.method === "DELETE") {
-    setAuthCookies(event, { token: null });
-    return { ok: true };
-  }
-  if (event.method === "POST") {
-    const body = await readBody(event);
-    if (body?.getToken) {
-      const token = readHttpOnlyJwt(event);
-      return {
-        hasSession: !!token,
-        token: token ?? null
-      };
-    }
-    if (body?.refresh) {
-      const refreshToken = readHttpOnlyRefresh(event);
-      if (!refreshToken) {
-        setAuthCookies(event, { token: null });
-        return { token: null };
-      }
-      const http = new ConvexHttpClient(convexUrl(event));
-      try {
-        const result = await http.action(authSignIn, { refreshToken });
-        const tokens = result.tokens ?? null;
-        if (!tokens) {
-          setAuthCookies(event, { token: null });
-          return { token: null };
-        }
-        setAuthCookies(event, {
-          token: tokens.token,
-          refreshToken: tokens.refreshToken
-        });
-        return { token: tokens.token };
-      } catch {
-        setAuthCookies(event, { token: null });
-        return { token: null };
-      }
-    }
-    if (!body?.token) {
-      setAuthCookies(event, { token: null });
-      return { ok: true };
-    }
-    setAuthCookies(event, {
-      token: body.token,
-      refreshToken: body.refreshToken ?? null
-    });
-    return { ok: true };
-  }
-  throw createError({ statusCode: 405, message: "Method not allowed" });
-});

package/dist/runtime/server/authCookies.d.ts

@@ -1,9 +0,0 @@
-import type { H3Event } from 'h3';
-export interface AuthCookieSet {
-    token: string | null;
-    refreshToken?: string | null;
-}
-/** Persist or clear HttpOnly auth cookies + readable presence marker. */
-export declare function setAuthCookies(event: H3Event, tokens: AuthCookieSet): void;
-export declare function readHttpOnlyJwt(event: H3Event): string | undefined;
-export declare function readHttpOnlyRefresh(event: H3Event): string | undefined;

package/dist/runtime/server/authCookies.js

@@ -1,64 +0,0 @@
-import { deleteCookie, getCookie, getRequestHeader, setCookie } from "h3";
-import {
-  AUTH_JWT_COOKIE_MAX_AGE,
-  isHttpOnlyAuth,
-  resolveAuthCookieName,
-  resolveAuthPresentCookieName,
-  resolveAuthRefreshCookieName
-} from "../utils/authStorage.js";
-import { readConvexConfig } from "./convexConfig.js";
-function readAuthConfig(event) {
-  return readConvexConfig(event)?.auth;
-}
-function isLocalHost(event) {
-  const host = getRequestHeader(event, "host") ?? "";
-  return host.startsWith("localhost") || host.startsWith("127.0.0.1") || host.startsWith("[::1]");
-}
-function cookieOptions(event, httpOnly) {
-  const local = isLocalHost(event);
-  return {
-    httpOnly,
-    secure: !local,
-    sameSite: "lax",
-    path: "/",
-    maxAge: AUTH_JWT_COOKIE_MAX_AGE
-  };
-}
-export function setAuthCookies(event, tokens) {
-  const auth = readAuthConfig(event);
-  if (!isHttpOnlyAuth(auth)) {
-    throw new Error("[use-convex] setAuthCookies requires convex.auth.httpOnly: true");
-  }
-  const jwtName = resolveAuthCookieName(auth);
-  const refreshName = resolveAuthRefreshCookieName(auth);
-  const presentName = resolveAuthPresentCookieName(auth);
-  const httpOpts = cookieOptions(event, true);
-  const presentOpts = cookieOptions(event, false);
-  if (!tokens.token) {
-    deleteCookie(event, jwtName, httpOpts);
-    deleteCookie(event, refreshName, httpOpts);
-    deleteCookie(event, presentName, presentOpts);
-    return;
-  }
-  setCookie(event, jwtName, tokens.token, httpOpts);
-  if (tokens.refreshToken) {
-    setCookie(event, refreshName, tokens.refreshToken, httpOpts);
-  }
-  setCookie(event, presentName, "1", presentOpts);
-}
-export function readHttpOnlyJwt(event) {
-  const auth = readAuthConfig(event);
-  const name = resolveAuthCookieName(auth);
-  if (!name) {
-    return void 0;
-  }
-  return getCookie(event, name) || void 0;
-}
-export function readHttpOnlyRefresh(event) {
-  const auth = readAuthConfig(event);
-  const name = resolveAuthRefreshCookieName(auth);
-  if (!name) {
-    return void 0;
-  }
-  return getCookie(event, name) || void 0;
-}

package/dist/runtime/server/sameOrigin.d.ts

@@ -1,14 +0,0 @@
-import { type H3Event } from 'h3';
-/**
- * Fail-closed same-origin guard for cookie-bearing auth routes.
- *
- * Accepts the request when:
- * - `Sec-Fetch-Site` is `same-origin` or `none` (user-initiated / same origin), or
- * - `Origin` matches the trusted request origin (scheme + host), using
- *   `Host` and `getRequestProtocol` (honors `X-Forwarded-Proto` behind proxies).
- *
- * Rejects when `Sec-Fetch-Site` is `cross-site` / `same-site`, or when neither
- * signal can confirm same-origin. Missing both headers is rejected.
- * Scheme-mismatched Origins (e.g. `http://` vs HTTPS request) are rejected.
- */
-export declare function assertSameOrigin(event: H3Event): void;

package/dist/runtime/server/sameOrigin.js

@@ -1,29 +0,0 @@
-import { createError, getRequestHeader, getRequestProtocol } from "h3";
-export function assertSameOrigin(event) {
-  const secFetchSite = getRequestHeader(event, "sec-fetch-site");
-  if (secFetchSite === "same-origin" || secFetchSite === "none") {
-    return;
-  }
-  if (secFetchSite === "cross-site" || secFetchSite === "same-site") {
-    throw createError({
-      statusCode: 403,
-      message: "Forbidden"
-    });
-  }
-  const origin = getRequestHeader(event, "origin");
-  const host = getRequestHeader(event, "host");
-  if (origin && host) {
-    try {
-      const originUrl = new URL(origin);
-      const protocol = getRequestProtocol(event, { xForwardedProto: true });
-      if (originUrl.protocol === `${protocol}:` && originUrl.host === host) {
-        return;
-      }
-    } catch {
-    }
-  }
-  throw createError({
-    statusCode: 403,
-    message: "Forbidden"
-  });
-}

package/dist/runtime/utils/authMutex.d.ts

@@ -1,15 +0,0 @@
-/**
- * Single-flight mutex for token refresh (mirrors @convex-dev/auth/react).
- * Prefers `navigator.locks` when available; falls back to an in-memory queue.
- */
-type MutexState = {
-    currentlyRunning: Promise<void> | null;
-    waiting: Array<() => Promise<void>>;
-};
-declare global {
-    var __convexNuxtAuthMutexes: Record<string, MutexState> | undefined;
-}
-export declare function withRefreshMutex<T>(key: string, callback: () => Promise<T>): Promise<T>;
-/** Test helper — clear in-memory mutex state between tests. */
-export declare function resetAuthMutexesForTests(): void;
-export {};

package/dist/runtime/utils/authMutex.js

@@ -1,47 +0,0 @@
-export async function withRefreshMutex(key, callback) {
-  const lockManager = typeof navigator !== "undefined" ? navigator.locks : void 0;
-  if (lockManager !== void 0) {
-    return await lockManager.request(key, callback);
-  }
-  return await manualMutex(key, callback);
-}
-async function manualMutex(key, callback) {
-  return await new Promise((resolve, reject) => {
-    const wrapped = () => callback().then(resolve).catch(reject).then(() => void 0);
-    void enqueueCallbackForMutex(key, wrapped);
-  });
-}
-function getMutexValue(key) {
-  if (globalThis.__convexNuxtAuthMutexes === void 0) {
-    globalThis.__convexNuxtAuthMutexes = {};
-  }
-  let mutex = globalThis.__convexNuxtAuthMutexes[key];
-  if (mutex === void 0) {
-    mutex = { currentlyRunning: null, waiting: [] };
-    globalThis.__convexNuxtAuthMutexes[key] = mutex;
-  }
-  return mutex;
-}
-async function enqueueCallbackForMutex(key, callback) {
-  const mutex = getMutexValue(key);
-  if (mutex.currentlyRunning === null) {
-    globalThis.__convexNuxtAuthMutexes[key] = {
-      currentlyRunning: callback().finally(() => {
-        const next = getMutexValue(key).waiting.shift();
-        getMutexValue(key).currentlyRunning = null;
-        if (next !== void 0) {
-          void enqueueCallbackForMutex(key, next);
-        }
-      }),
-      waiting: []
-    };
-  } else {
-    globalThis.__convexNuxtAuthMutexes[key] = {
-      ...mutex,
-      waiting: [...mutex.waiting, callback]
-    };
-  }
-}
-export function resetAuthMutexesForTests() {
-  globalThis.__convexNuxtAuthMutexes = void 0;
-}

package/dist/runtime/utils/oauthRedirect.d.ts

@@ -1,5 +0,0 @@
-/**
- * Validate an OAuth redirect from Convex `auth:signIn`.
- * Only http(s) absolute URLs are allowed (blocks javascript:/data: etc.).
- */
-export declare function parseOAuthRedirect(redirect: string): URL;

package/dist/runtime/utils/oauthRedirect.js

@@ -1,13 +0,0 @@
-import { useConvexError } from "./errors.js";
-export function parseOAuthRedirect(redirect) {
-  let url;
-  try {
-    url = new URL(redirect);
-  } catch {
-    throw useConvexError("Invalid OAuth redirect URL");
-  }
-  if (url.protocol !== "http:" && url.protocol !== "https:") {
-    throw useConvexError("OAuth redirect must be http(s)");
-  }
-  return url;
-}