use-convex 1.3.0 → 2.0.0

package/dist/runtime/composables/useAuth.js

@@ -1,476 +1,84 @@
-import { ConvexHttpClient } from "convex/browser";
-import { makeFunctionReference } from "convex/server";
-import { computed, nextTick } from "vue";
-import { useRuntimeConfig, useState } from "nuxt/app";
+import { computed, ref, shallowRef } from "vue";
+import { useConvexContext } from "../utils/context.js";
 import { useConvexAuth } from "./useConvexAuth.js";
-import { missingConvexUrlError, unreachableConvexUrlError } from "../utils/errors.js";
-import { withRefreshMutex } from "../utils/authMutex.js";
-import { useAuthJwtCookie, useAuthPresentCookie } from "../utils/authCookie.js";
-import { getConvexAuthClientOptions, setConvexAuthModuleDefaults } from "../utils/authClientOptions.js";
 import {
-  flattenSignInParams,
-  isHttpOnlyAuth,
-  JWT_STORAGE_KEY,
-  readLocalAsync,
-  readStored,
-  readVerifier,
-  readVerifierAsync,
-  REFRESH_TOKEN_STORAGE_KEY,
-  shouldConsumeOAuthCode,
-  storageKey,
-  VERIFIER_STORAGE_KEY,
-  writeLocalAsync,
-  writeVerifier
-} from "../utils/authStorage.js";
-import { tryUseConvexContext } from "../utils/context.js";
-import { parseOAuthRedirect } from "../utils/oauthRedirect.js";
-const authSignIn = makeFunctionReference("auth:signIn");
-const authSignOut = makeFunctionReference("auth:signOut");
-const RETRY_BACKOFF = [500, 2e3];
-const RETRY_JITTER = 100;
+  OAUTH_ACTIONS_KEY,
+  OAUTH_FLOW_ERROR_KEY,
+  OAUTH_SETUP_ID
+} from "../auth/oauth.js";
+function useBinding(name) {
+  const ctx = useConvexContext();
+  if (!import.meta.server && !ctx.convexAuth) {
+    throw new Error(
+      `[use-convex] ${name} requires \`convex.auth.provider: 'convex-auth'\` in nuxt.config.`
+    );
+  }
+  return ctx.convexAuth ?? null;
+}
+function requireBinding(name) {
+  const binding = useConvexContext().convexAuth;
+  if (!binding) {
+    throw new Error(`[use-convex] ${name} is browser-only and requires Convex Auth.`);
+  }
+  return binding;
+}
 export function useAuth() {
-  const session = useAuthSession();
-  if (!tryUseConvexContext()) {
-    return {
-      isLoading: computed(() => session.isLoading.value),
-      isAuthenticated: computed(() => false),
-      isRefreshing: computed(() => false),
-      hasSsrSession: computed(() => false),
-      showAuthedUi: computed(() => false),
-      error: session.error,
-      pending: session.pending,
-      signIn,
-      signOut
-    };
-  }
-  const convexAuth = useConvexAuth();
+  const binding = useBinding("useAuth");
+  const auth = useConvexAuth();
   return {
-    isLoading: convexAuth.isLoading,
-    isAuthenticated: convexAuth.isAuthenticated,
-    isRefreshing: convexAuth.isRefreshing,
-    hasSsrSession: convexAuth.hasSsrSession,
-    showAuthedUi: convexAuth.showAuthedUi,
-    error: session.error,
-    pending: session.pending,
-    signIn,
-    signOut
+    ...auth,
+    token: computed(() => binding?.state.value.token ?? null),
+    setSession: (session) => requireBinding("setSession").setSession(session),
+    signOut: () => signOut()
   };
 }
-export async function signIn(provider, params) {
-  const session = useAuthSession();
-  const convexUrl = session.convexUrl;
-  if (!convexUrl) {
-    throw missingConvexUrlError("signIn");
-  }
-  session.pending.value = true;
-  session.error.value = null;
-  try {
-    const flatParams = flattenSignInParams(params);
-    const existingVerifier = await readVerifierAsync(session.verifierKey.value) ?? void 0;
-    await writeVerifier(session.verifierKey.value, null);
-    const result = await callSignIn(convexUrl, {
-      provider,
-      params: flatParams,
-      verifier: existingVerifier
-    });
-    if (result.redirect !== void 0) {
-      const url = parseOAuthRedirect(result.redirect);
-      if (result.verifier) {
-        await writeVerifier(session.verifierKey.value, result.verifier);
-      }
-      if (inBrowser()) {
-        window.location.href = url.toString();
-      }
-      return { signingIn: false, redirect: url };
-    }
-    if (result.tokens !== void 0) {
-      await persistTokens(session, result.tokens);
-      return { signingIn: result.tokens !== null };
-    }
-    return { signingIn: false };
-  } catch (cause) {
-    const message = isNetworkError(cause) && convexUrl ? unreachableConvexUrlError(convexUrl).message : cause instanceof Error ? cause.message : "Authentication failed";
-    session.error.value = message;
-    throw cause;
-  } finally {
-    session.pending.value = false;
-  }
-}
 export async function signOut() {
-  const session = useAuthSession();
-  const convexUrl = session.convexUrl;
-  session.pending.value = true;
-  session.error.value = null;
-  try {
-    if (convexUrl) {
-      const token = await readLocalAsync(session.jwtKey.value);
-      const http = new ConvexHttpClient(convexUrl);
-      if (token) {
-        http.setAuth(token);
-      }
-      try {
-        await http.action(authSignOut, {});
-      } catch {
-      }
-    }
-    await persistTokens(session, null);
-  } finally {
-    session.pending.value = false;
-  }
-}
-export function hydrateAuthFromStorage() {
-  const session = useAuthSession();
-  if (!session.convexUrl) {
-    session.isLoading.value = false;
-    session.hasSession.value = false;
-    return;
-  }
-  if (session.httpOnly) {
-    const present = useAuthPresentCookie();
-    if (present?.value === "1") {
-      session.hasSession.value = true;
-      session.isLoading.value = false;
-      return;
-    }
-    session.isLoading.value = true;
-    void fetchAuthSession().then((result) => {
-      session.hasSession.value = result.hasSession;
-      session.isLoading.value = false;
-      if (result.hasSession) {
-        const marker = useAuthPresentCookie();
-        if (marker) {
-          marker.value = "1";
-        }
-      }
-    });
-    return;
-  }
-  const stored = readStored(session.jwtKey.value);
-  const applyToken = (token) => {
-    session.hasSession.value = token !== null;
-    session.isLoading.value = false;
-    if (token) {
-      setJwtCookie(token);
-    }
-  };
-  if (stored instanceof Promise) {
-    session.isLoading.value = true;
-    void stored.then(applyToken).catch(() => {
-      session.hasSession.value = false;
-      session.isLoading.value = false;
-    });
-    return;
-  }
-  applyToken(stored);
-}
-export async function getAuthToken({
-  forceRefreshToken
-}) {
-  const session = useAuthSession();
-  const convexUrl = session.convexUrl;
-  if (!convexUrl) {
-    return null;
-  }
-  if (session.httpOnly) {
-    return withRefreshMutex(session.refreshKey.value, async () => {
-      if (!forceRefreshToken) {
-        const current = await fetchAuthSessionToken();
-        if (current.token) {
-          session.hasSession.value = true;
-          return current.token;
-        }
-      }
-      const refreshed = await refreshAuthSession();
-      if (!refreshed) {
-        await clearAuthSession();
-        session.hasSession.value = false;
-        return null;
-      }
-      session.hasSession.value = true;
-      return refreshed;
-    });
-  }
-  if (!forceRefreshToken) {
-    return await readLocalAsync(session.jwtKey.value);
-  }
-  return withRefreshMutex(session.refreshKey.value, async () => {
-    const refreshToken = await readLocalAsync(session.refreshKey.value);
-    if (!refreshToken) {
-      await persistTokens(session, null);
-      return null;
+  await requireBinding("signOut").signOut();
+}
+export function useConvexSignIn(fn, options = {}) {
+  useBinding("useConvexSignIn");
+  const ctx = useConvexContext();
+  const pending = ref(false);
+  const run = async (args) => {
+    const binding = ctx.convexAuth;
+    if (!binding) {
+      throw new Error("[use-convex] useConvexSignIn().run is browser-only.");
     }
+    pending.value = true;
     try {
-      const result = await callSignInWithRetry(convexUrl, { refreshToken });
-      const tokens = result.tokens ?? null;
-      if (!tokens) {
-        await persistTokens(session, null);
-        return null;
+      const call = options.kind === "action" ? binding.signInApi.action : binding.signInApi.mutation;
+      const result = await call(fn, args);
+      if (result?.status === "complete" && result.tokens) {
+        await binding.setSession(result.tokens);
       }
-      await persistTokens(session, tokens);
-      return tokens.token;
-    } catch {
-      await persistTokens(session, null);
-      return null;
-    }
-  });
-}
-function inBrowser() {
-  if (import.meta.client) {
-    return true;
-  }
-  return import.meta.client !== false && typeof window !== "undefined";
-}
-export function hasPendingOAuthCallback() {
-  if (!inBrowser()) {
-    return false;
-  }
-  const session = useAuthSession();
-  if (!session.convexUrl) {
-    return false;
-  }
-  const code = new URLSearchParams(window.location.search).get("code");
-  if (!code) {
-    return false;
-  }
-  const gate = getConvexAuthClientOptions().shouldHandleCode;
-  if (gate === false || typeof gate === "function" && !gate()) {
-    return false;
-  }
-  const verifier = readVerifier(session.verifierKey.value);
-  if (verifier instanceof Promise) {
-    return true;
-  }
-  return shouldConsumeOAuthCode({
-    code,
-    verifier,
-    shouldHandleCode: gate
-  });
-}
-export async function consumeOAuthCodeFromUrl() {
-  if (!inBrowser()) {
-    return false;
-  }
-  const session = useAuthSession();
-  if (!session.convexUrl) {
-    return false;
-  }
-  const code = new URLSearchParams(window.location.search).get("code");
-  const verifier = await readVerifierAsync(session.verifierKey.value);
-  const gate = getConvexAuthClientOptions().shouldHandleCode;
-  if (!shouldConsumeOAuthCode({
-    code,
-    verifier,
-    shouldHandleCode: gate
-  })) {
-    return false;
-  }
-  const url = new URL(window.location.href);
-  url.searchParams.delete("code");
-  const relativeUrl = url.pathname + url.search + url.hash;
-  const replaceURL = getConvexAuthClientOptions().replaceURL;
-  try {
-    if (replaceURL) {
-      await replaceURL(relativeUrl);
-    } else {
-      window.history.replaceState({}, "", relativeUrl);
+      return result;
+    } catch (cause) {
+      return { status: "error", userError: { error: "OTHER_ERROR", cause } };
+    } finally {
+      pending.value = false;
     }
-  } catch (cause) {
-    session.error.value = cause instanceof Error ? cause.message : "OAuth callback failed";
-    session.isLoading.value = false;
-    session.pending.value = false;
-    return false;
-  }
-  session.pending.value = true;
-  session.error.value = null;
-  session.isLoading.value = true;
-  try {
-    await writeVerifier(session.verifierKey.value, null);
-    const result = await callSignInWithRetry(session.convexUrl, {
-      params: { code },
-      verifier
-    });
-    await persistTokens(session, result.tokens ?? null);
-    return result.tokens != null;
-  } catch (cause) {
-    const message = cause instanceof Error ? cause.message : "OAuth callback failed";
-    session.error.value = message;
-    await persistTokens(session, null);
-    return false;
-  } finally {
-    session.pending.value = false;
-  }
-}
-export function useAuthProviderState() {
-  const session = useAuthSession();
-  return {
-    isLoading: computed(() => session.isLoading.value),
-    hasSession: computed(() => session.hasSession.value)
-  };
-}
-function useAuthSession() {
-  const config = useRuntimeConfig();
-  const convexConfig = config.public.convex;
-  const convexUrl = convexConfig?.url;
-  const authConfig = convexConfig?.auth;
-  const httpOnly = isHttpOnlyAuth(authConfig);
-  if (authConfig?.provider === "convex-auth") {
-    setConvexAuthModuleDefaults({
-      storageNamespace: authConfig.storageNamespace,
-      storage: authConfig.storage,
-      shouldHandleCode: authConfig.shouldHandleCode
-    });
-  }
-  const isLoading = useState("convex-auth-loading", () => true);
-  const hasSession = useState("convex-auth-has-session", () => false);
-  const error = useState("convex-auth-error", () => null);
-  const pending = useState("convex-auth-pending", () => false);
-  const namespace = getConvexAuthClientOptions().storageNamespace ?? authConfig?.storageNamespace ?? convexUrl;
-  const jwtKey = computed(
-    () => namespace ? storageKey(JWT_STORAGE_KEY, namespace) : JWT_STORAGE_KEY
-  );
-  const refreshKey = computed(
-    () => namespace ? storageKey(REFRESH_TOKEN_STORAGE_KEY, namespace) : REFRESH_TOKEN_STORAGE_KEY
-  );
-  const verifierKey = computed(
-    () => namespace ? storageKey(VERIFIER_STORAGE_KEY, namespace) : VERIFIER_STORAGE_KEY
-  );
-  return {
-    convexUrl,
-    httpOnly,
-    jwtKey,
-    refreshKey,
-    verifierKey,
-    isLoading,
-    hasSession,
-    error,
-    pending
   };
-}
-function setJwtCookie(token) {
-  const cookie = useAuthJwtCookie();
-  if (!cookie) {
-    return;
-  }
-  cookie.value = token;
-}
-function setPresentCookie(value) {
-  const cookie = useAuthPresentCookie();
-  if (!cookie) {
-    return;
-  }
-  cookie.value = value;
-}
-const AUTH_SESSION_PATH = "/api/convex/auth/session";
-async function fetchAuthSession() {
-  try {
-    return await $fetch(AUTH_SESSION_PATH, {
-      method: "GET"
-    });
-  } catch {
-    return { hasSession: false };
-  }
-}
-async function fetchAuthSessionToken() {
-  try {
-    return await $fetch(AUTH_SESSION_PATH, {
-      method: "POST",
-      body: { getToken: true }
-    });
-  } catch {
-    return { hasSession: false, token: null };
-  }
-}
-async function refreshAuthSession() {
-  try {
-    const result = await $fetch(AUTH_SESSION_PATH, {
-      method: "POST",
-      body: { refresh: true }
-    });
-    return result.token;
-  } catch {
-    return null;
-  }
-}
-async function clearAuthSession() {
-  try {
-    await $fetch(AUTH_SESSION_PATH, { method: "DELETE" });
-  } catch {
-  }
-  setPresentCookie(null);
-}
-async function writeHttpOnlySession(tokens) {
-  if (tokens === null) {
-    await clearAuthSession();
-    return;
-  }
-  await $fetch(AUTH_SESSION_PATH, {
-    method: "POST",
-    body: {
-      token: tokens.token,
-      refreshToken: tokens.refreshToken
+  return { run, pending };
+}
+export function useOAuth() {
+  const binding = useBinding("useOAuth");
+  if (!binding) {
+    return { flowError: shallowRef(null) };
+  }
+  const value = binding.ambientValue(OAUTH_SETUP_ID, OAUTH_FLOW_ERROR_KEY);
+  return { flowError: computed(() => value.value ?? null) };
+}
+export function useOAuthSignIn(refs) {
+  const binding = useBinding("useOAuthSignIn");
+  const actions = binding?.ambientValue(OAUTH_SETUP_ID, OAUTH_ACTIONS_KEY);
+  const signIn = (async (options) => {
+    const current = actions?.value;
+    if (!current) {
+      throw new Error(
+        "[use-convex] OAuth is not registered. Include convexOAuth() in configureConvexAuth({ ambientSignIns })."
+      );
     }
+    return await current.signIn(refs, options);
   });
-  setPresentCookie("1");
-}
-async function persistTokens(session, tokens) {
-  if (session.httpOnly) {
-    if (tokens === null) {
-      await writeHttpOnlySession(null);
-      await writeLocalAsync(session.jwtKey.value, null);
-      await writeLocalAsync(session.refreshKey.value, null);
-      session.hasSession.value = false;
-      session.isLoading.value = false;
-      return;
-    }
-    session.hasSession.value = true;
-    session.isLoading.value = false;
-    await writeHttpOnlySession(tokens);
-    return;
-  }
-  if (tokens === null) {
-    await writeLocalAsync(session.jwtKey.value, null);
-    await writeLocalAsync(session.refreshKey.value, null);
-    setJwtCookie(null);
-    session.hasSession.value = false;
-    session.isLoading.value = false;
-    return;
-  }
-  await writeLocalAsync(session.jwtKey.value, tokens.token);
-  await writeLocalAsync(session.refreshKey.value, tokens.refreshToken);
-  session.hasSession.value = true;
-  session.isLoading.value = false;
-  nextTick(() => {
-    setJwtCookie(tokens.token);
-  });
-}
-async function callSignIn(convexUrl, args) {
-  const http = new ConvexHttpClient(convexUrl);
-  return await http.action(authSignIn, args);
-}
-async function callSignInWithRetry(convexUrl, args) {
-  let lastError;
-  let retry = 0;
-  while (retry < RETRY_BACKOFF.length) {
-    try {
-      return await callSignIn(convexUrl, args);
-    } catch (e) {
-      lastError = e;
-      if (!isNetworkError(e)) {
-        break;
-      }
-      const wait = RETRY_BACKOFF[retry] + RETRY_JITTER * Math.random();
-      retry++;
-      await new Promise((resolve) => setTimeout(resolve, wait));
-    }
-  }
-  throw lastError;
-}
-function isNetworkError(error) {
-  if (error instanceof TypeError) {
-    return true;
-  }
-  if (error instanceof Error && /network|fetch|Failed to fetch/i.test(error.message)) {
-    return true;
-  }
-  return false;
+  return { signIn };
 }

package/dist/runtime/composables/useAuthToken.d.ts

@@ -4,8 +4,8 @@ import { type ComputedRef } from 'vue';
  * Current JWT for authenticated HTTP calls (React `@convex-dev/auth`
  * `useAuthToken` parity).
  *
- * Prefers `ConvexClient.getAuth()`, then the configured `fetchToken`
- * (Convex Auth / BYO). Returns `null` when signed out or unavailable.
+ * Uses the Convex Auth client token when Convex Auth is enabled; otherwise
+ * `ConvexClient.getAuth()`, then the configured BYO `fetchToken`. Returns `null` when signed out or unavailable.
  */
 export declare function useAuthToken(): ComputedRef<string | null>;
 /**

package/dist/runtime/composables/useAuthToken.js

@@ -9,6 +9,10 @@ export function useAuthToken() {
     return computed(() => null);
   }
   const auth = useConvexAuth();
+  const binding = ctx.convexAuth;
+  if (binding) {
+    return computed(() => binding.state.value.token);
+  }
   const refresh = async () => {
     if (!ctx.client) {
       token.value = null;

package/dist/runtime/composables/useConvexAuth.js

@@ -61,7 +61,7 @@ export function useConvexAuth(setup) {
       );
     };
     watch(
-      () => [toValue(setup.isLoading) ?? false, toValue(setup.isAuthenticated) ?? true],
+      [() => toValue(setup.isLoading) ?? false, () => toValue(setup.isAuthenticated) ?? true],
       syncFromProvider,
       { immediate: true }
     );

package/dist/runtime/composables/useConvexPaginatedQuery.js

@@ -1,3 +1,4 @@
+import { sessionKeyFromToken } from "../utils/authStorage.js";
 import { convexToJson, jsonToConvex } from "convex/values";
 import { useAsyncData, useRuntimeConfig } from "nuxt/app";
 import {
@@ -60,7 +61,11 @@ export async function useConvexPaginatedQuery(query, args = {}, options) {
       server,
       watch: [
         () => toValue(args),
-        () => options.token ?? ctx.ssrToken.value,
+        // Session identity (JWT iss + sub), not the raw token: Convex Auth
+        // rotates the access token every minute without changing session,
+        // but switching accounts must re-run the snapshot (`live: false`
+        // and BYO cookies included).
+        () => sessionKeyFromToken(options.token ?? ctx.ssrToken.value),
         () => requireAuth && ctx.auth.isAuthenticated.value && !!(options.token ?? ctx.ssrToken.value)
       ]
     }

package/dist/runtime/composables/useConvexQuery.js

@@ -1,3 +1,4 @@
+import { sessionKeyFromToken } from "../utils/authStorage.js";
 import { convexToJson, jsonToConvex } from "convex/values";
 import { useAsyncData, useRuntimeConfig } from "nuxt/app";
 import {
@@ -47,7 +48,11 @@ export async function useConvexQuery(query, args = {}, options = {}) {
         () => toValue(args),
         // Re-run HttpClient snapshot when the SSR JWT cookie / token changes
         // (e.g. after sign-in with live:false, or Refresh).
-        () => options.token ?? ctx.ssrToken.value,
+        // Session identity (JWT iss + sub), not the raw token: Convex Auth
+        // rotates the access token every minute without changing session,
+        // but switching accounts must re-run the snapshot (`live: false`
+        // and BYO cookies included).
+        () => sessionKeyFromToken(options.token ?? ctx.ssrToken.value),
         // Re-run when auth confirms *and* a JWT is available for HttpClient
         // (readable cookie / SSR). Avoids anonymous client refetches with HttpOnly.
         () => requireAuth && ctx.auth.isAuthenticated.value && !!(options.token ?? ctx.ssrToken.value)

package/dist/runtime/plugin.auth.client.d.ts

@@ -1,8 +1,13 @@
 /**
- * First-party Convex Auth wiring (opt-in via `convex.auth.provider: 'convex-auth'`).
+ * First-party Convex Auth v2 wiring (`convex.auth.provider: 'convex-auth'`).
  *
- * Must stay synchronous through `useConvexAuth` / `inject` — awaiting first
- * drops Vue setup context and caused the "plugin did not start" 500.
+ * Builds an `AuthClient` from `@convex-dev/auth/browser` in SSR mode (refresh
+ * token in an httpOnly cookie, sign-ins through the Nitro auth proxy) or SPA
+ * mode (tokens in browser storage, sign-ins straight to the deployment),
+ * then hands its token to `useConvexAuth` and watches `isAuthenticated` so a
+ * session revoked server-side signs the client out.
+ *
+ * Setup stays synchronous so `useConvexAuth` keeps the Nuxt app context.
  */
 declare const _default: import("nuxt/app").Plugin<Record<string, unknown>> & import("nuxt/app").ObjectPlugin<Record<string, unknown>>;
 export default _default;