@aurostack/stacks 0.2.1 → 0.2.2

package/package.json

@@ -1,6 +1,6 @@
 {
 	"name": "@aurostack/stacks",
-	"version": "0.2.1",
+	"version": "0.2.2",
 	"description": "Scaffold new projects from house templates: a NestJS API, React app or Turborepo monorepo, and Node or Python workers. Subtractive templates plus a zero-dependency generator.",
 	"license": "MIT",
 	"author": "Aurostack (https://github.com/aurostack-org)",

package/templates/nest-api/files/.env.example

@@ -8,7 +8,10 @@ APP_HOST='0.0.0.0'
 PORT='5000'
 SERVER_HOST='http://localhost:5000'
 FRONTEND_HOST='http://localhost:3000'
-# Extra CORS origins beyond FRONTEND_HOST, comma separated.
+# Extra origins beyond FRONTEND_HOST, comma separated: trusted by auth in every
+# environment, allowed by CORS in development only. A full origin
+# (`http://localhost:3001`) is used as written; a bare hostname (`example.com`)
+# expands to https://example.com and its auth., app. and admin. subdomains.
 MISC_CORS_ORIGINS=''
 
 DATABASE_URL='postgresql://root:postgres@localhost:5432/main'
@@ -16,9 +19,13 @@ DATABASE_URL='postgresql://root:postgres@localhost:5432/main'
 # openssl rand -base64 32
 BETTER_AUTH_SECRET='change-me-openssl-rand-base64-32'
 BETTER_AUTH_URL='http://localhost:5000'
-# Leading dot shares the session cookie across subdomains. `.lvh.me` resolves
-# to 127.0.0.1 for every subdomain, which makes local multi-app auth work.
-BETTER_AUTH_COOKIE_DOMAIN='.lvh.me'
+# Empty: the session cookie belongs to the API's own host, which is what
+# localhost development and a single-origin frontend need. Set a parent domain
+# with a leading dot (`.example.com`) when frontends live on subdomains, to share
+# one login across them; locally, `.lvh.me` does the same with `*.lvh.me` hosts
+# (every subdomain resolves to 127.0.0.1). The domain must cover the host the
+# browser talks to, or the cookie is dropped and every sign-in bounces.
+BETTER_AUTH_COOKIE_DOMAIN=''
 BETTER_AUTH_COOKIE_PREFIX='acme'
 
 # Seeded by `yarn db:seed`.

package/templates/nest-api/files/src/app.module.ts

@@ -81,13 +81,15 @@ import { OriginBuilder } from 'common/misc';
 							ipAddressHeaders: config.rateLimit.ipHeaders
 						},
 						// @feature:end
-						// Share the session cookie across subdomains so one login covers
-						// every frontend. Domain comes from BETTER_AUTH_COOKIE_DOMAIN
-						// (`.lvh.me` in dev, your apex in production).
+						// With BETTER_AUTH_COOKIE_DOMAIN set (`.example.com`), the session
+						// cookie is shared across subdomains so one login covers every
+						// frontend. Empty, it belongs to the API's own host: right for
+						// localhost and for a single-origin frontend. A browser drops a
+						// cookie whose domain doesn't cover the host that set it.
 						cookiePrefix: config.betterAuth.cookiePrefix,
 						crossSubDomainCookies: {
-							enabled: true,
-							domain: config.betterAuth.cookieDomain
+							enabled: Boolean(config.betterAuth.cookieDomain),
+							domain: config.betterAuth.cookieDomain || undefined
 						},
 						database: {
 							joins: true

package/templates/nest-api/files/src/common/__tests__/origin-builder.spec.ts

@@ -0,0 +1,24 @@
+import { OriginBuilder } from 'common/misc/origin-builder';
+
+describe('OriginBuilder', () => {
+	it('expands a bare hostname into https origins for it and its subdomains', () => {
+		expect(OriginBuilder.build('example.com')).toEqual([
+			'https://example.com',
+			'https://auth.example.com',
+			'https://app.example.com',
+			'https://admin.example.com'
+		]);
+	});
+
+	it('takes an entry with a scheme as one origin, as written', () => {
+		expect(OriginBuilder.build('http://localhost:3001, http://localhost:3002/')).toEqual([
+			'http://localhost:3001',
+			'http://localhost:3002'
+		]);
+	});
+
+	it('is empty for an empty list', () => {
+		expect(OriginBuilder.build('')).toEqual([]);
+		expect(OriginBuilder.build(undefined)).toEqual([]);
+	});
+});

package/templates/nest-api/files/src/common/misc/origin-builder.ts

@@ -1,7 +1,9 @@
 /**
- * Builds a list of origins for CORS configuration, given a list of hostnames.
- * Each hostname will generate the main domain and subdomains
- * for app, auth, and admin.
+ * Builds a list of origins for CORS configuration from a list of entries.
+ * A bare hostname (`shop.example.com`) generates https origins for it and its
+ * app, auth and admin subdomains. An entry with a scheme
+ * (`http://localhost:3001`) is taken as one origin, as written: that is how
+ * frontends on other local ports are allowed.
  *
  * @remarks This is mainly for development purposes
  * For frontend developers on the team who cannot run a standalone
@@ -28,6 +30,7 @@ export class OriginBuilder {
 	 * Origins for a single hostname: the main domain plus each subdomain.
 	 */
 	fromHost(hostname: string): string[] {
+		if (hostname.includes('://')) return [hostname.replace(/\/+$/, '')];
 		return [
 			`${this.protocol}${hostname}`,
 			...this.subdomains.map((sub) => `${this.protocol}${sub}.${hostname}`)

package/templates/nest-api/files/src/common/services/config.service.ts

@@ -172,7 +172,7 @@ namespace Config {
 		DATABASE_URL: str(),
 		BETTER_AUTH_SECRET: str(),
 		BETTER_AUTH_URL: str(),
-		BETTER_AUTH_COOKIE_DOMAIN: str(),
+		BETTER_AUTH_COOKIE_DOMAIN: z.string().default(''),
 		BETTER_AUTH_COOKIE_PREFIX: str(),
 		SUPERUSER_EMAIL: str(),
 		SUPERUSER_PASSWORD: str(),

package/templates/nest-api/files/src/lib/auth.ts

@@ -33,8 +33,8 @@ export const auth = betterAuth({
 		// sessions through this one, so a different cookie name would reject them.
 		cookiePrefix: env.BETTER_AUTH_COOKIE_PREFIX,
 		crossSubDomainCookies: {
-			enabled: true,
-			domain: env.BETTER_AUTH_COOKIE_DOMAIN
+			enabled: Boolean(env.BETTER_AUTH_COOKIE_DOMAIN),
+			domain: env.BETTER_AUTH_COOKIE_DOMAIN || undefined
 		},
 		database: {
 			joins: true