@dialtribe/auth 0.1.0 → 0.1.2

package/README.md

@@ -53,6 +53,10 @@ betterAuth({
         dialtribeProvider({
           clientId: process.env.DIALTRIBE_OIDC_CLIENT_ID!,
           clientSecret: process.env.DIALTRIBE_OIDC_CLIENT_SECRET!,
+          // Optional: name to use when Dialtribe sends none (email-code
+          // identities have no name). String or (async) function.
+          // Omit for a random `member-xxxxxxxx`.
+          fallbackName: () => myRandomHandle(),
         }), // pkce: true baked in
       ],
     }),
@@ -60,6 +64,10 @@ betterAuth({
 });
 ```
 
+`dialtribeProvider` maps the profile for you: a missing name uses
+`fallbackName` (never anything from the email), and the email only counts as
+verified when Dialtribe sends `email_verified: true`.
+
 ```ts
 // app/api/auth/backchannel-logout/route.ts
 import { createBackchannelLogoutHandler } from "@dialtribe/auth/server";

package/dist/server.d.ts

@@ -20,12 +20,23 @@ export interface DialtribeProviderOptions {
     discoveryUrl?: string;
     /** Extra scopes on top of openid/email/profile. */
     extraScopes?: string[];
+    /**
+     * Name to use when Dialtribe sends none. Identities created by email code
+     * have an empty name, and better-auth rejects an empty name
+     * (`name_is_missing`). Pass a string or a function to use your own naming
+     * style; omit it to get a random `member-xxxxxxxx`. Only used locally in
+     * your app; it is never sent back to Dialtribe.
+     */
+    fallbackName?: string | (() => string | Promise<string>);
 }
 /**
  * The better-auth `genericOAuth` provider config for Dialtribe, with PKCE baked
  * in (the Dialtribe provider requires it). Spread into the plugin:
  *
  *   genericOAuth({ config: [dialtribeProvider({ clientId, clientSecret })] })
+ *
+ * It also maps the profile: a missing name falls back to `fallbackName`, and
+ * the email only counts as verified when Dialtribe says `email_verified: true`.
  */
 export declare function dialtribeProvider(opts: DialtribeProviderOptions): {
     providerId: string;
@@ -34,6 +45,10 @@ export declare function dialtribeProvider(opts: DialtribeProviderOptions): {
     clientSecret: string;
     scopes: string[];
     pkce: true;
+    mapProfileToUser: (profile: Record<string, unknown>) => Promise<{
+        name: string;
+        emailVerified: boolean;
+    }>;
 };
 /**
  * Recommended top-level better-auth `account` options for a Dialtribe client.

package/dist/server.js

@@ -23,11 +23,24 @@ export async function getServiceOnlineCount(opts) {
     const data = (await res.json());
     return { users: data.users ?? 0, clients: data.clients ?? 0 };
 }
+/** Random, non-identifying default name (never derived from the email). */
+function defaultFallbackName() {
+    const bytes = new Uint8Array(4);
+    globalThis.crypto.getRandomValues(bytes);
+    return `member-${Array.from(bytes, (b) => b.toString(16).padStart(2, "0")).join("")}`;
+}
+async function resolveFallbackName(fallback) {
+    const value = typeof fallback === "function" ? await fallback() : fallback;
+    return (typeof value === "string" && value.trim()) || defaultFallbackName();
+}
 /**
  * The better-auth `genericOAuth` provider config for Dialtribe, with PKCE baked
  * in (the Dialtribe provider requires it). Spread into the plugin:
  *
  *   genericOAuth({ config: [dialtribeProvider({ clientId, clientSecret })] })
+ *
+ * It also maps the profile: a missing name falls back to `fallbackName`, and
+ * the email only counts as verified when Dialtribe says `email_verified: true`.
  */
 export function dialtribeProvider(opts) {
     return {
@@ -37,6 +50,13 @@ export function dialtribeProvider(opts) {
         clientSecret: opts.clientSecret,
         scopes: ["openid", "email", "profile", ...(opts.extraScopes ?? [])],
         pkce: true,
+        mapProfileToUser: async (profile) => {
+            const name = typeof profile.name === "string" ? profile.name.trim() : "";
+            return {
+                name: name || (await resolveFallbackName(opts.fallbackName)),
+                emailVerified: profile.email_verified === true,
+            };
+        },
     };
 }
 /**

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@dialtribe/auth",
-  "version": "0.1.0",
+  "version": "0.1.2",
   "description": "Relying-party SDK for Dialtribe Identity (OIDC SSO): sign-in, global sign-out, guest-work resume, and back-channel logout.",
   "type": "module",
   "sideEffects": false,