@effectify/node-better-auth 0.5.12 → 0.5.13-beta.0

package/dist/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@effectify/node-better-auth",
-  "version": "0.5.12",
+  "version": "0.5.13-beta.0",
   "description": "Integration of better-auth with Effect for Node.js applications",
   "repository": {
     "type": "git",

package/dist/src/lib/handler.d.ts

@@ -1,9 +1,11 @@
 import type { Auth } from "better-auth";
 import * as Effect from "effect/Effect";
-import { BetterAuthApiError } from "./better-auth-error.js";
 import type { ConfigError } from "effect/Config";
 import * as HttpServerResponse from "effect/unstable/http/HttpServerResponse";
 import * as HttpServerRequest from "effect/unstable/http/HttpServerRequest";
-export declare const toEffectHandler: (auth: {
-    handler: Auth["handler"];
-} | Auth["handler"]) => Effect.Effect<HttpServerResponse.HttpServerResponse, BetterAuthApiError | ConfigError, HttpServerRequest.HttpServerRequest>;
+type BetterAuthHandler = Auth["handler"] | {
+    readonly handler: Auth["handler"];
+    readonly options?: Pick<Auth["options"], "trustedOrigins">;
+};
+export declare const toEffectHandler: (auth: BetterAuthHandler) => Effect.Effect<HttpServerResponse.HttpServerResponse, ConfigError, HttpServerRequest.HttpServerRequest>;
+export {};

package/dist/src/lib/handler.js

@@ -5,8 +5,18 @@ import { BetterAuthApiError } from "./better-auth-error.js";
 import * as HttpServerResponse from "effect/unstable/http/HttpServerResponse";
 import * as HttpServerRequest from "effect/unstable/http/HttpServerRequest";
 import * as NodeHttpServerRequest from "@effect/platform-node/NodeHttpServerRequest";
-const TRAILING_SLASH_REGEX = /\/+$/;
-const PROTOCOL_REGEX = /(https?:\/\/)+/;
+const canonicalOrigin = (value) => {
+    if (!URL.canParse(value))
+        return undefined;
+    const url = new URL(value);
+    if ((url.protocol !== "http:" && url.protocol !== "https:") ||
+        url.username !== "" ||
+        url.password !== "" ||
+        url.hostname.includes("*")) {
+        return undefined;
+    }
+    return url.origin;
+};
 export const toEffectHandler = (auth) => Effect.gen(function* () {
     const request = yield* HttpServerRequest.HttpServerRequest;
     const nodeRequest = NodeHttpServerRequest.toIncomingMessage(request);
@@ -14,14 +24,21 @@ export const toEffectHandler = (auth) => Effect.gen(function* () {
     const appUrl = yield* Config.url("BETTER_AUTH_URL");
     // Debug: log the configured app URL so we can diagnose Config errors
     yield* Effect.log(`toEffectHandler: BETTER_AUTH_URL=${String(appUrl)}`);
-    const normalizeUrl = (url) => url
-        .toString()
-        .replace(TRAILING_SLASH_REGEX, "")
-        .replace(PROTOCOL_REGEX, "http://");
-    const allowedOrigins = [normalizeUrl(appUrl)];
-    const origin = nodeRequest.headers.origin ? normalizeUrl(appUrl) : "";
-    if (allowedOrigins.includes(origin)) {
-        nodeResponse.setHeader("Access-Control-Allow-Origin", nodeRequest.headers.origin || "");
+    const allowedOrigins = new Set([appUrl.origin]);
+    const trustedOrigins = typeof auth === "function" ? undefined : auth.options?.trustedOrigins;
+    if (Array.isArray(trustedOrigins)) {
+        for (const trustedOrigin of trustedOrigins) {
+            if (typeof trustedOrigin !== "string")
+                continue;
+            const origin = canonicalOrigin(trustedOrigin);
+            if (origin !== undefined)
+                allowedOrigins.add(origin);
+        }
+    }
+    const requestOrigin = nodeRequest.headers.origin;
+    const origin = requestOrigin === undefined ? undefined : canonicalOrigin(requestOrigin);
+    if (origin !== undefined && allowedOrigins.has(origin)) {
+        nodeResponse.setHeader("Access-Control-Allow-Origin", origin);
         nodeResponse.setHeader("Access-Control-Allow-Methods", "GET, POST, PUT, DELETE, OPTIONS");
         nodeResponse.setHeader("Access-Control-Allow-Headers", "Content-Type, Authorization");
         nodeResponse.setHeader("Access-Control-Max-Age", "600");
@@ -35,40 +52,28 @@ export const toEffectHandler = (auth) => Effect.gen(function* () {
     }
     // Log incoming request for debugging
     const authHeader = nodeRequest.headers.authorization;
-    yield* Effect.log(`toEffectHandler: incoming ${nodeRequest.method} ${String(nodeRequest.url)} headers: cookie=${nodeRequest.headers.cookie?.substring(0, 50) || "none"}, auth=${authHeader?.substring(0, 30) || "none"}`);
+    yield* Effect.log(`toEffectHandler: incoming ${nodeRequest.method} ${String(nodeRequest.url)} headers: cookie=${nodeRequest.headers.cookie ? "present" : "none"}, auth=${authHeader ? "present" : "none"}`);
     // If no cookie but has Authorization header (bearer token), set it as cookie for better-auth
     if (!nodeRequest.headers.cookie && authHeader?.startsWith("Bearer ")) {
         const token = authHeader.slice(7); // Remove "Bearer " prefix
         nodeRequest.headers.cookie = `better-auth.session_token=${token}`;
         yield* Effect.log(`toEffectHandler: using token from Authorization header as cookie`);
     }
-    try {
-        yield* Effect.tryPromise({
-            try: () => "handler" in auth
-                ? toNodeHandler(auth.handler)(nodeRequest, nodeResponse)
-                : toNodeHandler(auth)(nodeRequest, nodeResponse),
-            catch: (cause) => new BetterAuthApiError({ cause }),
-        });
-        // Log the response status after the handler completes
-        yield* Effect.log(`toEffectHandler: completed ${nodeRequest.method} ${String(nodeRequest.url)} -> ${nodeResponse.statusCode}`);
-    }
-    catch (err) {
-        // Ensure we log errors from the underlying handler for debugging
-        yield* Effect.log(`toEffectHandler: error handling ${nodeRequest.method} ${String(nodeRequest.url)}: ${String(err)}`);
-        try {
-            // Try to return the error to the client as JSON to make debugging easier
-            nodeResponse.statusCode = 500;
-            nodeResponse.setHeader("Content-Type", "application/json");
-            const payload = JSON.stringify({ error: String(err) });
-            nodeResponse.end(payload);
-        }
-        catch (writeErr) {
-            // If writing the error response fails, log that too
-            yield* Effect.log(`toEffectHandler: failed to write error response: ${String(writeErr)}`);
+    const handler = typeof auth === "function" ? auth : auth.handler;
+    return yield* Effect.tryPromise({
+        try: () => toNodeHandler(handler)(nodeRequest, nodeResponse),
+        catch: (cause) => new BetterAuthApiError({ cause }),
+    }).pipe(Effect.tap(() => Effect.log(`toEffectHandler: completed ${nodeRequest.method} ${String(nodeRequest.url)} -> ${nodeResponse.statusCode}`)), Effect.map(() => HttpServerResponse.empty({
+        status: nodeResponse.writableEnded ? nodeResponse.statusCode : 499,
+    })), Effect.catchTag("BetterAuthApiError", (error) => Effect.gen(function* () {
+        const errorMessage = `${String(error)}: ${String(error.cause)}`;
+        yield* Effect.log(`toEffectHandler: error handling ${nodeRequest.method} ${String(nodeRequest.url)}: ${errorMessage}`);
+        if (nodeResponse.headersSent || nodeResponse.writableEnded) {
+            if (!nodeResponse.writableEnded) {
+                yield* Effect.sync(() => nodeResponse.end());
+            }
+            return HttpServerResponse.empty({ status: nodeResponse.statusCode });
         }
-        return HttpServerResponse.empty({ status: 500 });
-    }
-    return HttpServerResponse.empty({
-        status: nodeResponse.writableFinished ? nodeResponse.statusCode : 499,
-    });
+        return HttpServerResponse.jsonUnsafe({ error: "Internal Server Error" }, { status: 500 });
+    })));
 });

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@effectify/node-better-auth",
-  "version": "0.5.12",
+  "version": "0.5.13-beta.0",
   "description": "Integration of better-auth with Effect for Node.js applications",
   "repository": {
     "type": "git",