@farm.js/auth 0.1.0-beta.10 → 0.1.0-beta.101

package/dist/config.js

@@ -48,11 +48,47 @@ export function resolveFarmAuthConfig(input) {
     return resolved;
 }
 function normalizeBasePath(value) {
-    const path = (value || "/api/auth").trim();
-    const withLeadingSlash = path.startsWith("/") ? path : `/${path}`;
+    const route = (value || "/api/auth").trim();
+    if (!route)
+        return "/api/auth";
+    assertStableBasePath(route);
+    const withLeadingSlash = route.startsWith("/") ? route : `/${route}`;
     const normalized = withLeadingSlash.replace(/\/+/g, "/").replace(/\/+$/, "");
     return normalized || "/api/auth";
 }
+function assertStableBasePath(route) {
+    if (route.includes("?") || route.includes("#")) {
+        throw new Error("auth.basePath cannot contain a query string or fragment.");
+    }
+    if (route.startsWith("//") || /^[a-z][a-z\d+.-]*:\/\//i.test(route)) {
+        throw new Error('auth.basePath must be an application pathname such as "/api/auth".');
+    }
+    if (hasUnstablePathCharacters(route)) {
+        throw new Error("auth.basePath cannot contain backslashes or control characters.");
+    }
+    for (const segment of route.split("/")) {
+        let decoded = segment;
+        try {
+            decoded = decodeURIComponent(segment);
+        }
+        catch {
+            // Malformed escapes remain literal URL pathname segments.
+        }
+        if (hasUnstablePathCharacters(decoded) || decoded.includes("/")) {
+            throw new Error("auth.basePath cannot contain encoded path separators.");
+        }
+        if (decoded === "." || decoded === "..") {
+            throw new Error('auth.basePath cannot contain "." or ".." path segments.');
+        }
+    }
+}
+function hasUnstablePathCharacters(value) {
+    return (value.includes("\\") ||
+        Array.from(value).some((character) => {
+            const code = character.charCodeAt(0);
+            return code <= 31 || (code >= 127 && code <= 159);
+        }));
+}
 function validateFarmAuthConfig(config) {
     const { minPasswordLength, maxPasswordLength } = config.emailAndPassword;
     if (!Number.isInteger(minPasswordLength) || minPasswordLength < 1) {

package/dist/internal.d.ts

@@ -18,5 +18,6 @@ interface FarmAuthIntegration {
 }
 export declare function createFarmAuthIntegration(config: ResolvedFarmAuthConfig, options: FarmAuthIntegrationOptions): FarmAuthIntegration;
 export declare function migrateFarmAuth(): Promise<void>;
+export declare function disposeFarmAuth(): Promise<void>;
 export {};
 //# sourceMappingURL=internal.d.ts.map

package/dist/internal.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"internal.d.ts","sourceRoot":"","sources":["../src/internal.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,YAAY,CAAC;AAOzD,UAAU,0BAA0B;IAClC,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,aAAa,GAAG,YAAY,CAAC;CACpC;AAED,UAAU,mBAAmB;IAC3B,QAAQ,CAAC,IAAI,EAAE,kBAAkB,CAAC;IAClC,QAAQ,EAAE,MAAM,CAAC;IACjB,IAAI,EAAE,WAAW,CAAC;IAClB,QAAQ,EAAE;QAAE,QAAQ,CAAC,IAAI,EAAE,mBAAmB,CAAA;KAAE,CAAC;IACjD,MAAM,EAAE,KAAK,CAAC;QACZ,IAAI,EAAE,MAAM,CAAC;QACb,OAAO,EAAE,SAAS,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC;QAClC,OAAO,CAAC,OAAO,EAAE,OAAO,GAAG,OAAO,CAAC,QAAQ,CAAC,CAAC;KAC9C,CAAC,CAAC;CACJ;AAED,wBAAgB,yBAAyB,CACvC,MAAM,EAAE,sBAAsB,EAC9B,OAAO,EAAE,0BAA0B,GAClC,mBAAmB,CAmBrB;AAED,wBAAsB,eAAe,IAAI,OAAO,CAAC,IAAI,CAAC,CAErD"}
+{"version":3,"file":"internal.d.ts","sourceRoot":"","sources":["../src/internal.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,YAAY,CAAC;AAQzD,UAAU,0BAA0B;IAClC,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,aAAa,GAAG,YAAY,CAAC;CACpC;AAED,UAAU,mBAAmB;IAC3B,QAAQ,CAAC,IAAI,EAAE,kBAAkB,CAAC;IAClC,QAAQ,EAAE,MAAM,CAAC;IACjB,IAAI,EAAE,WAAW,CAAC;IAClB,QAAQ,EAAE;QAAE,QAAQ,CAAC,IAAI,EAAE,mBAAmB,CAAA;KAAE,CAAC;IACjD,MAAM,EAAE,KAAK,CAAC;QACZ,IAAI,EAAE,MAAM,CAAC;QACb,OAAO,EAAE,SAAS,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC;QAClC,OAAO,CAAC,OAAO,EAAE,OAAO,GAAG,OAAO,CAAC,QAAQ,CAAC,CAAC;KAC9C,CAAC,CAAC;CACJ;AAED,wBAAgB,yBAAyB,CACvC,MAAM,EAAE,sBAAsB,EAC9B,OAAO,EAAE,0BAA0B,GAClC,mBAAmB,CAmBrB;AAED,wBAAsB,eAAe,IAAI,OAAO,CAAC,IAAI,CAAC,CAErD;AAED,wBAAsB,eAAe,IAAI,OAAO,CAAC,IAAI,CAAC,CAErD"}

package/dist/internal.js

@@ -1,4 +1,4 @@
-import { configureFarmAuth, getFarmAuthRuntime, migrateFarmAuth as runMigration, } from "./runtime.js";
+import { configureFarmAuth, disposeFarmAuth as runDispose, getFarmAuthRuntime, migrateFarmAuth as runMigration, } from "./runtime.js";
 export function createFarmAuthIntegration(config, options) {
     configureFarmAuth(config, options);
     return {
@@ -21,3 +21,6 @@ export function createFarmAuthIntegration(config, options) {
 export async function migrateFarmAuth() {
     await runMigration();
 }
+export async function disposeFarmAuth() {
+    await runDispose();
+}

package/dist/runtime.d.ts

@@ -14,6 +14,14 @@ interface BetterAuthRuntime {
 export declare function configureFarmAuth(config: ResolvedFarmAuthConfig, options: FarmAuthRuntimeOptions): void;
 export declare function getFarmAuthRuntime(): Promise<BetterAuthRuntime>;
 export declare function getFarmAuthRequest(request?: Request): Request;
+/**
+ * Close the connection opened for the runtime and drop the cached instance.
+ *
+ * The runtime is cached on globalThis and its connection stays open for the life
+ * of the process, which leaves a file lock behind on SQLite and a pool open on
+ * every other driver. Call this from a teardown hook.
+ */
+export declare function disposeFarmAuth(): Promise<void>;
 export declare function migrateFarmAuth(): Promise<void>;
 export {};
 //# sourceMappingURL=runtime.d.ts.map

package/dist/runtime.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"runtime.d.ts","sourceRoot":"","sources":["../src/runtime.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,YAAY,CAAC;AAMzD,UAAU,sBAAsB;IAC9B,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,aAAa,GAAG,YAAY,CAAC;CACpC;AAED,UAAU,iBAAiB;IACzB,OAAO,CAAC,OAAO,EAAE,OAAO,GAAG,OAAO,CAAC,QAAQ,CAAC,CAAC;IAC7C,GAAG,EAAE;QACH,UAAU,CAAC,KAAK,EAAE;YAAE,OAAO,EAAE,OAAO,CAAA;SAAE,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;KAC3D,CAAC;CACH;AAmBD,wBAAgB,iBAAiB,CAC/B,MAAM,EAAE,sBAAsB,EAC9B,OAAO,EAAE,sBAAsB,GAC9B,IAAI,CAYN;AAED,wBAAsB,kBAAkB,IAAI,OAAO,CAAC,iBAAiB,CAAC,CAUrE;AAED,wBAAgB,kBAAkB,CAAC,OAAO,CAAC,EAAE,OAAO,GAAG,OAAO,CAU7D;AAED,wBAAsB,eAAe,IAAI,OAAO,CAAC,IAAI,CAAC,CAgBrD"}
+{"version":3,"file":"runtime.d.ts","sourceRoot":"","sources":["../src/runtime.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,YAAY,CAAC;AAMzD,UAAU,sBAAsB;IAC9B,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,aAAa,GAAG,YAAY,CAAC;CACpC;AAED,UAAU,iBAAiB;IACzB,OAAO,CAAC,OAAO,EAAE,OAAO,GAAG,OAAO,CAAC,QAAQ,CAAC,CAAC;IAC7C,GAAG,EAAE;QACH,UAAU,CAAC,KAAK,EAAE;YAAE,OAAO,EAAE,OAAO,CAAA;SAAE,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;KAC3D,CAAC;CACH;AAqBD,wBAAgB,iBAAiB,CAC/B,MAAM,EAAE,sBAAsB,EAC9B,OAAO,EAAE,sBAAsB,GAC9B,IAAI,CAeN;AAED,wBAAsB,kBAAkB,IAAI,OAAO,CAAC,iBAAiB,CAAC,CA6BrE;AAED,wBAAgB,kBAAkB,CAAC,OAAO,CAAC,EAAE,OAAO,GAAG,OAAO,CAU7D;AAED;;;;;;GAMG;AACH,wBAAsB,eAAe,IAAI,OAAO,CAAC,IAAI,CAAC,CASrD;AAED,wBAAsB,eAAe,IAAI,OAAO,CAAC,IAAI,CAAC,CAgBrD"}

package/dist/runtime.js

@@ -17,7 +17,11 @@ export function configureFarmAuth(config, options) {
     state.config = config;
     state.options = options;
     if (changed) {
+        const previous = state.database;
         state.runtime = undefined;
+        state.database = undefined;
+        if (previous)
+            void closeDatabase(previous).catch(() => { });
     }
 }
 export async function getFarmAuthRuntime() {
@@ -25,7 +29,28 @@ export async function getFarmAuthRuntime() {
     if (!state.config?.enabled || !state.options) {
         throw new Error("Farm Auth is not enabled. Add `auth: true` to farm.config.ts before using @farm.js/auth.");
     }
-    state.runtime ||= createRuntime(state.config, state.options);
+    if (!state.runtime) {
+        const runtime = createRuntime(state.config, state.options, (database) => {
+            // A dispose or reconfigure that raced this creation already closed what it
+            // knew about, so an orphaned connection closes itself instead of leaking.
+            if (state.runtime === runtime) {
+                state.database = database;
+            }
+            else {
+                void closeDatabase(database).catch(() => { });
+            }
+        });
+        state.runtime = runtime;
+        void runtime.catch(() => {
+            if (state.runtime === runtime) {
+                state.runtime = undefined;
+                const database = state.database;
+                state.database = undefined;
+                if (database)
+                    void closeDatabase(database).catch(() => { });
+            }
+        });
+    }
     return state.runtime;
 }
 export function getFarmAuthRequest(request) {
@@ -37,6 +62,24 @@ export function getFarmAuthRequest(request) {
     }
     return current;
 }
+/**
+ * Close the connection opened for the runtime and drop the cached instance.
+ *
+ * The runtime is cached on globalThis and its connection stays open for the life
+ * of the process, which leaves a file lock behind on SQLite and a pool open on
+ * every other driver. Call this from a teardown hook.
+ */
+export async function disposeFarmAuth() {
+    const state = getState();
+    // Let an in-flight creation finish so its connection is registered and closed
+    // here, instead of resolving before the handle even exists.
+    if (state.runtime)
+        await state.runtime.catch(() => { });
+    const database = state.database;
+    state.runtime = undefined;
+    state.database = undefined;
+    await closeDatabase(database);
+}
 export async function migrateFarmAuth() {
     const state = getState();
     if (!state.config?.enabled || !state.options) {
@@ -54,8 +97,9 @@ export async function migrateFarmAuth() {
         await closeDatabase(options.database);
     }
 }
-async function createRuntime(config, options) {
+async function createRuntime(config, options, onDatabase) {
     const authOptions = await createBetterAuthOptions(config, options);
+    onDatabase(authOptions.database);
     if (options.mode === "development" && config.database.migrateInDevelopment) {
         const { getMigrations } = await import("better-auth/db/migration");
         const migrations = await getMigrations(authOptions);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@farm.js/auth",
-  "version": "0.1.0-beta.10",
+  "version": "0.1.0-beta.101",
   "description": "Farm-native authentication with email/password, server helpers, and React hooks",
   "license": "MIT",
   "repository": {
@@ -50,7 +50,7 @@
     "@types/react": "^18.2.45",
     "react": "19.2.8",
     "typescript": "^5.3.3",
-    "vitest": "^1.1.0"
+    "vitest": "^3.2.7"
   },
   "peerDependencies": {
     "react": "^18.2.0 || ^19.0.0"