@farm.js/auth 0.1.0-beta.103 → 0.1.0-beta.105

package/dist/internal.d.ts

@@ -18,6 +18,7 @@ interface FarmAuthIntegration {
 }
 export declare function createFarmAuthIntegration(config: ResolvedFarmAuthConfig, options: FarmAuthIntegrationOptions): FarmAuthIntegration;
 export declare function migrateFarmAuth(): Promise<void>;
+export declare function compileFarmAuthMigration(): Promise<string>;
 export declare function disposeFarmAuth(): Promise<void>;
 export {};
 //# sourceMappingURL=internal.d.ts.map

package/dist/internal.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"internal.d.ts","sourceRoot":"","sources":["../src/internal.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,YAAY,CAAC;AAQzD,UAAU,0BAA0B;IAClC,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,aAAa,GAAG,YAAY,CAAC;CACpC;AAED,UAAU,mBAAmB;IAC3B,QAAQ,CAAC,IAAI,EAAE,kBAAkB,CAAC;IAClC,QAAQ,EAAE,MAAM,CAAC;IACjB,IAAI,EAAE,WAAW,CAAC;IAClB,QAAQ,EAAE;QAAE,QAAQ,CAAC,IAAI,EAAE,mBAAmB,CAAA;KAAE,CAAC;IACjD,MAAM,EAAE,KAAK,CAAC;QACZ,IAAI,EAAE,MAAM,CAAC;QACb,OAAO,EAAE,SAAS,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC;QAClC,OAAO,CAAC,OAAO,EAAE,OAAO,GAAG,OAAO,CAAC,QAAQ,CAAC,CAAC;KAC9C,CAAC,CAAC;CACJ;AAED,wBAAgB,yBAAyB,CACvC,MAAM,EAAE,sBAAsB,EAC9B,OAAO,EAAE,0BAA0B,GAClC,mBAAmB,CAmBrB;AAED,wBAAsB,eAAe,IAAI,OAAO,CAAC,IAAI,CAAC,CAErD;AAED,wBAAsB,eAAe,IAAI,OAAO,CAAC,IAAI,CAAC,CAErD"}
+{"version":3,"file":"internal.d.ts","sourceRoot":"","sources":["../src/internal.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,YAAY,CAAC;AASzD,UAAU,0BAA0B;IAClC,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,aAAa,GAAG,YAAY,CAAC;CACpC;AAED,UAAU,mBAAmB;IAC3B,QAAQ,CAAC,IAAI,EAAE,kBAAkB,CAAC;IAClC,QAAQ,EAAE,MAAM,CAAC;IACjB,IAAI,EAAE,WAAW,CAAC;IAClB,QAAQ,EAAE;QAAE,QAAQ,CAAC,IAAI,EAAE,mBAAmB,CAAA;KAAE,CAAC;IACjD,MAAM,EAAE,KAAK,CAAC;QACZ,IAAI,EAAE,MAAM,CAAC;QACb,OAAO,EAAE,SAAS,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC;QAClC,OAAO,CAAC,OAAO,EAAE,OAAO,GAAG,OAAO,CAAC,QAAQ,CAAC,CAAC;KAC9C,CAAC,CAAC;CACJ;AAED,wBAAgB,yBAAyB,CACvC,MAAM,EAAE,sBAAsB,EAC9B,OAAO,EAAE,0BAA0B,GAClC,mBAAmB,CAmBrB;AAED,wBAAsB,eAAe,IAAI,OAAO,CAAC,IAAI,CAAC,CAErD;AAED,wBAAsB,wBAAwB,IAAI,OAAO,CAAC,MAAM,CAAC,CAEhE;AAED,wBAAsB,eAAe,IAAI,OAAO,CAAC,IAAI,CAAC,CAErD"}

package/dist/internal.js

@@ -1,4 +1,4 @@
-import { configureFarmAuth, disposeFarmAuth as runDispose, getFarmAuthRuntime, migrateFarmAuth as runMigration, } from "./runtime.js";
+import { configureFarmAuth, disposeFarmAuth as runDispose, getFarmAuthRuntime, migrateFarmAuth as runMigration, compileFarmAuthMigration as runCompileMigration, } from "./runtime.js";
 export function createFarmAuthIntegration(config, options) {
     configureFarmAuth(config, options);
     return {
@@ -21,6 +21,9 @@ export function createFarmAuthIntegration(config, options) {
 export async function migrateFarmAuth() {
     await runMigration();
 }
+export async function compileFarmAuthMigration() {
+    return runCompileMigration();
+}
 export async function disposeFarmAuth() {
     await runDispose();
 }

package/dist/runtime.d.ts

@@ -23,5 +23,31 @@ export declare function getFarmAuthRequest(request?: Request): Request;
  */
 export declare function disposeFarmAuth(): Promise<void>;
 export declare function migrateFarmAuth(): Promise<void>;
+/**
+ * The statements `migrateFarmAuth` would run, for review before applying them.
+ * Better Auth owns the schema, so the sql comes from its migrator rather than
+ * from Farm's own table declarations.
+ */
+export declare function compileFarmAuthMigration(): Promise<string>;
+/**
+ * The origin Better Auth signs cookies and validates requests against.
+ *
+ * Better Auth trusts the baseURL's own origin and rejects everything else
+ * with INVALID_ORIGIN, so this has to resolve to the host users actually
+ * visit. Vercel exposes two: `VERCEL_URL` is unique per deployment
+ * (`my-app-a1b2c3.vercel.app`) while `VERCEL_PROJECT_PRODUCTION_URL` is the
+ * project's canonical domain. Pinning a production deployment to its
+ * per-deployment hostname rejects every request arriving on the real domain,
+ * so production prefers the canonical one and previews keep their own URL.
+ */
+export declare function resolveFarmAuthBaseURL(mode: "development" | "production", env?: NodeJS.ProcessEnv): string | undefined;
+/**
+ * Hosts that stay valid alongside the base URL.
+ *
+ * A production deployment is still reachable at its own deployment hostname,
+ * and previews get a fresh one per build, so both are trusted explicitly
+ * rather than leaving direct deployment-URL access broken.
+ */
+export declare function resolveFarmAuthTrustedOrigins(env?: NodeJS.ProcessEnv): string[];
 export {};
 //# sourceMappingURL=runtime.d.ts.map

package/dist/runtime.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"runtime.d.ts","sourceRoot":"","sources":["../src/runtime.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,YAAY,CAAC;AAMzD,UAAU,sBAAsB;IAC9B,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,aAAa,GAAG,YAAY,CAAC;CACpC;AAED,UAAU,iBAAiB;IACzB,OAAO,CAAC,OAAO,EAAE,OAAO,GAAG,OAAO,CAAC,QAAQ,CAAC,CAAC;IAC7C,GAAG,EAAE;QACH,UAAU,CAAC,KAAK,EAAE;YAAE,OAAO,EAAE,OAAO,CAAA;SAAE,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;KAC3D,CAAC;CACH;AAqBD,wBAAgB,iBAAiB,CAC/B,MAAM,EAAE,sBAAsB,EAC9B,OAAO,EAAE,sBAAsB,GAC9B,IAAI,CAeN;AAED,wBAAsB,kBAAkB,IAAI,OAAO,CAAC,iBAAiB,CAAC,CA6BrE;AAED,wBAAgB,kBAAkB,CAAC,OAAO,CAAC,EAAE,OAAO,GAAG,OAAO,CAU7D;AAED;;;;;;GAMG;AACH,wBAAsB,eAAe,IAAI,OAAO,CAAC,IAAI,CAAC,CASrD;AAED,wBAAsB,eAAe,IAAI,OAAO,CAAC,IAAI,CAAC,CAgBrD"}
+{"version":3,"file":"runtime.d.ts","sourceRoot":"","sources":["../src/runtime.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,YAAY,CAAC;AAMzD,UAAU,sBAAsB;IAC9B,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,aAAa,GAAG,YAAY,CAAC;CACpC;AAED,UAAU,iBAAiB;IACzB,OAAO,CAAC,OAAO,EAAE,OAAO,GAAG,OAAO,CAAC,QAAQ,CAAC,CAAC;IAC7C,GAAG,EAAE;QACH,UAAU,CAAC,KAAK,EAAE;YAAE,OAAO,EAAE,OAAO,CAAA;SAAE,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;KAC3D,CAAC;CACH;AAqBD,wBAAgB,iBAAiB,CAC/B,MAAM,EAAE,sBAAsB,EAC9B,OAAO,EAAE,sBAAsB,GAC9B,IAAI,CAeN;AAED,wBAAsB,kBAAkB,IAAI,OAAO,CAAC,iBAAiB,CAAC,CA6BrE;AAED,wBAAgB,kBAAkB,CAAC,OAAO,CAAC,EAAE,OAAO,GAAG,OAAO,CAU7D;AAED;;;;;;GAMG;AACH,wBAAsB,eAAe,IAAI,OAAO,CAAC,IAAI,CAAC,CASrD;AAED,wBAAsB,eAAe,IAAI,OAAO,CAAC,IAAI,CAAC,CAIrD;AAED;;;;GAIG;AACH,wBAAsB,wBAAwB,IAAI,OAAO,CAAC,MAAM,CAAC,CAEhE;AA4ED;;;;;;;;;;GAUG;AACH,wBAAgB,sBAAsB,CACpC,IAAI,EAAE,aAAa,GAAG,YAAY,EAClC,GAAG,GAAE,MAAM,CAAC,UAAwB,GACnC,MAAM,GAAG,SAAS,CAWpB;AAED;;;;;;GAMG;AACH,wBAAgB,6BAA6B,CAAC,GAAG,GAAE,MAAM,CAAC,UAAwB,GAAG,MAAM,EAAE,CAM5F"}

package/dist/runtime.js

@@ -81,6 +81,19 @@ export async function disposeFarmAuth() {
     await closeDatabase(database);
 }
 export async function migrateFarmAuth() {
+    await withAuthMigrations(async (migrations) => {
+        await migrations.runMigrations();
+    });
+}
+/**
+ * The statements `migrateFarmAuth` would run, for review before applying them.
+ * Better Auth owns the schema, so the sql comes from its migrator rather than
+ * from Farm's own table declarations.
+ */
+export async function compileFarmAuthMigration() {
+    return withAuthMigrations((migrations) => migrations.compileMigrations());
+}
+async function withAuthMigrations(use) {
     const state = getState();
     if (!state.config?.enabled || !state.options) {
         throw new Error("Farm Auth is not enabled in farm.config.ts.");
@@ -90,8 +103,7 @@ export async function migrateFarmAuth() {
     });
     const { getMigrations } = await import("better-auth/db/migration");
     try {
-        const migrations = await getMigrations(options);
-        await migrations.runMigrations();
+        return await use(await getMigrations(options));
     }
     finally {
         await closeDatabase(options.database);
@@ -115,7 +127,8 @@ async function createBetterAuthOptions(config, options, runtimeOptions = {}) {
     }
     return {
         appName: config.appName || "Farm app",
-        baseURL: resolveBaseURL(options.mode),
+        baseURL: resolveFarmAuthBaseURL(options.mode),
+        trustedOrigins: resolveFarmAuthTrustedOrigins(),
         basePath: config.basePath,
         secret: secret || "farm-auth-development-or-migration-secret",
         database: await createDatabase(config, options),
@@ -131,17 +144,46 @@ async function createBetterAuthOptions(config, options, runtimeOptions = {}) {
         },
     };
 }
-function resolveBaseURL(mode) {
-    const configured = process.env.FARM_AUTH_URL || process.env.BETTER_AUTH_URL;
+/**
+ * The origin Better Auth signs cookies and validates requests against.
+ *
+ * Better Auth trusts the baseURL's own origin and rejects everything else
+ * with INVALID_ORIGIN, so this has to resolve to the host users actually
+ * visit. Vercel exposes two: `VERCEL_URL` is unique per deployment
+ * (`my-app-a1b2c3.vercel.app`) while `VERCEL_PROJECT_PRODUCTION_URL` is the
+ * project's canonical domain. Pinning a production deployment to its
+ * per-deployment hostname rejects every request arriving on the real domain,
+ * so production prefers the canonical one and previews keep their own URL.
+ */
+export function resolveFarmAuthBaseURL(mode, env = process.env) {
+    const configured = env.FARM_AUTH_URL || env.BETTER_AUTH_URL;
     if (configured)
         return configured;
-    if (process.env.VERCEL_URL) {
-        return process.env.VERCEL_URL.startsWith("http")
-            ? process.env.VERCEL_URL
-            : `https://${process.env.VERCEL_URL}`;
-    }
+    const vercelHost = env.VERCEL_ENV === "production"
+        ? env.VERCEL_PROJECT_PRODUCTION_URL || env.VERCEL_URL
+        : env.VERCEL_URL;
+    if (vercelHost)
+        return toAbsoluteOrigin(vercelHost);
     return mode === "development" ? "http://localhost:3000" : undefined;
 }
+/**
+ * Hosts that stay valid alongside the base URL.
+ *
+ * A production deployment is still reachable at its own deployment hostname,
+ * and previews get a fresh one per build, so both are trusted explicitly
+ * rather than leaving direct deployment-URL access broken.
+ */
+export function resolveFarmAuthTrustedOrigins(env = process.env) {
+    const origins = new Set();
+    for (const host of [env.VERCEL_URL, env.VERCEL_PROJECT_PRODUCTION_URL, env.VERCEL_BRANCH_URL]) {
+        if (host)
+            origins.add(toAbsoluteOrigin(host));
+    }
+    return [...origins];
+}
+function toAbsoluteOrigin(host) {
+    return host.startsWith("http://") || host.startsWith("https://") ? host : `https://${host}`;
+}
 async function closeDatabase(database) {
     if (!database || typeof database !== "object")
         return;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@farm.js/auth",
-  "version": "0.1.0-beta.103",
+  "version": "0.1.0-beta.105",
   "description": "Farm-native authentication with email/password, server helpers, and React hooks",
   "license": "MIT",
   "repository": {