@farm.js/auth 0.1.0-beta.104 → 0.1.0-beta.105

package/dist/runtime.d.ts

@@ -29,5 +29,25 @@ export declare function migrateFarmAuth(): Promise<void>;
  * from Farm's own table declarations.
  */
 export declare function compileFarmAuthMigration(): Promise<string>;
+/**
+ * The origin Better Auth signs cookies and validates requests against.
+ *
+ * Better Auth trusts the baseURL's own origin and rejects everything else
+ * with INVALID_ORIGIN, so this has to resolve to the host users actually
+ * visit. Vercel exposes two: `VERCEL_URL` is unique per deployment
+ * (`my-app-a1b2c3.vercel.app`) while `VERCEL_PROJECT_PRODUCTION_URL` is the
+ * project's canonical domain. Pinning a production deployment to its
+ * per-deployment hostname rejects every request arriving on the real domain,
+ * so production prefers the canonical one and previews keep their own URL.
+ */
+export declare function resolveFarmAuthBaseURL(mode: "development" | "production", env?: NodeJS.ProcessEnv): string | undefined;
+/**
+ * Hosts that stay valid alongside the base URL.
+ *
+ * A production deployment is still reachable at its own deployment hostname,
+ * and previews get a fresh one per build, so both are trusted explicitly
+ * rather than leaving direct deployment-URL access broken.
+ */
+export declare function resolveFarmAuthTrustedOrigins(env?: NodeJS.ProcessEnv): string[];
 export {};
 //# sourceMappingURL=runtime.d.ts.map

package/dist/runtime.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"runtime.d.ts","sourceRoot":"","sources":["../src/runtime.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,YAAY,CAAC;AAMzD,UAAU,sBAAsB;IAC9B,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,aAAa,GAAG,YAAY,CAAC;CACpC;AAED,UAAU,iBAAiB;IACzB,OAAO,CAAC,OAAO,EAAE,OAAO,GAAG,OAAO,CAAC,QAAQ,CAAC,CAAC;IAC7C,GAAG,EAAE;QACH,UAAU,CAAC,KAAK,EAAE;YAAE,OAAO,EAAE,OAAO,CAAA;SAAE,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;KAC3D,CAAC;CACH;AAqBD,wBAAgB,iBAAiB,CAC/B,MAAM,EAAE,sBAAsB,EAC9B,OAAO,EAAE,sBAAsB,GAC9B,IAAI,CAeN;AAED,wBAAsB,kBAAkB,IAAI,OAAO,CAAC,iBAAiB,CAAC,CA6BrE;AAED,wBAAgB,kBAAkB,CAAC,OAAO,CAAC,EAAE,OAAO,GAAG,OAAO,CAU7D;AAED;;;;;;GAMG;AACH,wBAAsB,eAAe,IAAI,OAAO,CAAC,IAAI,CAAC,CASrD;AAED,wBAAsB,eAAe,IAAI,OAAO,CAAC,IAAI,CAAC,CAIrD;AAED;;;;GAIG;AACH,wBAAsB,wBAAwB,IAAI,OAAO,CAAC,MAAM,CAAC,CAEhE"}
+{"version":3,"file":"runtime.d.ts","sourceRoot":"","sources":["../src/runtime.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,YAAY,CAAC;AAMzD,UAAU,sBAAsB;IAC9B,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,aAAa,GAAG,YAAY,CAAC;CACpC;AAED,UAAU,iBAAiB;IACzB,OAAO,CAAC,OAAO,EAAE,OAAO,GAAG,OAAO,CAAC,QAAQ,CAAC,CAAC;IAC7C,GAAG,EAAE;QACH,UAAU,CAAC,KAAK,EAAE;YAAE,OAAO,EAAE,OAAO,CAAA;SAAE,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;KAC3D,CAAC;CACH;AAqBD,wBAAgB,iBAAiB,CAC/B,MAAM,EAAE,sBAAsB,EAC9B,OAAO,EAAE,sBAAsB,GAC9B,IAAI,CAeN;AAED,wBAAsB,kBAAkB,IAAI,OAAO,CAAC,iBAAiB,CAAC,CA6BrE;AAED,wBAAgB,kBAAkB,CAAC,OAAO,CAAC,EAAE,OAAO,GAAG,OAAO,CAU7D;AAED;;;;;;GAMG;AACH,wBAAsB,eAAe,IAAI,OAAO,CAAC,IAAI,CAAC,CASrD;AAED,wBAAsB,eAAe,IAAI,OAAO,CAAC,IAAI,CAAC,CAIrD;AAED;;;;GAIG;AACH,wBAAsB,wBAAwB,IAAI,OAAO,CAAC,MAAM,CAAC,CAEhE;AA4ED;;;;;;;;;;GAUG;AACH,wBAAgB,sBAAsB,CACpC,IAAI,EAAE,aAAa,GAAG,YAAY,EAClC,GAAG,GAAE,MAAM,CAAC,UAAwB,GACnC,MAAM,GAAG,SAAS,CAWpB;AAED;;;;;;GAMG;AACH,wBAAgB,6BAA6B,CAAC,GAAG,GAAE,MAAM,CAAC,UAAwB,GAAG,MAAM,EAAE,CAM5F"}

package/dist/runtime.js

@@ -127,7 +127,8 @@ async function createBetterAuthOptions(config, options, runtimeOptions = {}) {
     }
     return {
         appName: config.appName || "Farm app",
-        baseURL: resolveBaseURL(options.mode),
+        baseURL: resolveFarmAuthBaseURL(options.mode),
+        trustedOrigins: resolveFarmAuthTrustedOrigins(),
         basePath: config.basePath,
         secret: secret || "farm-auth-development-or-migration-secret",
         database: await createDatabase(config, options),
@@ -143,17 +144,46 @@ async function createBetterAuthOptions(config, options, runtimeOptions = {}) {
         },
     };
 }
-function resolveBaseURL(mode) {
-    const configured = process.env.FARM_AUTH_URL || process.env.BETTER_AUTH_URL;
+/**
+ * The origin Better Auth signs cookies and validates requests against.
+ *
+ * Better Auth trusts the baseURL's own origin and rejects everything else
+ * with INVALID_ORIGIN, so this has to resolve to the host users actually
+ * visit. Vercel exposes two: `VERCEL_URL` is unique per deployment
+ * (`my-app-a1b2c3.vercel.app`) while `VERCEL_PROJECT_PRODUCTION_URL` is the
+ * project's canonical domain. Pinning a production deployment to its
+ * per-deployment hostname rejects every request arriving on the real domain,
+ * so production prefers the canonical one and previews keep their own URL.
+ */
+export function resolveFarmAuthBaseURL(mode, env = process.env) {
+    const configured = env.FARM_AUTH_URL || env.BETTER_AUTH_URL;
     if (configured)
         return configured;
-    if (process.env.VERCEL_URL) {
-        return process.env.VERCEL_URL.startsWith("http")
-            ? process.env.VERCEL_URL
-            : `https://${process.env.VERCEL_URL}`;
-    }
+    const vercelHost = env.VERCEL_ENV === "production"
+        ? env.VERCEL_PROJECT_PRODUCTION_URL || env.VERCEL_URL
+        : env.VERCEL_URL;
+    if (vercelHost)
+        return toAbsoluteOrigin(vercelHost);
     return mode === "development" ? "http://localhost:3000" : undefined;
 }
+/**
+ * Hosts that stay valid alongside the base URL.
+ *
+ * A production deployment is still reachable at its own deployment hostname,
+ * and previews get a fresh one per build, so both are trusted explicitly
+ * rather than leaving direct deployment-URL access broken.
+ */
+export function resolveFarmAuthTrustedOrigins(env = process.env) {
+    const origins = new Set();
+    for (const host of [env.VERCEL_URL, env.VERCEL_PROJECT_PRODUCTION_URL, env.VERCEL_BRANCH_URL]) {
+        if (host)
+            origins.add(toAbsoluteOrigin(host));
+    }
+    return [...origins];
+}
+function toAbsoluteOrigin(host) {
+    return host.startsWith("http://") || host.startsWith("https://") ? host : `https://${host}`;
+}
 async function closeDatabase(database) {
     if (!database || typeof database !== "object")
         return;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@farm.js/auth",
-  "version": "0.1.0-beta.104",
+  "version": "0.1.0-beta.105",
   "description": "Farm-native authentication with email/password, server helpers, and React hooks",
   "license": "MIT",
   "repository": {