@farm.js/auth 0.1.0-beta.98 → 0.1.0

package/dist/client.d.ts

@@ -92,6 +92,8 @@ export declare function createFarmAuthClient(options?: FarmAuthClientOptions): {
     signOut: () => Promise<{
         data: {
             success: boolean;
+            url: string | undefined;
+            redirect: boolean | undefined;
         };
         error: null;
     } | {
@@ -253,6 +255,8 @@ export declare function createFarmAuthClient(options?: FarmAuthClientOptions): {
         signOut: () => Promise<{
             data: {
                 success: boolean;
+                url: string | undefined;
+                redirect: boolean | undefined;
             };
             error: null;
         } | {
@@ -334,6 +338,8 @@ export declare const getSession: () => Promise<{
 }>, signOut: () => Promise<{
     data: {
         success: boolean;
+        url: string | undefined;
+        redirect: boolean | undefined;
     };
     error: null;
 } | {
@@ -515,6 +521,8 @@ export declare const getSession: () => Promise<{
     signOut: () => Promise<{
         data: {
             success: boolean;
+            url: string | undefined;
+            redirect: boolean | undefined;
         };
         error: null;
     } | {

package/dist/client.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"client.d.ts","sourceRoot":"","sources":["../src/client.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,qBAAqB,EAAE,mBAAmB,EAAE,mBAAmB,EAAE,MAAM,YAAY,CAAC;AAElG,wBAAgB,oBAAoB,CAAC,OAAO,GAAE,qBAA0B;oBAG/C,mBAAmB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;oBAInB,mBAAmB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;iBA0CwgB,CAAC;;wBA9C5hB,mBAAmB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;wBAInB,mBAAmB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EAmC3C;AAID,eAAO,MAAQ,UAAU;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;IAAE,MAAM,UA3CR,mBAAmB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;IA2CT,OAAO;;;;;;;;;;;;;IAAE,MAAM,UAvCzB,mBAAmB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;IAuCQ,OAAO;;;;;;;;;;;;;;;;;;;;;;;;aAGyf,CAAC;;oBA9C5hB,mBAAmB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;oBAInB,mBAAmB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAuCiC,CAAC;AAE9E,YAAY,EAAE,qBAAqB,EAAE,mBAAmB,EAAE,mBAAmB,EAAE,MAAM,YAAY,CAAC"}
+{"version":3,"file":"client.d.ts","sourceRoot":"","sources":["../src/client.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,qBAAqB,EAAE,mBAAmB,EAAE,mBAAmB,EAAE,MAAM,YAAY,CAAC;AAElG,wBAAgB,oBAAoB,CAAC,OAAO,GAAE,qBAA0B;oBAG/C,mBAAmB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;oBAInB,mBAAmB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;iBA0CilB,CAAC;;wBA9CrmB,mBAAmB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;wBAInB,mBAAmB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EAmC3C;AAID,eAAO,MAAQ,UAAU;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;IAAE,MAAM,UA3CR,mBAAmB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;IA2CT,OAAO;;;;;;;;;;;;;;;IAAE,MAAM,UAvCzB,mBAAmB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;IAuCQ,OAAO;;;;;;;;;;;;;;;;;;;;;;;;aAGkkB,CAAC;;oBA9CrmB,mBAAmB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;oBAInB,mBAAmB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAuCiC,CAAC;AAE9E,YAAY,EAAE,qBAAqB,EAAE,mBAAmB,EAAE,mBAAmB,EAAE,MAAM,YAAY,CAAC"}

package/dist/internal.d.ts

@@ -18,6 +18,7 @@ interface FarmAuthIntegration {
 }
 export declare function createFarmAuthIntegration(config: ResolvedFarmAuthConfig, options: FarmAuthIntegrationOptions): FarmAuthIntegration;
 export declare function migrateFarmAuth(): Promise<void>;
+export declare function compileFarmAuthMigration(): Promise<string>;
 export declare function disposeFarmAuth(): Promise<void>;
 export {};
 //# sourceMappingURL=internal.d.ts.map

package/dist/internal.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"internal.d.ts","sourceRoot":"","sources":["../src/internal.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,YAAY,CAAC;AAQzD,UAAU,0BAA0B;IAClC,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,aAAa,GAAG,YAAY,CAAC;CACpC;AAED,UAAU,mBAAmB;IAC3B,QAAQ,CAAC,IAAI,EAAE,kBAAkB,CAAC;IAClC,QAAQ,EAAE,MAAM,CAAC;IACjB,IAAI,EAAE,WAAW,CAAC;IAClB,QAAQ,EAAE;QAAE,QAAQ,CAAC,IAAI,EAAE,mBAAmB,CAAA;KAAE,CAAC;IACjD,MAAM,EAAE,KAAK,CAAC;QACZ,IAAI,EAAE,MAAM,CAAC;QACb,OAAO,EAAE,SAAS,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC;QAClC,OAAO,CAAC,OAAO,EAAE,OAAO,GAAG,OAAO,CAAC,QAAQ,CAAC,CAAC;KAC9C,CAAC,CAAC;CACJ;AAED,wBAAgB,yBAAyB,CACvC,MAAM,EAAE,sBAAsB,EAC9B,OAAO,EAAE,0BAA0B,GAClC,mBAAmB,CAmBrB;AAED,wBAAsB,eAAe,IAAI,OAAO,CAAC,IAAI,CAAC,CAErD;AAED,wBAAsB,eAAe,IAAI,OAAO,CAAC,IAAI,CAAC,CAErD"}
+{"version":3,"file":"internal.d.ts","sourceRoot":"","sources":["../src/internal.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,YAAY,CAAC;AASzD,UAAU,0BAA0B;IAClC,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,aAAa,GAAG,YAAY,CAAC;CACpC;AAED,UAAU,mBAAmB;IAC3B,QAAQ,CAAC,IAAI,EAAE,kBAAkB,CAAC;IAClC,QAAQ,EAAE,MAAM,CAAC;IACjB,IAAI,EAAE,WAAW,CAAC;IAClB,QAAQ,EAAE;QAAE,QAAQ,CAAC,IAAI,EAAE,mBAAmB,CAAA;KAAE,CAAC;IACjD,MAAM,EAAE,KAAK,CAAC;QACZ,IAAI,EAAE,MAAM,CAAC;QACb,OAAO,EAAE,SAAS,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC;QAClC,OAAO,CAAC,OAAO,EAAE,OAAO,GAAG,OAAO,CAAC,QAAQ,CAAC,CAAC;KAC9C,CAAC,CAAC;CACJ;AAED,wBAAgB,yBAAyB,CACvC,MAAM,EAAE,sBAAsB,EAC9B,OAAO,EAAE,0BAA0B,GAClC,mBAAmB,CAmBrB;AAED,wBAAsB,eAAe,IAAI,OAAO,CAAC,IAAI,CAAC,CAErD;AAED,wBAAsB,wBAAwB,IAAI,OAAO,CAAC,MAAM,CAAC,CAEhE;AAED,wBAAsB,eAAe,IAAI,OAAO,CAAC,IAAI,CAAC,CAErD"}

package/dist/internal.js

@@ -1,4 +1,4 @@
-import { configureFarmAuth, disposeFarmAuth as runDispose, getFarmAuthRuntime, migrateFarmAuth as runMigration, } from "./runtime.js";
+import { configureFarmAuth, disposeFarmAuth as runDispose, getFarmAuthRuntime, migrateFarmAuth as runMigration, compileFarmAuthMigration as runCompileMigration, } from "./runtime.js";
 export function createFarmAuthIntegration(config, options) {
     configureFarmAuth(config, options);
     return {
@@ -21,6 +21,9 @@ export function createFarmAuthIntegration(config, options) {
 export async function migrateFarmAuth() {
     await runMigration();
 }
+export async function compileFarmAuthMigration() {
+    return runCompileMigration();
+}
 export async function disposeFarmAuth() {
     await runDispose();
 }

package/dist/runtime.d.ts

@@ -23,5 +23,31 @@ export declare function getFarmAuthRequest(request?: Request): Request;
  */
 export declare function disposeFarmAuth(): Promise<void>;
 export declare function migrateFarmAuth(): Promise<void>;
+/**
+ * The statements `migrateFarmAuth` would run, for review before applying them.
+ * Better Auth owns the schema, so the sql comes from its migrator rather than
+ * from Farm's own table declarations.
+ */
+export declare function compileFarmAuthMigration(): Promise<string>;
+/**
+ * The origin Better Auth signs cookies and validates requests against.
+ *
+ * Better Auth trusts the baseURL's own origin and rejects everything else
+ * with INVALID_ORIGIN, so this has to resolve to the host users actually
+ * visit. Vercel exposes two: `VERCEL_URL` is unique per deployment
+ * (`my-app-a1b2c3.vercel.app`) while `VERCEL_PROJECT_PRODUCTION_URL` is the
+ * project's canonical domain. Pinning a production deployment to its
+ * per-deployment hostname rejects every request arriving on the real domain,
+ * so production prefers the canonical one and previews keep their own URL.
+ */
+export declare function resolveFarmAuthBaseURL(mode: "development" | "production", env?: NodeJS.ProcessEnv): string | undefined;
+/**
+ * Hosts that stay valid alongside the base URL.
+ *
+ * A production deployment is still reachable at its own deployment hostname,
+ * and previews get a fresh one per build, so both are trusted explicitly
+ * rather than leaving direct deployment-URL access broken.
+ */
+export declare function resolveFarmAuthTrustedOrigins(env?: NodeJS.ProcessEnv): string[];
 export {};
 //# sourceMappingURL=runtime.d.ts.map

package/dist/runtime.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"runtime.d.ts","sourceRoot":"","sources":["../src/runtime.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,YAAY,CAAC;AAMzD,UAAU,sBAAsB;IAC9B,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,aAAa,GAAG,YAAY,CAAC;CACpC;AAED,UAAU,iBAAiB;IACzB,OAAO,CAAC,OAAO,EAAE,OAAO,GAAG,OAAO,CAAC,QAAQ,CAAC,CAAC;IAC7C,GAAG,EAAE;QACH,UAAU,CAAC,KAAK,EAAE;YAAE,OAAO,EAAE,OAAO,CAAA;SAAE,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;KAC3D,CAAC;CACH;AAqBD,wBAAgB,iBAAiB,CAC/B,MAAM,EAAE,sBAAsB,EAC9B,OAAO,EAAE,sBAAsB,GAC9B,IAAI,CAeN;AAED,wBAAsB,kBAAkB,IAAI,OAAO,CAAC,iBAAiB,CAAC,CAqBrE;AAED,wBAAgB,kBAAkB,CAAC,OAAO,CAAC,EAAE,OAAO,GAAG,OAAO,CAU7D;AAED;;;;;;GAMG;AACH,wBAAsB,eAAe,IAAI,OAAO,CAAC,IAAI,CAAC,CASrD;AAED,wBAAsB,eAAe,IAAI,OAAO,CAAC,IAAI,CAAC,CAgBrD"}
+{"version":3,"file":"runtime.d.ts","sourceRoot":"","sources":["../src/runtime.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,YAAY,CAAC;AAMzD,UAAU,sBAAsB;IAC9B,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,aAAa,GAAG,YAAY,CAAC;CACpC;AAED,UAAU,iBAAiB;IACzB,OAAO,CAAC,OAAO,EAAE,OAAO,GAAG,OAAO,CAAC,QAAQ,CAAC,CAAC;IAC7C,GAAG,EAAE;QACH,UAAU,CAAC,KAAK,EAAE;YAAE,OAAO,EAAE,OAAO,CAAA;SAAE,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;KAC3D,CAAC;CACH;AAqBD,wBAAgB,iBAAiB,CAC/B,MAAM,EAAE,sBAAsB,EAC9B,OAAO,EAAE,sBAAsB,GAC9B,IAAI,CAeN;AAED,wBAAsB,kBAAkB,IAAI,OAAO,CAAC,iBAAiB,CAAC,CA6BrE;AAED,wBAAgB,kBAAkB,CAAC,OAAO,CAAC,EAAE,OAAO,GAAG,OAAO,CAU7D;AAED;;;;;;GAMG;AACH,wBAAsB,eAAe,IAAI,OAAO,CAAC,IAAI,CAAC,CASrD;AAED,wBAAsB,eAAe,IAAI,OAAO,CAAC,IAAI,CAAC,CAIrD;AAED;;;;GAIG;AACH,wBAAsB,wBAAwB,IAAI,OAAO,CAAC,MAAM,CAAC,CAEhE;AA4ED;;;;;;;;;;GAUG;AACH,wBAAgB,sBAAsB,CACpC,IAAI,EAAE,aAAa,GAAG,YAAY,EAClC,GAAG,GAAE,MAAM,CAAC,UAAwB,GACnC,MAAM,GAAG,SAAS,CAWpB;AAED;;;;;;GAMG;AACH,wBAAgB,6BAA6B,CAAC,GAAG,GAAE,MAAM,CAAC,UAAwB,GAAG,MAAM,EAAE,CAM5F"}

package/dist/runtime.js

@@ -41,6 +41,15 @@ export async function getFarmAuthRuntime() {
             }
         });
         state.runtime = runtime;
+        void runtime.catch(() => {
+            if (state.runtime === runtime) {
+                state.runtime = undefined;
+                const database = state.database;
+                state.database = undefined;
+                if (database)
+                    void closeDatabase(database).catch(() => { });
+            }
+        });
     }
     return state.runtime;
 }
@@ -72,6 +81,19 @@ export async function disposeFarmAuth() {
     await closeDatabase(database);
 }
 export async function migrateFarmAuth() {
+    await withAuthMigrations(async (migrations) => {
+        await migrations.runMigrations();
+    });
+}
+/**
+ * The statements `migrateFarmAuth` would run, for review before applying them.
+ * Better Auth owns the schema, so the sql comes from its migrator rather than
+ * from Farm's own table declarations.
+ */
+export async function compileFarmAuthMigration() {
+    return withAuthMigrations((migrations) => migrations.compileMigrations());
+}
+async function withAuthMigrations(use) {
     const state = getState();
     if (!state.config?.enabled || !state.options) {
         throw new Error("Farm Auth is not enabled in farm.config.ts.");
@@ -81,8 +103,7 @@ export async function migrateFarmAuth() {
     });
     const { getMigrations } = await import("better-auth/db/migration");
     try {
-        const migrations = await getMigrations(options);
-        await migrations.runMigrations();
+        return await use(await getMigrations(options));
     }
     finally {
         await closeDatabase(options.database);
@@ -106,7 +127,8 @@ async function createBetterAuthOptions(config, options, runtimeOptions = {}) {
     }
     return {
         appName: config.appName || "Farm app",
-        baseURL: resolveBaseURL(options.mode),
+        baseURL: resolveFarmAuthBaseURL(options.mode),
+        trustedOrigins: resolveFarmAuthTrustedOrigins(),
         basePath: config.basePath,
         secret: secret || "farm-auth-development-or-migration-secret",
         database: await createDatabase(config, options),
@@ -122,17 +144,46 @@ async function createBetterAuthOptions(config, options, runtimeOptions = {}) {
         },
     };
 }
-function resolveBaseURL(mode) {
-    const configured = process.env.FARM_AUTH_URL || process.env.BETTER_AUTH_URL;
+/**
+ * The origin Better Auth signs cookies and validates requests against.
+ *
+ * Better Auth trusts the baseURL's own origin and rejects everything else
+ * with INVALID_ORIGIN, so this has to resolve to the host users actually
+ * visit. Vercel exposes two: `VERCEL_URL` is unique per deployment
+ * (`my-app-a1b2c3.vercel.app`) while `VERCEL_PROJECT_PRODUCTION_URL` is the
+ * project's canonical domain. Pinning a production deployment to its
+ * per-deployment hostname rejects every request arriving on the real domain,
+ * so production prefers the canonical one and previews keep their own URL.
+ */
+export function resolveFarmAuthBaseURL(mode, env = process.env) {
+    const configured = env.FARM_AUTH_URL || env.BETTER_AUTH_URL;
     if (configured)
         return configured;
-    if (process.env.VERCEL_URL) {
-        return process.env.VERCEL_URL.startsWith("http")
-            ? process.env.VERCEL_URL
-            : `https://${process.env.VERCEL_URL}`;
-    }
+    const vercelHost = env.VERCEL_ENV === "production"
+        ? env.VERCEL_PROJECT_PRODUCTION_URL || env.VERCEL_URL
+        : env.VERCEL_URL;
+    if (vercelHost)
+        return toAbsoluteOrigin(vercelHost);
     return mode === "development" ? "http://localhost:3000" : undefined;
 }
+/**
+ * Hosts that stay valid alongside the base URL.
+ *
+ * A production deployment is still reachable at its own deployment hostname,
+ * and previews get a fresh one per build, so both are trusted explicitly
+ * rather than leaving direct deployment-URL access broken.
+ */
+export function resolveFarmAuthTrustedOrigins(env = process.env) {
+    const origins = new Set();
+    for (const host of [env.VERCEL_URL, env.VERCEL_PROJECT_PRODUCTION_URL, env.VERCEL_BRANCH_URL]) {
+        if (host)
+            origins.add(toAbsoluteOrigin(host));
+    }
+    return [...origins];
+}
+function toAbsoluteOrigin(host) {
+    return host.startsWith("http://") || host.startsWith("https://") ? host : `https://${host}`;
+}
 async function closeDatabase(database) {
     if (!database || typeof database !== "object")
         return;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@farm.js/auth",
-  "version": "0.1.0-beta.98",
+  "version": "0.1.0",
   "description": "Farm-native authentication with email/password, server helpers, and React hooks",
   "license": "MIT",
   "repository": {
@@ -41,7 +41,7 @@
     "access": "public"
   },
   "dependencies": {
-    "better-auth": "1.5.5",
+    "better-auth": "1.7.7",
     "pg": "8.20.0"
   },
   "devDependencies": {