@headless-lms/adapter-auth 0.3.0 → 0.4.0

package/dist/better-auth.js

@@ -1,8 +1,8 @@
-import { accessTokenAuthorization, consentOrgId, grantFromClaims, isCompactJws, needsOrgChoice, orgIdFromMetadata, permissionsToScopes, scopesToPermissions } from "./access-grant.js";
-import { ac, roles } from "./access.js";
+import { accessTokenAuthorization, consentOrgId, grantFromClaims, isCompactJws, needsOrgChoice, orgIdFromMetadata, roleFromMetadata } from "./access-grant.js";
+import { OWNER_MEMBERSHIP, PARTICIPANT_MEMBERSHIP, ac, roles } from "./access.js";
 import { withLoopbackNativeDefault } from "./client-registration.js";
 import { ACCESS_TOKEN_TTL_SECONDS, ORG_CLAIM } from "@headless-lms/core/identity";
-import { ACCESS_SCOPES, OrganizationRuleError, parseRole } from "@headless-lms/core/organizations";
+import { ALL_PERMISSIONS, OrganizationRuleError } from "@headless-lms/core/organizations";
 import { createDpopReplayStore, enforceDpopBinding, isDpopBindingError, verifyJwsAccessToken } from "better-auth/oauth2";
 import { fromNodeHeaders } from "better-auth/node";
 import { APIError, betterAuth } from "better-auth";
@@ -10,20 +10,30 @@ import { createAuthMiddleware } from "better-auth/api";
 import { drizzleAdapter } from "better-auth/adapters/drizzle";
 import * as authSchema from "@headless-lms/adapter-db/schema/better-auth";
 import { prefixId } from "@headless-lms/core/shared/id";
-import { NotFoundError } from "@headless-lms/core/shared/errors";
-import { customSession, jwt, magicLink, organization } from "better-auth/plugins";
+import { ConflictError, NotFoundError } from "@headless-lms/core/shared/errors";
+import { jwt, magicLink, organization } from "better-auth/plugins";
+import { getOrgAdapter } from "better-auth/plugins/organization";
 import { oauthProviderAuthServerMetadata } from "@better-auth/oauth-provider";
 import { mcp } from "@better-auth/mcp";
 import { cimd } from "@better-auth/cimd";
 import { fetchClientMetadataResource } from "@better-auth/cimd/node";
 import { apiKey } from "@better-auth/api-key";
-import { eq } from "drizzle-orm";
+import { and, count, eq, sql } from "drizzle-orm";
 //#region src/better-auth.ts
 const JWT_ALG = "EdDSA";
-const UNMIRRORED_ORG_ENDPOINTS = /* @__PURE__ */ new Set([
-	"/organization/leave",
-	"/organization/invite-member",
-	"/organization/accept-invitation"
+const API_KEY_PREFIX = "hlms_";
+const API_KEY_NAME_MAX = 80;
+const DAY_SECONDS = 1440 * 60;
+const OPEN_ORG_ENDPOINTS = /* @__PURE__ */ new Set([
+	"/organization/set-active",
+	"/organization/list",
+	"/organization/get-active-member"
+]);
+const CORE_API_KEY_ENDPOINTS = /* @__PURE__ */ new Set([
+	"/api-key/get",
+	"/api-key/list",
+	"/api-key/update",
+	"/api-key/delete"
 ]);
 const OAUTH_CLIENT_WRITES = /* @__PURE__ */ new Set([
 	"/oauth2/create-client",
@@ -42,8 +52,8 @@ function mcpOAuthPlugins(opts) {
 		resource: opts.mcp.resource,
 		loginPage: opts.mcp.loginPage,
 		consentPage: opts.mcp.consentPage,
-		scopes: [...ACCESS_SCOPES, "offline_access"],
-		clientRegistrationDefaultScopes: [...ACCESS_SCOPES, "offline_access"],
+		scopes: [...ALL_PERMISSIONS, "offline_access"],
+		clientRegistrationDefaultScopes: [...ALL_PERMISSIONS, "offline_access"],
 		accessTokenExpiresIn: ACCESS_TOKEN_TTL_SECONDS,
 		allowDynamicClientRegistration: true,
 		allowUnauthenticatedClientRegistration: true,
@@ -71,6 +81,10 @@ function buildAuthOptions(opts) {
 		baseURL: opts.baseUrl,
 		secret: opts.secret,
 		trustedOrigins: opts.trustedOrigins,
+		logger: { log: (level, message, ...args) => {
+			const [first] = args;
+			opts.logger[level](message, first instanceof Error ? { err: first } : args.length > 0 ? { details: args } : void 0);
+		} },
 		session: { cookieCache: {
 			enabled: true,
 			maxAge: 300
@@ -105,7 +119,8 @@ function buildAuthOptions(opts) {
 			organization({
 				ac,
 				roles,
-				creatorRole: "owner",
+				creatorRole: OWNER_MEMBERSHIP,
+				membershipLimit: Number.MAX_SAFE_INTEGER,
 				organizationHooks: opts.hooks
 			}),
 			jwt({
@@ -115,37 +130,15 @@ function buildAuthOptions(opts) {
 			...opts.mcp.oauthEnabled ? mcpOAuthPlugins(opts) : [],
 			apiKey({
 				enableMetadata: true,
+				defaultPrefix: API_KEY_PREFIX,
+				maximumNameLength: API_KEY_NAME_MAX,
 				rateLimit: { enabled: false }
-			}),
-			customSession(async ({ user, session }) => {
-				const memberships = await opts.db.select({
-					role: authSchema.member.role,
-					id: authSchema.organization.id,
-					name: authSchema.organization.name,
-					slug: authSchema.organization.slug
-				}).from(authSchema.member).innerJoin(authSchema.organization, eq(authSchema.member.organizationId, authSchema.organization.id)).where(eq(authSchema.member.userId, user.id));
-				const activeOrgId = session.activeOrganizationId ?? null;
-				const active = memberships.find((m) => m.id === activeOrgId) ?? null;
-				return {
-					user,
-					session,
-					activeMemberRole: active?.role ?? null,
-					activeOrganization: active ? {
-						id: active.id,
-						name: active.name,
-						slug: active.slug
-					} : null,
-					organizations: memberships.map(({ id, name, slug }) => ({
-						id,
-						name,
-						slug
-					}))
-				};
 			})
 		],
 		hooks: { before: createAuthMiddleware(async (ctx) => {
 			if (ctx.path === "/api-key/create" && (ctx.request || ctx.headers)) throw new APIError("FORBIDDEN", { message: "API keys are created through the LMS" });
-			if (UNMIRRORED_ORG_ENDPOINTS.has(ctx.path)) throw new APIError("FORBIDDEN", { message: "Membership changes go through the LMS" });
+			if (ctx.request && ctx.path.startsWith("/organization/") && !OPEN_ORG_ENDPOINTS.has(ctx.path)) throw new APIError("FORBIDDEN", { message: "Organizations are managed through the LMS" });
+			if (ctx.request && CORE_API_KEY_ENDPOINTS.has(ctx.path)) throw new APIError("FORBIDDEN", { message: "API keys are managed through the LMS" });
 			if (OAUTH_CLIENT_WRITES.has(ctx.path) && (ctx.request || ctx.headers)) throw new APIError("FORBIDDEN", { message: "Apps register themselves when they connect" });
 			if (ctx.path === "/api-key/update" && ctx.body?.metadata !== void 0) throw new APIError("FORBIDDEN", { message: "An API key stays in the organization it was made for" });
 			if (ctx.path !== "/oauth2/register") return;
@@ -161,14 +154,34 @@ function buildAuthOptions(opts) {
 function createAuth(opts) {
 	return betterAuth(buildAuthOptions(opts));
 }
+function toStored(key) {
+	return {
+		id: key.id,
+		name: key.name ?? null,
+		start: key.start ?? null,
+		roleKey: roleFromMetadata(key.metadata),
+		createdAt: new Date(key.createdAt),
+		lastUsedAt: key.lastRequest ? new Date(key.lastRequest) : null,
+		expiresAt: key.expiresAt ? new Date(key.expiresAt) : null
+	};
+}
+function apiKeyHeader(headers) {
+	const header = headers["x-api-key"];
+	if (typeof header === "string" && header.length > 0) return header;
+	const authorization = accessTokenAuthorization(headers.authorization);
+	if (authorization?.scheme === "Bearer" && !isCompactJws(authorization.token)) return authorization.token;
+	return null;
+}
 var BetterAuth = class {
 	auth;
+	db;
 	logger;
 	mcp;
 	issuer;
 	jwksCacheKey = {};
 	constructor(opts, auth) {
 		this.auth = auth ?? createAuth(opts);
+		this.db = opts.db;
 		this.logger = opts.logger;
 		this.mcp = opts.mcp;
 		this.issuer = `${opts.baseUrl.replace(/\/+$/, "")}/api/auth`;
@@ -183,13 +196,16 @@ var BetterAuth = class {
 		return oauthProviderAuthServerMetadata(this.auth)(request);
 	}
 	async verifyAccess(request) {
-		const apiKeyHeader = request.headers["x-api-key"];
-		if (typeof apiKeyHeader === "string" && apiKeyHeader.length > 0) return this.verifyApiKey(apiKeyHeader);
+		const key = apiKeyHeader(request.headers);
+		if (key) return this.grantForKey(key);
 		const authorization = accessTokenAuthorization(request.headers.authorization);
 		if (!authorization) return null;
-		if (authorization.scheme === "Bearer" && !isCompactJws(authorization.token)) return this.verifyApiKey(authorization.token);
 		return this.mcp.oauthEnabled ? this.verifyAccessToken(authorization, request) : null;
 	}
+	async verifyApiKey(headers) {
+		const key = apiKeyHeader(headers);
+		return key ? this.grantForKey(key) : null;
+	}
 	async verifyAccessToken(authorization, request) {
 		let claims;
 		try {
@@ -239,37 +255,82 @@ var BetterAuth = class {
 				}
 			]
 		});
-		return consent ? {
+		if (!consent || !("scopes" in grant.limit)) return null;
+		return {
 			...grant,
-			scopes: grant.scopes.filter((scope) => consent.scopes.includes(scope))
-		} : null;
+			limit: { scopes: grant.limit.scopes.filter((scope) => consent.scopes.includes(scope)) }
+		};
 	}
-	async verifyApiKey(key) {
+	async grantForKey(key) {
 		const result = await this.pluginApi.verifyApiKey({ body: { key } });
 		if (!result.valid || !result.key) return null;
 		const orgId = orgIdFromMetadata(result.key.metadata);
-		if (!orgId) return null;
+		const roleKey = roleFromMetadata(result.key.metadata);
+		if (!orgId || !roleKey) return null;
 		return {
 			userId: result.key.referenceId,
 			orgId,
-			scopes: permissionsToScopes(result.key.permissions),
-			clientId: `api-key:${result.key.id}`
+			clientId: `api-key:${result.key.id}`,
+			limit: { roleKey }
+		};
+	}
+	async ownKeys(orgId, userExternalId) {
+		return (await (await this.auth.$context).adapter.findMany({
+			model: "apikey",
+			where: [{
+				field: "referenceId",
+				value: userExternalId
+			}]
+		})).filter((key) => orgIdFromMetadata(key.metadata) === orgId);
+	}
+	async list(orgId, userExternalId) {
+		return (await this.ownKeys(orgId, userExternalId)).map(toStored);
+	}
+	async create(orgId, userExternalId, input) {
+		const created = await this.pluginApi.createApiKey({ body: {
+			name: input.name,
+			userId: userExternalId,
+			metadata: {
+				organizationId: orgId,
+				role: input.roleKey
+			},
+			...input.expiresInDays !== void 0 && { expiresIn: input.expiresInDays * DAY_SECONDS }
+		} });
+		return {
+			...toStored(created),
+			key: created.key
 		};
 	}
-	async sessionUserId(headers) {
-		const session = await this.auth.api.getSession({ headers: fromNodeHeaders(headers) });
-		if (!session) throw new OrganizationRuleError("No session");
-		return session.user.id;
+	async countWithRole(orgId, roleKey) {
+		const metadata = sql`${authSchema.apikey.metadata}::jsonb`;
+		const [row] = await this.db.select({ value: count() }).from(authSchema.apikey).where(and(sql`${metadata} ->> 'organizationId' = ${orgId}`, sql`${metadata} ->> 'role' = ${roleKey}`));
+		return row?.value ?? 0;
+	}
+	async createAccount(input) {
+		return { externalId: (await (await this.auth.$context).internalAdapter.createUser({
+			email: input.email,
+			name: input.name,
+			emailVerified: true
+		}, { method: "admin" })).id };
+	}
+	async revoke(orgId, userExternalId, keyId) {
+		if (!(await this.ownKeys(orgId, userExternalId)).some((key) => key.id === keyId)) throw new NotFoundError("API key", keyId);
+		await (await this.auth.$context).adapter.delete({
+			model: "apikey",
+			where: [{
+				field: "id",
+				value: keyId
+			}]
+		});
 	}
-	async listConnectedApps(headers, orgId) {
-		const userId = await this.sessionUserId(headers);
+	async listApps(orgId, userExternalId) {
 		if (!this.mcp.oauthEnabled) return [];
 		const ctx = await this.auth.$context;
 		const consents = await ctx.adapter.findMany({
 			model: "oauthConsent",
 			where: [{
 				field: "userId",
-				value: userId
+				value: userExternalId
 			}, {
 				field: "referenceId",
 				value: orgId
@@ -292,8 +353,7 @@ var BetterAuth = class {
 			};
 		}));
 	}
-	async revokeConnectedApp(headers, orgId, clientId) {
-		const userId = await this.sessionUserId(headers);
+	async revokeApp(orgId, userExternalId, clientId) {
 		if (!this.mcp.oauthEnabled) return;
 		const ctx = await this.auth.$context;
 		const where = [
@@ -303,7 +363,7 @@ var BetterAuth = class {
 			},
 			{
 				field: "userId",
-				value: userId
+				value: userExternalId
 			},
 			{
 				field: "referenceId",
@@ -323,38 +383,41 @@ var BetterAuth = class {
 			where
 		});
 	}
-	async listApiKeys(headers, orgId) {
-		return (await this.pluginApi.listApiKeys({ headers: fromNodeHeaders(headers) })).apiKeys.filter((key) => orgIdFromMetadata(key.metadata) === orgId).map((key) => ({
-			id: key.id,
-			name: key.name ?? null,
-			start: key.start ?? null,
-			scopes: permissionsToScopes(key.permissions),
-			createdAt: new Date(key.createdAt),
-			lastUsedAt: key.lastRequest ? new Date(key.lastRequest) : null
-		}));
-	}
-	async createApiKey(input) {
-		const created = await this.pluginApi.createApiKey({ body: {
-			name: input.name,
-			userId: input.authUserId,
-			metadata: { organizationId: input.orgId },
-			permissions: scopesToPermissions(input.scopes)
-		} });
-		return {
-			id: created.id,
-			name: created.name ?? null,
-			start: created.start ?? null,
-			scopes: permissionsToScopes(created.permissions),
-			createdAt: new Date(created.createdAt),
-			lastUsedAt: null,
-			key: created.key
-		};
-	}
-	async deleteApiKey(headers, orgId, keyId) {
-		if (!(await this.listApiKeys(headers, orgId)).some((key) => key.id === keyId)) throw new NotFoundError("API key", keyId);
-		await this.pluginApi.deleteApiKey({
-			body: { keyId },
-			headers: fromNodeHeaders(headers)
+	async revokeAllFor(orgId, userExternalId) {
+		const ctx = await this.auth.$context;
+		const keys = await this.ownKeys(orgId, userExternalId);
+		for (const key of keys) await ctx.adapter.delete({
+			model: "apikey",
+			where: [{
+				field: "id",
+				value: key.id
+			}]
+		});
+		if (this.mcp.oauthEnabled) {
+			const where = [{
+				field: "userId",
+				value: userExternalId
+			}, {
+				field: "referenceId",
+				value: orgId
+			}];
+			await ctx.adapter.deleteMany({
+				model: "oauthAccessToken",
+				where
+			});
+			await ctx.adapter.deleteMany({
+				model: "oauthRefreshToken",
+				where
+			});
+			await ctx.adapter.deleteMany({
+				model: "oauthConsent",
+				where
+			});
+		}
+		this.logger.info("access revoked for person", {
+			orgId,
+			userExternalId,
+			apiKeys: keys.length
 		});
 	}
 	async verify(headers) {
@@ -398,35 +461,42 @@ var BetterAuth = class {
 			createdAt: org.createdAt
 		};
 	}
+	async createOrganizationFor(ownerExternalId, input) {
+		let org;
+		try {
+			org = await this.auth.api.createOrganization({ body: {
+				name: input.name,
+				slug: input.slug,
+				userId: ownerExternalId
+			} });
+		} catch (err) {
+			if (err instanceof APIError && err.body?.code === "ORGANIZATION_ALREADY_EXISTS") throw new ConflictError("That slug is already in use");
+			throw err;
+		}
+		if (!org) throw new Error(`Couldn't create organization`);
+		return {
+			id: org.id,
+			name: org.name,
+			slug: org.slug,
+			createdAt: org.createdAt
+		};
+	}
 	async setActiveOrganization(headers, externalId) {
 		await this.auth.api.setActiveOrganization({
 			body: { organizationId: externalId },
 			headers: fromNodeHeaders(headers)
 		});
 	}
-	async updateOrganization(headers, externalId, input) {
-		try {
-			const org = await this.auth.api.updateOrganization({
-				body: {
-					organizationId: externalId,
-					data: {
-						name: input.name,
-						slug: input.slug
-					}
-				},
-				headers: fromNodeHeaders(headers)
-			});
-			if (!org) throw new Error(`Couldn't update organization`);
-			return {
-				id: org.id,
-				name: org.name,
-				slug: org.slug,
-				createdAt: org.createdAt
-			};
-		} catch (err) {
-			if (err instanceof APIError) throw new OrganizationRuleError(err.message || "Could not update organization");
-			throw err;
-		}
+	async orgAdapter() {
+		return getOrgAdapter(await this.auth.$context, {});
+	}
+	async updateOrganization(externalId, input) {
+		const data = {
+			...input.name !== void 0 && { name: input.name },
+			...input.slug !== void 0 && { slug: input.slug }
+		};
+		if (Object.keys(data).length === 0) return;
+		if (!await (await this.orgAdapter()).updateOrganization(externalId, data)) throw new NotFoundError("Organization", externalId);
 	}
 	async deleteOrganization(headers, externalId) {
 		try {
@@ -439,55 +509,50 @@ var BetterAuth = class {
 			throw err;
 		}
 	}
-	async grantMembership(orgExternalId, userExternalId, role) {
-		try {
-			await this.auth.api.addMember({ body: {
-				userId: userExternalId,
+	async grantMembership(orgExternalId, userExternalId) {
+		const adapter = await this.orgAdapter();
+		if (await adapter.findMemberByOrgId({
+			userId: userExternalId,
+			organizationId: orgExternalId
+		})) return;
+		await adapter.createMember({
+			organizationId: orgExternalId,
+			userId: userExternalId,
+			role: PARTICIPANT_MEMBERSHIP
+		});
+	}
+	async setMembershipOwner(orgExternalId, userExternalId, owner) {
+		const adapter = await this.orgAdapter();
+		const role = owner ? OWNER_MEMBERSHIP : PARTICIPANT_MEMBERSHIP;
+		const existing = await adapter.findMemberByOrgId({
+			userId: userExternalId,
+			organizationId: orgExternalId
+		});
+		if (!existing) {
+			await adapter.createMember({
 				organizationId: orgExternalId,
-				role: parseRole(role)
-			} });
-		} catch (err) {
-			if (err instanceof APIError && err.body?.code === "USER_IS_ALREADY_A_MEMBER_OF_THIS_ORGANIZATION") return;
-			throw err;
+				userId: userExternalId,
+				role
+			});
+			return;
 		}
+		if (existing.role !== role) await adapter.updateMember(existing.id, role);
 	}
-	async updateRole(ctx, userExternalId, role) {
-		await this.auth.api.updateMemberRole({
-			body: {
-				memberId: await this.resolveMemberId(ctx, userExternalId),
-				role,
-				organizationId: ctx.authOrgId
-			},
-			headers: this.headersOf(ctx)
+	async removeMembership(orgExternalId, userExternalId) {
+		const adapter = await this.orgAdapter();
+		const existing = await adapter.findMemberByOrgId({
+			userId: userExternalId,
+			organizationId: orgExternalId
 		});
-	}
-	async removeMember(ctx, userExternalId) {
-		await this.auth.api.removeMember({
-			body: {
-				memberIdOrEmail: await this.resolveMemberId(ctx, userExternalId),
-				organizationId: ctx.authOrgId
-			},
-			headers: this.headersOf(ctx)
+		if (!existing) return;
+		await adapter.deleteMember({
+			memberId: existing.id,
+			organizationId: orgExternalId,
+			userId: userExternalId
 		});
 	}
-	headersOf(ctx) {
-		return fromNodeHeaders(ctx.headers);
-	}
-	async resolveMemberId(ctx, userExternalId) {
-		const memberId = (await this.auth.api.listMembers({
-			query: {
-				organizationId: ctx.authOrgId,
-				filterField: "userId",
-				filterValue: userExternalId,
-				limit: 1
-			},
-			headers: this.headersOf(ctx)
-		}))?.members?.[0]?.id;
-		if (!memberId) throw new OrganizationRuleError("That person is no longer a member of this organization");
-		return memberId;
-	}
 };
 //#endregion
-export { BetterAuth, buildAuthOptions, createAuth };
+export { API_KEY_PREFIX, BetterAuth, buildAuthOptions, createAuth };
 
 //# sourceMappingURL=better-auth.js.map