@igstack/app-catalog-backend-core 6.1.6-alpha-20260927042212 → 6.1.6

package/dist/modules/auth/authRouter.d.mts

@@ -2,6 +2,7 @@ import { AcTrpcContext } from "../../server/acTrpcContext.mjs";
 import { BetterAuth } from "./auth.mjs";
 import * as _trpc_server0 from "@trpc/server";
 import { TRPCRootObject } from "@trpc/server";
+import * as better_auth0 from "better-auth";
 
 //#region src/modules/auth/authRouter.d.ts
 /**
@@ -38,7 +39,7 @@ declare function createAuthRouter(t: TRPCRootObject<AcTrpcContext, {}, {}>, auth
   getProviders: _trpc_server0.TRPCQueryProcedure<{
     input: void;
     output: {
-      providers: string[];
+      providers: better_auth0.LiteralString[];
       devLoginEnabled: boolean;
     };
     meta: {};

package/dist/modules/auth/authRouter.d.mts.map

@@ -1 +1 @@
-{"version":3,"file":"authRouter.d.mts","names":[],"sources":["../../../src/modules/auth/authRouter.ts"],"mappings":";;;;;;;;;AAWA;;;iBAAgB,gBAAA,CACd,CAAA,EAAG,cAAA,CAAe,aAAA,WAClB,IAAA,GAAO,UAAA,EACP,OAAA;EAAY,eAAA;AAAA,kBAA2B,eAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;KA0D7B,UAAA,GAAa,UAAA,QAAkB,gBAAA"}
+{"version":3,"file":"authRouter.d.mts","names":[],"sources":["../../../src/modules/auth/authRouter.ts"],"mappings":";;;;;;;;;;;AAUA;;iBAAgB,gBAAA,CACd,CAAA,EAAG,cAAA,CAAe,aAAA,WAClB,IAAA,GAAO,UAAA,EACP,OAAA;EAAY,eAAA;AAAA,kBAA2B,eAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;KA+B7B,UAAA,GAAa,UAAA,QAAkB,gBAAA"}

package/dist/modules/auth/authRouter.mjs

@@ -16,23 +16,9 @@ function createAuthRouter(t, auth, options) {
 				isAdmin: ctx.isAdmin
 			};
 		}),
-		getProviders: publicProcedure.query(() => {
-			const providers = [];
-			const authOptions = auth?.options;
-			if (authOptions?.socialProviders) {
-				const socialProviders = authOptions.socialProviders;
-				Object.keys(socialProviders).forEach((key) => {
-					if (socialProviders[key]) providers.push(key);
-				});
-			}
-			if (authOptions?.plugins) authOptions.plugins.forEach((plugin) => {
-				if (plugin.id !== "generic-oauth" || !plugin.options?.config) return;
-				(Array.isArray(plugin.options.config) ? plugin.options.config : [plugin.options.config]).forEach((config) => {
-					if (config.providerId) providers.push(config.providerId);
-				});
-			});
+		getProviders: publicProcedure.query(async () => {
 			return {
-				providers,
+				providers: (await auth?.$context)?.socialProviders.map((p) => p.id) ?? [],
 				devLoginEnabled: options?.devLoginEnabled ?? false
 			};
 		})

package/dist/modules/auth/authRouter.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"authRouter.mjs","names":[],"sources":["../../../src/modules/auth/authRouter.ts"],"sourcesContent":["import type { BetterAuthPlugin } from 'better-auth'\nimport type { TRPCRootObject } from '@trpc/server'\nimport type { AcTrpcContext } from '../../server/acTrpcContext'\nimport type { BetterAuth } from './auth'\n\n/**\n * Create auth tRPC procedures\n * @param t - tRPC instance\n * @param auth - Better Auth instance (optional, for future extensions)\n * @returns tRPC router with auth procedures\n */\nexport function createAuthRouter(\n  t: TRPCRootObject<AcTrpcContext, {}, {}>,\n  auth?: BetterAuth,\n  options?: { devLoginEnabled?: boolean },\n) {\n  const router = t.router\n  const publicProcedure = t.procedure\n\n  return router({\n    getSession: publicProcedure.query(async ({ ctx }) => {\n      return {\n        user: ctx.user ?? null,\n        isAuthenticated: !!ctx.user,\n        isAdmin: ctx.isAdmin,\n      }\n    }),\n    getProviders: publicProcedure.query(() => {\n      // Return configured social providers and OAuth providers from plugins\n      const providers: string[] = []\n      const authOptions = auth?.options\n\n      // Add built-in social providers (github, google, etc.)\n      if (authOptions?.socialProviders) {\n        const socialProviders = authOptions.socialProviders as Record<\n          string,\n          unknown\n        >\n        Object.keys(socialProviders).forEach((key) => {\n          if (socialProviders[key]) {\n            providers.push(key)\n          }\n        })\n      }\n\n      // Add OAuth providers from plugins (like Okta via genericOAuth). They are\n      // absent from socialProviders above: the plugin only merges them into the\n      // auth context at init time, not into the static options.\n      if (authOptions?.plugins) {\n        const plugins = authOptions.plugins\n        plugins.forEach((plugin: BetterAuthPlugin) => {\n          if (plugin.id !== 'generic-oauth' || !plugin.options?.config) {\n            return\n          }\n          const configs: { providerId?: string }[] = Array.isArray(\n            plugin.options.config,\n          )\n            ? plugin.options.config\n            : [plugin.options.config]\n          configs.forEach((config) => {\n            if (config.providerId) {\n              providers.push(config.providerId)\n            }\n          })\n        })\n      }\n\n      return { providers, devLoginEnabled: options?.devLoginEnabled ?? false }\n    }),\n  })\n}\n\nexport type AuthRouter = ReturnType<typeof createAuthRouter>\n"],"mappings":";;;;;;;AAWA,SAAgB,iBACd,GACA,MACA,SACA;CACA,MAAM,SAAS,EAAE;CACjB,MAAM,kBAAkB,EAAE;AAE1B,QAAO,OAAO;EACZ,YAAY,gBAAgB,MAAM,OAAO,EAAE,UAAU;AACnD,UAAO;IACL,MAAM,IAAI,QAAQ;IAClB,iBAAiB,CAAC,CAAC,IAAI;IACvB,SAAS,IAAI;IACd;IACD;EACF,cAAc,gBAAgB,YAAY;GAExC,MAAM,YAAsB,EAAE;GAC9B,MAAM,cAAc,MAAM;AAG1B,OAAI,aAAa,iBAAiB;IAChC,MAAM,kBAAkB,YAAY;AAIpC,WAAO,KAAK,gBAAgB,CAAC,SAAS,QAAQ;AAC5C,SAAI,gBAAgB,KAClB,WAAU,KAAK,IAAI;MAErB;;AAMJ,OAAI,aAAa,QAEf,CADgB,YAAY,QACpB,SAAS,WAA6B;AAC5C,QAAI,OAAO,OAAO,mBAAmB,CAAC,OAAO,SAAS,OACpD;AAOF,KAL2C,MAAM,QAC/C,OAAO,QAAQ,OAChB,GACG,OAAO,QAAQ,SACf,CAAC,OAAO,QAAQ,OAAO,EACnB,SAAS,WAAW;AAC1B,SAAI,OAAO,WACT,WAAU,KAAK,OAAO,WAAW;MAEnC;KACF;AAGJ,UAAO;IAAE;IAAW,iBAAiB,SAAS,mBAAmB;IAAO;IACxE;EACH,CAAC"}
+{"version":3,"file":"authRouter.mjs","names":[],"sources":["../../../src/modules/auth/authRouter.ts"],"sourcesContent":["import type { TRPCRootObject } from '@trpc/server'\nimport type { AcTrpcContext } from '../../server/acTrpcContext'\nimport type { BetterAuth } from './auth'\n\n/**\n * Create auth tRPC procedures\n * @param t - tRPC instance\n * @param auth - Better Auth instance (optional, for future extensions)\n * @returns tRPC router with auth procedures\n */\nexport function createAuthRouter(\n  t: TRPCRootObject<AcTrpcContext, {}, {}>,\n  auth?: BetterAuth,\n  options?: { devLoginEnabled?: boolean },\n) {\n  const router = t.router\n  const publicProcedure = t.procedure\n\n  return router({\n    getSession: publicProcedure.query(async ({ ctx }) => {\n      return {\n        user: ctx.user ?? null,\n        isAuthenticated: !!ctx.user,\n        isAdmin: ctx.isAdmin,\n      }\n    }),\n    getProviders: publicProcedure.query(async () => {\n      // Read the providers better-auth actually resolved, not the static\n      // config. The generic OAuth plugin resolves OIDC discovery once, in its\n      // init, and silently skips a provider whose discovery document failed to\n      // load -- for the whole life of that process. Deriving the list from the\n      // static config would keep offering a sign-in button that answers 404\n      // \"Provider not found\". The resolved context holds both halves: built-in\n      // social providers and the generic ones that survived discovery.\n      const authContext = await auth?.$context\n\n      return {\n        providers: authContext?.socialProviders.map((p) => p.id) ?? [],\n        devLoginEnabled: options?.devLoginEnabled ?? false,\n      }\n    }),\n  })\n}\n\nexport type AuthRouter = ReturnType<typeof createAuthRouter>\n"],"mappings":";;;;;;;AAUA,SAAgB,iBACd,GACA,MACA,SACA;CACA,MAAM,SAAS,EAAE;CACjB,MAAM,kBAAkB,EAAE;AAE1B,QAAO,OAAO;EACZ,YAAY,gBAAgB,MAAM,OAAO,EAAE,UAAU;AACnD,UAAO;IACL,MAAM,IAAI,QAAQ;IAClB,iBAAiB,CAAC,CAAC,IAAI;IACvB,SAAS,IAAI;IACd;IACD;EACF,cAAc,gBAAgB,MAAM,YAAY;AAU9C,UAAO;IACL,YAHkB,MAAM,MAAM,WAGN,gBAAgB,KAAK,MAAM,EAAE,GAAG,IAAI,EAAE;IAC9D,iBAAiB,SAAS,mBAAmB;IAC9C;IACD;EACH,CAAC"}

package/dist/server/controller.d.mts

@@ -3,6 +3,7 @@ import { AcTrpcContext } from "./acTrpcContext.mjs";
 import { BetterAuth } from "../modules/auth/auth.mjs";
 import { CommentView } from "../modules/comments/service.mjs";
 import * as _trpc_server0 from "@trpc/server";
+import * as better_auth0 from "better-auth";
 
 //#region src/server/controller.d.ts
 /**
@@ -118,7 +119,7 @@ declare function createTrpcRouter(auth?: BetterAuth, options?: {
     getProviders: _trpc_server0.TRPCQueryProcedure<{
       input: void;
       output: {
-        providers: string[];
+        providers: better_auth0.LiteralString[];
         devLoginEnabled: boolean;
       };
       meta: {};

package/dist/server/controller.d.mts.map

@@ -1 +1 @@
-{"version":3,"file":"controller.d.mts","names":[],"sources":["../../src/server/controller.ts"],"mappings":";;;;;;;;;;;iBAmCgB,gBAAA,CACd,IAAA,GAAO,UAAA,EACP,OAAA;EAAY,eAAA;AAAA,kBAA2B,eAAA;OADtB,aAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;KAwCP,UAAA,GAAa,UAAA,QAAkB,gBAAA"}
+{"version":3,"file":"controller.d.mts","names":[],"sources":["../../src/server/controller.ts"],"mappings":";;;;;;;;;;;;iBAmCgB,gBAAA,CACd,IAAA,GAAO,UAAA,EACP,OAAA;EAAY,eAAA;AAAA,kBAA2B,eAAA;OADtB,aAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;KAwCP,UAAA,GAAa,UAAA,QAAkB,gBAAA"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@igstack/app-catalog-backend-core",
-  "version": "6.1.6-alpha-20260927042212",
+  "version": "6.1.6",
   "description": "Backend core library for App Catalog",
   "homepage": "https://github.com/lislon/app-catalog",
   "repository": {
@@ -44,8 +44,8 @@
     "tsyringe": "^4.10.0",
     "yaml": "^2.8.0",
     "zod": "^4.3.5",
-    "@igstack/app-catalog-shared-core": "6.1.6-alpha-20260927042212",
-    "@igstack/app-catalog-table-sync": "6.1.6-alpha-20260927042212"
+    "@igstack/app-catalog-shared-core": "6.1.6",
+    "@igstack/app-catalog-table-sync": "6.1.6"
   },
   "devDependencies": {
     "@tanstack/vite-config": "^0.4.3",
@@ -72,7 +72,7 @@
   "engines": {
     "node": ">=24"
   },
-  "gitHead": "fd9dfe8da430f2adacd331609440085e52de0286",
+  "gitHead": "0a2ab15f93f8e6b362fa6bb09e3e06e7fed68abd",
   "scripts": {
     "build": "tsdown",
     "build:lenient": "tsdown",

package/src/__tests__/authProviders.test.ts

@@ -1,3 +1,5 @@
+import { betterAuth } from 'better-auth'
+import { memoryAdapter } from 'better-auth/adapters/memory'
 import { genericOAuth } from 'better-auth/plugins'
 import { describe, expect, it } from 'vitest'
 import { createAuthRouter } from '../modules/auth/authRouter'
@@ -7,60 +9,85 @@ import { t } from '../server/trpcSetup'
 
 // The sign-in page renders one button per name getProviders returns, so an
 // upstream rename of the plugin id or of `options.config` silently leaves users
-// with no way to sign in. The real plugin is instantiated here on purpose --
-// a hand-written stub of its shape would keep passing through that rename.
-function providers(auth: Partial<BetterAuth>) {
-  const caller = createAuthRouter(t, auth as BetterAuth).createCaller(
-    {} as AcTrpcContext,
-  )
-  return caller.getProviders()
+// with no way to sign in. A real betterAuth instance is built here on purpose --
+// a hand-written stub of the auth context would keep passing through that
+// rename, and would not run the plugin's own init, which is where the provider
+// list is actually decided.
+function auth(options: Record<string, unknown>): BetterAuth {
+  return betterAuth({
+    database: memoryAdapter({}),
+    secret: 'test-secret-that-is-long-enough',
+    baseURL: 'http://localhost',
+    // Provider skips are logged as errors; the skip is the expectation here.
+    logger: { disabled: true },
+    ...options,
+  }) as BetterAuth
+}
+
+function providers(instance: BetterAuth) {
+  return createAuthRouter(t, instance)
+    .createCaller({} as AcTrpcContext)
+    .getProviders()
+}
+
+// Needs no discovery document, so it resolves without touching the network.
+const resolvable = {
+  providerId: 'okta',
+  clientId: 'id',
+  clientSecret: 'secret',
+  authorizationUrl: 'https://example.com/oauth2/v1/authorize',
+  tokenUrl: 'https://example.com/oauth2/v1/token',
+}
+
+// Port 1 on the loopback refuses instantly, with no DNS lookup and no reliance
+// on the CI network -- which is exactly the unreachable-discovery-endpoint
+// condition this guards. better-auth passes no timeout to its fetch, so a host
+// that black-holed the connection instead would hang to vitest's default.
+const unresolvable = {
+  providerId: 'okta',
+  clientId: 'id',
+  clientSecret: 'secret',
+  discoveryUrl: 'http://127.0.0.1:1/.well-known/openid-configuration',
 }
 
 describe('auth getProviders', () => {
   it('lists a provider registered through the generic OAuth plugin', async () => {
-    const { providers: names } = await providers({
-      options: {
-        plugins: [
-          genericOAuth({
-            config: [
-              {
-                providerId: 'okta',
-                clientId: 'id',
-                clientSecret: 'secret',
-                discoveryUrl:
-                  'https://example.invalid/.well-known/openid-configuration',
-              },
-            ],
-          }),
-        ],
-      },
-    })
+    const { providers: names } = await providers(
+      auth({ plugins: [genericOAuth({ config: [resolvable] })] }),
+    )
 
     expect(names).toEqual(['okta'])
   })
 
   it('lists built-in social providers alongside plugin ones', async () => {
-    const { providers: names } = await providers({
-      options: {
-        socialProviders: {
-          github: { clientId: 'id', clientSecret: 'secret' },
-        },
+    const { providers: names } = await providers(
+      auth({
+        socialProviders: { github: { clientId: 'id', clientSecret: 'secret' } },
+        plugins: [genericOAuth({ config: [resolvable] })],
+      }),
+    )
+
+    // The plugin prepends its providers, so the order is upstream's to choose --
+    // but the set is not, and toContain alone would pass on a duplicate or an
+    // extra name.
+    expect([...names].sort()).toEqual(['github', 'okta'])
+  })
+
+  // better-auth 1.7 resolves OIDC discovery once, in the plugin's init, and
+  // skips a provider whose discovery failed. Deriving the list from the static
+  // config instead would still offer the button, and clicking it 400s with
+  // "Provider not found" for the whole life of that pod.
+  it('omits a provider whose discovery failed, and keeps the ones that resolved', async () => {
+    const { providers: names } = await providers(
+      auth({
         plugins: [
           genericOAuth({
-            config: [
-              {
-                providerId: 'okta',
-                clientId: 'id',
-                clientSecret: 'secret',
-                discoveryUrl:
-                  'https://example.invalid/.well-known/openid-configuration',
-              },
-            ],
+            config: [unresolvable, { ...resolvable, providerId: 'other-idp' }],
           }),
         ],
-      },
-    })
+      }),
+    )
 
-    expect(names).toEqual(['github', 'okta'])
+    expect(names).toEqual(['other-idp'])
   })
 })

package/src/modules/auth/authRouter.ts

@@ -1,4 +1,3 @@
-import type { BetterAuthPlugin } from 'better-auth'
 import type { TRPCRootObject } from '@trpc/server'
 import type { AcTrpcContext } from '../../server/acTrpcContext'
 import type { BetterAuth } from './auth'
@@ -25,47 +24,20 @@ export function createAuthRouter(
         isAdmin: ctx.isAdmin,
       }
     }),
-    getProviders: publicProcedure.query(() => {
-      // Return configured social providers and OAuth providers from plugins
-      const providers: string[] = []
-      const authOptions = auth?.options
+    getProviders: publicProcedure.query(async () => {
+      // Read the providers better-auth actually resolved, not the static
+      // config. The generic OAuth plugin resolves OIDC discovery once, in its
+      // init, and silently skips a provider whose discovery document failed to
+      // load -- for the whole life of that process. Deriving the list from the
+      // static config would keep offering a sign-in button that answers 404
+      // "Provider not found". The resolved context holds both halves: built-in
+      // social providers and the generic ones that survived discovery.
+      const authContext = await auth?.$context
 
-      // Add built-in social providers (github, google, etc.)
-      if (authOptions?.socialProviders) {
-        const socialProviders = authOptions.socialProviders as Record<
-          string,
-          unknown
-        >
-        Object.keys(socialProviders).forEach((key) => {
-          if (socialProviders[key]) {
-            providers.push(key)
-          }
-        })
-      }
-
-      // Add OAuth providers from plugins (like Okta via genericOAuth). They are
-      // absent from socialProviders above: the plugin only merges them into the
-      // auth context at init time, not into the static options.
-      if (authOptions?.plugins) {
-        const plugins = authOptions.plugins
-        plugins.forEach((plugin: BetterAuthPlugin) => {
-          if (plugin.id !== 'generic-oauth' || !plugin.options?.config) {
-            return
-          }
-          const configs: { providerId?: string }[] = Array.isArray(
-            plugin.options.config,
-          )
-            ? plugin.options.config
-            : [plugin.options.config]
-          configs.forEach((config) => {
-            if (config.providerId) {
-              providers.push(config.providerId)
-            }
-          })
-        })
+      return {
+        providers: authContext?.socialProviders.map((p) => p.id) ?? [],
+        devLoginEnabled: options?.devLoginEnabled ?? false,
       }
-
-      return { providers, devLoginEnabled: options?.devLoginEnabled ?? false }
     }),
   })
 }