@ingram-tech/nk-auth 0.10.0 → 0.11.0
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/README.md +4 -0
- package/dist/keys.d.ts +6 -0
- package/dist/keys.d.ts.map +1 -1
- package/dist/keys.js +28 -4
- package/dist/keys.js.map +1 -1
- package/package.json +1 -1
package/README.md
CHANGED
|
@@ -48,6 +48,10 @@ BETTER_AUTH_URL=https://example.com
|
|
|
48
48
|
DATABASE_URL=… # direct Postgres connection (:5432)
|
|
49
49
|
```
|
|
50
50
|
|
|
51
|
+
Outside production, `BETTER_AUTH_SECRET` falls back to a well-known insecure
|
|
52
|
+
placeholder, so local dev and tests run without setting it (a warning is logged).
|
|
53
|
+
In production it stays required — a missing secret throws at startup.
|
|
54
|
+
|
|
51
55
|
## 1. Apply the schema
|
|
52
56
|
|
|
53
57
|
```bash
|
package/dist/keys.d.ts
CHANGED
|
@@ -10,6 +10,12 @@
|
|
|
10
10
|
* BETTER_AUTH_SECRET — session/CSRF signing key (`openssl rand -hex 32`)
|
|
11
11
|
* BETTER_AUTH_URL — canonical site origin, e.g. "https://example.com"
|
|
12
12
|
* DATABASE_URL — direct Postgres connection for Better Auth (:5432)
|
|
13
|
+
*
|
|
14
|
+
* Outside production, BETTER_AUTH_SECRET falls back to a well-known insecure
|
|
15
|
+
* placeholder so local dev and tests run without hand-setting it (`nk dev` and
|
|
16
|
+
* plain `next dev` alike). In production it stays strictly required — a missing
|
|
17
|
+
* secret throws at startup rather than silently signing sessions with a value
|
|
18
|
+
* anyone could guess.
|
|
13
19
|
*/
|
|
14
20
|
export interface AuthEnv {
|
|
15
21
|
secret: string;
|
package/dist/keys.d.ts.map
CHANGED
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"keys.d.ts","sourceRoot":"","sources":["../src/keys.ts"],"names":[],"mappings":"AAAA
|
|
1
|
+
{"version":3,"file":"keys.d.ts","sourceRoot":"","sources":["../src/keys.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AA6BH,MAAM,WAAW,OAAO;IACvB,MAAM,EAAE,MAAM,CAAC;IACf,OAAO,EAAE,MAAM,CAAC;IAChB,WAAW,EAAE,MAAM,CAAC;CACpB;AAED;;;;GAIG;AACH,eAAO,MAAM,OAAO,QAAO,OAoB1B,CAAC;AAEF,+EAA+E;AAC/E,eAAO,MAAM,YAAY,QAAO,OAAuD,CAAC"}
|
package/dist/keys.js
CHANGED
|
@@ -10,20 +10,40 @@
|
|
|
10
10
|
* BETTER_AUTH_SECRET — session/CSRF signing key (`openssl rand -hex 32`)
|
|
11
11
|
* BETTER_AUTH_URL — canonical site origin, e.g. "https://example.com"
|
|
12
12
|
* DATABASE_URL — direct Postgres connection for Better Auth (:5432)
|
|
13
|
+
*
|
|
14
|
+
* Outside production, BETTER_AUTH_SECRET falls back to a well-known insecure
|
|
15
|
+
* placeholder so local dev and tests run without hand-setting it (`nk dev` and
|
|
16
|
+
* plain `next dev` alike). In production it stays strictly required — a missing
|
|
17
|
+
* secret throws at startup rather than silently signing sessions with a value
|
|
18
|
+
* anyone could guess.
|
|
13
19
|
*/
|
|
14
20
|
import { z } from "zod";
|
|
15
|
-
|
|
16
|
-
|
|
21
|
+
/**
|
|
22
|
+
* Well-known, deliberately insecure secret used ONLY when NODE_ENV is not
|
|
23
|
+
* "production". Never applied to a production build — see `secretField`.
|
|
24
|
+
*/
|
|
25
|
+
const DEV_SECRET_PLACEHOLDER = "nk-dev-insecure-placeholder-not-for-production";
|
|
26
|
+
/**
|
|
27
|
+
* In production the secret is required; everywhere else it defaults to the
|
|
28
|
+
* insecure placeholder. Read NODE_ENV at parse time (not module load) so the
|
|
29
|
+
* same process can be exercised under either mode.
|
|
30
|
+
*/
|
|
31
|
+
const secretField = () => process.env.NODE_ENV === "production"
|
|
32
|
+
? z.string().min(1)
|
|
33
|
+
: z.string().min(1).default(DEV_SECRET_PLACEHOLDER);
|
|
34
|
+
const buildSchema = () => z.object({
|
|
35
|
+
BETTER_AUTH_SECRET: secretField(),
|
|
17
36
|
BETTER_AUTH_URL: z.string().url(),
|
|
18
37
|
DATABASE_URL: z.string().min(1),
|
|
19
38
|
});
|
|
39
|
+
let warnedPlaceholder = false;
|
|
20
40
|
/**
|
|
21
41
|
* Read and validate all nk-auth env vars at once. Throws a single error listing
|
|
22
42
|
* everything missing/invalid, so a misconfigured site fails fast at startup
|
|
23
43
|
* rather than at first sign-in.
|
|
24
44
|
*/
|
|
25
45
|
export const authEnv = () => {
|
|
26
|
-
const result =
|
|
46
|
+
const result = buildSchema().safeParse(process.env);
|
|
27
47
|
if (!result.success) {
|
|
28
48
|
const issues = result.error.issues
|
|
29
49
|
.map((issue) => `${issue.path.join(".")}: ${issue.message}`)
|
|
@@ -31,6 +51,10 @@ export const authEnv = () => {
|
|
|
31
51
|
throw new Error(`@ingram-tech/nk-auth: invalid environment — ${issues}`);
|
|
32
52
|
}
|
|
33
53
|
const env = result.data;
|
|
54
|
+
if (env.BETTER_AUTH_SECRET === DEV_SECRET_PLACEHOLDER && !warnedPlaceholder) {
|
|
55
|
+
warnedPlaceholder = true;
|
|
56
|
+
console.warn("@ingram-tech/nk-auth: BETTER_AUTH_SECRET is unset — using an insecure dev placeholder. Set it before deploying.");
|
|
57
|
+
}
|
|
34
58
|
return {
|
|
35
59
|
secret: env.BETTER_AUTH_SECRET,
|
|
36
60
|
baseURL: env.BETTER_AUTH_URL,
|
|
@@ -38,5 +62,5 @@ export const authEnv = () => {
|
|
|
38
62
|
};
|
|
39
63
|
};
|
|
40
64
|
/** Whether nk-auth is fully configured (lets callers degrade in local/dev). */
|
|
41
|
-
export const isConfigured = () =>
|
|
65
|
+
export const isConfigured = () => buildSchema().safeParse(process.env).success;
|
|
42
66
|
//# sourceMappingURL=keys.js.map
|
package/dist/keys.js.map
CHANGED
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"keys.js","sourceRoot":"","sources":["../src/keys.ts"],"names":[],"mappings":"AAAA
|
|
1
|
+
{"version":3,"file":"keys.js","sourceRoot":"","sources":["../src/keys.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB;;;GAGG;AACH,MAAM,sBAAsB,GAAG,gDAAgD,CAAC;AAEhF;;;;GAIG;AACH,MAAM,WAAW,GAAG,GAAG,EAAE,CACxB,OAAO,CAAC,GAAG,CAAC,QAAQ,KAAK,YAAY;IACpC,CAAC,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACnB,CAAC,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,sBAAsB,CAAC,CAAC;AAEtD,MAAM,WAAW,GAAG,GAAG,EAAE,CACxB,CAAC,CAAC,MAAM,CAAC;IACR,kBAAkB,EAAE,WAAW,EAAE;IACjC,eAAe,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE;IACjC,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;CAC/B,CAAC,CAAC;AAEJ,IAAI,iBAAiB,GAAG,KAAK,CAAC;AAQ9B;;;;GAIG;AACH,MAAM,CAAC,MAAM,OAAO,GAAG,GAAY,EAAE;IACpC,MAAM,MAAM,GAAG,WAAW,EAAE,CAAC,SAAS,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;IACpD,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;QACrB,MAAM,MAAM,GAAG,MAAM,CAAC,KAAK,CAAC,MAAM;aAChC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,GAAG,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,KAAK,KAAK,CAAC,OAAO,EAAE,CAAC;aAC3D,IAAI,CAAC,IAAI,CAAC,CAAC;QACb,MAAM,IAAI,KAAK,CAAC,+CAA+C,MAAM,EAAE,CAAC,CAAC;IAC1E,CAAC;IACD,MAAM,GAAG,GAAG,MAAM,CAAC,IAAI,CAAC;IACxB,IAAI,GAAG,CAAC,kBAAkB,KAAK,sBAAsB,IAAI,CAAC,iBAAiB,EAAE,CAAC;QAC7E,iBAAiB,GAAG,IAAI,CAAC;QACzB,OAAO,CAAC,IAAI,CACX,iHAAiH,CACjH,CAAC;IACH,CAAC;IACD,OAAO;QACN,MAAM,EAAE,GAAG,CAAC,kBAAkB;QAC9B,OAAO,EAAE,GAAG,CAAC,eAAe;QAC5B,WAAW,EAAE,GAAG,CAAC,YAAY;KAC7B,CAAC;AACH,CAAC,CAAC;AAEF,+EAA+E;AAC/E,MAAM,CAAC,MAAM,YAAY,GAAG,GAAY,EAAE,CAAC,WAAW,EAAE,CAAC,SAAS,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,OAAO,CAAC"}
|
package/package.json
CHANGED