@intelligo-dev/auth 1.0.0-beta.1 → 1.0.0-beta.14

package/src/server.ts

@@ -1,13 +1,7 @@
 /**
- * Better-Auth Server Configuration
- *
- * Configures authentication with:
- * - Email + password authentication
- * - OAuth providers (Google, GitHub) with graceful env var fallback
- * - Drizzle database adapter
- * - Session persistence (7-day expiration, 1-day update age)
- * - Organization plugin for multi-tenant workspace support (Phase 10)
- * - Email sending via Resend for verification, password reset, welcome (Phase 14)
+ * The Better-Auth instance: email + password, optional Google/GitHub OAuth,
+ * organizations as workspaces, and the admin plugin for impersonation.
+ * Configured at module load; reaches the database and email provider.
  */
 
 import { betterAuth } from "better-auth";
@@ -20,16 +14,12 @@ import {
   userAc,
 } from "better-auth/plugins/admin/access";
 import { PLATFORM_ADMIN_ROLE } from "./roles";
+import { resolveTrustedOrigins } from "./trusted-origins";
 
 /**
- * Access control for the platform role.
- *
- * Better-Auth refuses an `adminRoles` entry that no role definition
- * backs — "Invalid admin roles" at build time — which is the right
- * behaviour: it stops a typo from silently granting nothing, or a
- * renamed role from silently granting everything. `platform-admin`
- * takes the plugin's own admin statements unchanged; the product
- * defines no extra platform permissions yet.
+ * Access control for the platform role. Better-Auth refuses an `adminRoles`
+ * entry no role definition backs ("Invalid admin roles"); `platform-admin`
+ * takes the plugin's own admin statements unchanged.
  */
 const accessControl = createAccessControl(defaultStatements);
 const platformAdminRole = accessControl.newRole(adminAc.statements);
@@ -45,38 +35,57 @@ import {
   invitation,
 } from "@intelligo-dev/core/db/schema";
 import {
+  ConsoleProvider,
+  getEmailProvider,
   sendVerifyEmail,
   sendPasswordResetEmail,
   sendWelcomeEmail,
   sendInvitationEmail,
 } from "@intelligo-dev/core/email";
 import { eq } from "drizzle-orm";
+import { invitationLinks } from "./invitation-links";
+import { personalWorkspaceSlug } from "./workspace-slug";
+import { workspaceCreated } from "./workspace-bootstrap";
+
+/**
+ * The origin this app is served from. `NEXT_PUBLIC_APP_URL` is required, but
+ * auth is configured at module load, before any composition root asserts it,
+ * and the absolute links in email still need a concrete host.
+ */
+const APP_URL = process.env.NEXT_PUBLIC_APP_URL ?? "http://localhost:4000";
+
+/**
+ * Origins the CSRF check accepts. The fallback above must NOT apply here:
+ * a guessed port rejects every sign-in. See `resolveTrustedOrigins`.
+ */
+const TRUSTED_ORIGINS = resolveTrustedOrigins(process.env);
 
 export const auth = betterAuth({
+  // Explicit, so the documented name is the one honoured; AUTH_SECRET is
+  // accepted as an alias.
+  secret: process.env.BETTER_AUTH_SECRET ?? process.env.AUTH_SECRET,
   database: drizzleAdapter(db, {
     provider: "pg",
-    // Map our schema tables to Better-Auth's expected names
     schema: {
       user: users,
       session: sessions,
       account: accounts,
       verification: verifications,
-      // Organization plugin tables (Phase 10)
       organization: organizationTable,
       member: member,
       invitation: invitation,
     },
   }),
 
-  baseURL: process.env.NEXT_PUBLIC_APP_URL || "http://localhost:4000",
+  baseURL: APP_URL,
 
   emailAndPassword: {
     enabled: true,
-    // Only enforce email verification when a real email provider is configured
-    // or in production — otherwise dev users (no RESEND_API_KEY) cannot log in.
-    requireEmailVerification:
-      process.env.NODE_ENV === "production" || !!process.env.RESEND_API_KEY,
-    // Password reset email hook (EMAIL-05)
+    // Verification is required exactly when a verification email can be
+    // sent. Without a provider the link only reaches the server console,
+    // so requiring it would lock every new account out — in production
+    // as much as in development. `validateEnv` warns about that case.
+    requireEmailVerification: !(getEmailProvider() instanceof ConsoleProvider),
     sendResetPassword: async ({ user, url }) => {
       sendPasswordResetEmail({
         to: user.email,
@@ -88,7 +97,6 @@ export const auth = betterAuth({
     },
   },
 
-  // Email verification hook (EMAIL-04)
   emailVerification: {
     sendVerificationEmail: async ({ user, url }) => {
       sendVerifyEmail({
@@ -104,7 +112,7 @@ export const auth = betterAuth({
   },
 
   socialProviders: {
-    // Google OAuth - only enabled when env vars are configured
+    // Each OAuth provider is enabled only when its env vars are set.
     ...(process.env.GOOGLE_CLIENT_ID && process.env.GOOGLE_CLIENT_SECRET
       ? {
           google: {
@@ -114,7 +122,6 @@ export const auth = betterAuth({
         }
       : {}),
 
-    // GitHub OAuth - only enabled when env vars are configured
     ...(process.env.GITHUB_CLIENT_ID && process.env.GITHUB_CLIENT_SECRET
       ? {
           github: {
@@ -126,63 +133,54 @@ export const auth = betterAuth({
   },
 
   session: {
-    // Sessions expire after 7 days
     expiresIn: 60 * 60 * 24 * 7,
-    // Session token updated every 24 hours (extends expiration on active usage)
+    // Refreshed at most daily, extending the expiry while in use.
     updateAge: 60 * 60 * 24,
   },
 
-  trustedOrigins: [process.env.NEXT_PUBLIC_APP_URL || "http://localhost:4000"],
+  trustedOrigins: TRUSTED_ORIGINS,
 
-  // Database hooks for automatic workspace setup (WORK-01)
   databaseHooks: {
     user: {
       create: {
         after: async (user) => {
-          // Auto-create personal workspace for new users
+          // Provision the personal workspace.
           try {
-            const slug = ((user.email || "user").split("@")[0] || "user")
-              .toLowerCase()
-              .replace(/[^a-z0-9-]/g, "-")
-              .slice(0, 30);
-
-            await auth.api.createOrganization({
-              headers: new Headers(),
+            const created = await auth.api.createOrganization({
+              // Deliberately no `headers`: the organization plugin throws
+              // UNAUTHORIZED when headers are present but carry no session,
+              // and an empty `new Headers()` counts as present. Omitting
+              // them takes the system path `body.userId` exists for.
               body: {
                 name: `${user.name || "User"}'s Workspace`,
-                slug: `${slug}-${Date.now().toString(36)}`,
-                userId: user.id, // Associate with the user
+                slug: personalWorkspaceSlug(user.email, user.id),
+                userId: user.id,
               },
             });
-          } catch (error) {
-            // TR-0024: handle race — if hook fires twice for same signup (two
-            // concurrent requests), the unique slug constraint catches the dup.
-            // Check if an org was created despite the error.
-            if (
-              error instanceof Error &&
-              (error.message?.includes("duplicate") ||
-                error.message?.includes("unique") ||
-                error.message?.includes("slug"))
-            ) {
-              const orgs = await auth.api.listOrganizations({
-                headers: new Headers(),
+            if (created) {
+              workspaceCreated({
+                workspaceId: created.id,
+                userId: user.id,
+                email: user.email,
               });
-              if (orgs && orgs.length > 0) {
-                // Org already created by the other hook — not an error.
-                return;
-              }
             }
-            // Log for ops visibility; do not throw (user registration succeeded)
-            console.error(
-              "[user.create hook] Failed to create workspace:",
-              error
-            );
+          } catch (error) {
+            // The slug is derived from the user, so a racing provisioner
+            // loses on `organization.slug`'s unique index: the workspace
+            // exists, which is the outcome this hook wanted. Anything else
+            // is worth ops visibility, but never fails the registration.
+            const message =
+              error instanceof Error ? error.message : String(error);
+            if (!/already exists|duplicate|unique|slug/i.test(message)) {
+              console.error(
+                "[user.create hook] Failed to create workspace:",
+                error
+              );
+            }
           }
 
-          // Send welcome email (EMAIL-03, fire-and-forget).
-          // NOTE(DB-12): No retry or outbox — downstream failures silently ignored.
-          // Acceptable for v0.2; consider transactional outbox for Phase 14.
-          const dashboardUrl = `${process.env.NEXT_PUBLIC_APP_URL || "http://localhost:4000"}/dashboard`;
+          // Fire-and-forget: no retry or outbox, a failure is only logged.
+          const dashboardUrl = `${APP_URL}/dashboard`;
           sendWelcomeEmail({
             to: user.email,
             userName: user.name || user.email,
@@ -196,7 +194,7 @@ export const auth = betterAuth({
     session: {
       create: {
         before: async (session): Promise<{ data: typeof session }> => {
-          // Check if user is soft-deleted before creating session
+          // A soft-deleted user gets no session.
           try {
             const userRecord = await db
               .select({ deletedAt: users.deletedAt })
@@ -214,25 +212,25 @@ export const auth = betterAuth({
               "[session.create hook] Deleted user check failed:",
               error
             );
-            throw error; // Re-throw to prevent session creation
+            throw error;
           }
 
-          // Auto-set active organization on session creation
-          // NOTE(DB-11): Uses new Headers() — bypasses any future middleware
-          // (bot detection, request signing). Acceptable for v0.2; pass request
-          // headers through hook context if middleware layering is needed later.
+          // Set the active organization. Reads `member` directly because
+          // `/organization/list` resolves the user from a session, and this
+          // hook runs while that session is being created.
           try {
-            const orgs: any = await auth.api.listOrganizations({
-              headers: new Headers(),
-              query: { userId: session.userId },
-            });
+            const [membership] = await db
+              .select({ organizationId: member.organizationId })
+              .from(member)
+              .where(eq(member.userId, session.userId))
+              .orderBy(member.createdAt)
+              .limit(1);
 
-            if (orgs && orgs.length > 0) {
-              // Auto-set active org on session creation
+            if (membership) {
               return {
                 data: {
                   ...session,
-                  activeOrganizationId: orgs[0].id,
+                  activeOrganizationId: membership.organizationId,
                 },
               };
             }
@@ -251,47 +249,31 @@ export const auth = betterAuth({
 
   plugins: [
     organization({
-      // Allow all users to create organizations (will be plan-gated in Phase 15)
       allowUserToCreateOrganization: async () => true,
-      // Generous default limit (will be plan-gated later)
       organizationLimit: 5,
-      // Creator becomes owner (explicit for clarity)
       creatorRole: "owner",
-      // Invitation email sending via Resend (EMAIL-06, replaces Phase 10 placeholder)
       sendInvitationEmail: async (data) => {
-        const appUrl =
-          process.env.NEXT_PUBLIC_APP_URL || "http://localhost:4000";
+        const { acceptUrl, declineUrl } = invitationLinks(APP_URL, data.id);
         sendInvitationEmail({
           to: data.email,
           inviterName: data.inviter?.user?.name || "A team member",
           workspaceName: data.organization?.name || "a workspace",
           role: data.role || "member",
-          acceptUrl: `${appUrl}/accept-invitation/${data.id}`,
-          declineUrl: `${appUrl}/invitation/decline?id=${data.id}`,
+          acceptUrl,
+          declineUrl,
         }).catch((err) =>
           console.error("[Auth] Failed to send invitation email:", err)
         );
       },
-      // Invitations expire after 7 days (matches TEAM-10)
       invitationExpiresIn: 60 * 60 * 24 * 7,
     }),
     /**
-     * Platform administration — enabled only for its impersonation
-     * endpoints, which the operational console uses for support.
-     *
-     * `adminRoles` is deliberately a platform role and not a workspace
-     * one: workspace `owner` is per-tenant and every self-serve signup
-     * owns their own workspace, so gating anything cross-tenant on it
-     * grants it to everybody. `users.role` carries the platform role;
+     * Enabled for its impersonation endpoints, used by the console.
+     * `adminRoles` is a platform role, never a workspace one: every
+     * self-serve signup owns a workspace. `users.role` carries it;
      * requirePlatformAdmin promotes from PLATFORM_ADMIN_EMAILS into it.
-     *
-     * An impersonation session is capped at 30 minutes. Support work
-     * is measured in minutes, and a session inherited by whoever next
-     * uses that browser is the failure mode worth designing against.
-     *
-     * `allowImpersonatingAdmins` stays false: one platform admin
-     * cannot take over another's account, which is what keeps the
-     * audit trail meaningful.
+     * Sessions are capped at 30 minutes, and one admin cannot impersonate
+     * another, which keeps the audit trail meaningful.
      */
     admin({
       ac: accessControl,

package/src/team/errors.ts

@@ -1,12 +1,6 @@
 /**
- * Team service error type.
- *
- * The team service (./service.ts) throws this for every failure it
- * recognizes rather than returning an ad-hoc `{ success, error }`
- * envelope — that shaping is a transport concern (a Server Action, a
- * route handler) and belongs one layer up, alongside
- * revalidatePath/Sentry/toast/i18n, none of which this package may
- * depend on.
+ * Thrown for every failure the team service recognizes. Shaping it for a UI
+ * (a `{ success, error }` envelope, i18n, revalidation) is the transport's job.
  */
 
 /**
@@ -54,14 +48,11 @@ export class TeamServiceError extends Error {
     this.code = code;
     this.meta = options?.meta;
     if (options?.cause !== undefined) {
-      // ES2020 target predates the standard `cause` constructor option;
-      // assign it directly so `instanceof Error` consumers (and Node's
-      // own error inspection) still see it.
+      // The ES2020 target predates the `cause` constructor option.
       (this as { cause?: unknown }).cause = options.cause;
     }
 
-    // Restore prototype chain (extending built-ins across some
-    // transpilation targets loses `instanceof`).
+    // Extending built-ins loses `instanceof` on some transpilation targets.
     Object.setPrototypeOf(this, TeamServiceError.prototype);
   }
 }

package/src/team/schemas.ts

@@ -1,32 +1,19 @@
-/**
- * Team Management Validation Schemas
- *
- * Zod schemas for team invite and member management inputs, shared by
- * the team service and its transports.
- *
- * (Ported from the product application’s team validation module — same
- * semantics. Ignite's copy is retired at cutover.)
- */
+/** Team inputs, shared by the team service and its transports. */
 
 import { z } from "zod";
 
-/**
- * Invite Member Schema
- * Email + role for inviting new team members
- */
 export const inviteMemberSchema = z.object({
   email: z.string().email("Please enter a valid email address"),
   role: z.enum(["admin", "member"], {
-    required_error: "Please select a role",
+    // One message for a missing role and an unknown one: to the person
+    // filling in the form they are the same mistake. `message`, not
+    // `error`: the peer range admits zod 3, which reads only `message`.
+    message: "Please select a role",
   }),
 });
 
 export type InviteMemberInput = z.infer<typeof inviteMemberSchema>;
 
-/**
- * Update Role Schema
- * For changing an existing member's role
- */
 export const updateRoleSchema = z.object({
   memberId: z.string().min(1),
   role: z.enum(["admin", "member"]),