@intelligo-dev/auth 1.0.0-beta.2 → 1.0.0-beta.5

package/src/profile/schemas.ts

@@ -4,9 +4,8 @@
  * Zod schemas for user profile updates, shared by the profile service
  * and its transports.
  *
- * (Ported from the product application's `lib/validations/profile.ts` —
- * same semantics: optional name, optional-and-nullable image URL.
- * Ignite's copy is retired at cutover.)
+ * (Ported from the first product's `lib/validations/profile.ts` —
+ * same semantics: optional name, optional-and-nullable image URL.)
  */
 
 import { z } from "zod";

package/src/profile/service.ts

@@ -1,7 +1,7 @@
 /**
  * Profile management service — the durable business rules behind
  * reading the caller's own profile, updating it, and deleting the
- * account, extracted from the product application's profile actions
+ * account, lifted out of the first product's profile actions
  * (page/registry migration, `profile-settings` family, roadmap item 9).
  *
  * Mirrors `createTeamService(ports)` / `createWorkspaceService(ports)`
@@ -38,12 +38,12 @@
  * direct calls: this service should not own *content* — copy, subject
  * lines, template shape — for a side effect a consumer may want to
  * localize, skip, or replace with a different provider. `onAccountDeleted`
- * is fire-and-forget by design (matching ignite's `.catch(console.error)`
+ * is fire-and-forget by design (matching the original action's `.catch(console.error)`
  * pattern): a failed confirmation email must never block the deletion
  * that already succeeded.
  */
 
-import { headers } from "next/headers";
+import { getRequestHeaders } from "@intelligo-dev/core/request-context";
 import type { ZodType } from "zod";
 import { eq } from "drizzle-orm";
 import { createLogger } from "@intelligo-dev/core/logger";
@@ -134,12 +134,12 @@ export function createProfileService(ports: ProfileServicePorts = {}) {
    * Only the fields present in `input` are sent — omitting a field
    * leaves it unchanged; `image: null` is dropped rather than forwarded
    * (Better-Auth's `updateUser` does not accept `null`), matching
-   * ignite's original action.
+   * the original action.
    */
   async function updateProfile(input: UpdateProfileInput): Promise<void> {
     await callRequireAuth();
     const validated = parseInput(updateProfileSchema, input);
-    const hdrs = await headers();
+    const hdrs = await getRequestHeaders();
 
     const updateData: { name?: string; image?: string } = {};
     if (validated.name !== undefined) updateData.name = validated.name;

package/src/server.ts

@@ -20,6 +20,7 @@ import {
   userAc,
 } from "better-auth/plugins/admin/access";
 import { PLATFORM_ADMIN_ROLE } from "./roles";
+import { resolveTrustedOrigins } from "./trusted-origins";
 
 /**
  * Access control for the platform role.
@@ -52,6 +53,24 @@ import {
 } from "@intelligo-dev/core/email";
 import { eq } from "drizzle-orm";
 
+/**
+ * The origin this app is served from.
+ *
+ * `NEXT_PUBLIC_APP_URL` is a REQUIRED variable (`assertEnv` in
+ * `@intelligo-dev/core/env`), but auth is configured at module load,
+ * long before any composition root asserts it. This value therefore
+ * still needs a fallback for the absolute links that go into email —
+ * a verification or invitation URL has to name a concrete host.
+ */
+const APP_URL = process.env.NEXT_PUBLIC_APP_URL ?? "http://localhost:4000";
+
+/**
+ * Origins the CSRF check accepts — the one place the fallback above
+ * must NOT apply, because a guessed port there does not degrade
+ * gracefully. See `resolveTrustedOrigins` for the rule.
+ */
+const TRUSTED_ORIGINS = resolveTrustedOrigins(process.env);
+
 export const auth = betterAuth({
   // Explicit, so the name the framework documents (doctor, scaffold,
   // env validation) is the one that is honoured; AUTH_SECRET stays a
@@ -72,7 +91,7 @@ export const auth = betterAuth({
     },
   }),
 
-  baseURL: process.env.NEXT_PUBLIC_APP_URL || "http://localhost:4000",
+  baseURL: APP_URL,
 
   emailAndPassword: {
     enabled: true,
@@ -136,7 +155,7 @@ export const auth = betterAuth({
     updateAge: 60 * 60 * 24,
   },
 
-  trustedOrigins: [process.env.NEXT_PUBLIC_APP_URL || "http://localhost:4000"],
+  trustedOrigins: TRUSTED_ORIGINS,
 
   // Database hooks for automatic workspace setup (WORK-01)
   databaseHooks: {
@@ -186,7 +205,7 @@ export const auth = betterAuth({
           // Send welcome email (EMAIL-03, fire-and-forget).
           // NOTE(DB-12): No retry or outbox — downstream failures silently ignored.
           // Acceptable for v0.2; consider transactional outbox for Phase 14.
-          const dashboardUrl = `${process.env.NEXT_PUBLIC_APP_URL || "http://localhost:4000"}/dashboard`;
+          const dashboardUrl = `${APP_URL}/dashboard`;
           sendWelcomeEmail({
             to: user.email,
             userName: user.name || user.email,
@@ -263,15 +282,13 @@ export const auth = betterAuth({
       creatorRole: "owner",
       // Invitation email sending via Resend (EMAIL-06, replaces Phase 10 placeholder)
       sendInvitationEmail: async (data) => {
-        const appUrl =
-          process.env.NEXT_PUBLIC_APP_URL || "http://localhost:4000";
         sendInvitationEmail({
           to: data.email,
           inviterName: data.inviter?.user?.name || "A team member",
           workspaceName: data.organization?.name || "a workspace",
           role: data.role || "member",
-          acceptUrl: `${appUrl}/accept-invitation/${data.id}`,
-          declineUrl: `${appUrl}/invitation/decline?id=${data.id}`,
+          acceptUrl: `${APP_URL}/accept-invitation/${data.id}`,
+          declineUrl: `${APP_URL}/invitation/decline?id=${data.id}`,
         }).catch((err) =>
           console.error("[Auth] Failed to send invitation email:", err)
         );

package/src/team/schemas.ts

@@ -4,8 +4,8 @@
  * Zod schemas for team invite and member management inputs, shared by
  * the team service and its transports.
  *
- * (Ported from the product application’s team validation module — same
- * semantics. Ignite's copy is retired at cutover.)
+ * (Ported from the first product's team validation module — same
+ * semantics.)
  */
 
 import { z } from "zod";

package/src/team/service.ts

@@ -1,8 +1,8 @@
 /**
  * Team management service — the durable business rules behind
- * workspace membership and invitations, extracted from
- * the product application’s team actions (first slice of the page/registry
- * migration, section C1).
+ * workspace membership and invitations, lifted out of the first
+ * product's team actions (first slice of the page/registry migration,
+ * section C1).
  *
  * Mirrors `createExecutions(ports)` (packages/executions/src/lifecycle.ts):
  * a factory over optional ports, so this package's allowlisted
@@ -38,7 +38,7 @@
  * option, the hook fires on every `inviteMember()` call this service
  * makes — there is no code path where it does not.
  *
- * ignite's current `actions/team.ts` ALSO calls
+ * The product's original `actions/team.ts` ALSO called
  * `@intelligo-dev/core/email`'s `sendInvitationEmail` directly after the
  * same `/organization/invite-member` call. That means **two** emails
  * go out per invitation today. This is a live duplication bug, not a
@@ -72,7 +72,7 @@
  * own `organizationId`).
  */
 
-import { headers } from "next/headers";
+import { getRequestHeaders } from "@intelligo-dev/core/request-context";
 import type { ZodType } from "zod";
 import { createLogger } from "@intelligo-dev/core/logger";
 
@@ -110,7 +110,7 @@ export type TeamServicePorts = {
   /**
    * Notify the workspace owner that a new member joined. `memberEmail`
    * is included alongside the ports.md-listed fields because
-   * `triggerTeamMemberJoinedNotification` (the ignite binding) uses it
+   * `triggerTeamMemberJoinedNotification` (a consumer's binding) uses it
    * to compose the notification message — dropping it would silently
    * degrade the message text.
    */
@@ -198,7 +198,7 @@ export function createTeamService(ports: TeamServicePorts = {}) {
    */
   async function listMembers(): Promise<OrgMember[]> {
     const { workspace } = await callRequireWorkspace();
-    const hdrs = await headers();
+    const hdrs = await getRequestHeaders();
 
     const org = await callOrgApi("getFullOrganization", () =>
       auth.api.getFullOrganization({
@@ -215,7 +215,7 @@ export function createTeamService(ports: TeamServicePorts = {}) {
    */
   async function listInvitations(): Promise<OrgInvitation[]> {
     const { workspace } = await callRequireWorkspace();
-    const hdrs = await headers();
+    const hdrs = await getRequestHeaders();
 
     const org = await callOrgApi("getFullOrganization", () =>
       auth.api.getFullOrganization({
@@ -240,7 +240,7 @@ export function createTeamService(ports: TeamServicePorts = {}) {
   }): Promise<OrgInvitation | null> {
     const { workspace, user } = await callRequireRole(["owner", "admin"]);
     const validated = parseInput(inviteMemberSchema, input);
-    const hdrs = await headers();
+    const hdrs = await getRequestHeaders();
 
     // Check team member limit (FLAG-05), via port only.
     if (ports.checkMemberLimit) {
@@ -269,7 +269,7 @@ export function createTeamService(ports: TeamServicePorts = {}) {
 
     // Better-Auth's own duplicate-pending-invite guard
     // (USER_IS_ALREADY_INVITED_TO_THIS_ORGANIZATION) runs inside this
-    // call and surfaces as a provider_error if tripped — ignite's
+    // call and surfaces as a provider_error if tripped — the original
     // action never added a second check on top of it, so neither does
     // this service.
     const result = await callOrgApi("invite-member", () =>
@@ -317,7 +317,7 @@ export function createTeamService(ports: TeamServicePorts = {}) {
    */
   async function acceptInvitation(invitationId: string): Promise<void> {
     const { user } = await callRequireAuth();
-    const hdrs = await headers();
+    const hdrs = await getRequestHeaders();
 
     if (typeof invitationId !== "string" || invitationId.length === 0) {
       throw new TeamServiceError("invalid_input", "Invalid invitation id");
@@ -376,7 +376,7 @@ export function createTeamService(ports: TeamServicePorts = {}) {
     //
     // Reuses `targetOrg` from the post-check above (scoped to
     // `matched.organizationId`, the org the caller just joined) rather
-    // than re-fetching "the active org" the way ignite's original
+    // than re-fetching "the active org" the way the original
     // action did: Better-Auth's org plugin needs a
     // `sessions.activeOrganizationId` column to resolve an org from
     // headers alone, and this repo's Drizzle schema for `sessions`
@@ -427,7 +427,7 @@ export function createTeamService(ports: TeamServicePorts = {}) {
    */
   async function rejectInvitation(invitationId: string): Promise<void> {
     await callRequireAuth();
-    const hdrs = await headers();
+    const hdrs = await getRequestHeaders();
 
     if (typeof invitationId !== "string" || invitationId.length === 0) {
       throw new TeamServiceError("invalid_input", "Invalid invitation id");
@@ -456,7 +456,7 @@ export function createTeamService(ports: TeamServicePorts = {}) {
    */
   async function cancelInvitation(invitationId: string): Promise<void> {
     await callRequireRole(["owner", "admin"]);
-    const hdrs = await headers();
+    const hdrs = await getRequestHeaders();
 
     await callOrgApi("cancel-invitation", () =>
       orgApi["/organization/cancel-invitation"]({
@@ -471,7 +471,7 @@ export function createTeamService(ports: TeamServicePorts = {}) {
    */
   async function removeMember(memberId: string): Promise<void> {
     const { workspace } = await callRequireRole(["owner", "admin"]);
-    const hdrs = await headers();
+    const hdrs = await getRequestHeaders();
 
     await callOrgApi("remove-member", () =>
       orgApi["/organization/remove-member"]({
@@ -490,7 +490,7 @@ export function createTeamService(ports: TeamServicePorts = {}) {
   }): Promise<void> {
     const { workspace } = await callRequireRole(["owner", "admin"]);
     const validated = parseInput(updateRoleSchema, input);
-    const hdrs = await headers();
+    const hdrs = await getRequestHeaders();
 
     await callOrgApi("update-member-role", () =>
       orgApi["/organization/update-member-role"]({
@@ -510,7 +510,7 @@ export function createTeamService(ports: TeamServicePorts = {}) {
    */
   async function leaveWorkspace(): Promise<void> {
     const { workspace, membership } = await callRequireWorkspace();
-    const hdrs = await headers();
+    const hdrs = await getRequestHeaders();
 
     if (membership.role === "owner") {
       const org = await callOrgApi("getFullOrganization", () =>
@@ -555,7 +555,7 @@ export function createTeamService(ports: TeamServicePorts = {}) {
    */
   async function transferOwnership(targetMemberId: string): Promise<void> {
     const { workspace } = await callRequireRole(["owner"]);
-    const hdrs = await headers();
+    const hdrs = await getRequestHeaders();
 
     // Promote target to owner. Note: Better-Auth may handle demotion of
     // the previous owner automatically. If not, the old owner remains
@@ -576,10 +576,10 @@ export function createTeamService(ports: TeamServicePorts = {}) {
    * Get the caller's own pending invitations (for the invitation
    * accept page). No explicit requireAuth here — Better-Auth's
    * list-user-invitations endpoint reads the session off `headers`
-   * itself; ported as-is from ignite's action.
+   * itself; ported as-is from the original action.
    */
   async function getUserInvitations(): Promise<OrgInvitation[]> {
-    const hdrs = await headers();
+    const hdrs = await getRequestHeaders();
 
     const invitations = await callOrgApi("list-user-invitations", () =>
       orgApi["/organization/list-user-invitations"]({ headers: hdrs })

package/src/trusted-origins.ts

@@ -0,0 +1,32 @@
+/**
+ * Which origins Better-Auth's CSRF check accepts.
+ *
+ * Split out of `server.ts` so the rule can be tested without standing
+ * up the whole auth instance (which reaches the database and the email
+ * provider at module load).
+ */
+
+/**
+ * Resolve the trusted-origin list from the environment.
+ *
+ * `NEXT_PUBLIC_APP_URL` is a required variable, and when it is set it
+ * is the only origin trusted — in every environment.
+ *
+ * When it is unset the answer depends on where we are. A guessed port
+ * is the worst possible default: the reference app serves on 4002, a
+ * scaffolded app on 3000, so a fixed guess rejects every sign-in with
+ * `403 INVALID_ORIGIN` while the log names only the rejected origin —
+ * nothing points back at the missing variable. Outside production we
+ * therefore trust any loopback port, so a fresh checkout works on
+ * whatever port Next picked. In production we trust nothing: an unset
+ * variable there is a configuration error, and failing closed is the
+ * only safe reading of it.
+ */
+export function resolveTrustedOrigins(env: {
+  NEXT_PUBLIC_APP_URL?: string;
+  NODE_ENV?: string;
+}): string[] {
+  if (env.NEXT_PUBLIC_APP_URL) return [env.NEXT_PUBLIC_APP_URL];
+  if (env.NODE_ENV === "production") return [];
+  return ["http://localhost:*", "http://127.0.0.1:*"];
+}

package/src/workspace/schemas.ts

@@ -4,8 +4,8 @@
  * Zod schemas for workspace create/update inputs, shared by the
  * workspace service and its transports.
  *
- * (Ported from the product application's workspace validation module —
- * same semantics. Ignite's copy is retired at cutover.)
+ * (Ported from the first product's workspace validation module —
+ * same semantics.)
  */
 
 import { z } from "zod";

package/src/workspace/service.ts

@@ -1,8 +1,8 @@
 /**
  * Workspace management service — the durable business rules behind
  * workspace listing, creation, switching, editing and deletion,
- * extracted from the product application's workspace actions (page/
- * registry migration, `workspace-settings` family, roadmap item 8).
+ * lifted out of the first product's workspace actions (page/registry
+ * migration, `workspace-settings` family, roadmap item 8).
  *
  * Mirrors `createTeamService(ports)` (./../team/service.ts) one
  * directory over: a factory over optional ports, so this package's
@@ -24,7 +24,7 @@
  * Why `checkWorkspaceLimit` takes a `userId`, not a `workspaceId`
  * ---------------------------------------------------------------------
  * `createWorkspace` has no workspace to check the plan of yet — it is
- * the thing being created. Ignite's original action worked around this
+ * the thing being created. The product's original action worked around this
  * by reading the caller's *existing* workspaces and using the first
  * one's id to look up a plan via `@intelligo-dev/billing`'s
  * `checkPlanLimit(workspaceId, "workspaces", currentCount)`, i.e. it
@@ -34,7 +34,7 @@
  * `userId` and how many workspaces they already have. The composition
  * root's binding (`checkWorkspaceLimit`) is where a consumer decides
  * how to resolve "this user's plan" — by reading their first workspace
- * the same way ignite did, or by a real per-user plan lookup if one
+ * the same way the first product did, or by a real per-user plan lookup if one
  * exists.
  *
  * ---------------------------------------------------------------------
@@ -51,7 +51,7 @@
  *    updateOrganization, deleteOrganization, getFullOrganization}`
  *    directly for the base organization CRUD surface, which is not
  *    part of `orgApi`'s typed table (the same approach
- *    `../team/service.ts` takes for `getFullOrganization`). Ignite's
+ *    `../team/service.ts` takes for `getFullOrganization`). The product's
  *    original `actions/workspace.ts` already called these four by
  *    their correct `auth.api` names directly (it never went through a
  *    path-keyed cast), so there is no method-name bug to fix here.
@@ -64,7 +64,7 @@
  *    fallback) and passes that id explicitly to `getFullOrganization`.
  */
 
-import { headers } from "next/headers";
+import { getRequestHeaders } from "@intelligo-dev/core/request-context";
 import type { ZodType } from "zod";
 import { createLogger } from "@intelligo-dev/core/logger";
 
@@ -189,7 +189,7 @@ export function createWorkspaceService(ports: WorkspaceServicePorts = {}) {
    */
   async function listWorkspaces(): Promise<OrgListItem[]> {
     await callRequireAuth();
-    const hdrs = await headers();
+    const hdrs = await getRequestHeaders();
 
     const orgs = await callOrgApi("list", () =>
       orgApi["/organization/list"]({ headers: hdrs })
@@ -210,7 +210,7 @@ export function createWorkspaceService(ports: WorkspaceServicePorts = {}) {
   ): Promise<WorkspaceRecord> {
     const { user } = await callRequireAuth();
     const validated = parseInput(createWorkspaceSchema, input);
-    const hdrs = await headers();
+    const hdrs = await getRequestHeaders();
 
     const existing = await callOrgApi("list", () =>
       orgApi["/organization/list"]({ headers: hdrs })
@@ -271,7 +271,7 @@ export function createWorkspaceService(ports: WorkspaceServicePorts = {}) {
       throw new WorkspaceServiceError("invalid_input", "Invalid workspace id");
     }
 
-    const hdrs = await headers();
+    const hdrs = await getRequestHeaders();
 
     await callOrgApi("set-active", () =>
       orgApi["/organization/set-active"]({
@@ -289,7 +289,7 @@ export function createWorkspaceService(ports: WorkspaceServicePorts = {}) {
   ): Promise<WorkspaceRecord> {
     const { workspace } = await callRequireRole(["owner", "admin"]);
     const validated = parseInput(updateWorkspaceSchema, input);
-    const hdrs = await headers();
+    const hdrs = await getRequestHeaders();
 
     const updateData: { name?: string; slug?: string; logo?: string } = {};
     if (validated.name) updateData.name = validated.name;
@@ -319,7 +319,7 @@ export function createWorkspaceService(ports: WorkspaceServicePorts = {}) {
    */
   async function deleteWorkspace(): Promise<void> {
     const { workspace } = await callRequireRole(["owner"]);
-    const hdrs = await headers();
+    const hdrs = await getRequestHeaders();
 
     await callOrgApi("delete", () =>
       auth.api.deleteOrganization({
@@ -343,13 +343,13 @@ export function createWorkspaceService(ports: WorkspaceServicePorts = {}) {
 
   /**
    * Get the caller's active workspace, fully resolved. Unlike
-   * ignite's original (see the module doc comment), this resolves the
+   * the original action (see the module doc comment), this resolves the
    * workspace id explicitly via `requireWorkspace()` rather than
    * relying on a non-existent `sessions.activeOrganizationId` fallback.
    */
   async function getActiveWorkspace(): Promise<WorkspaceRecord> {
     const { workspace } = await callRequireWorkspace();
-    const hdrs = await headers();
+    const hdrs = await getRequestHeaders();
 
     const org = (await callOrgApi("getFullOrganization", () =>
       auth.api.getFullOrganization({