@invect/user-auth 0.0.1

package/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2025 @robase
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/README.md

@@ -0,0 +1,106 @@
+# @invect/user-auth
+
+Better Auth integration for [Invect](https://github.com/invect/invect). Adds user authentication, session management, identity resolution, and auth UI components.
+
+## Install
+
+```bash
+pnpm add @invect/user-auth better-auth
+```
+
+## Usage
+
+### Backend
+
+```ts
+import { betterAuth } from 'better-auth';
+import { betterAuthPlugin } from '@invect/user-auth';
+import { createInvectRouter } from '@invect/express';
+
+// 1. Configure better-auth
+const auth = betterAuth({
+  database: { url: 'file:./auth.db', type: 'sqlite' },
+  emailAndPassword: { enabled: true },
+});
+
+// 2. Add the plugin
+app.use('/invect', createInvectRouter({
+  databaseUrl: 'file:./dev.db',
+  plugins: [
+    betterAuthPlugin({
+      auth,
+      globalAdmins: [
+        {
+          email: process.env.INVECT_ADMIN_EMAIL,
+          pw: process.env.INVECT_ADMIN_PASSWORD,
+          name: 'Admin',
+        },
+      ],
+    }),
+  ],
+}));
+```
+
+`globalAdmins` is the explicit source of truth for seeded admin accounts. If you
+want to use environment variables, wire them into that array yourself.
+
+### Frontend
+
+```tsx
+import { AuthProvider, useAuth, SignInForm, UserButton, AuthGate } from '@invect/user-auth/ui';
+
+function App() {
+  return (
+    <AuthProvider baseUrl="http://localhost:3000/invect">
+      <AuthGate fallback={<SignInPage />}>
+        <Header />
+        <MainApp />
+      </AuthGate>
+    </AuthProvider>
+  );
+}
+
+function Header() {
+  return (
+    <header>
+      <UserButton />
+    </header>
+  );
+}
+
+function SignInPage() {
+  return <SignInForm onSuccess={() => window.location.reload()} />;
+}
+```
+
+## Package Exports
+
+| Entry Point | Import | Content |
+|-------------|--------|---------|
+| `@invect/user-auth` | `import { betterAuthPlugin } from '@invect/user-auth'` | Backend plugin (Node.js) |
+| `@invect/user-auth/ui` | `import { AuthProvider, useAuth } from '@invect/user-auth/ui'` | Frontend components (Browser) |
+| `@invect/user-auth/types` | `import type { AuthUser } from '@invect/user-auth/types'` | Shared types |
+
+## What It Does
+
+### Backend (`@invect/user-auth`)
+- **Proxies auth routes** — Sign-in, sign-up, OAuth, session endpoints at `/plugins/auth/*`
+- **Resolves sessions** — Every Invect API request calls `auth.api.getSession()` to populate `InvectIdentity`
+- **Maps roles** — better-auth user roles align with Invect RBAC (`owner`, `editor`, `operator`, `viewer`), preserve `admin`, and fall back to `default` for no global access
+- **Middleware helper** — `createSessionResolver()` for use as `auth.resolveUser` callback
+
+### Frontend (`@invect/user-auth/ui`)
+- **AuthProvider** — Context provider that fetches session state and provides sign-in/sign-up/sign-out actions
+- **useAuth()** — Hook for accessing current user, auth state, and actions
+- **SignInForm** — Email/password sign-in form
+- **SignUpForm** — Email/password sign-up form
+- **UserButton** — User avatar with dropdown (name, email, role, sign-out)
+- **AuthGate** — Conditionally renders children based on auth state
+
+## Docs
+
+Full documentation: [invect.dev/docs/authentication](https://invect.dev/docs/authentication)
+
+## License
+
+MIT