@jxsuite/auth 0.4.2 → 0.5.0

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@jxsuite/auth",
-  "version": "0.4.2",
+  "version": "0.5.0",
   "description": "Better Auth sessions, sign-in flows, and table permissions for Jx sites over /_jx/auth",
   "license": "MIT",
   "repository": {
@@ -38,13 +38,13 @@
     "upgrade": "bunx npm-check-updates -u && bun install"
   },
   "dependencies": {
-    "@jxsuite/connector": "^0.4.2",
-    "@jxsuite/schema": "^1.5.0",
-    "better-auth": "^1.6.25",
-    "kysely": "^0.29.4"
+    "@jxsuite/connector": "^0.5.0",
+    "@jxsuite/schema": "^1.6.0",
+    "better-auth": "^1.7.1",
+    "kysely": "^0.29.5"
   },
   "devDependencies": {
-    "@happy-dom/global-registrator": "^20.11.1",
+    "@happy-dom/global-registrator": "^20.11.2",
     "ajv": "^8.20.0"
   },
   "jx": "./jx-extension.json"

package/src/config.ts

@@ -16,6 +16,87 @@ export const AUTH_BASE_PATH = "/_jx/auth";
 /** Default NAME of the env var holding the Better Auth signing secret. */
 export const DEFAULT_SECRET_ENV = "BETTER_AUTH_SECRET";
 
+/**
+ * How long a session lives, and how often activity extends it (seconds).
+ *
+ * These are Better Auth's own defaults, restated so the lifetime is **this project's** decision and
+ * shows up in a diff when it changes. A session lifetime that lives only in a dependency's default
+ * is one nobody chose.
+ */
+export const SESSION_EXPIRES_SECONDS = 60 * 60 * 24 * 7;
+export const SESSION_UPDATE_SECONDS = 60 * 60 * 24;
+
+/** Auth-route rate limit: requests per IP per window (seconds). */
+export const RATE_LIMIT_MAX = 100;
+export const RATE_LIMIT_WINDOW_SECONDS = 10;
+
+/** Better Auth's own cookie-name prefix. Changing it signs every existing session out. */
+const COOKIE_PREFIX = "better-auth";
+
+/** The cookies `createCookieGetter` mints, all of them same-host and `Path=/`. */
+const COOKIE_IDS = ["session_token", "session_data", "dont_remember", "account_data"];
+
+/**
+ * Whether this deployment's cookies must carry `Secure` — and therefore a name prefix.
+ *
+ * **Default secure, and only step down when the origin is positively known to be plain HTTP.**
+ * Better Auth's own rule falls back to `NODE_ENV === "production"`, which is _false on Cloudflare
+ * Workers_ — where `NODE_ENV` is simply unset — so the library's default silently produced
+ * unprefixed, non-`Secure` session cookies on exactly the platform Jx deploys to. The one host that
+ * genuinely serves auth over plain HTTP is the local dev server, and it pins `BETTER_AUTH_URL` to
+ * its own origin so this reads `http:` there rather than guessing.
+ *
+ * @param {Env} env
+ * @returns {boolean}
+ */
+export function cookiesAreSecure(env: Env): boolean {
+  const baseURL = env["BETTER_AUTH_URL"];
+  if (typeof baseURL === "string" && baseURL !== "") {
+    return !baseURL.startsWith("http://");
+  }
+  return true;
+}
+
+/**
+ * The `advanced` block: cookie names and attributes (RFC 6265bis §4.1.3).
+ *
+ * **`__Host-`, not `__Secure-`.** `__Secure-` only promises the cookie was set with `Secure`; a
+ * page on a sibling origin — `evil.example.com` against `example.com` — can still overwrite it by
+ * setting a `Domain`. `__Host-` forbids `Domain`, pins `Path=/`, and is therefore the prefix that
+ * actually stops a session-fixation write. Better Auth's defaults already set `Path=/` and no
+ * `Domain`, so the stronger prefix costs nothing.
+ *
+ * Getting there means turning **off** `useSecureCookies` and putting `Secure` back by hand: the
+ * library prepends `__Secure-` to whatever name it is given, so leaving it on would mint
+ * `__Secure-__Host-…`, a name no browser accepts. `secure: true` in `defaultCookieAttributes`
+ * restores the attribute the flag would have set. `tests/config.test.ts` asserts the resulting
+ * names, so a library upgrade that changes this is loud rather than silent.
+ *
+ * **`Partitioned` is not set, and must not default on.** CHIPS is for cookies in a _third-party_
+ * context; Jx auth cookies are first-party to the site that serves them. Setting it would force
+ * `SameSite=None; Secure` and partition the session per top-level site — signing a visitor out
+ * whenever the embedding page changed.
+ *
+ * @param {boolean} secure
+ * @returns {Record<string, unknown>}
+ */
+function advancedCookieOptions(secure: boolean): Record<string, unknown> {
+  if (!secure) {
+    // Plain-HTTP dev origin: a prefixed cookie without `Secure` is rejected outright.
+    return { cookiePrefix: COOKIE_PREFIX, useSecureCookies: false };
+  }
+  const cookies: Record<string, { name: string }> = {};
+  for (const id of COOKIE_IDS) {
+    cookies[id] = { name: `__Host-${COOKIE_PREFIX}.${id}` };
+  }
+  return {
+    cookiePrefix: COOKIE_PREFIX,
+    cookies,
+    defaultCookieAttributes: { secure: true },
+    useSecureCookies: false,
+  };
+}
+
 /** One social provider entry: env-var NAMES for the OAuth credentials, never values. */
 export interface AuthProviderDef {
   clientIdEnv?: string;
@@ -119,8 +200,19 @@ export function buildAuthOptions(
     // Without BETTER_AUTH_URL Better Auth derives the origin from each incoming request, which
     // Is correct for same-origin /_jx/auth mounts; setting it pins callbacks for OAuth flows.
     ...(typeof baseURL === "string" && baseURL !== "" ? { baseURL } : {}),
+    advanced: advancedCookieOptions(cookiesAreSecure(env)),
     basePath: AUTH_BASE_PATH,
     emailAndPassword: { enabled: section.methods?.emailPassword ?? true },
+    /*
+     * Rate limiting is ON everywhere, not just in production. Better Auth gates its own default on
+     * `NODE_ENV === "production"`, which is unset on Workers — so the limit was off in the one
+     * place it matters. It is also on in dev deliberately: 100 requests per 10 seconds is far
+     * beyond anything a person does by hand, and a limit that is disabled while you develop is a
+     * limit nobody ever finds out is broken. Storage is Better Auth's in-memory default, which on
+     * a serverless runtime is per-isolate — a speed bump for credential stuffing, not a wall.
+     */
+    rateLimit: { enabled: true, max: RATE_LIMIT_MAX, window: RATE_LIMIT_WINDOW_SECONDS },
+    session: { expiresIn: SESSION_EXPIRES_SECONDS, updateAge: SESSION_UPDATE_SECONDS },
     ...(Object.keys(socialProviders).length > 0 ? { socialProviders } : {}),
     ...(roles.length > 0
       ? {