@lunora/auth 1.0.0-alpha.27 → 1.0.0-alpha.29

package/dist/index.d.mts

@@ -575,4 +575,4 @@ declare const validateSessionPolicy: (policy: SessionPolicy) => SessionPolicy;
 *   with the same 60s cookie cache as `rolling`.
 */
 declare const sessionPresets: Record<"longLived" | "rolling" | "strict", SessionPolicy>;
-export { type AuthAccount, type AuthAdmin, type AuthAdminSession, type AuthAdminUser, type AuthCapabilities, type AuthInvitation, type AuthMember, type AuthOrganization, type AuthPage, type AuthPasskey, type AuthTimestamp, type CreateAuthAdminOptions, DEFAULT_AUTH_BASE_PATH, type ImpersonationResult, type ListUsersOptions, type LunoraAuth, LunoraAuthAdminError, type LunoraAuthOptions, type SessionPolicy, compileMigrationsSql, createAuthAdmin, ensureMigrated, handleAuthRequest, sessionPresets, validateSessionPolicy };
+export { type AuthAccount, type AuthAdmin, type AuthAdminSession, type AuthAdminUser, type AuthCapabilities, type AuthConfigInfo, type AuthInvitation, type AuthMember, type AuthOrgRole, type AuthOrganization, type AuthPage, type AuthPasskey, type AuthTeam, type AuthTeamMember, type AuthTimestamp, type AuthUserFieldSpec, type CreateAuthAdminOptions, DEFAULT_AUTH_BASE_PATH, type ImpersonationResult, type ListUsersOptions, type LunoraAuth, LunoraAuthAdminError, type LunoraAuthOptions, type SessionPolicy, compileMigrationsSql, createAuthAdmin, ensureMigrated, handleAuthRequest, sessionPresets, validateSessionPolicy };

package/dist/index.d.ts

@@ -575,4 +575,4 @@ declare const validateSessionPolicy: (policy: SessionPolicy) => SessionPolicy;
 *   with the same 60s cookie cache as `rolling`.
 */
 declare const sessionPresets: Record<"longLived" | "rolling" | "strict", SessionPolicy>;
-export { type AuthAccount, type AuthAdmin, type AuthAdminSession, type AuthAdminUser, type AuthCapabilities, type AuthInvitation, type AuthMember, type AuthOrganization, type AuthPage, type AuthPasskey, type AuthTimestamp, type CreateAuthAdminOptions, DEFAULT_AUTH_BASE_PATH, type ImpersonationResult, type ListUsersOptions, type LunoraAuth, LunoraAuthAdminError, type LunoraAuthOptions, type SessionPolicy, compileMigrationsSql, createAuthAdmin, ensureMigrated, handleAuthRequest, sessionPresets, validateSessionPolicy };
+export { type AuthAccount, type AuthAdmin, type AuthAdminSession, type AuthAdminUser, type AuthCapabilities, type AuthConfigInfo, type AuthInvitation, type AuthMember, type AuthOrgRole, type AuthOrganization, type AuthPage, type AuthPasskey, type AuthTeam, type AuthTeamMember, type AuthTimestamp, type AuthUserFieldSpec, type CreateAuthAdminOptions, DEFAULT_AUTH_BASE_PATH, type ImpersonationResult, type ListUsersOptions, type LunoraAuth, LunoraAuthAdminError, type LunoraAuthOptions, type SessionPolicy, compileMigrationsSql, createAuthAdmin, ensureMigrated, handleAuthRequest, sessionPresets, validateSessionPolicy };

package/dist/index.mjs

@@ -1,9 +1,9 @@
 export { lunoraAuthAdapter, lunoraD1Adapter } from './adapter.mjs';
-export { LunoraAuthAdminError, createAuthAdmin } from './packem_shared/LunoraAuthAdminError-D4L7n6gN.mjs';
-export { createAuth, resolveAuthOptions } from './packem_shared/createAuth-BVMMllTm.mjs';
+export { LunoraAuthAdminError, createAuthAdmin } from './packem_shared/LunoraAuthAdminError-CReJPMkx.mjs';
+export { createAuth, resolveAuthOptions } from './packem_shared/createAuth-s4i7WhAh.mjs';
 export { DEFAULT_AUTH_BASE_PATH, handleAuthRequest } from './packem_shared/DEFAULT_AUTH_BASE_PATH-DjcUWEQl.mjs';
 export { LunoraAuthHeadersError, withAuthPlugins } from './middleware.mjs';
-export { compileMigrationsSql, ensureMigrated } from './packem_shared/compileMigrationsSql-B9bj-mJv.mjs';
+export { compileMigrationsSql, ensureMigrated } from './packem_shared/compileMigrationsSql-Dl5N8z5q.mjs';
 export { default as authTables } from './schema.mjs';
 export { sessionPresets, validateSessionPolicy } from './packem_shared/sessionPresets-Dwwd74_J.mjs';
 export { createSqlAuthStore, d1Executor } from './sql-store.mjs';

package/dist/packem_shared/{LunoraAuthAdminError-D4L7n6gN.mjs → LunoraAuthAdminError-CReJPMkx.mjs}

@@ -74,6 +74,17 @@ const asAdminError = (error) => {
 const createAuthAdmin = (auth, options = {}) => {
   const context = auth.$context;
   const features = options.features ?? {};
+  const deriveCapabilities = (authOptions) => {
+    const ids = new Set((authOptions.plugins ?? []).map((plugin) => plugin.id));
+    const has = (id) => ids.has(id);
+    return {
+      accounts: features.accounts ?? true,
+      admin: features.admin ?? has("admin"),
+      organization: features.organization ?? has("organization"),
+      passkey: features.passkey ?? has("passkey"),
+      twoFactor: features.twoFactor ?? has("two-factor")
+    };
+  };
   const withContext = async (function_) => {
     try {
       return await function_(await context);
@@ -98,9 +109,18 @@ const createAuthAdmin = (auth, options = {}) => {
   };
   return {
     banUser: ({ expiresInSeconds, reason, userId }) => withContext(async (context_) => {
-      const seconds = typeof expiresInSeconds === "number" && Number.isFinite(expiresInSeconds) ? Math.min(Math.trunc(expiresInSeconds), MAX_BAN_SECONDS) : 0;
-      const banExpires = seconds > 0 ? new Date(Date.now() + seconds * 1e3) : void 0;
+      let banExpires = null;
+      if (expiresInSeconds !== void 0) {
+        if (!Number.isInteger(expiresInSeconds) || expiresInSeconds <= 0) {
+          throw new LunoraAuthAdminError("expiresInSeconds must be a positive finite integer", "INVALID_BAN_SECONDS");
+        }
+        const seconds = Math.min(expiresInSeconds, MAX_BAN_SECONDS);
+        banExpires = new Date(Date.now() + seconds * 1e3);
+      }
       const user = await context_.internalAdapter.updateUser(userId, {
+        // `null` (not `undefined`) for a permanent ban so the adapter clears any prior
+        // `banExpires` rather than skipping it — otherwise a temp-ban-then-permanent-ban
+        // escalation leaves the old expiry and the "permanent" ban silently lapses.
         banExpires,
         banned: true,
         banReason: reason ?? "No reason"
@@ -111,17 +131,7 @@ const createAuthAdmin = (auth, options = {}) => {
     cancelInvitation: ({ invitationId }) => withContext(async (context_) => {
       await context_.adapter.delete({ model: "invitation", where: [{ field: "id", value: invitationId }] });
     }),
-    capabilities: () => withContext((context_) => {
-      const ids = new Set((context_.options.plugins ?? []).map((plugin) => plugin.id));
-      const has = (id) => ids.has(id);
-      return Promise.resolve({
-        accounts: features.accounts ?? true,
-        admin: features.admin ?? has("admin"),
-        organization: features.organization ?? has("organization"),
-        passkey: features.passkey ?? has("passkey"),
-        twoFactor: features.twoFactor ?? has("two-factor")
-      });
-    }),
+    capabilities: () => withContext((context_) => Promise.resolve(deriveCapabilities(context_.options))),
     // ── Directly add an existing user to an org (no invitation/acceptance). ──
     addMember: ({ organizationId, role, userId }) => withContext(async (context_) => {
       const member = await context_.adapter.create({
@@ -141,15 +151,8 @@ const createAuthAdmin = (auth, options = {}) => {
     // only from the resolved better-auth options (no DB, no secrets).
     config: () => withContext((context_) => {
       const authOptions = context_.options;
+      const capabilities = deriveCapabilities(authOptions);
       const ids = new Set((authOptions.plugins ?? []).map((plugin) => plugin.id));
-      const has = (id) => ids.has(id);
-      const capabilities = {
-        accounts: features.accounts ?? true,
-        admin: features.admin ?? has("admin"),
-        organization: features.organization ?? has("organization"),
-        passkey: features.passkey ?? has("passkey"),
-        twoFactor: features.twoFactor ?? has("two-factor")
-      };
       const tables = getAuthTables(authOptions);
       const session = authOptions.session ?? {};
       const rateLimit = authOptions.rateLimit ?? {};

package/dist/packem_shared/{compileMigrationsSql-B9bj-mJv.mjs → compileMigrationsSql-Dl5N8z5q.mjs}

@@ -1,5 +1,5 @@
 import { getMigrations } from 'better-auth/db/migration';
-import { resolveAuthOptions } from './createAuth-BVMMllTm.mjs';
+import { resolveAuthOptions } from './createAuth-s4i7WhAh.mjs';
 
 const migrating = /* @__PURE__ */ new WeakMap();
 const ensureMigrated = async (auth) => {

package/dist/packem_shared/{createAuth-BVMMllTm.mjs → createAuth-s4i7WhAh.mjs}

@@ -7,21 +7,6 @@ const isWeakSecret = (secret) => {
   const trimmedLength = typeof secret === "string" ? secret.trim().length : 0;
   return trimmedLength > 0 && trimmedLength < MIN_SECRET_LENGTH;
 };
-const isHttpsBaseUrl = (baseURL) => {
-  if (typeof baseURL === "string") {
-    return baseURL.startsWith("https://");
-  }
-  if (baseURL && typeof baseURL === "object") {
-    if (baseURL.protocol === "https") {
-      return true;
-    }
-    if (baseURL.protocol === "http") {
-      return false;
-    }
-    return typeof baseURL.fallback === "string" && baseURL.fallback.startsWith("https://");
-  }
-  return false;
-};
 const isExplicitHttpBaseUrl = (baseURL) => {
   if (typeof baseURL === "string") {
     return baseURL.toLowerCase().startsWith("http://");
@@ -40,7 +25,7 @@ const isExplicitHttpBaseUrl = (baseURL) => {
 const hardenAuthOptions = (options) => {
   if (isWeakSecret(options.secret)) {
     const message = `@lunora/auth: AUTH_SECRET is only ${String(options.secret?.trim().length)} characters. Use at least ${String(MIN_SECRET_LENGTH)} for a brute-force-resistant secret — generate one with \`openssl rand -hex 32\`.`;
-    if (isHttpsBaseUrl(options.baseURL)) {
+    if (!isExplicitHttpBaseUrl(options.baseURL)) {
       throw new LunoraError("INTERNAL", message);
     }
     console.warn(message);

package/dist/turnstile.mjs

@@ -28,7 +28,12 @@ const verifyTurnstile = async ({
   if (!response.ok) {
     throw new LunoraError("SERVICE_UNAVAILABLE", `turnstile siteverify returned ${String(response.status)}`, { status: 503 });
   }
-  const raw = await response.json();
+  let raw;
+  try {
+    raw = await response.json();
+  } catch (error) {
+    throw new LunoraError("SERVICE_UNAVAILABLE", "turnstile siteverify returned a non-JSON body", { cause: error, status: 503 });
+  }
   const action = asString(raw.action);
   const hostname = asString(raw.hostname);
   const errorCodes = asStringArray(raw["error-codes"]);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@lunora/auth",
-  "version": "1.0.0-alpha.27",
+  "version": "1.0.0-alpha.29",
   "description": "Auth for Lunora — a thin better-auth wrapper: email/password, OAuth, plugins, D1-backed",
   "keywords": [
     "auth",
@@ -83,9 +83,9 @@
   },
   "dependencies": {
     "@better-auth/passkey": "^1.6.23",
-    "@lunora/errors": "1.0.0-alpha.3",
-    "@lunora/server": "1.0.0-alpha.21",
-    "@lunora/values": "1.0.0-alpha.6",
+    "@lunora/errors": "1.0.0-alpha.4",
+    "@lunora/server": "1.0.0-alpha.23",
+    "@lunora/values": "1.0.0-alpha.7",
     "better-auth": "^1.6.23"
   },
   "engines": {