@lunora/auth 1.0.0-alpha.37 → 1.0.0-alpha.39

package/dist/packem_shared/createAuth-s4i7WhAh.mjs

@@ -1,72 +0,0 @@
-import { LunoraError } from '@lunora/errors';
-import { betterAuth } from 'better-auth';
-import { validateSessionPolicy } from './sessionPresets-Dwwd74_J.mjs';
-
-const MIN_SECRET_LENGTH = 32;
-const isWeakSecret = (secret) => {
-  const trimmedLength = typeof secret === "string" ? secret.trim().length : 0;
-  return trimmedLength > 0 && trimmedLength < MIN_SECRET_LENGTH;
-};
-const isExplicitHttpBaseUrl = (baseURL) => {
-  if (typeof baseURL === "string") {
-    return baseURL.toLowerCase().startsWith("http://");
-  }
-  if (baseURL && typeof baseURL === "object") {
-    if (baseURL.protocol === "http") {
-      return true;
-    }
-    if (baseURL.protocol === "https") {
-      return false;
-    }
-    return typeof baseURL.fallback === "string" && baseURL.fallback.toLowerCase().startsWith("http://");
-  }
-  return false;
-};
-const hardenAuthOptions = (options) => {
-  if (isWeakSecret(options.secret)) {
-    const message = `@lunora/auth: AUTH_SECRET is only ${String(options.secret?.trim().length)} characters. Use at least ${String(MIN_SECRET_LENGTH)} for a brute-force-resistant secret — generate one with \`openssl rand -hex 32\`.`;
-    if (!isExplicitHttpBaseUrl(options.baseURL)) {
-      throw new LunoraError("INTERNAL", message);
-    }
-    console.warn(message);
-  }
-  const advanced = options.advanced ?? {};
-  return {
-    ...options,
-    advanced: {
-      ...advanced,
-      defaultCookieAttributes: advanced.defaultCookieAttributes ?? { httpOnly: true, path: "/", sameSite: "lax" },
-      ...advanced.useSecureCookies === void 0 ? { useSecureCookies: !isExplicitHttpBaseUrl(options.baseURL) } : {}
-    }
-  };
-};
-const resolveAuthOptions = (options) => {
-  const hardened = hardenAuthOptions(options);
-  const needsRateLimitEnabled = hardened.rateLimit?.enabled === void 0;
-  const needsRateLimitStorage = hardened.rateLimit?.storage === void 0 && hardened.rateLimit?.enabled !== false;
-  return {
-    ...hardened,
-    ...needsRateLimitEnabled || needsRateLimitStorage ? {
-      rateLimit: {
-        ...hardened.rateLimit,
-        ...needsRateLimitEnabled ? { enabled: true } : {},
-        ...needsRateLimitStorage ? { storage: "database" } : {}
-      }
-    } : {},
-    ...hardened.session?.cookieCache === void 0 ? { session: { ...hardened.session, cookieCache: { enabled: true, maxAge: 60 } } } : {}
-  };
-};
-const createAuth = (options) => {
-  if (!options.secret || options.secret.trim() === "") {
-    throw new LunoraError(
-      "INTERNAL",
-      '@lunora/auth: `secret` is required. Set AUTH_SECRET locally in .dev.vars (`lunora env set AUTH_SECRET "$(openssl rand -hex 32)"`), and in production with `wrangler secret put AUTH_SECRET`.'
-    );
-  }
-  if (options.session) {
-    validateSessionPolicy(options.session);
-  }
-  return betterAuth(resolveAuthOptions(options));
-};
-
-export { createAuth, resolveAuthOptions };

package/dist/packem_shared/emailGateDatabaseHooks-BGS4uJM9.mjs

@@ -1,64 +0,0 @@
-import { LunoraError } from '@lunora/errors';
-import { APIError } from 'better-auth/api';
-import { assertEmailAllowed } from '../email-guard.mjs';
-
-const statusString = (status) => {
-  switch (status) {
-    case 400: {
-      return "BAD_REQUEST";
-    }
-    case 422: {
-      return "UNPROCESSABLE_ENTITY";
-    }
-    case 429: {
-      return "TOO_MANY_REQUESTS";
-    }
-    default: {
-      return "INTERNAL_SERVER_ERROR";
-    }
-  }
-};
-const buildBeforeHook = (config) => async (user, context) => {
-  const email = typeof user.email === "string" ? user.email : void 0;
-  if (email === void 0 || email === "") {
-    return;
-  }
-  let classification;
-  try {
-    classification = await assertEmailAllowed(email, config);
-  } catch (error) {
-    if (error instanceof LunoraError) {
-      throw new APIError(statusString(error.status), { code: error.code, message: error.message });
-    }
-    throw error;
-  }
-  config.onClassify?.(classification, user, context);
-};
-const emailGateDatabaseHooks = (config = {}) => {
-  return {
-    user: { create: { before: buildBeforeHook(config) } }
-  };
-};
-const withEmailGate = (options, config = {}) => {
-  const gate = buildBeforeHook(config);
-  const existing = options.databaseHooks?.user?.create?.before;
-  const before = existing ? async (user, context) => {
-    await gate(user, context);
-    return existing(user, context);
-  } : gate;
-  return {
-    ...options,
-    databaseHooks: {
-      ...options.databaseHooks,
-      user: {
-        ...options.databaseHooks?.user,
-        create: {
-          ...options.databaseHooks?.user?.create,
-          before
-        }
-      }
-    }
-  };
-};
-
-export { emailGateDatabaseHooks, withEmailGate };

package/dist/packem_shared/sessionPresets-Dwwd74_J.mjs

@@ -1,38 +0,0 @@
-const MINUTE = 60;
-const HOUR = 60 * MINUTE;
-const DAY = 24 * HOUR;
-const validateSessionPolicy = (policy) => {
-  const durationFields = ["expiresIn", "updateAge", "freshAge"];
-  for (const field of durationFields) {
-    const value = policy[field];
-    if (value === void 0) {
-      continue;
-    }
-    if (typeof value !== "number" || !Number.isFinite(value) || value < 0) {
-      throw new TypeError(`@lunora/auth: \`session.${field}\` must be a non-negative, finite number of seconds`);
-    }
-  }
-  return policy;
-};
-const sessionPresets = {
-  longLived: {
-    cookieCache: { enabled: true, maxAge: 60 },
-    expiresIn: 30 * DAY,
-    freshAge: DAY,
-    updateAge: DAY
-  },
-  rolling: {
-    cookieCache: { enabled: true, maxAge: 60 },
-    expiresIn: 7 * DAY,
-    freshAge: DAY,
-    updateAge: DAY
-  },
-  strict: {
-    cookieCache: { enabled: false },
-    expiresIn: HOUR,
-    freshAge: 5 * MINUTE,
-    updateAge: 15 * MINUTE
-  }
-};
-
-export { sessionPresets, validateSessionPolicy };