@masheev/better-auth 0.0.0-stage → 1.7.5

package/dist/plugins/admin/admin.mjs

@@ -0,0 +1,89 @@
+import { mergeSchema } from "../../db/schema.mjs";
+import { PACKAGE_VERSION } from "../../version.mjs";
+import { defaultRoles } from "./access/statement.mjs";
+import { ADMIN_ERROR_CODES } from "./error-codes.mjs";
+import { getEndpointResponse } from "../../utils/plugin-helper.mjs";
+import { adminUpdateUser, banUser, createUser, getUser, impersonateUser, listUserSessions, listUsers, removeUser, revokeUserSession, revokeUserSessions, setRole, setUserPassword, stopImpersonating, unbanUser, userHasPermission } from "./routes.mjs";
+import { schema } from "./schema.mjs";
+import { APIError, BetterAuthError } from "@better-auth/core/error";
+import { createAuthMiddleware } from "@better-auth/core/api";
+//#region src/plugins/admin/admin.ts
+const admin = (options) => {
+	const opts = {
+		...options || {},
+		defaultRole: options?.defaultRole ?? "user",
+		adminRoles: options?.adminRoles ?? ["admin"],
+		bannedUserMessage: options?.bannedUserMessage ?? "You have been banned from this application. Please contact support if you believe this is an error."
+	};
+	if (options?.adminRoles) {
+		const invalidRoles = (Array.isArray(options.adminRoles) ? options.adminRoles : [...options.adminRoles.split(",")]).filter((role) => !Object.keys(options?.roles || defaultRoles).map((r) => r.toLowerCase()).includes(role.toLowerCase()));
+		if (invalidRoles.length > 0) throw new BetterAuthError(`Invalid admin roles: ${invalidRoles.join(", ")}. Admin roles must be defined in the 'roles' configuration.`);
+	}
+	return {
+		id: "admin",
+		version: PACKAGE_VERSION,
+		init() {
+			return { options: { databaseHooks: {
+				user: { create: { async before(user) {
+					return { data: {
+						role: options?.defaultRole ?? "user",
+						...user
+					} };
+				} } },
+				session: { create: { async before(session, ctx) {
+					if (!ctx) return;
+					const user = await ctx.context.internalAdapter.findUserById(session.userId);
+					if (user?.banned) {
+						if (user.banExpires && new Date(user.banExpires).getTime() < Date.now()) {
+							await ctx.context.internalAdapter.updateUser(session.userId, {
+								banned: false,
+								banReason: null,
+								banExpires: null
+							});
+							return;
+						}
+						throw APIError.from("FORBIDDEN", {
+							message: opts.bannedUserMessage,
+							code: "BANNED_USER"
+						});
+					}
+				} } }
+			} } };
+		},
+		hooks: { after: [{
+			matcher(context) {
+				return context.path === "/list-sessions";
+			},
+			handler: createAuthMiddleware(async (ctx) => {
+				const response = await getEndpointResponse(ctx);
+				if (!response) return;
+				const newJson = response.filter((session) => {
+					return !session.impersonatedBy;
+				});
+				return ctx.json(newJson);
+			})
+		}] },
+		endpoints: {
+			setRole: setRole(opts),
+			getUser: getUser(opts),
+			createUser: createUser(opts),
+			adminUpdateUser: adminUpdateUser(opts),
+			listUsers: listUsers(opts),
+			listUserSessions: listUserSessions(opts),
+			unbanUser: unbanUser(opts),
+			banUser: banUser(opts),
+			impersonateUser: impersonateUser(opts),
+			stopImpersonating: stopImpersonating(),
+			revokeUserSession: revokeUserSession(opts),
+			revokeUserSessions: revokeUserSessions(opts),
+			removeUser: removeUser(opts),
+			setUserPassword: setUserPassword(opts),
+			userHasPermission: userHasPermission(opts)
+		},
+		$ERROR_CODES: ADMIN_ERROR_CODES,
+		schema: mergeSchema(schema, opts.schema),
+		options
+	};
+};
+//#endregion
+export { admin };

package/dist/plugins/admin/client.d.mts

@@ -0,0 +1,81 @@
+import { AccessControl, ArrayElement, Role, Statements } from "../access/types.mjs";
+import { AdminOptions, InferAdminRolesFromOption, SessionWithImpersonatedBy, UserWithRole } from "./types.mjs";
+import { admin } from "./admin.mjs";
+import { ADMIN_ERROR_CODES } from "./error-codes.mjs";
+import * as _$_better_auth_core_utils_error_codes0 from "@better-auth/core/utils/error-codes";
+
+//#region src/plugins/admin/client.d.ts
+interface AdminClientOptions {
+  ac?: AccessControl | undefined;
+  roles?: { [key in string]: Role } | undefined;
+}
+declare const adminClient: <O extends AdminClientOptions>(options?: O | undefined) => {
+  id: "admin-client";
+  version: string;
+  $InferServerPlugin: ReturnType<typeof admin<{
+    ac: O["ac"] extends AccessControl ? O["ac"] : AccessControl<{
+      readonly user: readonly ["create", "list", "set-role", "ban", "impersonate", "impersonate-admins", "delete", "set-password", "set-email", "get", "update"];
+      readonly session: readonly ["list", "revoke", "delete"];
+    }>;
+    roles: O["roles"] extends Record<string, Role> ? O["roles"] : {
+      admin: Role;
+      user: Role;
+    };
+  }>>;
+  getActions: () => {
+    admin: {
+      checkRolePermission: <R extends (O extends {
+        roles: any;
+      } ? keyof O["roles"] : "admin" | "user")>(data: {
+        permissions: { [key in keyof (O["ac"] extends AccessControl<infer S extends Statements> ? S : {
+          readonly user: readonly ["create", "list", "set-role", "ban", "impersonate", "impersonate-admins", "delete", "set-password", "set-email", "get", "update"];
+          readonly session: readonly ["list", "revoke", "delete"];
+        })]?: ((O["ac"] extends AccessControl<infer S extends Statements> ? S : {
+          readonly user: readonly ["create", "list", "set-role", "ban", "impersonate", "impersonate-admins", "delete", "set-password", "set-email", "get", "update"];
+          readonly session: readonly ["list", "revoke", "delete"];
+        })[key] extends readonly unknown[] ? ArrayElement<(O["ac"] extends AccessControl<infer S extends Statements> ? S : {
+          readonly user: readonly ["create", "list", "set-role", "ban", "impersonate", "impersonate-admins", "delete", "set-password", "set-email", "get", "update"];
+          readonly session: readonly ["list", "revoke", "delete"];
+        })[key]> : never)[] | undefined };
+      } & {
+        role: R;
+      }) => boolean;
+    };
+  };
+  pathMethods: {
+    "/admin/list-users": "GET";
+    "/admin/impersonate-user": "POST";
+    "/admin/stop-impersonating": "POST";
+  };
+  atomListeners: {
+    matcher: (path: string) => path is "/admin/impersonate-user" | "/admin/stop-impersonating";
+    signal: "$sessionSignal";
+  }[];
+  $ERROR_CODES: {
+    USER_ALREADY_EXISTS_USE_ANOTHER_EMAIL: _$_better_auth_core_utils_error_codes0.RawError<"USER_ALREADY_EXISTS_USE_ANOTHER_EMAIL">;
+    FAILED_TO_CREATE_USER: _$_better_auth_core_utils_error_codes0.RawError<"FAILED_TO_CREATE_USER">;
+    USER_ALREADY_EXISTS: _$_better_auth_core_utils_error_codes0.RawError<"USER_ALREADY_EXISTS">;
+    YOU_CANNOT_BAN_YOURSELF: _$_better_auth_core_utils_error_codes0.RawError<"YOU_CANNOT_BAN_YOURSELF">;
+    YOU_ARE_NOT_ALLOWED_TO_CHANGE_USERS_ROLE: _$_better_auth_core_utils_error_codes0.RawError<"YOU_ARE_NOT_ALLOWED_TO_CHANGE_USERS_ROLE">;
+    YOU_ARE_NOT_ALLOWED_TO_CREATE_USERS: _$_better_auth_core_utils_error_codes0.RawError<"YOU_ARE_NOT_ALLOWED_TO_CREATE_USERS">;
+    YOU_ARE_NOT_ALLOWED_TO_LIST_USERS: _$_better_auth_core_utils_error_codes0.RawError<"YOU_ARE_NOT_ALLOWED_TO_LIST_USERS">;
+    YOU_ARE_NOT_ALLOWED_TO_LIST_USERS_SESSIONS: _$_better_auth_core_utils_error_codes0.RawError<"YOU_ARE_NOT_ALLOWED_TO_LIST_USERS_SESSIONS">;
+    YOU_ARE_NOT_ALLOWED_TO_BAN_USERS: _$_better_auth_core_utils_error_codes0.RawError<"YOU_ARE_NOT_ALLOWED_TO_BAN_USERS">;
+    YOU_ARE_NOT_ALLOWED_TO_IMPERSONATE_USERS: _$_better_auth_core_utils_error_codes0.RawError<"YOU_ARE_NOT_ALLOWED_TO_IMPERSONATE_USERS">;
+    YOU_ARE_NOT_ALLOWED_TO_REVOKE_USERS_SESSIONS: _$_better_auth_core_utils_error_codes0.RawError<"YOU_ARE_NOT_ALLOWED_TO_REVOKE_USERS_SESSIONS">;
+    YOU_ARE_NOT_ALLOWED_TO_DELETE_USERS: _$_better_auth_core_utils_error_codes0.RawError<"YOU_ARE_NOT_ALLOWED_TO_DELETE_USERS">;
+    YOU_ARE_NOT_ALLOWED_TO_SET_USERS_PASSWORD: _$_better_auth_core_utils_error_codes0.RawError<"YOU_ARE_NOT_ALLOWED_TO_SET_USERS_PASSWORD">;
+    BANNED_USER: _$_better_auth_core_utils_error_codes0.RawError<"BANNED_USER">;
+    YOU_ARE_NOT_ALLOWED_TO_GET_USER: _$_better_auth_core_utils_error_codes0.RawError<"YOU_ARE_NOT_ALLOWED_TO_GET_USER">;
+    NO_DATA_TO_UPDATE: _$_better_auth_core_utils_error_codes0.RawError<"NO_DATA_TO_UPDATE">;
+    YOU_ARE_NOT_ALLOWED_TO_UPDATE_USERS: _$_better_auth_core_utils_error_codes0.RawError<"YOU_ARE_NOT_ALLOWED_TO_UPDATE_USERS">;
+    YOU_CANNOT_REMOVE_YOURSELF: _$_better_auth_core_utils_error_codes0.RawError<"YOU_CANNOT_REMOVE_YOURSELF">;
+    YOU_ARE_NOT_ALLOWED_TO_SET_NON_EXISTENT_VALUE: _$_better_auth_core_utils_error_codes0.RawError<"YOU_ARE_NOT_ALLOWED_TO_SET_NON_EXISTENT_VALUE">;
+    YOU_CANNOT_IMPERSONATE_ADMINS: _$_better_auth_core_utils_error_codes0.RawError<"YOU_CANNOT_IMPERSONATE_ADMINS">;
+    INVALID_ROLE_TYPE: _$_better_auth_core_utils_error_codes0.RawError<"INVALID_ROLE_TYPE">;
+    YOU_ARE_NOT_ALLOWED_TO_SET_USERS_EMAIL: _$_better_auth_core_utils_error_codes0.RawError<"YOU_ARE_NOT_ALLOWED_TO_SET_USERS_EMAIL">;
+    PASSWORD_CANNOT_BE_UPDATED_VIA_UPDATE_USER: _$_better_auth_core_utils_error_codes0.RawError<"PASSWORD_CANNOT_BE_UPDATED_VIA_UPDATE_USER">;
+  };
+};
+//#endregion
+export { AdminClientOptions, adminClient };

package/dist/plugins/admin/client.mjs

@@ -0,0 +1,39 @@
+import { PACKAGE_VERSION } from "../../version.mjs";
+import { adminAc, userAc } from "./access/statement.mjs";
+import { ADMIN_ERROR_CODES } from "./error-codes.mjs";
+import { hasPermission } from "./has-permission.mjs";
+//#region src/plugins/admin/client.ts
+const adminClient = (options) => {
+	const roles = {
+		admin: adminAc,
+		user: userAc,
+		...options?.roles
+	};
+	return {
+		id: "admin-client",
+		version: PACKAGE_VERSION,
+		$InferServerPlugin: {},
+		getActions: () => ({ admin: { checkRolePermission: (data) => {
+			return hasPermission({
+				role: data.role,
+				options: {
+					ac: options?.ac,
+					roles
+				},
+				permissions: data.permissions
+			});
+		} } }),
+		pathMethods: {
+			"/admin/list-users": "GET",
+			"/admin/impersonate-user": "POST",
+			"/admin/stop-impersonating": "POST"
+		},
+		atomListeners: [{
+			matcher: (path) => path === "/admin/impersonate-user" || path === "/admin/stop-impersonating",
+			signal: "$sessionSignal"
+		}],
+		$ERROR_CODES: ADMIN_ERROR_CODES
+	};
+};
+//#endregion
+export { adminClient };

package/dist/plugins/admin/error-codes.d.mts

@@ -0,0 +1,30 @@
+import * as _$_better_auth_core_utils_error_codes0 from "@better-auth/core/utils/error-codes";
+
+//#region src/plugins/admin/error-codes.d.ts
+declare const ADMIN_ERROR_CODES: {
+  USER_ALREADY_EXISTS_USE_ANOTHER_EMAIL: _$_better_auth_core_utils_error_codes0.RawError<"USER_ALREADY_EXISTS_USE_ANOTHER_EMAIL">;
+  FAILED_TO_CREATE_USER: _$_better_auth_core_utils_error_codes0.RawError<"FAILED_TO_CREATE_USER">;
+  USER_ALREADY_EXISTS: _$_better_auth_core_utils_error_codes0.RawError<"USER_ALREADY_EXISTS">;
+  YOU_CANNOT_BAN_YOURSELF: _$_better_auth_core_utils_error_codes0.RawError<"YOU_CANNOT_BAN_YOURSELF">;
+  YOU_ARE_NOT_ALLOWED_TO_CHANGE_USERS_ROLE: _$_better_auth_core_utils_error_codes0.RawError<"YOU_ARE_NOT_ALLOWED_TO_CHANGE_USERS_ROLE">;
+  YOU_ARE_NOT_ALLOWED_TO_CREATE_USERS: _$_better_auth_core_utils_error_codes0.RawError<"YOU_ARE_NOT_ALLOWED_TO_CREATE_USERS">;
+  YOU_ARE_NOT_ALLOWED_TO_LIST_USERS: _$_better_auth_core_utils_error_codes0.RawError<"YOU_ARE_NOT_ALLOWED_TO_LIST_USERS">;
+  YOU_ARE_NOT_ALLOWED_TO_LIST_USERS_SESSIONS: _$_better_auth_core_utils_error_codes0.RawError<"YOU_ARE_NOT_ALLOWED_TO_LIST_USERS_SESSIONS">;
+  YOU_ARE_NOT_ALLOWED_TO_BAN_USERS: _$_better_auth_core_utils_error_codes0.RawError<"YOU_ARE_NOT_ALLOWED_TO_BAN_USERS">;
+  YOU_ARE_NOT_ALLOWED_TO_IMPERSONATE_USERS: _$_better_auth_core_utils_error_codes0.RawError<"YOU_ARE_NOT_ALLOWED_TO_IMPERSONATE_USERS">;
+  YOU_ARE_NOT_ALLOWED_TO_REVOKE_USERS_SESSIONS: _$_better_auth_core_utils_error_codes0.RawError<"YOU_ARE_NOT_ALLOWED_TO_REVOKE_USERS_SESSIONS">;
+  YOU_ARE_NOT_ALLOWED_TO_DELETE_USERS: _$_better_auth_core_utils_error_codes0.RawError<"YOU_ARE_NOT_ALLOWED_TO_DELETE_USERS">;
+  YOU_ARE_NOT_ALLOWED_TO_SET_USERS_PASSWORD: _$_better_auth_core_utils_error_codes0.RawError<"YOU_ARE_NOT_ALLOWED_TO_SET_USERS_PASSWORD">;
+  BANNED_USER: _$_better_auth_core_utils_error_codes0.RawError<"BANNED_USER">;
+  YOU_ARE_NOT_ALLOWED_TO_GET_USER: _$_better_auth_core_utils_error_codes0.RawError<"YOU_ARE_NOT_ALLOWED_TO_GET_USER">;
+  NO_DATA_TO_UPDATE: _$_better_auth_core_utils_error_codes0.RawError<"NO_DATA_TO_UPDATE">;
+  YOU_ARE_NOT_ALLOWED_TO_UPDATE_USERS: _$_better_auth_core_utils_error_codes0.RawError<"YOU_ARE_NOT_ALLOWED_TO_UPDATE_USERS">;
+  YOU_CANNOT_REMOVE_YOURSELF: _$_better_auth_core_utils_error_codes0.RawError<"YOU_CANNOT_REMOVE_YOURSELF">;
+  YOU_ARE_NOT_ALLOWED_TO_SET_NON_EXISTENT_VALUE: _$_better_auth_core_utils_error_codes0.RawError<"YOU_ARE_NOT_ALLOWED_TO_SET_NON_EXISTENT_VALUE">;
+  YOU_CANNOT_IMPERSONATE_ADMINS: _$_better_auth_core_utils_error_codes0.RawError<"YOU_CANNOT_IMPERSONATE_ADMINS">;
+  INVALID_ROLE_TYPE: _$_better_auth_core_utils_error_codes0.RawError<"INVALID_ROLE_TYPE">;
+  YOU_ARE_NOT_ALLOWED_TO_SET_USERS_EMAIL: _$_better_auth_core_utils_error_codes0.RawError<"YOU_ARE_NOT_ALLOWED_TO_SET_USERS_EMAIL">;
+  PASSWORD_CANNOT_BE_UPDATED_VIA_UPDATE_USER: _$_better_auth_core_utils_error_codes0.RawError<"PASSWORD_CANNOT_BE_UPDATED_VIA_UPDATE_USER">;
+};
+//#endregion
+export { ADMIN_ERROR_CODES };

package/dist/plugins/admin/error-codes.mjs

@@ -0,0 +1,29 @@
+import { defineErrorCodes } from "@better-auth/core/utils/error-codes";
+//#region src/plugins/admin/error-codes.ts
+const ADMIN_ERROR_CODES = defineErrorCodes({
+	FAILED_TO_CREATE_USER: "Failed to create user",
+	USER_ALREADY_EXISTS: "User already exists.",
+	USER_ALREADY_EXISTS_USE_ANOTHER_EMAIL: "User already exists. Use another email.",
+	YOU_CANNOT_BAN_YOURSELF: "You cannot ban yourself",
+	YOU_ARE_NOT_ALLOWED_TO_CHANGE_USERS_ROLE: "You are not allowed to change users role",
+	YOU_ARE_NOT_ALLOWED_TO_CREATE_USERS: "You are not allowed to create users",
+	YOU_ARE_NOT_ALLOWED_TO_LIST_USERS: "You are not allowed to list users",
+	YOU_ARE_NOT_ALLOWED_TO_LIST_USERS_SESSIONS: "You are not allowed to list users sessions",
+	YOU_ARE_NOT_ALLOWED_TO_BAN_USERS: "You are not allowed to ban users",
+	YOU_ARE_NOT_ALLOWED_TO_IMPERSONATE_USERS: "You are not allowed to impersonate users",
+	YOU_ARE_NOT_ALLOWED_TO_REVOKE_USERS_SESSIONS: "You are not allowed to revoke users sessions",
+	YOU_ARE_NOT_ALLOWED_TO_DELETE_USERS: "You are not allowed to delete users",
+	YOU_ARE_NOT_ALLOWED_TO_SET_USERS_PASSWORD: "You are not allowed to set users password",
+	BANNED_USER: "You have been banned from this application",
+	YOU_ARE_NOT_ALLOWED_TO_GET_USER: "You are not allowed to get user",
+	NO_DATA_TO_UPDATE: "No data to update",
+	YOU_ARE_NOT_ALLOWED_TO_UPDATE_USERS: "You are not allowed to update users",
+	YOU_CANNOT_REMOVE_YOURSELF: "You cannot remove yourself",
+	YOU_ARE_NOT_ALLOWED_TO_SET_NON_EXISTENT_VALUE: "You are not allowed to set a non-existent role value",
+	YOU_CANNOT_IMPERSONATE_ADMINS: "You cannot impersonate admins",
+	INVALID_ROLE_TYPE: "Invalid role type",
+	YOU_ARE_NOT_ALLOWED_TO_SET_USERS_EMAIL: "You are not allowed to update users email",
+	PASSWORD_CANNOT_BE_UPDATED_VIA_UPDATE_USER: "Password cannot be updated through update-user. Use the set-user-password endpoint instead"
+});
+//#endregion
+export { ADMIN_ERROR_CODES };

package/dist/plugins/admin/has-permission.mjs

@@ -0,0 +1,12 @@
+import { defaultRoles } from "./access/statement.mjs";
+//#region src/plugins/admin/has-permission.ts
+const hasPermission = (input) => {
+	if (input.userId && input.options?.adminUserIds?.includes(input.userId)) return true;
+	if (!input.permissions) return false;
+	const roles = (input.role || input.options?.defaultRole || "user").split(",");
+	const acRoles = input.options?.roles || defaultRoles;
+	for (const role of roles) if ((acRoles[role]?.authorize(input.permissions))?.success) return true;
+	return false;
+};
+//#endregion
+export { hasPermission };

package/dist/plugins/admin/index.d.mts

@@ -0,0 +1,3 @@
+import { AdminOptions, InferAdminRolesFromOption, SessionWithImpersonatedBy, UserWithRole } from "./types.mjs";
+import { admin } from "./admin.mjs";
+export { AdminOptions, InferAdminRolesFromOption, SessionWithImpersonatedBy, UserWithRole, admin };

package/dist/plugins/admin/index.mjs

@@ -0,0 +1,2 @@
+import { admin } from "./admin.mjs";
+export { admin };