@mastra/auth-better-auth 1.1.2-alpha.0 → 1.1.2-alpha.2

package/dist/index.js

@@ -1,3 +1,9 @@
+import { LibsqlDialect } from '@libsql/kysely-libsql';
+import { betterAuth } from 'better-auth';
+import { makeSignature } from 'better-auth/crypto';
+import { getMigrations } from 'better-auth/db/migration';
+import { organization } from 'better-auth/plugins';
+
 // ../../packages/_internal-core/dist/chunk-3M4SEWMI.js
 var RegisteredLogger = {
   LLM: "LLM"};
@@ -150,7 +156,7 @@ var MastraBase = class {
   }
 };
 
-// ../../packages/_internals/auth/dist/chunk-7GLKLOU3.js
+// ../../packages/_internals/auth/dist/chunk-NJOKT6V5.js
 var MastraAuthProvider = class extends MastraBase {
   protected;
   public;
@@ -178,8 +184,13 @@ var MastraAuthProvider = class extends MastraBase {
     }
   }
 };
-
-// src/index.ts
+function tryDecode(value) {
+  try {
+    return decodeURIComponent(value);
+  } catch {
+    return value;
+  }
+}
 function getRequestHeader2(request, name) {
   if (request instanceof Request) {
     return request.headers.get(name);
@@ -200,23 +211,253 @@ function mapBetterAuthUserToEEUser(user) {
   };
 }
 var MastraAuthBetterAuth = class extends MastraAuthProvider {
-  auth;
+  #auth;
+  #secret;
+  /** True when `init()` built the instance — then we also own its migrations. */
+  #ownsInstance = false;
+  /** Once-per-process migration latch; reset on failure so a later call retries. */
+  #migrated;
+  /** In-process `userId → orgId` cache so hosts can call `ensureOrganization` per request. */
+  #orgCache = /* @__PURE__ */ new Map();
+  /** Set from `init()`: cross-origin SPA deploys need SameSite=None; Secure cookies. */
+  #crossSite = false;
   signUpEnabledConfig;
-  sessionCookieName;
   constructor(options) {
     super({ name: options?.name ?? "better-auth" });
-    if (!options.auth) {
+    if (!options.auth && !options.secret) {
       throw new Error(
-        "Better Auth instance is required. Please provide the auth option with your Better Auth instance created via betterAuth({ ... })"
+        "Better Auth instance is required. Please provide the auth option with your Better Auth instance created via betterAuth({ ... }), or provide `secret` so the provider can build its own instance in init() on the host database."
       );
     }
-    this.auth = options.auth;
+    this.#auth = options.auth;
+    this.#secret = options.secret;
     this.signUpEnabledConfig = options.signUpEnabled ?? true;
-    const authWithOptions = this.auth;
-    const prefix = authWithOptions.options?.advanced?.cookiePrefix ?? "better-auth";
-    this.sessionCookieName = `${prefix}.session_token`;
     this.registerOptions(options);
   }
+  /**
+   * The active Better Auth instance. Throws before `init()` in deferred
+   * instance mode (constructed with `secret` instead of `auth`).
+   */
+  get auth() {
+    if (!this.#auth) {
+      throw new Error(
+        "MastraAuthBetterAuth is not initialized \u2014 init() must run first (or pass a configured `auth` instance)."
+      );
+    }
+    return this.#auth;
+  }
+  /**
+   * Session cookie name, honoring Better Auth's `cookiePrefix`, a caller
+   * override via `advanced.cookies.session_token.name`, and the `__Secure-`
+   * prefix Better Auth applies when secure cookies are active.
+   */
+  get sessionCookieName() {
+    const options = this.#auth?.options;
+    const advanced = options?.advanced;
+    const prefix = advanced?.cookiePrefix ?? "better-auth";
+    const secure = advanced?.useSecureCookies ?? options?.baseURL?.startsWith("https://") ?? false;
+    const baseName = advanced?.cookies?.session_token?.name ?? `${prefix}.session_token`;
+    return `${secure ? "__Secure-" : ""}${baseName}`;
+  }
+  // ============================================
+  // IAuthInit implementation
+  // ============================================
+  /**
+   * One-time host initialization. In deferred instance mode (no `auth` in the
+   * options) this builds the provider-owned `betterAuth()` instance on the
+   * host's auth database; schema migrations then run lazily behind a
+   * once-per-process latch on first use.
+   *
+   * Bring-your-own `auth` instances skip construction entirely — the caller
+   * owns their database and migrations.
+   */
+  async init(ctx) {
+    this.#crossSite = (ctx.allowedOrigins?.length ?? 0) > 0;
+    if (this.#auth) return;
+    const authDb = ctx.database;
+    if (!authDb) {
+      throw new Error(
+        "MastraAuthBetterAuth needs a database to build its own better-auth instance, but the host passed none. Use a storage backend that exposes an auth database, or pass your own configured `auth` instance."
+      );
+    }
+    const database = authDb.dialect === "postgres" ? authDb.pool : authDb.dialect === "libsql" ? {
+      dialect: new LibsqlDialect({ client: authDb.client }),
+      type: "sqlite"
+    } : authDb.database;
+    const allowedOrigins = ctx.allowedOrigins ?? [];
+    const options = {
+      database,
+      secret: this.#secret,
+      // All provider endpoints (sign-in/up/out/session) live under /auth/api/*,
+      // where hosts mount handleAuthRequest.
+      basePath: "/auth/api",
+      ...ctx.publicUrl ? { baseURL: ctx.publicUrl } : {},
+      // Cross-origin SPA deploys: SameSite=None only lets the browser SEND the
+      // cookie — better-auth still rejects requests from origins outside its
+      // own allow-list, so the SPA origins must be trusted too.
+      ...allowedOrigins.length ? { trustedOrigins: allowedOrigins } : {},
+      emailAndPassword: { enabled: true, disableSignUp: !this.signUpEnabledConfig },
+      plugins: [organization()],
+      // Cross-origin SPA deploys need SameSite=None; Secure for the browser to
+      // send the session cookie.
+      ...this.#crossSite ? { advanced: { defaultCookieAttributes: { sameSite: "none", secure: true } } } : {}
+    };
+    this.#auth = betterAuth(options);
+    this.#ownsInstance = true;
+  }
+  /**
+   * Ensure better-auth's tables exist in the host database. Only for instances
+   * this provider built — bring-your-own instances manage their own migrations.
+   */
+  async #ensureDbReady() {
+    if (!this.#ownsInstance) return;
+    this.#migrated ??= (async () => {
+      const { runMigrations } = await getMigrations(this.auth.options);
+      await runMigrations();
+    })();
+    try {
+      await this.#migrated;
+    } catch (error) {
+      this.#migrated = void 0;
+      console.warn("[BetterAuth] Failed to run auth schema migrations; auth stays unavailable until this succeeds.");
+      throw error;
+    }
+  }
+  // ============================================
+  // IAuthHttpHandler implementation
+  // ============================================
+  /**
+   * Proxy a raw HTTP request to Better Auth's own API surface
+   * (sign-in/up/out/session). Hosts mount this under `/auth/api/*`.
+   */
+  async handleAuthRequest(request) {
+    try {
+      await this.#ensureDbReady();
+    } catch {
+      return new Response(JSON.stringify({ error: "auth_unavailable" }), {
+        status: 503,
+        headers: { "content-type": "application/json" }
+      });
+    }
+    return this.auth.handler(request);
+  }
+  // ============================================
+  // IOrganizationsProvider implementation
+  // ============================================
+  /**
+   * Ensure the user belongs to an organization, mirroring the WorkOS
+   * personal-org bootstrap on better-auth's organization tables:
+   * ≥1 membership → first org id; 0 → create a personal org with an
+   * idempotent slug derived from the user id.
+   *
+   * Concurrent/retried first logins recover via the unique slug instead of
+   * creating duplicates. Slug alone is NOT proof of ownership though: the
+   * organization API is reachable by any authenticated user, so an attacker
+   * could squat `personal-<victimId>`. The slug-matched org is only adopted
+   * when nobody else is a member; otherwise a fresh org with an unguessable
+   * slug is created instead.
+   *
+   * Best-effort: any failure is swallowed and leaves the user no-org.
+   */
+  async ensureOrganization(userId) {
+    const cached = this.#orgCache.get(userId);
+    if (cached) return cached;
+    try {
+      await this.#ensureDbReady();
+      const ctx = await this.getAuthContext();
+      if (!ctx) return void 0;
+      const memberships = await ctx.adapter.findMany({
+        model: "member",
+        where: [{ field: "userId", value: userId }]
+      });
+      const firstExisting = memberships.find((m) => m.organizationId)?.organizationId;
+      if (firstExisting) {
+        this.#orgCache.set(userId, firstExisting);
+        return firstExisting;
+      }
+      const userRecord = await ctx.internalAdapter.findUserById(userId).catch(() => null);
+      const label = userRecord?.email ?? userRecord?.name ?? userId;
+      const orgName = `${label}'s org`;
+      const orgData = () => ({
+        name: orgName,
+        createdAt: /* @__PURE__ */ new Date(),
+        metadata: JSON.stringify({ mastraPersonalOrg: "true" })
+      });
+      const slug = `personal-${userId}`;
+      let organizationId;
+      try {
+        const created = await ctx.adapter.create({
+          model: "organization",
+          data: { ...orgData(), slug }
+        });
+        organizationId = created.id;
+      } catch (error) {
+        const existing = await ctx.adapter.findOne({
+          model: "organization",
+          where: [{ field: "slug", value: slug }]
+        });
+        if (!existing) throw error;
+        const existingMembers = await ctx.adapter.findMany({
+          model: "member",
+          where: [{ field: "organizationId", value: existing.id }]
+        });
+        const foreignMember = existingMembers.some((m) => m.userId !== userId);
+        if (foreignMember) {
+          const fallback = await ctx.adapter.create({
+            model: "organization",
+            data: { ...orgData(), slug: `personal-${userId}-${crypto.randomUUID()}` }
+          });
+          organizationId = fallback.id;
+        } else {
+          organizationId = existing.id;
+        }
+      }
+      try {
+        await ctx.adapter.create({
+          model: "member",
+          data: { organizationId, userId, role: "owner", createdAt: /* @__PURE__ */ new Date() }
+        });
+      } catch (error) {
+        const member = await ctx.adapter.findOne({
+          model: "member",
+          where: [
+            { field: "organizationId", value: organizationId },
+            { field: "userId", value: userId }
+          ]
+        });
+        if (!member) throw error;
+      }
+      this.#orgCache.set(userId, organizationId);
+      return organizationId;
+    } catch (error) {
+      console.warn(
+        `[BetterAuth] Failed to bootstrap personal organization for user ${userId}. The user will see organization_required until this succeeds.`,
+        error
+      );
+      return void 0;
+    }
+  }
+  /**
+   * Whether the user holds an admin-equivalent role (`owner` or `admin`) in
+   * the organization. Provider errors resolve to `false`.
+   */
+  async isOrganizationAdmin(organizationId, userId) {
+    try {
+      await this.#ensureDbReady();
+      const ctx = await this.getAuthContext();
+      if (!ctx) return false;
+      const membership = await ctx.adapter.findOne({
+        model: "member",
+        where: [
+          { field: "organizationId", value: organizationId },
+          { field: "userId", value: userId }
+        ]
+      });
+      return membership?.role === "owner" || membership?.role === "admin";
+    } catch {
+      return false;
+    }
+  }
   /**
    * Check if sign-up is enabled.
    * Implements ICredentialsProvider.isSignUpEnabled.
@@ -232,13 +473,21 @@ var MastraAuthBetterAuth = class extends MastraAuthProvider {
    * Get current user from request.
    * Implements IUserProvider for EE user awareness in Studio.
    *
+   * Supports both cookie-based sessions and `Authorization: Bearer <token>`
+   * requests (e.g. API clients using the token returned by `signIn`).
+   *
    * @param request - Incoming HTTP request
    * @returns EE User object or null if not authenticated
    */
   async getCurrentUser(request) {
     try {
+      await this.#ensureDbReady();
+      const headers = new Headers(request.headers);
+      const authHeader = headers.get("Authorization");
+      const bearerToken = authHeader && authHeader.slice(0, 7).toLowerCase() === "bearer " ? authHeader.slice(7).trim() : void 0;
+      await this.ensureSessionCookie(headers, bearerToken);
       const result = await this.auth.api.getSession({
-        headers: request.headers
+        headers
       });
       if (!result?.user) return null;
       return mapBetterAuthUserToEEUser(result.user);
@@ -250,18 +499,32 @@ var MastraAuthBetterAuth = class extends MastraAuthProvider {
    * Get user by ID.
    * Implements IUserProvider for EE user awareness.
    *
-   * Note: Better Auth doesn't expose a direct getUser API.
-   * For full functionality, you may need to implement this using
-   * direct database access in a subclass.
+   * Uses Better Auth's internal adapter to look up the user record,
+   * so it works with whichever database Better Auth is configured with.
    *
    * @param userId - User identifier
    * @returns EE User object or null if not found
    */
-  async getUser(_userId) {
-    console.warn(
-      "[MastraAuthBetterAuth] getUser() requires direct database access. Override this method in a subclass for full user lookup support."
-    );
-    return null;
+  async getUser(userId) {
+    try {
+      const ctx = await this.getAuthContext();
+      if (!ctx) return null;
+      const user = await ctx.internalAdapter.findUserById(userId);
+      if (!user) return null;
+      return mapBetterAuthUserToEEUser(user);
+    } catch {
+      return null;
+    }
+  }
+  /**
+   * Get multiple users by ID.
+   * Optional IUserProvider method used for batch author enrichment.
+   *
+   * @param userIds - User identifiers
+   * @returns EE User objects (null for missing users, order preserved)
+   */
+  async getUsers(userIds) {
+    return Promise.all(userIds.map((userId) => this.getUser(userId)));
   }
   /**
    * Get URL to user's profile page.
@@ -270,11 +533,51 @@ var MastraAuthBetterAuth = class extends MastraAuthProvider {
   getUserProfileUrl(user) {
     return `/profile/${user.id}`;
   }
+  /**
+   * Get the resolved Better Auth context, or null when unavailable
+   * (e.g. a partial mock without `$context`).
+   */
+  async getAuthContext() {
+    try {
+      return await Promise.resolve(this.auth.$context) ?? null;
+    } catch {
+      return null;
+    }
+  }
+  /**
+   * Ensure the Cookie header on `headers` carries a Better Auth session cookie
+   * for the given token.
+   *
+   * Better Auth's `getSession` reads the session from a *signed* cookie
+   * (`<token>.<HMAC-SHA256 signature>`), while `signIn`/`signUp` return the
+   * raw unsigned token. Mirroring Better Auth's bearer plugin, unsigned tokens
+   * are signed with the instance secret before being set as the session cookie.
+   */
+  async ensureSessionCookie(headers, token) {
+    if (!token) return;
+    const ctx = await this.getAuthContext();
+    const cookieName = ctx?.authCookies.sessionToken.name ?? this.sessionCookieName;
+    const secret = ctx?.secret;
+    const cookieHeader = headers.get("Cookie");
+    const hasSessionCookie = !!cookieHeader?.split(";").some((pair) => {
+      const [key] = pair.trim().split("=");
+      return key?.trim() === cookieName;
+    });
+    if (hasSessionCookie) return;
+    let cookieValue = token.includes(".") ? token.includes("%") ? tryDecode(token) : token : token;
+    if (!token.includes(".") && secret) {
+      cookieValue = `${token}.${await makeSignature(token, secret)}`;
+    }
+    const existingCookies = cookieHeader ? `${cookieHeader}; ` : "";
+    headers.set("Cookie", `${existingCookies}${cookieName}=${encodeURIComponent(cookieValue)}`);
+  }
   /**
    * Authenticate a bearer token by verifying the session with Better Auth.
    *
    * This method extracts the session from the request headers using
-   * Better Auth's `api.getSession()` endpoint.
+   * Better Auth's `api.getSession()` endpoint. Raw (unsigned) session tokens —
+   * as returned by `signIn`/`signUp` — are signed before being passed to
+   * Better Auth as a session cookie, matching the bearer plugin's semantics.
    *
    * @param token - The bearer token (session token) to authenticate
    * @param request - The request containing headers
@@ -282,19 +585,13 @@ var MastraAuthBetterAuth = class extends MastraAuthProvider {
    */
   async authenticateToken(token, request) {
     try {
+      await this.#ensureDbReady();
       const headers = new Headers();
       const cookieHeader = getRequestHeader2(request, "Cookie");
       if (cookieHeader) {
         headers.set("Cookie", cookieHeader);
       }
-      const hasSessionCookie = !!cookieHeader?.split(";").some((pair) => {
-        const [key] = pair.trim().split("=");
-        return key?.trim() === this.sessionCookieName;
-      });
-      if (token && !hasSessionCookie) {
-        const existingCookies = cookieHeader ? `${cookieHeader}; ` : "";
-        headers.set("Cookie", `${existingCookies}${this.sessionCookieName}=${token}`);
-      }
+      await this.ensureSessionCookie(headers, token);
       const result = await this.auth.api.getSession({
         headers
       });
@@ -414,9 +711,10 @@ var MastraAuthBetterAuth = class extends MastraAuthProvider {
    * Clears Better Auth's default session cookies.
    */
   getClearSessionHeaders() {
+    const sameSite = this.#crossSite ? "None; Secure" : "Lax";
     const cookies = [
-      `${this.sessionCookieName}=; Path=/; HttpOnly; SameSite=Lax; Max-Age=0`,
-      `${this.sessionCookieName}_sig=; Path=/; HttpOnly; SameSite=Lax; Max-Age=0`
+      `${this.sessionCookieName}=; Path=/; HttpOnly; SameSite=${sameSite}; Max-Age=0`,
+      `${this.sessionCookieName}_sig=; Path=/; HttpOnly; SameSite=${sameSite}; Max-Age=0`
     ];
     return {
       "Set-Cookie": cookies.join(", ")