@mastra/auth-better-auth 1.1.2-alpha.1 → 1.1.2

package/dist/index.js

@@ -1,4 +1,8 @@
+import { LibsqlDialect } from '@libsql/kysely-libsql';
+import { betterAuth } from 'better-auth';
 import { makeSignature } from 'better-auth/crypto';
+import { getMigrations } from 'better-auth/db/migration';
+import { organization } from 'better-auth/plugins';
 
 // ../../packages/_internal-core/dist/chunk-3M4SEWMI.js
 var RegisteredLogger = {
@@ -152,7 +156,7 @@ var MastraBase = class {
   }
 };
 
-// ../../packages/_internals/auth/dist/chunk-7GLKLOU3.js
+// ../../packages/_internals/auth/dist/chunk-NJOKT6V5.js
 var MastraAuthProvider = class extends MastraBase {
   protected;
   public;
@@ -207,23 +211,253 @@ function mapBetterAuthUserToEEUser(user) {
   };
 }
 var MastraAuthBetterAuth = class extends MastraAuthProvider {
-  auth;
+  #auth;
+  #secret;
+  /** True when `init()` built the instance — then we also own its migrations. */
+  #ownsInstance = false;
+  /** Once-per-process migration latch; reset on failure so a later call retries. */
+  #migrated;
+  /** In-process `userId → orgId` cache so hosts can call `ensureOrganization` per request. */
+  #orgCache = /* @__PURE__ */ new Map();
+  /** Set from `init()`: cross-origin SPA deploys need SameSite=None; Secure cookies. */
+  #crossSite = false;
   signUpEnabledConfig;
-  sessionCookieName;
   constructor(options) {
     super({ name: options?.name ?? "better-auth" });
-    if (!options.auth) {
+    if (!options.auth && !options.secret) {
       throw new Error(
-        "Better Auth instance is required. Please provide the auth option with your Better Auth instance created via betterAuth({ ... })"
+        "Better Auth instance is required. Please provide the auth option with your Better Auth instance created via betterAuth({ ... }), or provide `secret` so the provider can build its own instance in init() on the host database."
       );
     }
-    this.auth = options.auth;
+    this.#auth = options.auth;
+    this.#secret = options.secret;
     this.signUpEnabledConfig = options.signUpEnabled ?? true;
-    const authWithOptions = this.auth;
-    const prefix = authWithOptions.options?.advanced?.cookiePrefix ?? "better-auth";
-    this.sessionCookieName = `${prefix}.session_token`;
     this.registerOptions(options);
   }
+  /**
+   * The active Better Auth instance. Throws before `init()` in deferred
+   * instance mode (constructed with `secret` instead of `auth`).
+   */
+  get auth() {
+    if (!this.#auth) {
+      throw new Error(
+        "MastraAuthBetterAuth is not initialized \u2014 init() must run first (or pass a configured `auth` instance)."
+      );
+    }
+    return this.#auth;
+  }
+  /**
+   * Session cookie name, honoring Better Auth's `cookiePrefix`, a caller
+   * override via `advanced.cookies.session_token.name`, and the `__Secure-`
+   * prefix Better Auth applies when secure cookies are active.
+   */
+  get sessionCookieName() {
+    const options = this.#auth?.options;
+    const advanced = options?.advanced;
+    const prefix = advanced?.cookiePrefix ?? "better-auth";
+    const secure = advanced?.useSecureCookies ?? options?.baseURL?.startsWith("https://") ?? false;
+    const baseName = advanced?.cookies?.session_token?.name ?? `${prefix}.session_token`;
+    return `${secure ? "__Secure-" : ""}${baseName}`;
+  }
+  // ============================================
+  // IAuthInit implementation
+  // ============================================
+  /**
+   * One-time host initialization. In deferred instance mode (no `auth` in the
+   * options) this builds the provider-owned `betterAuth()` instance on the
+   * host's auth database; schema migrations then run lazily behind a
+   * once-per-process latch on first use.
+   *
+   * Bring-your-own `auth` instances skip construction entirely — the caller
+   * owns their database and migrations.
+   */
+  async init(ctx) {
+    this.#crossSite = (ctx.allowedOrigins?.length ?? 0) > 0;
+    if (this.#auth) return;
+    const authDb = ctx.database;
+    if (!authDb) {
+      throw new Error(
+        "MastraAuthBetterAuth needs a database to build its own better-auth instance, but the host passed none. Use a storage backend that exposes an auth database, or pass your own configured `auth` instance."
+      );
+    }
+    const database = authDb.dialect === "postgres" ? authDb.pool : authDb.dialect === "libsql" ? {
+      dialect: new LibsqlDialect({ client: authDb.client }),
+      type: "sqlite"
+    } : authDb.database;
+    const allowedOrigins = ctx.allowedOrigins ?? [];
+    const options = {
+      database,
+      secret: this.#secret,
+      // All provider endpoints (sign-in/up/out/session) live under /auth/api/*,
+      // where hosts mount handleAuthRequest.
+      basePath: "/auth/api",
+      ...ctx.publicUrl ? { baseURL: ctx.publicUrl } : {},
+      // Cross-origin SPA deploys: SameSite=None only lets the browser SEND the
+      // cookie — better-auth still rejects requests from origins outside its
+      // own allow-list, so the SPA origins must be trusted too.
+      ...allowedOrigins.length ? { trustedOrigins: allowedOrigins } : {},
+      emailAndPassword: { enabled: true, disableSignUp: !this.signUpEnabledConfig },
+      plugins: [organization()],
+      // Cross-origin SPA deploys need SameSite=None; Secure for the browser to
+      // send the session cookie.
+      ...this.#crossSite ? { advanced: { defaultCookieAttributes: { sameSite: "none", secure: true } } } : {}
+    };
+    this.#auth = betterAuth(options);
+    this.#ownsInstance = true;
+  }
+  /**
+   * Ensure better-auth's tables exist in the host database. Only for instances
+   * this provider built — bring-your-own instances manage their own migrations.
+   */
+  async #ensureDbReady() {
+    if (!this.#ownsInstance) return;
+    this.#migrated ??= (async () => {
+      const { runMigrations } = await getMigrations(this.auth.options);
+      await runMigrations();
+    })();
+    try {
+      await this.#migrated;
+    } catch (error) {
+      this.#migrated = void 0;
+      console.warn("[BetterAuth] Failed to run auth schema migrations; auth stays unavailable until this succeeds.");
+      throw error;
+    }
+  }
+  // ============================================
+  // IAuthHttpHandler implementation
+  // ============================================
+  /**
+   * Proxy a raw HTTP request to Better Auth's own API surface
+   * (sign-in/up/out/session). Hosts mount this under `/auth/api/*`.
+   */
+  async handleAuthRequest(request) {
+    try {
+      await this.#ensureDbReady();
+    } catch {
+      return new Response(JSON.stringify({ error: "auth_unavailable" }), {
+        status: 503,
+        headers: { "content-type": "application/json" }
+      });
+    }
+    return this.auth.handler(request);
+  }
+  // ============================================
+  // IOrganizationsProvider implementation
+  // ============================================
+  /**
+   * Ensure the user belongs to an organization, mirroring the WorkOS
+   * personal-org bootstrap on better-auth's organization tables:
+   * ≥1 membership → first org id; 0 → create a personal org with an
+   * idempotent slug derived from the user id.
+   *
+   * Concurrent/retried first logins recover via the unique slug instead of
+   * creating duplicates. Slug alone is NOT proof of ownership though: the
+   * organization API is reachable by any authenticated user, so an attacker
+   * could squat `personal-<victimId>`. The slug-matched org is only adopted
+   * when nobody else is a member; otherwise a fresh org with an unguessable
+   * slug is created instead.
+   *
+   * Best-effort: any failure is swallowed and leaves the user no-org.
+   */
+  async ensureOrganization(userId) {
+    const cached = this.#orgCache.get(userId);
+    if (cached) return cached;
+    try {
+      await this.#ensureDbReady();
+      const ctx = await this.getAuthContext();
+      if (!ctx) return void 0;
+      const memberships = await ctx.adapter.findMany({
+        model: "member",
+        where: [{ field: "userId", value: userId }]
+      });
+      const firstExisting = memberships.find((m) => m.organizationId)?.organizationId;
+      if (firstExisting) {
+        this.#orgCache.set(userId, firstExisting);
+        return firstExisting;
+      }
+      const userRecord = await ctx.internalAdapter.findUserById(userId).catch(() => null);
+      const label = userRecord?.email ?? userRecord?.name ?? userId;
+      const orgName = `${label}'s org`;
+      const orgData = () => ({
+        name: orgName,
+        createdAt: /* @__PURE__ */ new Date(),
+        metadata: JSON.stringify({ mastraPersonalOrg: "true" })
+      });
+      const slug = `personal-${userId}`;
+      let organizationId;
+      try {
+        const created = await ctx.adapter.create({
+          model: "organization",
+          data: { ...orgData(), slug }
+        });
+        organizationId = created.id;
+      } catch (error) {
+        const existing = await ctx.adapter.findOne({
+          model: "organization",
+          where: [{ field: "slug", value: slug }]
+        });
+        if (!existing) throw error;
+        const existingMembers = await ctx.adapter.findMany({
+          model: "member",
+          where: [{ field: "organizationId", value: existing.id }]
+        });
+        const foreignMember = existingMembers.some((m) => m.userId !== userId);
+        if (foreignMember) {
+          const fallback = await ctx.adapter.create({
+            model: "organization",
+            data: { ...orgData(), slug: `personal-${userId}-${crypto.randomUUID()}` }
+          });
+          organizationId = fallback.id;
+        } else {
+          organizationId = existing.id;
+        }
+      }
+      try {
+        await ctx.adapter.create({
+          model: "member",
+          data: { organizationId, userId, role: "owner", createdAt: /* @__PURE__ */ new Date() }
+        });
+      } catch (error) {
+        const member = await ctx.adapter.findOne({
+          model: "member",
+          where: [
+            { field: "organizationId", value: organizationId },
+            { field: "userId", value: userId }
+          ]
+        });
+        if (!member) throw error;
+      }
+      this.#orgCache.set(userId, organizationId);
+      return organizationId;
+    } catch (error) {
+      console.warn(
+        `[BetterAuth] Failed to bootstrap personal organization for user ${userId}. The user will see organization_required until this succeeds.`,
+        error
+      );
+      return void 0;
+    }
+  }
+  /**
+   * Whether the user holds an admin-equivalent role (`owner` or `admin`) in
+   * the organization. Provider errors resolve to `false`.
+   */
+  async isOrganizationAdmin(organizationId, userId) {
+    try {
+      await this.#ensureDbReady();
+      const ctx = await this.getAuthContext();
+      if (!ctx) return false;
+      const membership = await ctx.adapter.findOne({
+        model: "member",
+        where: [
+          { field: "organizationId", value: organizationId },
+          { field: "userId", value: userId }
+        ]
+      });
+      return membership?.role === "owner" || membership?.role === "admin";
+    } catch {
+      return false;
+    }
+  }
   /**
    * Check if sign-up is enabled.
    * Implements ICredentialsProvider.isSignUpEnabled.
@@ -247,6 +481,7 @@ var MastraAuthBetterAuth = class extends MastraAuthProvider {
    */
   async getCurrentUser(request) {
     try {
+      await this.#ensureDbReady();
       const headers = new Headers(request.headers);
       const authHeader = headers.get("Authorization");
       const bearerToken = authHeader && authHeader.slice(0, 7).toLowerCase() === "bearer " ? authHeader.slice(7).trim() : void 0;
@@ -350,6 +585,7 @@ var MastraAuthBetterAuth = class extends MastraAuthProvider {
    */
   async authenticateToken(token, request) {
     try {
+      await this.#ensureDbReady();
       const headers = new Headers();
       const cookieHeader = getRequestHeader2(request, "Cookie");
       if (cookieHeader) {
@@ -475,9 +711,10 @@ var MastraAuthBetterAuth = class extends MastraAuthProvider {
    * Clears Better Auth's default session cookies.
    */
   getClearSessionHeaders() {
+    const sameSite = this.#crossSite ? "None; Secure" : "Lax";
     const cookies = [
-      `${this.sessionCookieName}=; Path=/; HttpOnly; SameSite=Lax; Max-Age=0`,
-      `${this.sessionCookieName}_sig=; Path=/; HttpOnly; SameSite=Lax; Max-Age=0`
+      `${this.sessionCookieName}=; Path=/; HttpOnly; SameSite=${sameSite}; Max-Age=0`,
+      `${this.sessionCookieName}_sig=; Path=/; HttpOnly; SameSite=${sameSite}; Max-Age=0`
     ];
     return {
       "Set-Cookie": cookies.join(", ")