@multiplatform.one/auth 7.11.0 → 7.16.0

package/src/index.ts

@@ -311,6 +311,19 @@ function createKeycloakSsoPlugin(options: KeycloakSsoPluginOptions) {
       signOutSso,
     },
     hooks: {
+      before: [
+        {
+          // Signed out is the expected answer on every anonymous page load,
+          // so it is a 200 with no token, as /get-session answers, instead
+          // of a 4xx the browser logs. Runs before body validation, so the
+          // client's body-shape negotiation never 400s for a visitor either.
+          matcher: (ctx) => ctx.path === "/get-access-token",
+          handler: createAuthMiddleware(async (ctx) => {
+            const session = await getSessionFromCtx(ctx).catch(() => null);
+            if (!session) return ctx.json(null);
+          }),
+        },
+      ],
       after: [
         {
           matcher: (ctx) => ctx.path === "/get-access-token",
@@ -392,25 +405,33 @@ function createKeycloakSsoPlugin(options: KeycloakSsoPluginOptions) {
   } satisfies BetterAuthPlugin;
 }
 
+function runtimeEnv(): Record<string, string | undefined> {
+  return typeof process === "undefined" ? {} : process.env;
+}
+
 /**
  * Create a Better Auth instance configured for Keycloak.
  * Keycloak is expected at ${BASE_URL}/auth (proxied by Frappe in dev).
+ *
+ * Settings are read from the env OBJECT when createAuth runs, never as a
+ * static `process.env.<KEY>`: vxrn's build defines that expression for every
+ * key in apps/one/.env, which baked the build machine's Keycloak realm,
+ * client, client secret and SECRET into the deployed server bundle.
  */
 export function createAuth(options: CreateAuthOptions = {}) {
-  const baseUrl =
-    options.baseUrl || process.env.BASE_URL || `http://localhost:${process.env.ONE_PORT || "3000"}`;
+  const env = runtimeEnv();
+  const baseUrl = options.baseUrl || env.BASE_URL || `http://localhost:${env.ONE_PORT || "3000"}`;
   const isProduction = process.env.NODE_ENV === "production";
 
   // In production Keycloak is proxied at /auth by Frappe, so default to ${baseUrl}/auth.
   // In dev (no proxy), use KEYCLOAK_BACKCHANNEL_URL (server-to-server direct address).
   const keycloakBaseUrl =
-    options.keycloak?.baseUrl || process.env.KEYCLOAK_BACKCHANNEL_URL || `${baseUrl}/auth`;
-  const keycloakRealm = options.keycloak?.realm || process.env.KEYCLOAK_REALM || "master";
+    options.keycloak?.baseUrl || env.KEYCLOAK_BACKCHANNEL_URL || `${baseUrl}/auth`;
+  const keycloakRealm = options.keycloak?.realm || env.KEYCLOAK_REALM || "master";
   const issuer = `${keycloakBaseUrl}/realms/${keycloakRealm}`;
 
-  const keycloakClientId = options.keycloak?.clientId || process.env.KEYCLOAK_CLIENT_ID || "";
-  const keycloakClientSecret =
-    options.keycloak?.clientSecret || process.env.KEYCLOAK_CLIENT_SECRET || "";
+  const keycloakClientId = options.keycloak?.clientId || env.KEYCLOAK_CLIENT_ID || "";
+  const keycloakClientSecret = options.keycloak?.clientSecret || env.KEYCLOAK_CLIENT_SECRET || "";
 
   const expoPlugin = options.enableExpo !== false ? expo() : undefined;
 
@@ -567,7 +588,7 @@ export function createAuth(options: CreateAuthOptions = {}) {
 
   // Database for session/account storage.
   // Reads DATABASE_URL env var, or uses an explicit option.
-  const database = options.database ?? (process.env.DATABASE_URL || undefined);
+  const database = options.database ?? (env.DATABASE_URL || undefined);
 
   return betterAuth({
     basePath,
@@ -578,13 +599,13 @@ export function createAuth(options: CreateAuthOptions = {}) {
     // redirectURI getter above + the LAN trustedOrigins below instead.
     baseURL: baseUrl,
     ...(database ? { database } : {}),
-    secret: options.secret || process.env.SECRET || "",
+    secret: options.secret || env.SECRET || "",
     trustedOrigins: options.trustedOrigins || [
       baseUrl,
       keycloakBaseUrl,
       // In dev, ONE_PORT may differ from BASE_URL; ensure the dev server origin is trusted.
-      ...(process.env.ONE_PORT && !baseUrl.includes(`:${process.env.ONE_PORT}`)
-        ? [`http://localhost:${process.env.ONE_PORT}`]
+      ...(env.ONE_PORT && !baseUrl.includes(`:${env.ONE_PORT}`)
+        ? [`http://localhost:${env.ONE_PORT}`]
         : []),
       "multiplatform-one://",
       // Expo Go (dev) receives OAuth returns on the exp:// scheme — the app

package/types/index.d.ts

@@ -57,6 +57,11 @@ export interface AuthLike {
 /**
  * Create a Better Auth instance configured for Keycloak.
  * Keycloak is expected at ${BASE_URL}/auth (proxied by Frappe in dev).
+ *
+ * Settings are read from the env OBJECT when createAuth runs, never as a
+ * static `process.env.<KEY>`: vxrn's build defines that expression for every
+ * key in apps/one/.env, which baked the build machine's Keycloak realm,
+ * client, client secret and SECRET into the deployed server bundle.
  */
 export declare function createAuth(options?: CreateAuthOptions): import("better-auth").Auth<{
     secret: string;

package/types/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAGH,OAAO,EAAE,UAAU,EAAsB,MAAM,aAAa,CAAC;AAc7D,OAAO,EACL,4BAA4B,EAC5B,0BAA0B,EAC1B,yBAAyB,EACzB,2BAA2B,EAC3B,mBAAmB,EACnB,oBAAoB,GACrB,MAAM,sBAAsB,CAAC;AAC9B,YAAY,EAAE,sBAAsB,EAAE,kBAAkB,EAAE,MAAM,sBAAsB,CAAC;AAmDvF,MAAM,WAAW,eAAe;IAC9B,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,YAAY,CAAC,EAAE,MAAM,CAAC;CACvB;AAED,MAAM,WAAW,iBAAiB;IAChC,uDAAuD;IACvD,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,sFAAsF;IACtF,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,yCAAyC;IACzC,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,wEAAwE;IACxE,cAAc,CAAC,EAAE,MAAM,EAAE,CAAC;IAC1B,yDAAyD;IACzD,QAAQ,CAAC,EAAE,eAAe,CAAC;IAC3B,0DAA0D;IAC1D,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,uDAAuD;IACvD,UAAU,CAAC,EAAE,OAAO,CAAC;IACrB,qCAAqC;IACrC,OAAO,CAAC,EAAE,UAAU,CAAC,OAAO,UAAU,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC;IACtD;;;OAGG;IACH,QAAQ,CAAC,EAAE,UAAU,CAAC,OAAO,UAAU,CAAC,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC;CACzD;AAED,kEAAkE;AAClE,MAAM,WAAW,QAAQ;IACvB,OAAO,EAAE,CAAC,OAAO,EAAE,OAAO,KAAK,OAAO,CAAC,QAAQ,CAAC,GAAG,QAAQ,CAAC;IAC5D,GAAG,EAAE;QACH,UAAU,EAAE,CAAC,IAAI,EAAE;YAAE,OAAO,EAAE,OAAO,CAAA;SAAE,KAAK,OAAO,CAAC,OAAO,CAAC,CAAC;KAC9D,CAAC;CACH;AA2QD;;;GAGG;AACH,wBAAgB,UAAU,CAAC,OAAO,GAAE,iBAAsB;;;;;;;;;;;;;;;;;;;GAoNzD;AAED,yCAAyC;AACzC,MAAM,MAAM,YAAY,GAAG,UAAU,CAAC,OAAO,UAAU,CAAC,CAAC;AAIzD;;;;;;;;;;;GAWG;AACH,wBAAgB,sBAAsB,CAAC,IAAI,EAAE,QAAQ;wBAK7B,OAAO;yBAAP,OAAO;EAK9B;AAID;;;;GAIG;AACH,wBAAgB,oBAAoB,CAAC,IAAI,EAAE,QAAQ;sBAOlB,OAAO;sBALP,OAAO;EAcvC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAGH,OAAO,EAAE,UAAU,EAAsB,MAAM,aAAa,CAAC;AAc7D,OAAO,EACL,4BAA4B,EAC5B,0BAA0B,EAC1B,yBAAyB,EACzB,2BAA2B,EAC3B,mBAAmB,EACnB,oBAAoB,GACrB,MAAM,sBAAsB,CAAC;AAC9B,YAAY,EAAE,sBAAsB,EAAE,kBAAkB,EAAE,MAAM,sBAAsB,CAAC;AAmDvF,MAAM,WAAW,eAAe;IAC9B,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,YAAY,CAAC,EAAE,MAAM,CAAC;CACvB;AAED,MAAM,WAAW,iBAAiB;IAChC,uDAAuD;IACvD,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,sFAAsF;IACtF,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,yCAAyC;IACzC,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,wEAAwE;IACxE,cAAc,CAAC,EAAE,MAAM,EAAE,CAAC;IAC1B,yDAAyD;IACzD,QAAQ,CAAC,EAAE,eAAe,CAAC;IAC3B,0DAA0D;IAC1D,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,uDAAuD;IACvD,UAAU,CAAC,EAAE,OAAO,CAAC;IACrB,qCAAqC;IACrC,OAAO,CAAC,EAAE,UAAU,CAAC,OAAO,UAAU,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC;IACtD;;;OAGG;IACH,QAAQ,CAAC,EAAE,UAAU,CAAC,OAAO,UAAU,CAAC,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC;CACzD;AAED,kEAAkE;AAClE,MAAM,WAAW,QAAQ;IACvB,OAAO,EAAE,CAAC,OAAO,EAAE,OAAO,KAAK,OAAO,CAAC,QAAQ,CAAC,GAAG,QAAQ,CAAC;IAC5D,GAAG,EAAE;QACH,UAAU,EAAE,CAAC,IAAI,EAAE;YAAE,OAAO,EAAE,OAAO,CAAA;SAAE,KAAK,OAAO,CAAC,OAAO,CAAC,CAAC;KAC9D,CAAC;CACH;AA4RD;;;;;;;;GAQG;AACH,wBAAgB,UAAU,CAAC,OAAO,GAAE,iBAAsB;;;;;;;;;;;;;;;;;;;GAmNzD;AAED,yCAAyC;AACzC,MAAM,MAAM,YAAY,GAAG,UAAU,CAAC,OAAO,UAAU,CAAC,CAAC;AAIzD;;;;;;;;;;;GAWG;AACH,wBAAgB,sBAAsB,CAAC,IAAI,EAAE,QAAQ;wBAK7B,OAAO;yBAAP,OAAO;EAK9B;AAID;;;;GAIG;AACH,wBAAgB,oBAAoB,CAAC,IAAI,EAAE,QAAQ;sBAOlB,OAAO;sBALP,OAAO;EAcvC"}