@nano-app/backend 0.12.5 → 0.14.0

package/README.md

@@ -87,7 +87,7 @@ Every option is optional.
 | `mainPlugin` | `{ routesDir: "src/routes" }` | Your routes (`routesDir`, relative to `cwd`), `basePath` (e.g. `/api`, no trailing slash) and database: see [Database](#database). |
 | `plugins` | `[]` | Plugins mounted around your routes, in order: see [Plugins](#plugins). |
 
-`packages` accepts `morgan`, `cors`, `helmet`, `compression`, `express` (`express.json` options), `urlencoded` and `betterAuth` (off by default: see [Better Auth](#better-auth)). The merge is **per section**: passing one key keeps the others; pass `false` to disable one.
+`packages` accepts `morgan`, `cors`, `helmet`, `compression`, `express` (`express.json` options) and `urlencoded`. The merge is **per section**: passing one key keeps the others; pass `false` to disable one.
 
 `morgan` logs `:timestamp | :method :path :status` by default: `:path` is the path without its query string, so tokens sent there stay out of the logs. Set `format` with `:url` to log the full URL.
 
@@ -166,39 +166,36 @@ export default createRoute<PrismaClient>({
 
 ## Better Auth
 
-Users, sign-in and sessions with [Better Auth](https://www.better-auth.com), on your database. Off until `packages.betterAuth` gets its options (everything but `database`: nano-app passes your Prisma client).
+Users, sign-in and sessions with [Better Auth](https://www.better-auth.com), on your database. On when your app has `src/auth.ts` (or the built `src/auth.js`), relative to `cwd`: its default export holds the options in `options` (everything but `database`: nano-app passes your Prisma client). Without the file it stays off.
 
 ```bash
 pnpm add better-auth
 ```
 
 ```ts
-// src/auth.ts: the options, and an instance only for the Better Auth CLI
-import { betterAuth, type BetterAuthOptions } from 'better-auth';
+// src/auth.ts: nano-app and the Better Auth CLI read `options`
+import type { BetterAuthOptions } from 'better-auth';
 
-export const authOptions = { emailAndPassword: { enabled: true } } satisfies BetterAuthOptions;
-export const auth = betterAuth(authOptions);
+export default {
+  options: { emailAndPassword: { enabled: true } } satisfies BetterAuthOptions,
+};
 ```
 
 ```ts
 // src/app.ts
 import { createNanoApp } from '@nano-app/backend';
-import { authOptions } from './auth';
 
-createNanoApp({
-  packages: { betterAuth: authOptions },
-  mainPlugin: { database: { enabled: true } },
-});
+createNanoApp({ mainPlugin: { database: { enabled: true } } });
 ```
 
 Its tables are yours, like the rest of your schema. Add its models with its CLI, then apply them with Prisma; run both again when you change the options:
 
 ```bash
-npx auth generate --config src/auth.ts --adapter prisma --dialect postgresql --output src/prisma/schema.prisma
+npx auth generate --adapter prisma --dialect postgresql --output src/prisma/schema.prisma
 npx prisma migrate dev
 ```
 
-- It needs the database: `packages.betterAuth` without `mainPlugin.database.enabled` fails at startup.
+- It needs the database: `src/auth.ts` without `mainPlugin.database.enabled` fails at startup, and so does a file without `options`.
 - Startup also fails if your schema lacks a model the options need (`user`, `session`, ...), naming them.
 - Its endpoints are mounted with your routes, at its `basePath` (default `/api/auth`), and stay public.
 - In production, Better Auth limits sign-in, sign-up and password reset to a few attempts per client IP (its `rateLimit`): see [Client IP](#client-ip).
@@ -212,6 +209,8 @@ npx prisma migrate dev
 - `createRoute({ public: true, ... })` answers without a session; its handlers still receive `session` when the request has one. An unknown path answers 404.
 - Its own endpoints, the plugins mounted before the app and the middlewares a plugin adds with `app.use` in `onMount` are not checked: a plugin that exposes something public says it in its README.
 - Better Auth is loaded only when it is on.
+- Before 0.14.0 the options went in `packages.betterAuth`: move them to the default export of `src/auth.ts`.
+- nano-app creates the one instance the app uses: do not call `betterAuth()` in `src/auth.ts`. The CLI's `generate` only reads `options` of its default export.
 
 ### Permissions
 

package/build/index.d.ts

@@ -2,7 +2,7 @@ import express, { Express, Request, Request as Request$1 } from "express";
 import { CorsOptions } from "cors";
 import "dotenv/config";
 import "jiti";
-import { BetterAuthOptions } from "better-auth";
+import "better-auth";
 /** API response */
 type ApiResponse<T = any> = {
   status?: number;
@@ -142,8 +142,6 @@ type PackagesConfig = {
   express?: Partial<Parameters<typeof express.json>[0]> | false;
   /** urlencoded configuration */
   urlencoded?: Partial<Parameters<typeof express.urlencoded>[0]> | false;
-  /** Better Auth options, without `database`: it uses the app's Prisma client. Defaults to false */
-  betterAuth?: Omit<BetterAuthOptions, 'database'> | false;
 };
 /** Application configuration */
 type NanoAppConfig = {

package/build/index.js

@@ -5,9 +5,9 @@ import cors from "cors";
 import helmet from "helmet";
 import compression from "compression";
 import "dotenv/config";
+import { existsSync, mkdirSync, readFileSync, writeFileSync } from "node:fs";
 import { glob } from "glob";
 import { dirname, isAbsolute, join, resolve } from "node:path";
-import { existsSync, mkdirSync, readFileSync, writeFileSync } from "node:fs";
 import { createJiti } from "jiti";
 import { execFileSync } from "node:child_process";
 import { createHash } from "node:crypto";
@@ -165,6 +165,57 @@ var FileLoader = class {
 		return Validator.validate(oEntries, extension);
 	}
 };
+// src/auth/BetterAuth.ts
+/** Files of the app's Better Auth options, relative to `cwd`: source, then built */
+const AUTH_FILES = ["src/auth.ts", "src/auth.js"];
+/** Better Auth on the app's Prisma client: the instance, its handler and the session lookup */
+var BetterAuth = class {
+	static oAuth;
+	/** The options of the app's `src/auth.ts`, or undefined without it: Better Auth stays off */
+	static async findOptions() {
+		const sFilePath = AUTH_FILES.find(existsSync);
+		if (!sFilePath) return void 0;
+		const oFile = await FileReader.loadModule(sFilePath, { default: true });
+		if (!oFile?.options) throw new Error(`[nano-app] [ERROR] ${sFilePath} must default export { options }: the Better Auth options.`);
+		return oFile.options;
+	}
+	/** The instance, once the app's plugin created it */
+	static get() {
+		return this.oAuth;
+	}
+	/** Creates the instance on the app's client, its handler and the session lookup */
+	static async create(oOptions, oDb) {
+		const { betterAuth } = await import("better-auth");
+		const { prismaAdapter } = await import("better-auth/adapters/prisma");
+		const { getSchema } = await import("better-auth/db");
+		const { fromNodeHeaders, toNodeHandler } = await import("better-auth/node");
+		const aMissing = Object.keys(getSchema(oOptions)).filter((sModel) => !oDb[sModel]);
+		if (aMissing.length) throw new Error(`[nano-app] [ERROR] Better Auth needs the models ${aMissing.join(", ")} in the app's schema. Run \`npx auth generate\` and apply your schema with Prisma.`);
+		const oAuth = betterAuth({
+			...oOptions,
+			advanced: {
+				...oOptions.advanced,
+				ipAddress: {
+					trustedProxies: PRIVATE_NETWORKS,
+					...oOptions.advanced?.ipAddress
+				}
+			},
+			database: prismaAdapter(oDb, { provider: "postgresql" })
+		});
+		this.oAuth = oAuth;
+		const fnSession = (oReq, oRes, fnNext) => {
+			oAuth.api.getSession({ headers: fromNodeHeaders(oReq.headers) }).then((oSession) => {
+				oRes.locals.session = oSession ?? void 0;
+				fnNext();
+			}).catch(fnNext);
+		};
+		return {
+			oHandler: toNodeHandler(oAuth),
+			fnSession,
+			sPath: `${oOptions.basePath ?? "/api/auth"}/{*path}`
+		};
+	}
+};
 // src/auth/permissions.ts
 /** Whether the session's user has the permissions; always without Better Auth or permissions */
 async function isGranted({ auth, session }, oPermissions) {
@@ -196,7 +247,7 @@ var Endpoint = class {
 	}
 	/** Handler for all methods */
 	async mount(oParams, sPath) {
-		if (!oParams.auth && Object.values(this.oMethods).some(({ permissions }) => permissions)) console.warn(`[nano-app] [WARNING] ${sPath}: its permissions are not checked without Better Auth. Turn on packages.betterAuth.`);
+		if (!oParams.auth && Object.values(this.oMethods).some(({ permissions }) => permissions)) console.warn(`[nano-app] [WARNING] ${sPath}: its permissions are not checked without Better Auth. Add src/auth.ts.`);
 		await this.oCallbacks.onInit?.(oParams);
 		return this.createHandler(oParams);
 	}
@@ -272,47 +323,6 @@ var Router = class {
 		return `${this.sBasePath}${sEndpoint.replace(/\/index$/, "")}${sExpression}` || "/";
 	}
 };
-// src/auth/BetterAuth.ts
-/** Better Auth on the app's Prisma client: the instance, its handler and the session lookup */
-var BetterAuth = class {
-	static oAuth;
-	/** The instance, once the app's plugin created it */
-	static get() {
-		return this.oAuth;
-	}
-	/** Creates the instance on the app's client, its handler and the session lookup */
-	static async create(oOptions, oDb) {
-		const { betterAuth } = await import("better-auth");
-		const { prismaAdapter } = await import("better-auth/adapters/prisma");
-		const { getSchema } = await import("better-auth/db");
-		const { fromNodeHeaders, toNodeHandler } = await import("better-auth/node");
-		const aMissing = Object.keys(getSchema(oOptions)).filter((sModel) => !oDb[sModel]);
-		if (aMissing.length) throw new Error(`[nano-app] [ERROR] Better Auth needs the models ${aMissing.join(", ")} in the app's schema. Run \`npx auth generate\` and apply your schema with Prisma.`);
-		const oAuth = betterAuth({
-			...oOptions,
-			advanced: {
-				...oOptions.advanced,
-				ipAddress: {
-					trustedProxies: PRIVATE_NETWORKS,
-					...oOptions.advanced?.ipAddress
-				}
-			},
-			database: prismaAdapter(oDb, { provider: "postgresql" })
-		});
-		this.oAuth = oAuth;
-		const fnSession = (oReq, oRes, fnNext) => {
-			oAuth.api.getSession({ headers: fromNodeHeaders(oReq.headers) }).then((oSession) => {
-				oRes.locals.session = oSession ?? void 0;
-				fnNext();
-			}).catch(fnNext);
-		};
-		return {
-			oHandler: toNodeHandler(oAuth),
-			fnSession,
-			sPath: `${oOptions.basePath ?? "/api/auth"}/{*path}`
-		};
-	}
-};
 // src/database/Prisma.ts
 /** Runs the consumer's Prisma CLI: generates clients and applies official plugins' migrations */
 var Prisma = class {
@@ -462,7 +472,7 @@ var Plugin = class {
 		const { name, routesDir, basePath, database, options, callbacks } = this.oConfig;
 		const oDb = database?.enabled ? await Database.mount(name, database) : Database.get("app");
 		if (this.oAuthOptions) {
-			if (!oDb) throw new Error("[nano-app] [ERROR] packages.betterAuth needs the database of the app: set mainPlugin.database.enabled to true.");
+			if (!oDb) throw new Error("[nano-app] [ERROR] src/auth.ts needs the database of the app: set mainPlugin.database.enabled to true.");
 			const { sPath, oHandler, fnSession } = await BetterAuth.create(this.oAuthOptions, oDb);
 			oApp.all(sPath, oHandler);
 			oApp.use(fnSession);
@@ -506,8 +516,7 @@ const INITIAL_CONFIG = {
 		helmet: true,
 		compression: true,
 		express: { limit: "10kb" },
-		urlencoded: { extended: false },
-		betterAuth: false
+		urlencoded: { extended: false }
 	},
 	/** Main plugin to mount */
 	mainPlugin: {
@@ -643,8 +652,8 @@ var NanoApp = class {
 		};
 		for (const oPlugin of this.oConfig.plugins) oPlugins[oPlugin.stage ?? "before"].push(oPlugin);
 		for (const oPlugin of oPlugins.before) await new Plugin(oPlugin).mount(this.oApp);
-		const { mainPlugin, packages } = this.oConfig;
-		await new Plugin(mainPlugin, packages.betterAuth).mount(this.oApp);
+		const { mainPlugin } = this.oConfig;
+		await new Plugin(mainPlugin, await BetterAuth.findOptions()).mount(this.oApp);
 		for (const oPlugin of oPlugins.after) await new Plugin(oPlugin).mount(this.oApp);
 		this.oApp.use(notFoundHandler);
 		this.oApp.use(errorHandler);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@nano-app/backend",
-  "version": "0.12.5",
+  "version": "0.14.0",
   "description": "Express server with file-convention routes, plugins and an optional PostgreSQL layer",
   "type": "module",
   "main": "build/index.js",