@nestjs-kit/better-auth 2.1.0 → 2.1.2

package/dist/testing/conformance.cjs

@@ -1,15 +1,15 @@
 Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
-const require_rolldown_runtime = require("../rolldown-runtime-VH7oDXx4.cjs");
-const require_auth_errors = require("../auth-errors-DmiKl0L_.cjs");
-const require_decorate = require("../decorate-Cr4Q7bNE.cjs");
-const require_auth_scope_interceptor = require("../auth-scope-interceptor-BjxAL1-S.cjs");
-const require_auth_module = require("../auth-module-BgcY2HpA.cjs");
-const require_auth_guard = require("../auth-guard-CLyhAEEj.cjs");
-const require_bridge_protocol = require("../bridge-protocol-BDw8opAG.cjs");
-const require_auth_decorators = require("../auth-decorators-Cu_nxWnF.cjs");
-const require_admin = require("../admin.cjs");
-const require_organization = require("../organization.cjs");
+const require_rolldown_runtime = require("../rolldown-runtime-CmQyd0Gu.cjs");
+const require_auth_errors = require("../auth-errors-RW7hOVI-.cjs");
+const require_bridge_protocol = require("../bridge-protocol-DNFhIKdo.cjs");
+const require_auth_decorators = require("../auth-decorators-CJKE9wlT.cjs");
+const require_auth_module = require("../auth-module-ab60-WJZ.cjs");
+const require_decorate = require("../decorate-fMNf0caZ.cjs");
+const require_auth_guard = require("../auth-guard-wapEh_M_.cjs");
+const require_auth_scope_interceptor = require("../auth-scope-interceptor-Bui20-Ps.cjs");
 const require_testing = require("../testing.cjs");
+const require_organization = require("../organization.cjs");
+const require_admin = require("../admin.cjs");
 let better_auth_api = require("better-auth/api");
 let _nestjs_common = require("@nestjs/common");
 let _nestjs_core = require("@nestjs/core");
@@ -25,7 +25,7 @@ node_assert_strict = require_rolldown_runtime.__toESM(node_assert_strict, 1);
 let node_http2 = require("node:http2");
 let node_net = require("node:net");
 let _nestjs_testing = require("@nestjs/testing");
-//#region src/database-hook-dispatcher.ts
+// src/database-hook-dispatcher.ts
 /**
 * Construct all dispatchers once; bindings supply only the late-bound methods.
 *
@@ -97,8 +97,7 @@ function createDatabaseDispatchers(getBinding, countUnbound) {
 		}
 	};
 }
-//#endregion
-//#region src/hook-dispatcher.ts
+// src/hook-dispatcher.ts
 const API_ERROR_HEADERS = Symbol.for("better-call:api-error-headers");
 const mergeContext = (0, defu.createDefu)((object, key, value) => {
 	if (Array.isArray(object[key]) && Array.isArray(value)) {
@@ -192,8 +191,7 @@ async function runAfter(binding, ctx, scope, relayMatcherError) {
 	}
 	return ctx.context.returned;
 }
-//#endregion
-//#region src/plugin.ts
+// src/plugin.ts
 const NESTJS_PLUGIN_ID = "@nestjs-kit/better-auth";
 const isRouter = (ctx) => "_flag" in ctx && ctx._flag === "router";
 const separator = "\0";
@@ -336,8 +334,7 @@ function nestjs(options = {}) {
 		}
 	};
 }
-//#endregion
-//#region src/conformance-fixtures.ts
+// src/conformance-fixtures.ts
 const PROBE_PLUGIN_ID = "nestjs-kit-better-auth-conformance-probe";
 /** The trusted origin the probe plugin contributes through init(), so origin cases see the post-init set. */
 const PROBE_TRUSTED_ORIGIN = "https://probe-plugin.example";
@@ -803,8 +800,7 @@ function bootIssueCodes(error) {
 	visit(error);
 	return codes;
 }
-//#endregion
-//#region src/conformance-http.ts
+// src/conformance-http.ts
 const AUTH = "/api/auth";
 const DYNAMIC_AUTH = "/tenant/auth";
 /** The client IP of the kit's requests: baseUrl() always connects over IPv4 loopback. */
@@ -2146,8 +2142,7 @@ async function bridgeOf(auth) {
 	const plugin = (await auth.$context).getPlugin("@nestjs-kit/better-auth");
 	return Reflect.get(plugin, require_bridge_protocol.BRIDGE_HANDLE);
 }
-//#endregion
-//#region src/conformance-policy-harness.ts
+// src/conformance-policy-harness.ts
 /** An instance with the given overrides, built by options.variant() or createConformanceAuth(). */
 async function variantOf$1(options, overrides) {
 	return options.variant ? await options.variant(overrides) : createConformanceAuth(overrides);
@@ -2546,8 +2541,7 @@ async function sessionPrincipalOf(auth, headers) {
 		session
 	};
 }
-//#endregion
-//#region src/conformance-policy-units.ts
+// src/conformance-policy-units.ts
 const ADMIN_POLICY = "better-auth:admin/permission";
 const ORG_POLICIES = /* @__PURE__ */ new Set(["better-auth:organization/permission", "better-auth:organization/member"]);
 const API_KEY_POLICY = "better-auth:api-key/permission";
@@ -3209,8 +3203,7 @@ function unitPolicyCases(options, known) {
 		...(options.deliveries ?? []).flatMap(deliveryCases)
 	];
 }
-//#endregion
-//#region src/conformance-policy.ts
+// src/conformance-policy.ts
 const noGrant = {
 	description: "conformance: no grant",
 	allows: () => false
@@ -3410,7 +3403,7 @@ function policyConformance(options) {
 				}
 			})));
 			probe.storageFault = void 0;
-			for (const outcome of outcomes) if (customSession) node_assert_strict.default.ok(outcome.ok && isSessionLoss(outcome.value), `with customSession a storage failure must answer the documented 401: ${outcome.ok ? JSON.stringify(outcome.value) : String(outcome.error)}`);
+			for (const outcome of outcomes) if (customSession) node_assert_strict.default.ok(outcome.ok ? isSessionLoss(outcome.value) : require_auth_errors.isInfrastructureError(outcome.error), `with customSession a storage failure must be infrastructure or the documented 401: ${outcome.ok ? JSON.stringify(outcome.value) : String(outcome.error)}`);
 			else node_assert_strict.default.ok(!outcome.ok && require_auth_errors.isInfrastructureError(outcome.error), `a storage failure at the policy's call must be infrastructure: ${JSON.stringify(outcome.ok && outcome.value)}`);
 			node_assert_strict.default.equal(sessionReads$1(probe, reads), 1, `two invocations of one request re-read the session ${sessionReads$1(probe, reads)} times during the outage`);
 		}),
@@ -3498,8 +3491,7 @@ function policyConformance(options) {
 		...unitPolicyCases(options, known)
 	];
 }
-//#endregion
-//#region src/conformance-principal.ts
+// src/conformance-principal.ts
 var RecordingSink = class {
 	values = [];
 	append(setCookies) {
@@ -4444,8 +4436,7 @@ function jwtCases(options) {
 		node_assert_strict.default.ok(!require_auth_errors.isAuthFailure(!result.ok && result.error), `a key-set outage was thrown as a denial: ${String(!result.ok && result.error)}`);
 	})];
 }
-//#endregion
-//#region src/conformance-transport.ts
+// src/conformance-transport.ts
 const KEY_SOURCE_ID = "@nestjs-kit/better-auth:conformance-api-key";
 /** An origin only a function-valued trustedOrigins returns (T-ws-origin-*). */
 const FUNCTION_TRUSTED_ORIGIN = "https://function-trusted.example";
@@ -5911,6 +5902,7 @@ function transportConformance(options) {
 			...cookie(env),
 			cookie: later.cookie
 		};
+		const rebuilt = [];
 		await withApp(options, env, async ({ app, logger }) => {
 			const first = await invokeAlone(app, "required", cookie(env));
 			succeeded(first, "the first caller of a cached context");
@@ -5923,6 +5915,7 @@ function transportConformance(options) {
 					if (result.ok) {
 						const principal = principalOf(result);
 						node_assert_strict.default.ok(principal === null || principal?.userId === later.userId, `${label} read neither its own principal nor none: ${JSON.stringify(result.body)}`);
+						if (principal !== null) rebuilt.push(handler);
 					} else denied(result, 401, void 0, label);
 					continue;
 				}
@@ -5941,6 +5934,7 @@ function transportConformance(options) {
 				node_assert_strict.default.doesNotMatch(logger.text(), /AUTH_MISCONFIGURED|GRAPHQL_CONTEXT_STALE_REQUEST/);
 			}
 		}, { graphqlContext: "cached" });
+		if (rebuilt.length > 0) return conformanceSkip(`the later caller of ${rebuilt.join(" and ")} read its own principal, so the driver built a new context for its connection instead of serving the cached one, and no closed connection's context reached the transport`);
 	});
 	/** The claimed site of each graph fixture handler of a booted app, by fixture name. */
 	const graphSites = async (app) => {
@@ -6201,7 +6195,6 @@ function transportConformance(options) {
 	}, staticMember(options.transport, "defaultAccessFor") === false && !options.invokeEntities ? "the transport nests no handlers, so it serves no federation reference resolvers" : void 0);
 	return cases;
 }
-//#endregion
 exports.PROBE_TRUSTED_ORIGIN = PROBE_TRUSTED_ORIGIN;
 exports.conformanceProbePlugin = conformanceProbePlugin;
 exports.createConformanceAuth = createConformanceAuth;