@neutralauth/internal-auth 0.10.11

package/package.json

@@ -0,0 +1,208 @@
+{
+  "name": "@neutralauth/internal-auth",
+  "description": "A Better Auth component for Convex.",
+  "repository": "github:get-convex/better-auth",
+  "homepage": "https://github.com/get-convex/better-auth#readme",
+  "bugs": {
+    "url": "https://github.com/get-convex/better-auth/issues"
+  },
+  "version": "0.10.11",
+  "license": "Apache-2.0",
+  "keywords": [
+    "convex",
+    "component",
+    "auth",
+    "authentication",
+    "better-auth",
+    "convex-auth"
+  ],
+  "type": "module",
+  "scripts": {
+    "dev": "cd examples/react && npm run dev",
+    "clean": "rm -rf dist *.tsbuildinfo",
+    "build": "tsc --project tsconfig.build.json",
+    "check:exports": "node ./scripts/check-exports.mjs",
+    "typecheck": "tsc --noEmit && tsc -p examples/next && tsc -p examples/next/convex && tsc -p examples/react && tsc -p examples/react/convex && tsc -p examples/tanstack && tsc -p examples/tanstack/convex",
+    "lint": "eslint .",
+    "all": "run-p -r 'dev' 'test:watch'",
+    "test": "vitest run --typecheck",
+    "test:watch": "vitest --typecheck --clearScreen false",
+    "test:debug": "vitest --inspect-brk --no-file-parallelism",
+    "test:coverage": "vitest run --coverage --coverage.reporter=text",
+    "check-npm-auth": "npm whoami 2>/dev/null || (echo 'Error: You must be logged in to npm to publish. Run `npm login` first.' && exit 1)",
+    "prepublishOnly": "npm run check-npm-auth && npm run build",
+    "preversion": "npm run clean && npm run build",
+    "alpha": "npm version prerelease --preid alpha && npm publish --access public --tag alpha && git push --follow-tags",
+    "release": "npm version patch && npm publish --access public && git push --follow-tags",
+    "prerelease": "npm run check-npm-auth",
+    "version": "vim -c 'normal o' -c 'normal o## '$npm_package_version CHANGELOG.md && prettier -w CHANGELOG.md && git add CHANGELOG.md"
+  },
+  "files": [
+    "dist",
+    "src"
+  ],
+  "exports": {
+    "./package.json": "./package.json",
+    ".": {
+      "types": "./dist/client/index.d.ts",
+      "default": "./dist/client/index.js"
+    },
+    "./_generated/component.js": {
+      "types": "./dist/component/_generated/component.d.ts"
+    },
+    "./convex.config": {
+      "types": "./dist/component/convex.config.d.ts",
+      "default": "./dist/component/convex.config.js"
+    },
+    "./convex.config.js": {
+      "types": "./dist/component/convex.config.d.ts",
+      "default": "./dist/component/convex.config.js"
+    },
+    "./adapter": {
+      "types": "./dist/component/adapter.d.ts",
+      "default": "./dist/component/adapter.js"
+    },
+    "./auth-config": {
+      "types": "./dist/auth-config.d.ts",
+      "default": "./dist/auth-config.js"
+    },
+    "./client": {
+      "types": "./dist/client/index.d.ts",
+      "default": "./dist/client/index.js"
+    },
+    "./client/adapter": {
+      "types": "./dist/client/adapter.d.ts",
+      "default": "./dist/client/adapter.js"
+    },
+    "./client/adapter-utils": {
+      "types": "./dist/client/adapter-utils.d.ts",
+      "default": "./dist/client/adapter-utils.js"
+    },
+    "./client/create-api": {
+      "types": "./dist/client/create-api.d.ts",
+      "default": "./dist/client/create-api.js"
+    },
+    "./client/create-client": {
+      "types": "./dist/client/create-client.d.ts",
+      "default": "./dist/client/create-client.js"
+    },
+    "./client/create-schema": {
+      "types": "./dist/client/create-schema.d.ts",
+      "default": "./dist/client/create-schema.js"
+    },
+    "./client/plugins": {
+      "types": "./dist/client/plugins/index.d.ts",
+      "default": "./dist/client/plugins/index.js"
+    },
+    "./component/adapter": {
+      "types": "./dist/component/adapter.d.ts",
+      "default": "./dist/component/adapter.js"
+    },
+    "./component/convex.config": {
+      "types": "./dist/component/convex.config.d.ts",
+      "default": "./dist/component/convex.config.js"
+    },
+    "./component/schema": {
+      "types": "./dist/component/schema.d.ts",
+      "default": "./dist/component/schema.js"
+    },
+    "./nextjs": {
+      "types": "./dist/nextjs/index.d.ts",
+      "default": "./dist/nextjs/index.js"
+    },
+    "./nextjs/client": {
+      "types": "./dist/nextjs/client.d.ts",
+      "default": "./dist/nextjs/client.js"
+    },
+    "./plugins": {
+      "types": "./dist/plugins/index.d.ts",
+      "default": "./dist/plugins/index.js"
+    },
+    "./plugins/convex": {
+      "types": "./dist/plugins/convex/index.d.ts",
+      "default": "./dist/plugins/convex/index.js"
+    },
+    "./plugins/convex/client": {
+      "types": "./dist/plugins/convex/client.d.ts",
+      "default": "./dist/plugins/convex/client.js"
+    },
+    "./plugins/cross-domain": {
+      "types": "./dist/plugins/cross-domain/index.d.ts",
+      "default": "./dist/plugins/cross-domain/index.js"
+    },
+    "./plugins/cross-domain/client": {
+      "types": "./dist/plugins/cross-domain/client.d.ts",
+      "default": "./dist/plugins/cross-domain/client.js"
+    },
+    "./react": {
+      "types": "./dist/react/index.d.ts",
+      "default": "./dist/react/index.js"
+    },
+    "./react-start": {
+      "types": "./dist/react-start/index.d.ts",
+      "default": "./dist/react-start/index.js"
+    },
+    "./test": "./src/test.ts",
+    "./utils": {
+      "types": "./dist/utils/index.d.ts",
+      "default": "./dist/utils/index.js"
+    }
+  },
+  "typesVersions": {
+    "*": {
+      "next-js": [
+        "./dist/nextjs/index.d.ts"
+      ]
+    }
+  },
+  "peerDependencies": {
+    "better-auth": "catalog:",
+    "convex": "catalog:",
+    "react": "^18.3.1 || ^19.0.0",
+    "react-dom": "^18.3.1 || ^19.0.0"
+  },
+  "devDependencies": {
+    "@edge-runtime/vm": "5.0.0",
+    "@eslint/eslintrc": "3.3.1",
+    "@eslint/js": "9.39.1",
+    "@tanstack/react-start": "^1.140.1",
+    "@types/common-tags": "^1.8.4",
+    "@types/node": "catalog:",
+    "@types/react": "catalog:",
+    "@types/react-dom": "catalog:",
+    "@types/semver": "^7.7.0",
+    "chokidar-cli": "3.0.0",
+    "concurrently": "^9.2.0",
+    "convex": "catalog:",
+    "convex-test": "0.0.41",
+    "cpy-cli": "6.0.0",
+    "eslint": "9.39.1",
+    "eslint-plugin-import": "^2.32.0",
+    "eslint-plugin-react": "7.37.5",
+    "eslint-plugin-react-hooks": "5.2.0",
+    "eslint-plugin-react-refresh": "0.4.24",
+    "globals": "15.14.0",
+    "next": "^16.0.3",
+    "npm-run-all2": "8.0.4",
+    "pkg-pr-new": "0.0.60",
+    "prettier": "3.6.2",
+    "react": "18.3.1",
+    "react-dom": "18.3.1",
+    "typescript": "catalog:",
+    "typescript-eslint": "8.46.4",
+    "vitest": "^4.0.15"
+  },
+  "types": "./dist/client/index.d.ts",
+  "module": "./dist/client/index.js",
+  "dependencies": {
+    "@better-auth/passkey": "1.4.9",
+    "@better-fetch/fetch": "^1.1.18",
+    "common-tags": "^1.8.2",
+    "convex-helpers": "catalog:",
+    "jose": "^6.1.0",
+    "remeda": "^2.32.0",
+    "semver": "^7.7.3",
+    "type-fest": "^4.39.1",
+    "zod": "catalog:"
+  }
+}

package/src/auth-config.ts

@@ -0,0 +1,80 @@
+import type { JwtOptions } from "better-auth/plugins";
+import type { AuthProvider } from "convex/server";
+import type { JSONWebKeySet } from "jose";
+
+type JwksDoc = {
+  id: string;
+  publicKey: string;
+  privateKey: string;
+  createdAt: number;
+  expiresAt?: number;
+  alg?: string;
+  crv?: string;
+};
+
+export const createPublicJwks = (jwks: JwksDoc[], options?: JwtOptions) => {
+  /*
+  const now = Date.now();
+  const DEFAULT_GRACE_PERIOD = 60 * 60 * 24 * 30;
+  const gracePeriod =
+    (options?.jwks?.gracePeriod ?? DEFAULT_GRACE_PERIOD) * 1000;
+
+  const keys = jwks.filter((key) => {
+    if (!key.expiresAt) {
+      return true;
+    }
+    return new Date(key.expiresAt).getTime() + gracePeriod > now;
+  });
+  */
+  const keys = jwks;
+
+  const keyPairConfig = options?.jwks?.keyPairConfig;
+  const defaultCrv = keyPairConfig
+    ? "crv" in keyPairConfig
+      ? (keyPairConfig as { crv: string }).crv
+      : undefined
+    : undefined;
+  return {
+    keys: keys.map((keySet) => ({
+      alg: keySet.alg ?? options?.jwks?.keyPairConfig?.alg ?? "EdDSA",
+      crv: keySet.crv ?? defaultCrv,
+      ...JSON.parse(keySet.publicKey),
+      kid: keySet.id,
+    })),
+  } satisfies JSONWebKeySet as JSONWebKeySet;
+};
+
+export const getAuthConfigProvider = (opts?: {
+  basePath?: string;
+  /**
+   * @param jwks - Optional static JWKS to avoid fetching from the database.
+   *
+   * This should be a stringified document from the Better Auth JWKS table. You
+   * can create one in the console.
+   *
+   * Example:
+   * ```bash
+   * npx convex run auth:generateJwk | npx convex env set JWKS
+   * ```
+   *
+   * Then use it in your auth config:
+   * ```ts
+   * export default {
+   *   providers: [getAuthConfigProvider({ jwks: process.env.JWKS })],
+   * } satisfies AuthConfig;
+   * ```
+   *
+   */
+  jwks?: string;
+}) => {
+  const parsedJwks = opts?.jwks ? JSON.parse(opts.jwks) : undefined;
+  return {
+    type: "customJwt",
+    issuer: `${process.env.CONVEX_SITE_URL}`,
+    applicationID: "convex",
+    algorithm: "RS256",
+    jwks: parsedJwks
+      ? `data:text/plain;charset=utf-8;base64,${btoa(JSON.stringify(createPublicJwks(parsedJwks)))}`
+      : `${process.env.CONVEX_SITE_URL}${opts?.basePath ?? "/api/auth"}/convex/jwks`,
+  } satisfies AuthProvider;
+};

package/src/auth-options.ts

@@ -0,0 +1,54 @@
+import type { BetterAuthOptions } from "better-auth/minimal";
+import {
+  anonymous,
+  bearer,
+  emailOTP,
+  genericOAuth,
+  jwt,
+  magicLink,
+  oidcProvider,
+  oneTap,
+  oneTimeToken,
+  phoneNumber,
+  twoFactor,
+  username,
+} from "better-auth/plugins";
+import { passkey } from "@better-auth/passkey";
+import { convex } from "./plugins/convex/index.js";
+import { convexAdapter } from "./client/adapter.js";
+
+// This is the config used to generate the schema
+export const options = {
+  database: convexAdapter({} as any, {} as any),
+  rateLimit: {
+    storage: "database",
+  },
+  plugins: [
+    twoFactor(),
+    anonymous(),
+    username(),
+    phoneNumber(),
+    magicLink({ sendMagicLink: async () => {} }),
+    emailOTP({ sendVerificationOTP: async () => {} }),
+    passkey(),
+    genericOAuth({
+      config: [
+        {
+          clientId: "",
+          clientSecret: "",
+          providerId: "",
+        },
+      ],
+    }),
+    oneTap(),
+    oidcProvider({
+      loginPage: "/login",
+    }),
+    bearer(),
+    oneTimeToken(),
+    jwt(),
+    convex({
+      authConfig: { providers: [{ applicationID: "convex", domain: "" }] },
+    }),
+  ],
+} as BetterAuthOptions; // assert type to avoid overloading ts compiler

package/src/auth.ts

@@ -0,0 +1,4 @@
+import { betterAuth } from "better-auth/minimal";
+import { options } from "./auth-options.js";
+
+export const auth = betterAuth(options);