@nuxt-customer-portal/core 0.3.0

package/server/utils/auth.ts

@@ -0,0 +1,326 @@
+import { betterAuth } from 'better-auth'
+import { APIError, createAuthMiddleware, getSessionFromCtx } from 'better-auth/api'
+import { drizzleAdapter } from 'better-auth/adapters/drizzle'
+import { sendEmail } from './email'
+import { getInvitationEmailContent, getOTPEmailContent, getDeleteAccountEmailContent } from './email-texts'
+import { admin as adminPlugin, customSession, emailOTP, openAPI, organization } from 'better-auth/plugins'
+import { db } from './db'
+import { and, eq, gt } from 'drizzle-orm'
+import {
+  user as userTable,
+  account as accountTable,
+  session as sessionTable,
+  verification as verificationTable,
+  organization as organizationTable,
+  member as organizationMemberTable,
+  invitation as organizationInvitationTable
+} from '../db/schema/auth-schema'
+import { nanoid } from 'nanoid'
+import { ac, user, admin as adminRole } from '../../shared/permissions'
+import { canViewOrganizationDirectory } from '../../shared/feature-registry'
+import { isSystemAdminEmail, parseSystemAdminEmails } from './admin-email-allowlist'
+
+/**
+ * Generate an ID in the same format as better-auth uses (nanoid)
+ * This ensures consistency across all ID generation in the application
+ */
+export function generateId(): string {
+  return nanoid()
+}
+
+const envFlag = (value: string | undefined, fallback = true) => (value === undefined ? fallback : value === 'true')
+const portalAuthConfig = useRuntimeConfig().portalAuth
+const registrationMode = ['open', 'invitation-only', 'disabled'].includes(process.env.PORTAL_REGISTRATION_MODE || '')
+  ? process.env.PORTAL_REGISTRATION_MODE
+  : portalAuthConfig.registrationMode
+const githubEnabled = envFlag(process.env.PORTAL_GITHUB_ENABLED, portalAuthConfig.githubEnabled)
+const googleEnabled = envFlag(process.env.PORTAL_GOOGLE_ENABLED, portalAuthConfig.googleEnabled)
+const systemAdminEmails = parseSystemAdminEmails(process.env.ADMIN_EMAILS)
+
+export const auth = betterAuth({
+  baseURL: process.env.BETTER_AUTH_URL || process.env.PUBLIC_URL || 'http://localhost:3051',
+  database: drizzleAdapter(db, {
+    provider: 'pg',
+    schema: {
+      user: userTable,
+      account: accountTable,
+      session: sessionTable,
+      member: organizationMemberTable,
+      verification: verificationTable,
+      organization: organizationTable,
+      invitation: organizationInvitationTable
+    },
+    usePlural: false
+    // Tables are singular (e.g., "user"), so no need for usePlural
+  }),
+  hooks: {
+    before: createAuthMiddleware(async (ctx) => {
+      if (ctx.path !== '/organization/list-members' && ctx.path !== '/organization/list-invitations') {
+        return
+      }
+
+      const session = await getSessionFromCtx(ctx)
+      if (!session) {
+        return
+      }
+      const organizationId = ctx.query?.organizationId || session.session.activeOrganizationId
+      if (!organizationId) {
+        return
+      }
+
+      const [membership] = await db
+        .select({ role: organizationMemberTable.role })
+        .from(organizationMemberTable)
+        .where(
+          and(
+            eq(organizationMemberTable.userId, session.user.id),
+            eq(organizationMemberTable.organizationId, String(organizationId))
+          )
+        )
+        .limit(1)
+
+      if (!canViewOrganizationDirectory(membership?.role)) {
+        throw new APIError('FORBIDDEN', { message: 'Organization owner or administrator access required' })
+      }
+    })
+  },
+  emailAndPassword: {
+    enabled: true,
+    disableSignUp: registrationMode === 'disabled',
+    requireEmailVerification: true
+  },
+  user: {
+    deleteUser: {
+      enabled: true,
+      sendDeleteAccountVerification: async ({ user, url, token: _token }, _request) => {
+        // url is already a full URL from better-auth, use it directly
+        const emailContent = getDeleteAccountEmailContent({
+          userName: user.name || '',
+          userEmail: user.email,
+          deletionLink: url
+        })
+
+        await sendEmail({
+          to: user.email,
+          ...emailContent
+        })
+      },
+      beforeDelete: async (user) => {
+        const [record] = await db
+          .select({ role: userTable.role })
+          .from(userTable)
+          .where(eq(userTable.id, user.id))
+          .limit(1)
+
+        if (record?.role === 'admin') {
+          throw new APIError('BAD_REQUEST', { message: 'System administrator accounts cannot be deleted' })
+        }
+      }
+    }
+  },
+  socialProviders: {
+    ...(githubEnabled && process.env.GITHUB_CLIENT_ID && process.env.GITHUB_CLIENT_SECRET
+      ? {
+          github: {
+            clientId: process.env.GITHUB_CLIENT_ID,
+            clientSecret: process.env.GITHUB_CLIENT_SECRET
+          }
+        }
+      : {}),
+    ...(googleEnabled && process.env.GOOGLE_CLIENT_ID && process.env.GOOGLE_CLIENT_SECRET
+      ? {
+          google: {
+            clientId: process.env.GOOGLE_CLIENT_ID,
+            clientSecret: process.env.GOOGLE_CLIENT_SECRET
+          }
+        }
+      : {})
+  },
+  databaseHooks: {
+    user: {
+      create: {
+        before: async (user) => {
+          if (registrationMode === 'invitation-only') {
+            const [invitation] = await db
+              .select({ id: organizationInvitationTable.id })
+              .from(organizationInvitationTable)
+              .where(
+                and(
+                  eq(organizationInvitationTable.email, user.email),
+                  eq(organizationInvitationTable.status, 'pending'),
+                  gt(organizationInvitationTable.expiresAt, new Date())
+                )
+              )
+              .limit(1)
+
+            if (!invitation) {
+              throw new APIError('FORBIDDEN', { message: 'Registration requires a valid invitation' })
+            }
+          }
+
+          if (isSystemAdminEmail(user.email, systemAdminEmails)) {
+            return { data: { ...user, role: 'admin' } }
+          }
+        },
+        after: async (user) => {
+          if (!isSystemAdminEmail(user.email, systemAdminEmails)) {
+            return
+          }
+
+          const [providerOrganization] = await db
+            .select({ id: organizationTable.id })
+            .from(organizationTable)
+            .where(eq(organizationTable.organizationType, 'PROVIDER'))
+            .limit(1)
+          if (!providerOrganization) {
+            return
+          }
+
+          const [membership] = await db
+            .select({ id: organizationMemberTable.id })
+            .from(organizationMemberTable)
+            .where(
+              and(
+                eq(organizationMemberTable.organizationId, providerOrganization.id),
+                eq(organizationMemberTable.userId, user.id)
+              )
+            )
+            .limit(1)
+          if (membership) {
+            return
+          }
+
+          await db.insert(organizationMemberTable).values({
+            id: generateId(),
+            organizationId: providerOrganization.id,
+            userId: user.id,
+            role: 'owner',
+            createdAt: new Date()
+          })
+        }
+      }
+    },
+    session: {
+      create: {
+        before: async (session) => {
+          const [record] = await db
+            .select({ email: userTable.email, role: userTable.role })
+            .from(userTable)
+            .where(eq(userTable.id, session.userId))
+            .limit(1)
+
+          if (record && record.role !== 'admin' && isSystemAdminEmail(record.email, systemAdminEmails)) {
+            await db
+              .update(userTable)
+              .set({ role: 'admin', updatedAt: new Date() })
+              .where(eq(userTable.id, session.userId))
+          }
+
+          return { data: session }
+        }
+      }
+    }
+  },
+  plugins: [
+    openAPI({
+      disableDefaultReference: true
+    }),
+    organization({
+      allowUserToCreateOrganization: false,
+      schema: {
+        organization: {
+          additionalFields: {
+            organizationType: { type: 'string', required: true, input: true }
+          }
+        },
+        member: {
+          additionalFields: {
+            phone: { type: 'string', required: false, input: true },
+            jobTitle: { type: 'string', required: false, input: true }
+          }
+        }
+      },
+      sendInvitationEmail: async ({ invitation, organization, inviter }) => {
+        const baseURL = process.env.BETTER_AUTH_URL || process.env.PUBLIC_URL || 'http://localhost:3000'
+        const invitationLink = `${baseURL}/signup?invitationId=${invitation.id}`
+
+        const emailContent = getInvitationEmailContent({
+          inviterName: inviter.user.name || '',
+          inviterEmail: inviter.user.email,
+          organizationName: organization.name,
+          role: invitation.role || 'member',
+          invitationLink
+        })
+
+        await sendEmail({
+          to: invitation.email,
+          ...emailContent
+        })
+      },
+      organizationHooks: {
+        afterCreateOrganization: async ({ organization: createdOrganization, member, user: creator }) => {
+          const [creatorRecord] = await db
+            .select({ role: userTable.role })
+            .from(userTable)
+            .where(eq(userTable.id, creator.id))
+            .limit(1)
+
+          // A system admin manages organizations globally and does not need an
+          // artificial membership in every organization they create.
+          if (creatorRecord?.role === 'admin' && member) {
+            await db.delete(organizationMemberTable).where(eq(organizationMemberTable.id, member.id))
+            console.log(`Removed system admin ${creator.email} as member from ${createdOrganization.name}`)
+          }
+        },
+        afterAcceptInvitation: async ({ invitation: _invitation, member, user, organization }) => {
+          // Ensure the user gets the correct role when accepting invitation
+          // Better Auth handles this automatically, but we log it for debugging
+          console.log(`User ${user.email} accepted invitation to ${organization.name} with role ${member.role}`)
+        }
+      }
+    }),
+    emailOTP({
+      overrideDefaultEmailVerification: true,
+      async sendVerificationOTP({ email, otp, type }) {
+        const config = useRuntimeConfig()
+        const emailContent = getOTPEmailContent({
+          otp,
+          type,
+          brandName: config.portalEmail?.brandName
+        })
+
+        await sendEmail({
+          to: email,
+          ...emailContent
+        })
+      }
+    }),
+    adminPlugin({
+      ac,
+      roles: {
+        user,
+        admin: adminRole
+      },
+      defaultRole: 'user'
+    }),
+    customSession(async (sessionData) => {
+      // Destructure user and session from the input object
+      const { user, session } = sessionData
+      // Fetch the account for the user
+      const [account] = await db
+        .select({ providerId: accountTable.providerId })
+        .from(accountTable)
+        .where(eq(accountTable.userId, user.id))
+        .limit(1)
+
+      // Return modified session data
+      return {
+        ...session, // Spread the original session part
+        user: {
+          ...user, // Spread the original user part
+          providerId: account?.providerId || null // Add providerId to user object
+        }
+      }
+    })
+  ]
+})

package/server/utils/business-hooks.ts

@@ -0,0 +1,28 @@
+type TimeEntryReopenGuard = (organizationId: string, entryIds: string[]) => Promise<void>
+const reopenGuards: TimeEntryReopenGuard[] = []
+
+type ClientCreatedHook = (transaction: unknown, clientOrganizationId: string) => Promise<void>
+const clientCreatedHooks: ClientCreatedHook[] = []
+
+export const registerClientCreatedHook = (hook: ClientCreatedHook) => {
+  if (!clientCreatedHooks.includes(hook)) {
+    clientCreatedHooks.push(hook)
+  }
+}
+
+export const runClientCreatedHooks = async (transaction: unknown, clientOrganizationId: string) => {
+  for (const hook of clientCreatedHooks) {
+    await hook(transaction, clientOrganizationId)
+  }
+}
+
+export const registerTimeEntryReopenGuard = (guard: TimeEntryReopenGuard) => {
+  if (!reopenGuards.includes(guard)) {
+    reopenGuards.push(guard)
+  }
+}
+export const assertTimeEntriesReopenable = async (organizationId: string, entryIds: string[]) => {
+  for (const guard of reopenGuards) {
+    await guard(organizationId, entryIds)
+  }
+}

package/server/utils/db.ts

@@ -0,0 +1,18 @@
+import { drizzle } from 'drizzle-orm/node-postgres'
+import { Pool } from 'pg'
+
+// Declare globals to avoid multiple instances in development
+declare global {
+  var portalDatabase: ReturnType<typeof drizzle> | undefined
+}
+
+export const pool = new Pool({
+  connectionString: process.env.DATABASE_URL
+})
+
+export const db = globalThis.portalDatabase || drizzle(pool)
+
+// If in development, assign the instances to the global variables
+if (process.env.NODE_ENV !== 'production') {
+  globalThis.portalDatabase = db
+}

package/server/utils/email-template.html

@@ -0,0 +1,105 @@
+<!doctype html>
+<html lang="en">
+  <head>
+    <meta charset="UTF-8" />
+    <meta name="viewport" content="width=device-width, initial-scale=1.0" />
+    <title>{{subject}}</title>
+    <style>
+      body {
+        font-family: Arial, Helvetica, sans-serif;
+        line-height: 1.6;
+        color: #333;
+        background-color: #ffffff;
+        margin: 0;
+        padding: 0;
+      }
+      .container {
+        max-width: 600px;
+        margin: 20px auto;
+        background-color: #ffffff;
+        border-radius: 8px;
+        overflow: hidden;
+        box-shadow: 0 2px 4px rgba(0, 0, 0, 0.1);
+        border-top: 6px solid {{brand_primary_color}};
+      }
+      .header {
+        text-align: center;
+        padding: 28px 30px;
+        background-color: #ffffff;
+      }
+      .header h1 {
+        color: {{brand_primary_color}};
+        margin: 0;
+        font-size: 24px;
+      }
+      .header p {
+        color: {{brand_primary_color}};
+        margin: 4px 0 0;
+        font-size: 14px;
+      }
+      .content {
+        padding: 30px;
+      }
+      .content p {
+        margin-bottom: 15px;
+      }
+      .content code {
+        font-size: 30px;
+        font-weight: bold;
+        font-family: monospace;
+      }
+      .button {
+        display: inline-block;
+        background-color: {{brand_primary_color}};
+        color: #ffffff !important; /* Ensure link text is white */
+        padding: 12px 25px;
+        text-decoration: none;
+        border-radius: 5px;
+        font-weight: bold;
+        text-transform: uppercase;
+        text-align: center;
+        margin-top: 10px;
+        margin-bottom: 20px;
+      }
+      .footer {
+        text-align: center;
+        font-size: 0.9em;
+        color: #777;
+        padding: 20px 30px;
+        border-top: 1px solid #eeeeee;
+        background-color: #ffffff;
+      }
+      a {
+        color: #0ea5e9;
+      }
+      @media only screen and (max-width: 640px) {
+        .container {
+          margin: 0;
+          border-radius: 0;
+        }
+        .header,
+        .content,
+        .footer {
+          padding-left: 20px;
+          padding-right: 20px;
+        }
+      }
+    </style>
+  </head>
+  <body>
+    <div class="container">
+      <div class="header">
+        {{brand_logo_light}}
+        <h1>{{brand_name}}</h1>
+        <p>{{brand_tagline}}</p>
+      </div>
+      <div class="content">
+        <div>{{body}}</div>
+        <p>{{footer}}</p>
+      </div>
+      <div class="footer">
+        <p>&copy; {{current_year}} {{brand_name}}. All rights reserved.</p>
+      </div>
+    </div>
+  </body>
+</html>

package/server/utils/email-texts.ts

@@ -0,0 +1,110 @@
+/**
+ * Centralized invitation email content
+ * Used across all invitation email sending functions
+ */
+
+export interface InvitationEmailParams {
+  inviterName: string
+  inviterEmail: string
+  organizationName: string
+  role: string
+  invitationLink: string
+}
+
+export function getInvitationEmailContent(params: InvitationEmailParams) {
+  const { inviterName, inviterEmail, organizationName, role, invitationLink } = params
+  const inviterDisplay = inviterName || inviterEmail
+
+  return {
+    messageId: 'invitation',
+    values: {
+      inviter_name: inviterDisplay,
+      organization_name: organizationName,
+      role: role || 'member',
+      action_url: invitationLink
+    },
+    subject: `You've been invited to join ${organizationName}`,
+    params: {
+      greeting: 'Hello,',
+      body_text: `${inviterDisplay} has invited you to join <strong>${organizationName}</strong> as a ${role || 'member'}. Click the button below to accept the invitation and create your account.
+             <p style="text-align: center;">
+                <a href="${invitationLink}" class="button">Accept Invitation</a>
+            </p>
+        `,
+      action_url: invitationLink,
+      action_text: 'Accept Invitation',
+      footer_text: 'This invitation will expire soon. If you did not expect this invitation, please ignore this email.'
+    }
+  }
+}
+
+/**
+ * Centralized OTP email content
+ * Used for email verification, sign-in, and password reset OTP codes
+ */
+
+export type OTPEmailType = 'email-verification' | 'sign-in' | 'forget-password' | 'change-email'
+
+export interface OTPEmailParams {
+  otp: string
+  type: OTPEmailType
+  brandName?: string
+}
+
+export function getOTPEmailContent(params: OTPEmailParams) {
+  const { otp, type, brandName = 'Nuxt Customer Portal' } = params
+
+  const subjects = {
+    'email-verification': `Verify your ${brandName} email address`,
+    'sign-in': `Your ${brandName} sign-in code`,
+    'forget-password': `Reset your ${brandName} password`,
+    'change-email': `Confirm your new ${brandName} email address`
+  }
+
+  return {
+    messageId: type,
+    values: { otp },
+    subject: subjects[type],
+    params: {
+      greeting: 'Hello,',
+      body_text: `Your verification code is: <code>${otp}</code>`,
+      action_url: '#', // Not used for OTP
+      action_text: 'Verification Code',
+      footer_text: 'This code will expire soon. If you did not request this, please ignore this email.'
+    }
+  }
+}
+
+/**
+ * Centralized account deletion email content
+ * Used for account deletion verification
+ */
+
+export interface DeleteAccountEmailParams {
+  userName: string
+  userEmail: string
+  deletionLink: string
+}
+
+export function getDeleteAccountEmailContent(params: DeleteAccountEmailParams) {
+  const { userName, userEmail, deletionLink } = params
+  const userDisplay = userName || userEmail
+
+  return {
+    messageId: 'account-deletion',
+    values: { user_name: userDisplay, action_url: deletionLink },
+    subject: 'Confirm Account Deletion',
+    params: {
+      greeting: `Hello ${userDisplay},`,
+      body_text: `You have requested to delete your account. This action cannot be undone. All your data will be permanently deleted.
+             <p style="text-align: center;">
+                <a href="${deletionLink}" class="button">Delete Account</a>
+            </p>
+        `,
+      action_url: deletionLink,
+      action_text: 'Delete Account',
+      footer_text:
+        'If you did not request to delete your account, please ignore this email and your account will remain active.'
+    }
+  }
+}

package/server/utils/email.ts

@@ -0,0 +1,37 @@
+import { coreFeature } from '@nuxt-customer-portal/core/shared/core-feature'
+import { sendPortalEmail } from './portal-email'
+
+// Define the structure for the parameters used in the template
+interface EmailParams {
+  greeting?: string
+  body_text: string
+  action_url: string
+  action_text: string
+  footer_text: string
+}
+
+// Define the arguments for the sendEmail function
+interface SendEmailArgs {
+  to: string
+  subject: string
+  params: EmailParams
+  messageId?: string
+  values?: Record<string, string>
+  locale?: string
+}
+
+// Updated sendEmail function using the template
+export const sendEmail = async ({ to, subject, params, messageId, values = {}, locale }: SendEmailArgs) => {
+  const definition = coreFeature.emails?.find((item) => item.id === messageId)
+  if (!definition) {
+    throw new Error(`Unknown core email definition: ${messageId}`)
+  }
+  return sendPortalEmail({
+    moduleId: coreFeature.id,
+    definition,
+    locale,
+    values,
+    to,
+    text: messageId ? undefined : { subject, body: params.body_text, footer: params.footer_text }
+  })
+}

package/server/utils/invitation-management.ts

@@ -0,0 +1,29 @@
+import { and, eq, gt } from 'drizzle-orm'
+import { createError } from 'h3'
+import { invitationChangeSchema } from '../../shared/invitation-validation'
+import { db } from './db'
+import { invitation } from '../db/schema/auth-schema'
+
+export const changePendingInvitation = async (organizationId: string, invitationId: string, body: unknown) => {
+  const parsed = invitationChangeSchema.safeParse(body)
+  if (!parsed.success) {
+    throw createError({ statusCode: 400, message: 'Invalid invitation change' })
+  }
+  const change = parsed.data
+  const [updated] = await db
+    .update(invitation)
+    .set(change)
+    .where(
+      and(
+        eq(invitation.id, invitationId),
+        eq(invitation.organizationId, organizationId),
+        eq(invitation.status, 'pending'),
+        'role' in change ? gt(invitation.expiresAt, new Date()) : undefined
+      )
+    )
+    .returning({ id: invitation.id })
+  if (!updated) {
+    throw createError({ statusCode: 409, message: 'Invitation is no longer pending or available' })
+  }
+  return { success: true }
+}