@objectstack/plugin-auth 6.0.0 → 6.2.0

package/dist/index.mjs

@@ -483,6 +483,7 @@ var AuthManager = class {
   async createAuthInstance() {
     const { betterAuth } = await import("better-auth");
     const plugins = await this.buildPluginList();
+    const passwordHasher = await this.resolvePasswordHasher();
     const betterAuthConfig = {
       // Base configuration
       secret: this.config.secret || this.generateSecret(),
@@ -542,6 +543,7 @@ var AuthManager = class {
       // Email and password configuration
       emailAndPassword: {
         enabled: this.config.emailAndPassword?.enabled ?? true,
+        ...passwordHasher ? { password: passwordHasher } : {},
         ...this.config.emailAndPassword?.disableSignUp != null ? { disableSignUp: this.config.emailAndPassword.disableSignUp } : {},
         ...this.config.emailAndPassword?.requireEmailVerification != null ? { requireEmailVerification: this.config.emailAndPassword.requireEmailVerification } : {},
         ...this.config.emailAndPassword?.minPasswordLength != null ? { minPasswordLength: this.config.emailAndPassword.minPasswordLength } : {},
@@ -658,6 +660,35 @@ var AuthManager = class {
     };
     return betterAuth(betterAuthConfig);
   }
+  /**
+   * Detect WebContainer (StackBlitz) and swap in a pure-JS scrypt hasher.
+   *
+   * better-auth defaults to `@better-auth/utils/password.node`, which calls
+   * `node:crypto.scrypt`. WebContainer polyfills that API incompletely and
+   * signup throws `TypeError: y.run is not a function`. The pure-JS variant
+   * at `@better-auth/utils/password` uses `@noble/hashes/scrypt` with
+   * identical params (N=16384, r=16, p=1, dkLen=64) and emits the same
+   * `{salt}:{keyHex}` format, so existing hashes remain verifiable.
+   *
+   * Returns `undefined` outside WebContainer so production deployments keep
+   * the native (fast) hasher and never load the JS fallback.
+   */
+  async resolvePasswordHasher() {
+    const isWebContainer = typeof globalThis !== "undefined" && (Boolean(globalThis.process?.versions?.webcontainer) || Boolean(globalThis.process?.env?.SHELL?.includes?.("jsh")) || Boolean(globalThis.process?.env?.STACKBLITZ));
+    if (!isWebContainer) return void 0;
+    try {
+      const mod = await import("@better-auth/utils/password");
+      return {
+        hash: (password) => mod.hashPassword(password),
+        verify: ({ hash, password }) => mod.verifyPassword(hash, password)
+      };
+    } catch (err) {
+      console.warn(
+        `[AuthManager] WebContainer detected but pure-JS password hasher unavailable: ${err?.message ?? err}. Falling back to default.`
+      );
+      return void 0;
+    }
+  }
   /**
    * Build the list of better-auth plugins based on AuthPluginConfig flags.
    *