@objectstack/plugin-auth 6.7.0 → 6.8.0

package/dist/index.mjs

@@ -1,6 +1,7 @@
 // src/auth-plugin.ts
 import {
   SETUP_APP,
+  STUDIO_APP,
   SystemOverviewDashboard,
   SetupAppTranslations
 } from "@objectstack/platform-objects/apps";
@@ -527,6 +528,7 @@ var AuthManager = class {
    */
   async createAuthInstance() {
     const { betterAuth } = await import("better-auth");
+    const { createAuthMiddleware } = await import("better-auth/api");
     const plugins = await this.buildPluginList();
     const passwordHasher = await this.resolvePasswordHasher();
     const betterAuthConfig = {
@@ -585,46 +587,55 @@ var AuthManager = class {
       },
       // Social / OAuth providers
       ...this.config.socialProviders ? { socialProviders: this.config.socialProviders } : {},
-      // Email and password configuration
-      emailAndPassword: {
-        enabled: this.config.emailAndPassword?.enabled ?? true,
-        ...passwordHasher ? { password: passwordHasher } : {},
-        ...this.config.emailAndPassword?.disableSignUp != null ? { disableSignUp: this.config.emailAndPassword.disableSignUp } : {},
-        ...this.config.emailAndPassword?.requireEmailVerification != null ? { requireEmailVerification: this.config.emailAndPassword.requireEmailVerification } : {},
-        ...this.config.emailAndPassword?.minPasswordLength != null ? { minPasswordLength: this.config.emailAndPassword.minPasswordLength } : {},
-        ...this.config.emailAndPassword?.maxPasswordLength != null ? { maxPasswordLength: this.config.emailAndPassword.maxPasswordLength } : {},
-        ...this.config.emailAndPassword?.resetPasswordTokenExpiresIn != null ? { resetPasswordTokenExpiresIn: this.config.emailAndPassword.resetPasswordTokenExpiresIn } : {},
-        ...this.config.emailAndPassword?.autoSignIn != null ? { autoSignIn: this.config.emailAndPassword.autoSignIn } : {},
-        ...this.config.emailAndPassword?.revokeSessionsOnPasswordReset != null ? { revokeSessionsOnPasswordReset: this.config.emailAndPassword.revokeSessionsOnPasswordReset } : {},
-        sendResetPassword: async ({ user, url, token }) => {
-          const email = this.getEmailService();
-          if (!email) {
-            console.warn(
-              `[AuthManager] Password-reset requested for ${user.email} but no email service is wired. URL: ${url}`
-            );
-            return;
-          }
-          const ttlSec = this.config.emailAndPassword?.resetPasswordTokenExpiresIn ?? 60 * 60;
-          try {
-            await email.sendTemplate({
-              template: "auth.password_reset",
-              to: { address: user.email, ...user.name ? { name: user.name } : {} },
-              data: {
-                user: { name: user.name || user.email, email: user.email, id: user.id },
-                resetUrl: url,
-                token,
-                expiresInMinutes: Math.round(ttlSec / 60),
-                appName: this.getAppName()
-              },
-              relatedObject: "sys_user",
-              relatedId: user.id
-            });
-          } catch (err) {
-            console.error(`[AuthManager] sendResetPassword failed: ${err?.message ?? err}`);
-            throw err;
+      // Email and password configuration.
+      // `disableSignUp`: the env var `OS_DISABLE_SIGNUP=true` overrides
+      // the config-file value so deployments can flip the toggle without
+      // a code change (`getPublicConfig()` applies the same precedence so
+      // `/auth/config` stays consistent with the server enforcement).
+      emailAndPassword: (() => {
+        const disableSignUpEnv = globalThis?.process?.env?.OS_DISABLE_SIGNUP;
+        const disableSignUpFromEnv = disableSignUpEnv != null ? String(disableSignUpEnv).toLowerCase() === "true" : void 0;
+        const effectiveDisableSignUp = disableSignUpFromEnv ?? this.config.emailAndPassword?.disableSignUp;
+        return {
+          enabled: this.config.emailAndPassword?.enabled ?? true,
+          ...passwordHasher ? { password: passwordHasher } : {},
+          ...effectiveDisableSignUp != null ? { disableSignUp: effectiveDisableSignUp } : {},
+          ...this.config.emailAndPassword?.requireEmailVerification != null ? { requireEmailVerification: this.config.emailAndPassword.requireEmailVerification } : {},
+          ...this.config.emailAndPassword?.minPasswordLength != null ? { minPasswordLength: this.config.emailAndPassword.minPasswordLength } : {},
+          ...this.config.emailAndPassword?.maxPasswordLength != null ? { maxPasswordLength: this.config.emailAndPassword.maxPasswordLength } : {},
+          ...this.config.emailAndPassword?.resetPasswordTokenExpiresIn != null ? { resetPasswordTokenExpiresIn: this.config.emailAndPassword.resetPasswordTokenExpiresIn } : {},
+          ...this.config.emailAndPassword?.autoSignIn != null ? { autoSignIn: this.config.emailAndPassword.autoSignIn } : {},
+          ...this.config.emailAndPassword?.revokeSessionsOnPasswordReset != null ? { revokeSessionsOnPasswordReset: this.config.emailAndPassword.revokeSessionsOnPasswordReset } : {},
+          sendResetPassword: async ({ user, url, token }) => {
+            const email = this.getEmailService();
+            if (!email) {
+              console.warn(
+                `[AuthManager] Password-reset requested for ${user.email} but no email service is wired. URL: ${url}`
+              );
+              return;
+            }
+            const ttlSec = this.config.emailAndPassword?.resetPasswordTokenExpiresIn ?? 60 * 60;
+            try {
+              await email.sendTemplate({
+                template: "auth.password_reset",
+                to: { address: user.email, ...user.name ? { name: user.name } : {} },
+                data: {
+                  user: { name: user.name || user.email, email: user.email, id: user.id },
+                  resetUrl: url,
+                  token,
+                  expiresInMinutes: Math.round(ttlSec / 60),
+                  appName: this.getAppName()
+                },
+                relatedObject: "sys_user",
+                relatedId: user.id
+              });
+            } catch (err) {
+              console.error(`[AuthManager] sendResetPassword failed: ${err?.message ?? err}`);
+              throw err;
+            }
           }
-        }
-      },
+        };
+      })(),
       // Email verification
       ...this.config.emailVerification || this.config.emailService ? {
         emailVerification: {
@@ -676,6 +687,38 @@ var AuthManager = class {
       // for SSO JIT-provisioning too, unlike kernel-level ObjectQL
       // middleware which better-auth's adapter bypasses).
       ...this.config.databaseHooks ? { databaseHooks: this.config.databaseHooks } : {},
+      // Bootstrap bypass for `disableSignUp`. The first-run owner wizard
+      // (`/_account/setup`) calls `POST /auth/sign-up/email` to create
+      // the very first user — if `OS_DISABLE_SIGNUP=true` is set on a
+      // fresh install we'd lock the operator out of their own instance.
+      // Solution: when the request hits `/sign-up/email` AND no users
+      // exist yet, temporarily flip `disableSignUp` off for *this*
+      // request's context. Once the owner is created the next request
+      // sees `userCount > 0` and the toggle is enforced again.
+      hooks: {
+        before: createAuthMiddleware(async (ctx) => {
+          if (ctx?.path !== "/sign-up/email") return;
+          const ep = ctx?.context?.options?.emailAndPassword;
+          if (!ep?.disableSignUp) return;
+          try {
+            const adapter = ctx.context.adapter;
+            const existing = await adapter.findOne({ model: "user", where: [] });
+            if (!existing) {
+              ctx.context.__osDisableSignUpOrig = ep.disableSignUp;
+              ep.disableSignUp = false;
+            }
+          } catch {
+          }
+        }),
+        after: createAuthMiddleware(async (ctx) => {
+          if (ctx?.path !== "/sign-up/email") return;
+          const ep = ctx?.context?.options?.emailAndPassword;
+          if (ep && ctx.context.__osDisableSignUpOrig !== void 0) {
+            ep.disableSignUp = ctx.context.__osDisableSignUpOrig;
+            delete ctx.context.__osDisableSignUpOrig;
+          }
+        })
+      },
       // Trusted origins for CSRF protection (supports wildcards like "https://*.example.com")
       // Auto-includes origins from CORS_ORIGIN env var so CORS and CSRF stay in sync.
       ...(() => {
@@ -830,6 +873,22 @@ var AuthManager = class {
         // never seed `sys_environment`) keep working: any lookup error
         // is treated as "no envs to protect".
         organizationHooks: {
+          // Gate fresh organization creation behind `OS_MULTI_ORG_ENABLED`.
+          // The plugin itself is always installed (so list/update/invite endpoints
+          // keep responding); only the `create` operation is denied when the
+          // deployment is provisioned in single-org mode. Default is enabled
+          // to preserve historical behaviour.
+          beforeCreateOrganization: async () => {
+            const flag = String(
+              globalThis?.process?.env?.OS_MULTI_ORG_ENABLED ?? "true"
+            ).toLowerCase();
+            if (flag === "false") {
+              const { APIError } = await import("better-auth/api");
+              throw new APIError("FORBIDDEN", {
+                message: "Creating additional organizations is disabled on this deployment."
+              });
+            }
+          },
           beforeUpdateOrganization: async ({ organization: organization2, member }) => {
             const newSlug = organization2?.slug;
             const orgId = member?.organizationId;
@@ -1203,20 +1262,40 @@ var AuthManager = class {
       }
     }
     const emailPasswordConfig = this.config.emailAndPassword ?? {};
+    const disableSignUpEnv = globalThis?.process?.env?.OS_DISABLE_SIGNUP;
+    const disableSignUpFromEnv = disableSignUpEnv != null ? String(disableSignUpEnv).toLowerCase() === "true" : void 0;
     const emailPassword = {
       enabled: emailPasswordConfig.enabled !== false,
       // Default to true
-      disableSignUp: emailPasswordConfig.disableSignUp ?? false,
+      disableSignUp: disableSignUpFromEnv ?? emailPasswordConfig.disableSignUp ?? false,
       requireEmailVerification: emailPasswordConfig.requireEmailVerification ?? false
     };
     const pluginConfig = this.config.plugins ?? {};
+    const multiOrgEnabled = String(
+      globalThis?.process?.env?.OS_MULTI_ORG_ENABLED ?? "true"
+    ).toLowerCase() !== "false";
+    const DEFAULT_TERMS_URL = "https://objectstack.ai/terms";
+    const DEFAULT_PRIVACY_URL = "https://objectstack.ai/privacy";
+    const rawTermsUrl = globalThis?.process?.env?.OS_TERMS_URL;
+    const rawPrivacyUrl = globalThis?.process?.env?.OS_PRIVACY_URL;
+    const resolveLegalUrl = (raw, fallback) => {
+      if (typeof raw !== "string") return fallback;
+      const trimmed = raw.trim();
+      if (trimmed === "") return void 0;
+      return trimmed;
+    };
+    const termsUrl = resolveLegalUrl(rawTermsUrl, DEFAULT_TERMS_URL);
+    const privacyUrl = resolveLegalUrl(rawPrivacyUrl, DEFAULT_PRIVACY_URL);
     const features = {
       twoFactor: pluginConfig.twoFactor ?? false,
       passkeys: pluginConfig.passkeys ?? false,
       magicLink: pluginConfig.magicLink ?? false,
       organization: pluginConfig.organization ?? true,
+      multiOrgEnabled,
       oidcProvider: pluginConfig.oidcProvider ?? false,
-      deviceAuthorization: pluginConfig.deviceAuthorization ?? false
+      deviceAuthorization: pluginConfig.deviceAuthorization ?? false,
+      ...termsUrl ? { termsUrl } : {},
+      ...privacyUrl ? { privacyUrl } : {}
     };
     return {
       emailPassword,
@@ -1324,7 +1403,7 @@ var AuthPlugin = class {
       // @objectstack/platform-objects/apps). plugin-auth is the natural
       // owner of its registration since it loads first among the trio
       // (auth + security + audit) that supplies the underlying objects.
-      apps: [SETUP_APP],
+      apps: [SETUP_APP, STUDIO_APP],
       // List views for each Setup-nav object are defined on the schema
       // itself via the canonical `listViews` map (e.g.
       // sys_user.listViews.{all_users,unverified,two_factor}). Registering