@objectstack/plugin-auth 7.1.0 → 7.2.1

package/dist/index.mjs

@@ -7,6 +7,9 @@ import {
 } from "@objectstack/platform-objects/apps";
 import { SysOrganizationDetailPage, SysUserDetailPage } from "@objectstack/platform-objects/pages";
 
+// src/auth-manager.ts
+import { readEnvWithDeprecation } from "@objectstack/types";
+
 // src/objectql-adapter.ts
 import { createAdapterFactory } from "better-auth/adapters";
 import { SystemObjectName } from "@objectstack/spec/system";
@@ -719,10 +722,10 @@ var AuthManager = class {
         })
       },
       // Trusted origins for CSRF protection (supports wildcards like "https://*.example.com")
-      // Auto-includes origins from CORS_ORIGIN env var so CORS and CSRF stay in sync.
+      // Auto-includes origins from OS_CORS_ORIGIN env var so CORS and CSRF stay in sync.
       ...(() => {
         const origins = [...this.config.trustedOrigins || []];
-        const corsOrigin = process.env.CORS_ORIGIN;
+        const corsOrigin = readEnvWithDeprecation("OS_CORS_ORIGIN", "CORS_ORIGIN");
         if (corsOrigin && corsOrigin !== "*") {
           corsOrigin.split(",").map((s) => s.trim()).filter(Boolean).forEach((o) => {
             if (!origins.includes(o)) origins.push(o);
@@ -884,9 +887,8 @@ var AuthManager = class {
           beforeCreateOrganization: async () => {
             const env = globalThis?.process?.env ?? {};
             const explicit = env.OS_MULTI_ORG_ENABLED;
-            const flag = String(
-              explicit ?? env.OS_MULTI_TENANT ?? "false"
-            ).toLowerCase();
+            const legacy = explicit === void 0 ? readEnvWithDeprecation("OS_MULTI_ORG_ENABLED", "OS_MULTI_TENANT") : explicit;
+            const flag = String(legacy ?? "false").toLowerCase();
             if (flag === "false") {
               const { APIError } = await import("better-auth/api");
               throw new APIError("FORBIDDEN", {
@@ -1028,18 +1030,22 @@ var AuthManager = class {
       plugins.push(jwt({ schema: buildJwtPluginSchema() }));
       const { oauthProvider } = await import("@better-auth/oauth-provider");
       const baseUrl = (this.config.baseUrl ?? "").replace(/\/$/, "");
+      const uiBase = (this.config.uiBasePath ?? "/_console").replace(/\/$/, "");
       plugins.push(oauthProvider({
-        // Account SPA renders both pages — see apps/account.
-        loginPage: `${baseUrl}/_account/login`,
-        consentPage: `${baseUrl}/_account/oauth/consent`,
+        // Console SPA renders both pages (replaces the legacy Account SPA at
+        // /_account). Override `uiBasePath` in AuthConfig if Console is
+        // mounted elsewhere.
+        loginPage: `${baseUrl}${uiBase}/login`,
+        consentPage: `${baseUrl}${uiBase}/oauth/consent`,
         schema: buildOauthProviderPluginSchema()
       }));
     }
     if (enabled.deviceAuthorization) {
       const { deviceAuthorization } = await import("better-auth/plugins/device-authorization");
       const baseUrl = (this.config.baseUrl ?? "").replace(/\/$/, "");
+      const uiBase = (this.config.uiBasePath ?? "/_console").replace(/\/$/, "");
       plugins.push(deviceAuthorization({
-        verificationUri: `${baseUrl}/_account/auth/device`,
+        verificationUri: `${baseUrl}${uiBase}/auth/device`,
         schema: buildDeviceAuthorizationPluginSchema()
       }));
     }
@@ -1119,11 +1125,11 @@ var AuthManager = class {
    * Generate a secure secret if not provided
    */
   generateSecret() {
-    const envSecret = process.env.AUTH_SECRET;
+    const envSecret = readEnvWithDeprecation("OS_AUTH_SECRET", ["AUTH_SECRET", "BETTER_AUTH_SECRET"]);
     if (!envSecret) {
       const fallbackSecret = "dev-secret-" + Date.now();
       console.warn(
-        "\u26A0\uFE0F  WARNING: No AUTH_SECRET environment variable set! Using a temporary development secret. This is NOT secure for production use. Please set AUTH_SECRET in your environment variables."
+        "\u26A0\uFE0F  WARNING: No OS_AUTH_SECRET environment variable set! Using a temporary development secret. This is NOT secure for production use. Please set OS_AUTH_SECRET in your environment variables."
       );
       return fallbackSecret;
     }
@@ -1276,9 +1282,8 @@ var AuthManager = class {
     };
     const pluginConfig = this.config.plugins ?? {};
     const multiOrgEnv = globalThis?.process?.env ?? {};
-    const multiOrgEnabled = String(
-      multiOrgEnv.OS_MULTI_ORG_ENABLED ?? multiOrgEnv.OS_MULTI_TENANT ?? "false"
-    ).toLowerCase() !== "false";
+    const multiOrgRaw = multiOrgEnv.OS_MULTI_ORG_ENABLED !== void 0 ? multiOrgEnv.OS_MULTI_ORG_ENABLED : readEnvWithDeprecation("OS_MULTI_ORG_ENABLED", "OS_MULTI_TENANT") ?? "false";
+    const multiOrgEnabled = String(multiOrgRaw).toLowerCase() !== "false";
     const DEFAULT_TERMS_URL = "https://objectstack.ai/terms";
     const DEFAULT_PRIVACY_URL = "https://objectstack.ai/privacy";
     const rawTermsUrl = globalThis?.process?.env?.OS_TERMS_URL;