@openora/core 0.4.0 → 0.4.1-canary.100

package/dist/server/auth/__tests__/permission-levels.test.js

@@ -0,0 +1,89 @@
+import { describe, it, expect } from 'vitest';
+import { levelRank, isLevelSufficient, levelToActions, actionsToLevel, PERMISSION_LEVELS, } from '../permission-levels.js';
+import { statement } from '../permissions.js';
+describe('levelRank', () => {
+    it('orders the levels from no_access up to read_write', () => {
+        expect(PERMISSION_LEVELS.map(levelRank)).toEqual([0, 1, 2]);
+    });
+    it('ranks an unknown level below every real one so it can never satisfy a check', () => {
+        expect(levelRank('owner')).toBe(-1);
+    });
+});
+describe('isLevelSufficient', () => {
+    it.each([
+        ['no_access', 'no_access', true],
+        ['no_access', 'read', false],
+        ['no_access', 'read_write', false],
+        ['read', 'no_access', true],
+        ['read', 'read', true],
+        ['read', 'read_write', false],
+        ['read_write', 'no_access', true],
+        ['read_write', 'read', true],
+        ['read_write', 'read_write', true],
+    ])('%s covering %s is %s', (have, required, expected) => {
+        expect(isLevelSufficient(have, required)).toBe(expected);
+    });
+    it('refuses to escalate an unknown level', () => {
+        expect(isLevelSufficient('owner', 'read')).toBe(false);
+    });
+});
+describe('levelToActions', () => {
+    it('grants nothing at no_access, whatever the resource', () => {
+        for (const resource of Object.keys(statement)) {
+            expect(levelToActions(resource, 'no_access')).toEqual([]);
+        }
+    });
+    it('grants every declared action at read_write', () => {
+        for (const [resource, actions] of Object.entries(statement)) {
+            expect(levelToActions(resource, 'read_write')).toEqual(actions);
+        }
+    });
+    it('grants only view at read', () => {
+        expect(levelToActions('player', 'read')).toEqual(['view']);
+        expect(levelToActions('withdrawal', 'read')).toEqual(['view']);
+    });
+    it('grants nothing at read for a resource that declares no view action', () => {
+        expect(statement.content).not.toContain('view');
+        expect(levelToActions('content', 'read')).toEqual([]);
+    });
+    it.each(PERMISSION_LEVELS)('grants nothing on an unknown resource at %s', (level) => {
+        expect(levelToActions('tournaments', level)).toEqual([]);
+    });
+    it('never returns an action the resource does not declare', () => {
+        for (const [resource, actions] of Object.entries(statement)) {
+            for (const level of PERMISSION_LEVELS) {
+                expect(actions).toEqual(expect.arrayContaining([...levelToActions(resource, level)]));
+            }
+        }
+    });
+});
+describe('actionsToLevel', () => {
+    it('round-trips every level for every resource that can express it', () => {
+        for (const [resource, actions] of Object.entries(statement)) {
+            const viewOnlyResource = actions.length === 1 && actions[0] === 'view';
+            for (const level of PERMISSION_LEVELS) {
+                const granted = levelToActions(resource, level);
+                const expected = granted.length === 0 ? 'no_access' : viewOnlyResource ? 'read_write' : level;
+                expect(actionsToLevel(resource, granted)).toBe(expected);
+            }
+        }
+    });
+    it('cannot tell read from read_write on a resource whose only action is view', () => {
+        expect(statement.report).toEqual(['view']);
+        expect(actionsToLevel('report', ['view'])).toBe('read_write');
+    });
+    it('collapses a partial action set down, never up', () => {
+        expect(actionsToLevel('player', ['view', 'update'])).toBe('read');
+        expect(actionsToLevel('player', ['update', 'ban'])).toBe('no_access');
+    });
+    it('reports no_access for an unknown resource', () => {
+        expect(actionsToLevel('tournaments', ['view'])).toBe('no_access');
+    });
+    it('reports no_access for an empty action set', () => {
+        expect(actionsToLevel('player', [])).toBe('no_access');
+    });
+    it('ignores actions the resource does not declare', () => {
+        expect(actionsToLevel('report', ['view', 'delete-everything'])).toBe('read_write');
+    });
+});
+//# sourceMappingURL=permission-levels.test.js.map

package/dist/server/auth/__tests__/permission-levels.test.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"permission-levels.test.js","sourceRoot":"","sources":["../../../../src/server/auth/__tests__/permission-levels.test.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,EAAE,EAAE,MAAM,EAAE,MAAM,QAAQ,CAAC;AAC9C,OAAO,EACL,SAAS,EACT,iBAAiB,EACjB,cAAc,EACd,cAAc,EACd,iBAAiB,GAElB,MAAM,yBAAyB,CAAC;AACjC,OAAO,EAAE,SAAS,EAAE,MAAM,mBAAmB,CAAC;AAE9C,QAAQ,CAAC,WAAW,EAAE,GAAG,EAAE;IACzB,EAAE,CAAC,mDAAmD,EAAE,GAAG,EAAE;QAC3D,MAAM,CAAC,iBAAiB,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;IAC9D,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,6EAA6E,EAAE,GAAG,EAAE;QACrF,MAAM,CAAC,SAAS,CAAC,OAA0B,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC;IACzD,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC;AAEH,QAAQ,CAAC,mBAAmB,EAAE,GAAG,EAAE;IACjC,EAAE,CAAC,IAAI,CAAC;QACN,CAAC,WAAW,EAAE,WAAW,EAAE,IAAI,CAAC;QAChC,CAAC,WAAW,EAAE,MAAM,EAAE,KAAK,CAAC;QAC5B,CAAC,WAAW,EAAE,YAAY,EAAE,KAAK,CAAC;QAClC,CAAC,MAAM,EAAE,WAAW,EAAE,IAAI,CAAC;QAC3B,CAAC,MAAM,EAAE,MAAM,EAAE,IAAI,CAAC;QACtB,CAAC,MAAM,EAAE,YAAY,EAAE,KAAK,CAAC;QAC7B,CAAC,YAAY,EAAE,WAAW,EAAE,IAAI,CAAC;QACjC,CAAC,YAAY,EAAE,MAAM,EAAE,IAAI,CAAC;QAC5B,CAAC,YAAY,EAAE,YAAY,EAAE,IAAI,CAAC;KAC1B,CAAC,CAAC,sBAAsB,EAAE,CAAC,IAAI,EAAE,QAAQ,EAAE,QAAQ,EAAE,EAAE;QAC/D,MAAM,CAAC,iBAAiB,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;IAC3D,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,sCAAsC,EAAE,GAAG,EAAE;QAC9C,MAAM,CAAC,iBAAiB,CAAC,OAA0B,EAAE,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IAC5E,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC;AAEH,QAAQ,CAAC,gBAAgB,EAAE,GAAG,EAAE;IAC9B,EAAE,CAAC,oDAAoD,EAAE,GAAG,EAAE;QAC5D,KAAK,MAAM,QAAQ,IAAI,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,CAAC;YAC9C,MAAM,CAAC,cAAc,CAAC,QAAQ,EAAE,WAAW,CAAC,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;QAC5D,CAAC;IACH,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,4CAA4C,EAAE,GAAG,EAAE;QACpD,KAAK,MAAM,CAAC,QAAQ,EAAE,OAAO,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,SAAS,CAAC,EAAE,CAAC;YAC5D,MAAM,CAAC,cAAc,CAAC,QAAQ,EAAE,YAAY,CAAC,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;QAClE,CAAC;IACH,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,0BAA0B,EAAE,GAAG,EAAE;QAClC,MAAM,CAAC,cAAc,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC;QAC3D,MAAM,CAAC,cAAc,CAAC,YAAY,EAAE,MAAM,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC;IACjE,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,oEAAoE,EAAE,GAAG,EAAE;QAC5E,MAAM,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC,GAAG,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC;QAChD,MAAM,CAAC,cAAc,CAAC,SAAS,EAAE,MAAM,CAAC,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;IACxD,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,IAAI,CAAC,iBAAiB,CAAC,CAAC,6CAA6C,EAAE,CAAC,KAAK,EAAE,EAAE;QAClF,MAAM,CAAC,cAAc,CAAC,aAAa,EAAE,KAAK,CAAC,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;IAC3D,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,uDAAuD,EAAE,GAAG,EAAE;QAC/D,KAAK,MAAM,CAAC,QAAQ,EAAE,OAAO,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,SAAS,CAAC,EAAE,CAAC;YAC5D,KAAK,MAAM,KAAK,IAAI,iBAAiB,EAAE,CAAC;gBACtC,MAAM,CAAC,OAAO,CAAC,CAAC,OAAO,CAAC,MAAM,CAAC,eAAe,CAAC,CAAC,GAAG,cAAc,CAAC,QAAQ,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;YACxF,CAAC;QACH,CAAC;IACH,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC;AAEH,QAAQ,CAAC,gBAAgB,EAAE,GAAG,EAAE;IAC9B,EAAE,CAAC,gEAAgE,EAAE,GAAG,EAAE;QACxE,KAAK,MAAM,CAAC,QAAQ,EAAE,OAAO,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,SAAS,CAAC,EAAE,CAAC;YAC5D,MAAM,gBAAgB,GAAG,OAAO,CAAC,MAAM,KAAK,CAAC,IAAI,OAAO,CAAC,CAAC,CAAC,KAAK,MAAM,CAAC;YACvE,KAAK,MAAM,KAAK,IAAI,iBAAiB,EAAE,CAAC;gBACtC,MAAM,OAAO,GAAG,cAAc,CAAC,QAAQ,EAAE,KAAK,CAAC,CAAC;gBAChD,MAAM,QAAQ,GACZ,OAAO,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,gBAAgB,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,KAAK,CAAC;gBAC/E,MAAM,CAAC,cAAc,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;YAC3D,CAAC;QACH,CAAC;IACH,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,0EAA0E,EAAE,GAAG,EAAE;QAClF,MAAM,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,OAAO,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC;QAC3C,MAAM,CAAC,cAAc,CAAC,QAAQ,EAAE,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC;IAChE,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,+CAA+C,EAAE,GAAG,EAAE;QACvD,MAAM,CAAC,cAAc,CAAC,QAAQ,EAAE,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QAClE,MAAM,CAAC,cAAc,CAAC,QAAQ,EAAE,CAAC,QAAQ,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;IACxE,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,2CAA2C,EAAE,GAAG,EAAE;QACnD,MAAM,CAAC,cAAc,CAAC,aAAa,EAAE,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;IACpE,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,2CAA2C,EAAE,GAAG,EAAE;QACnD,MAAM,CAAC,cAAc,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;IACzD,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,+CAA+C,EAAE,GAAG,EAAE;QACvD,MAAM,CAAC,cAAc,CAAC,QAAQ,EAAE,CAAC,MAAM,EAAE,mBAAmB,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC;IACrF,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC"}

package/dist/server/auth/__tests__/session-resolver.int.test.d.ts

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=session-resolver.int.test.d.ts.map

package/dist/server/auth/__tests__/session-resolver.int.test.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"session-resolver.int.test.d.ts","sourceRoot":"","sources":["../../../../src/server/auth/__tests__/session-resolver.int.test.ts"],"names":[],"mappings":""}

package/dist/server/auth/__tests__/session-resolver.int.test.js

@@ -0,0 +1,59 @@
+import { describe, it, expect, vi, beforeAll, afterAll, beforeEach } from 'vitest';
+import { randomUUID } from 'node:crypto';
+import { createTestDb } from '@openora/core/testing';
+import { SessionResolver } from '../session-resolver.js';
+const { createAuthMock, getSessionMock } = vi.hoisted(() => ({
+    createAuthMock: vi.fn(),
+    getSessionMock: vi.fn(),
+}));
+vi.mock('../auth.js', () => ({
+    createAuth: createAuthMock.mockImplementation(() => ({
+        api: { getSession: getSessionMock },
+    })),
+}));
+let db;
+beforeAll(async () => {
+    db = await createTestDb([]);
+});
+afterAll(async () => {
+    await db.drop();
+});
+beforeEach(() => {
+    createAuthMock.mockClear();
+    getSessionMock.mockClear();
+    getSessionMock.mockResolvedValue(null);
+});
+describe('SessionResolver (real PG-backed drizzle)', () => {
+    it('hands the drizzle db and the injected schema to better-auth exactly once', () => {
+        const schema = { session: {} };
+        new SessionResolver(db.drizzle, schema);
+        expect(createAuthMock).toHaveBeenCalledTimes(1);
+        expect(createAuthMock).toHaveBeenCalledWith({ db: db.drizzle.db, schema });
+    });
+    it('omits the schema key when none is injected', () => {
+        new SessionResolver(db.drizzle);
+        expect(createAuthMock).toHaveBeenCalledWith({ db: db.drizzle.db });
+    });
+    it('returns undefined when there is no session', async () => {
+        const resolver = new SessionResolver(db.drizzle);
+        expect(await resolver.resolveUserId(new Headers())).toBeUndefined();
+    });
+    it('returns the user id when a session resolves', async () => {
+        const userId = randomUUID();
+        getSessionMock.mockResolvedValueOnce({ user: { id: userId } });
+        const resolver = new SessionResolver(db.drizzle);
+        expect(await resolver.resolveUserId(new Headers())).toBe(userId);
+    });
+    it('forwards the caller headers to better-auth', async () => {
+        const resolver = new SessionResolver(db.drizzle);
+        const headers = new Headers({ cookie: 'session=abc' });
+        await resolver.resolveUserId(headers);
+        expect(getSessionMock).toHaveBeenCalledWith({ headers });
+    });
+    it('returns undefined for a session without a user', async () => {
+        getSessionMock.mockResolvedValueOnce({});
+        const resolver = new SessionResolver(db.drizzle);
+        expect(await resolver.resolveUserId(new Headers())).toBeUndefined();
+    });
+});
+//# sourceMappingURL=session-resolver.int.test.js.map

package/dist/server/auth/__tests__/session-resolver.int.test.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"session-resolver.int.test.js","sourceRoot":"","sources":["../../../../src/server/auth/__tests__/session-resolver.int.test.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,EAAE,EAAE,MAAM,EAAE,EAAE,EAAE,SAAS,EAAE,QAAQ,EAAE,UAAU,EAAE,MAAM,QAAQ,CAAC;AACnF,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,YAAY,EAAe,MAAM,uBAAuB,CAAC;AAClE,OAAO,EAAE,eAAe,EAAE,MAAM,wBAAwB,CAAC;AAEzD,MAAM,EAAE,cAAc,EAAE,cAAc,EAAE,GAAG,EAAE,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC,CAAC;IAC3D,cAAc,EAAE,EAAE,CAAC,EAAE,EAAE;IACvB,cAAc,EAAE,EAAE,CAAC,EAAE,EAAE;CACxB,CAAC,CAAC,CAAC;AAEJ,EAAE,CAAC,IAAI,CAAC,YAAY,EAAE,GAAG,EAAE,CAAC,CAAC;IAC3B,UAAU,EAAE,cAAc,CAAC,kBAAkB,CAAC,GAAG,EAAE,CAAC,CAAC;QACnD,GAAG,EAAE,EAAE,UAAU,EAAE,cAAc,EAAE;KACpC,CAAC,CAAC;CACJ,CAAC,CAAC,CAAC;AAEJ,IAAI,EAAU,CAAC;AAEf,SAAS,CAAC,KAAK,IAAI,EAAE;IACnB,EAAE,GAAG,MAAM,YAAY,CAAC,EAAE,CAAC,CAAC;AAC9B,CAAC,CAAC,CAAC;AAEH,QAAQ,CAAC,KAAK,IAAI,EAAE;IAClB,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC;AAClB,CAAC,CAAC,CAAC;AAEH,UAAU,CAAC,GAAG,EAAE;IACd,cAAc,CAAC,SAAS,EAAE,CAAC;IAC3B,cAAc,CAAC,SAAS,EAAE,CAAC;IAC3B,cAAc,CAAC,iBAAiB,CAAC,IAAI,CAAC,CAAC;AACzC,CAAC,CAAC,CAAC;AAEH,QAAQ,CAAC,0CAA0C,EAAE,GAAG,EAAE;IACxD,EAAE,CAAC,0EAA0E,EAAE,GAAG,EAAE;QAClF,MAAM,MAAM,GAAG,EAAE,OAAO,EAAE,EAAE,EAAE,CAAC;QAE/B,IAAI,eAAe,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;QAExC,MAAM,CAAC,cAAc,CAAC,CAAC,qBAAqB,CAAC,CAAC,CAAC,CAAC;QAChD,MAAM,CAAC,cAAc,CAAC,CAAC,oBAAoB,CAAC,EAAE,EAAE,EAAE,EAAE,CAAC,OAAO,CAAC,EAAE,EAAE,MAAM,EAAE,CAAC,CAAC;IAC7E,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,4CAA4C,EAAE,GAAG,EAAE;QACpD,IAAI,eAAe,CAAC,EAAE,CAAC,OAAO,CAAC,CAAC;QAEhC,MAAM,CAAC,cAAc,CAAC,CAAC,oBAAoB,CAAC,EAAE,EAAE,EAAE,EAAE,CAAC,OAAO,CAAC,EAAE,EAAE,CAAC,CAAC;IACrE,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,4CAA4C,EAAE,KAAK,IAAI,EAAE;QAC1D,MAAM,QAAQ,GAAG,IAAI,eAAe,CAAC,EAAE,CAAC,OAAO,CAAC,CAAC;QAEjD,MAAM,CAAC,MAAM,QAAQ,CAAC,aAAa,CAAC,IAAI,OAAO,EAAE,CAAC,CAAC,CAAC,aAAa,EAAE,CAAC;IACtE,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,6CAA6C,EAAE,KAAK,IAAI,EAAE;QAC3D,MAAM,MAAM,GAAG,UAAU,EAAE,CAAC;QAC5B,cAAc,CAAC,qBAAqB,CAAC,EAAE,IAAI,EAAE,EAAE,EAAE,EAAE,MAAM,EAAE,EAAE,CAAC,CAAC;QAC/D,MAAM,QAAQ,GAAG,IAAI,eAAe,CAAC,EAAE,CAAC,OAAO,CAAC,CAAC;QAEjD,MAAM,CAAC,MAAM,QAAQ,CAAC,aAAa,CAAC,IAAI,OAAO,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;IACnE,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,4CAA4C,EAAE,KAAK,IAAI,EAAE;QAC1D,MAAM,QAAQ,GAAG,IAAI,eAAe,CAAC,EAAE,CAAC,OAAO,CAAC,CAAC;QACjD,MAAM,OAAO,GAAG,IAAI,OAAO,CAAC,EAAE,MAAM,EAAE,aAAa,EAAE,CAAC,CAAC;QAEvD,MAAM,QAAQ,CAAC,aAAa,CAAC,OAAO,CAAC,CAAC;QAEtC,MAAM,CAAC,cAAc,CAAC,CAAC,oBAAoB,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC;IAC3D,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,gDAAgD,EAAE,KAAK,IAAI,EAAE;QAC9D,cAAc,CAAC,qBAAqB,CAAC,EAAE,CAAC,CAAC;QACzC,MAAM,QAAQ,GAAG,IAAI,eAAe,CAAC,EAAE,CAAC,OAAO,CAAC,CAAC;QAEjD,MAAM,CAAC,MAAM,QAAQ,CAAC,aAAa,CAAC,IAAI,OAAO,EAAE,CAAC,CAAC,CAAC,aAAa,EAAE,CAAC;IACtE,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC"}

package/dist/server/auth/__tests__/sign-session-cookie.test.d.ts

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=sign-session-cookie.test.d.ts.map

package/dist/server/auth/__tests__/sign-session-cookie.test.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sign-session-cookie.test.d.ts","sourceRoot":"","sources":["../../../../src/server/auth/__tests__/sign-session-cookie.test.ts"],"names":[],"mappings":""}

package/dist/server/auth/__tests__/sign-session-cookie.test.js

@@ -0,0 +1,59 @@
+import { describe, it, expect } from 'vitest';
+import { signSessionCookie } from '../sign-session-cookie.js';
+const SESSION_COOKIE = {
+    name: 'better-auth.session_token',
+    attributes: { httpOnly: true, secure: false, sameSite: 'lax', path: '/' },
+};
+describe('signSessionCookie', () => {
+    it('produces a signature matching a known-good vector', () => {
+        const cookie = signSessionCookie({
+            token: 'fixed-token-for-golden-vector',
+            sessionCookie: SESSION_COOKIE,
+            secret: 'unit-test-secret-do-not-use-in-prod',
+            maxAgeSeconds: 3600,
+        });
+        expect(cookie).toContain('better-auth.session_token=fixed-token-for-golden-vector.HUa0peblWWtfebbtuTmir7Km5kqZbRR2ZVIMnEP8BDQ%3D');
+    });
+    it('carries the cookie attributes and the given max-age', () => {
+        const cookie = signSessionCookie({
+            token: 't',
+            sessionCookie: SESSION_COOKIE,
+            secret: 's',
+            maxAgeSeconds: 86_400,
+        });
+        expect(cookie).toContain('Max-Age=86400');
+        expect(cookie).toContain('Path=/');
+        expect(cookie).toContain('HttpOnly');
+        expect(cookie).toContain('SameSite=Lax');
+        expect(cookie).not.toContain('Secure');
+    });
+    it('differs for different secrets, so a signature cannot be replayed across environments', () => {
+        const a = signSessionCookie({
+            token: 'same-token',
+            sessionCookie: SESSION_COOKIE,
+            secret: 'secret-a',
+            maxAgeSeconds: 60,
+        });
+        const b = signSessionCookie({
+            token: 'same-token',
+            sessionCookie: SESSION_COOKIE,
+            secret: 'secret-b',
+            maxAgeSeconds: 60,
+        });
+        expect(a).not.toBe(b);
+    });
+    it('omits Max-Age when no ttl is given, producing a real browser session cookie', () => {
+        const cookieWithInheritedDefault = {
+            name: 'better-auth.session_token',
+            attributes: { ...SESSION_COOKIE.attributes, maxAge: 7 * 24 * 60 * 60 },
+        };
+        const cookie = signSessionCookie({
+            token: 't',
+            sessionCookie: cookieWithInheritedDefault,
+            secret: 's',
+            maxAgeSeconds: undefined,
+        });
+        expect(cookie).not.toContain('Max-Age');
+    });
+});
+//# sourceMappingURL=sign-session-cookie.test.js.map

package/dist/server/auth/__tests__/sign-session-cookie.test.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sign-session-cookie.test.js","sourceRoot":"","sources":["../../../../src/server/auth/__tests__/sign-session-cookie.test.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,EAAE,EAAE,MAAM,EAAE,MAAM,QAAQ,CAAC;AAC9C,OAAO,EAAE,iBAAiB,EAAE,MAAM,2BAA2B,CAAC;AAE9D,MAAM,cAAc,GAAG;IACrB,IAAI,EAAE,2BAA2B;IACjC,UAAU,EAAE,EAAE,QAAQ,EAAE,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,QAAQ,EAAE,KAAc,EAAE,IAAI,EAAE,GAAG,EAAE;CACnF,CAAC;AAEF,QAAQ,CAAC,mBAAmB,EAAE,GAAG,EAAE;IACjC,EAAE,CAAC,mDAAmD,EAAE,GAAG,EAAE;QAC3D,MAAM,MAAM,GAAG,iBAAiB,CAAC;YAC/B,KAAK,EAAE,+BAA+B;YACtC,aAAa,EAAE,cAAc;YAC7B,MAAM,EAAE,qCAAqC;YAC7C,aAAa,EAAE,IAAI;SACpB,CAAC,CAAC;QAEH,MAAM,CAAC,MAAM,CAAC,CAAC,SAAS,CACtB,wGAAwG,CACzG,CAAC;IACJ,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,qDAAqD,EAAE,GAAG,EAAE;QAC7D,MAAM,MAAM,GAAG,iBAAiB,CAAC;YAC/B,KAAK,EAAE,GAAG;YACV,aAAa,EAAE,cAAc;YAC7B,MAAM,EAAE,GAAG;YACX,aAAa,EAAE,MAAM;SACtB,CAAC,CAAC;QAEH,MAAM,CAAC,MAAM,CAAC,CAAC,SAAS,CAAC,eAAe,CAAC,CAAC;QAC1C,MAAM,CAAC,MAAM,CAAC,CAAC,SAAS,CAAC,QAAQ,CAAC,CAAC;QACnC,MAAM,CAAC,MAAM,CAAC,CAAC,SAAS,CAAC,UAAU,CAAC,CAAC;QACrC,MAAM,CAAC,MAAM,CAAC,CAAC,SAAS,CAAC,cAAc,CAAC,CAAC;QACzC,MAAM,CAAC,MAAM,CAAC,CAAC,GAAG,CAAC,SAAS,CAAC,QAAQ,CAAC,CAAC;IACzC,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,sFAAsF,EAAE,GAAG,EAAE;QAC9F,MAAM,CAAC,GAAG,iBAAiB,CAAC;YAC1B,KAAK,EAAE,YAAY;YACnB,aAAa,EAAE,cAAc;YAC7B,MAAM,EAAE,UAAU;YAClB,aAAa,EAAE,EAAE;SAClB,CAAC,CAAC;QACH,MAAM,CAAC,GAAG,iBAAiB,CAAC;YAC1B,KAAK,EAAE,YAAY;YACnB,aAAa,EAAE,cAAc;YAC7B,MAAM,EAAE,UAAU;YAClB,aAAa,EAAE,EAAE;SAClB,CAAC,CAAC;QACH,MAAM,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IACxB,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,6EAA6E,EAAE,GAAG,EAAE;QACrF,MAAM,0BAA0B,GAAG;YACjC,IAAI,EAAE,2BAA2B;YACjC,UAAU,EAAE,EAAE,GAAG,cAAc,CAAC,UAAU,EAAE,MAAM,EAAE,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,EAAE;SACvE,CAAC;QAEF,MAAM,MAAM,GAAG,iBAAiB,CAAC;YAC/B,KAAK,EAAE,GAAG;YACV,aAAa,EAAE,0BAA0B;YACzC,MAAM,EAAE,GAAG;YACX,aAAa,EAAE,SAAS;SACzB,CAAC,CAAC;QAEH,MAAM,CAAC,MAAM,CAAC,CAAC,GAAG,CAAC,SAAS,CAAC,SAAS,CAAC,CAAC;IAC1C,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC"}

package/dist/server/auth/admin-guard.d.ts

@@ -1,23 +1,36 @@
-import { type Token, type AdminPermissionResolver } from '@openora/core/contracts';
+import { type Token, type AdminPermissionResolver, type IdentityReader, type ClientMeta } from '@openora/core/contracts';
 import { DrizzleService } from '../db/index.js';
 import { SessionResolver } from './session-resolver.js';
 import { type ResourceName, type ActionOf } from './permissions.js';
 import type { EventBus } from '../kernel/index.js';
 export declare const ADMIN_GUARD: Token<AdminGuard>;
+export type AdminCaller = {
+    userId: string;
+    role: string;
+} & ClientMeta;
+/**
+ * The single admin-enforcement point - every admin route calls `assert()` as its
+ * first line, never re-implementing the role check. Overload without
+ * `resource`/`action` only requires a valid admin session; the 3-arg overload
+ * additionally checks a specific permission. When the iam module's permission
+ * resolver is bound, DB-assigned grants are authoritative; when a role has no DB
+ * assignment row (the bootstrap path - seed admin), it falls back to the static
+ * role table instead of denying outright. A revoked-in-DB but still
+ * statically-granted role is NOT denied by this fallback - revoke the static role
+ * to fully lock a bootstrap admin out. Every denial emits
+ * `identity.user.unauthorized_access` for audit, before throwing.
+ */
 export declare class AdminGuard {
     private readonly drizzle;
     private readonly sessions;
     private readonly permissionResolver?;
     private readonly events?;
-    constructor(drizzle: DrizzleService, sessions: SessionResolver, permissionResolver?: AdminPermissionResolver | undefined, events?: EventBus | undefined);
-    assert(context: unknown): Promise<{
-        userId: string;
-        role: string;
-    }>;
-    assert<R extends ResourceName>(context: unknown, resource: R, action: ActionOf<R>): Promise<{
-        userId: string;
-        role: string;
-    }>;
+    private readonly identityReader?;
+    constructor(drizzle: DrizzleService, sessions: SessionResolver, permissionResolver?: AdminPermissionResolver | undefined, events?: EventBus | undefined, identityReader?: IdentityReader | undefined);
+    assert(context: unknown): Promise<AdminCaller>;
+    assert<R extends ResourceName>(context: unknown, resource: R, action: ActionOf<R>): Promise<AdminCaller>;
+    private resolveGrants;
+    private checkGrant;
     private emitUnauthorized;
 }
 //# sourceMappingURL=admin-guard.d.ts.map

package/dist/server/auth/admin-guard.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"admin-guard.d.ts","sourceRoot":"","sources":["../../../src/server/auth/admin-guard.ts"],"names":[],"mappings":"AACA,OAAO,EAAe,KAAK,KAAK,EAAE,KAAK,uBAAuB,EAAE,MAAM,yBAAyB,CAAC;AAChG,OAAO,EAAE,cAAc,EAAE,MAAM,gBAAgB,CAAC;AAEhD,OAAO,EAAE,eAAe,EAAE,MAAM,uBAAuB,CAAC;AACxD,OAAO,EAAS,KAAK,YAAY,EAAE,KAAK,QAAQ,EAAE,MAAM,kBAAkB,CAAC;AAC3E,OAAO,KAAK,EAAc,QAAQ,EAAE,MAAM,oBAAoB,CAAC;AAE/D,eAAO,MAAM,WAAW,EAAE,KAAK,CAAC,UAAU,CAA8B,CAAC;AAEzE,qBAAa,UAAU;IAGnB,OAAO,CAAC,QAAQ,CAAC,OAAO;IACxB,OAAO,CAAC,QAAQ,CAAC,QAAQ;IAEzB,OAAO,CAAC,QAAQ,CAAC,kBAAkB,CAAC;IACpC,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAC;gBAJP,OAAO,EAAE,cAAc,EACvB,QAAQ,EAAE,eAAe,EAEzB,kBAAkB,CAAC,EAAE,uBAAuB,YAAA,EAC5C,MAAM,CAAC,EAAE,QAAQ,YAAA;IAG9B,MAAM,CAAC,OAAO,EAAE,OAAO,GAAG,OAAO,CAAC;QAAE,MAAM,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAA;KAAE,CAAC;IACnE,MAAM,CAAC,CAAC,SAAS,YAAY,EACjC,OAAO,EAAE,OAAO,EAChB,QAAQ,EAAE,CAAC,EACX,MAAM,EAAE,QAAQ,CAAC,CAAC,CAAC,GAClB,OAAO,CAAC;QAAE,MAAM,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAA;KAAE,CAAC;IAwE5C,OAAO,CAAC,gBAAgB;CAmBzB"}
+{"version":3,"file":"admin-guard.d.ts","sourceRoot":"","sources":["../../../src/server/auth/admin-guard.ts"],"names":[],"mappings":"AACA,OAAO,EAGL,KAAK,KAAK,EACV,KAAK,uBAAuB,EAE5B,KAAK,cAAc,EACnB,KAAK,UAAU,EAChB,MAAM,yBAAyB,CAAC;AACjC,OAAO,EAAE,cAAc,EAAE,MAAM,gBAAgB,CAAC;AAEhD,OAAO,EAAE,eAAe,EAAE,MAAM,uBAAuB,CAAC;AACxD,OAAO,EAAS,KAAK,YAAY,EAAE,KAAK,QAAQ,EAAE,MAAM,kBAAkB,CAAC;AAC3E,OAAO,KAAK,EAAc,QAAQ,EAAE,MAAM,oBAAoB,CAAC;AAI/D,eAAO,MAAM,WAAW,EAAE,KAAK,CAAC,UAAU,CAA8B,CAAC;AAIzE,MAAM,MAAM,WAAW,GAAG;IAAE,MAAM,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAA;CAAE,GAAG,UAAU,CAAC;AAExE;;;;;;;;;;;GAWG;AACH,qBAAa,UAAU;IAGnB,OAAO,CAAC,QAAQ,CAAC,OAAO;IACxB,OAAO,CAAC,QAAQ,CAAC,QAAQ;IAEzB,OAAO,CAAC,QAAQ,CAAC,kBAAkB,CAAC;IACpC,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAC;IAIxB,OAAO,CAAC,QAAQ,CAAC,cAAc,CAAC;gBARf,OAAO,EAAE,cAAc,EACvB,QAAQ,EAAE,eAAe,EAEzB,kBAAkB,CAAC,EAAE,uBAAuB,YAAA,EAC5C,MAAM,CAAC,EAAE,QAAQ,YAAA,EAIjB,cAAc,CAAC,EAAE,cAAc,YAAA;IAG5C,MAAM,CAAC,OAAO,EAAE,OAAO,GAAG,OAAO,CAAC,WAAW,CAAC;IAC9C,MAAM,CAAC,CAAC,SAAS,YAAY,EACjC,OAAO,EAAE,OAAO,EAChB,QAAQ,EAAE,CAAC,EACX,MAAM,EAAE,QAAQ,CAAC,CAAC,CAAC,GAClB,OAAO,CAAC,WAAW,CAAC;IA+EvB,OAAO,CAAC,aAAa;IAMrB,OAAO,CAAC,UAAU;IAYlB,OAAO,CAAC,gBAAgB;CA4BzB"}

package/dist/server/auth/admin-guard.js

@@ -1,95 +1,141 @@
 import { ORPCError } from '@orpc/server';
-import { createToken } from '@openora/core/contracts';
+import { createToken, AuthGuardReasonSchema, } from '@openora/core/contracts';
 import { sql } from 'drizzle-orm';
 import { roles } from './permissions.js';
+import { createLogger } from '../kernel/logger.js';
+import { extractClientMeta } from '../kernel/router-utils.js';
 export const ADMIN_GUARD = createToken('ADMIN_GUARD');
+const logger = createLogger('admin-guard');
+/**
+ * The single admin-enforcement point - every admin route calls `assert()` as its
+ * first line, never re-implementing the role check. Overload without
+ * `resource`/`action` only requires a valid admin session; the 3-arg overload
+ * additionally checks a specific permission. When the iam module's permission
+ * resolver is bound, DB-assigned grants are authoritative; when a role has no DB
+ * assignment row (the bootstrap path - seed admin), it falls back to the static
+ * role table instead of denying outright. A revoked-in-DB but still
+ * statically-granted role is NOT denied by this fallback - revoke the static role
+ * to fully lock a bootstrap admin out. Every denial emits
+ * `identity.user.unauthorized_access` for audit, before throwing.
+ */
 export class AdminGuard {
     drizzle;
     sessions;
     permissionResolver;
     events;
+    identityReader;
     // Uses the shared SessionResolver (one better-auth init for the whole app) rather than a second createAuth over the same DB.
     constructor(drizzle, sessions, 
     // When bound (iam module loaded), grants come from DB; otherwise falls back to static roles.
-    permissionResolver, events) {
+    permissionResolver, events, 
+    // When bound (identity module loaded), resolves the PAM player.id for a
+    // player-role denial's audit attribution. This engine-zone file must not import
+    // the player schema directly (ADR-0019/0025), so it goes through this port instead.
+    identityReader) {
         this.drizzle = drizzle;
         this.sessions = sessions;
         this.permissionResolver = permissionResolver;
         this.events = events;
+        this.identityReader = identityReader;
     }
     async assert(context, resource, action) {
         const request = context.request;
         if (!request || typeof request.headers !== 'object') {
-            throw new ORPCError('UNAUTHORIZED', { message: 'Missing request context' });
+            throw new ORPCError('UNAUTHORIZED', {
+                message: 'Missing request context',
+                data: { reason: AuthGuardReasonSchema.enum.missing_request_context },
+            });
         }
+        const { ip, userAgent } = extractClientMeta(request.headers);
         const headers = new Headers();
         for (const [k, v] of Object.entries(request.headers)) {
-            if (v === undefined)
+            if (v === undefined) {
                 continue;
+            }
             headers.set(k, Array.isArray(v) ? v.join(', ') : v);
         }
         const userId = await this.sessions.resolveUserId(headers);
         if (!userId) {
-            throw new ORPCError('UNAUTHORIZED', { message: 'Authentication required' });
+            throw new ORPCError('UNAUTHORIZED', {
+                message: 'Authentication required',
+                data: { reason: AuthGuardReasonSchema.enum.authentication_required },
+            });
         }
         const result = await this.drizzle.db.execute(sql `SELECT id, role FROM "user" WHERE id = ${userId} LIMIT 1`);
         const userRecord = result.rows[0];
         if (!userRecord) {
             if (resource !== undefined && action !== undefined) {
-                this.emitUnauthorized(userId, undefined, resource, action, headers);
+                this.emitUnauthorized(userId, undefined, resource, action, ip, userAgent);
             }
             else {
-                this.emitUnauthorized(userId, undefined, 'admin', 'access', headers);
+                this.emitUnauthorized(userId, undefined, 'admin', 'access', ip, userAgent);
             }
-            throw new ORPCError('FORBIDDEN', { message: 'Admin access required' });
+            throw new ORPCError('FORBIDDEN', {
+                message: 'Admin access required',
+                data: { reason: AuthGuardReasonSchema.enum.admin_required },
+            });
         }
         const userRole = roles[userRecord.role];
         if (!userRole) {
             if (resource !== undefined && action !== undefined) {
-                this.emitUnauthorized(userId, userRecord.role, resource, action, headers);
+                this.emitUnauthorized(userId, userRecord.role, resource, action, ip, userAgent);
             }
             else {
-                this.emitUnauthorized(userId, userRecord.role, 'admin', 'access', headers);
+                this.emitUnauthorized(userId, userRecord.role, 'admin', 'access', ip, userAgent);
             }
-            throw new ORPCError('FORBIDDEN', { message: 'Admin access required' });
+            throw new ORPCError('FORBIDDEN', {
+                message: 'Admin access required',
+                data: { reason: AuthGuardReasonSchema.enum.admin_required },
+            });
         }
         if (resource !== undefined && action !== undefined) {
-            const grants = this.permissionResolver
-                ? await this.permissionResolver.getGrants(userId)
-                : null;
-            if (grants !== null) {
-                const allowed = grants.some((g) => g.resource === resource && g.action === action);
-                if (!allowed) {
-                    this.emitUnauthorized(userId, userRecord.role, resource, action, headers);
-                    throw new ORPCError('FORBIDDEN', {
-                        message: `Missing permission: ${String(resource)}:${String(action)}`,
-                    });
-                }
-            }
-            else {
-                // Bootstrap path: seed admin has user.role='admin' but no DB assignment row. DB revocation is NOT authoritative while a static role still grants - revoke the static role to fully deny.
-                const check = userRole.authorize({ [resource]: [action] });
-                if (!check.success) {
-                    this.emitUnauthorized(userId, userRecord.role, resource, action, headers);
-                    throw new ORPCError('FORBIDDEN', {
-                        message: `Missing permission: ${String(resource)}:${String(action)}`,
-                    });
-                }
+            const grants = await this.resolveGrants(userId);
+            const allowed = this.checkGrant(grants, userRole, resource, action);
+            if (!allowed) {
+                this.emitUnauthorized(userId, userRecord.role, resource, action, ip, userAgent);
+                throw new ORPCError('FORBIDDEN', {
+                    message: `Missing permission: ${String(resource)}:${String(action)}`,
+                    data: {
+                        reason: AuthGuardReasonSchema.enum.permission_denied,
+                        resource: String(resource),
+                        action: String(action),
+                    },
+                });
             }
         }
-        return { userId, role: userRecord.role };
+        return { userId, role: userRecord.role, ip, userAgent };
+    }
+    resolveGrants(userId) {
+        return this.permissionResolver
+            ? this.permissionResolver.getGrants(userId)
+            : Promise.resolve(null);
+    }
+    checkGrant(grants, userRole, resource, action) {
+        if (grants !== null) {
+            return grants.some((g) => g.resource === resource && g.action === action);
+        }
+        return userRole?.authorize({ [resource]: [action] }).success ?? false;
     }
-    emitUnauthorized(userId, role, resource, action, headers) {
-        const ip = headers.get('x-forwarded-for')?.split(',')[0]?.trim() || headers.get('x-real-ip') || null;
-        const userAgent = headers.get('user-agent') || null;
-        this.events?.emit('identity.user.unauthorized_access', {
-            userId,
-            resource,
-            action,
-            ip,
-            userAgent,
-            role,
-        });
+    emitUnauthorized(userId, role, resource, action, ip, userAgent) {
+        void (async () => {
+            const playerId = role === 'player'
+                ? ((await this.identityReader?.getPlayerIdByUserIdSafe(userId)) ?? null)
+                : null;
+            try {
+                this.events?.emit('identity.user.unauthorized_access', {
+                    userId,
+                    playerId,
+                    resource,
+                    action,
+                    ip,
+                    userAgent,
+                    role,
+                });
+            }
+            catch (err) {
+                logger.error({ err, userId, resource, action }, 'denial audit event failed');
+            }
+        })();
     }
 }
 //# sourceMappingURL=admin-guard.js.map

package/dist/server/auth/admin-guard.js.map

@@ -1 +1 @@
-{"version":3,"file":"admin-guard.js","sourceRoot":"","sources":["../../../src/server/auth/admin-guard.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,MAAM,cAAc,CAAC;AACzC,OAAO,EAAE,WAAW,EAA4C,MAAM,yBAAyB,CAAC;AAEhG,OAAO,EAAE,GAAG,EAAE,MAAM,aAAa,CAAC;AAElC,OAAO,EAAE,KAAK,EAAoC,MAAM,kBAAkB,CAAC;AAG3E,MAAM,CAAC,MAAM,WAAW,GAAsB,WAAW,CAAC,aAAa,CAAC,CAAC;AAEzE,MAAM,OAAO,UAAU;IAGF;IACA;IAEA;IACA;IANnB,6HAA6H;IAC7H,YACmB,OAAuB,EACvB,QAAyB;IAC1C,6FAA6F;IAC5E,kBAA4C,EAC5C,MAAiB;QAJjB,YAAO,GAAP,OAAO,CAAgB;QACvB,aAAQ,GAAR,QAAQ,CAAiB;QAEzB,uBAAkB,GAAlB,kBAAkB,CAA0B;QAC5C,WAAM,GAAN,MAAM,CAAW;IACjC,CAAC;IAQJ,KAAK,CAAC,MAAM,CACV,OAAgB,EAChB,QAAY,EACZ,MAAoB;QAEpB,MAAM,OAAO,GAAI,OAA+C,CAAC,OAAO,CAAC;QACzE,IAAI,CAAC,OAAO,IAAI,OAAO,OAAO,CAAC,OAAO,KAAK,QAAQ,EAAE,CAAC;YACpD,MAAM,IAAI,SAAS,CAAC,cAAc,EAAE,EAAE,OAAO,EAAE,yBAAyB,EAAE,CAAC,CAAC;QAC9E,CAAC;QAED,MAAM,OAAO,GAAG,IAAI,OAAO,EAAE,CAAC;QAC9B,KAAK,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC;YACrD,IAAI,CAAC,KAAK,SAAS;gBAAE,SAAS;YAC9B,OAAO,CAAC,GAAG,CAAC,CAAC,EAAE,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;QACtD,CAAC;QACD,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,QAAQ,CAAC,aAAa,CAAC,OAAO,CAAC,CAAC;QAC1D,IAAI,CAAC,MAAM,EAAE,CAAC;YACZ,MAAM,IAAI,SAAS,CAAC,cAAc,EAAE,EAAE,OAAO,EAAE,yBAAyB,EAAE,CAAC,CAAC;QAC9E,CAAC;QAED,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC,OAAO,CAC1C,GAAG,CAAA,0CAA0C,MAAM,UAAU,CAC9D,CAAC;QACF,MAAM,UAAU,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC,CAA6C,CAAC;QAC9E,IAAI,CAAC,UAAU,EAAE,CAAC;YAChB,IAAI,QAAQ,KAAK,SAAS,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;gBACnD,IAAI,CAAC,gBAAgB,CAAC,MAAM,EAAE,SAAS,EAAE,QAAQ,EAAE,MAAM,EAAE,OAAO,CAAC,CAAC;YACtE,CAAC;iBAAM,CAAC;gBACN,IAAI,CAAC,gBAAgB,CAAC,MAAM,EAAE,SAAS,EAAE,OAAO,EAAE,QAAQ,EAAE,OAAO,CAAC,CAAC;YACvE,CAAC;YACD,MAAM,IAAI,SAAS,CAAC,WAAW,EAAE,EAAE,OAAO,EAAE,uBAAuB,EAAE,CAAC,CAAC;QACzE,CAAC;QAED,MAAM,QAAQ,GAAG,KAAK,CAAC,UAAU,CAAC,IAA0B,CAAC,CAAC;QAC9D,IAAI,CAAC,QAAQ,EAAE,CAAC;YACd,IAAI,QAAQ,KAAK,SAAS,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;gBACnD,IAAI,CAAC,gBAAgB,CAAC,MAAM,EAAE,UAAU,CAAC,IAAI,EAAE,QAAQ,EAAE,MAAM,EAAE,OAAO,CAAC,CAAC;YAC5E,CAAC;iBAAM,CAAC;gBACN,IAAI,CAAC,gBAAgB,CAAC,MAAM,EAAE,UAAU,CAAC,IAAI,EAAE,OAAO,EAAE,QAAQ,EAAE,OAAO,CAAC,CAAC;YAC7E,CAAC;YACD,MAAM,IAAI,SAAS,CAAC,WAAW,EAAE,EAAE,OAAO,EAAE,uBAAuB,EAAE,CAAC,CAAC;QACzE,CAAC;QAED,IAAI,QAAQ,KAAK,SAAS,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;YACnD,MAAM,MAAM,GAAG,IAAI,CAAC,kBAAkB;gBACpC,CAAC,CAAC,MAAM,IAAI,CAAC,kBAAkB,CAAC,SAAS,CAAC,MAAM,CAAC;gBACjD,CAAC,CAAC,IAAI,CAAC;YAET,IAAI,MAAM,KAAK,IAAI,EAAE,CAAC;gBACpB,MAAM,OAAO,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,KAAK,QAAQ,IAAI,CAAC,CAAC,MAAM,KAAK,MAAM,CAAC,CAAC;gBACnF,IAAI,CAAC,OAAO,EAAE,CAAC;oBACb,IAAI,CAAC,gBAAgB,CAAC,MAAM,EAAE,UAAU,CAAC,IAAI,EAAE,QAAQ,EAAE,MAAM,EAAE,OAAO,CAAC,CAAC;oBAC1E,MAAM,IAAI,SAAS,CAAC,WAAW,EAAE;wBAC/B,OAAO,EAAE,uBAAuB,MAAM,CAAC,QAAQ,CAAC,IAAI,MAAM,CAAC,MAAM,CAAC,EAAE;qBACrE,CAAC,CAAC;gBACL,CAAC;YACH,CAAC;iBAAM,CAAC;gBACN,yLAAyL;gBACzL,MAAM,KAAK,GAAG,QAAQ,CAAC,SAAS,CAAC,EAAE,CAAC,QAAQ,CAAC,EAAE,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;gBAC3D,IAAI,CAAC,KAAK,CAAC,OAAO,EAAE,CAAC;oBACnB,IAAI,CAAC,gBAAgB,CAAC,MAAM,EAAE,UAAU,CAAC,IAAI,EAAE,QAAQ,EAAE,MAAM,EAAE,OAAO,CAAC,CAAC;oBAC1E,MAAM,IAAI,SAAS,CAAC,WAAW,EAAE;wBAC/B,OAAO,EAAE,uBAAuB,MAAM,CAAC,QAAQ,CAAC,IAAI,MAAM,CAAC,MAAM,CAAC,EAAE;qBACrE,CAAC,CAAC;gBACL,CAAC;YACH,CAAC;QACH,CAAC;QAED,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,UAAU,CAAC,IAAI,EAAE,CAAC;IAC3C,CAAC;IAEO,gBAAgB,CACtB,MAAc,EACd,IAAwB,EACxB,QAAgB,EAChB,MAAc,EACd,OAAgB;QAEhB,MAAM,EAAE,GACN,OAAO,CAAC,GAAG,CAAC,iBAAiB,CAAC,EAAE,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,IAAI,OAAO,CAAC,GAAG,CAAC,WAAW,CAAC,IAAI,IAAI,CAAC;QAC5F,MAAM,SAAS,GAAG,OAAO,CAAC,GAAG,CAAC,YAAY,CAAC,IAAI,IAAI,CAAC;QACpD,IAAI,CAAC,MAAM,EAAE,IAAI,CAAC,mCAAmC,EAAE;YACrD,MAAM;YACN,QAAQ;YACR,MAAM;YACN,EAAE;YACF,SAAS;YACT,IAAI;SACL,CAAC,CAAC;IACL,CAAC;CACF"}
+{"version":3,"file":"admin-guard.js","sourceRoot":"","sources":["../../../src/server/auth/admin-guard.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,MAAM,cAAc,CAAC;AACzC,OAAO,EACL,WAAW,EACX,qBAAqB,GAMtB,MAAM,yBAAyB,CAAC;AAEjC,OAAO,EAAE,GAAG,EAAE,MAAM,aAAa,CAAC;AAElC,OAAO,EAAE,KAAK,EAAoC,MAAM,kBAAkB,CAAC;AAE3E,OAAO,EAAE,YAAY,EAAE,MAAM,qBAAqB,CAAC;AACnD,OAAO,EAAE,iBAAiB,EAAE,MAAM,2BAA2B,CAAC;AAE9D,MAAM,CAAC,MAAM,WAAW,GAAsB,WAAW,CAAC,aAAa,CAAC,CAAC;AAEzE,MAAM,MAAM,GAAG,YAAY,CAAC,aAAa,CAAC,CAAC;AAI3C;;;;;;;;;;;GAWG;AACH,MAAM,OAAO,UAAU;IAGF;IACA;IAEA;IACA;IAIA;IAVnB,6HAA6H;IAC7H,YACmB,OAAuB,EACvB,QAAyB;IAC1C,6FAA6F;IAC5E,kBAA4C,EAC5C,MAAiB;IAClC,wEAAwE;IACxE,gFAAgF;IAChF,oFAAoF;IACnE,cAA+B;QAR/B,YAAO,GAAP,OAAO,CAAgB;QACvB,aAAQ,GAAR,QAAQ,CAAiB;QAEzB,uBAAkB,GAAlB,kBAAkB,CAA0B;QAC5C,WAAM,GAAN,MAAM,CAAW;QAIjB,mBAAc,GAAd,cAAc,CAAiB;IAC/C,CAAC;IAQJ,KAAK,CAAC,MAAM,CACV,OAAgB,EAChB,QAAY,EACZ,MAAoB;QAEpB,MAAM,OAAO,GAAI,OAA+C,CAAC,OAAO,CAAC;QACzE,IAAI,CAAC,OAAO,IAAI,OAAO,OAAO,CAAC,OAAO,KAAK,QAAQ,EAAE,CAAC;YACpD,MAAM,IAAI,SAAS,CAAC,cAAc,EAAE;gBAClC,OAAO,EAAE,yBAAyB;gBAClC,IAAI,EAAE,EAAE,MAAM,EAAE,qBAAqB,CAAC,IAAI,CAAC,uBAAuB,EAAE;aACrE,CAAC,CAAC;QACL,CAAC;QAED,MAAM,EAAE,EAAE,EAAE,SAAS,EAAE,GAAG,iBAAiB,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;QAE7D,MAAM,OAAO,GAAG,IAAI,OAAO,EAAE,CAAC;QAC9B,KAAK,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC;YACrD,IAAI,CAAC,KAAK,SAAS,EAAE,CAAC;gBACpB,SAAS;YACX,CAAC;YACD,OAAO,CAAC,GAAG,CAAC,CAAC,EAAE,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;QACtD,CAAC;QACD,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,QAAQ,CAAC,aAAa,CAAC,OAAO,CAAC,CAAC;QAC1D,IAAI,CAAC,MAAM,EAAE,CAAC;YACZ,MAAM,IAAI,SAAS,CAAC,cAAc,EAAE;gBAClC,OAAO,EAAE,yBAAyB;gBAClC,IAAI,EAAE,EAAE,MAAM,EAAE,qBAAqB,CAAC,IAAI,CAAC,uBAAuB,EAAE;aACrE,CAAC,CAAC;QACL,CAAC;QAED,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC,OAAO,CAC1C,GAAG,CAAA,0CAA0C,MAAM,UAAU,CAC9D,CAAC;QACF,MAAM,UAAU,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC,CAA6C,CAAC;QAC9E,IAAI,CAAC,UAAU,EAAE,CAAC;YAChB,IAAI,QAAQ,KAAK,SAAS,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;gBACnD,IAAI,CAAC,gBAAgB,CAAC,MAAM,EAAE,SAAS,EAAE,QAAQ,EAAE,MAAM,EAAE,EAAE,EAAE,SAAS,CAAC,CAAC;YAC5E,CAAC;iBAAM,CAAC;gBACN,IAAI,CAAC,gBAAgB,CAAC,MAAM,EAAE,SAAS,EAAE,OAAO,EAAE,QAAQ,EAAE,EAAE,EAAE,SAAS,CAAC,CAAC;YAC7E,CAAC;YACD,MAAM,IAAI,SAAS,CAAC,WAAW,EAAE;gBAC/B,OAAO,EAAE,uBAAuB;gBAChC,IAAI,EAAE,EAAE,MAAM,EAAE,qBAAqB,CAAC,IAAI,CAAC,cAAc,EAAE;aAC5D,CAAC,CAAC;QACL,CAAC;QAED,MAAM,QAAQ,GAAG,KAAK,CAAC,UAAU,CAAC,IAA0B,CAAC,CAAC;QAC9D,IAAI,CAAC,QAAQ,EAAE,CAAC;YACd,IAAI,QAAQ,KAAK,SAAS,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;gBACnD,IAAI,CAAC,gBAAgB,CAAC,MAAM,EAAE,UAAU,CAAC,IAAI,EAAE,QAAQ,EAAE,MAAM,EAAE,EAAE,EAAE,SAAS,CAAC,CAAC;YAClF,CAAC;iBAAM,CAAC;gBACN,IAAI,CAAC,gBAAgB,CAAC,MAAM,EAAE,UAAU,CAAC,IAAI,EAAE,OAAO,EAAE,QAAQ,EAAE,EAAE,EAAE,SAAS,CAAC,CAAC;YACnF,CAAC;YACD,MAAM,IAAI,SAAS,CAAC,WAAW,EAAE;gBAC/B,OAAO,EAAE,uBAAuB;gBAChC,IAAI,EAAE,EAAE,MAAM,EAAE,qBAAqB,CAAC,IAAI,CAAC,cAAc,EAAE;aAC5D,CAAC,CAAC;QACL,CAAC;QAED,IAAI,QAAQ,KAAK,SAAS,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;YACnD,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,aAAa,CAAC,MAAM,CAAC,CAAC;YAChD,MAAM,OAAO,GAAG,IAAI,CAAC,UAAU,CAAC,MAAM,EAAE,QAAQ,EAAE,QAAQ,EAAE,MAAM,CAAC,CAAC;YACpE,IAAI,CAAC,OAAO,EAAE,CAAC;gBACb,IAAI,CAAC,gBAAgB,CAAC,MAAM,EAAE,UAAU,CAAC,IAAI,EAAE,QAAQ,EAAE,MAAM,EAAE,EAAE,EAAE,SAAS,CAAC,CAAC;gBAChF,MAAM,IAAI,SAAS,CAAC,WAAW,EAAE;oBAC/B,OAAO,EAAE,uBAAuB,MAAM,CAAC,QAAQ,CAAC,IAAI,MAAM,CAAC,MAAM,CAAC,EAAE;oBACpE,IAAI,EAAE;wBACJ,MAAM,EAAE,qBAAqB,CAAC,IAAI,CAAC,iBAAiB;wBACpD,QAAQ,EAAE,MAAM,CAAC,QAAQ,CAAC;wBAC1B,MAAM,EAAE,MAAM,CAAC,MAAM,CAAC;qBACvB;iBACF,CAAC,CAAC;YACL,CAAC;QACH,CAAC;QAED,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,UAAU,CAAC,IAAI,EAAE,EAAE,EAAE,SAAS,EAAE,CAAC;IAC1D,CAAC;IAEO,aAAa,CAAC,MAAc;QAClC,OAAO,IAAI,CAAC,kBAAkB;YAC5B,CAAC,CAAC,IAAI,CAAC,kBAAkB,CAAC,SAAS,CAAC,MAAM,CAAC;YAC3C,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;IAC5B,CAAC;IAEO,UAAU,CAChB,MAA2B,EAC3B,QAAwD,EACxD,QAAgB,EAChB,MAAc;QAEd,IAAI,MAAM,KAAK,IAAI,EAAE,CAAC;YACpB,OAAO,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,KAAK,QAAQ,IAAI,CAAC,CAAC,MAAM,KAAK,MAAM,CAAC,CAAC;QAC5E,CAAC;QACD,OAAO,QAAQ,EAAE,SAAS,CAAC,EAAE,CAAC,QAAQ,CAAC,EAAE,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,OAAO,IAAI,KAAK,CAAC;IACxE,CAAC;IAEO,gBAAgB,CACtB,MAAc,EACd,IAAwB,EACxB,QAAgB,EAChB,MAAc,EACd,EAAiB,EACjB,SAAwB;QAExB,KAAK,CAAC,KAAK,IAAI,EAAE;YACf,MAAM,QAAQ,GACZ,IAAI,KAAK,QAAQ;gBACf,CAAC,CAAC,CAAC,CAAC,MAAM,IAAI,CAAC,cAAc,EAAE,uBAAuB,CAAC,MAAM,CAAC,CAAC,IAAI,IAAI,CAAC;gBACxE,CAAC,CAAC,IAAI,CAAC;YACX,IAAI,CAAC;gBACH,IAAI,CAAC,MAAM,EAAE,IAAI,CAAC,mCAAmC,EAAE;oBACrD,MAAM;oBACN,QAAQ;oBACR,QAAQ;oBACR,MAAM;oBACN,EAAE;oBACF,SAAS;oBACT,IAAI;iBACL,CAAC,CAAC;YACL,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,MAAM,CAAC,KAAK,CAAC,EAAE,GAAG,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,EAAE,2BAA2B,CAAC,CAAC;YAC/E,CAAC;QACH,CAAC,CAAC,EAAE,CAAC;IACP,CAAC;CACF"}

package/dist/server/auth/auth.d.ts

@@ -1,5 +1,6 @@
 import type { Auth as BetterAuthType } from 'better-auth';
 import type { DrizzleDb } from '../db/index.js';
+import { type EmailTemplateRenderer } from '@openora/core/contracts';
 export type SendEmail = (args: {
     to: string;
     subject: string;
@@ -9,7 +10,33 @@ export type AuthOptions = {
     db: DrizzleDb;
     schema?: Record<string, unknown>;
     sendEmail?: SendEmail;
+    onPasswordReset?: (user: {
+        id: string;
+        email: string;
+    }) => Promise<void> | void;
+    templateRenderer?: EmailTemplateRenderer;
+    getUserLanguage?: (email: string) => Promise<string | null>;
+    registrationWebUrl?: string;
+    onExistingUserSignUp?: (user: {
+        id: string;
+        email: string;
+    }) => Promise<void> | void;
+    cookieDomain?: string;
 };
+/**
+ * Builds the one shared better-auth instance for the whole app - both the
+ * per-request session middleware and `AdminGuard` resolve sessions through it,
+ * never a second `createAuth()` over the same DB. Bundles the org, admin
+ * (role/permission), and two-factor plugins; `sendEmail` is a silent no-op
+ * when omitted (eg tests) rather than throwing. The explicit `BetterAuthType`
+ * return annotation is load-bearing, not stylistic - it dodges a TS2883 Zod v4
+ * `$strip` portability error the inferred type would otherwise surface.
+ *
+ * `cookieDomain` (or `AUTH_COOKIE_DOMAIN`) widens the session cookie to a parent
+ * domain, so a frontend on `app.example.com` still sends it to an API on
+ * `api.example.com`. Left unset the cookie stays host-only, which is correct when
+ * both run on one host and is the safer default everywhere else.
+ */
 export declare function createAuth(options: AuthOptions): BetterAuthType;
 export type Auth = BetterAuthType;
 //# sourceMappingURL=auth.d.ts.map

package/dist/server/auth/auth.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"auth.d.ts","sourceRoot":"","sources":["../../../src/server/auth/auth.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,IAAI,IAAI,cAAc,EAAE,MAAM,aAAa,CAAC;AAG1D,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,gBAAgB,CAAC;AAKhD,MAAM,MAAM,SAAS,GAAG,CAAC,IAAI,EAAE;IAC7B,EAAE,EAAE,MAAM,CAAC;IACX,OAAO,EAAE,MAAM,CAAC;IAChB,IAAI,EAAE,MAAM,CAAC;CACd,KAAK,OAAO,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC;AAE3B,MAAM,MAAM,WAAW,GAAG;IACxB,EAAE,EAAE,SAAS,CAAC;IACd,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACjC,SAAS,CAAC,EAAE,SAAS,CAAC;CACvB,CAAC;AAGF,wBAAgB,UAAU,CAAC,OAAO,EAAE,WAAW,GAAG,cAAc,CAqD/D;AAED,MAAM,MAAM,IAAI,GAAG,cAAc,CAAC"}
+{"version":3,"file":"auth.d.ts","sourceRoot":"","sources":["../../../src/server/auth/auth.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,IAAI,IAAI,cAAc,EAAE,MAAM,aAAa,CAAC;AAG1D,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,gBAAgB,CAAC;AAEhD,OAAO,EAIL,KAAK,qBAAqB,EAC3B,MAAM,yBAAyB,CAAC;AAIjC,MAAM,MAAM,SAAS,GAAG,CAAC,IAAI,EAAE;IAC7B,EAAE,EAAE,MAAM,CAAC;IACX,OAAO,EAAE,MAAM,CAAC;IAChB,IAAI,EAAE,MAAM,CAAC;CACd,KAAK,OAAO,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC;AAE3B,MAAM,MAAM,WAAW,GAAG;IACxB,EAAE,EAAE,SAAS,CAAC;IACd,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACjC,SAAS,CAAC,EAAE,SAAS,CAAC;IACtB,eAAe,CAAC,EAAE,CAAC,IAAI,EAAE;QAAE,EAAE,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAA;KAAE,KAAK,OAAO,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC;IAChF,gBAAgB,CAAC,EAAE,qBAAqB,CAAC;IACzC,eAAe,CAAC,EAAE,CAAC,KAAK,EAAE,MAAM,KAAK,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAAC;IAC5D,kBAAkB,CAAC,EAAE,MAAM,CAAC;IAC5B,oBAAoB,CAAC,EAAE,CAAC,IAAI,EAAE;QAAE,EAAE,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAA;KAAE,KAAK,OAAO,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC;IACrF,YAAY,CAAC,EAAE,MAAM,CAAC;CACvB,CAAC;AAWF;;;;;;;;;;;;;GAaG;AACH,wBAAgB,UAAU,CAAC,OAAO,EAAE,WAAW,GAAG,cAAc,CA6F/D;AAED,MAAM,MAAM,IAAI,GAAG,cAAc,CAAC"}