@openora/core 0.4.1-canary.13 → 0.4.1-canary.130

package/dist/server/auth/__tests__/auth.test.js

@@ -0,0 +1,150 @@
+import { describe, it, expect, vi, beforeEach } from 'vitest';
+import { createAuth } from '../auth.js';
+const betterAuthMock = vi.hoisted(() => vi.fn());
+const emailOTPMock = vi.hoisted(() => vi.fn((opts) => ({ id: 'email-otp', ...opts })));
+vi.mock('better-auth', async (importOriginal) => {
+    const actual = await importOriginal();
+    return {
+        ...actual,
+        betterAuth: betterAuthMock,
+    };
+});
+vi.mock('better-auth/plugins', async (importOriginal) => {
+    const actual = await importOriginal();
+    return {
+        ...actual,
+        emailOTP: emailOTPMock,
+    };
+});
+describe('createAuth', () => {
+    beforeEach(() => {
+        vi.clearAllMocks();
+    });
+    describe('emailOTP plugin - sendVerificationOTP', () => {
+        it('dispatches the reset-password template when type is forget-password', async () => {
+            const dispatchOtpMail = vi.fn().mockResolvedValue(undefined);
+            createAuth({ db: {}, dispatchOtpMail });
+            const emailOtpOpts = emailOTPMock.mock.calls[0][0];
+            await emailOtpOpts.sendVerificationOTP({
+                email: 'test@example.com',
+                otp: '123456',
+                type: 'forget-password',
+            });
+            expect(dispatchOtpMail).toHaveBeenCalledWith({
+                to: 'test@example.com',
+                template: { key: 'resetPasswordOtp', data: { otp: '123456', email: 'test@example.com' } },
+            });
+        });
+        it('dispatches the existing-account template when the reset came from a sign-up', async () => {
+            // better-auth issues both through the same `forget-password` type, so without the
+            // predicate a duplicate sign-up mails a bare "Reset your password" to someone who
+            // never asked to reset anything.
+            const dispatchOtpMail = vi.fn().mockResolvedValue(undefined);
+            createAuth({
+                db: {},
+                dispatchOtpMail,
+                isExistingAccountSignUp: (email) => email === 'test@example.com',
+            });
+            const emailOtpOpts = emailOTPMock.mock.calls[0][0];
+            await emailOtpOpts.sendVerificationOTP({
+                email: 'test@example.com',
+                otp: '123456',
+                type: 'forget-password',
+            });
+            expect(dispatchOtpMail).toHaveBeenCalledWith({
+                to: 'test@example.com',
+                template: {
+                    key: 'existingAccountSignUp',
+                    data: { otp: '123456', email: 'test@example.com' },
+                },
+            });
+        });
+        it('carries the admin-reset origin in the queued template', async () => {
+            const dispatchOtpMail = vi.fn().mockResolvedValue(undefined);
+            createAuth({
+                db: {},
+                dispatchOtpMail,
+                isAdminPasswordReset: async (email) => email === 'test@example.com',
+            });
+            const emailOtpOpts = emailOTPMock.mock.calls[0][0];
+            await emailOtpOpts.sendVerificationOTP({
+                email: 'test@example.com',
+                otp: '123456',
+                type: 'forget-password',
+            });
+            expect(dispatchOtpMail).toHaveBeenCalledWith({
+                to: 'test@example.com',
+                template: {
+                    key: 'adminResetPasswordOtp',
+                    data: { otp: '123456', email: 'test@example.com' },
+                },
+            });
+        });
+        it('dispatches the verification code template for an email-verification OTP', async () => {
+            const dispatchOtpMail = vi.fn().mockResolvedValue(undefined);
+            createAuth({ db: {}, dispatchOtpMail });
+            const emailOtpOpts = emailOTPMock.mock.calls[0][0];
+            await emailOtpOpts.sendVerificationOTP({
+                email: 'test@example.com',
+                otp: '123456',
+                type: 'email-verification',
+            });
+            expect(dispatchOtpMail).toHaveBeenCalledWith({
+                to: 'test@example.com',
+                template: { key: 'verifyEmail', data: { otp: '123456' } },
+            });
+        });
+        it('returns early without dispatching mail for other types', async () => {
+            const dispatchOtpMail = vi.fn();
+            createAuth({ db: {}, dispatchOtpMail });
+            const emailOtpOpts = emailOTPMock.mock.calls[0][0];
+            await emailOtpOpts.sendVerificationOTP({
+                email: 'test@example.com',
+                otp: '123456',
+                type: 'sign-in',
+            });
+            expect(dispatchOtpMail).not.toHaveBeenCalled();
+        });
+    });
+    describe('email verification gate', () => {
+        it('does not require a verified address by default', () => {
+            // Unverified players stay unrestricted while the KYC toggle is off.
+            createAuth({ db: {} });
+            expect(betterAuthMock.mock.calls[0][0].emailAndPassword.requireEmailVerification).toBe(false);
+        });
+        it('requires one when the operator turns the gate on', () => {
+            createAuth({ db: {}, requireEmailVerification: true });
+            expect(betterAuthMock.mock.calls[0][0].emailAndPassword.requireEmailVerification).toBe(true);
+        });
+        it('never lets better-auth mail the code on sign-up', () => {
+            // Its sign-up hook also fires on the synthetic duplicate-email response, which
+            // would mail a live code to an address whose owner never asked for it.
+            createAuth({ db: {} });
+            expect(betterAuthMock.mock.calls[0][0].emailVerification.sendOnSignUp).toBe(false);
+            expect(betterAuthMock.mock.calls[0][0].emailVerification.autoSignInAfterVerification).toBe(true);
+        });
+    });
+    describe('cookie domain', () => {
+        it('leaves the session cookie host-only by default', () => {
+            createAuth({ db: {} });
+            expect(betterAuthMock.mock.calls[0][0].advanced.crossSubDomainCookies).toBeUndefined();
+        });
+        it('widens the session cookie to the domain passed in options', () => {
+            createAuth({ db: {}, cookieDomain: '.example.com' });
+            expect(betterAuthMock.mock.calls[0][0].advanced.crossSubDomainCookies).toEqual({
+                enabled: true,
+                domain: '.example.com',
+            });
+        });
+        it('falls back to AUTH_COOKIE_DOMAIN when no option is passed', () => {
+            vi.stubEnv('AUTH_COOKIE_DOMAIN', '.env-example.com');
+            createAuth({ db: {} });
+            expect(betterAuthMock.mock.calls[0][0].advanced.crossSubDomainCookies).toEqual({
+                enabled: true,
+                domain: '.env-example.com',
+            });
+            vi.unstubAllEnvs();
+        });
+    });
+});
+//# sourceMappingURL=auth.test.js.map

package/dist/server/auth/__tests__/auth.test.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth.test.js","sourceRoot":"","sources":["../../../../src/server/auth/__tests__/auth.test.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,EAAE,EAAE,MAAM,EAAE,EAAE,EAAE,UAAU,EAAE,MAAM,QAAQ,CAAC;AAC9D,OAAO,EAAE,UAAU,EAAE,MAAM,YAAY,CAAC;AAExC,MAAM,cAAc,GAAG,EAAE,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC;AACjD,MAAM,YAAY,GAAG,EAAE,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,EAAE,EAAE,EAAE,WAAW,EAAE,GAAG,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC;AAEvF,EAAE,CAAC,IAAI,CAAC,aAAa,EAAE,KAAK,EAAE,cAAc,EAAE,EAAE;IAC9C,MAAM,MAAM,GAAG,MAAM,cAAc,EAAU,CAAC;IAC9C,OAAO;QACL,GAAG,MAAM;QACT,UAAU,EAAE,cAAc;KAC3B,CAAC;AACJ,CAAC,CAAC,CAAC;AAEH,EAAE,CAAC,IAAI,CAAC,qBAAqB,EAAE,KAAK,EAAE,cAAc,EAAE,EAAE;IACtD,MAAM,MAAM,GAAG,MAAM,cAAc,EAAU,CAAC;IAC9C,OAAO;QACL,GAAG,MAAM;QACT,QAAQ,EAAE,YAAY;KACvB,CAAC;AACJ,CAAC,CAAC,CAAC;AAEH,QAAQ,CAAC,YAAY,EAAE,GAAG,EAAE;IAC1B,UAAU,CAAC,GAAG,EAAE;QACd,EAAE,CAAC,aAAa,EAAE,CAAC;IACrB,CAAC,CAAC,CAAC;IAEH,QAAQ,CAAC,uCAAuC,EAAE,GAAG,EAAE;QACrD,EAAE,CAAC,qEAAqE,EAAE,KAAK,IAAI,EAAE;YACnF,MAAM,eAAe,GAAG,EAAE,CAAC,EAAE,EAAE,CAAC,iBAAiB,CAAC,SAAS,CAAC,CAAC;YAE7D,UAAU,CAAC,EAAE,EAAE,EAAE,EAAW,EAAE,eAAe,EAAE,CAAC,CAAC;YAEjD,MAAM,YAAY,GAAG,YAAY,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;YACnD,MAAM,YAAY,CAAC,mBAAmB,CAAC;gBACrC,KAAK,EAAE,kBAAkB;gBACzB,GAAG,EAAE,QAAQ;gBACb,IAAI,EAAE,iBAAiB;aACxB,CAAC,CAAC;YAEH,MAAM,CAAC,eAAe,CAAC,CAAC,oBAAoB,CAAC;gBAC3C,EAAE,EAAE,kBAAkB;gBACtB,QAAQ,EAAE,EAAE,GAAG,EAAE,kBAAkB,EAAE,IAAI,EAAE,EAAE,GAAG,EAAE,QAAQ,EAAE,KAAK,EAAE,kBAAkB,EAAE,EAAE;aAC1F,CAAC,CAAC;QACL,CAAC,CAAC,CAAC;QAEH,EAAE,CAAC,6EAA6E,EAAE,KAAK,IAAI,EAAE;YAC3F,kFAAkF;YAClF,kFAAkF;YAClF,iCAAiC;YACjC,MAAM,eAAe,GAAG,EAAE,CAAC,EAAE,EAAE,CAAC,iBAAiB,CAAC,SAAS,CAAC,CAAC;YAE7D,UAAU,CAAC;gBACT,EAAE,EAAE,EAAW;gBACf,eAAe;gBACf,uBAAuB,EAAE,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,KAAK,kBAAkB;aACjE,CAAC,CAAC;YAEH,MAAM,YAAY,GAAG,YAAY,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;YACnD,MAAM,YAAY,CAAC,mBAAmB,CAAC;gBACrC,KAAK,EAAE,kBAAkB;gBACzB,GAAG,EAAE,QAAQ;gBACb,IAAI,EAAE,iBAAiB;aACxB,CAAC,CAAC;YAEH,MAAM,CAAC,eAAe,CAAC,CAAC,oBAAoB,CAAC;gBAC3C,EAAE,EAAE,kBAAkB;gBACtB,QAAQ,EAAE;oBACR,GAAG,EAAE,uBAAuB;oBAC5B,IAAI,EAAE,EAAE,GAAG,EAAE,QAAQ,EAAE,KAAK,EAAE,kBAAkB,EAAE;iBACnD;aACF,CAAC,CAAC;QACL,CAAC,CAAC,CAAC;QAEH,EAAE,CAAC,uDAAuD,EAAE,KAAK,IAAI,EAAE;YACrE,MAAM,eAAe,GAAG,EAAE,CAAC,EAAE,EAAE,CAAC,iBAAiB,CAAC,SAAS,CAAC,CAAC;YAE7D,UAAU,CAAC;gBACT,EAAE,EAAE,EAAW;gBACf,eAAe;gBACf,oBAAoB,EAAE,KAAK,EAAE,KAAK,EAAE,EAAE,CAAC,KAAK,KAAK,kBAAkB;aACpE,CAAC,CAAC;YAEH,MAAM,YAAY,GAAG,YAAY,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;YACnD,MAAM,YAAY,CAAC,mBAAmB,CAAC;gBACrC,KAAK,EAAE,kBAAkB;gBACzB,GAAG,EAAE,QAAQ;gBACb,IAAI,EAAE,iBAAiB;aACxB,CAAC,CAAC;YAEH,MAAM,CAAC,eAAe,CAAC,CAAC,oBAAoB,CAAC;gBAC3C,EAAE,EAAE,kBAAkB;gBACtB,QAAQ,EAAE;oBACR,GAAG,EAAE,uBAAuB;oBAC5B,IAAI,EAAE,EAAE,GAAG,EAAE,QAAQ,EAAE,KAAK,EAAE,kBAAkB,EAAE;iBACnD;aACF,CAAC,CAAC;QACL,CAAC,CAAC,CAAC;QAEH,EAAE,CAAC,yEAAyE,EAAE,KAAK,IAAI,EAAE;YACvF,MAAM,eAAe,GAAG,EAAE,CAAC,EAAE,EAAE,CAAC,iBAAiB,CAAC,SAAS,CAAC,CAAC;YAE7D,UAAU,CAAC,EAAE,EAAE,EAAE,EAAW,EAAE,eAAe,EAAE,CAAC,CAAC;YAEjD,MAAM,YAAY,GAAG,YAAY,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;YACnD,MAAM,YAAY,CAAC,mBAAmB,CAAC;gBACrC,KAAK,EAAE,kBAAkB;gBACzB,GAAG,EAAE,QAAQ;gBACb,IAAI,EAAE,oBAAoB;aAC3B,CAAC,CAAC;YAEH,MAAM,CAAC,eAAe,CAAC,CAAC,oBAAoB,CAAC;gBAC3C,EAAE,EAAE,kBAAkB;gBACtB,QAAQ,EAAE,EAAE,GAAG,EAAE,aAAa,EAAE,IAAI,EAAE,EAAE,GAAG,EAAE,QAAQ,EAAE,EAAE;aAC1D,CAAC,CAAC;QACL,CAAC,CAAC,CAAC;QAEH,EAAE,CAAC,wDAAwD,EAAE,KAAK,IAAI,EAAE;YACtE,MAAM,eAAe,GAAG,EAAE,CAAC,EAAE,EAAE,CAAC;YAEhC,UAAU,CAAC,EAAE,EAAE,EAAE,EAAW,EAAE,eAAe,EAAE,CAAC,CAAC;YAEjD,MAAM,YAAY,GAAG,YAAY,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;YACnD,MAAM,YAAY,CAAC,mBAAmB,CAAC;gBACrC,KAAK,EAAE,kBAAkB;gBACzB,GAAG,EAAE,QAAQ;gBACb,IAAI,EAAE,SAAS;aAChB,CAAC,CAAC;YAEH,MAAM,CAAC,eAAe,CAAC,CAAC,GAAG,CAAC,gBAAgB,EAAE,CAAC;QACjD,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;IAEH,QAAQ,CAAC,yBAAyB,EAAE,GAAG,EAAE;QACvC,EAAE,CAAC,gDAAgD,EAAE,GAAG,EAAE;YACxD,oEAAoE;YACpE,UAAU,CAAC,EAAE,EAAE,EAAE,EAAW,EAAE,CAAC,CAAC;YAEhC,MAAM,CAAC,cAAc,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,gBAAgB,CAAC,wBAAwB,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QAChG,CAAC,CAAC,CAAC;QAEH,EAAE,CAAC,kDAAkD,EAAE,GAAG,EAAE;YAC1D,UAAU,CAAC,EAAE,EAAE,EAAE,EAAW,EAAE,wBAAwB,EAAE,IAAI,EAAE,CAAC,CAAC;YAEhE,MAAM,CAAC,cAAc,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,gBAAgB,CAAC,wBAAwB,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAC/F,CAAC,CAAC,CAAC;QAEH,EAAE,CAAC,iDAAiD,EAAE,GAAG,EAAE;YACzD,+EAA+E;YAC/E,uEAAuE;YACvE,UAAU,CAAC,EAAE,EAAE,EAAE,EAAW,EAAE,CAAC,CAAC;YAEhC,MAAM,CAAC,cAAc,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,iBAAiB,CAAC,YAAY,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;YACnF,MAAM,CAAC,cAAc,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,iBAAiB,CAAC,2BAA2B,CAAC,CAAC,IAAI,CACxF,IAAI,CACL,CAAC;QACJ,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;IAEH,QAAQ,CAAC,eAAe,EAAE,GAAG,EAAE;QAC7B,EAAE,CAAC,gDAAgD,EAAE,GAAG,EAAE;YACxD,UAAU,CAAC,EAAE,EAAE,EAAE,EAAW,EAAE,CAAC,CAAC;YAEhC,MAAM,CAAC,cAAc,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,qBAAqB,CAAC,CAAC,aAAa,EAAE,CAAC;QACzF,CAAC,CAAC,CAAC;QAEH,EAAE,CAAC,2DAA2D,EAAE,GAAG,EAAE;YACnE,UAAU,CAAC,EAAE,EAAE,EAAE,EAAW,EAAE,YAAY,EAAE,cAAc,EAAE,CAAC,CAAC;YAE9D,MAAM,CAAC,cAAc,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,qBAAqB,CAAC,CAAC,OAAO,CAAC;gBAC7E,OAAO,EAAE,IAAI;gBACb,MAAM,EAAE,cAAc;aACvB,CAAC,CAAC;QACL,CAAC,CAAC,CAAC;QAEH,EAAE,CAAC,2DAA2D,EAAE,GAAG,EAAE;YACnE,EAAE,CAAC,OAAO,CAAC,oBAAoB,EAAE,kBAAkB,CAAC,CAAC;YAErD,UAAU,CAAC,EAAE,EAAE,EAAE,EAAW,EAAE,CAAC,CAAC;YAEhC,MAAM,CAAC,cAAc,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,qBAAqB,CAAC,CAAC,OAAO,CAAC;gBAC7E,OAAO,EAAE,IAAI;gBACb,MAAM,EAAE,kBAAkB;aAC3B,CAAC,CAAC;YACH,EAAE,CAAC,aAAa,EAAE,CAAC;QACrB,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC"}

package/dist/server/auth/__tests__/permission-levels.test.d.ts

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=permission-levels.test.d.ts.map

package/dist/server/auth/__tests__/permission-levels.test.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"permission-levels.test.d.ts","sourceRoot":"","sources":["../../../../src/server/auth/__tests__/permission-levels.test.ts"],"names":[],"mappings":""}

package/dist/server/auth/__tests__/permission-levels.test.js

@@ -0,0 +1,89 @@
+import { describe, it, expect } from 'vitest';
+import { levelRank, isLevelSufficient, levelToActions, actionsToLevel, PERMISSION_LEVELS, } from '../permission-levels.js';
+import { statement } from '../permissions.js';
+describe('levelRank', () => {
+    it('orders the levels from no_access up to read_write', () => {
+        expect(PERMISSION_LEVELS.map(levelRank)).toEqual([0, 1, 2]);
+    });
+    it('ranks an unknown level below every real one so it can never satisfy a check', () => {
+        expect(levelRank('owner')).toBe(-1);
+    });
+});
+describe('isLevelSufficient', () => {
+    it.each([
+        ['no_access', 'no_access', true],
+        ['no_access', 'read', false],
+        ['no_access', 'read_write', false],
+        ['read', 'no_access', true],
+        ['read', 'read', true],
+        ['read', 'read_write', false],
+        ['read_write', 'no_access', true],
+        ['read_write', 'read', true],
+        ['read_write', 'read_write', true],
+    ])('%s covering %s is %s', (have, required, expected) => {
+        expect(isLevelSufficient(have, required)).toBe(expected);
+    });
+    it('refuses to escalate an unknown level', () => {
+        expect(isLevelSufficient('owner', 'read')).toBe(false);
+    });
+});
+describe('levelToActions', () => {
+    it('grants nothing at no_access, whatever the resource', () => {
+        for (const resource of Object.keys(statement)) {
+            expect(levelToActions(resource, 'no_access')).toEqual([]);
+        }
+    });
+    it('grants every declared action at read_write', () => {
+        for (const [resource, actions] of Object.entries(statement)) {
+            expect(levelToActions(resource, 'read_write')).toEqual(actions);
+        }
+    });
+    it('grants only view at read', () => {
+        expect(levelToActions('player', 'read')).toEqual(['view']);
+        expect(levelToActions('withdrawal', 'read')).toEqual(['view']);
+    });
+    it('grants nothing at read for a resource that declares no view action', () => {
+        expect(statement.content).not.toContain('view');
+        expect(levelToActions('content', 'read')).toEqual([]);
+    });
+    it.each(PERMISSION_LEVELS)('grants nothing on an unknown resource at %s', (level) => {
+        expect(levelToActions('tournaments', level)).toEqual([]);
+    });
+    it('never returns an action the resource does not declare', () => {
+        for (const [resource, actions] of Object.entries(statement)) {
+            for (const level of PERMISSION_LEVELS) {
+                expect(actions).toEqual(expect.arrayContaining([...levelToActions(resource, level)]));
+            }
+        }
+    });
+});
+describe('actionsToLevel', () => {
+    it('round-trips every level for every resource that can express it', () => {
+        for (const [resource, actions] of Object.entries(statement)) {
+            const viewOnlyResource = actions.length === 1 && actions[0] === 'view';
+            for (const level of PERMISSION_LEVELS) {
+                const granted = levelToActions(resource, level);
+                const expected = granted.length === 0 ? 'no_access' : viewOnlyResource ? 'read_write' : level;
+                expect(actionsToLevel(resource, granted)).toBe(expected);
+            }
+        }
+    });
+    it('cannot tell read from read_write on a resource whose only action is view', () => {
+        expect(statement.report).toEqual(['view']);
+        expect(actionsToLevel('report', ['view'])).toBe('read_write');
+    });
+    it('collapses a partial action set down, never up', () => {
+        expect(actionsToLevel('player', ['view', 'update'])).toBe('read');
+        expect(actionsToLevel('player', ['update', 'ban'])).toBe('no_access');
+    });
+    it('reports no_access for an unknown resource', () => {
+        expect(actionsToLevel('tournaments', ['view'])).toBe('no_access');
+    });
+    it('reports no_access for an empty action set', () => {
+        expect(actionsToLevel('player', [])).toBe('no_access');
+    });
+    it('ignores actions the resource does not declare', () => {
+        expect(actionsToLevel('report', ['view', 'delete-everything'])).toBe('read_write');
+    });
+});
+//# sourceMappingURL=permission-levels.test.js.map

package/dist/server/auth/__tests__/permission-levels.test.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"permission-levels.test.js","sourceRoot":"","sources":["../../../../src/server/auth/__tests__/permission-levels.test.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,EAAE,EAAE,MAAM,EAAE,MAAM,QAAQ,CAAC;AAC9C,OAAO,EACL,SAAS,EACT,iBAAiB,EACjB,cAAc,EACd,cAAc,EACd,iBAAiB,GAElB,MAAM,yBAAyB,CAAC;AACjC,OAAO,EAAE,SAAS,EAAE,MAAM,mBAAmB,CAAC;AAE9C,QAAQ,CAAC,WAAW,EAAE,GAAG,EAAE;IACzB,EAAE,CAAC,mDAAmD,EAAE,GAAG,EAAE;QAC3D,MAAM,CAAC,iBAAiB,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;IAC9D,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,6EAA6E,EAAE,GAAG,EAAE;QACrF,MAAM,CAAC,SAAS,CAAC,OAA0B,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC;IACzD,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC;AAEH,QAAQ,CAAC,mBAAmB,EAAE,GAAG,EAAE;IACjC,EAAE,CAAC,IAAI,CAAC;QACN,CAAC,WAAW,EAAE,WAAW,EAAE,IAAI,CAAC;QAChC,CAAC,WAAW,EAAE,MAAM,EAAE,KAAK,CAAC;QAC5B,CAAC,WAAW,EAAE,YAAY,EAAE,KAAK,CAAC;QAClC,CAAC,MAAM,EAAE,WAAW,EAAE,IAAI,CAAC;QAC3B,CAAC,MAAM,EAAE,MAAM,EAAE,IAAI,CAAC;QACtB,CAAC,MAAM,EAAE,YAAY,EAAE,KAAK,CAAC;QAC7B,CAAC,YAAY,EAAE,WAAW,EAAE,IAAI,CAAC;QACjC,CAAC,YAAY,EAAE,MAAM,EAAE,IAAI,CAAC;QAC5B,CAAC,YAAY,EAAE,YAAY,EAAE,IAAI,CAAC;KAC1B,CAAC,CAAC,sBAAsB,EAAE,CAAC,IAAI,EAAE,QAAQ,EAAE,QAAQ,EAAE,EAAE;QAC/D,MAAM,CAAC,iBAAiB,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;IAC3D,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,sCAAsC,EAAE,GAAG,EAAE;QAC9C,MAAM,CAAC,iBAAiB,CAAC,OAA0B,EAAE,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IAC5E,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC;AAEH,QAAQ,CAAC,gBAAgB,EAAE,GAAG,EAAE;IAC9B,EAAE,CAAC,oDAAoD,EAAE,GAAG,EAAE;QAC5D,KAAK,MAAM,QAAQ,IAAI,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,CAAC;YAC9C,MAAM,CAAC,cAAc,CAAC,QAAQ,EAAE,WAAW,CAAC,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;QAC5D,CAAC;IACH,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,4CAA4C,EAAE,GAAG,EAAE;QACpD,KAAK,MAAM,CAAC,QAAQ,EAAE,OAAO,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,SAAS,CAAC,EAAE,CAAC;YAC5D,MAAM,CAAC,cAAc,CAAC,QAAQ,EAAE,YAAY,CAAC,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;QAClE,CAAC;IACH,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,0BAA0B,EAAE,GAAG,EAAE;QAClC,MAAM,CAAC,cAAc,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC;QAC3D,MAAM,CAAC,cAAc,CAAC,YAAY,EAAE,MAAM,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC;IACjE,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,oEAAoE,EAAE,GAAG,EAAE;QAC5E,MAAM,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC,GAAG,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC;QAChD,MAAM,CAAC,cAAc,CAAC,SAAS,EAAE,MAAM,CAAC,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;IACxD,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,IAAI,CAAC,iBAAiB,CAAC,CAAC,6CAA6C,EAAE,CAAC,KAAK,EAAE,EAAE;QAClF,MAAM,CAAC,cAAc,CAAC,aAAa,EAAE,KAAK,CAAC,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;IAC3D,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,uDAAuD,EAAE,GAAG,EAAE;QAC/D,KAAK,MAAM,CAAC,QAAQ,EAAE,OAAO,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,SAAS,CAAC,EAAE,CAAC;YAC5D,KAAK,MAAM,KAAK,IAAI,iBAAiB,EAAE,CAAC;gBACtC,MAAM,CAAC,OAAO,CAAC,CAAC,OAAO,CAAC,MAAM,CAAC,eAAe,CAAC,CAAC,GAAG,cAAc,CAAC,QAAQ,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;YACxF,CAAC;QACH,CAAC;IACH,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC;AAEH,QAAQ,CAAC,gBAAgB,EAAE,GAAG,EAAE;IAC9B,EAAE,CAAC,gEAAgE,EAAE,GAAG,EAAE;QACxE,KAAK,MAAM,CAAC,QAAQ,EAAE,OAAO,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,SAAS,CAAC,EAAE,CAAC;YAC5D,MAAM,gBAAgB,GAAG,OAAO,CAAC,MAAM,KAAK,CAAC,IAAI,OAAO,CAAC,CAAC,CAAC,KAAK,MAAM,CAAC;YACvE,KAAK,MAAM,KAAK,IAAI,iBAAiB,EAAE,CAAC;gBACtC,MAAM,OAAO,GAAG,cAAc,CAAC,QAAQ,EAAE,KAAK,CAAC,CAAC;gBAChD,MAAM,QAAQ,GACZ,OAAO,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,gBAAgB,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,KAAK,CAAC;gBAC/E,MAAM,CAAC,cAAc,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;YAC3D,CAAC;QACH,CAAC;IACH,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,0EAA0E,EAAE,GAAG,EAAE;QAClF,MAAM,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,OAAO,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC;QAC3C,MAAM,CAAC,cAAc,CAAC,QAAQ,EAAE,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC;IAChE,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,+CAA+C,EAAE,GAAG,EAAE;QACvD,MAAM,CAAC,cAAc,CAAC,QAAQ,EAAE,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QAClE,MAAM,CAAC,cAAc,CAAC,QAAQ,EAAE,CAAC,QAAQ,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;IACxE,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,2CAA2C,EAAE,GAAG,EAAE;QACnD,MAAM,CAAC,cAAc,CAAC,aAAa,EAAE,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;IACpE,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,2CAA2C,EAAE,GAAG,EAAE;QACnD,MAAM,CAAC,cAAc,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;IACzD,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,+CAA+C,EAAE,GAAG,EAAE;QACvD,MAAM,CAAC,cAAc,CAAC,QAAQ,EAAE,CAAC,MAAM,EAAE,mBAAmB,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC;IACrF,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC"}

package/dist/server/auth/__tests__/permissions.test.d.ts

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=permissions.test.d.ts.map

package/dist/server/auth/__tests__/permissions.test.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"permissions.test.d.ts","sourceRoot":"","sources":["../../../../src/server/auth/__tests__/permissions.test.ts"],"names":[],"mappings":""}

package/dist/server/auth/__tests__/permissions.test.js

@@ -0,0 +1,15 @@
+import { describe, it, expect } from 'vitest';
+import { adminStatement } from '@openora/core/contracts';
+import { adminRole, statement } from '../permissions.js';
+describe('admin permission catalog', () => {
+    it('serves the same catalog the browser imports from contracts', () => {
+        expect(statement).toBe(adminStatement);
+    });
+    // The built-in `admin` role is the AdminGuard fallback when the iam module is
+    // absent, and it mirrors the catalog by hand on purpose: a new resource must
+    // be granted deliberately, not inherited. This catches the drift instead.
+    it('grants the built-in admin role every action in the catalog', () => {
+        expect(adminRole.statements).toEqual(adminStatement);
+    });
+});
+//# sourceMappingURL=permissions.test.js.map

package/dist/server/auth/__tests__/permissions.test.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"permissions.test.js","sourceRoot":"","sources":["../../../../src/server/auth/__tests__/permissions.test.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,EAAE,EAAE,MAAM,EAAE,MAAM,QAAQ,CAAC;AAC9C,OAAO,EAAE,cAAc,EAAE,MAAM,yBAAyB,CAAC;AACzD,OAAO,EAAE,SAAS,EAAE,SAAS,EAAE,MAAM,mBAAmB,CAAC;AAEzD,QAAQ,CAAC,0BAA0B,EAAE,GAAG,EAAE;IACxC,EAAE,CAAC,4DAA4D,EAAE,GAAG,EAAE;QACpE,MAAM,CAAC,SAAS,CAAC,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC;IACzC,CAAC,CAAC,CAAC;IAEH,8EAA8E;IAC9E,6EAA6E;IAC7E,0EAA0E;IAC1E,EAAE,CAAC,4DAA4D,EAAE,GAAG,EAAE;QACpE,MAAM,CAAC,SAAS,CAAC,UAAU,CAAC,CAAC,OAAO,CAAC,cAAc,CAAC,CAAC;IACvD,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC"}

package/dist/server/auth/__tests__/session-resolver.int.test.d.ts

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=session-resolver.int.test.d.ts.map

package/dist/server/auth/__tests__/session-resolver.int.test.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"session-resolver.int.test.d.ts","sourceRoot":"","sources":["../../../../src/server/auth/__tests__/session-resolver.int.test.ts"],"names":[],"mappings":""}

package/dist/server/auth/__tests__/session-resolver.int.test.js

@@ -0,0 +1,59 @@
+import { describe, it, expect, vi, beforeAll, afterAll, beforeEach } from 'vitest';
+import { randomUUID } from 'node:crypto';
+import { createTestDb } from '@openora/core/testing';
+import { SessionResolver } from '../session-resolver.js';
+const { createAuthMock, getSessionMock } = vi.hoisted(() => ({
+    createAuthMock: vi.fn(),
+    getSessionMock: vi.fn(),
+}));
+vi.mock('../auth.js', () => ({
+    createAuth: createAuthMock.mockImplementation(() => ({
+        api: { getSession: getSessionMock },
+    })),
+}));
+let db;
+beforeAll(async () => {
+    db = await createTestDb([]);
+});
+afterAll(async () => {
+    await db.drop();
+});
+beforeEach(() => {
+    createAuthMock.mockClear();
+    getSessionMock.mockClear();
+    getSessionMock.mockResolvedValue(null);
+});
+describe('SessionResolver (real PG-backed drizzle)', () => {
+    it('hands the drizzle db and the injected schema to better-auth exactly once', () => {
+        const schema = { session: {} };
+        new SessionResolver(db.drizzle, schema);
+        expect(createAuthMock).toHaveBeenCalledTimes(1);
+        expect(createAuthMock).toHaveBeenCalledWith({ db: db.drizzle.db, schema });
+    });
+    it('omits the schema key when none is injected', () => {
+        new SessionResolver(db.drizzle);
+        expect(createAuthMock).toHaveBeenCalledWith({ db: db.drizzle.db });
+    });
+    it('returns undefined when there is no session', async () => {
+        const resolver = new SessionResolver(db.drizzle);
+        expect(await resolver.resolveUserId(new Headers())).toBeUndefined();
+    });
+    it('returns the user id when a session resolves', async () => {
+        const userId = randomUUID();
+        getSessionMock.mockResolvedValueOnce({ user: { id: userId } });
+        const resolver = new SessionResolver(db.drizzle);
+        expect(await resolver.resolveUserId(new Headers())).toBe(userId);
+    });
+    it('forwards the caller headers to better-auth', async () => {
+        const resolver = new SessionResolver(db.drizzle);
+        const headers = new Headers({ cookie: 'session=abc' });
+        await resolver.resolveUserId(headers);
+        expect(getSessionMock).toHaveBeenCalledWith({ headers });
+    });
+    it('returns undefined for a session without a user', async () => {
+        getSessionMock.mockResolvedValueOnce({});
+        const resolver = new SessionResolver(db.drizzle);
+        expect(await resolver.resolveUserId(new Headers())).toBeUndefined();
+    });
+});
+//# sourceMappingURL=session-resolver.int.test.js.map

package/dist/server/auth/__tests__/session-resolver.int.test.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"session-resolver.int.test.js","sourceRoot":"","sources":["../../../../src/server/auth/__tests__/session-resolver.int.test.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,EAAE,EAAE,MAAM,EAAE,EAAE,EAAE,SAAS,EAAE,QAAQ,EAAE,UAAU,EAAE,MAAM,QAAQ,CAAC;AACnF,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,YAAY,EAAe,MAAM,uBAAuB,CAAC;AAClE,OAAO,EAAE,eAAe,EAAE,MAAM,wBAAwB,CAAC;AAEzD,MAAM,EAAE,cAAc,EAAE,cAAc,EAAE,GAAG,EAAE,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC,CAAC;IAC3D,cAAc,EAAE,EAAE,CAAC,EAAE,EAAE;IACvB,cAAc,EAAE,EAAE,CAAC,EAAE,EAAE;CACxB,CAAC,CAAC,CAAC;AAEJ,EAAE,CAAC,IAAI,CAAC,YAAY,EAAE,GAAG,EAAE,CAAC,CAAC;IAC3B,UAAU,EAAE,cAAc,CAAC,kBAAkB,CAAC,GAAG,EAAE,CAAC,CAAC;QACnD,GAAG,EAAE,EAAE,UAAU,EAAE,cAAc,EAAE;KACpC,CAAC,CAAC;CACJ,CAAC,CAAC,CAAC;AAEJ,IAAI,EAAU,CAAC;AAEf,SAAS,CAAC,KAAK,IAAI,EAAE;IACnB,EAAE,GAAG,MAAM,YAAY,CAAC,EAAE,CAAC,CAAC;AAC9B,CAAC,CAAC,CAAC;AAEH,QAAQ,CAAC,KAAK,IAAI,EAAE;IAClB,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC;AAClB,CAAC,CAAC,CAAC;AAEH,UAAU,CAAC,GAAG,EAAE;IACd,cAAc,CAAC,SAAS,EAAE,CAAC;IAC3B,cAAc,CAAC,SAAS,EAAE,CAAC;IAC3B,cAAc,CAAC,iBAAiB,CAAC,IAAI,CAAC,CAAC;AACzC,CAAC,CAAC,CAAC;AAEH,QAAQ,CAAC,0CAA0C,EAAE,GAAG,EAAE;IACxD,EAAE,CAAC,0EAA0E,EAAE,GAAG,EAAE;QAClF,MAAM,MAAM,GAAG,EAAE,OAAO,EAAE,EAAE,EAAE,CAAC;QAE/B,IAAI,eAAe,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;QAExC,MAAM,CAAC,cAAc,CAAC,CAAC,qBAAqB,CAAC,CAAC,CAAC,CAAC;QAChD,MAAM,CAAC,cAAc,CAAC,CAAC,oBAAoB,CAAC,EAAE,EAAE,EAAE,EAAE,CAAC,OAAO,CAAC,EAAE,EAAE,MAAM,EAAE,CAAC,CAAC;IAC7E,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,4CAA4C,EAAE,GAAG,EAAE;QACpD,IAAI,eAAe,CAAC,EAAE,CAAC,OAAO,CAAC,CAAC;QAEhC,MAAM,CAAC,cAAc,CAAC,CAAC,oBAAoB,CAAC,EAAE,EAAE,EAAE,EAAE,CAAC,OAAO,CAAC,EAAE,EAAE,CAAC,CAAC;IACrE,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,4CAA4C,EAAE,KAAK,IAAI,EAAE;QAC1D,MAAM,QAAQ,GAAG,IAAI,eAAe,CAAC,EAAE,CAAC,OAAO,CAAC,CAAC;QAEjD,MAAM,CAAC,MAAM,QAAQ,CAAC,aAAa,CAAC,IAAI,OAAO,EAAE,CAAC,CAAC,CAAC,aAAa,EAAE,CAAC;IACtE,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,6CAA6C,EAAE,KAAK,IAAI,EAAE;QAC3D,MAAM,MAAM,GAAG,UAAU,EAAE,CAAC;QAC5B,cAAc,CAAC,qBAAqB,CAAC,EAAE,IAAI,EAAE,EAAE,EAAE,EAAE,MAAM,EAAE,EAAE,CAAC,CAAC;QAC/D,MAAM,QAAQ,GAAG,IAAI,eAAe,CAAC,EAAE,CAAC,OAAO,CAAC,CAAC;QAEjD,MAAM,CAAC,MAAM,QAAQ,CAAC,aAAa,CAAC,IAAI,OAAO,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;IACnE,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,4CAA4C,EAAE,KAAK,IAAI,EAAE;QAC1D,MAAM,QAAQ,GAAG,IAAI,eAAe,CAAC,EAAE,CAAC,OAAO,CAAC,CAAC;QACjD,MAAM,OAAO,GAAG,IAAI,OAAO,CAAC,EAAE,MAAM,EAAE,aAAa,EAAE,CAAC,CAAC;QAEvD,MAAM,QAAQ,CAAC,aAAa,CAAC,OAAO,CAAC,CAAC;QAEtC,MAAM,CAAC,cAAc,CAAC,CAAC,oBAAoB,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC;IAC3D,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,gDAAgD,EAAE,KAAK,IAAI,EAAE;QAC9D,cAAc,CAAC,qBAAqB,CAAC,EAAE,CAAC,CAAC;QACzC,MAAM,QAAQ,GAAG,IAAI,eAAe,CAAC,EAAE,CAAC,OAAO,CAAC,CAAC;QAEjD,MAAM,CAAC,MAAM,QAAQ,CAAC,aAAa,CAAC,IAAI,OAAO,EAAE,CAAC,CAAC,CAAC,aAAa,EAAE,CAAC;IACtE,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC"}

package/dist/server/auth/__tests__/sign-session-cookie.test.d.ts

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=sign-session-cookie.test.d.ts.map

package/dist/server/auth/__tests__/sign-session-cookie.test.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sign-session-cookie.test.d.ts","sourceRoot":"","sources":["../../../../src/server/auth/__tests__/sign-session-cookie.test.ts"],"names":[],"mappings":""}

package/dist/server/auth/__tests__/sign-session-cookie.test.js

@@ -0,0 +1,59 @@
+import { describe, it, expect } from 'vitest';
+import { signSessionCookie } from '../sign-session-cookie.js';
+const SESSION_COOKIE = {
+    name: 'better-auth.session_token',
+    attributes: { httpOnly: true, secure: false, sameSite: 'lax', path: '/' },
+};
+describe('signSessionCookie', () => {
+    it('produces a signature matching a known-good vector', () => {
+        const cookie = signSessionCookie({
+            token: 'fixed-token-for-golden-vector',
+            sessionCookie: SESSION_COOKIE,
+            secret: 'unit-test-secret-do-not-use-in-prod',
+            maxAgeSeconds: 3600,
+        });
+        expect(cookie).toContain('better-auth.session_token=fixed-token-for-golden-vector.HUa0peblWWtfebbtuTmir7Km5kqZbRR2ZVIMnEP8BDQ%3D');
+    });
+    it('carries the cookie attributes and the given max-age', () => {
+        const cookie = signSessionCookie({
+            token: 't',
+            sessionCookie: SESSION_COOKIE,
+            secret: 's',
+            maxAgeSeconds: 86_400,
+        });
+        expect(cookie).toContain('Max-Age=86400');
+        expect(cookie).toContain('Path=/');
+        expect(cookie).toContain('HttpOnly');
+        expect(cookie).toContain('SameSite=Lax');
+        expect(cookie).not.toContain('Secure');
+    });
+    it('differs for different secrets, so a signature cannot be replayed across environments', () => {
+        const a = signSessionCookie({
+            token: 'same-token',
+            sessionCookie: SESSION_COOKIE,
+            secret: 'secret-a',
+            maxAgeSeconds: 60,
+        });
+        const b = signSessionCookie({
+            token: 'same-token',
+            sessionCookie: SESSION_COOKIE,
+            secret: 'secret-b',
+            maxAgeSeconds: 60,
+        });
+        expect(a).not.toBe(b);
+    });
+    it('omits Max-Age when no ttl is given, producing a real browser session cookie', () => {
+        const cookieWithInheritedDefault = {
+            name: 'better-auth.session_token',
+            attributes: { ...SESSION_COOKIE.attributes, maxAge: 7 * 24 * 60 * 60 },
+        };
+        const cookie = signSessionCookie({
+            token: 't',
+            sessionCookie: cookieWithInheritedDefault,
+            secret: 's',
+            maxAgeSeconds: undefined,
+        });
+        expect(cookie).not.toContain('Max-Age');
+    });
+});
+//# sourceMappingURL=sign-session-cookie.test.js.map

package/dist/server/auth/__tests__/sign-session-cookie.test.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sign-session-cookie.test.js","sourceRoot":"","sources":["../../../../src/server/auth/__tests__/sign-session-cookie.test.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,EAAE,EAAE,MAAM,EAAE,MAAM,QAAQ,CAAC;AAC9C,OAAO,EAAE,iBAAiB,EAAE,MAAM,2BAA2B,CAAC;AAE9D,MAAM,cAAc,GAAG;IACrB,IAAI,EAAE,2BAA2B;IACjC,UAAU,EAAE,EAAE,QAAQ,EAAE,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,QAAQ,EAAE,KAAc,EAAE,IAAI,EAAE,GAAG,EAAE;CACnF,CAAC;AAEF,QAAQ,CAAC,mBAAmB,EAAE,GAAG,EAAE;IACjC,EAAE,CAAC,mDAAmD,EAAE,GAAG,EAAE;QAC3D,MAAM,MAAM,GAAG,iBAAiB,CAAC;YAC/B,KAAK,EAAE,+BAA+B;YACtC,aAAa,EAAE,cAAc;YAC7B,MAAM,EAAE,qCAAqC;YAC7C,aAAa,EAAE,IAAI;SACpB,CAAC,CAAC;QAEH,MAAM,CAAC,MAAM,CAAC,CAAC,SAAS,CACtB,wGAAwG,CACzG,CAAC;IACJ,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,qDAAqD,EAAE,GAAG,EAAE;QAC7D,MAAM,MAAM,GAAG,iBAAiB,CAAC;YAC/B,KAAK,EAAE,GAAG;YACV,aAAa,EAAE,cAAc;YAC7B,MAAM,EAAE,GAAG;YACX,aAAa,EAAE,MAAM;SACtB,CAAC,CAAC;QAEH,MAAM,CAAC,MAAM,CAAC,CAAC,SAAS,CAAC,eAAe,CAAC,CAAC;QAC1C,MAAM,CAAC,MAAM,CAAC,CAAC,SAAS,CAAC,QAAQ,CAAC,CAAC;QACnC,MAAM,CAAC,MAAM,CAAC,CAAC,SAAS,CAAC,UAAU,CAAC,CAAC;QACrC,MAAM,CAAC,MAAM,CAAC,CAAC,SAAS,CAAC,cAAc,CAAC,CAAC;QACzC,MAAM,CAAC,MAAM,CAAC,CAAC,GAAG,CAAC,SAAS,CAAC,QAAQ,CAAC,CAAC;IACzC,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,sFAAsF,EAAE,GAAG,EAAE;QAC9F,MAAM,CAAC,GAAG,iBAAiB,CAAC;YAC1B,KAAK,EAAE,YAAY;YACnB,aAAa,EAAE,cAAc;YAC7B,MAAM,EAAE,UAAU;YAClB,aAAa,EAAE,EAAE;SAClB,CAAC,CAAC;QACH,MAAM,CAAC,GAAG,iBAAiB,CAAC;YAC1B,KAAK,EAAE,YAAY;YACnB,aAAa,EAAE,cAAc;YAC7B,MAAM,EAAE,UAAU;YAClB,aAAa,EAAE,EAAE;SAClB,CAAC,CAAC;QACH,MAAM,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IACxB,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,6EAA6E,EAAE,GAAG,EAAE;QACrF,MAAM,0BAA0B,GAAG;YACjC,IAAI,EAAE,2BAA2B;YACjC,UAAU,EAAE,EAAE,GAAG,cAAc,CAAC,UAAU,EAAE,MAAM,EAAE,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,EAAE;SACvE,CAAC;QAEF,MAAM,MAAM,GAAG,iBAAiB,CAAC;YAC/B,KAAK,EAAE,GAAG;YACV,aAAa,EAAE,0BAA0B;YACzC,MAAM,EAAE,GAAG;YACX,aAAa,EAAE,SAAS;SACzB,CAAC,CAAC;QAEH,MAAM,CAAC,MAAM,CAAC,CAAC,GAAG,CAAC,SAAS,CAAC,SAAS,CAAC,CAAC;IAC1C,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC"}

package/dist/server/auth/admin-guard.d.ts

@@ -1,9 +1,13 @@
-import { type Token, type AdminPermissionResolver } from '@openora/core/contracts';
+import { type Token, type AdminPermissionResolver, type AdminSecurityPolicy, type IdentityReader, type ClientMeta } from '@openora/core/contracts';
 import { DrizzleService } from '../db/index.js';
 import { SessionResolver } from './session-resolver.js';
 import { type ResourceName, type ActionOf } from './permissions.js';
 import type { EventBus } from '../kernel/index.js';
 export declare const ADMIN_GUARD: Token<AdminGuard>;
+export type AdminCaller = {
+    userId: string;
+    role: string;
+} & ClientMeta;
 /**
  * The single admin-enforcement point - every admin route calls `assert()` as its
  * first line, never re-implementing the role check. Overload without
@@ -21,15 +25,14 @@ export declare class AdminGuard {
     private readonly sessions;
     private readonly permissionResolver?;
     private readonly events?;
-    constructor(drizzle: DrizzleService, sessions: SessionResolver, permissionResolver?: AdminPermissionResolver | undefined, events?: EventBus | undefined);
-    assert(context: unknown): Promise<{
-        userId: string;
-        role: string;
-    }>;
-    assert<R extends ResourceName>(context: unknown, resource: R, action: ActionOf<R>): Promise<{
-        userId: string;
-        role: string;
-    }>;
+    private readonly identityReader?;
+    private readonly securityPolicy?;
+    constructor(drizzle: DrizzleService, sessions: SessionResolver, permissionResolver?: AdminPermissionResolver | undefined, events?: EventBus | undefined, identityReader?: IdentityReader | undefined, securityPolicy?: AdminSecurityPolicy | undefined);
+    assert(context: unknown): Promise<AdminCaller>;
+    assert<R extends ResourceName>(context: unknown, resource: R, action: ActionOf<R>): Promise<AdminCaller>;
+    assertSuperAdmin(context: unknown): Promise<AdminCaller>;
+    private resolveGrants;
+    private checkGrant;
     private emitUnauthorized;
 }
 //# sourceMappingURL=admin-guard.d.ts.map

package/dist/server/auth/admin-guard.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"admin-guard.d.ts","sourceRoot":"","sources":["../../../src/server/auth/admin-guard.ts"],"names":[],"mappings":"AACA,OAAO,EAAe,KAAK,KAAK,EAAE,KAAK,uBAAuB,EAAE,MAAM,yBAAyB,CAAC;AAChG,OAAO,EAAE,cAAc,EAAE,MAAM,gBAAgB,CAAC;AAEhD,OAAO,EAAE,eAAe,EAAE,MAAM,uBAAuB,CAAC;AACxD,OAAO,EAAS,KAAK,YAAY,EAAE,KAAK,QAAQ,EAAE,MAAM,kBAAkB,CAAC;AAC3E,OAAO,KAAK,EAAc,QAAQ,EAAE,MAAM,oBAAoB,CAAC;AAE/D,eAAO,MAAM,WAAW,EAAE,KAAK,CAAC,UAAU,CAA8B,CAAC;AAEzE;;;;;;;;;;;GAWG;AACH,qBAAa,UAAU;IAGnB,OAAO,CAAC,QAAQ,CAAC,OAAO;IACxB,OAAO,CAAC,QAAQ,CAAC,QAAQ;IAEzB,OAAO,CAAC,QAAQ,CAAC,kBAAkB,CAAC;IACpC,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAC;gBAJP,OAAO,EAAE,cAAc,EACvB,QAAQ,EAAE,eAAe,EAEzB,kBAAkB,CAAC,EAAE,uBAAuB,YAAA,EAC5C,MAAM,CAAC,EAAE,QAAQ,YAAA;IAG9B,MAAM,CAAC,OAAO,EAAE,OAAO,GAAG,OAAO,CAAC;QAAE,MAAM,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAA;KAAE,CAAC;IACnE,MAAM,CAAC,CAAC,SAAS,YAAY,EACjC,OAAO,EAAE,OAAO,EAChB,QAAQ,EAAE,CAAC,EACX,MAAM,EAAE,QAAQ,CAAC,CAAC,CAAC,GAClB,OAAO,CAAC;QAAE,MAAM,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAA;KAAE,CAAC;IA0E5C,OAAO,CAAC,gBAAgB;CAmBzB"}
+{"version":3,"file":"admin-guard.d.ts","sourceRoot":"","sources":["../../../src/server/auth/admin-guard.ts"],"names":[],"mappings":"AACA,OAAO,EAGL,KAAK,KAAK,EACV,KAAK,uBAAuB,EAE5B,KAAK,mBAAmB,EACxB,KAAK,cAAc,EACnB,KAAK,UAAU,EAChB,MAAM,yBAAyB,CAAC;AACjC,OAAO,EAAE,cAAc,EAAE,MAAM,gBAAgB,CAAC;AAEhD,OAAO,EAAE,eAAe,EAAE,MAAM,uBAAuB,CAAC;AACxD,OAAO,EAAS,KAAK,YAAY,EAAE,KAAK,QAAQ,EAAE,MAAM,kBAAkB,CAAC;AAC3E,OAAO,KAAK,EAAc,QAAQ,EAAE,MAAM,oBAAoB,CAAC;AAI/D,eAAO,MAAM,WAAW,EAAE,KAAK,CAAC,UAAU,CAA8B,CAAC;AAIzE,MAAM,MAAM,WAAW,GAAG;IAAE,MAAM,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAA;CAAE,GAAG,UAAU,CAAC;AAExE;;;;;;;;;;;GAWG;AACH,qBAAa,UAAU;IAGnB,OAAO,CAAC,QAAQ,CAAC,OAAO;IACxB,OAAO,CAAC,QAAQ,CAAC,QAAQ;IAEzB,OAAO,CAAC,QAAQ,CAAC,kBAAkB,CAAC;IACpC,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAC;IAIxB,OAAO,CAAC,QAAQ,CAAC,cAAc,CAAC;IAGhC,OAAO,CAAC,QAAQ,CAAC,cAAc,CAAC;gBAXf,OAAO,EAAE,cAAc,EACvB,QAAQ,EAAE,eAAe,EAEzB,kBAAkB,CAAC,EAAE,uBAAuB,YAAA,EAC5C,MAAM,CAAC,EAAE,QAAQ,YAAA,EAIjB,cAAc,CAAC,EAAE,cAAc,YAAA,EAG/B,cAAc,CAAC,EAAE,mBAAmB,YAAA;IAGjD,MAAM,CAAC,OAAO,EAAE,OAAO,GAAG,OAAO,CAAC,WAAW,CAAC;IAC9C,MAAM,CAAC,CAAC,SAAS,YAAY,EACjC,OAAO,EAAE,OAAO,EAChB,QAAQ,EAAE,CAAC,EACX,MAAM,EAAE,QAAQ,CAAC,CAAC,CAAC,GAClB,OAAO,CAAC,WAAW,CAAC;IA2FjB,gBAAgB,CAAC,OAAO,EAAE,OAAO,GAAG,OAAO,CAAC,WAAW,CAAC;IAsB9D,OAAO,CAAC,aAAa;IAMrB,OAAO,CAAC,UAAU;IAYlB,OAAO,CAAC,gBAAgB;CA4BzB"}