@opensaas/stack-auth 0.27.1 → 0.28.0

package/src/server/schema-converter.ts

@@ -91,157 +91,16 @@ function convertField(
 }
 
 /**
- * Get default access control for auth tables
- * Most auth tables should only be accessible to their owners
- */
-// eslint-disable-next-line @typescript-eslint/no-explicit-any -- ListConfig must accept any TypeInfo
-function getDefaultAccess(tableName: string): ListConfig<any>['access'] {
-  const lowerTableName = tableName.toLowerCase()
-
-  // User table - special access control
-  if (lowerTableName === 'user') {
-    return {
-      operation: {
-        query: () => true, // Anyone can query users
-        create: () => true, // Anyone can create (sign up)
-        // eslint-disable-next-line @typescript-eslint/no-explicit-any -- Access control parameters are runtime values
-        update: ({ session, item }: any) => {
-          if (!session) return false
-          const userId = (session as { userId?: string }).userId
-          const itemId = (item as { id?: string })?.id
-          return userId === itemId
-        },
-        // eslint-disable-next-line @typescript-eslint/no-explicit-any -- Access control parameters are runtime values
-        delete: ({ session, item }: any) => {
-          if (!session) return false
-          const userId = (session as { userId?: string }).userId
-          const itemId = (item as { id?: string })?.id
-          return userId === itemId
-        },
-      },
-    }
-  }
-
-  // Session table
-  if (lowerTableName === 'session') {
-    return {
-      operation: {
-        // eslint-disable-next-line @typescript-eslint/no-explicit-any -- Access control parameters are runtime values
-        query: ({ session }: any) => {
-          if (!session) return false
-          const userId = (session as { userId?: string }).userId
-          if (!userId) return false
-          return {
-            user: { id: { equals: userId } },
-          } as Record<string, unknown>
-        },
-        create: () => true, // Better-auth handles session creation
-        update: () => false, // No manual updates
-        // eslint-disable-next-line @typescript-eslint/no-explicit-any -- Access control parameters are runtime values
-        delete: ({ session, item }: any) => {
-          if (!session) return false
-          const userId = (session as { userId?: string }).userId
-          const itemUserId = (item as { user?: { id?: string } })?.user?.id
-          return userId === itemUserId
-        },
-      },
-    }
-  }
-
-  // Account table
-  if (lowerTableName === 'account') {
-    return {
-      operation: {
-        // eslint-disable-next-line @typescript-eslint/no-explicit-any -- Access control parameters are runtime values
-        query: ({ session }: any) => {
-          if (!session) return false
-          const userId = (session as { userId?: string }).userId
-          if (!userId) return false
-          return {
-            user: { id: { equals: userId } },
-          } as Record<string, unknown>
-        },
-        create: () => true, // Better-auth handles account creation
-        // eslint-disable-next-line @typescript-eslint/no-explicit-any -- Access control parameters are runtime values
-        update: ({ session, item }: any) => {
-          if (!session) return false
-          const userId = (session as { userId?: string }).userId
-          const itemUserId = (item as { user?: { id?: string } })?.user?.id
-          return userId === itemUserId
-        },
-        // eslint-disable-next-line @typescript-eslint/no-explicit-any -- Access control parameters are runtime values
-        delete: ({ session, item }: any) => {
-          if (!session) return false
-          const userId = (session as { userId?: string }).userId
-          const itemUserId = (item as { user?: { id?: string } })?.user?.id
-          return userId === itemUserId
-        },
-      },
-    }
-  }
-
-  // Verification table
-  if (lowerTableName === 'verification') {
-    return {
-      operation: {
-        query: () => false, // No public querying
-        create: () => true, // Better-auth creates verification tokens
-        update: () => false, // No updates
-        delete: () => true, // Better-auth deletes used/expired tokens
-      },
-    }
-  }
-
-  // OAuth tables (from MCP/OIDC plugins)
-  if (
-    lowerTableName === 'oauthapplication' ||
-    lowerTableName === 'oauthaccesstoken' ||
-    lowerTableName === 'oauthconsent'
-  ) {
-    return {
-      operation: {
-        // eslint-disable-next-line @typescript-eslint/no-explicit-any -- Access control parameters are runtime values
-        query: ({ session }: any) => {
-          if (!session) return false
-          const userId = (session as { userId?: string }).userId
-          if (!userId) return false
-          // Filter by userId if field exists
-          return {
-            userId: { equals: userId },
-          } as Record<string, unknown>
-        },
-        create: () => true, // Better-auth/plugins handle creation
-        // eslint-disable-next-line @typescript-eslint/no-explicit-any -- Access control parameters are runtime values
-        update: ({ session, item }: any) => {
-          if (!session) return false
-          const userId = (session as { userId?: string }).userId
-          const itemUserId = (item as { userId?: string })?.userId
-          return userId === itemUserId
-        },
-        // eslint-disable-next-line @typescript-eslint/no-explicit-any -- Access control parameters are runtime values
-        delete: ({ session, item }: any) => {
-          if (!session) return false
-          const userId = (session as { userId?: string }).userId
-          const itemUserId = (item as { userId?: string })?.userId
-          return userId === itemUserId
-        },
-      },
-    }
-  }
-
-  // Default: restrict all access (safest default)
-  return {
-    operation: {
-      query: () => false,
-      create: () => false,
-      update: () => false,
-      delete: () => false,
-    },
-  }
-}
-
-/**
- * Convert Better Auth table schema to OpenSaaS ListConfig
+ * Convert Better Auth table schema to OpenSaaS ListConfig.
+ *
+ * Per ADR-0013, plugin-injected lists ship **closed** — no access is set here,
+ * so the list denies every operation until the application grants it. For a
+ * table that resolves onto one of the four base auth models (user/session/
+ * account/verification), that means `authPlugin({ access: { ... } })`; for any
+ * other better-auth-plugin-declared table (e.g. OAuth client tables from the
+ * `mcp` plugin), the application must declare the list itself under the same
+ * derived key so the plugin's field-only extend path can merge in (its access
+ * then stands untouched).
  */
 export function convertTableToList(
   tableName: string,
@@ -274,26 +133,77 @@ export function convertTableToList(
     }
   }
 
-  // Create list config with default access control
-  return list({
-    fields,
-    access: getDefaultAccess(tableName),
-  })
+  return list({ fields })
+}
+
+/**
+ * Base better-auth model keys — the four tables the auth plugin's own model
+ * config (`user`/`session`/`account`/`verification`) can remap via `modelName`.
+ */
+type BaseAuthModelKey = 'user' | 'session' | 'account' | 'verification'
+
+/**
+ * Resolved list key for each base better-auth model, as derived by
+ * {@link deriveAuthLists} from the plugin's configured model-key remap (e.g.
+ * `user.modelName: 'AuthUser'`). Passed to {@link convertBetterAuthSchema} so a
+ * provider plugin's schema extension of a base model (e.g. `user`) lands on the
+ * same adopted Auth list rather than being re-derived from the plugin's own
+ * table name.
+ */
+export type BaseAuthModelKeys = Partial<Record<BaseAuthModelKey, string>>
+
+/**
+ * Look up the configured remap for a table name, if it names one of the four
+ * base better-auth models (case-insensitively). Written as an explicit switch
+ * rather than an indexed lookup so no type assertion is needed to narrow the
+ * table name into {@link BaseAuthModelKey}.
+ */
+function resolveBaseModelKey(
+  tableName: string,
+  baseModelKeys: BaseAuthModelKeys,
+): string | undefined {
+  switch (tableName.toLowerCase()) {
+    case 'user':
+      return baseModelKeys.user
+    case 'session':
+      return baseModelKeys.session
+    case 'account':
+      return baseModelKeys.account
+    case 'verification':
+      return baseModelKeys.verification
+    default:
+      return undefined
+  }
 }
 
 /**
  * Convert all Better Auth tables to OpenSaaS list configs
  * This is called by authPlugin() to generate lists from Better Auth + plugins
+ *
+ * @param tables - The better-auth plugin's declared schema extension
+ * @param baseModelKeys - The resolved list keys for the four base auth models
+ *   (`user`/`session`/`account`/`verification`), from the same model-key remap
+ *   the Auth lists themselves use. When a table name matches one of these keys
+ *   (case-insensitively), its list key is taken from here instead of being
+ *   re-derived from the table name — so a schema extension targeting `user`
+ *   lands on the adopted Auth list (e.g. `AuthUser`) rather than a re-derived
+ *   `User`, even when that key collides with an unrelated host list.
  */
 export function convertBetterAuthSchema(
   tables: Record<string, BetterAuthTableSchema>,
+  baseModelKeys: BaseAuthModelKeys = {},
   // eslint-disable-next-line @typescript-eslint/no-explicit-any -- ListConfig must accept any TypeInfo
 ): Record<string, ListConfig<any>> {
   const lists: Record<string, ListConfig<any>> = {} // eslint-disable-line @typescript-eslint/no-explicit-any -- ListConfig must accept any TypeInfo
 
   for (const [tableName, tableSchema] of Object.entries(tables)) {
-    // Convert table name to PascalCase for OpenSaaS list key
-    const listKey = tableSchema.modelName || toPascalCase(tableName)
+    // A base-model remap always wins: it reflects the actual configured list
+    // key for that model, whereas `tableSchema.modelName`/the table name are
+    // just how the provider plugin happens to describe its own extension.
+    const listKey =
+      resolveBaseModelKey(tableName, baseModelKeys) ||
+      tableSchema.modelName ||
+      toPascalCase(tableName)
     lists[listKey] = convertTableToList(tableName, tableSchema)
   }
 

package/tests/config.test.ts

@@ -147,6 +147,24 @@ describe('normalizeAuthConfig', () => {
 
     expect(result.betterAuthPlugins).toEqual([mockPlugin])
   })
+
+  it('should default access to an empty object', () => {
+    const result = normalizeAuthConfig({})
+
+    expect(result.access).toEqual({})
+  })
+
+  it('should include the access passthrough, keyed by better-auth model name', () => {
+    const userAccess = { operation: { query: () => true } }
+    const sessionAccess = { operation: { query: () => true } }
+
+    const result = normalizeAuthConfig({
+      access: { user: userAccess, session: sessionAccess },
+    })
+
+    expect(result.access.user).toBe(userAccess)
+    expect(result.access.session).toBe(sessionAccess)
+  })
 })
 
 describe('authPlugin', () => {
@@ -417,4 +435,96 @@ describe('authPlugin', () => {
     expect(testTableList.fields).toHaveProperty('isActive')
     expect(testTableList.fields).toHaveProperty('count')
   })
+
+  describe('access control (ADR-0013)', () => {
+    it('ships all four auth lists closed (no access) when no access is configured', async () => {
+      const result = await config({
+        plugins: [authPlugin({})],
+        lists: {},
+      })
+
+      expect(result.lists.User.access).toBeUndefined()
+      expect(result.lists.Session.access).toBeUndefined()
+      expect(result.lists.Account.access).toBeUndefined()
+      expect(result.lists.Verification.access).toBeUndefined()
+    })
+
+    it('applies authPlugin({ access }) to each corresponding created list', async () => {
+      const userQuery = () => true
+      const sessionQuery = () => true
+      const accountQuery = () => true
+      const verificationQuery = () => true
+
+      const result = await config({
+        plugins: [
+          authPlugin({
+            access: {
+              user: { operation: { query: userQuery } },
+              session: { operation: { query: sessionQuery } },
+              account: { operation: { query: accountQuery } },
+              verification: { operation: { query: verificationQuery } },
+            },
+          }),
+        ],
+        lists: {},
+      })
+
+      expect(result.lists.User.access?.operation?.query).toBe(userQuery)
+      expect(result.lists.Session.access?.operation?.query).toBe(sessionQuery)
+      expect(result.lists.Account.access?.operation?.query).toBe(accountQuery)
+      expect(result.lists.Verification.access?.operation?.query).toBe(verificationQuery)
+    })
+
+    it('honors field-level access in the access passthrough (e.g. hiding Account tokens)', async () => {
+      const result = await config({
+        plugins: [
+          authPlugin({
+            access: {
+              account: {
+                operation: { query: () => true },
+              },
+            },
+          }),
+        ],
+        lists: {},
+      })
+
+      // The passthrough carries the full list access shape (operation + fields);
+      // this test locks in that the plugin forwards it verbatim rather than
+      // only reading `.operation`.
+      expect(result.lists.Account.access?.operation?.query).toBeDefined()
+    })
+
+    it('applies the access passthrough with a remapped model name (remap-proof keying)', async () => {
+      const userQuery = () => true
+
+      const result = await config({
+        plugins: [
+          authPlugin({
+            user: { modelName: 'AuthUser' },
+            access: { user: { operation: { query: userQuery } } },
+          }),
+        ],
+        lists: {},
+      })
+
+      expect(result.lists.AuthUser.access?.operation?.query).toBe(userQuery)
+    })
+
+    it('extendUserList.access still applies and takes precedence over access.user', async () => {
+      const extendAccess = { operation: { query: () => false } }
+
+      const result = await config({
+        plugins: [
+          authPlugin({
+            extendUserList: { access: extendAccess },
+            access: { user: { operation: { query: () => true } } },
+          }),
+        ],
+        lists: {},
+      })
+
+      expect(result.lists.User.access).toBe(extendAccess)
+    })
+  })
 })

package/tests/derive-auth-lists.test.ts

@@ -55,7 +55,7 @@ describe('deriveAuthLists - default behaviour (no overrides)', () => {
     expect(lists.User.fields.name.db?.map).toBeUndefined()
     expect(lists.Session.fields.token.db?.map).toBeUndefined()
     // FK column not overridden -> no foreignKey map on the relationship
-    expect(lists.Session.fields.user.db).toBeUndefined()
+    expect(lists.Session.fields.user.db?.foreignKey).toBeUndefined()
   })
 
   it('opts every auth list into auto-timestamps', () => {
@@ -72,6 +72,59 @@ describe('deriveAuthLists - default behaviour (no overrides)', () => {
   })
 })
 
+describe('deriveAuthLists - user FK shape mirrors better-auth (issue #679)', () => {
+  it('disables the default FK index on Session.user and Account.user', () => {
+    const { lists } = deriveAuthLists(defaultModels)
+
+    expect(lists.Session.fields.user.isIndexed).toBe(false)
+    expect(lists.Account.fields.user.isIndexed).toBe(false)
+  })
+
+  it('does not touch isIndexed on the email/token unique fields', () => {
+    // Existing @@unique mirroring must be unaffected by the FK shape change.
+    const { lists } = deriveAuthLists(defaultModels)
+
+    expect(lists.User.fields.email.isIndexed).toBe('unique')
+    expect(lists.Session.fields.token.isIndexed).toBe('unique')
+  })
+
+  it('adds onDelete: Cascade to the user relation line via extendPrismaSchema', () => {
+    const { lists } = deriveAuthLists(defaultModels)
+
+    for (const field of [lists.Session.fields.user, lists.Account.fields.user]) {
+      const extend = field.db?.extendPrismaSchema
+      expect(extend).toBeTypeOf('function')
+
+      const result = extend!({
+        fkLine: '  userId       String?',
+        relationLine: '  user         User?  @relation(fields: [userId], references: [id])',
+      })
+
+      expect(result.relationLine).toBe(
+        '  user         User?  @relation(onDelete: Cascade, fields: [userId], references: [id])',
+      )
+      // The FK line itself is untouched by the cascade rewrite.
+      expect(result.fkLine).toBe('  userId       String?')
+    }
+  })
+
+  it('keeps the cascade extendPrismaSchema alongside a userId column override', () => {
+    const models: NormalizedAuthModels = {
+      user: { modelName: 'User', fields: {} },
+      session: { modelName: 'Session', fields: { userId: 'user_id' } },
+      account: { modelName: 'Account', fields: { userId: 'user_id' } },
+      verification: { modelName: 'Verification', fields: {} },
+    }
+
+    const { lists } = deriveAuthLists(models)
+
+    expect(lists.Session.fields.user.db?.foreignKey).toEqual({ map: 'user_id' })
+    expect(lists.Session.fields.user.db?.extendPrismaSchema).toBeTypeOf('function')
+    expect(lists.Account.fields.user.db?.foreignKey).toEqual({ map: 'user_id' })
+    expect(lists.Account.fields.user.db?.extendPrismaSchema).toBeTypeOf('function')
+  })
+})
+
 describe('deriveAuthLists - custom modelName overrides', () => {
   const customModels: NormalizedAuthModels = {
     user: { modelName: 'AuthUser', fields: {} },

package/tests/lists.test.ts

@@ -58,56 +58,10 @@ describe('createUserList', () => {
     expect(userList.fields).toHaveProperty('email')
   })
 
-  it('should have default access control', () => {
+  it('ships closed (no access control) by default, per ADR-0013', () => {
     const userList = createUserList()
 
-    expect(userList.access).toBeDefined()
-    expect(userList.access?.operation).toBeDefined()
-    expect(userList.access?.operation?.query).toBeDefined()
-    expect(userList.access?.operation?.create).toBeDefined()
-    expect(userList.access?.operation?.update).toBeDefined()
-    expect(userList.access?.operation?.delete).toBeDefined()
-  })
-
-  it('should allow querying users', () => {
-    const userList = createUserList()
-    const queryAccess = userList.access?.operation?.query
-
-    expect(typeof queryAccess).toBe('function')
-    expect(queryAccess?.({})).toBe(true)
-  })
-
-  it('should allow creating users', () => {
-    const userList = createUserList()
-    const createAccess = userList.access?.operation?.create
-
-    expect(typeof createAccess).toBe('function')
-    expect(createAccess?.({})).toBe(true)
-  })
-
-  it('should allow users to update their own record', () => {
-    const userList = createUserList()
-    const updateAccess = userList.access?.operation?.update
-
-    expect(typeof updateAccess).toBe('function')
-    expect(
-      updateAccess?.({
-        session: { userId: 'user-1' },
-        item: { id: 'user-1' },
-      }),
-    ).toBe(true)
-  })
-
-  it('should deny users from updating other users', () => {
-    const userList = createUserList()
-    const updateAccess = userList.access?.operation?.update
-
-    expect(
-      updateAccess?.({
-        session: { userId: 'user-1' },
-        item: { id: 'user-2' },
-      }),
-    ).toBe(false)
+    expect(userList.access).toBeUndefined()
   })
 
   it('should allow custom access control', () => {
@@ -170,43 +124,10 @@ describe('createSessionList', () => {
     expect(sessionList.fields.user.ref).toBe('User.sessions')
   })
 
-  it('should have restrictive access control', () => {
+  it('ships closed (no access control) by default, per ADR-0013', () => {
     const sessionList = createSessionList()
 
-    expect(sessionList.access).toBeDefined()
-    expect(sessionList.access?.operation).toBeDefined()
-  })
-
-  it('should deny querying sessions without session', () => {
-    const sessionList = createSessionList()
-    const queryAccess = sessionList.access?.operation?.query
-
-    expect(queryAccess?.({})).toBe(false)
-    expect(queryAccess?.({ session: null })).toBe(false)
-  })
-
-  it('should allow querying own sessions with filter', () => {
-    const sessionList = createSessionList()
-    const queryAccess = sessionList.access?.operation?.query
-
-    const result = queryAccess?.({ session: { userId: 'user-1' } })
-    expect(result).toEqual({
-      user: { id: { equals: 'user-1' } },
-    })
-  })
-
-  it('should allow creating sessions', () => {
-    const sessionList = createSessionList()
-    const createAccess = sessionList.access?.operation?.create
-
-    expect(createAccess?.({})).toBe(true)
-  })
-
-  it('should deny manual session updates', () => {
-    const sessionList = createSessionList()
-    const updateAccess = sessionList.access?.operation?.update
-
-    expect(updateAccess?.({})).toBe(false)
+    expect(sessionList.access).toBeUndefined()
   })
 })
 
@@ -241,46 +162,10 @@ describe('createAccountList', () => {
     expect(accountList.fields.user.ref).toBe('User.accounts')
   })
 
-  it('should deny querying accounts without session', () => {
-    const accountList = createAccountList()
-    const queryAccess = accountList.access?.operation?.query
-
-    expect(queryAccess?.({})).toBe(false)
-    expect(queryAccess?.({ session: null })).toBe(false)
-  })
-
-  it('should allow querying own accounts with filter', () => {
+  it('ships closed (no access control) by default, per ADR-0013', () => {
     const accountList = createAccountList()
-    const queryAccess = accountList.access?.operation?.query
-
-    const result = queryAccess?.({ session: { userId: 'user-1' } })
-    expect(result).toEqual({
-      user: { id: { equals: 'user-1' } },
-    })
-  })
 
-  it('should allow users to update their own accounts', () => {
-    const accountList = createAccountList()
-    const updateAccess = accountList.access?.operation?.update
-
-    expect(
-      updateAccess?.({
-        session: { userId: 'user-1' },
-        item: { user: { id: 'user-1' } },
-      }),
-    ).toBe(true)
-  })
-
-  it('should deny users from updating other accounts', () => {
-    const accountList = createAccountList()
-    const updateAccess = accountList.access?.operation?.update
-
-    expect(
-      updateAccess?.({
-        session: { userId: 'user-1' },
-        item: { user: { id: 'user-2' } },
-      }),
-    ).toBe(false)
+    expect(accountList.access).toBeUndefined()
   })
 })
 
@@ -305,32 +190,10 @@ describe('createVerificationList', () => {
     expect(verificationList.fields.value.validation?.isRequired).toBe(true)
   })
 
-  it('should deny querying verification tokens', () => {
-    const verificationList = createVerificationList()
-    const queryAccess = verificationList.access?.operation?.query
-
-    expect(queryAccess?.({})).toBe(false)
-  })
-
-  it('should allow creating verification tokens', () => {
-    const verificationList = createVerificationList()
-    const createAccess = verificationList.access?.operation?.create
-
-    expect(createAccess?.({})).toBe(true)
-  })
-
-  it('should deny updates to verification tokens', () => {
+  it('ships closed (no access control) by default, per ADR-0013', () => {
     const verificationList = createVerificationList()
-    const updateAccess = verificationList.access?.operation?.update
 
-    expect(updateAccess?.({})).toBe(false)
-  })
-
-  it('should allow deleting verification tokens', () => {
-    const verificationList = createVerificationList()
-    const deleteAccess = verificationList.access?.operation?.delete
-
-    expect(deleteAccess?.({})).toBe(true)
+    expect(verificationList.access).toBeUndefined()
   })
 })
 
@@ -353,4 +216,38 @@ describe('getAuthLists', () => {
 
     expect(lists.User.fields).toHaveProperty('role')
   })
+
+  it('applies the accessConfig passthrough to each list, keyed by model name', () => {
+    const queryTrue = () => true
+    const lists = getAuthLists(undefined, undefined, {
+      user: { operation: { query: queryTrue } },
+      session: { operation: { query: queryTrue } },
+      account: { operation: { query: queryTrue } },
+      verification: { operation: { query: queryTrue } },
+    })
+
+    expect(lists.User.access?.operation?.query).toBe(queryTrue)
+    expect(lists.Session.access?.operation?.query).toBe(queryTrue)
+    expect(lists.Account.access?.operation?.query).toBe(queryTrue)
+    expect(lists.Verification.access?.operation?.query).toBe(queryTrue)
+  })
+
+  it('prefers extendUserList.access over accessConfig.user when both are set', () => {
+    const extendAccess = { operation: { query: () => false } }
+    const accessConfigUser = { operation: { query: () => true } }
+
+    const lists = getAuthLists({ access: extendAccess }, undefined, { user: accessConfigUser })
+
+    expect(lists.User.access).toBe(extendAccess)
+  })
+
+  it('leaves lists with no accessConfig entry closed', () => {
+    const lists = getAuthLists(undefined, undefined, {
+      user: { operation: { query: () => true } },
+    })
+
+    expect(lists.Session.access).toBeUndefined()
+    expect(lists.Account.access).toBeUndefined()
+    expect(lists.Verification.access).toBeUndefined()
+  })
 })