@opensaas/stack-auth 0.27.1 → 0.28.0

package/tests/plugin-derived-keys.test.ts

@@ -71,20 +71,127 @@ describe('authPlugin - add-vs-extend with derived keys', () => {
     expect(user.fields).toHaveProperty('email') // auth field merged in
     expect(user.fields).toHaveProperty('sessions')
   })
+
+  it("does not overwrite an app's admin-only access when the auth plugin extends the same default key (ADR-0013)", async () => {
+    // Regression test for #678: the auth plugin ships permissive defaults
+    // (query: () => true, self-only update/delete) for its own User list.
+    // Before the ADR-0013 fix, extending an app-declared `User` at the
+    // default key forwarded those permissive defaults and silently replaced
+    // the app's admin-only access. Now the plugin must not forward `access`
+    // at all on its extend path, so the app's access survives untouched.
+    const adminOnlyUpdate = vi.fn(() => false)
+    const adminOnlyQuery = vi.fn(() => false)
+
+    const result = await config({
+      db: { provider: 'sqlite' },
+      plugins: [authPlugin({})],
+      lists: {
+        User: list({
+          fields: { bio: text() },
+          access: {
+            operation: {
+              query: adminOnlyQuery,
+              update: adminOnlyUpdate,
+            },
+          },
+        }),
+      },
+    })
+
+    const user = result.lists.User
+    expect(user.fields).toHaveProperty('email') // auth fields still merged in
+    // The app's admin-only access is intact — not replaced by the plugin's
+    // permissive `query: () => true` / self-only `update` defaults.
+    expect(user.access?.operation?.query).toBe(adminOnlyQuery)
+    expect(user.access?.operation?.update).toBe(adminOnlyUpdate)
+    // eslint-disable-next-line @typescript-eslint/no-explicit-any -- access control parameters are runtime values
+    expect(user.access?.operation?.query?.({} as any)).toBe(false)
+  })
+
+  it('routes a better-auth plugin schema extension of `user` onto the remapped Auth list, not an unrelated host User', async () => {
+    // A better-auth provider plugin (e.g. the `anonymous` plugin) that ships a
+    // schema extension for the base `user` model.
+    const anonymousBetterAuthPlugin = {
+      id: 'anonymous',
+      schema: {
+        user: {
+          fields: {
+            isAnonymous: { type: 'boolean', required: false },
+          },
+        },
+      },
+    }
+
+    const hostUserUpdate = vi.fn(() => false)
+    const result = await config({
+      db: { provider: 'sqlite' },
+      plugins: [
+        authPlugin({
+          user: { modelName: 'AuthUser' },
+          session: { modelName: 'AuthSession' },
+          account: { modelName: 'AuthAccount' },
+          verification: { modelName: 'AuthVerification' },
+          betterAuthPlugins: [anonymousBetterAuthPlugin],
+        }),
+      ],
+      lists: {
+        // An app's own unrelated domain list that happens to share the
+        // default (unmapped) auth user key.
+        User: list({
+          fields: {
+            subjectId: text({ validation: { isRequired: true } }),
+          },
+          access: { operation: { update: hostUserUpdate } },
+        }),
+      },
+    })
+
+    // The plugin's schema extension lands on the adopted Auth list...
+    expect(result.lists.AuthUser.fields).toHaveProperty('isAnonymous')
+    expect(result.lists.AuthUser.fields).toHaveProperty('email')
+
+    // ...and the unrelated host `User` list is left completely untouched: no
+    // injected column, and its own (admin-only-style) access control survives
+    // instead of being overwritten by the plugin's permissive defaults.
+    const appUser = result.lists.User
+    expect(appUser.fields).toHaveProperty('subjectId')
+    expect(appUser.fields).not.toHaveProperty('isAnonymous')
+    expect(appUser.fields).not.toHaveProperty('email')
+    // eslint-disable-next-line @typescript-eslint/no-explicit-any -- access control parameters are runtime values
+    expect(appUser.access?.operation?.update?.({} as any)).toBe(false)
+    expect(appUser.access?.operation?.update).toBe(hostUserUpdate)
+  })
 })
 
 describe('authPlugin - runtime user-key resolution', () => {
   /**
-   * Build a minimal AccessContext whose `db` records which model key was
-   * accessed, so we can assert the runtime resolves the configured user model.
+   * Build a minimal AccessContext whose non-sudo `db` always denies (returns
+   * null, as an access-controlled `context.db` read does), plus a separate
+   * `sudo` factory (passed as `plugin.runtime`'s second argument, NOT a
+   * method on `context` itself — see ADR-0013 / the `Plugin['runtime']` doc)
+   * whose `.db` records which model key was accessed and returns the real
+   * record. Since the User list ships closed by default (ADR-0013),
+   * getUser/getCurrentUser only resolve a real user if they go through
+   * `sudo()` rather than the plain `context.db`.
    */
   function makeFakeContext(session: { userId?: string } | null) {
     const accessedKeys: string[] = []
+    const sudoAccessedKeys: string[] = []
+
     const db = new Proxy(
       {},
       {
         get(_target, key: string) {
           accessedKeys.push(key)
+          return { findUnique: async () => null }
+        },
+      },
+    )
+    const sudoDb = new Proxy(
+      {},
+      {
+        get(_target, key: string) {
+          sudoAccessedKeys.push(key)
           return {
             findUnique: async ({ where }: { where: { id: string } }) => ({
               id: where.id,
@@ -94,44 +201,49 @@ describe('authPlugin - runtime user-key resolution', () => {
         },
       },
     )
+    const sudoContext = { session, db: sudoDb, _isSudo: true } as unknown as AccessContext
     const context = { session, db } as unknown as AccessContext
-    return { context, accessedKeys }
+    const sudo = () => sudoContext
+    return { context, sudo, accessedKeys, sudoAccessedKeys }
   }
 
-  it('getUser uses the default `user` db key when no modelName override', () => {
+  it('getUser resolves through sudo(), not the plain (closed-by-default) context.db', async () => {
     const plugin = authPlugin({})
-    const { context, accessedKeys } = makeFakeContext({ userId: 'u1' })
-    const services = plugin.runtime?.(context) as AuthRuntimeServices
+    const { context, sudo, accessedKeys, sudoAccessedKeys } = makeFakeContext({ userId: 'u1' })
+    const services = plugin.runtime?.(context, sudo) as AuthRuntimeServices
 
-    void services.getUser('u1')
-    expect(accessedKeys).toContain('user')
+    const user = (await services.getUser('u1')) as { __model: string }
+    expect(sudoAccessedKeys).toContain('user')
+    expect(accessedKeys).not.toContain('user')
+    expect(user.__model).toBe('user')
   })
 
   it('getUser uses the configured user model db key (AuthUser -> authUser)', async () => {
     const plugin = authPlugin({ user: { modelName: 'AuthUser' } })
-    const { context, accessedKeys } = makeFakeContext({ userId: 'u1' })
-    const services = plugin.runtime?.(context) as AuthRuntimeServices
+    const { context, sudo, sudoAccessedKeys } = makeFakeContext({ userId: 'u1' })
+    const services = plugin.runtime?.(context, sudo) as AuthRuntimeServices
 
     const user = (await services.getUser('u1')) as { __model: string }
-    expect(accessedKeys).toContain('authUser')
-    expect(accessedKeys).not.toContain('user')
+    expect(sudoAccessedKeys).toContain('authUser')
+    expect(sudoAccessedKeys).not.toContain('user')
     expect(user.__model).toBe('authUser')
   })
 
-  it('getCurrentUser uses the configured user model db key', async () => {
+  it('getCurrentUser uses the configured user model db key via sudo()', async () => {
     const plugin = authPlugin({ user: { modelName: 'AuthUser' } })
-    const { context, accessedKeys } = makeFakeContext({ userId: 'u1' })
-    const services = plugin.runtime?.(context) as AuthRuntimeServices
+    const { context, sudo, accessedKeys, sudoAccessedKeys } = makeFakeContext({ userId: 'u1' })
+    const services = plugin.runtime?.(context, sudo) as AuthRuntimeServices
 
     const user = (await services.getCurrentUser()) as { __model: string }
-    expect(accessedKeys).toContain('authUser')
+    expect(sudoAccessedKeys).toContain('authUser')
+    expect(accessedKeys).not.toContain('authUser')
     expect(user.__model).toBe('authUser')
   })
 
   it('getCurrentUser returns null when there is no session', async () => {
     const plugin = authPlugin({ user: { modelName: 'AuthUser' } })
-    const { context } = makeFakeContext(null)
-    const services = plugin.runtime?.(context) as AuthRuntimeServices
+    const { context, sudo } = makeFakeContext(null)
+    const services = plugin.runtime?.(context, sudo) as AuthRuntimeServices
 
     expect(await services.getCurrentUser()).toBeNull()
   })

package/tests/schema-converter.test.ts

@@ -138,7 +138,7 @@ describe('convertTableToList', () => {
     expect(listConfig.fields.customField.type).toBe('text')
   })
 
-  it('should apply default access control for User table', () => {
+  it('should ship the User table closed (no access control) per ADR-0013', () => {
     const tableSchema = {
       modelName: 'User',
       fields: {
@@ -148,12 +148,10 @@ describe('convertTableToList', () => {
 
     const listConfig = convertTableToList('user', tableSchema)
 
-    expect(listConfig.access).toBeDefined()
-    expect(listConfig.access?.operation?.query?.({})).toBe(true)
-    expect(listConfig.access?.operation?.create?.({})).toBe(true)
+    expect(listConfig.access).toBeUndefined()
   })
 
-  it('should apply default access control for Session table', () => {
+  it('should ship the Session table closed (no access control) per ADR-0013', () => {
     const tableSchema = {
       modelName: 'Session',
       fields: {
@@ -163,12 +161,10 @@ describe('convertTableToList', () => {
 
     const listConfig = convertTableToList('session', tableSchema)
 
-    expect(listConfig.access?.operation?.query?.({ session: null })).toBe(false)
-    expect(listConfig.access?.operation?.create?.({})).toBe(true)
-    expect(listConfig.access?.operation?.update?.({})).toBe(false)
+    expect(listConfig.access).toBeUndefined()
   })
 
-  it('should apply default access control for Verification table', () => {
+  it('should ship the Verification table closed (no access control) per ADR-0013', () => {
     const tableSchema = {
       modelName: 'Verification',
       fields: {
@@ -178,13 +174,10 @@ describe('convertTableToList', () => {
 
     const listConfig = convertTableToList('verification', tableSchema)
 
-    expect(listConfig.access?.operation?.query?.({})).toBe(false)
-    expect(listConfig.access?.operation?.create?.({})).toBe(true)
-    expect(listConfig.access?.operation?.update?.({})).toBe(false)
-    expect(listConfig.access?.operation?.delete?.({})).toBe(true)
+    expect(listConfig.access).toBeUndefined()
   })
 
-  it('should apply restrictive default access for unknown tables', () => {
+  it('should ship unknown tables closed (no access control)', () => {
     const tableSchema = {
       modelName: 'UnknownTable',
       fields: {
@@ -194,13 +187,10 @@ describe('convertTableToList', () => {
 
     const listConfig = convertTableToList('unknown_table', tableSchema)
 
-    expect(listConfig.access?.operation?.query?.({})).toBe(false)
-    expect(listConfig.access?.operation?.create?.({})).toBe(false)
-    expect(listConfig.access?.operation?.update?.({})).toBe(false)
-    expect(listConfig.access?.operation?.delete?.({})).toBe(false)
+    expect(listConfig.access).toBeUndefined()
   })
 
-  it('should handle OAuth application table', () => {
+  it('should ship OAuth application table closed (no access control)', () => {
     const tableSchema = {
       modelName: 'OAuthApplication',
       fields: {
@@ -211,8 +201,7 @@ describe('convertTableToList', () => {
 
     const listConfig = convertTableToList('oauthapplication', tableSchema)
 
-    expect(listConfig.access?.operation?.query?.({ session: null })).toBe(false)
-    expect(listConfig.access?.operation?.create?.({})).toBe(true)
+    expect(listConfig.access).toBeUndefined()
   })
 })
 
@@ -276,6 +265,54 @@ describe('convertBetterAuthSchema', () => {
     expect(lists).toEqual({})
   })
 
+  it('should resolve a base-model table against the configured baseModelKeys remap instead of the table name', () => {
+    const schema = {
+      user: {
+        modelName: '',
+        fields: {
+          isAnonymous: { type: 'boolean' },
+        },
+      },
+    }
+
+    const lists = convertBetterAuthSchema(schema, { user: 'AuthUser' })
+
+    expect(lists).toHaveProperty('AuthUser')
+    expect(lists).not.toHaveProperty('User')
+    expect(lists.AuthUser.fields).toHaveProperty('isAnonymous')
+  })
+
+  it('should prefer the baseModelKeys remap over an explicit tableSchema.modelName', () => {
+    const schema = {
+      user: {
+        modelName: 'User',
+        fields: {
+          isAnonymous: { type: 'boolean' },
+        },
+      },
+    }
+
+    const lists = convertBetterAuthSchema(schema, { user: 'AuthUser' })
+
+    expect(lists).toHaveProperty('AuthUser')
+    expect(lists).not.toHaveProperty('User')
+  })
+
+  it('should leave non-base tables unaffected by baseModelKeys', () => {
+    const schema = {
+      oauth_application: {
+        modelName: '',
+        fields: {
+          data: { type: 'string' },
+        },
+      },
+    }
+
+    const lists = convertBetterAuthSchema(schema, { user: 'AuthUser' })
+
+    expect(lists).toHaveProperty('OauthApplication')
+  })
+
   it('should convert complex schema with multiple field types', () => {
     const schema = {
       test_table: {