@opensaas/stack-auth 0.35.0 → 0.37.0

package/tests/generated-fk-shape.test.ts

@@ -79,3 +79,68 @@ describe('generated auth schema — Session/Account user FK mirrors better-auth
     expect(widget).toContain('@@index([ownerId])')
   })
 })
+
+describe('generated auth schema — required columns mirror better-auth (issue #863)', () => {
+  it('emits a required (non-nullable) userId FK and user relation on Session and Account', async () => {
+    const schema = await generateSchema({
+      db: { provider: 'sqlite' },
+      plugins: [authPlugin({ emailAndPassword: { enabled: true } })],
+      lists: {},
+    })
+
+    for (const model of ['Session', 'Account']) {
+      const block = modelBlock(schema, model)
+
+      expect(block).toMatch(/userId\s+String\s/)
+      expect(block).not.toMatch(/userId\s+String\?/)
+      expect(block).toMatch(/user\s+User\s+@relation/)
+      expect(block).not.toMatch(/user\s+User\?/)
+    }
+  })
+
+  it('emits a required (non-nullable) expiresAt on Session and Verification', async () => {
+    const schema = await generateSchema({
+      db: { provider: 'sqlite' },
+      plugins: [authPlugin({ emailAndPassword: { enabled: true } })],
+      lists: {},
+    })
+
+    for (const model of ['Session', 'Verification']) {
+      const block = modelBlock(schema, model)
+
+      expect(block).toMatch(/expiresAt\s+DateTime\s/)
+      expect(block).not.toMatch(/expiresAt\s+DateTime\?/)
+    }
+  })
+})
+
+describe('generated auth schema — tableName independent of modelName (issue #862)', () => {
+  it('emits a prefixed model name with a @@map to a better-auth default lowercase table', async () => {
+    const schema = await generateSchema({
+      db: { provider: 'postgresql' },
+      plugins: [
+        authPlugin({
+          user: { modelName: 'AuthUser', tableName: 'user' },
+          session: { modelName: 'AuthSession', tableName: 'session' },
+          account: { modelName: 'AuthAccount', tableName: 'account' },
+          verification: { modelName: 'AuthVerification', tableName: 'verification' },
+          emailAndPassword: { enabled: true },
+        }),
+      ],
+      lists: {},
+    })
+
+    for (const [model, table] of [
+      ['AuthUser', 'user'],
+      ['AuthSession', 'session'],
+      ['AuthAccount', 'account'],
+      ['AuthVerification', 'verification'],
+    ]) {
+      const block = modelBlock(schema, model)
+      // The generated model keeps the prefixed name but maps to the live
+      // lowercase table — no DROP/CREATE rename against a real better-auth
+      // install using its own default table names.
+      expect(block).toContain(`@@map("${table}")`)
+    }
+  })
+})

package/tests/plugin-derived-keys.test.ts

@@ -161,6 +161,54 @@ describe('authPlugin - add-vs-extend with derived keys', () => {
     expect(appUser.access?.operation?.update?.({} as any)).toBe(false)
     expect(appUser.access?.operation?.update).toBe(hostUserUpdate)
   })
+
+  it('preserves the derived Auth list db (map/schema/timestamps) and access when a better-auth plugin extends a base model (#861)', async () => {
+    // A better-auth provider plugin (e.g. the `anonymous` plugin) that ships a
+    // schema extension for the base `user` model — the exact shape adoptBetterAuthTables()
+    // + betterAuthPlugins produces in the field. Before the #861 fix, the
+    // plugin's schema loop ran BEFORE the derived Auth lists were added, so it
+    // pre-empted `AuthUser` with a bare `list({ fields })` (no `db`, no
+    // `access`) — and the real derived list then lost to the field-only
+    // `extendList` merge, silently dropping `@@map`/`@@schema`/timestamps/access.
+    const anonymousBetterAuthPlugin = {
+      id: 'anonymous',
+      schema: {
+        user: {
+          fields: {
+            isAnonymous: { type: 'boolean', required: false },
+          },
+        },
+      },
+    }
+
+    const userQuery = vi.fn(() => true)
+    const result = await config({
+      db: { provider: 'postgresql' },
+      plugins: [
+        authPlugin({
+          schema: 'auth',
+          user: { modelName: 'AuthUser' },
+          session: { modelName: 'AuthSession' },
+          account: { modelName: 'AuthAccount' },
+          verification: { modelName: 'AuthVerification' },
+          betterAuthPlugins: [anonymousBetterAuthPlugin],
+          access: { user: { operation: { query: userQuery } } },
+        }),
+      ],
+      lists: {},
+    })
+
+    const authUser = result.lists.AuthUser
+
+    // The plugin's schema extension is merged in...
+    expect(authUser.fields).toHaveProperty('isAnonymous')
+    // ...without displacing the derived list's own db config...
+    expect(authUser.db?.map).toBe('AuthUser')
+    expect(authUser.db?.schema).toBe('auth')
+    expect(authUser.db?.timestamps).toBe(true)
+    // ...or its access config.
+    expect(authUser.access?.operation?.query).toBe(userQuery)
+  })
 })
 
 describe('authPlugin - runtime user-key resolution', () => {

package/tests/server.test.ts

@@ -0,0 +1,517 @@
+import { describe, it, expect, vi, beforeEach } from 'vitest'
+import type { BetterAuthOptions } from 'better-auth'
+import type { NormalizedAuthConfig } from '../src/config/types.js'
+import type { OpenSaasConfig, AccessContext } from '@opensaas/stack-core'
+
+const betterAuthMock = vi.fn(() => ({ api: { getSession: vi.fn(async () => null) } }))
+const prismaAdapterMock = vi.fn((client: unknown, opts: unknown) => ({ client, opts }))
+const nextCookiesMock = vi.fn(() => ({ id: 'next-cookies' }))
+
+vi.mock('better-auth', () => ({
+  betterAuth: betterAuthMock,
+}))
+
+vi.mock('better-auth/adapters/prisma', () => ({
+  prismaAdapter: prismaAdapterMock,
+}))
+
+vi.mock('better-auth/next-js', () => ({
+  nextCookies: nextCookiesMock,
+}))
+
+const { createAuth, buildBetterAuthOptions, getSessionFromAuth } =
+  await import('../src/server/index.js')
+
+function makeAuthConfig(overrides: Partial<NormalizedAuthConfig> = {}): NormalizedAuthConfig {
+  return {
+    emailAndPassword: {
+      enabled: true,
+      minPasswordLength: 8,
+      requireConfirmation: true,
+      sendResetPassword: vi.fn(async () => {}),
+    },
+    emailVerification: {
+      enabled: false,
+      sendOnSignUp: true,
+      tokenExpiration: 86400,
+      sendVerificationEmail: vi.fn(async () => {}),
+    },
+    passwordReset: { enabled: false, tokenExpiration: 3600 },
+    socialProviders: {},
+    session: { expiresIn: 604800, updateAge: 86400 },
+    models: {
+      user: { modelName: 'User', fields: {} },
+      session: { modelName: 'Session', fields: {} },
+      account: { modelName: 'Account', fields: {} },
+      verification: { modelName: 'Verification', fields: {} },
+    },
+    sessionFields: ['userId', 'email', 'name'],
+    extendUserList: {},
+    access: {},
+    betterAuthPlugins: [],
+    rateLimit: undefined,
+    betterAuthOptions: {},
+    ...overrides,
+  }
+}
+
+function makeOpensaasConfig(authConfig: NormalizedAuthConfig): OpenSaasConfig {
+  return {
+    db: { provider: 'sqlite' },
+    lists: {},
+    _pluginData: { auth: authConfig },
+    // eslint-disable-next-line @typescript-eslint/no-explicit-any -- minimal test fixture
+  } as any
+}
+
+function makeContext(): AccessContext {
+  // eslint-disable-next-line @typescript-eslint/no-explicit-any -- minimal test fixture
+  return { prisma: { __mockPrisma: true } } as any
+}
+
+async function buildBetterAuthConfig(authConfig: NormalizedAuthConfig): Promise<BetterAuthOptions> {
+  const auth = createAuth(makeOpensaasConfig(authConfig), makeContext())
+  // Calling a nested method is what actually forces the lazy proxy to resolve
+  // the underlying betterAuth() instance — merely accessing `auth.api` does not.
+  await auth.api.getSession({})
+  expect(betterAuthMock).toHaveBeenCalledTimes(1)
+  return betterAuthMock.mock.calls[0][0] as BetterAuthOptions
+}
+
+describe('createAuth', () => {
+  beforeEach(() => {
+    betterAuthMock.mockClear()
+    prismaAdapterMock.mockClear()
+    nextCookiesMock.mockClear()
+  })
+
+  it('forwards emailAndPassword.minPasswordLength', async () => {
+    const config = await buildBetterAuthConfig(
+      makeAuthConfig({
+        emailAndPassword: {
+          enabled: true,
+          minPasswordLength: 12,
+          requireConfirmation: true,
+          sendResetPassword: vi.fn(async () => {}),
+        },
+      }),
+    )
+
+    expect(config.emailAndPassword).toMatchObject({ enabled: true, minPasswordLength: 12 })
+  })
+
+  it('omits emailAndPassword entirely when disabled', async () => {
+    const config = await buildBetterAuthConfig(
+      makeAuthConfig({
+        emailAndPassword: {
+          enabled: false,
+          minPasswordLength: 8,
+          requireConfirmation: true,
+          sendResetPassword: vi.fn(async () => {}),
+        },
+      }),
+    )
+
+    expect(config.emailAndPassword).toBeUndefined()
+  })
+
+  it('forwards emailVerification.sendOnSignUp and tokenExpiration when enabled', async () => {
+    const config = await buildBetterAuthConfig(
+      makeAuthConfig({
+        emailVerification: {
+          enabled: true,
+          sendOnSignUp: false,
+          tokenExpiration: 1234,
+          sendVerificationEmail: vi.fn(async () => {}),
+        },
+      }),
+    )
+
+    expect(config.emailVerification).toBeDefined()
+    expect(config.emailVerification?.sendOnSignUp).toBe(false)
+    expect(config.emailVerification?.expiresIn).toBe(1234)
+    expect(typeof config.emailVerification?.sendVerificationEmail).toBe('function')
+  })
+
+  it('omits emailVerification entirely when disabled', async () => {
+    const config = await buildBetterAuthConfig(
+      makeAuthConfig({
+        emailVerification: {
+          enabled: false,
+          sendOnSignUp: true,
+          tokenExpiration: 86400,
+          sendVerificationEmail: vi.fn(async () => {}),
+        },
+      }),
+    )
+
+    expect(config.emailVerification).toBeUndefined()
+  })
+
+  it('forwards the configured sendVerificationEmail callback straight through, unwrapped', async () => {
+    const sendVerificationEmail = vi.fn(async () => {})
+    const config = await buildBetterAuthConfig(
+      makeAuthConfig({
+        emailVerification: {
+          enabled: true,
+          sendOnSignUp: true,
+          tokenExpiration: 86400,
+          sendVerificationEmail,
+        },
+      }),
+    )
+
+    expect(config.emailVerification?.sendVerificationEmail).toBe(sendVerificationEmail)
+  })
+
+  it('forwards passwordReset.tokenExpiration and the configured sendResetPassword callback straight through, unwrapped', async () => {
+    const sendResetPassword = vi.fn(async () => {})
+    const config = await buildBetterAuthConfig(
+      makeAuthConfig({
+        passwordReset: { enabled: true, tokenExpiration: 4321 },
+        emailAndPassword: {
+          enabled: true,
+          minPasswordLength: 8,
+          requireConfirmation: true,
+          sendResetPassword,
+        },
+      }),
+    )
+
+    // eslint-disable-next-line @typescript-eslint/no-explicit-any -- narrow test-only access
+    const emailAndPassword = config.emailAndPassword as any
+    expect(emailAndPassword.resetPasswordTokenExpiresIn).toBe(4321)
+    expect(emailAndPassword.sendResetPassword).toBe(sendResetPassword)
+  })
+
+  it('does not add sendResetPassword when passwordReset is disabled', async () => {
+    const config = await buildBetterAuthConfig(
+      makeAuthConfig({ passwordReset: { enabled: false, tokenExpiration: 3600 } }),
+    )
+
+    // eslint-disable-next-line @typescript-eslint/no-explicit-any -- narrow test-only access
+    const emailAndPassword = config.emailAndPassword as any
+    expect(emailAndPassword.sendResetPassword).toBeUndefined()
+    expect(emailAndPassword.resetPasswordTokenExpiresIn).toBeUndefined()
+  })
+
+  it('passes session.updateAge through as a number', async () => {
+    const config = await buildBetterAuthConfig(
+      makeAuthConfig({ session: { expiresIn: 604800, updateAge: 3600 } }),
+    )
+
+    expect(config.session?.updateAge).toBe(3600)
+  })
+
+  it('sets disableSessionRefresh instead of updateAge: 0 when updateAge is false', async () => {
+    const config = await buildBetterAuthConfig(
+      makeAuthConfig({ session: { expiresIn: 604800, updateAge: false } }),
+    )
+
+    // better-auth treats `updateAge: 0` as "refresh on every request", not
+    // "never refresh" — disabling refresh requires the separate flag.
+    expect(config.session?.disableSessionRefresh).toBe(true)
+    expect(config.session?.updateAge).toBeUndefined()
+  })
+
+  it('warns when requireConfirmation is set to false since it has no server-side effect', async () => {
+    const warnSpy = vi.spyOn(console, 'warn').mockImplementation(() => {})
+
+    await buildBetterAuthConfig(
+      makeAuthConfig({
+        emailAndPassword: {
+          enabled: true,
+          minPasswordLength: 8,
+          requireConfirmation: false,
+          sendResetPassword: vi.fn(async () => {}),
+        },
+      }),
+    )
+
+    expect(warnSpy).toHaveBeenCalledWith(expect.stringContaining('requireConfirmation'))
+    warnSpy.mockRestore()
+  })
+
+  it('does not warn when requireConfirmation is left at its default (true)', async () => {
+    const warnSpy = vi.spyOn(console, 'warn').mockImplementation(() => {})
+
+    await buildBetterAuthConfig(
+      makeAuthConfig({
+        emailAndPassword: {
+          enabled: true,
+          minPasswordLength: 8,
+          requireConfirmation: true,
+          sendResetPassword: vi.fn(async () => {}),
+        },
+      }),
+    )
+
+    expect(warnSpy).not.toHaveBeenCalled()
+    warnSpy.mockRestore()
+  })
+
+  it('does not warn about requireConfirmation when emailAndPassword is disabled', async () => {
+    const warnSpy = vi.spyOn(console, 'warn').mockImplementation(() => {})
+
+    await buildBetterAuthConfig(
+      makeAuthConfig({
+        emailAndPassword: {
+          enabled: false,
+          minPasswordLength: 8,
+          requireConfirmation: false,
+          sendResetPassword: vi.fn(async () => {}),
+        },
+      }),
+    )
+
+    expect(warnSpy).not.toHaveBeenCalledWith(expect.stringContaining('requireConfirmation'))
+    warnSpy.mockRestore()
+  })
+
+  it('warns when passwordReset is enabled but emailAndPassword is disabled', async () => {
+    const warnSpy = vi.spyOn(console, 'warn').mockImplementation(() => {})
+
+    await buildBetterAuthConfig(
+      makeAuthConfig({
+        emailAndPassword: {
+          enabled: false,
+          minPasswordLength: 8,
+          requireConfirmation: true,
+          sendResetPassword: vi.fn(async () => {}),
+        },
+        passwordReset: { enabled: true, tokenExpiration: 3600 },
+      }),
+    )
+
+    expect(warnSpy).toHaveBeenCalledWith(expect.stringContaining('passwordReset'))
+    warnSpy.mockRestore()
+  })
+
+  it('does not warn about passwordReset when emailAndPassword is enabled', async () => {
+    const warnSpy = vi.spyOn(console, 'warn').mockImplementation(() => {})
+
+    await buildBetterAuthConfig(
+      makeAuthConfig({
+        emailAndPassword: {
+          enabled: true,
+          minPasswordLength: 8,
+          requireConfirmation: true,
+          sendResetPassword: vi.fn(async () => {}),
+        },
+        passwordReset: { enabled: true, tokenExpiration: 3600 },
+      }),
+    )
+
+    expect(warnSpy).not.toHaveBeenCalledWith(expect.stringContaining('passwordReset'))
+    warnSpy.mockRestore()
+  })
+})
+
+describe('betterAuthOptions passthrough', () => {
+  beforeEach(() => {
+    betterAuthMock.mockClear()
+    prismaAdapterMock.mockClear()
+    nextCookiesMock.mockClear()
+  })
+
+  it('produces byte-for-byte identical options to today when unused', async () => {
+    // `normalizeAuthConfig` is what actually defaults a config without
+    // `betterAuthOptions` to `{}` (see config.test.ts) — reproduce that
+    // realistic normalized shape here rather than an AuthConfig missing a
+    // required NormalizedAuthConfig field.
+    const authConfig = makeAuthConfig({ betterAuthOptions: {} })
+
+    const built = await buildBetterAuthConfig(authConfig)
+
+    expect(built).toEqual({
+      database: { client: { __mockPrisma: true }, opts: { provider: 'sqlite' } },
+      user: { modelName: 'User' },
+      session: { modelName: 'Session', expiresIn: 604800, updateAge: 86400 },
+      account: { modelName: 'Account' },
+      verification: { modelName: 'Verification' },
+      emailAndPassword: {
+        enabled: true,
+        requireEmailVerification: false,
+        minPasswordLength: 8,
+      },
+      emailVerification: undefined,
+      trustedOrigins: [],
+      socialProviders: {},
+      rateLimit: undefined,
+      plugins: [{ id: 'next-cookies' }],
+    })
+  })
+
+  it('surfaces a top-level option the stack does not model (e.g. baseURL)', async () => {
+    const config = await buildBetterAuthConfig(
+      makeAuthConfig({ betterAuthOptions: { baseURL: 'https://example.com' } }),
+    )
+
+    expect(config.baseURL).toBe('https://example.com')
+  })
+
+  it('merges a nested database hook without clobbering sibling top-level keys', async () => {
+    const after = vi.fn()
+    const config = await buildBetterAuthConfig(
+      makeAuthConfig({
+        session: { expiresIn: 604800, updateAge: 86400 },
+        betterAuthOptions: {
+          // eslint-disable-next-line @typescript-eslint/no-explicit-any -- test-only shape
+          databaseHooks: { user: { create: { after } } } as any,
+        },
+      }),
+    )
+
+    // eslint-disable-next-line @typescript-eslint/no-explicit-any -- narrow test-only access
+    expect((config as any).databaseHooks.user.create.after).toBe(after)
+    // The stack's own session config survives — passthrough added a sibling
+    // top-level key, it didn't replace the whole options object.
+    expect(config.session?.expiresIn).toBe(604800)
+  })
+
+  it('merges a nested session option without clobbering the stack-set session keys', async () => {
+    const config = await buildBetterAuthConfig(
+      makeAuthConfig({
+        session: { expiresIn: 604800, updateAge: 3600 },
+        betterAuthOptions: {
+          session: { cookieCache: { enabled: true, maxAge: 300 } },
+        },
+      }),
+    )
+
+    // eslint-disable-next-line @typescript-eslint/no-explicit-any -- narrow test-only access
+    expect((config.session as any).cookieCache).toEqual({ enabled: true, maxAge: 300 })
+    expect(config.session?.expiresIn).toBe(604800)
+    expect(config.session?.updateAge).toBe(3600)
+  })
+
+  it('lets the passthrough win on a genuine key collision', async () => {
+    const config = await buildBetterAuthConfig(
+      makeAuthConfig({
+        session: { expiresIn: 604800, updateAge: 3600 },
+        betterAuthOptions: {
+          session: { expiresIn: 999 },
+        },
+      }),
+    )
+
+    expect(config.session?.expiresIn).toBe(999)
+  })
+
+  it('replaces an array outright instead of concatenating (e.g. trustedOrigins)', async () => {
+    process.env.BETTER_AUTH_TRUSTED_ORIGINS = 'https://env-origin.com'
+    try {
+      const config = await buildBetterAuthConfig(
+        makeAuthConfig({
+          betterAuthOptions: { trustedOrigins: ['https://config-origin.com'] },
+        }),
+      )
+
+      expect(config.trustedOrigins).toEqual(['https://config-origin.com'])
+    } finally {
+      delete process.env.BETTER_AUTH_TRUSTED_ORIGINS
+    }
+  })
+
+  it('rejects betterAuthOptions.database', async () => {
+    await expect(
+      buildBetterAuthOptions(
+        // eslint-disable-next-line @typescript-eslint/no-explicit-any -- test-only shape
+        makeOpensaasConfig(makeAuthConfig({ betterAuthOptions: { database: {} as any } })),
+        makeContext(),
+      ),
+    ).rejects.toThrow(/betterAuthOptions\.database/)
+  })
+
+  it('rejects betterAuthOptions.plugins', async () => {
+    await expect(
+      buildBetterAuthOptions(
+        makeOpensaasConfig(makeAuthConfig({ betterAuthOptions: { plugins: [] } })),
+        makeContext(),
+      ),
+    ).rejects.toThrow(/betterAuthOptions\.plugins/)
+  })
+
+  it.each(['user', 'session', 'account', 'verification'] as const)(
+    'rejects betterAuthOptions.%s.additionalFields',
+    async (model) => {
+      await expect(
+        buildBetterAuthOptions(
+          makeOpensaasConfig(
+            makeAuthConfig({
+              betterAuthOptions: {
+                // eslint-disable-next-line @typescript-eslint/no-explicit-any -- test-only shape
+                [model]: { additionalFields: { foo: { type: 'string' } } } as any,
+              },
+            }),
+          ),
+          makeContext(),
+        ),
+      ).rejects.toThrow(new RegExp(`betterAuthOptions\\.${model}\\.additionalFields`))
+    },
+  )
+
+  it('does not reject additionalFields nested under an unrelated model key', async () => {
+    // A plain object at `user` with no `additionalFields` key must not trip the guard.
+    const config = await buildBetterAuthConfig(
+      makeAuthConfig({ betterAuthOptions: { user: { modelName: 'CustomUser' } } }),
+    )
+
+    expect(config.user).toMatchObject({ modelName: 'CustomUser' })
+  })
+})
+
+describe('buildBetterAuthOptions / createAuth parity', () => {
+  beforeEach(() => {
+    betterAuthMock.mockClear()
+  })
+
+  it('createAuth constructs betterAuth with exactly what buildBetterAuthOptions returns', async () => {
+    const authConfig = makeAuthConfig({
+      betterAuthOptions: { baseURL: 'https://example.com' },
+    })
+    const opensaasConfig = makeOpensaasConfig(authConfig)
+    const context = makeContext()
+
+    const built = await buildBetterAuthOptions(opensaasConfig, context)
+
+    const auth = createAuth(opensaasConfig, context)
+    await auth.api.getSession({})
+
+    expect(betterAuthMock).toHaveBeenCalledTimes(1)
+    expect(betterAuthMock.mock.calls[0][0]).toEqual(built)
+  })
+})
+
+describe('getSessionFromAuth', () => {
+  it('passes the caller-supplied headers to auth.api.getSession', async () => {
+    const headers = new Headers({ cookie: 'session=abc' })
+    const getSession = vi.fn(async () => ({ user: { id: 'user-1', email: 'a@b.com' } }))
+    const auth = { api: { getSession } } as unknown as Parameters<typeof getSessionFromAuth>[0]
+
+    const result = await getSessionFromAuth(auth, ['userId', 'email'], headers)
+
+    expect(getSession).toHaveBeenCalledWith({ headers })
+    expect(result).toEqual({ userId: 'user-1', email: 'a@b.com' })
+  })
+
+  it('returns null when there is no session', async () => {
+    const getSession = vi.fn(async () => null)
+    const auth = { api: { getSession } } as unknown as Parameters<typeof getSessionFromAuth>[0]
+
+    const result = await getSessionFromAuth(auth, ['userId'], new Headers())
+
+    expect(result).toBeNull()
+  })
+
+  it('returns null when auth.api.getSession throws', async () => {
+    const getSession = vi.fn(async () => {
+      throw new Error('boom')
+    })
+    const auth = { api: { getSession } } as unknown as Parameters<typeof getSessionFromAuth>[0]
+
+    const result = await getSessionFromAuth(auth, ['userId'], new Headers())
+
+    expect(result).toBeNull()
+  })
+})