@opensaas/stack-auth 0.36.0 → 0.38.0

package/tests/adopt-better-auth-tables.test.ts

@@ -76,6 +76,105 @@ describe('adoptBetterAuthTables - recipe defaults', () => {
   })
 })
 
+describe('adoptBetterAuthTables - table names (issue #862)', () => {
+  it('sets no tableName by default (prefixed modelName also pins the table, as before)', () => {
+    const fragment = adoptBetterAuthTables()
+
+    expect(fragment.user).toEqual({ modelName: 'AuthUser' })
+    expect(fragment.session).toEqual({ modelName: 'AuthSession' })
+  })
+
+  it('useBetterAuthTableNames sets every model tableName to the better-auth default lowercase name', () => {
+    const fragment = adoptBetterAuthTables({ useBetterAuthTableNames: true })
+
+    expect(fragment.user).toEqual({ modelName: 'AuthUser', tableName: 'user' })
+    expect(fragment.session).toEqual({ modelName: 'AuthSession', tableName: 'session' })
+    expect(fragment.account).toEqual({ modelName: 'AuthAccount', tableName: 'account' })
+    expect(fragment.verification).toEqual({
+      modelName: 'AuthVerification',
+      tableName: 'verification',
+    })
+  })
+
+  it('tableNames sets explicit per-model table names', () => {
+    const fragment = adoptBetterAuthTables({
+      tableNames: { user: 'users', session: 'user_sessions' },
+    })
+
+    expect(fragment.user).toEqual({ modelName: 'AuthUser', tableName: 'users' })
+    expect(fragment.session).toEqual({ modelName: 'AuthSession', tableName: 'user_sessions' })
+    // Models without an explicit tableName entry stay unset.
+    expect(fragment.account).toEqual({ modelName: 'AuthAccount' })
+  })
+
+  it('tableNames takes precedence over useBetterAuthTableNames for the same model', () => {
+    const fragment = adoptBetterAuthTables({
+      useBetterAuthTableNames: true,
+      tableNames: { user: 'custom_user_table' },
+    })
+
+    expect(fragment.user?.tableName).toBe('custom_user_table')
+    // Other models still fall back to the better-auth default.
+    expect(fragment.session?.tableName).toBe('session')
+  })
+
+  it('combines tableName with a field column map on the same model', () => {
+    const fragment = adoptBetterAuthTables({
+      useBetterAuthTableNames: true,
+      fields: { user: { name: 'full_name' } },
+    })
+
+    expect(fragment.user).toEqual({
+      modelName: 'AuthUser',
+      tableName: 'user',
+      fields: { name: 'full_name' },
+    })
+  })
+})
+
+describe('adoptBetterAuthTables - clean-diff adoption with better-auth default table names', () => {
+  it('produces Auth lists that @@map to the live lowercase tables under prefixed list keys', async () => {
+    const result = await generationConfig({
+      db: { provider: 'postgresql' },
+      plugins: [
+        authPlugin({
+          ...adoptBetterAuthTables({ useBetterAuthTableNames: true }),
+          emailAndPassword: { enabled: true },
+        }),
+      ],
+      lists: {
+        User: list({
+          fields: { subjectId: text({ validation: { isRequired: true } }) },
+        }),
+      },
+    })
+
+    // List keys stay prefixed (no collision with the app's own User)...
+    expect(result.lists).toHaveProperty('AuthUser')
+    // ...but the physical table is better-auth's own default lowercase name.
+    expect(result.lists.AuthUser.db).toEqual({ timestamps: true, map: 'user', schema: 'auth' })
+    expect(result.lists.AuthSession.db).toEqual({
+      timestamps: true,
+      map: 'session',
+      schema: 'auth',
+    })
+    expect(result.lists.AuthAccount.db).toEqual({
+      timestamps: true,
+      map: 'account',
+      schema: 'auth',
+    })
+    expect(result.lists.AuthVerification.db).toEqual({
+      timestamps: true,
+      map: 'verification',
+      schema: 'auth',
+    })
+
+    // The app's own domain User is untouched.
+    expect(result.lists.User.fields).toHaveProperty('subjectId')
+    expect(result.lists.User.fields).not.toHaveProperty('email')
+  })
+})
+
 describe('adoptBetterAuthTables - composes with authPlugin', () => {
   it('spreads into authPlugin alongside the rest of the auth config', async () => {
     const result = await config({

package/tests/config.test.ts

@@ -14,9 +14,19 @@ describe('normalizeAuthConfig', () => {
     expect(result.emailVerification.enabled).toBe(false)
     expect(result.passwordReset.enabled).toBe(false)
     expect(result.session.expiresIn).toBe(604800) // 7 days
+    expect(result.session.updateAge).toBe(86400) // 1 day, matching better-auth's own default
     expect(result.sessionFields).toEqual(['userId', 'email', 'name'])
     expect(result.socialProviders).toEqual({})
     expect(result.betterAuthPlugins).toEqual([])
+    expect(result.betterAuthOptions).toEqual({})
+  })
+
+  it('should pass through betterAuthOptions unchanged', () => {
+    const result = normalizeAuthConfig({
+      betterAuthOptions: { baseURL: 'https://example.com' },
+    })
+
+    expect(result.betterAuthOptions).toEqual({ baseURL: 'https://example.com' })
   })
 
   it('should normalize email and password config', () => {
@@ -81,6 +91,14 @@ describe('normalizeAuthConfig', () => {
     expect(result.session.updateAge).toBe(false)
   })
 
+  it('should normalize a custom numeric session.updateAge', () => {
+    const result = normalizeAuthConfig({
+      session: { updateAge: 3600 },
+    })
+
+    expect(result.session.updateAge).toBe(3600)
+  })
+
   it('should normalize custom session fields', () => {
     const result = normalizeAuthConfig({
       sessionFields: ['userId', 'email', 'role'],
@@ -120,22 +138,24 @@ describe('normalizeAuthConfig', () => {
     expect(result.extendUserList.fields).toHaveProperty('role')
   })
 
-  it('should include custom sendEmail function', () => {
-    const mockSendEmail = async () => {}
+  it('should include custom sendResetPassword and sendVerificationEmail functions', () => {
+    const mockSendResetPassword = async () => {}
+    const mockSendVerificationEmail = async () => {}
 
     const result = normalizeAuthConfig({
-      sendEmail: mockSendEmail,
+      emailAndPassword: { enabled: true, sendResetPassword: mockSendResetPassword },
+      emailVerification: { enabled: true, sendVerificationEmail: mockSendVerificationEmail },
     })
 
-    expect(result.sendEmail).toBe(mockSendEmail)
+    expect(result.emailAndPassword.sendResetPassword).toBe(mockSendResetPassword)
+    expect(result.emailVerification.sendVerificationEmail).toBe(mockSendVerificationEmail)
   })
 
-  it('should provide default sendEmail that logs to console', () => {
+  it('should provide default sendResetPassword and sendVerificationEmail that log to console', () => {
     const result = normalizeAuthConfig({})
 
-    expect(typeof result.sendEmail).toBe('function')
-    // Default sendEmail should be a function that accepts email params
-    expect(result.sendEmail.length).toBe(1)
+    expect(typeof result.emailAndPassword.sendResetPassword).toBe('function')
+    expect(typeof result.emailVerification.sendVerificationEmail).toBe('function')
   })
 
   it('should include betterAuthPlugins', () => {
@@ -165,6 +185,44 @@ describe('normalizeAuthConfig', () => {
     expect(result.access.user).toBe(userAccess)
     expect(result.access.session).toBe(sessionAccess)
   })
+
+  describe('models.tableName (issue #862)', () => {
+    it('defaults tableName to undefined for unrenamed models', () => {
+      const result = normalizeAuthConfig({})
+
+      expect(result.models.user.tableName).toBeUndefined()
+      expect(result.models.session.tableName).toBeUndefined()
+      expect(result.models.account.tableName).toBeUndefined()
+      expect(result.models.verification.tableName).toBeUndefined()
+    })
+
+    it('defaults tableName to the renamed modelName, matching pre-#862 behaviour', () => {
+      const result = normalizeAuthConfig({
+        user: { modelName: 'AuthUser' },
+      })
+
+      expect(result.models.user.modelName).toBe('AuthUser')
+      expect(result.models.user.tableName).toBe('AuthUser')
+    })
+
+    it('resolves an explicit tableName independent of modelName', () => {
+      const result = normalizeAuthConfig({
+        user: { modelName: 'AuthUser', tableName: 'user' },
+      })
+
+      expect(result.models.user.modelName).toBe('AuthUser')
+      expect(result.models.user.tableName).toBe('user')
+    })
+
+    it('honours an explicit tableName even when modelName is left at its default', () => {
+      const result = normalizeAuthConfig({
+        session: { tableName: 'sessions' },
+      })
+
+      expect(result.models.session.modelName).toBe('Session')
+      expect(result.models.session.tableName).toBe('sessions')
+    })
+  })
 })
 
 describe('authPlugin', () => {

package/tests/derive-auth-lists.test.ts

@@ -44,6 +44,13 @@ describe('deriveAuthLists - default behaviour (no overrides)', () => {
     expect(lists.User.fields.accounts.ref).toBe('Account.user')
   })
 
+  it('marks Session/Verification expiresAt as DB-required, matching better-auth (issue #863)', () => {
+    const { lists } = deriveAuthLists(defaultModels)
+
+    expect(lists.Session.fields.expiresAt.db?.isNullable).toBe(false)
+    expect(lists.Verification.fields.expiresAt.db?.isNullable).toBe(false)
+  })
+
   it('emits no table @@map and no scalar @map for default keys', () => {
     const { lists } = deriveAuthLists(defaultModels)
 
@@ -108,6 +115,13 @@ describe('deriveAuthLists - user FK shape mirrors better-auth (issue #679)', ()
     }
   })
 
+  it('marks the user FK non-nullable, matching better-auth (issue #863)', () => {
+    const { lists } = deriveAuthLists(defaultModels)
+
+    expect(lists.Session.fields.user.db?.isNullable).toBe(false)
+    expect(lists.Account.fields.user.db?.isNullable).toBe(false)
+  })
+
   it('keeps the cascade extendPrismaSchema alongside a userId column override', () => {
     const models: NormalizedAuthModels = {
       user: { modelName: 'User', fields: {} },
@@ -126,11 +140,16 @@ describe('deriveAuthLists - user FK shape mirrors better-auth (issue #679)', ()
 })
 
 describe('deriveAuthLists - custom modelName overrides', () => {
+  // `deriveAuthLists` is the pure derivation step: it consumes an already-
+  // resolved `tableName` rather than re-deriving one from `modelName`. That
+  // default derivation (tableName follows modelName when it differs from the
+  // better-auth default) lives in `normalizeModelConfig` (config/index.ts) —
+  // mirror its output here since these fixtures bypass normalization.
   const customModels: NormalizedAuthModels = {
-    user: { modelName: 'AuthUser', fields: {} },
-    session: { modelName: 'AuthSession', fields: {} },
-    account: { modelName: 'AuthAccount', fields: {} },
-    verification: { modelName: 'AuthVerification', fields: {} },
+    user: { modelName: 'AuthUser', tableName: 'AuthUser', fields: {} },
+    session: { modelName: 'AuthSession', tableName: 'AuthSession', fields: {} },
+    account: { modelName: 'AuthAccount', tableName: 'AuthAccount', fields: {} },
+    verification: { modelName: 'AuthVerification', tableName: 'AuthVerification', fields: {} },
   }
 
   it('derives list keys from modelName', () => {
@@ -179,6 +198,61 @@ describe('deriveAuthLists - custom modelName overrides', () => {
   })
 })
 
+describe('deriveAuthLists - tableName independent of modelName (issue #862)', () => {
+  it('emits @@map from tableName even though modelName is unchanged', () => {
+    const models: NormalizedAuthModels = {
+      user: { modelName: 'User', tableName: 'users', fields: {} },
+      session: { modelName: 'Session', fields: {} },
+      account: { modelName: 'Account', fields: {} },
+      verification: { modelName: 'Verification', fields: {} },
+    }
+
+    const { keys, lists } = deriveAuthLists(models)
+
+    // The list key follows modelName, unaffected by tableName.
+    expect(keys.user).toBe('User')
+    expect(lists.User.db?.map).toBe('users')
+  })
+
+  it('adopts a better-auth default lowercase table under a prefixed list key', () => {
+    // The shape issue #862 exists for: a prefixed list key (to avoid
+    // colliding with the app's own domain User) whose live table is still
+    // better-auth's own default lowercase name.
+    const models: NormalizedAuthModels = {
+      user: { modelName: 'AuthUser', tableName: 'user', fields: {} },
+      session: { modelName: 'AuthSession', tableName: 'session', fields: {} },
+      account: { modelName: 'AuthAccount', tableName: 'account', fields: {} },
+      verification: { modelName: 'AuthVerification', tableName: 'verification', fields: {} },
+    }
+
+    const { keys, lists } = deriveAuthLists(models)
+
+    expect(keys).toEqual({
+      user: 'AuthUser',
+      session: 'AuthSession',
+      account: 'AuthAccount',
+      verification: 'AuthVerification',
+    })
+    expect(lists.AuthUser.db?.map).toBe('user')
+    expect(lists.AuthSession.db?.map).toBe('session')
+    expect(lists.AuthAccount.db?.map).toBe('account')
+    expect(lists.AuthVerification.db?.map).toBe('verification')
+  })
+
+  it('emits no @@map when tableName is unset, even with a renamed modelName', () => {
+    const models: NormalizedAuthModels = {
+      user: { modelName: 'AuthUser', fields: {} },
+      session: { modelName: 'Session', fields: {} },
+      account: { modelName: 'Account', fields: {} },
+      verification: { modelName: 'Verification', fields: {} },
+    }
+
+    const { lists } = deriveAuthLists(models)
+
+    expect(lists.AuthUser.db?.map).toBeUndefined()
+  })
+})
+
 describe('deriveAuthLists - custom field column maps', () => {
   const models: NormalizedAuthModels = {
     user: { modelName: 'AuthUser', fields: { name: 'full_name', emailVerified: 'is_verified' } },
@@ -229,7 +303,7 @@ describe('deriveAuthLists - schema placement', () => {
 
   it('carries both @@map and @@schema for renamed + relocated lists', () => {
     const models: NormalizedAuthModels = {
-      user: { modelName: 'AuthUser', fields: {}, schema: 'auth' },
+      user: { modelName: 'AuthUser', tableName: 'AuthUser', fields: {}, schema: 'auth' },
       session: { modelName: 'AuthSession', fields: {}, schema: 'auth' },
       account: { modelName: 'AuthAccount', fields: {}, schema: 'auth' },
       verification: { modelName: 'AuthVerification', fields: {}, schema: 'auth' },

package/tests/generated-fk-shape.test.ts

@@ -79,3 +79,68 @@ describe('generated auth schema — Session/Account user FK mirrors better-auth
     expect(widget).toContain('@@index([ownerId])')
   })
 })
+
+describe('generated auth schema — required columns mirror better-auth (issue #863)', () => {
+  it('emits a required (non-nullable) userId FK and user relation on Session and Account', async () => {
+    const schema = await generateSchema({
+      db: { provider: 'sqlite' },
+      plugins: [authPlugin({ emailAndPassword: { enabled: true } })],
+      lists: {},
+    })
+
+    for (const model of ['Session', 'Account']) {
+      const block = modelBlock(schema, model)
+
+      expect(block).toMatch(/userId\s+String\s/)
+      expect(block).not.toMatch(/userId\s+String\?/)
+      expect(block).toMatch(/user\s+User\s+@relation/)
+      expect(block).not.toMatch(/user\s+User\?/)
+    }
+  })
+
+  it('emits a required (non-nullable) expiresAt on Session and Verification', async () => {
+    const schema = await generateSchema({
+      db: { provider: 'sqlite' },
+      plugins: [authPlugin({ emailAndPassword: { enabled: true } })],
+      lists: {},
+    })
+
+    for (const model of ['Session', 'Verification']) {
+      const block = modelBlock(schema, model)
+
+      expect(block).toMatch(/expiresAt\s+DateTime\s/)
+      expect(block).not.toMatch(/expiresAt\s+DateTime\?/)
+    }
+  })
+})
+
+describe('generated auth schema — tableName independent of modelName (issue #862)', () => {
+  it('emits a prefixed model name with a @@map to a better-auth default lowercase table', async () => {
+    const schema = await generateSchema({
+      db: { provider: 'postgresql' },
+      plugins: [
+        authPlugin({
+          user: { modelName: 'AuthUser', tableName: 'user' },
+          session: { modelName: 'AuthSession', tableName: 'session' },
+          account: { modelName: 'AuthAccount', tableName: 'account' },
+          verification: { modelName: 'AuthVerification', tableName: 'verification' },
+          emailAndPassword: { enabled: true },
+        }),
+      ],
+      lists: {},
+    })
+
+    for (const [model, table] of [
+      ['AuthUser', 'user'],
+      ['AuthSession', 'session'],
+      ['AuthAccount', 'account'],
+      ['AuthVerification', 'verification'],
+    ]) {
+      const block = modelBlock(schema, model)
+      // The generated model keeps the prefixed name but maps to the live
+      // lowercase table — no DROP/CREATE rename against a real better-auth
+      // install using its own default table names.
+      expect(block).toContain(`@@map("${table}")`)
+    }
+  })
+})

package/tests/plugin-derived-keys.test.ts

@@ -161,6 +161,54 @@ describe('authPlugin - add-vs-extend with derived keys', () => {
     expect(appUser.access?.operation?.update?.({} as any)).toBe(false)
     expect(appUser.access?.operation?.update).toBe(hostUserUpdate)
   })
+
+  it('preserves the derived Auth list db (map/schema/timestamps) and access when a better-auth plugin extends a base model (#861)', async () => {
+    // A better-auth provider plugin (e.g. the `anonymous` plugin) that ships a
+    // schema extension for the base `user` model — the exact shape adoptBetterAuthTables()
+    // + betterAuthPlugins produces in the field. Before the #861 fix, the
+    // plugin's schema loop ran BEFORE the derived Auth lists were added, so it
+    // pre-empted `AuthUser` with a bare `list({ fields })` (no `db`, no
+    // `access`) — and the real derived list then lost to the field-only
+    // `extendList` merge, silently dropping `@@map`/`@@schema`/timestamps/access.
+    const anonymousBetterAuthPlugin = {
+      id: 'anonymous',
+      schema: {
+        user: {
+          fields: {
+            isAnonymous: { type: 'boolean', required: false },
+          },
+        },
+      },
+    }
+
+    const userQuery = vi.fn(() => true)
+    const result = await config({
+      db: { provider: 'postgresql' },
+      plugins: [
+        authPlugin({
+          schema: 'auth',
+          user: { modelName: 'AuthUser' },
+          session: { modelName: 'AuthSession' },
+          account: { modelName: 'AuthAccount' },
+          verification: { modelName: 'AuthVerification' },
+          betterAuthPlugins: [anonymousBetterAuthPlugin],
+          access: { user: { operation: { query: userQuery } } },
+        }),
+      ],
+      lists: {},
+    })
+
+    const authUser = result.lists.AuthUser
+
+    // The plugin's schema extension is merged in...
+    expect(authUser.fields).toHaveProperty('isAnonymous')
+    // ...without displacing the derived list's own db config...
+    expect(authUser.db?.map).toBe('AuthUser')
+    expect(authUser.db?.schema).toBe('auth')
+    expect(authUser.db?.timestamps).toBe(true)
+    // ...or its access config.
+    expect(authUser.access?.operation?.query).toBe(userQuery)
+  })
 })
 
 describe('authPlugin - runtime user-key resolution', () => {