@opensaas/stack-auth 0.37.0 → 0.39.0

package/tests/schema-converter.test.ts

@@ -36,6 +36,47 @@ describe('convertTableToList', () => {
     expect(listConfig.fields.score.defaultValue).toBe(0)
   })
 
+  it('should convert a number field with bigint: true to a bigInt field (issue #917)', () => {
+    const tableSchema = {
+      modelName: 'TestTable',
+      fields: {
+        lastRequest: { type: 'number', required: true, bigint: true },
+      },
+    }
+
+    const listConfig = convertTableToList('test_table', tableSchema)
+
+    expect(listConfig.fields.lastRequest.type).toBe('bigInt')
+    expect(listConfig.fields.lastRequest.validation?.isRequired).toBe(true)
+  })
+
+  it('should keep a number field with bigint: false as integer', () => {
+    const tableSchema = {
+      modelName: 'TestTable',
+      fields: {
+        age: { type: 'number', bigint: false },
+      },
+    }
+
+    const listConfig = convertTableToList('test_table', tableSchema)
+
+    expect(listConfig.fields.age.type).toBe('integer')
+  })
+
+  it('should pass defaultValue through on a bigint number field', () => {
+    const tableSchema = {
+      modelName: 'TestTable',
+      fields: {
+        lastRequest: { type: 'number', bigint: true, defaultValue: 0 },
+      },
+    }
+
+    const listConfig = convertTableToList('test_table', tableSchema)
+
+    expect(listConfig.fields.lastRequest.type).toBe('bigInt')
+    expect(listConfig.fields.lastRequest.defaultValue).toBe(0)
+  })
+
   it('should convert boolean fields', () => {
     const tableSchema = {
       modelName: 'TestTable',
@@ -298,6 +339,23 @@ describe('convertBetterAuthSchema', () => {
     expect(lists).not.toHaveProperty('User')
   })
 
+  it('should resolve a rateLimit table (case-insensitively) against the configured baseModelKeys remap (issue #909)', () => {
+    const schema = {
+      rateLimit: {
+        modelName: '',
+        fields: {
+          customField: { type: 'boolean' },
+        },
+      },
+    }
+
+    const lists = convertBetterAuthSchema(schema, { rateLimit: 'AuthRateLimit' })
+
+    expect(lists).toHaveProperty('AuthRateLimit')
+    expect(lists).not.toHaveProperty('RateLimit')
+    expect(lists.AuthRateLimit.fields).toHaveProperty('customField')
+  })
+
   it('should leave non-base tables unaffected by baseModelKeys', () => {
     const schema = {
       oauth_application: {

package/tests/server.test.ts

@@ -1,4 +1,4 @@
-import { describe, it, expect, vi, beforeEach } from 'vitest'
+import { describe, it, expect, vi, beforeEach, afterEach } from 'vitest'
 import type { BetterAuthOptions } from 'better-auth'
 import type { NormalizedAuthConfig } from '../src/config/types.js'
 import type { OpenSaasConfig, AccessContext } from '@opensaas/stack-core'
@@ -459,6 +459,106 @@ describe('betterAuthOptions passthrough', () => {
 
     expect(config.user).toMatchObject({ modelName: 'CustomUser' })
   })
+
+  it('rejects betterAuthOptions.rateLimit.storage', async () => {
+    await expect(
+      buildBetterAuthOptions(
+        makeOpensaasConfig(
+          makeAuthConfig({ betterAuthOptions: { rateLimit: { storage: 'database' } } }),
+        ),
+        makeContext(),
+      ),
+    ).rejects.toThrow(/betterAuthOptions\.rateLimit\.storage/)
+  })
+
+  it('does not reject other betterAuthOptions.rateLimit keys (customRules/customStorage) and merges them', async () => {
+    const customRules = { '/sign-in/email': { window: 10, max: 3 } }
+    const config = await buildBetterAuthConfig(
+      makeAuthConfig({
+        rateLimit: { enabled: true, window: 60, max: 100 },
+        betterAuthOptions: {
+          // eslint-disable-next-line @typescript-eslint/no-explicit-any -- test-only shape
+          rateLimit: { customRules } as any,
+        },
+      }),
+    )
+
+    // eslint-disable-next-line @typescript-eslint/no-explicit-any -- narrow test-only access
+    const rateLimit = config.rateLimit as any
+    expect(rateLimit.customRules).toBe(customRules)
+    // The stack's own enabled/window/max survive the merge alongside customRules.
+    expect(rateLimit.enabled).toBe(true)
+    expect(rateLimit.window).toBe(60)
+    expect(rateLimit.max).toBe(100)
+  })
+})
+
+describe('rateLimit option forwarding (issue #909)', () => {
+  beforeEach(() => {
+    betterAuthMock.mockClear()
+    prismaAdapterMock.mockClear()
+    nextCookiesMock.mockClear()
+  })
+
+  it('forwards enabled/window/max with no storage key when rateLimit.storage is unset', async () => {
+    const config = await buildBetterAuthConfig(
+      makeAuthConfig({ rateLimit: { enabled: true, window: 60, max: 100 } }),
+    )
+
+    expect(config.rateLimit).toEqual({ enabled: true, window: 60, max: 100 })
+  })
+
+  it('forwards storage: "database" alongside enabled/window/max', async () => {
+    const config = await buildBetterAuthConfig(
+      makeAuthConfig({
+        rateLimit: { enabled: true, window: 60, max: 100, storage: 'database' },
+        models: {
+          user: { modelName: 'User', fields: {} },
+          session: { modelName: 'Session', fields: {} },
+          account: { modelName: 'Account', fields: {} },
+          verification: { modelName: 'Verification', fields: {} },
+          rateLimit: { modelName: 'RateLimit', fields: {} },
+        },
+      }),
+    )
+
+    expect(config.rateLimit).toMatchObject({
+      enabled: true,
+      window: 60,
+      max: 100,
+      storage: 'database',
+      modelName: 'RateLimit',
+    })
+  })
+
+  it('forwards a custom rateLimit modelName/fields to better-auth so the running instance matches the derived table', async () => {
+    const config = await buildBetterAuthConfig(
+      makeAuthConfig({
+        rateLimit: { enabled: true, storage: 'database' },
+        models: {
+          user: { modelName: 'User', fields: {} },
+          session: { modelName: 'Session', fields: {} },
+          account: { modelName: 'Account', fields: {} },
+          verification: { modelName: 'Verification', fields: {} },
+          rateLimit: { modelName: 'AuthRateLimit', fields: { key: 'limit_key' } },
+        },
+      }),
+    )
+
+    // eslint-disable-next-line @typescript-eslint/no-explicit-any -- narrow test-only access
+    const rateLimit = config.rateLimit as any
+    expect(rateLimit.modelName).toBe('AuthRateLimit')
+    expect(rateLimit.fields).toEqual({ key: 'limit_key' })
+  })
+
+  it('does not forward modelName/fields when no rateLimit model was derived (storage unset)', async () => {
+    const config = await buildBetterAuthConfig(makeAuthConfig({ rateLimit: { enabled: true } }))
+
+    // eslint-disable-next-line @typescript-eslint/no-explicit-any -- narrow test-only access
+    const rateLimit = config.rateLimit as any
+    expect(rateLimit.modelName).toBeUndefined()
+    expect(rateLimit.fields).toBeUndefined()
+  })
 })
 
 describe('buildBetterAuthOptions / createAuth parity', () => {
@@ -481,6 +581,108 @@ describe('buildBetterAuthOptions / createAuth parity', () => {
     expect(betterAuthMock).toHaveBeenCalledTimes(1)
     expect(betterAuthMock.mock.calls[0][0]).toEqual(built)
   })
+
+  it('createAuth with a plugin tuple constructs betterAuth with exactly what buildBetterAuthOptions returns for the same tuple', async () => {
+    const pluginA = { id: 'plugin-a' }
+    const authConfig = makeAuthConfig({ betterAuthPlugins: [pluginA] })
+    const opensaasConfig = makeOpensaasConfig(authConfig)
+    const context = makeContext()
+
+    const built = await buildBetterAuthOptions(opensaasConfig, context, [pluginA])
+
+    const auth = createAuth(opensaasConfig, context, [pluginA])
+    await auth.api.getSession({})
+
+    expect(betterAuthMock).toHaveBeenCalledTimes(1)
+    expect(betterAuthMock.mock.calls[0][0]).toEqual(built)
+  })
+
+  it('createAuth rejects when its plugin tuple does not match the resolved betterAuthPlugins', async () => {
+    const pluginA = { id: 'plugin-a' }
+    const differentInstance = { id: 'plugin-a' }
+    const authConfig = makeAuthConfig({ betterAuthPlugins: [pluginA] })
+    const opensaasConfig = makeOpensaasConfig(authConfig)
+    const context = makeContext()
+
+    const auth = createAuth(opensaasConfig, context, [differentInstance])
+
+    await expect(auth.api.getSession({})).rejects.toThrow(
+      /does not match the plugin array resolved/,
+    )
+    expect(betterAuthMock).not.toHaveBeenCalled()
+  })
+})
+
+describe('buildBetterAuthOptions plugin-tuple argument', () => {
+  beforeEach(() => {
+    betterAuthMock.mockClear()
+    prismaAdapterMock.mockClear()
+    nextCookiesMock.mockClear()
+  })
+
+  it('rejects when the supplied tuple has a different length than the resolved betterAuthPlugins', async () => {
+    const pluginA = { id: 'plugin-a' }
+    const authConfig = makeAuthConfig({ betterAuthPlugins: [pluginA] })
+
+    await expect(
+      buildBetterAuthOptions(makeOpensaasConfig(authConfig), makeContext(), []),
+    ).rejects.toThrow(/has 0 plugin\(s\), but the plugin array resolved.*has 1/)
+  })
+
+  it('rejects naming the mismatching index when a supplied plugin is not the same instance', async () => {
+    const pluginA = { id: 'plugin-a' }
+    const pluginB = { id: 'plugin-b' }
+    const differentInstance = { id: 'plugin-a' } // same id, different identity
+
+    const authConfig = makeAuthConfig({ betterAuthPlugins: [pluginA, pluginB] })
+
+    await expect(
+      buildBetterAuthOptions(makeOpensaasConfig(authConfig), makeContext(), [
+        differentInstance,
+        pluginB,
+      ]),
+    ).rejects.toThrow(/at index 0/)
+  })
+
+  it('rejects naming the mismatching index when the supplied order differs', async () => {
+    const pluginA = { id: 'plugin-a' }
+    const pluginB = { id: 'plugin-b' }
+    const authConfig = makeAuthConfig({ betterAuthPlugins: [pluginA, pluginB] })
+
+    await expect(
+      buildBetterAuthOptions(makeOpensaasConfig(authConfig), makeContext(), [pluginB, pluginA]),
+    ).rejects.toThrow(/at index 0/)
+  })
+
+  it('does not throw when the supplied tuple is the exact same instances in the same order', async () => {
+    const pluginA = { id: 'plugin-a' }
+    const pluginB = { id: 'plugin-b' }
+    const authConfig = makeAuthConfig({ betterAuthPlugins: [pluginA, pluginB] })
+
+    const config = await buildBetterAuthOptions(makeOpensaasConfig(authConfig), makeContext(), [
+      pluginA,
+      pluginB,
+    ])
+
+    expect(config.plugins).toEqual([pluginA, pluginB, { id: 'next-cookies' }])
+  })
+
+  it('appends exactly one nextCookies() plugin, last, whether or not a plugin tuple is supplied', async () => {
+    const pluginA = { id: 'plugin-a' }
+    const authConfig = makeAuthConfig({ betterAuthPlugins: [pluginA] })
+    const opensaasConfig = makeOpensaasConfig(authConfig)
+    const context = makeContext()
+
+    const withoutArg = await buildBetterAuthOptions(opensaasConfig, context)
+    expect(nextCookiesMock).toHaveBeenCalledTimes(1)
+    expect(withoutArg.plugins).toEqual([pluginA, { id: 'next-cookies' }])
+
+    nextCookiesMock.mockClear()
+
+    const withArg = await buildBetterAuthOptions(opensaasConfig, context, [pluginA])
+    expect(nextCookiesMock).toHaveBeenCalledTimes(1)
+    expect(withArg.plugins).toEqual([pluginA, { id: 'next-cookies' }])
+  })
 })
 
 describe('getSessionFromAuth', () => {
@@ -504,14 +706,118 @@ describe('getSessionFromAuth', () => {
     expect(result).toBeNull()
   })
 
-  it('returns null when auth.api.getSession throws', async () => {
+  it('propagates an error thrown by the underlying session lookup, distinguishable from no session', async () => {
     const getSession = vi.fn(async () => {
       throw new Error('boom')
     })
     const auth = { api: { getSession } } as unknown as Parameters<typeof getSessionFromAuth>[0]
 
-    const result = await getSessionFromAuth(auth, ['userId'], new Headers())
+    await expect(getSessionFromAuth(auth, ['userId'], new Headers())).rejects.toThrow('boom')
+  })
 
-    expect(result).toBeNull()
+  it('resolves the documented happy path unchanged: fields on the user, userId from user.id', async () => {
+    const getSession = vi.fn(async () => ({
+      user: { id: 'user-1', email: 'a@b.com', name: 'Ada' },
+    }))
+    const auth = { api: { getSession } } as unknown as Parameters<typeof getSessionFromAuth>[0]
+
+    const result = await getSessionFromAuth(auth, ['userId', 'email', 'name'], new Headers())
+
+    expect(result).toEqual({ userId: 'user-1', email: 'a@b.com', name: 'Ada' })
+  })
+
+  it('projects a customSession shape with no top-level user key instead of reporting anonymous', async () => {
+    // A customSession plugin can fully replace the resolved shape (e.g.
+    // nesting fields under a custom key) and drop the `user` object entirely
+    // — that must still be treated as "a session", not "no session".
+    const getSession = vi.fn(async () => ({
+      email: 'nested@example.com',
+      data: { role: 'admin' },
+    }))
+    const auth = { api: { getSession } } as unknown as Parameters<typeof getSessionFromAuth>[0]
+
+    const result = await getSessionFromAuth(auth, ['email'], new Headers())
+
+    expect(result).not.toBeNull()
+    expect(result).toEqual({ email: 'nested@example.com' })
+  })
+
+  it('resolves a field living on the session sub-object, not just the user', async () => {
+    const getSession = vi.fn(async () => ({
+      user: { id: 'user-1' },
+      session: { impersonatedBy: 'admin-1' },
+    }))
+    const auth = { api: { getSession } } as unknown as Parameters<typeof getSessionFromAuth>[0]
+
+    const result = await getSessionFromAuth(auth, ['userId', 'impersonatedBy'], new Headers())
+
+    expect(result).toEqual({ userId: 'user-1', impersonatedBy: 'admin-1' })
+  })
+
+  describe('resolution precedence', () => {
+    it('prefers a top-level key over the same name on user or session (deliberate collision)', async () => {
+      const getSession = vi.fn(async () => ({
+        role: 'top-level-role',
+        user: { role: 'user-role' },
+        session: { role: 'session-role' },
+      }))
+      const auth = { api: { getSession } } as unknown as Parameters<typeof getSessionFromAuth>[0]
+
+      const result = await getSessionFromAuth(auth, ['role'], new Headers())
+
+      expect(result).toEqual({ role: 'top-level-role' })
+    })
+
+    it('prefers the user object over the session sub-object when there is no top-level key', async () => {
+      const getSession = vi.fn(async () => ({
+        user: { role: 'user-role' },
+        session: { role: 'session-role' },
+      }))
+      const auth = { api: { getSession } } as unknown as Parameters<typeof getSessionFromAuth>[0]
+
+      const result = await getSessionFromAuth(auth, ['role'], new Headers())
+
+      expect(result).toEqual({ role: 'user-role' })
+    })
+  })
+
+  // The warn-once cache is module-level state, so these tests re-import the
+  // module fresh via vi.resetModules() — same pattern as the `select` no-op
+  // warning tests in packages/core/tests/context.test.ts.
+  describe('unresolved field warning', () => {
+    let warnSpy: ReturnType<typeof vi.spyOn>
+    let freshGetSessionFromAuth: typeof getSessionFromAuth
+
+    beforeEach(async () => {
+      vi.resetModules()
+      warnSpy = vi.spyOn(console, 'warn').mockImplementation(() => {})
+      const mod = await import('../src/server/index.js')
+      freshGetSessionFromAuth = mod.getSessionFromAuth
+    })
+
+    afterEach(() => {
+      warnSpy.mockRestore()
+    })
+
+    it('omits an unresolvable field, warns once naming it, and does not throw', async () => {
+      const getSession = vi.fn(async () => ({ user: { id: 'user-1' } }))
+      const auth = { api: { getSession } } as unknown as Parameters<typeof getSessionFromAuth>[0]
+
+      const result = await freshGetSessionFromAuth(auth, ['userId', 'nickname'], new Headers())
+
+      expect(result).toEqual({ userId: 'user-1' })
+      expect(warnSpy).toHaveBeenCalledTimes(1)
+      expect(warnSpy.mock.calls[0][0]).toContain('"nickname"')
+    })
+
+    it('does not warn again for the same field on a second call', async () => {
+      const getSession = vi.fn(async () => ({ user: { id: 'user-1' } }))
+      const auth = { api: { getSession } } as unknown as Parameters<typeof getSessionFromAuth>[0]
+
+      await freshGetSessionFromAuth(auth, ['nickname'], new Headers())
+      await freshGetSessionFromAuth(auth, ['nickname'], new Headers())
+
+      expect(warnSpy).toHaveBeenCalledTimes(1)
+    })
   })
 })