@opensaas/stack-auth 0.38.0 → 0.39.0

package/tests/generated-fk-shape.test.ts

@@ -144,3 +144,84 @@ describe('generated auth schema — tableName independent of modelName (issue #8
     }
   })
 })
+
+describe('generated RateLimit schema mirrors better-auth exactly (issue #909)', () => {
+  it('does not add a RateLimit model when storage is unset', async () => {
+    const schema = await generateSchema({
+      db: { provider: 'sqlite' },
+      plugins: [authPlugin({ emailAndPassword: { enabled: true } })],
+      lists: {},
+    })
+
+    expect(schema).not.toContain('model RateLimit')
+  })
+
+  it('emits key (unique, non-null), count (non-null Int), lastRequest (non-null BigInt), no createdAt/updatedAt, no @default', async () => {
+    const schema = await generateSchema({
+      db: { provider: 'sqlite' },
+      plugins: [
+        authPlugin({
+          emailAndPassword: { enabled: true },
+          rateLimit: { enabled: true, storage: 'database' },
+        }),
+      ],
+      lists: {},
+    })
+
+    const block = modelBlock(schema, 'RateLimit')
+
+    expect(block).toMatch(/key\s+String\s+@unique/)
+    expect(block).toMatch(/count\s+Int\s/)
+    expect(block).not.toMatch(/count\s+Int\?/)
+    expect(block).toMatch(/lastRequest\s+BigInt\s/)
+    expect(block).not.toMatch(/lastRequest\s+BigInt\?/)
+
+    expect(block).not.toContain('createdAt')
+    expect(block).not.toContain('updatedAt')
+    // The system `id` field carries its own @default(cuid()) — only the
+    // three better-auth-mirrored columns must carry none.
+    expect(block).not.toMatch(/key\s+String\s+@unique\s+@default/)
+    expect(block).not.toMatch(/count\s+Int\s+@default/)
+    expect(block).not.toMatch(/lastRequest\s+BigInt\s+@default/)
+  })
+
+  it('honours a custom modelName/tableName/fields/schema on the rateLimit model', async () => {
+    const schema = await generateSchema({
+      db: { provider: 'postgresql' },
+      plugins: [
+        authPlugin({
+          emailAndPassword: { enabled: true },
+          rateLimit: {
+            enabled: true,
+            storage: 'database',
+            modelName: 'AuthRateLimit',
+            tableName: 'rate_limit',
+            fields: { key: 'limit_key', count: 'hit_count', lastRequest: 'last_hit_at' },
+          },
+        }),
+      ],
+      lists: {},
+    })
+
+    const block = modelBlock(schema, 'AuthRateLimit')
+    expect(block).toContain('@@map("rate_limit")')
+    expect(block).toContain('@map("limit_key")')
+    expect(block).toContain('@map("hit_count")')
+    expect(block).toContain('@map("last_hit_at")')
+  })
+
+  it('produces a RateLimit model even when enabled is false, since better-auth still expects the table', async () => {
+    const schema = await generateSchema({
+      db: { provider: 'sqlite' },
+      plugins: [
+        authPlugin({
+          emailAndPassword: { enabled: true },
+          rateLimit: { enabled: false, storage: 'database' },
+        }),
+      ],
+      lists: {},
+    })
+
+    expect(schema).toContain('model RateLimit')
+  })
+})

package/tests/plugin-schema-placement.test.ts

@@ -119,3 +119,42 @@ describe('authPlugin - schema placement (adopt existing auth-schema install)', (
     expect(result.db.schemas).toContain('auth_internal')
   })
 })
+
+describe('authPlugin - RateLimit list schema placement', () => {
+  it('places the RateLimit list in the configured schema and wires the datasource', async () => {
+    const result = await generationConfig({
+      db: { provider: 'postgresql' },
+      plugins: [
+        authPlugin({
+          schema: 'auth',
+          rateLimit: { enabled: true, storage: 'database', modelName: 'AuthRateLimit' },
+        }),
+      ],
+      lists: {},
+    })
+
+    expect(result.lists.AuthRateLimit.db).toEqual({ map: 'AuthRateLimit', schema: 'auth' })
+    expect(result.db.schemas).toContain('auth')
+  })
+
+  it('honours a per-model schema override independent of the plugin-level schema', async () => {
+    const result = await generationConfig({
+      db: { provider: 'postgresql' },
+      plugins: [
+        authPlugin({
+          schema: 'auth',
+          rateLimit: {
+            enabled: true,
+            storage: 'database',
+            modelName: 'AuthRateLimit',
+            schema: 'auth_internal',
+          },
+        }),
+      ],
+      lists: {},
+    })
+
+    expect(result.lists.AuthRateLimit.db?.schema).toBe('auth_internal')
+    expect(result.db.schemas).toContain('auth_internal')
+  })
+})

package/tests/rate-limit-e2e.test.ts

@@ -0,0 +1,239 @@
+import { describe, it, expect, afterAll } from 'vitest'
+import { execFile } from 'node:child_process'
+import { promisify } from 'node:util'
+import { existsSync } from 'node:fs'
+import fsp from 'node:fs/promises'
+import os from 'node:os'
+import path from 'node:path'
+import { pathToFileURL } from 'node:url'
+import { createAuth } from '../src/server/index.js'
+import type { OpenSaasConfig, AccessContext } from '@opensaas/stack-core'
+
+/**
+ * Live end-to-end proof that the database-backed rate limiter (issue #909)
+ * actually works: it generates a real Prisma schema (with the derived
+ * `RateLimit` list), pushes it to a real SQLite database, constructs real
+ * `betterAuth()` instances against that database via `createAuth()` (the
+ * package's own source, not a stale build), and drives them through real
+ * HTTP-shaped requests via `auth.handler()`.
+ *
+ * This is the one guard in the suite that touches a live database, so it
+ * follows the same pattern as
+ * `packages/create-opensaas-app/tests/scaffold-first-run-guard.test.ts`
+ * (see ADR-0002): opt-in via an env flag, kept out of the fast unit lane, run
+ * only in the `e2e` CI job where `pnpm install && pnpm build` have already
+ * run. It borrows the `opensaas`/`prisma` binaries and the
+ * `@prisma/adapter-better-sqlite3` dependency from `examples/starter-auth`'s
+ * already-installed `node_modules` (symlinked into an OS temp dir) instead of
+ * adding a live-database toolchain to this package's own dependencies.
+ */
+
+const run = promisify(execFile)
+const here = path.dirname(new URL(import.meta.url).pathname)
+const repoRoot = path.resolve(here, '../../..')
+
+/** The `opensaas` CLI the temp project's `generate` step invokes. */
+const opensaasCli = path.join(repoRoot, 'packages/cli/dist/index.js')
+/** `createAuth()` (imported from source above) resolves `@opensaas/stack-core` through this build. */
+const coreDist = path.join(repoRoot, 'packages/core/dist')
+
+/** The toolchain (opensaas/prisma binaries + the sqlite adapter) borrowed from a working example. */
+const toolchainNodeModules = path.join(repoRoot, 'examples/starter-auth/node_modules')
+
+const guardEnabled = process.env.RUN_RATE_LIMIT_E2E === '1'
+
+const prerequisitesPresent =
+  guardEnabled &&
+  existsSync(opensaasCli) &&
+  existsSync(coreDist) &&
+  existsSync(path.join(toolchainNodeModules, '.bin', 'opensaas')) &&
+  existsSync(path.join(toolchainNodeModules, '.bin', 'prisma')) &&
+  existsSync(path.join(toolchainNodeModules, '@prisma', 'adapter-better-sqlite3'))
+
+/** Build the temp project's `opensaas.config.ts`: sqlite + a database-backed rate limiter. */
+function makeConfigSource(window: number, max: number): string {
+  return `import { config } from '@opensaas/stack-core'
+import { authPlugin } from '@opensaas/stack-auth'
+import { PrismaBetterSqlite3 } from '@prisma/adapter-better-sqlite3'
+
+export default config({
+  plugins: [
+    authPlugin({
+      emailAndPassword: { enabled: true },
+      rateLimit: { enabled: true, window: ${window}, max: ${max}, storage: 'database' },
+    }),
+  ],
+  db: {
+    provider: 'sqlite',
+    prismaClientConstructor: (PrismaClient) => {
+      const adapter = new PrismaBetterSqlite3({ url: process.env.DATABASE_URL || './dev.db' })
+      return new PrismaClient({ adapter })
+    },
+  },
+  lists: {},
+})
+`
+}
+
+/** A GET request against a real (rate-limited) better-auth endpoint from a fixed "client". */
+function sessionRequest(ip: string): Request {
+  return new Request('http://localhost:3000/api/auth/get-session', {
+    method: 'GET',
+    headers: { 'x-forwarded-for': ip },
+  })
+}
+
+/** Scaffold a fresh temp project with the given window/max and push its schema. Returns the project dir. */
+async function setupProject(window: number, max: number): Promise<string> {
+  const tmpRoot = await fsp.mkdtemp(path.join(os.tmpdir(), 'opensaas-ratelimit-e2e-'))
+  const dir = path.join(tmpRoot, 'project')
+  await fsp.mkdir(dir, { recursive: true })
+
+  await fsp.writeFile(path.join(dir, 'opensaas.config.ts'), makeConfigSource(window, max))
+  await fsp.writeFile(
+    path.join(dir, 'package.json'),
+    JSON.stringify(
+      { name: 'ratelimit-e2e-project', version: '0.0.0', private: true, type: 'module' },
+      null,
+      2,
+    ),
+  )
+  await fsp.writeFile(path.join(dir, '.env'), 'DATABASE_URL=file:./dev.db\n')
+  await fsp.symlink(toolchainNodeModules, path.join(dir, 'node_modules'))
+
+  const env = {
+    ...process.env,
+    DATABASE_URL: 'file:./dev.db',
+    BETTER_AUTH_SECRET: 'e2e-test-secret-not-for-production-0000000000',
+    BETTER_AUTH_URL: 'http://localhost:3000',
+  }
+  const binDir = path.join(dir, 'node_modules', '.bin')
+  await run(path.join(binDir, 'opensaas'), ['generate'], { cwd: dir, env })
+  await run(path.join(binDir, 'prisma'), ['db', 'push'], { cwd: dir, env })
+
+  return dir
+}
+
+/**
+ * Import the temp project's config + generated context and build a real auth
+ * instance via `createAuth()`. Each call produces a genuinely separate
+ * `betterAuth()` instance — `createAuth()`'s lazy proxy calls `betterAuth()`
+ * fresh on first use inside its own closure (see `src/server/index.ts`), so
+ * two calls here are two independently-constructed `Auth` objects even when
+ * (as here) they resolve through the same imported `rawOpensaasContext`
+ * module — itself just the standard Prisma-connection-pooling shape a real
+ * app would also share across requests. What distinguishes this from
+ * in-memory rate-limit storage is that each `betterAuth()` instance keeps no
+ * limiter state of its own — every read/write round-trips through Prisma to
+ * the shared on-disk table, which is exactly the property under test.
+ */
+async function createAuthInstanceForProject(dir: string) {
+  // The config's `prismaClientConstructor` reads `process.env.DATABASE_URL` at
+  // runtime (unlike the `generate`/`db push` subprocesses, which received it
+  // via their own `env`). An absolute path avoids it resolving relative to
+  // the test process's cwd instead of the temp project dir.
+  process.env.DATABASE_URL = `file:${path.join(dir, 'dev.db')}`
+
+  // `@vite-ignore` suppresses Vite's static analysis of this computed,
+  // external (outside the package root) specifier — it isn't something Vite
+  // could usefully pre-bundle anyway.
+  const config = (
+    (await import(/* @vite-ignore */ pathToFileURL(path.join(dir, 'opensaas.config.ts')).href)) as {
+      default: OpenSaasConfig | Promise<OpenSaasConfig>
+    }
+  ).default
+  const { rawOpensaasContext } = (await import(
+    /* @vite-ignore */ pathToFileURL(path.join(dir, '.opensaas/context.ts')).href
+  )) as { rawOpensaasContext: Promise<AccessContext> }
+
+  const resolvedContext = await rawOpensaasContext
+
+  return { auth: createAuth(config, resolvedContext), context: resolvedContext }
+}
+
+/** Unlink the borrowed node_modules symlink (never recurse into/delete the real one) and remove the temp root. */
+async function cleanupProject(dir: string): Promise<void> {
+  // The generated `.opensaas/context.ts` caches its Prisma client on
+  // `globalThis.prisma` outside `NODE_ENV === 'production'` (the standard
+  // dev-mode HMR pattern, so a hot reload doesn't open a fresh connection
+  // every time). That's process-wide, not per-module — so the NEXT temp
+  // project created in this same test process would otherwise inherit THIS
+  // one's already-cached client, silently pointed at a temp dir this
+  // function is about to delete. Clear it so each project's own
+  // `prismaClientConstructor` runs fresh.
+  delete (globalThis as { prisma?: unknown }).prisma
+
+  const linkPath = path.join(dir, 'node_modules')
+  if (existsSync(linkPath)) {
+    await fsp.unlink(linkPath)
+  }
+  await fsp.rm(path.dirname(dir), { recursive: true, force: true })
+}
+
+describe.skipIf(!prerequisitesPresent)(
+  'database-backed rate limiter — live end-to-end (issue #909)',
+  () => {
+    it('rejects requests once the count exceeds max within the window, against a real generated RateLimit table', async () => {
+      const dir = await setupProject(60, 3)
+      try {
+        const { auth, context } = await createAuthInstanceForProject(dir)
+        const ip = '203.0.113.10'
+
+        const statuses: number[] = []
+        for (let i = 0; i < 5; i++) {
+          const res = await auth.handler(sessionRequest(ip))
+          statuses.push(res.status)
+        }
+
+        // First `max` (3) requests succeed, everything past it is rejected.
+        expect(statuses.slice(0, 3)).toEqual([200, 200, 200])
+        expect(statuses.slice(3)).toEqual([429, 429])
+        await context.prisma.$disconnect()
+      } finally {
+        await cleanupProject(dir)
+      }
+    }, 120_000)
+
+    it('persists the counter across two separately-constructed auth instances sharing the database', async () => {
+      const dir = await setupProject(60, 3)
+      try {
+        const ip = '198.51.100.20'
+
+        // Two independently-constructed betterAuth() instances (via two
+        // separate createAuth() lazy proxies), sharing one sqlite file —
+        // the property in-memory storage does not have.
+        const { auth: authA } = await createAuthInstanceForProject(dir)
+        const { auth: authB, context } = await createAuthInstanceForProject(dir)
+
+        expect((await authA.handler(sessionRequest(ip))).status).toBe(200)
+        expect((await authA.handler(sessionRequest(ip))).status).toBe(200)
+        expect((await authA.handler(sessionRequest(ip))).status).toBe(200)
+
+        // Instance B, constructed fresh and never having handled a request
+        // for this IP, must see A's persisted counter via the database and
+        // reject — proof the limiter state lives in the DB, not in-process.
+        expect((await authB.handler(sessionRequest(ip))).status).toBe(429)
+        await context.prisma.$disconnect()
+      } finally {
+        await cleanupProject(dir)
+      }
+    }, 120_000)
+  },
+)
+
+// Surface, in a normal unit run, why this guard was skipped.
+describe.runIf(!prerequisitesPresent)('database-backed rate limiter e2e (skipped)', () => {
+  it('runs only in the e2e job (set RUN_RATE_LIMIT_E2E=1 after install + build)', () => {
+    expect(prerequisitesPresent).toBe(false)
+  })
+
+  afterAll(() => {
+    if (!guardEnabled) return
+    // The guard is opted in but its build/toolchain prerequisites are
+    // missing — surface why, mirroring the scaffold guard's message.
+    console.warn(
+      '[rate-limit-e2e] RUN_RATE_LIMIT_E2E=1 was set but prerequisites are missing. ' +
+        'Run `pnpm install && pnpm build` (and ensure examples/starter-auth has been installed) first.',
+    )
+  })
+})

package/tests/schema-converter.test.ts

@@ -36,6 +36,47 @@ describe('convertTableToList', () => {
     expect(listConfig.fields.score.defaultValue).toBe(0)
   })
 
+  it('should convert a number field with bigint: true to a bigInt field (issue #917)', () => {
+    const tableSchema = {
+      modelName: 'TestTable',
+      fields: {
+        lastRequest: { type: 'number', required: true, bigint: true },
+      },
+    }
+
+    const listConfig = convertTableToList('test_table', tableSchema)
+
+    expect(listConfig.fields.lastRequest.type).toBe('bigInt')
+    expect(listConfig.fields.lastRequest.validation?.isRequired).toBe(true)
+  })
+
+  it('should keep a number field with bigint: false as integer', () => {
+    const tableSchema = {
+      modelName: 'TestTable',
+      fields: {
+        age: { type: 'number', bigint: false },
+      },
+    }
+
+    const listConfig = convertTableToList('test_table', tableSchema)
+
+    expect(listConfig.fields.age.type).toBe('integer')
+  })
+
+  it('should pass defaultValue through on a bigint number field', () => {
+    const tableSchema = {
+      modelName: 'TestTable',
+      fields: {
+        lastRequest: { type: 'number', bigint: true, defaultValue: 0 },
+      },
+    }
+
+    const listConfig = convertTableToList('test_table', tableSchema)
+
+    expect(listConfig.fields.lastRequest.type).toBe('bigInt')
+    expect(listConfig.fields.lastRequest.defaultValue).toBe(0)
+  })
+
   it('should convert boolean fields', () => {
     const tableSchema = {
       modelName: 'TestTable',
@@ -298,6 +339,23 @@ describe('convertBetterAuthSchema', () => {
     expect(lists).not.toHaveProperty('User')
   })
 
+  it('should resolve a rateLimit table (case-insensitively) against the configured baseModelKeys remap (issue #909)', () => {
+    const schema = {
+      rateLimit: {
+        modelName: '',
+        fields: {
+          customField: { type: 'boolean' },
+        },
+      },
+    }
+
+    const lists = convertBetterAuthSchema(schema, { rateLimit: 'AuthRateLimit' })
+
+    expect(lists).toHaveProperty('AuthRateLimit')
+    expect(lists).not.toHaveProperty('RateLimit')
+    expect(lists.AuthRateLimit.fields).toHaveProperty('customField')
+  })
+
   it('should leave non-base tables unaffected by baseModelKeys', () => {
     const schema = {
       oauth_application: {

package/tests/server.test.ts

@@ -459,6 +459,106 @@ describe('betterAuthOptions passthrough', () => {
 
     expect(config.user).toMatchObject({ modelName: 'CustomUser' })
   })
+
+  it('rejects betterAuthOptions.rateLimit.storage', async () => {
+    await expect(
+      buildBetterAuthOptions(
+        makeOpensaasConfig(
+          makeAuthConfig({ betterAuthOptions: { rateLimit: { storage: 'database' } } }),
+        ),
+        makeContext(),
+      ),
+    ).rejects.toThrow(/betterAuthOptions\.rateLimit\.storage/)
+  })
+
+  it('does not reject other betterAuthOptions.rateLimit keys (customRules/customStorage) and merges them', async () => {
+    const customRules = { '/sign-in/email': { window: 10, max: 3 } }
+    const config = await buildBetterAuthConfig(
+      makeAuthConfig({
+        rateLimit: { enabled: true, window: 60, max: 100 },
+        betterAuthOptions: {
+          // eslint-disable-next-line @typescript-eslint/no-explicit-any -- test-only shape
+          rateLimit: { customRules } as any,
+        },
+      }),
+    )
+
+    // eslint-disable-next-line @typescript-eslint/no-explicit-any -- narrow test-only access
+    const rateLimit = config.rateLimit as any
+    expect(rateLimit.customRules).toBe(customRules)
+    // The stack's own enabled/window/max survive the merge alongside customRules.
+    expect(rateLimit.enabled).toBe(true)
+    expect(rateLimit.window).toBe(60)
+    expect(rateLimit.max).toBe(100)
+  })
+})
+
+describe('rateLimit option forwarding (issue #909)', () => {
+  beforeEach(() => {
+    betterAuthMock.mockClear()
+    prismaAdapterMock.mockClear()
+    nextCookiesMock.mockClear()
+  })
+
+  it('forwards enabled/window/max with no storage key when rateLimit.storage is unset', async () => {
+    const config = await buildBetterAuthConfig(
+      makeAuthConfig({ rateLimit: { enabled: true, window: 60, max: 100 } }),
+    )
+
+    expect(config.rateLimit).toEqual({ enabled: true, window: 60, max: 100 })
+  })
+
+  it('forwards storage: "database" alongside enabled/window/max', async () => {
+    const config = await buildBetterAuthConfig(
+      makeAuthConfig({
+        rateLimit: { enabled: true, window: 60, max: 100, storage: 'database' },
+        models: {
+          user: { modelName: 'User', fields: {} },
+          session: { modelName: 'Session', fields: {} },
+          account: { modelName: 'Account', fields: {} },
+          verification: { modelName: 'Verification', fields: {} },
+          rateLimit: { modelName: 'RateLimit', fields: {} },
+        },
+      }),
+    )
+
+    expect(config.rateLimit).toMatchObject({
+      enabled: true,
+      window: 60,
+      max: 100,
+      storage: 'database',
+      modelName: 'RateLimit',
+    })
+  })
+
+  it('forwards a custom rateLimit modelName/fields to better-auth so the running instance matches the derived table', async () => {
+    const config = await buildBetterAuthConfig(
+      makeAuthConfig({
+        rateLimit: { enabled: true, storage: 'database' },
+        models: {
+          user: { modelName: 'User', fields: {} },
+          session: { modelName: 'Session', fields: {} },
+          account: { modelName: 'Account', fields: {} },
+          verification: { modelName: 'Verification', fields: {} },
+          rateLimit: { modelName: 'AuthRateLimit', fields: { key: 'limit_key' } },
+        },
+      }),
+    )
+
+    // eslint-disable-next-line @typescript-eslint/no-explicit-any -- narrow test-only access
+    const rateLimit = config.rateLimit as any
+    expect(rateLimit.modelName).toBe('AuthRateLimit')
+    expect(rateLimit.fields).toEqual({ key: 'limit_key' })
+  })
+
+  it('does not forward modelName/fields when no rateLimit model was derived (storage unset)', async () => {
+    const config = await buildBetterAuthConfig(makeAuthConfig({ rateLimit: { enabled: true } }))
+
+    // eslint-disable-next-line @typescript-eslint/no-explicit-any -- narrow test-only access
+    const rateLimit = config.rateLimit as any
+    expect(rateLimit.modelName).toBeUndefined()
+    expect(rateLimit.fields).toBeUndefined()
+  })
 })
 
 describe('buildBetterAuthOptions / createAuth parity', () => {