@opensaas/stack-auth 0.39.2 → 0.40.0

package/dist/config/derive-auth-lists.d.ts

@@ -1,40 +1,30 @@
 /**
- * Pure `better-auth config → Auth lists` derivation.
- *
- * This module is intentionally free of side effects and plugin/runtime
- * concerns: given the resolved better-auth model config (per-model `modelName`,
- * `tableName`, and `fields` column maps) plus any custom User fields, it
- * produces the four OpenSaaS Auth lists (user/session/account/verification)
- * with:
- *
- *  - list keys taken from each model's `modelName`
- *  - a table `@@map` (list-level `db.map`) taken from each model's resolved
- *    `tableName` — independent of `modelName`, so a renamed list key can still
- *    adopt a differently-named live table
- *  - field-level `@map` (`db.map`) for any better-auth field → column override
- *  - relationship refs between the auth lists wired to the *derived* keys
- *    (e.g. `Session.user → AuthUser.sessions`)
- *
- * When the developer supplies no `modelName`/`fields` overrides, the output
- * keeps the historical default keys (`User`/`Session`/`Account`/
- * `Verification`) and field shapes — see the unit tests. Per ADR-0013, each
- * list ships with **no** operation-level access unless the caller supplies it
- * (`accessConfig`, or `userConfig.access` for the user list) — deny-by-default,
- * not the plugin's former permissive defaults.
- *
- * `getAuthLists`/`convertBetterAuthSchema` (and the runtime user-key
- * resolution) consume this module so derivation lives in exactly one place.
+ * `better-auth config → Auth lists` derivation, free of side effects and
+ * plugin/runtime concerns. Reads better-auth's own resolved table
+ * definitions (`getAuthTables`, re-exported from `better-auth/db`) rather
+ * than hand-transcribing them, so the Auth lists cannot silently drift from
+ * what better-auth itself declares (issue #987). This single derivation also
+ * covers better-auth *plugin* tables (e.g. the MCP plugin's OAuth tables) —
+ * `getAuthTables` merges a plugin's own `schema` into its result when
+ * `options.plugins` is populated, so one registry and one field-derivation
+ * pass cover base models and plugin tables alike (issue #992). See
+ * `packages/auth/CLAUDE.md` ("Deriving Auth lists from better-auth config")
+ * for the full behavior and examples.
  */
+import type { BetterAuthPlugin } from 'better-auth';
 import type { ListConfig } from '@opensaas/stack-core';
 import type { ExtendUserListConfig } from '../lists/index.js';
 import type { AuthAccessConfig, NormalizedAuthModels } from './types.js';
 /**
- * The derived Auth list set together with the keys each list was placed under.
- * Keys are surfaced separately so callers (plugin add-vs-extend logic, runtime
- * user-key resolution) don't have to re-derive them.
+ * The derived Auth list set together with the keys each of the five base
+ * better-auth models was placed under. Keys are surfaced separately so
+ * callers (plugin add-vs-extend logic, runtime user-key resolution) don't
+ * have to re-derive them. Better-auth *plugin* tables (e.g. `oauthApplication`)
+ * are derived alongside these but aren't named here — their keys are only
+ * needed internally, to resolve a reference target, and by callers that just
+ * want every derived list (`Object.keys(lists)`).
  */
 export type DerivedAuthLists = {
-    /** Derived list keys, one per better-auth model. */
     keys: {
         user: string;
         session: string;
@@ -43,25 +33,40 @@ export type DerivedAuthLists = {
         /** Only present when a `RateLimit` list was derived (`rateLimit.storage === 'database'`). */
         rateLimit?: string;
     };
-    /** The derived list configs, keyed by their derived list keys. */
+    /** The derived list configs, keyed by their derived list keys — base models and plugin tables alike. */
     lists: Record<string, ListConfig<any>>;
 };
 /**
- * Derive the OpenSaaS Auth lists from the resolved better-auth model config.
+ * Derive the OpenSaaS Auth lists from the resolved better-auth model config —
+ * the four base models, an optional database-backed `RateLimit`, and any
+ * table a better-auth plugin declares in its own `schema` (issue #992).
  *
- * Per ADR-0013 the derived lists ship **closed** (no permissive operation
+ * Per ADR-0013 every derived list ships **closed** (no permissive operation
  * access) unless the application supplies access via `accessConfig` (the
  * `authPlugin({ access: … })` passthrough, keyed by better-auth model name) or,
  * for the user list specifically, `userConfig.access` (`extendUserList.access`,
- * which takes precedence — see {@link AuthAccessConfig}).
+ * which takes precedence — see {@link AuthAccessConfig}). Plugin tables have no
+ * `access` passthrough at all — an app that needs to grant access declares the
+ * list itself under the same derived key so this function's field-only merge
+ * (in `authPlugin`'s add-vs-extend loop) leaves the app's own access standing.
  *
  * A fifth `RateLimit` list is included only when `models.rateLimit` is
  * present (i.e. `rateLimit.storage === 'database'`).
  *
- * @param models - Resolved better-auth per-model config (modelName + field column maps)
+ * Each base model's `indexes` (`AuthModelConfig.indexes`) carries through to
+ * the derived list's `db.indexes` unchanged, and suppresses this function's
+ * own derived field-level `isIndexed` for any column an entry names — the
+ * application's declaration wins over a derived default (ADR-0035).
+ *
+ * @param models - Resolved better-auth per-model config (modelName + field column maps + app-supplied indexes)
  * @param userConfig - Extra User-list fields/access/hooks supplied via `extendUserList`
- * @param accessConfig - App-authored access for each Auth list, keyed by better-auth model name
- * @returns The derived list keys and the Auth list configs keyed by those keys
+ * @param accessConfig - App-authored access for each base Auth list, keyed by better-auth model name
+ * @param plugins - The app's better-auth plugins (`authPlugin({ betterAuthPlugins })`), whose own
+ *   `schema` (base-model extensions and standalone plugin tables) is derived alongside the base models
+ * @param credentialFieldsConfig - App-authored additions to the credential-field read-deny
+ *   (`authPlugin({ credentialFields })`), keyed by better-auth model key. Additive only — see
+ *   {@link buildCredentialFieldRegistry}.
+ * @returns The derived base-model list keys and every derived list config (base models and plugin tables)
  */
-export declare function deriveAuthLists(models: NormalizedAuthModels, userConfig?: ExtendUserListConfig, accessConfig?: AuthAccessConfig): DerivedAuthLists;
+export declare function deriveAuthLists(models: NormalizedAuthModels, userConfig?: ExtendUserListConfig, accessConfig?: AuthAccessConfig, plugins?: BetterAuthPlugin[], credentialFieldsConfig?: Record<string, string[]>): DerivedAuthLists;
 //# sourceMappingURL=derive-auth-lists.d.ts.map

package/dist/config/derive-auth-lists.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"derive-auth-lists.d.ts","sourceRoot":"","sources":["../../src/config/derive-auth-lists.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AAWH,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,sBAAsB,CAAA;AAEtD,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,mBAAmB,CAAA;AAC7D,OAAO,KAAK,EAAE,gBAAgB,EAA6B,oBAAoB,EAAE,MAAM,YAAY,CAAA;AAEnG;;;;GAIG;AACH,MAAM,MAAM,gBAAgB,GAAG;IAC7B,oDAAoD;IACpD,IAAI,EAAE;QACJ,IAAI,EAAE,MAAM,CAAA;QACZ,OAAO,EAAE,MAAM,CAAA;QACf,OAAO,EAAE,MAAM,CAAA;QACf,YAAY,EAAE,MAAM,CAAA;QACpB,6FAA6F;QAC7F,SAAS,CAAC,EAAE,MAAM,CAAA;KACnB,CAAA;IACD,kEAAkE;IAElE,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,UAAU,CAAC,GAAG,CAAC,CAAC,CAAA;CACvC,CAAA;AA6PD;;;;;;;;;;;;;;;;GAgBG;AACH,wBAAgB,eAAe,CAC7B,MAAM,EAAE,oBAAoB,EAC5B,UAAU,GAAE,oBAAyB,EACrC,YAAY,GAAE,gBAAqB,GAClC,gBAAgB,CAsBlB"}
+{"version":3,"file":"derive-auth-lists.d.ts","sourceRoot":"","sources":["../../src/config/derive-auth-lists.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAYH,OAAO,KAAK,EAAqB,gBAAgB,EAAE,MAAM,aAAa,CAAA;AAEtE,OAAO,KAAK,EAAE,UAAU,EAAuC,MAAM,sBAAsB,CAAA;AAE3F,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,mBAAmB,CAAA;AAC7D,OAAO,KAAK,EAAE,gBAAgB,EAA6B,oBAAoB,EAAE,MAAM,YAAY,CAAA;AAEnG;;;;;;;;GAQG;AACH,MAAM,MAAM,gBAAgB,GAAG;IAC7B,IAAI,EAAE;QACJ,IAAI,EAAE,MAAM,CAAA;QACZ,OAAO,EAAE,MAAM,CAAA;QACf,OAAO,EAAE,MAAM,CAAA;QACf,YAAY,EAAE,MAAM,CAAA;QACpB,6FAA6F;QAC7F,SAAS,CAAC,EAAE,MAAM,CAAA;KACnB,CAAA;IACD,wGAAwG;IAExG,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,UAAU,CAAC,GAAG,CAAC,CAAC,CAAA;CACvC,CAAA;AAufD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+BG;AACH,wBAAgB,eAAe,CAC7B,MAAM,EAAE,oBAAoB,EAC5B,UAAU,GAAE,oBAAyB,EACrC,YAAY,GAAE,gBAAqB,EACnC,OAAO,GAAE,gBAAgB,EAAO,EAChC,sBAAsB,GAAE,MAAM,CAAC,MAAM,EAAE,MAAM,EAAE,CAAM,GACpD,gBAAgB,CAoMlB"}