@opensaas/stack-auth 0.39.2 → 0.41.0

package/tests/generated-fk-shape.test.ts

@@ -3,8 +3,10 @@ import { config, list } from '@opensaas/stack-core'
 import { text, relationship } from '@opensaas/stack-core/fields'
 import type { OpenSaasConfig } from '@opensaas/stack-core'
 import type { Plugin } from '@opensaas/stack-core/extend'
+import { mcp } from '@better-auth/mcp'
 import { generatePrismaSchema } from '@opensaas/stack-cli/generator/prisma'
 import { authPlugin } from '../src/config/plugin.js'
+import { adoptBetterAuthTables } from '../src/config/adopt-better-auth-tables.js'
 
 /**
  * Resolve a config through plugin `init` (via `config()`) and each plugin's
@@ -33,8 +35,8 @@ function modelBlock(schema: string, modelName: string): string {
   return schema.slice(start, end === -1 ? undefined : end + 2)
 }
 
-describe('generated auth schema — Session/Account user FK mirrors better-auth (issue #679/#753)', () => {
-  it('emits onDelete: Cascade and omits @@index on Session.user and Account.user', async () => {
+describe('generated auth schema — Session/Account/Verification mirror better-auth (issue #679/#753/#937)', () => {
+  it('emits onDelete: Cascade, a userId @map, and @@index([userId]) on Session.user and Account.user', async () => {
     const schema = await generateSchema({
       db: { provider: 'sqlite' },
       plugins: [authPlugin({ emailAndPassword: { enabled: true } })],
@@ -50,18 +52,33 @@ describe('generated auth schema — Session/Account user FK mirrors better-auth
       // column alignment.
       expect(block).toContain('@relation(onDelete: Cascade, fields: [userId], references: [id])')
 
-      // (b) No separate FK index is emitted — parity with better-auth, which
-      // ships no @@index([userId]). This is deliberate (ADR-0007), not a
-      // regression; catching a re-introduced index here flags drift.
-      expect(block).not.toContain('@@index([userId])')
+      // (b) The FK column maps to better-auth's own `userId` column name,
+      // not the generator's Keystone-parity default of the field name
+      // (`user`) — see issue #935.
+      expect(block).toContain('@map("userId")')
+
+      // (c) The FK index is emitted, matching better-auth's own
+      // `session_userId_idx` / `account_userId_idx` — see issue #937 and
+      // ADR-0007. It is never emitted against the wrong field name.
+      expect(block).toContain('@@index([userId])')
       expect(block).not.toContain('@@index([user])')
     }
   })
 
+  it('emits @@index([identifier]) on Verification', async () => {
+    const schema = await generateSchema({
+      db: { provider: 'sqlite' },
+      plugins: [authPlugin({ emailAndPassword: { enabled: true } })],
+      lists: {},
+    })
+
+    const block = modelBlock(schema, 'Verification')
+    expect(block).toContain('@@index([identifier])')
+  })
+
   it('still emits the default @@index for a non-auth relationship FK', async () => {
-    // Contrast case: the generic FK-index path is untouched. Only the auth
-    // user relations opt out (via isIndexed: false); an ordinary app
-    // relationship keeps the default Keystone-parity @@index.
+    // Contrast case: the generic FK-index path is untouched by the
+    // auth-specific FK/index shape above.
     const schema = await generateSchema({
       db: { provider: 'sqlite' },
       plugins: [authPlugin({ emailAndPassword: { enabled: true } })],
@@ -80,6 +97,92 @@ describe('generated auth schema — Session/Account user FK mirrors better-auth
   })
 })
 
+describe('generated auth schema — account.issuer (better-auth 1.7, issue #986)', () => {
+  it('emits a required, non-nullable issuer column on Account, positioned after providerId', async () => {
+    const schema = await generateSchema({
+      db: { provider: 'sqlite' },
+      plugins: [authPlugin({ emailAndPassword: { enabled: true } })],
+      lists: {},
+    })
+
+    const block = modelBlock(schema, 'Account')
+    expect(block).toMatch(/issuer\s+String\s/)
+    expect(block).not.toMatch(/issuer\s+String\?/)
+
+    // FIELD_ORDER groups issuer with accountId/providerId — the fields that
+    // together form better-auth's table-level @@unique([issuer, accountId]),
+    // which this derivation does not yet emit (blocked on #986 reading
+    // better-auth's own table-level `indexes` option; #985 only lands the
+    // app-supplied `db.indexes` passthrough, exercised below).
+    const providerIdLine = block.indexOf('providerId')
+    const issuerLine = block.indexOf('issuer')
+    expect(providerIdLine).toBeGreaterThan(-1)
+    expect(issuerLine).toBeGreaterThan(providerIdLine)
+
+    // Not yet emitted — see the migration note in the auth package's
+    // CHANGELOG and issue #986.
+    expect(block).not.toContain('@@unique([issuer, accountId])')
+  })
+})
+
+describe('generated auth schema — adopted index names match better-auth exactly (issue #937)', () => {
+  it('derives session_userId_idx / account_userId_idx / verification_identifier_idx under adoptBetterAuthTables()', async () => {
+    const schema = await generateSchema({
+      db: { provider: 'postgresql' },
+      plugins: [
+        authPlugin({
+          ...adoptBetterAuthTables({ useBetterAuthTableNames: true }),
+          emailAndPassword: { enabled: true },
+        }),
+      ],
+      lists: {},
+    })
+
+    // No explicit `map:` is set on these auto FK/scalar indexes — Prisma's own
+    // implicit naming convention (<mapped table>_<mapped column>_idx) is what
+    // has to line up with better-auth's migrator-assigned names, so assert
+    // against the raw @@index lines rather than a `map:` argument.
+    const session = modelBlock(schema, 'AuthSession')
+    expect(session).toContain('@@map("session")')
+    expect(session).toContain('@@index([userId])')
+
+    const account = modelBlock(schema, 'AuthAccount')
+    expect(account).toContain('@@map("account")')
+    expect(account).toContain('@@index([userId])')
+
+    const verification = modelBlock(schema, 'AuthVerification')
+    expect(verification).toContain('@@map("verification")')
+    expect(verification).toContain('@@index([identifier])')
+  })
+
+  it('still indexes all three columns under the default adoptBetterAuthTables() (Auth-prefixed physical tables)', async () => {
+    // Without useBetterAuthTableNames, the physical table stays the prefixed
+    // model name (@@map("AuthSession"), not better-auth's own lowercase
+    // "session") — the index name won't match better-auth's naming
+    // convention here, but the columns must still be indexed regardless of
+    // table naming.
+    const schema = await generateSchema({
+      db: { provider: 'postgresql' },
+      plugins: [
+        authPlugin({
+          ...adoptBetterAuthTables(),
+          emailAndPassword: { enabled: true },
+        }),
+      ],
+      lists: {},
+    })
+
+    for (const model of ['AuthSession', 'AuthAccount']) {
+      const block = modelBlock(schema, model)
+      expect(block).toContain(`@@map("${model}")`)
+      expect(block).toContain('@@index([userId])')
+    }
+
+    const verification = modelBlock(schema, 'AuthVerification')
+    expect(verification).toContain('@@index([identifier])')
+  })
+})
+
 describe('generated auth schema — required columns mirror better-auth (issue #863)', () => {
   it('emits a required (non-nullable) userId FK and user relation on Session and Account', async () => {
     const schema = await generateSchema({
@@ -95,6 +198,10 @@ describe('generated auth schema — required columns mirror better-auth (issue #
       expect(block).not.toMatch(/userId\s+String\?/)
       expect(block).toMatch(/user\s+User\s+@relation/)
       expect(block).not.toMatch(/user\s+User\?/)
+
+      // The physical column must be userId, not the Keystone-parity default
+      // of the relationship field name ("user") — issue #935.
+      expect(block).not.toContain('@map("user")')
     }
   })
 
@@ -145,6 +252,151 @@ describe('generated auth schema — tableName independent of modelName (issue #8
   })
 })
 
+describe('generated MCP plugin OAuth schema gets real foreign keys and cascades (issue #992)', () => {
+  it('emits onDelete: Cascade, a userId @map, and @@index([userId]) on every OAuth table’s user relation', async () => {
+    const schema = await generateSchema({
+      db: { provider: 'sqlite' },
+      plugins: [
+        authPlugin({
+          emailAndPassword: { enabled: true },
+          betterAuthPlugins: [
+            mcp({
+              loginPage: '/sign-in',
+              consentPage: '/consent',
+              resource: 'https://example.com/mcp',
+            }),
+          ],
+        }),
+      ],
+      lists: {},
+    })
+
+    for (const model of ['OauthClient', 'OauthAccessToken', 'OauthConsent']) {
+      const block = modelBlock(schema, model)
+      expect(block).toContain('@relation(onDelete: Cascade, fields: [userId], references: [id])')
+      expect(block).toContain('@map("userId")')
+      expect(block).toContain('@@index([userId])')
+    }
+  })
+
+  it('maps each OAuth table to its camelCase physical table name via @@map', async () => {
+    const schema = await generateSchema({
+      db: { provider: 'sqlite' },
+      plugins: [
+        authPlugin({
+          emailAndPassword: { enabled: true },
+          betterAuthPlugins: [
+            mcp({
+              loginPage: '/sign-in',
+              consentPage: '/consent',
+              resource: 'https://example.com/mcp',
+            }),
+          ],
+        }),
+      ],
+      lists: {},
+    })
+
+    expect(modelBlock(schema, 'OauthClient')).toContain('@@map("oauthClient")')
+    expect(modelBlock(schema, 'OauthAccessToken')).toContain('@@map("oauthAccessToken")')
+    expect(modelBlock(schema, 'OauthConsent')).toContain('@@map("oauthConsent")')
+  })
+
+  it('leaves the non-PK clientId reference (oauthAccessToken/oauthConsent -> oauthClient.clientId) as an indexed plain column, not a relation', async () => {
+    const schema = await generateSchema({
+      db: { provider: 'sqlite' },
+      plugins: [
+        authPlugin({
+          emailAndPassword: { enabled: true },
+          betterAuthPlugins: [
+            mcp({
+              loginPage: '/sign-in',
+              consentPage: '/consent',
+              resource: 'https://example.com/mcp',
+            }),
+          ],
+        }),
+      ],
+      lists: {},
+    })
+
+    for (const model of ['OauthAccessToken', 'OauthConsent']) {
+      const block = modelBlock(schema, model)
+      expect(block).toMatch(/clientId\s+String\s/)
+      expect(block).not.toContain('clientId  OauthClient')
+      expect(block).toContain('@@index([clientId])')
+    }
+  })
+
+  it('adds a reverse collection on User for every OAuth table referencing it, and on Session for the two token tables that also reference it, leaving Account/Verification unchanged', async () => {
+    const withMcp = await generateSchema({
+      db: { provider: 'sqlite' },
+      plugins: [
+        authPlugin({
+          emailAndPassword: { enabled: true },
+          betterAuthPlugins: [
+            mcp({
+              loginPage: '/sign-in',
+              consentPage: '/consent',
+              resource: 'https://example.com/mcp',
+            }),
+          ],
+        }),
+      ],
+      lists: {},
+    })
+    const withoutMcp = await generateSchema({
+      db: { provider: 'sqlite' },
+      plugins: [authPlugin({ emailAndPassword: { enabled: true } })],
+      lists: {},
+    })
+
+    const user = modelBlock(withMcp, 'User')
+    expect(user).toContain('oauthClients')
+    expect(user).toContain('oauthAccessTokens')
+    expect(user).toContain('oauthRefreshTokens')
+    expect(user).toContain('oauthConsents')
+
+    // oauthAccessToken.sessionId / oauthRefreshToken.sessionId both reference
+    // session.id (unlike better-auth's pre-1.7 MCP schema, which had no
+    // session-scoped OAuth tables at all) — Session gains reverse collections
+    // for both, Account/Verification stay untouched by the MCP plugin.
+    const session = modelBlock(withMcp, 'Session')
+    expect(session).toContain('oauthAccessTokens')
+    expect(session).toContain('oauthRefreshTokens')
+
+    for (const model of ['Account', 'Verification']) {
+      expect(modelBlock(withMcp, model)).toBe(modelBlock(withoutMcp, model))
+    }
+  })
+
+  it('generates a required, non-nullable userId FK on OauthRefreshToken (required upstream), and an optional one on OauthClient (optional upstream)', async () => {
+    const schema = await generateSchema({
+      db: { provider: 'sqlite' },
+      plugins: [
+        authPlugin({
+          emailAndPassword: { enabled: true },
+          betterAuthPlugins: [
+            mcp({
+              loginPage: '/sign-in',
+              consentPage: '/consent',
+              resource: 'https://example.com/mcp',
+            }),
+          ],
+        }),
+      ],
+      lists: {},
+    })
+
+    const refreshToken = modelBlock(schema, 'OauthRefreshToken')
+    expect(refreshToken).toMatch(/userId\s+String\s/)
+    expect(refreshToken).not.toMatch(/userId\s+String\?/)
+
+    const client = modelBlock(schema, 'OauthClient')
+    expect(client).toMatch(/userId\s+String\?/)
+  })
+})
+
 describe('generated RateLimit schema mirrors better-auth exactly (issue #909)', () => {
   it('does not add a RateLimit model when storage is unset', async () => {
     const schema = await generateSchema({
@@ -225,3 +477,174 @@ describe('generated RateLimit schema mirrors better-auth exactly (issue #909)',
     expect(schema).toContain('model RateLimit')
   })
 })
+
+describe('app-supplied db.indexes on derived auth lists (issue #985)', () => {
+  it('emits a composite index on Verification and suppresses the derived single-column index on identifier', async () => {
+    const schema = await generateSchema({
+      db: { provider: 'sqlite' },
+      plugins: [
+        authPlugin({
+          emailAndPassword: { enabled: true },
+          verification: {
+            indexes: [{ fields: ['identifier', { field: 'createdAt', sort: 'desc' }] }],
+          },
+        }),
+      ],
+      lists: {},
+    })
+
+    const block = modelBlock(schema, 'Verification')
+    expect(block).toContain('@@index([identifier, createdAt(sort: Desc)])')
+    // The derived single-column index on identifier is suppressed — only the
+    // composite survives (ADR-0035).
+    expect(block).not.toContain('@@index([identifier])')
+  })
+
+  it('adopts a live named unique constraint on User.email, suppressing the derived inline @unique', async () => {
+    const schema = await generateSchema({
+      db: { provider: 'sqlite' },
+      plugins: [
+        authPlugin({
+          emailAndPassword: { enabled: true },
+          user: { indexes: [{ fields: ['email'], unique: true, name: 'user_email_key' }] },
+        }),
+      ],
+      lists: {},
+    })
+
+    const block = modelBlock(schema, 'User')
+    expect(block).toContain('@@unique([email], map: "user_email_key")')
+    expect(block).not.toMatch(/email\s+String\s+@unique/)
+  })
+
+  it('suppresses per-column only — every other derived index on the model still emits', async () => {
+    const schema = await generateSchema({
+      db: { provider: 'sqlite' },
+      plugins: [
+        authPlugin({
+          emailAndPassword: { enabled: true },
+          user: { indexes: [{ fields: ['email'], unique: true, name: 'user_email_key' }] },
+        }),
+      ],
+      lists: {},
+    })
+
+    // Session/Account's derived FK index on the User relation is untouched —
+    // suppression only ever applies to the column(s) an app entry names.
+    for (const model of ['Session', 'Account']) {
+      expect(modelBlock(schema, model)).toContain('@@index([userId])')
+    }
+  })
+
+  it('suppresses the derived FK index on a relationship field, not just scalars', async () => {
+    // A relationship field's own generator defaults its FK index to indexed
+    // whenever isIndexed is *omitted* (unlike a scalar field) — suppression
+    // must set isIndexed: false explicitly, or the derived @@index([userId])
+    // survives and collides with the app's own named entry.
+    const schema = await generateSchema({
+      db: { provider: 'sqlite' },
+      plugins: [
+        authPlugin({
+          emailAndPassword: { enabled: true },
+          session: { indexes: [{ fields: ['user'], name: 'session_user_idx' }] },
+        }),
+      ],
+      lists: {},
+    })
+
+    const block = modelBlock(schema, 'Session')
+    expect(block).toContain('@@index([userId], map: "session_user_idx")')
+    // The derived, unnamed @@index([userId]) must not also survive alongside it.
+    expect(block).not.toContain('@@index([userId])')
+  })
+
+  it("resolves the entry's field key through the model's own column map (@map)", async () => {
+    const schema = await generateSchema({
+      db: { provider: 'sqlite' },
+      plugins: [
+        authPlugin({
+          emailAndPassword: { enabled: true },
+          verification: {
+            fields: { identifier: 'ident_col' },
+            indexes: [{ fields: ['identifier'] }],
+          },
+        }),
+      ],
+      lists: {},
+    })
+
+    const block = modelBlock(schema, 'Verification')
+    // db.indexes names the OpenSaaS field key, not the mapped column name —
+    // Prisma's @@index references the field, independent of its own @map.
+    expect(block).toContain('@map("ident_col")')
+    expect(block).toContain('@@index([identifier])')
+  })
+
+  it('#921: user.email and session.token both round-trip under adopted constraint names', async () => {
+    const schema = await generateSchema({
+      db: { provider: 'sqlite' },
+      plugins: [
+        authPlugin({
+          emailAndPassword: { enabled: true },
+          user: { indexes: [{ fields: ['email'], unique: true, name: 'user_email_key' }] },
+          session: { indexes: [{ fields: ['token'], unique: true, name: 'session_token_key' }] },
+        }),
+      ],
+      lists: {},
+    })
+
+    const user = modelBlock(schema, 'User')
+    expect(user).toContain('@@unique([email], map: "user_email_key")')
+    expect(user).not.toMatch(/email\s+String\s+@unique/)
+
+    const session = modelBlock(schema, 'Session')
+    expect(session).toContain('@@unique([token], map: "session_token_key")')
+    expect(session).not.toMatch(/token\s+String\s+@unique/)
+  })
+
+  it('fails generation naming the model, the entry, and the bad field for an unknown field', async () => {
+    await expect(
+      generateSchema({
+        db: { provider: 'sqlite' },
+        plugins: [
+          authPlugin({
+            emailAndPassword: { enabled: true },
+            verification: { indexes: [{ fields: ['doesNotExist'] }] },
+          }),
+        ],
+        lists: {},
+      }),
+    ).rejects.toThrow(/Verification.*references unknown field "doesNotExist"/)
+  })
+
+  it('names the remapped list key when modelName overrides the derived key', async () => {
+    await expect(
+      generateSchema({
+        db: { provider: 'sqlite' },
+        plugins: [
+          authPlugin({
+            emailAndPassword: { enabled: true },
+            verification: {
+              modelName: 'AuthVerification',
+              indexes: [{ fields: ['doesNotExist'] }],
+            },
+          }),
+        ],
+        lists: {},
+      }),
+    ).rejects.toThrow(/AuthVerification.*references unknown field "doesNotExist"/)
+  })
+
+  it('leaves existing auth-list derivation unchanged when no indexes are configured', async () => {
+    const withIndexes = await generateSchema({
+      db: { provider: 'sqlite' },
+      plugins: [authPlugin({ emailAndPassword: { enabled: true } })],
+      lists: {},
+    })
+
+    for (const model of ['User', 'Session', 'Account', 'Verification']) {
+      expect(modelBlock(withIndexes, model)).not.toContain('@@unique([')
+      expect(modelBlock(withIndexes, model)).not.toContain('@@index([identifier, ')
+    }
+  })
+})