@pathmx/auth 0.5.0

package/providers/magic-link.ts

@@ -0,0 +1,226 @@
+import { betterAuth, type BetterAuthOptions } from "better-auth"
+import { getMigrations } from "better-auth/db/migration"
+import { magicLink } from "better-auth/plugins"
+import type { CredentialDirectory, CredentialProvider } from "@pathmx/core"
+import { betterAuthDatabase } from "./database.ts"
+import type { AuthProviderFactory } from "./types.ts"
+
+export type MagicLinkDelivery = Readonly<{
+  email: string
+  confirmUrl: string
+  expiresAt: Date
+}>
+
+export type MagicLinkMailer = Readonly<{
+  send(delivery: MagicLinkDelivery): Promise<void>
+}>
+
+export type MagicLinkProviderOptions = Readonly<{
+  origin: string
+  secret: string
+  mailer: MagicLinkMailer
+  signInHref?: string
+  confirmHref?: string
+}>
+
+const INTERNAL_BASE = "/api/auth/internal"
+const EXPIRES_IN_SECONDS = 5 * 60
+
+export const authRoutes = Object.freeze({
+  requestLink: "/api/auth/magic-link/request",
+  confirm: "/api/auth/magic-link/confirm",
+  signOut: "/api/auth/sign-out",
+})
+
+function normalizeEmail(value: string) {
+  return value.trim().toLowerCase()
+}
+
+function exactOrigin(value: string) {
+  const url = new URL(value)
+  if (url.pathname !== "/" || url.search || url.hash) {
+    throw new Error("PATHMX_AUTH_ORIGIN must be one exact origin.")
+  }
+  return url.origin
+}
+
+function sameOriginPost(request: Request, origin: string) {
+  if (request.method !== "POST") return false
+  const supplied = request.headers.get("origin")
+  if (supplied) return supplied === origin
+  const referer = request.headers.get("referer")
+  if (!referer) return false
+  try {
+    return new URL(referer).origin === origin
+  } catch {
+    return false
+  }
+}
+
+function redirectResponse(response: Response, location = "/") {
+  if (response.status >= 300 && response.status < 400) return response
+  const headers = new Headers(response.headers)
+  headers.set("Location", location)
+  return new Response(null, { status: 303, headers })
+}
+
+export function magicLinkProvider(
+  options: MagicLinkProviderOptions,
+): AuthProviderFactory {
+  const origin = exactOrigin(options.origin)
+  if (options.secret.length < 32) {
+    throw new Error("Magic-link secret must be at least 32 characters.")
+  }
+  const confirmHref = options.confirmHref ?? "/auth/confirm"
+  return ({ database, log }): CredentialProvider => {
+    const auth = betterAuth({
+      appName: "PathMX",
+      baseURL: origin,
+      basePath: INTERNAL_BASE,
+      secret: options.secret,
+      database: betterAuthDatabase(database) as NonNullable<
+        BetterAuthOptions["database"]
+      >,
+      trustedOrigins: [origin],
+      advanced: {
+        useSecureCookies: new URL(origin).protocol === "https:",
+        disableCSRFCheck: false,
+        disableOriginCheck: false,
+      },
+      plugins: [
+        magicLink({
+          expiresIn: EXPIRES_IN_SECONDS,
+          disableSignUp: true,
+          storeToken: "hashed",
+          rateLimit: { window: 60, max: 5 },
+          async sendMagicLink({ email, token }) {
+            await options.mailer.send({
+              email,
+              confirmUrl: `${origin}${confirmHref}#token=${encodeURIComponent(token)}`,
+              expiresAt: new Date(Date.now() + EXPIRES_IN_SECONDS * 1000),
+            })
+          },
+        }),
+      ],
+    })
+
+    return {
+      signIn: { method: "get", href: options.signInHref ?? "/sign-in" },
+      async ready(directory) {
+        const migrations = await getMigrations(auth.options)
+        if (migrations.toBeCreated.length || migrations.toBeAdded.length) {
+          throw new Error("The @pathmx/auth database migration is not current.")
+        }
+        const { internalAdapter } = await auth.$context
+        for (const candidate of directory.candidates()) {
+          const email = candidate.identity.email
+            ? normalizeEmail(candidate.identity.email)
+            : undefined
+          if (!email) continue
+          const existing = await internalAdapter.findUserByEmail(email)
+          const avatar = candidate.profile.avatar ?? null
+          if (!existing) {
+            await internalAdapter.createUser({
+              name: candidate.profile.name,
+              email,
+              emailVerified: false,
+              ...(candidate.profile.avatar
+                ? { image: candidate.profile.avatar }
+                : {}),
+            })
+          } else if (
+            existing.user.name !== candidate.profile.name ||
+            existing.user.image !== avatar
+          ) {
+            await internalAdapter.updateUser(existing.user.id, {
+              name: candidate.profile.name,
+              image: avatar,
+            })
+          }
+        }
+      },
+      async resolve(request) {
+        try {
+          const session = await auth.api.getSession({
+            headers: request.headers,
+          })
+          if (!session?.user) return
+          return {
+            identity: {
+              provider: "magic-link",
+              subject: session.user.id,
+              email: normalizeEmail(session.user.email),
+            },
+            signOut: { method: "post", href: authRoutes.signOut },
+          }
+        } catch (error) {
+          log.warn("magic-link.session", {
+            error: error instanceof Error ? error.message : String(error),
+          })
+          return
+        }
+      },
+      async fetch(request, directory: CredentialDirectory) {
+        const url = new URL(request.url)
+        if (url.origin !== origin || !sameOriginPost(request, origin)) {
+          return new Response("Not Found", { status: 404 })
+        }
+        if (url.pathname === authRoutes.requestLink) {
+          const form = await request.formData()
+          const rawEmail = form.get("email")
+          const email =
+            typeof rawEmail === "string" ? normalizeEmail(rawEmail) : ""
+          if (
+            email &&
+            (await directory.allows({ provider: "magic-link", email }))
+          ) {
+            try {
+              await auth.api.signInMagicLink({
+                body: { email, callbackURL: "/" },
+                headers: request.headers,
+              })
+            } catch (error) {
+              log.error("magic-link.request", {
+                error: error instanceof Error ? error.message : String(error),
+              })
+              // Preserve an enumeration-safe public response.
+            }
+          }
+          return new Response(null, { status: 202 })
+        }
+        if (url.pathname === authRoutes.confirm) {
+          const form = await request.formData()
+          const token = form.get("token")
+          if (typeof token !== "string" || !token || token.length > 2048) {
+            return new Response("Invalid or expired link.", { status: 400 })
+          }
+          try {
+            return redirectResponse(
+              await auth.api.magicLinkVerify({
+                query: { token, callbackURL: "/" },
+                headers: request.headers,
+                asResponse: true,
+              }),
+            )
+          } catch {
+            return new Response("Invalid or expired link.", { status: 400 })
+          }
+        }
+        if (url.pathname === authRoutes.signOut) {
+          try {
+            return redirectResponse(
+              await auth.api.signOut({
+                headers: request.headers,
+                asResponse: true,
+              }),
+            )
+          } catch {
+            return new Response("Not Found", { status: 404 })
+          }
+        }
+        return new Response("Not Found", { status: 404 })
+      },
+      async close() {},
+    }
+  }
+}

package/providers/types.ts

@@ -0,0 +1,10 @@
+import type { CredentialProvider, PluginLog, SqlDatabase } from "@pathmx/core"
+
+export type AuthProviderContext = Readonly<{
+  database: SqlDatabase
+  log: PluginLog
+}>
+
+export type AuthProviderFactory = (
+  context: AuthProviderContext,
+) => CredentialProvider