@podosoft/podokit 0.17.4 → 1.0.2

package/dist/templates/modules/auth/files/apps/api/src/auth/auth.service.spec.ts

@@ -0,0 +1,52 @@
+import { describe, expect, test } from "bun:test";
+import { AccessPolicy } from "../core/services";
+import type { SettingsService } from "../settings/settings.service";
+import { AuthService, rolesOf, type AuthSession } from "./auth.service";
+
+function settings(require2fa: boolean): SettingsService {
+  return { getBool: () => require2fa } as unknown as SettingsService;
+}
+
+function session(overrides: Partial<AuthSession["user"]> = {}): AuthSession {
+  return { user: { id: "user-1", ...overrides }, session: {} };
+}
+
+describe("AuthService", () => {
+  test("normalizes string and array roles", () => {
+    expect(rolesOf(session({ role: "user, admin" }).user)).toEqual(["user", "admin"]);
+    expect(rolesOf(session({ role: ["owner"] }).user)).toEqual(["owner"]);
+  });
+
+  test("keeps explicitly public routes unauthenticated", async () => {
+    const policy = new AccessPolicy();
+    policy.register("GET", "/public", "public");
+    const service = new AuthService(settings(false), policy, async () => null);
+    await expect(service.guard(new Request("http://localhost/public"))).resolves.toBeUndefined();
+  });
+
+  test("requires a session by default", async () => {
+    const service = new AuthService(settings(false), new AccessPolicy(), async () => null);
+    const result = service.guard(new Request("http://localhost/private"));
+    await expect(result).rejects.toMatchObject({ code: "AUTH_REQUIRED", statusCode: 401 });
+  });
+
+  test("requires two-factor enrolment when the policy is enabled", async () => {
+    const service = new AuthService(
+      settings(true),
+      new AccessPolicy(),
+      async () => session({ twoFactorEnabled: false }),
+    );
+    const result = service.guard(new Request("http://localhost/private"));
+    await expect(result).rejects.toMatchObject({ code: "TWO_FACTOR_REQUIRED", statusCode: 403 });
+  });
+
+  test("requires the admin role for admin operations", async () => {
+    const service = new AuthService(
+      settings(false),
+      new AccessPolicy(),
+      async () => session({ role: "user" }),
+    );
+    await expect(service.requireAdmin(new Request("http://localhost/account/settings")))
+      .rejects.toMatchObject({ code: "ADMIN_REQUIRED", statusCode: 403 });
+  });
+});

package/dist/templates/modules/auth/files/apps/api/src/auth/auth.service.ts

@@ -0,0 +1,78 @@
+import { AppException } from "@podosoft/podokit-contracts";
+import type { AccessPolicy } from "../core/services";
+import type { SettingsService } from "../settings/settings.service";
+import { getAuth, refreshIfStale } from "./auth-provider";
+import { pool } from "./db";
+
+export interface AuthUser extends Record<string, unknown> {
+  id: string;
+  role?: string | string[] | null;
+  twoFactorEnabled?: boolean;
+}
+
+export interface AuthSession {
+  user: AuthUser;
+  session: Record<string, unknown>;
+}
+
+export type SessionResolver = (headers: Headers) => Promise<AuthSession | null>;
+
+function defaultSessionResolver(headers: Headers): Promise<AuthSession | null> {
+  return refreshIfStale()
+    .then(() => getAuth().api.getSession({ headers }))
+    .then((session) => session as AuthSession | null);
+}
+
+export function rolesOf(user: AuthUser): string[] {
+  if (Array.isArray(user.role)) return user.role;
+  return (user.role ?? "").split(",").map((role) => role.trim()).filter(Boolean);
+}
+
+export class AuthService {
+  private readonly sessions = new WeakMap<Request, Promise<AuthSession | null>>();
+
+  constructor(
+    private readonly settings: SettingsService,
+    private readonly accessPolicy: AccessPolicy,
+    private readonly resolveSession: SessionResolver = defaultSessionResolver,
+  ) {}
+
+  session(request: Request): Promise<AuthSession | null> {
+    const cached = this.sessions.get(request);
+    if (cached) return cached;
+    const result = this.resolveSession(request.headers);
+    this.sessions.set(request, result);
+    return result;
+  }
+
+  async requireSession(request: Request): Promise<AuthSession> {
+    const session = await this.session(request);
+    if (!session) throw new AppException("AUTH_REQUIRED", "Authentication is required", 401);
+    return session;
+  }
+
+  async requireAdmin(request: Request): Promise<AuthSession> {
+    const session = await this.requireSession(request);
+    if (!rolesOf(session.user).includes("admin")) {
+      throw new AppException("ADMIN_REQUIRED", "Administrator access is required", 403);
+    }
+    return session;
+  }
+
+  async guard(request: Request): Promise<void> {
+    if (this.accessPolicy.resolve(request) !== "session") return;
+    const session = await this.requireSession(request);
+    if (!this.settings.getBool("require2fa") || session.user.twoFactorEnabled) return;
+    const path = new URL(request.url).pathname;
+    if (path === "/account/require-2fa" || path === "/account/settings") return;
+    throw new AppException(
+      "TWO_FACTOR_REQUIRED",
+      "Two-factor enrolment is required.",
+      403,
+    );
+  }
+
+  async close(): Promise<void> {
+    await pool.end();
+  }
+}

package/dist/templates/modules/auth/files/apps/api/src/auth/auth.ts

@@ -1,6 +1,6 @@
 import { betterAuth, type BetterAuthOptions, type BetterAuthPlugin } from "better-auth";
 import { APIError } from "better-auth/api";
-import { twoFactor, haveIBeenPwned, magicLink, emailOTP, username, multiSession, phoneNumber, organization, jwt, bearer } from "better-auth/plugins";
+import { twoFactor, haveIBeenPwned, magicLink, emailOTP, username, multiSession, phoneNumber, organization, jwt, bearer, openAPI } from "better-auth/plugins";
 import { actionEmail, sendMail } from "../mail/mailer";
 import { sendSms } from "../sms/sms";
 import { assertUserCreationAllowed, createFeatureGate, createSignupOpenCheck } from "./feature-gate";
@@ -118,6 +118,9 @@ export function buildAuth(config: AuthConfig) {
     // Register clients at /api/auth/oauth2/create-client; discovery at
     // /api/auth/.well-known/openid-configuration. See docs/modules.md.
     oauthProvider({ loginPage: "/login", consentPage: "/oauth2/consent" }),
+    // Makes the dynamic Better Auth route contract available for the generated
+    // OpenAPI parity check in addition to the Elysia application schema.
+    openAPI(),
   ];
   // Reject passwords found in known breaches (Have I Been Pwned, k-anonymity range
   // API). Admin-toggleable (auth_config), applied live on the next request.

package/dist/templates/modules/auth/files/apps/api/src/auth/user-delete-handlers.spec.ts

@@ -1,4 +1,4 @@
-import { afterEach, describe, expect, it, jest } from "@jest/globals";
+import { afterEach, describe, expect, mock, spyOn, test } from "bun:test";
 import {
   registerUserDeletedHandler,
   runUserDeletedHandlers,
@@ -10,15 +10,15 @@ describe("user deletion handlers", () => {
 
   afterEach(() => {
     for (const remove of unregister.splice(0)) remove();
-    jest.restoreAllMocks();
+    mock.restore();
   });
 
   function register(handler: UserDeletedHandler): void {
     unregister.push(registerUserDeletedHandler(handler));
   }
 
-  it("runs registered module cleanup with the deleted user", async () => {
-    const handler: UserDeletedHandler = jest.fn(async () => undefined);
+  test("runs registered module cleanup with the deleted user", async () => {
+    const handler: UserDeletedHandler = mock(async () => undefined);
     register(handler);
     const user = { id: "user-1", image: "/api/profile-images/avatar.png" };
 
@@ -27,8 +27,8 @@ describe("user deletion handlers", () => {
     expect(handler).toHaveBeenCalledWith(user);
   });
 
-  it("does not fail account deletion when one cleanup rejects", async () => {
-    jest.spyOn(console, "error").mockImplementation(() => undefined);
+  test("does not fail account deletion when one cleanup rejects", async () => {
+    spyOn(console, "error").mockImplementation(() => undefined);
     register(async () => {
       throw new Error("storage unavailable");
     });

package/dist/templates/modules/auth/files/apps/api/src/auth-config/auth-config.service.ts

@@ -1,7 +1,5 @@
-import { BadRequestException, Injectable } from "@nestjs/common";
-import { InjectRepository } from "@nestjs/typeorm";
-import { Repository } from "typeorm";
-import { AuthConfigRow } from "./auth-config.entity";
+import type { SQL } from "bun";
+import { AppException } from "@podosoft/podokit-contracts";
 import {
   DEFAULT_SESSION_LIFETIME_SECONDS,
   encryptSecret,
@@ -14,18 +12,26 @@ import {
 } from "@podosoft/podokit-auth";
 import { refreshAuthNow } from "../auth/auth-provider";
 
-/** One configured social provider as shown to the admin (no secret — just a
- *  `hasSecret` flag). */
-export type SocialProviderView = { id: string; enabled: boolean; clientId: string; redirectURI: string; hasSecret: boolean };
+export type SocialProviderView = {
+  id: string;
+  enabled: boolean;
+  clientId: string;
+  redirectURI: string;
+  hasSecret: boolean;
+};
 
-/** Admin-facing view — non-secret fields plus a `hasSecret` flag. Never exposes
- *  the stored client secret / SMTP password. Social providers are dynamic: the
- *  map holds one entry per configured provider (google, github, apple, …). */
 export type AuthConfigView = {
   social: Record<string, SocialProviderView>;
-  /** Catalog of addable providers (id + display label) for the "add provider" picker. */
   catalog: ReadonlyArray<{ id: string; label: string }>;
-  smtp: { enabled: boolean; host: string; port: number; secure: boolean; user: string; from: string; hasSecret: boolean };
+  smtp: {
+    enabled: boolean;
+    host: string;
+    port: number;
+    secure: boolean;
+    user: string;
+    from: string;
+    hasSecret: boolean;
+  };
   server: {
     requireEmailVerification: boolean;
     requireSignupApproval: boolean;
@@ -36,11 +42,25 @@ export type AuthConfigView = {
   };
 };
 
-type ProviderUpdate = { enabled?: boolean; clientId?: string; clientSecret?: string; redirectURI?: string; delete?: boolean };
+export type ProviderUpdate = {
+  enabled?: boolean;
+  clientId?: string;
+  clientSecret?: string;
+  redirectURI?: string;
+  delete?: boolean;
+};
+
 export type AuthConfigUpdate = {
-  /** Per-provider upsert (keyed by provider id); `{ delete: true }` removes it. */
   social?: Record<string, ProviderUpdate>;
-  smtp?: { enabled?: boolean; host?: string; port?: number; secure?: boolean; user?: string; pass?: string; from?: string };
+  smtp?: {
+    enabled?: boolean;
+    host?: string;
+    port?: number;
+    secure?: boolean;
+    user?: string;
+    pass?: string;
+    from?: string;
+  };
   server?: {
     requireEmailVerification?: boolean;
     requireSignupApproval?: boolean;
@@ -51,129 +71,223 @@ export type AuthConfigUpdate = {
   };
 };
 
-@Injectable()
+interface AuthConfigRow {
+  key: string;
+  enabled: boolean;
+  config: unknown;
+  secret: string | null;
+}
+
+function object(value: unknown): Record<string, unknown> {
+  if (value !== null && typeof value === "object" && !Array.isArray(value)) {
+    return value as Record<string, unknown>;
+  }
+  if (typeof value === "string") {
+    try {
+      return object(JSON.parse(value) as unknown);
+    } catch {
+      return {};
+    }
+  }
+  return {};
+}
+
+function stringField(source: Record<string, unknown>, key: string): string {
+  const value = source[key];
+  return typeof value === "string" ? value : "";
+}
+
+function booleanField(source: Record<string, unknown>, key: string, fallback: boolean): boolean {
+  return typeof source[key] === "boolean" ? source[key] : fallback;
+}
+
 export class AuthConfigService {
-  constructor(@InjectRepository(AuthConfigRow) private readonly repo: Repository<AuthConfigRow>) {}
+  constructor(private readonly sql: SQL) {}
 
-  async describe(): Promise<AuthConfigView> {
-    const rows = await this.repo.find();
-    const byKey = new Map(rows.map((r) => [r.key, r]));
-    const env = envAuthConfig();
+  private async rows(): Promise<AuthConfigRow[]> {
+    return this.sql<AuthConfigRow[]>`
+      SELECT "key", "enabled", "config", "secret" FROM "auth_config"
+    `;
+  }
+
+  private async row(key: string): Promise<AuthConfigRow | null> {
+    const rows = await this.sql<AuthConfigRow[]>`
+      SELECT "key", "enabled", "config", "secret"
+      FROM "auth_config" WHERE "key" = ${key}
+    `;
+    return rows[0] ?? null;
+  }
+
+  private async upsert(row: AuthConfigRow): Promise<void> {
+    const config = object(row.config);
+    await this.sql`
+      INSERT INTO "auth_config" ("key", "enabled", "config", "secret", "updatedAt")
+      VALUES (${row.key}, ${row.enabled}, ${config}, ${row.secret}, CURRENT_TIMESTAMP)
+      ON CONFLICT ("key") DO UPDATE SET
+        "enabled" = EXCLUDED."enabled",
+        "config" = EXCLUDED."config",
+        "secret" = EXCLUDED."secret",
+        "updatedAt" = CURRENT_TIMESTAMP
+    `;
+  }
 
+  async describe(): Promise<AuthConfigView> {
+    const rows = await this.rows();
+    const byKey = new Map(rows.map((row) => [row.key, row]));
+    const environment = envAuthConfig();
     const social: Record<string, SocialProviderView> = {};
+
     for (const row of rows) {
       if (!row.key.startsWith("social.")) continue;
       const id = row.key.slice("social.".length);
       if (!SUPPORTED_PROVIDER_IDS.has(id)) continue;
-      const c = (row.config ?? {}) as { clientId?: string; redirectURI?: string };
-      social[id] = { id, enabled: row.enabled, clientId: c.clientId ?? "", redirectURI: c.redirectURI ?? "", hasSecret: !!row.secret };
+      const config = object(row.config);
+      social[id] = {
+        id,
+        enabled: row.enabled,
+        clientId: stringField(config, "clientId"),
+        redirectURI: stringField(config, "redirectURI"),
+        hasSecret: row.secret !== null && row.secret.length > 0,
+      };
     }
-    // Surface env-configured providers (google/github) that have no DB row yet, so
-    // the admin sees them as already-active rather than missing.
-    for (const [id, p] of Object.entries(env.social)) {
-      if (!social[id]) social[id] = { id, enabled: p.enabled, clientId: p.clientId, redirectURI: p.redirectURI ?? "", hasSecret: !!p.clientSecret };
+    for (const [id, provider] of Object.entries(environment.social)) {
+      if (social[id]) continue;
+      social[id] = {
+        id,
+        enabled: provider.enabled,
+        clientId: provider.clientId,
+        redirectURI: provider.redirectURI ?? "",
+        hasSecret: provider.clientSecret.length > 0,
+      };
     }
 
-    const smtpRow = byKey.get("smtp");
-    const smtpC = (smtpRow?.config ?? {}) as { host?: string; port?: number; secure?: boolean; user?: string; from?: string };
-    const serverRow = byKey.get("server");
-    const serverC = (serverRow?.config ?? {}) as {
-      requireEmailVerification?: boolean;
-      requireSignupApproval?: boolean;
-      allowDelete?: boolean;
-      hibp?: boolean;
-      auditLog?: boolean;
-      sessionIdleTimeoutMinutes?: number | null;
-    };
+    const smtp = byKey.get("smtp");
+    const smtpConfig = object(smtp?.config);
+    const serverConfig = object(byKey.get("server")?.config);
     return {
       social,
       catalog: SUPPORTED_SOCIAL_PROVIDERS,
       smtp: {
-        enabled: smtpRow?.enabled ?? false,
-        host: smtpC.host ?? "",
-        port: smtpC.port ?? 587,
-        secure: smtpC.secure ?? false,
-        user: smtpC.user ?? "",
-        from: smtpC.from ?? "",
-        hasSecret: !!smtpRow?.secret,
+        enabled: smtp?.enabled ?? false,
+        host: stringField(smtpConfig, "host"),
+        port: typeof smtpConfig.port === "number" ? smtpConfig.port : 587,
+        secure: booleanField(smtpConfig, "secure", false),
+        user: stringField(smtpConfig, "user"),
+        from: stringField(smtpConfig, "from"),
+        hasSecret: smtp?.secret !== null && smtp?.secret !== undefined && smtp.secret.length > 0,
       },
       server: {
-        requireEmailVerification: serverC.requireEmailVerification ?? env.requireEmailVerification,
-        requireSignupApproval: serverC.requireSignupApproval ?? env.requireSignupApproval,
-        allowDelete: serverC.allowDelete ?? env.allowDelete,
-        hibp: serverC.hibp ?? env.hibp,
-        auditLog: serverC.auditLog ?? env.auditLog,
+        requireEmailVerification: booleanField(
+          serverConfig,
+          "requireEmailVerification",
+          environment.requireEmailVerification,
+        ),
+        requireSignupApproval: booleanField(
+          serverConfig,
+          "requireSignupApproval",
+          environment.requireSignupApproval,
+        ),
+        allowDelete: booleanField(serverConfig, "allowDelete", environment.allowDelete),
+        hibp: booleanField(serverConfig, "hibp", environment.hibp),
+        auditLog: booleanField(serverConfig, "auditLog", environment.auditLog),
         sessionIdleTimeoutMinutes: resolveSessionIdleTimeoutMinutes(
-          serverC.sessionIdleTimeoutMinutes,
-          env.sessionIdleTimeoutMinutes,
+          serverConfig.sessionIdleTimeoutMinutes,
+          environment.sessionIdleTimeoutMinutes,
         ),
       },
     };
   }
 
-  async update(dto: AuthConfigUpdate): Promise<AuthConfigView> {
-    for (const [id, u] of Object.entries(dto.social ?? {})) {
-      if (!SUPPORTED_PROVIDER_IDS.has(id)) throw new BadRequestException(`Unsupported social provider: ${id}`);
-      if (u.delete) await this.repo.delete({ key: socialKey(id) });
-      else await this.upsertProvider(socialKey(id), u);
+  async update(update: AuthConfigUpdate): Promise<AuthConfigView> {
+    for (const [id, provider] of Object.entries(update.social ?? {})) {
+      if (!SUPPORTED_PROVIDER_IDS.has(id)) {
+        throw new AppException("AUTH_PROVIDER_UNSUPPORTED", `Unsupported social provider: ${id}`, 400);
+      }
+      const key = socialKey(id);
+      if (provider.delete) await this.sql`DELETE FROM "auth_config" WHERE "key" = ${key}`;
+      else await this.upsertProvider(key, provider);
     }
-    if (dto.smtp) await this.upsertSmtp(dto.smtp);
-    if (dto.server) await this.upsertServer(dto.server);
+    if (update.smtp) await this.upsertSmtp(update.smtp);
+    if (update.server) await this.upsertServer(update.server);
     await refreshAuthNow();
-    if (dto.server?.sessionIdleTimeoutMinutes !== undefined) {
-      await this.resetSessionExpirations(dto.server.sessionIdleTimeoutMinutes);
+    if (update.server?.sessionIdleTimeoutMinutes !== undefined) {
+      await this.resetSessionExpirations(update.server.sessionIdleTimeoutMinutes);
     }
     return this.describe();
   }
 
-  private async upsertProvider(key: string, u: ProviderUpdate): Promise<void> {
-    const row = (await this.repo.findOneBy({ key })) ?? this.repo.create({ key, enabled: false, config: {}, secret: null });
-    const config = { ...(row.config as { clientId?: string; redirectURI?: string }) };
-    if (u.clientId !== undefined) config.clientId = u.clientId;
-    if (u.redirectURI !== undefined) config.redirectURI = u.redirectURI;
-    if (u.enabled !== undefined) row.enabled = u.enabled;
-    // Replace the secret only when a non-empty value is supplied; otherwise keep it.
-    if (u.clientSecret) row.secret = encryptSecret(u.clientSecret);
-    row.config = config;
-    await this.repo.save(row);
+  private async upsertProvider(key: string, update: ProviderUpdate): Promise<void> {
+    const current = await this.row(key) ?? { key, enabled: false, config: {}, secret: null };
+    const config = object(current.config);
+    if (update.clientId !== undefined) config.clientId = update.clientId;
+    if (update.redirectURI !== undefined) config.redirectURI = update.redirectURI;
+    await this.upsert({
+      ...current,
+      enabled: update.enabled ?? current.enabled,
+      config,
+      secret: update.clientSecret ? encryptSecret(update.clientSecret) : current.secret,
+    });
   }
 
-  private async upsertSmtp(u: NonNullable<AuthConfigUpdate["smtp"]>): Promise<void> {
-    const row = (await this.repo.findOneBy({ key: "smtp" })) ?? this.repo.create({ key: "smtp", enabled: false, config: {}, secret: null });
-    const config = { ...(row.config as Record<string, unknown>) };
-    for (const f of ["host", "port", "secure", "user", "from"] as const) if (u[f] !== undefined) config[f] = u[f];
-    if (u.enabled !== undefined) row.enabled = u.enabled;
-    if (u.pass) row.secret = encryptSecret(u.pass);
-    row.config = config;
-    await this.repo.save(row);
+  private async upsertSmtp(update: NonNullable<AuthConfigUpdate["smtp"]>): Promise<void> {
+    const current = await this.row("smtp") ?? {
+      key: "smtp",
+      enabled: false,
+      config: {},
+      secret: null,
+    };
+    const config = object(current.config);
+    for (const field of ["host", "port", "secure", "user", "from"] as const) {
+      if (update[field] !== undefined) config[field] = update[field];
+    }
+    await this.upsert({
+      ...current,
+      enabled: update.enabled ?? current.enabled,
+      config,
+      secret: update.pass ? encryptSecret(update.pass) : current.secret,
+    });
   }
 
-  private async upsertServer(u: NonNullable<AuthConfigUpdate["server"]>): Promise<void> {
-    if (u.sessionIdleTimeoutMinutes !== undefined && !isSessionIdleTimeoutMinutes(u.sessionIdleTimeoutMinutes)) {
-      throw new BadRequestException("Session idle timeout must be null or an integer from 5 to 10080 minutes");
+  private async upsertServer(update: NonNullable<AuthConfigUpdate["server"]>): Promise<void> {
+    if (
+      update.sessionIdleTimeoutMinutes !== undefined
+      && !isSessionIdleTimeoutMinutes(update.sessionIdleTimeoutMinutes)
+    ) {
+      throw new AppException(
+        "SESSION_IDLE_TIMEOUT_INVALID",
+        "Session idle timeout must be null or an integer from 5 to 10080 minutes",
+        400,
+      );
     }
-    const row = (await this.repo.findOneBy({ key: "server" })) ?? this.repo.create({ key: "server", enabled: true, config: {}, secret: null });
-    const config = { ...(row.config as Record<string, unknown>) };
-    for (const f of ["requireEmailVerification", "requireSignupApproval", "allowDelete", "hibp", "auditLog"] as const) {
-      if (u[f] !== undefined) config[f] = u[f];
+    const current = await this.row("server") ?? {
+      key: "server",
+      enabled: true,
+      config: {},
+      secret: null,
+    };
+    const config = object(current.config);
+    for (const field of [
+      "requireEmailVerification",
+      "requireSignupApproval",
+      "allowDelete",
+      "hibp",
+      "auditLog",
+    ] as const) {
+      if (update[field] !== undefined) config[field] = update[field];
     }
-    if (u.sessionIdleTimeoutMinutes !== undefined) {
-      config.sessionIdleTimeoutMinutes = u.sessionIdleTimeoutMinutes;
+    if (update.sessionIdleTimeoutMinutes !== undefined) {
+      config.sessionIdleTimeoutMinutes = update.sessionIdleTimeoutMinutes;
     }
-    row.config = config;
-    await this.repo.save(row);
+    await this.upsert({ ...current, config });
   }
 
   private async resetSessionExpirations(minutes: number | null): Promise<void> {
-    const lifetimeSeconds = minutes === null
-      ? DEFAULT_SESSION_LIFETIME_SECONDS
-      : minutes * 60;
-    await this.repo.manager.query(
-      `UPDATE "session"
-       SET "expiresAt" = CURRENT_TIMESTAMP + ($1 * INTERVAL '1 second'),
-           "updatedAt" = CURRENT_TIMESTAMP
-       WHERE "expiresAt" > CURRENT_TIMESTAMP`,
-      [lifetimeSeconds],
-    );
+    const lifetimeSeconds = minutes === null ? DEFAULT_SESSION_LIFETIME_SECONDS : minutes * 60;
+    await this.sql`
+      UPDATE "session"
+      SET "expiresAt" = CURRENT_TIMESTAMP + (${lifetimeSeconds} * INTERVAL '1 second'),
+          "updatedAt" = CURRENT_TIMESTAMP
+      WHERE "expiresAt" > CURRENT_TIMESTAMP
+    `;
   }
 }

package/dist/templates/modules/auth/files/apps/api/src/migrations/1720400000000-InitAppSettings.ts

@@ -27,7 +27,8 @@ export class InitAppSettings1720400000000 implements MigrationInterface {
         ('apiKey', 'true'),
         ('passkey', 'true'),
         ('organization', 'true'),
-        ('oidcProvider', 'false')
+        ('oidcProvider', 'false'),
+        ('require2fa', 'false')
       ON CONFLICT ("key") DO NOTHING
     `);
   }

package/dist/templates/modules/auth/files/apps/api/src/settings/app-settings.migration.spec.ts

@@ -0,0 +1,34 @@
+import { describe, expect, it } from "bun:test";
+import type { QueryRunner } from "typeorm";
+import { InitAppSettings1720400000000 } from "../migrations/1720400000000-InitAppSettings";
+
+describe("app setting migration", () => {
+  it("seeds every authentication feature and policy default", async () => {
+    const queries: string[] = [];
+    const runner = {
+      query: (sql: string): Promise<unknown[]> => {
+        queries.push(sql);
+        return Promise.resolve([]);
+      },
+    } as unknown as QueryRunner;
+
+    await new InitAppSettings1720400000000().up(runner);
+
+    const seed = queries.join("\n");
+    for (const key of [
+      "twoFactor",
+      "magicLink",
+      "emailOtp",
+      "username",
+      "multiSession",
+      "phoneNumber",
+      "apiKey",
+      "passkey",
+      "organization",
+      "oidcProvider",
+      "require2fa",
+    ]) {
+      expect(seed).toContain(`('${key}',`);
+    }
+  });
+});

package/dist/templates/modules/auth/files/apps/api/src/settings/flag-defaults.ts

@@ -1,7 +1,7 @@
 /** Admin-managed auth feature flags and their shipped defaults.
  *
- *  Kept free of Nest/TypeORM imports so both the DI-managed SettingsService and
- *  the better-auth feature gate (loaded by auth.ts, outside DI — including when
+ *  Kept free of framework/ORM imports so both SettingsService and the Better
+ *  Auth feature gate (loaded by auth.ts, including when
  *  the better-auth CLI evaluates auth.ts for migrations) can import it safely.
  *
  *  Must match the rows seeded by the InitAppSettings migration. phoneNumber is
@@ -21,7 +21,7 @@ export const FLAG_DEFAULTS: Record<FeatureFlag, boolean> = {
   // Acting as an OIDC identity provider is an enterprise opt-in; off by default.
   oidcProvider: false,
   // Policy (not a feature endpoint): when on, every signed-in user must enrol in
-  // two-factor before using the app. Enforced by TwoFactorRequiredGuard + the web
+  // two-factor before using the app. Enforced by AuthService + the web
   // enrolment gate — the feature gate ignores it (no endpoint prefix). Off by default.
   require2fa: false,
 };