@porulle/core 0.21.0 → 0.22.0

package/dist/auth/actor.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"actor.d.ts","sourceRoot":"","sources":["../../src/auth/actor.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAmB,cAAc,EAAE,MAAM,oBAAoB,CAAC;AAC1E,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,YAAY,CAAC;AACxC,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,YAAY,CAAC;AAI/C,eAAO,MAAM,kBAAkB,OAAO,CAAC;AACvC,eAAO,MAAM,mBAAmB,qBAAwC,CAAC;AAEzE,eAAO,MAAM,4BAA4B,0JAS/B,CAAC;AAEX,wBAAgB,sBAAsB,CAAC,MAAM,EAAE,cAAc,GAAG,MAAM,EAAE,CAEvE;AAsBD,8EAA8E;AAC9E,wBAAsB,YAAY,CAChC,OAAO,EAAE,OAAO,EAChB,IAAI,EAAE,YAAY,EAClB,MAAM,EAAE,cAAc,EACtB,OAAO,GAAE,OAAsD,GAC9D,OAAO,CAAC,KAAK,GAAG,IAAI,CAAC,CA2EvB"}
+{"version":3,"file":"actor.d.ts","sourceRoot":"","sources":["../../src/auth/actor.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAmB,cAAc,EAAE,MAAM,oBAAoB,CAAC;AAC1E,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,YAAY,CAAC;AACxC,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,YAAY,CAAC;AAmB/C,eAAO,MAAM,kBAAkB,OAAO,CAAC;AACvC,eAAO,MAAM,mBAAmB,qBAAwC,CAAC;AAEzE,eAAO,MAAM,4BAA4B,0JAS/B,CAAC;AAEX,wBAAgB,sBAAsB,CAAC,MAAM,EAAE,cAAc,GAAG,MAAM,EAAE,CAEvE;AAkED,8EAA8E;AAC9E,wBAAsB,YAAY,CAChC,OAAO,EAAE,OAAO,EAChB,IAAI,EAAE,YAAY,EAClB,MAAM,EAAE,cAAc,EACtB,OAAO,GAAE,OAAsD,GAC9D,OAAO,CAAC,KAAK,GAAG,IAAI,CAAC,CAiDvB"}

package/dist/auth/actor.js

@@ -31,6 +31,44 @@ function toIsoString(value) {
     const date = value instanceof Date ? value : typeof value === "string" ? new Date(value) : null;
     return date !== null && Number.isFinite(date.getTime()) ? date.toISOString() : null;
 }
+/**
+ * The caller's role in one organization, by one indexed read of `member`.
+ *
+ * This used to go through the organization plugin's endpoints, and that cost six
+ * statements instead of one. `getFullOrganization` loads the organization row,
+ * its invitations and its ENTIRE member list, then scans in JavaScript for a
+ * single membership; `getActiveMemberRole` then looks for the same membership
+ * again. Both take `headers` and re-resolve the session from them, so each also
+ * re-reads `session` and `user`, and the plugin writes `active_organization_id`
+ * back to the session row — a write on the hot path of every GET.
+ *
+ * For a shopper every one of those is a guaranteed miss: a shopper is not a
+ * member of the platform organization and never will be. The member-by-
+ * organization scan also grows with the member list, so the platform's busiest
+ * request got slower as the platform got bigger.
+ *
+ * The adapter read below is the same query the plugin ended with, issued once
+ * and without re-resolving anything. `findOne` returning null IS the answer for
+ * a shopper — one miss, done.
+ */
+async function findMembershipRole(auth, userId, organizationId) {
+    try {
+        const context = await auth.$context;
+        const membership = await context?.adapter?.findOne({
+            model: "member",
+            where: [
+                { field: "userId", value: userId },
+                { field: "organizationId", value: organizationId },
+            ],
+        });
+        return membership?.role;
+    }
+    catch {
+        // A membership that cannot be read is not a role. Treated as customer, as
+        // the plugin-endpoint version was, so this stays a performance change.
+        return undefined;
+    }
+}
 /** Resolve a better-auth session and its porulle organization permissions. */
 export async function resolveActor(headers, auth, config, request = new Request("http://localhost", { headers })) {
     let session;
@@ -52,32 +90,10 @@ export async function resolveActor(headers, auth, config, request = new Request(
     const defaultOrgId = config.auth?.defaultOrganizationId ?? DEFAULT_ORG_ID;
     let role = session.session.activeOrganizationRole;
     let orgId = session.session.activeOrganizationId;
-    if (!role && auth.api.getFullOrganization) {
-        try {
-            const org = await auth.api.getFullOrganization({
-                query: { organizationId: orgId ?? defaultOrgId },
-                headers,
-            });
-            if (org?.members) {
-                const membership = org.members.find((m) => m.userId === session.user.id);
-                if (membership) {
-                    role = membership.role;
-                    orgId = orgId ?? defaultOrgId;
-                }
-            }
-        }
-        catch {
-            // fall through — treat as customer
-        }
-    }
-    if (!role && orgId && auth.api.getActiveMemberRole) {
-        try {
-            const roleResult = await auth.api.getActiveMemberRole({ headers });
-            role = roleResult?.role;
-        }
-        catch {
-            // fall through — treat as customer
-        }
+    if (!role) {
+        role = await findMembershipRole(auth, session.user.id, orgId ?? defaultOrgId);
+        if (role)
+            orgId = orgId ?? defaultOrgId;
     }
     if (!orgId && config.auth?.storeResolver) {
         try {

package/dist/test-utils/create-pglite-adapter.d.ts

@@ -13,6 +13,20 @@
  */
 import type { DatabaseAdapter } from "../kernel/database/adapter.js";
 import type { DrizzleDatabase } from "../kernel/database/drizzle-db.js";
+/**
+ * Records the SQL statements issued between `start()` and `stop()`.
+ *
+ * Counting statements is the regression guard for round-trip cost: the queries
+ * behind an authenticated request take 0.3 ms of database time between them, so
+ * a timing assertion measures the network and tells you nothing you can act on,
+ * while a count is stable, fast and names exactly what regressed.
+ */
+export interface QueryLog {
+    /** Begin recording; clears anything previously recorded. */
+    start(): void;
+    /** Stop recording and return the statements captured, in order. */
+    stop(): string[];
+}
 /**
  * Creates a PGlite-backed database adapter for testing.
  *
@@ -28,5 +42,6 @@ export declare function createPGliteTestAdapter(): Promise<{
     adapter: DatabaseAdapter;
     db: DrizzleDatabase;
     cleanup: () => Promise<void>;
+    queryLog: QueryLog;
 }>;
 //# sourceMappingURL=create-pglite-adapter.d.ts.map

package/dist/test-utils/create-pglite-adapter.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"create-pglite-adapter.d.ts","sourceRoot":"","sources":["../../src/test-utils/create-pglite-adapter.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAMH,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,+BAA+B,CAAC;AAMrE,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,kCAAkC,CAAC;AA0BxE;;;;;;;;;;GAUG;AACH,wBAAsB,uBAAuB,IAAI,OAAO,CAAC;IACvD,OAAO,EAAE,eAAe,CAAC;IACzB,EAAE,EAAE,eAAe,CAAC;IACpB,OAAO,EAAE,MAAM,OAAO,CAAC,IAAI,CAAC,CAAC;CAC9B,CAAC,CAqFD"}
+{"version":3,"file":"create-pglite-adapter.d.ts","sourceRoot":"","sources":["../../src/test-utils/create-pglite-adapter.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAMH,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,+BAA+B,CAAC;AAMrE,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,kCAAkC,CAAC;AAExE;;;;;;;GAOG;AACH,MAAM,WAAW,QAAQ;IACvB,4DAA4D;IAC5D,KAAK,IAAI,IAAI,CAAC;IACd,mEAAmE;IACnE,IAAI,IAAI,MAAM,EAAE,CAAC;CAClB;AA0BD;;;;;;;;;;GAUG;AACH,wBAAsB,uBAAuB,IAAI,OAAO,CAAC;IACvD,OAAO,EAAE,eAAe,CAAC;IACzB,EAAE,EAAE,eAAe,CAAC;IACpB,OAAO,EAAE,MAAM,OAAO,CAAC,IAAI,CAAC,CAAC;IAC7B,QAAQ,EAAE,QAAQ,CAAC;CACpB,CAAC,CA6GD"}

package/dist/test-utils/create-pglite-adapter.js

@@ -50,8 +50,32 @@ async function pushCoreSchema(db) {
 export async function createPGliteTestAdapter() {
     // Create in-memory PGlite instance
     const pg = new PGlite();
+    // Every statement Drizzle issues passes through this logger, and Better Auth's
+    // drizzleAdapter shares this same instance — so a recording covers the auth
+    // reads too. That is the point: the only honest regression guard for "this
+    // request costs N round trips" is a count of the statements, not a stopwatch.
+    const recorded = [];
+    let recording = false;
+    const queryLog = {
+        start() {
+            recorded.length = 0;
+            recording = true;
+        },
+        stop() {
+            recording = false;
+            return [...recorded];
+        },
+    };
     // Wrap with Drizzle ORM first (pushSchema needs the Drizzle instance)
-    const db = drizzle(pg, { schema: fullSchema });
+    const db = drizzle(pg, {
+        schema: fullSchema,
+        logger: {
+            logQuery(query) {
+                if (recording)
+                    recorded.push(query);
+            },
+        },
+    });
     // Push core schema via drizzle-kit/api (no migration files needed)
     // PgliteDatabase<Schema> and DrizzleDatabase share the same Schema type;
     // the HKT parameter differs (PgliteQueryResultHKT vs PgQueryResultHKT)
@@ -125,5 +149,5 @@ export async function createPGliteTestAdapter() {
         // Re-insert default org after truncation (CASCADE wipes it)
         await ensureDefaultOrg(db);
     }
-    return { adapter, db, cleanup };
+    return { adapter, db, cleanup, queryLog };
 }

package/dist/test-utils/create-test-config.d.ts

@@ -1,4 +1,5 @@
 import type { CommerceConfig } from "../config/types.js";
+import type { QueryLog } from "./create-pglite-adapter.js";
 export declare function createTestConfig(overrides?: Partial<CommerceConfig>): Promise<CommerceConfig>;
 /**
  * Creates a test config backed by PGlite (in-memory PostgreSQL).
@@ -14,5 +15,6 @@ export declare function createTestConfig(overrides?: Partial<CommerceConfig>): P
 export declare function createPGliteTestConfig(overrides?: Partial<CommerceConfig>): Promise<{
     config: CommerceConfig;
     cleanup: () => Promise<void>;
+    queryLog: QueryLog;
 }>;
 //# sourceMappingURL=create-test-config.d.ts.map

package/dist/test-utils/create-test-config.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"create-test-config.d.ts","sourceRoot":"","sources":["../../src/test-utils/create-test-config.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,oBAAoB,CAAC;AAgDzD,wBAAsB,gBAAgB,CACpC,SAAS,GAAE,OAAO,CAAC,cAAc,CAAM,GACtC,OAAO,CAAC,cAAc,CAAC,CAqHzB;AAED;;;;;;;;;;GAUG;AACH,wBAAsB,sBAAsB,CAC1C,SAAS,GAAE,OAAO,CAAC,cAAc,CAAM,GACtC,OAAO,CAAC;IAAE,MAAM,EAAE,cAAc,CAAC;IAAC,OAAO,EAAE,MAAM,OAAO,CAAC,IAAI,CAAC,CAAA;CAAE,CAAC,CAUnE"}
+{"version":3,"file":"create-test-config.d.ts","sourceRoot":"","sources":["../../src/test-utils/create-test-config.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,oBAAoB,CAAC;AAGzD,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,4BAA4B,CAAC;AA8C3D,wBAAsB,gBAAgB,CACpC,SAAS,GAAE,OAAO,CAAC,cAAc,CAAM,GACtC,OAAO,CAAC,cAAc,CAAC,CAqHzB;AAED;;;;;;;;;;GAUG;AACH,wBAAsB,sBAAsB,CAC1C,SAAS,GAAE,OAAO,CAAC,cAAc,CAAM,GACtC,OAAO,CAAC;IACT,MAAM,EAAE,cAAc,CAAC;IACvB,OAAO,EAAE,MAAM,OAAO,CAAC,IAAI,CAAC,CAAC;IAC7B,QAAQ,EAAE,QAAQ,CAAC;CACpB,CAAC,CAUD"}

package/dist/test-utils/create-test-config.js

@@ -169,10 +169,10 @@ export async function createTestConfig(overrides = {}) {
  */
 export async function createPGliteTestConfig(overrides = {}) {
     const { createPGliteTestAdapter } = await import("./create-pglite-adapter.js");
-    const { adapter, cleanup } = await createPGliteTestAdapter();
+    const { adapter, cleanup, queryLog } = await createPGliteTestAdapter();
     const config = await createTestConfig({
         databaseAdapter: adapter,
         ...overrides,
     });
-    return { config, cleanup };
+    return { config, cleanup, queryLog };
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@porulle/core",
-  "version": "0.21.0",
+  "version": "0.22.0",
   "license": "MIT",
   "type": "module",
   "exports": {

package/src/auth/actor.ts

@@ -4,6 +4,21 @@ import type { AuthInstance } from "./setup.js";
 import { DEFAULT_ORG_ID } from "./org.js";
 import { isCredentialRejection } from "./auth-failure.js";
 
+/**
+ * The slice of Better Auth's internal context this file uses. Declared here
+ * rather than imported because `$context` is not on the public `Auth` type; if a
+ * future Better Auth removes or renames it, `findMembershipRole` degrades to
+ * "no role" rather than throwing, and the membership tests fail loudly.
+ */
+interface AuthContextLike {
+  adapter?: {
+    findOne<T>(query: {
+      model: string;
+      where: { field: string; value: unknown }[];
+    }): Promise<T | null>;
+  };
+}
+
 export const AUTH_COOKIE_PREFIX = "uc";
 export const SESSION_COOKIE_NAME = `${AUTH_COOKIE_PREFIX}.session_token`;
 
@@ -42,6 +57,50 @@ function toIsoString(value: unknown): string | null {
   return date !== null && Number.isFinite(date.getTime()) ? date.toISOString() : null;
 }
 
+/**
+ * The caller's role in one organization, by one indexed read of `member`.
+ *
+ * This used to go through the organization plugin's endpoints, and that cost six
+ * statements instead of one. `getFullOrganization` loads the organization row,
+ * its invitations and its ENTIRE member list, then scans in JavaScript for a
+ * single membership; `getActiveMemberRole` then looks for the same membership
+ * again. Both take `headers` and re-resolve the session from them, so each also
+ * re-reads `session` and `user`, and the plugin writes `active_organization_id`
+ * back to the session row — a write on the hot path of every GET.
+ *
+ * For a shopper every one of those is a guaranteed miss: a shopper is not a
+ * member of the platform organization and never will be. The member-by-
+ * organization scan also grows with the member list, so the platform's busiest
+ * request got slower as the platform got bigger.
+ *
+ * The adapter read below is the same query the plugin ended with, issued once
+ * and without re-resolving anything. `findOne` returning null IS the answer for
+ * a shopper — one miss, done.
+ */
+async function findMembershipRole(
+  auth: AuthInstance,
+  userId: string,
+  organizationId: string,
+): Promise<string | undefined> {
+  try {
+    const context = await (
+      auth as unknown as { $context?: Promise<AuthContextLike> }
+    ).$context;
+    const membership = await context?.adapter?.findOne<{ role?: string }>({
+      model: "member",
+      where: [
+        { field: "userId", value: userId },
+        { field: "organizationId", value: organizationId },
+      ],
+    });
+    return membership?.role;
+  } catch {
+    // A membership that cannot be read is not a role. Treated as customer, as
+    // the plugin-endpoint version was, so this stays a performance change.
+    return undefined;
+  }
+}
+
 /** Resolve a better-auth session and its porulle organization permissions. */
 export async function resolveActor(
   headers: Headers,
@@ -68,35 +127,9 @@ export async function resolveActor(
   let role = session.session.activeOrganizationRole as string | undefined;
   let orgId = session.session.activeOrganizationId as string | null;
 
-  if (!role && auth.api.getFullOrganization) {
-    try {
-      const org = await auth.api.getFullOrganization({
-        query: { organizationId: orgId ?? defaultOrgId },
-        headers,
-      });
-      if (org?.members) {
-        const membership = org.members.find(
-          (m) => m.userId === session.user.id,
-        );
-        if (membership) {
-          role = membership.role;
-          orgId = orgId ?? defaultOrgId;
-        }
-      }
-    } catch {
-      // fall through — treat as customer
-    }
-  }
-
-  if (!role && orgId && auth.api.getActiveMemberRole) {
-    try {
-      const roleResult = await auth.api.getActiveMemberRole({ headers });
-      role = (roleResult as Record<string, unknown>)?.role as
-        | string
-        | undefined;
-    } catch {
-      // fall through — treat as customer
-    }
+  if (!role) {
+    role = await findMembershipRole(auth, session.user.id, orgId ?? defaultOrgId);
+    if (role) orgId = orgId ?? defaultOrgId;
   }
 
   if (!orgId && config.auth?.storeResolver) {

package/src/test-utils/create-pglite-adapter.ts

@@ -24,6 +24,21 @@ import { ensureDefaultOrg } from "../auth/org.js";
 import * as fullSchema from "../kernel/database/schema.js";
 import type { DrizzleDatabase } from "../kernel/database/drizzle-db.js";
 
+/**
+ * Records the SQL statements issued between `start()` and `stop()`.
+ *
+ * Counting statements is the regression guard for round-trip cost: the queries
+ * behind an authenticated request take 0.3 ms of database time between them, so
+ * a timing assertion measures the network and tells you nothing you can act on,
+ * while a count is stable, fast and names exactly what regressed.
+ */
+export interface QueryLog {
+  /** Begin recording; clears anything previously recorded. */
+  start(): void;
+  /** Stop recording and return the statements captured, in order. */
+  stop(): string[];
+}
+
 // drizzle-kit/api uses CJS internally; createRequire provides ESM compat.
 const require = createRequire(import.meta.url);
 
@@ -63,12 +78,37 @@ export async function createPGliteTestAdapter(): Promise<{
   adapter: DatabaseAdapter;
   db: DrizzleDatabase;
   cleanup: () => Promise<void>;
+  queryLog: QueryLog;
 }> {
   // Create in-memory PGlite instance
   const pg = new PGlite();
 
+  // Every statement Drizzle issues passes through this logger, and Better Auth's
+  // drizzleAdapter shares this same instance — so a recording covers the auth
+  // reads too. That is the point: the only honest regression guard for "this
+  // request costs N round trips" is a count of the statements, not a stopwatch.
+  const recorded: string[] = [];
+  let recording = false;
+  const queryLog: QueryLog = {
+    start() {
+      recorded.length = 0;
+      recording = true;
+    },
+    stop() {
+      recording = false;
+      return [...recorded];
+    },
+  };
+
   // Wrap with Drizzle ORM first (pushSchema needs the Drizzle instance)
-  const db = drizzle(pg, { schema: fullSchema });
+  const db = drizzle(pg, {
+    schema: fullSchema,
+    logger: {
+      logQuery(query) {
+        if (recording) recorded.push(query);
+      },
+    },
+  });
 
   // Push core schema via drizzle-kit/api (no migration files needed)
   // PgliteDatabase<Schema> and DrizzleDatabase share the same Schema type;
@@ -147,5 +187,5 @@ export async function createPGliteTestAdapter(): Promise<{
     await ensureDefaultOrg(db);
   }
 
-  return { adapter, db, cleanup };
+  return { adapter, db, cleanup, queryLog };
 }

package/src/test-utils/create-test-config.ts

@@ -2,6 +2,7 @@ import { defineConfig } from "../config/define-config.js";
 import type { CommerceConfig } from "../config/types.js";
 import { Ok } from "../kernel/result.js";
 import type { StorageAdapter } from "../modules/media/adapter.js";
+import type { QueryLog } from "./create-pglite-adapter.js";
 
 function createInMemoryStorageAdapter(): StorageAdapter {
   const files = new Map<string, { data: ArrayBuffer; contentType: string }>();
@@ -181,14 +182,18 @@ export async function createTestConfig(
  */
 export async function createPGliteTestConfig(
   overrides: Partial<CommerceConfig> = {},
-): Promise<{ config: CommerceConfig; cleanup: () => Promise<void> }> {
+): Promise<{
+  config: CommerceConfig;
+  cleanup: () => Promise<void>;
+  queryLog: QueryLog;
+}> {
   const { createPGliteTestAdapter } = await import("./create-pglite-adapter.js");
-  const { adapter, cleanup } = await createPGliteTestAdapter();
+  const { adapter, cleanup, queryLog } = await createPGliteTestAdapter();
 
   const config = await createTestConfig({
     databaseAdapter: adapter,
     ...overrides,
   });
 
-  return { config, cleanup };
+  return { config, cleanup, queryLog };
 }