@porulle/core 0.43.0 → 0.44.0

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@porulle/core",
-  "version": "0.43.0",
+  "version": "0.44.0",
   "license": "MIT",
   "type": "module",
   "exports": {

package/src/auth/actor.ts

@@ -37,11 +37,7 @@ export function getCustomerPermissions(config: CommerceConfig): string[] {
   return config.auth?.customerPermissions ?? [...DEFAULT_CUSTOMER_PERMISSIONS];
 }
 
-function resolvePermissions(
-  session: AuthSessionLike,
-  config: CommerceConfig,
-): string[] {
-  const role = session.session.activeOrganizationRole;
+function resolvePermissions(role: string | null | undefined, config: CommerceConfig): string[] {
   if (!role) return getCustomerPermissions(config);
   const roleConfig = config.auth?.roles?.[role];
   return roleConfig ? roleConfig.permissions : [];
@@ -124,7 +120,7 @@ export async function resolveActor(
   if (!session) return null;
 
   const defaultOrgId = config.auth?.defaultOrganizationId ?? DEFAULT_ORG_ID;
-  let role = session.session.activeOrganizationRole as string | undefined;
+  let role: string | undefined;
   let orgId = session.session.activeOrganizationId as string | null;
 
   if (!role) {
@@ -141,10 +137,6 @@ export async function resolveActor(
     }
   }
 
-  const enrichedSession = {
-    ...session,
-    session: { ...session.session, activeOrganizationRole: role ?? null },
-  };
   return {
     type: "user",
     userId: session.user.id,
@@ -153,7 +145,7 @@ export async function resolveActor(
     vendorId: session.user.vendorId ?? null,
     organizationId: orgId ?? defaultOrgId,
     role: role ?? "customer",
-    permissions: resolvePermissions(enrichedSession, config),
+    permissions: resolvePermissions(role, config),
     sessionCreatedAt: toIsoString(session.session.createdAt),
   } satisfies Actor;
 }

package/src/auth/setup.ts

@@ -7,6 +7,7 @@ import type { CommerceConfig } from "../config/types.js";
 import type { DatabaseAdapter } from "../kernel/database/adapter.js";
 import * as authSchema from "./auth-schema.js";
 import { AUTH_COOKIE_PREFIX } from "./actor.js";
+import { SUPPRESSED_AUTH_PATH_LIST } from "./suppressed-auth-paths.js";
 
 type BetterAuthDbProvider = "pg";
 
@@ -141,6 +142,11 @@ export function createAuth(
   try {
     const auth = betterAuth({
       ...(config.auth?.baseURL ? { baseURL: config.auth.baseURL } : {}),
+      // Endpoints whose only currency is a raw session bearer token. Read in
+      // the router's own onRequest, before rate limiting and before any plugin
+      // hook, so no mount point or config reaches them. See
+      // ./suppressed-auth-paths.ts for the per-path argument.
+      disabledPaths: [...SUPPRESSED_AUTH_PATH_LIST],
       database: drizzleAdapter(db.db as unknown as Record<string, unknown>, {
         provider: resolveAuthDbProvider(db.provider),
         schema: authSchema,

package/src/auth/suppressed-auth-paths.ts

@@ -0,0 +1,66 @@
+/**
+ * Better Auth endpoints this repository refuses to serve, because their only
+ * currency is a raw session bearer token.
+ *
+ * THE DEFAULT IS TO SERVE. A Better Auth endpoint absent from this list is
+ * mounted, because suppressing one is a removal from a published surface and
+ * the list is the place where that removal is argued rather than assumed.
+ *
+ * These are handed to Better Auth's own `disabledPaths` option rather than
+ * refused by a middleware in front of the handler. The difference is what a
+ * future mount can reach around. `runtime/server.ts` funnels `/api/auth/*` into
+ * `auth.handler`, and `disabledPaths` is read inside that handler's router, in
+ * `onRequest`, BEFORE rate limiting and before any plugin hook — so there is no
+ * ordering, no second mount point and no consumer configuration that reaches
+ * the endpoint without passing it. A Hono middleware would have to be
+ * remembered at every mount point instead, and this is an auth surface.
+ *
+ * MATCHING IS EXACT, on the path Better Auth normalizes a request to: the
+ * pathname with the auth base path stripped, so `/api/auth/list-sessions`
+ * arrives here as `/list-sessions`. A consumer cannot move that out from under
+ * the list without breaking every auth route at once — `runtime/server.ts`
+ * mounts the handler at a literal `/api/auth/*`, and Better Auth derives the
+ * router's base path from `auth.baseURL`, so a `baseURL` carrying some other
+ * path makes EVERY endpoint unreachable rather than just these. The failure is
+ * loud, which is the property that matters: a guard that silently stops
+ * covering its route is worse than no guard.
+ *
+ * Suppression is unconditional and not configurable. A config flag here would
+ * be a documented way to switch the leak back on, and there is no caller that
+ * wants one: nothing in this repository calls either path.
+ */
+export type SuppressedAuthPath = {
+  /** The path as Better Auth normalizes it — no `/api/auth` prefix. */
+  path: string;
+  justification: string;
+};
+
+export const SUPPRESSED_AUTH_PATHS: readonly SuppressedAuthPath[] = [
+  {
+    path: "/list-sessions",
+    justification:
+      "Returns every one of the caller's live sessions through parseSessionOutput, " +
+      "which filters by the session output schema — and `token` carries no " +
+      "`returned: false`, so each row arrives with its raw bearer token. One " +
+      "compromised session therefore yields durable capture of all of them, and " +
+      "the capture survives the victim revoking the session they know about. " +
+      "Its guard is freshSessionMiddleware, whose freshAge defaults to a day, so " +
+      "a session phished minutes ago is fresh enough to ask.",
+  },
+  {
+    path: "/revoke-session",
+    justification:
+      "Takes `{ token }` as its only handle, so it is the consumer of what " +
+      "/list-sessions leaks and has no legitimate caller once that path is gone: " +
+      "the only token a client can still hold is its own, which sign-out ends. " +
+      "Revoking by an opaque id belongs to the consumer route that owns the " +
+      "shaped list. /revoke-sessions and /revoke-other-sessions take no token " +
+      "and stay — they are the supported way to end a session whose token the " +
+      "caller cannot obtain.",
+  },
+];
+
+/** The paths alone, in the shape Better Auth's `disabledPaths` option takes. */
+export const SUPPRESSED_AUTH_PATH_LIST: readonly string[] = SUPPRESSED_AUTH_PATHS.map(
+  (entry) => entry.path,
+);

package/src/config/types.ts

@@ -501,7 +501,6 @@ export interface AuthSessionLike {
   };
   session: {
     activeOrganizationId?: string | null;
-    activeOrganizationRole?: string | null;
     /** When the session was minted — the moment the human last authenticated. */
     createdAt?: Date | string | null;
   };

package/src/index.ts

@@ -43,6 +43,8 @@ export { OrganizationService } from "./modules/organization/service.js";
 export { createScopedDb } from "./kernel/database/scoped-db.js";
 export type { ScopedOrganizationId } from "./kernel/database/scoped-db.js";
 export { IDENTITY_FREE_ROUTES, isIdentityFreeRoute } from "./auth/identity-free-routes.js";
+export { SUPPRESSED_AUTH_PATHS, SUPPRESSED_AUTH_PATH_LIST } from "./auth/suppressed-auth-paths.js";
+export type { SuppressedAuthPath } from "./auth/suppressed-auth-paths.js";
 export type { IdentityFreeRoute } from "./auth/identity-free-routes.js";
 export {
   AUTHENTICATION_REQUIRED_MESSAGE,