@porulle/core 0.43.0 → 0.45.0

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@porulle/core",
-  "version": "0.43.0",
+  "version": "0.45.0",
   "license": "MIT",
   "type": "module",
   "exports": {

package/src/auth/actor.ts

@@ -37,11 +37,7 @@ export function getCustomerPermissions(config: CommerceConfig): string[] {
   return config.auth?.customerPermissions ?? [...DEFAULT_CUSTOMER_PERMISSIONS];
 }
 
-function resolvePermissions(
-  session: AuthSessionLike,
-  config: CommerceConfig,
-): string[] {
-  const role = session.session.activeOrganizationRole;
+function resolvePermissions(role: string | null | undefined, config: CommerceConfig): string[] {
   if (!role) return getCustomerPermissions(config);
   const roleConfig = config.auth?.roles?.[role];
   return roleConfig ? roleConfig.permissions : [];
@@ -124,7 +120,7 @@ export async function resolveActor(
   if (!session) return null;
 
   const defaultOrgId = config.auth?.defaultOrganizationId ?? DEFAULT_ORG_ID;
-  let role = session.session.activeOrganizationRole as string | undefined;
+  let role: string | undefined;
   let orgId = session.session.activeOrganizationId as string | null;
 
   if (!role) {
@@ -141,10 +137,6 @@ export async function resolveActor(
     }
   }
 
-  const enrichedSession = {
-    ...session,
-    session: { ...session.session, activeOrganizationRole: role ?? null },
-  };
   return {
     type: "user",
     userId: session.user.id,
@@ -153,7 +145,7 @@ export async function resolveActor(
     vendorId: session.user.vendorId ?? null,
     organizationId: orgId ?? defaultOrgId,
     role: role ?? "customer",
-    permissions: resolvePermissions(enrichedSession, config),
+    permissions: resolvePermissions(role, config),
     sessionCreatedAt: toIsoString(session.session.createdAt),
   } satisfies Actor;
 }

package/src/auth/setup.ts

@@ -7,6 +7,7 @@ import type { CommerceConfig } from "../config/types.js";
 import type { DatabaseAdapter } from "../kernel/database/adapter.js";
 import * as authSchema from "./auth-schema.js";
 import { AUTH_COOKIE_PREFIX } from "./actor.js";
+import { SUPPRESSED_AUTH_PATH_LIST } from "./suppressed-auth-paths.js";
 
 type BetterAuthDbProvider = "pg";
 
@@ -140,7 +141,16 @@ export function createAuth(
 
   try {
     const auth = betterAuth({
+      // Upstream options core does not own, FIRST so every core-owned key below
+      // wins. `AuthConfig["extend"]` Omits the keys core builds, so a consumer
+      // cannot reach one from here — it is a compile error, not a silent drop.
+      ...(config.auth?.extend ?? {}),
       ...(config.auth?.baseURL ? { baseURL: config.auth.baseURL } : {}),
+      // Endpoints whose only currency is a raw session bearer token. Read in
+      // the router's own onRequest, before rate limiting and before any plugin
+      // hook, so no mount point or config reaches them. See
+      // ./suppressed-auth-paths.ts for the per-path argument.
+      disabledPaths: [...SUPPRESSED_AUTH_PATH_LIST],
       database: drizzleAdapter(db.db as unknown as Record<string, unknown>, {
         provider: resolveAuthDbProvider(db.provider),
         schema: authSchema,
@@ -152,6 +162,33 @@ export function createAuth(
       emailAndPassword: {
         enabled: true,
         requireEmailVerification: config.auth?.requireEmailVerification ?? true,
+        // Forwarded from `config.auth.password`. Every one of these was dropped
+        // on the floor until 2026-09-20: Better Auth honours them, core never
+        // passed them, so setting them in a consumer config did nothing.
+        // `revokeSessionsOnPasswordReset` defaults to TRUE here, against Better
+        // Auth's own `false`. A password reset is the canonical "I think I am
+        // compromised" action, and leaving the attacker's session live through
+        // it is the wrong default for a commerce platform. Opt out explicitly.
+        revokeSessionsOnPasswordReset:
+          config.auth?.password?.revokeSessionsOnPasswordReset ?? true,
+        ...(config.auth?.password?.minLength !== undefined
+          ? { minPasswordLength: config.auth.password.minLength }
+          : {}),
+        ...(config.auth?.password?.maxLength !== undefined
+          ? { maxPasswordLength: config.auth.password.maxLength }
+          : {}),
+        ...(config.auth?.password?.disableSignUp !== undefined
+          ? { disableSignUp: config.auth.password.disableSignUp }
+          : {}),
+        ...(config.auth?.password?.autoSignIn !== undefined
+          ? { autoSignIn: config.auth.password.autoSignIn }
+          : {}),
+        ...(config.auth?.password?.resetTokenExpiresIn !== undefined
+          ? { resetPasswordTokenExpiresIn: config.auth.password.resetTokenExpiresIn }
+          : {}),
+        ...(config.auth?.password?.onPasswordReset !== undefined
+          ? { onPasswordReset: config.auth.password.onPasswordReset }
+          : {}),
         sendResetPassword: async ({ user, url }: AuthEmailPayload) => {
           if (!config.email) return;
           await config.email.send({

package/src/auth/suppressed-auth-paths.ts

@@ -0,0 +1,66 @@
+/**
+ * Better Auth endpoints this repository refuses to serve, because their only
+ * currency is a raw session bearer token.
+ *
+ * THE DEFAULT IS TO SERVE. A Better Auth endpoint absent from this list is
+ * mounted, because suppressing one is a removal from a published surface and
+ * the list is the place where that removal is argued rather than assumed.
+ *
+ * These are handed to Better Auth's own `disabledPaths` option rather than
+ * refused by a middleware in front of the handler. The difference is what a
+ * future mount can reach around. `runtime/server.ts` funnels `/api/auth/*` into
+ * `auth.handler`, and `disabledPaths` is read inside that handler's router, in
+ * `onRequest`, BEFORE rate limiting and before any plugin hook — so there is no
+ * ordering, no second mount point and no consumer configuration that reaches
+ * the endpoint without passing it. A Hono middleware would have to be
+ * remembered at every mount point instead, and this is an auth surface.
+ *
+ * MATCHING IS EXACT, on the path Better Auth normalizes a request to: the
+ * pathname with the auth base path stripped, so `/api/auth/list-sessions`
+ * arrives here as `/list-sessions`. A consumer cannot move that out from under
+ * the list without breaking every auth route at once — `runtime/server.ts`
+ * mounts the handler at a literal `/api/auth/*`, and Better Auth derives the
+ * router's base path from `auth.baseURL`, so a `baseURL` carrying some other
+ * path makes EVERY endpoint unreachable rather than just these. The failure is
+ * loud, which is the property that matters: a guard that silently stops
+ * covering its route is worse than no guard.
+ *
+ * Suppression is unconditional and not configurable. A config flag here would
+ * be a documented way to switch the leak back on, and there is no caller that
+ * wants one: nothing in this repository calls either path.
+ */
+export type SuppressedAuthPath = {
+  /** The path as Better Auth normalizes it — no `/api/auth` prefix. */
+  path: string;
+  justification: string;
+};
+
+export const SUPPRESSED_AUTH_PATHS: readonly SuppressedAuthPath[] = [
+  {
+    path: "/list-sessions",
+    justification:
+      "Returns every one of the caller's live sessions through parseSessionOutput, " +
+      "which filters by the session output schema — and `token` carries no " +
+      "`returned: false`, so each row arrives with its raw bearer token. One " +
+      "compromised session therefore yields durable capture of all of them, and " +
+      "the capture survives the victim revoking the session they know about. " +
+      "Its guard is freshSessionMiddleware, whose freshAge defaults to a day, so " +
+      "a session phished minutes ago is fresh enough to ask.",
+  },
+  {
+    path: "/revoke-session",
+    justification:
+      "Takes `{ token }` as its only handle, so it is the consumer of what " +
+      "/list-sessions leaks and has no legitimate caller once that path is gone: " +
+      "the only token a client can still hold is its own, which sign-out ends. " +
+      "Revoking by an opaque id belongs to the consumer route that owns the " +
+      "shaped list. /revoke-sessions and /revoke-other-sessions take no token " +
+      "and stay — they are the supported way to end a session whose token the " +
+      "caller cannot obtain.",
+  },
+];
+
+/** The paths alone, in the shape Better Auth's `disabledPaths` option takes. */
+export const SUPPRESSED_AUTH_PATH_LIST: readonly string[] = SUPPRESSED_AUTH_PATHS.map(
+  (entry) => entry.path,
+);

package/src/config/types.ts

@@ -1,3 +1,4 @@
+import type { betterAuth } from "better-auth";
 import type { Hono, MiddlewareHandler } from "hono";
 import type { Actor } from "../auth/types.js";
 import type { BeforeHook, AfterHook } from "../kernel/hooks/types.js";
@@ -14,6 +15,9 @@ import type {
   TaskDefinition,
 } from "../kernel/jobs/types.js";
 
+/** Better Auth's own options type, read off the function so no named export is required. */
+type BetterAuthOptions = Parameters<typeof betterAuth>[0];
+
 export interface RoleDefinition {
   permissions: string[];
 }
@@ -259,6 +263,63 @@ export interface AuthConfig {
    * a trusted actor for integration tests. Default false.
    */
   allowTestActor?: boolean;
+  /**
+   * Password policy and reset behaviour, forwarded into Better Auth's
+   * `emailAndPassword` block.
+   *
+   * These are surfaced deliberately rather than left to `extend`, because core
+   * OWNS `emailAndPassword` (it injects `sendResetPassword` and
+   * `sendVerificationEmail` from `config.email`), so a consumer cannot supply
+   * that block wholesale without losing the transactional email wiring.
+   *
+   * Every field here is one Better Auth honours and core previously dropped on
+   * the floor: setting them in a consumer config typechecked and did nothing.
+   */
+  password?: {
+    /** Minimum password length. Better Auth's own default is 8. */
+    minLength?: number;
+    /** Maximum password length. Better Auth's own default is 128. */
+    maxLength?: number;
+    /** Block new email+password registrations. */
+    disableSignUp?: boolean;
+    /** Sign the user in immediately after sign-up. */
+    autoSignIn?: boolean;
+    /**
+     * End every other session when a password is reset. Better Auth defaults
+     * this to FALSE, which leaves an attacker's session live through the one
+     * action a compromised user takes to evict them. Set it to true unless you
+     * have a specific reason not to.
+     */
+    revokeSessionsOnPasswordReset?: boolean;
+    /** Seconds a reset token stays valid. Better Auth's own default is 3600. */
+    resetTokenExpiresIn?: number;
+    /** Audit hook fired after a password is successfully changed. */
+    onPasswordReset?: (
+      data: { user: { id: string; email: string; name: string } },
+      request?: Request,
+    ) => Promise<void>;
+  };
+  /**
+   * Upstream Better Auth options core does not own, passed straight through.
+   *
+   * This is the escape hatch that stops the next upstream option from being
+   * silently dropped. The keys core builds itself are `Omit`ted, so setting one
+   * here is a COMPILE ERROR naming the key rather than a value that is accepted
+   * and ignored — the failure mode this option exists to remove.
+   *
+   * Spread FIRST in `createAuth`, so a core-owned key can never be clobbered.
+   */
+  extend?: Omit<
+    BetterAuthOptions,
+    | "database"
+    | "trustedOrigins"
+    | "emailAndPassword"
+    | "socialProviders"
+    | "session"
+    | "advanced"
+    | "user"
+    | "plugins"
+  >;
 }
 
 export interface CartConfig {
@@ -501,7 +562,6 @@ export interface AuthSessionLike {
   };
   session: {
     activeOrganizationId?: string | null;
-    activeOrganizationRole?: string | null;
     /** When the session was minted — the moment the human last authenticated. */
     createdAt?: Date | string | null;
   };

package/src/index.ts

@@ -43,6 +43,8 @@ export { OrganizationService } from "./modules/organization/service.js";
 export { createScopedDb } from "./kernel/database/scoped-db.js";
 export type { ScopedOrganizationId } from "./kernel/database/scoped-db.js";
 export { IDENTITY_FREE_ROUTES, isIdentityFreeRoute } from "./auth/identity-free-routes.js";
+export { SUPPRESSED_AUTH_PATHS, SUPPRESSED_AUTH_PATH_LIST } from "./auth/suppressed-auth-paths.js";
+export type { SuppressedAuthPath } from "./auth/suppressed-auth-paths.js";
 export type { IdentityFreeRoute } from "./auth/identity-free-routes.js";
 export {
   AUTHENTICATION_REQUIRED_MESSAGE,