@porulle/core 0.44.0 → 0.45.0

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@porulle/core",
-  "version": "0.44.0",
+  "version": "0.45.0",
   "license": "MIT",
   "type": "module",
   "exports": {

package/src/auth/setup.ts

@@ -141,6 +141,10 @@ export function createAuth(
 
   try {
     const auth = betterAuth({
+      // Upstream options core does not own, FIRST so every core-owned key below
+      // wins. `AuthConfig["extend"]` Omits the keys core builds, so a consumer
+      // cannot reach one from here — it is a compile error, not a silent drop.
+      ...(config.auth?.extend ?? {}),
       ...(config.auth?.baseURL ? { baseURL: config.auth.baseURL } : {}),
       // Endpoints whose only currency is a raw session bearer token. Read in
       // the router's own onRequest, before rate limiting and before any plugin
@@ -158,6 +162,33 @@ export function createAuth(
       emailAndPassword: {
         enabled: true,
         requireEmailVerification: config.auth?.requireEmailVerification ?? true,
+        // Forwarded from `config.auth.password`. Every one of these was dropped
+        // on the floor until 2026-09-20: Better Auth honours them, core never
+        // passed them, so setting them in a consumer config did nothing.
+        // `revokeSessionsOnPasswordReset` defaults to TRUE here, against Better
+        // Auth's own `false`. A password reset is the canonical "I think I am
+        // compromised" action, and leaving the attacker's session live through
+        // it is the wrong default for a commerce platform. Opt out explicitly.
+        revokeSessionsOnPasswordReset:
+          config.auth?.password?.revokeSessionsOnPasswordReset ?? true,
+        ...(config.auth?.password?.minLength !== undefined
+          ? { minPasswordLength: config.auth.password.minLength }
+          : {}),
+        ...(config.auth?.password?.maxLength !== undefined
+          ? { maxPasswordLength: config.auth.password.maxLength }
+          : {}),
+        ...(config.auth?.password?.disableSignUp !== undefined
+          ? { disableSignUp: config.auth.password.disableSignUp }
+          : {}),
+        ...(config.auth?.password?.autoSignIn !== undefined
+          ? { autoSignIn: config.auth.password.autoSignIn }
+          : {}),
+        ...(config.auth?.password?.resetTokenExpiresIn !== undefined
+          ? { resetPasswordTokenExpiresIn: config.auth.password.resetTokenExpiresIn }
+          : {}),
+        ...(config.auth?.password?.onPasswordReset !== undefined
+          ? { onPasswordReset: config.auth.password.onPasswordReset }
+          : {}),
         sendResetPassword: async ({ user, url }: AuthEmailPayload) => {
           if (!config.email) return;
           await config.email.send({

package/src/config/types.ts

@@ -1,3 +1,4 @@
+import type { betterAuth } from "better-auth";
 import type { Hono, MiddlewareHandler } from "hono";
 import type { Actor } from "../auth/types.js";
 import type { BeforeHook, AfterHook } from "../kernel/hooks/types.js";
@@ -14,6 +15,9 @@ import type {
   TaskDefinition,
 } from "../kernel/jobs/types.js";
 
+/** Better Auth's own options type, read off the function so no named export is required. */
+type BetterAuthOptions = Parameters<typeof betterAuth>[0];
+
 export interface RoleDefinition {
   permissions: string[];
 }
@@ -259,6 +263,63 @@ export interface AuthConfig {
    * a trusted actor for integration tests. Default false.
    */
   allowTestActor?: boolean;
+  /**
+   * Password policy and reset behaviour, forwarded into Better Auth's
+   * `emailAndPassword` block.
+   *
+   * These are surfaced deliberately rather than left to `extend`, because core
+   * OWNS `emailAndPassword` (it injects `sendResetPassword` and
+   * `sendVerificationEmail` from `config.email`), so a consumer cannot supply
+   * that block wholesale without losing the transactional email wiring.
+   *
+   * Every field here is one Better Auth honours and core previously dropped on
+   * the floor: setting them in a consumer config typechecked and did nothing.
+   */
+  password?: {
+    /** Minimum password length. Better Auth's own default is 8. */
+    minLength?: number;
+    /** Maximum password length. Better Auth's own default is 128. */
+    maxLength?: number;
+    /** Block new email+password registrations. */
+    disableSignUp?: boolean;
+    /** Sign the user in immediately after sign-up. */
+    autoSignIn?: boolean;
+    /**
+     * End every other session when a password is reset. Better Auth defaults
+     * this to FALSE, which leaves an attacker's session live through the one
+     * action a compromised user takes to evict them. Set it to true unless you
+     * have a specific reason not to.
+     */
+    revokeSessionsOnPasswordReset?: boolean;
+    /** Seconds a reset token stays valid. Better Auth's own default is 3600. */
+    resetTokenExpiresIn?: number;
+    /** Audit hook fired after a password is successfully changed. */
+    onPasswordReset?: (
+      data: { user: { id: string; email: string; name: string } },
+      request?: Request,
+    ) => Promise<void>;
+  };
+  /**
+   * Upstream Better Auth options core does not own, passed straight through.
+   *
+   * This is the escape hatch that stops the next upstream option from being
+   * silently dropped. The keys core builds itself are `Omit`ted, so setting one
+   * here is a COMPILE ERROR naming the key rather than a value that is accepted
+   * and ignored — the failure mode this option exists to remove.
+   *
+   * Spread FIRST in `createAuth`, so a core-owned key can never be clobbered.
+   */
+  extend?: Omit<
+    BetterAuthOptions,
+    | "database"
+    | "trustedOrigins"
+    | "emailAndPassword"
+    | "socialProviders"
+    | "session"
+    | "advanced"
+    | "user"
+    | "plugins"
+  >;
 }
 
 export interface CartConfig {