@porulle/core 0.44.0 → 0.46.0

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@porulle/core",
-  "version": "0.44.0",
+  "version": "0.46.0",
   "license": "MIT",
   "type": "module",
   "exports": {

package/src/auth/setup.ts

@@ -141,6 +141,10 @@ export function createAuth(
 
   try {
     const auth = betterAuth({
+      // Upstream options core does not own, FIRST so every core-owned key below
+      // wins. `AuthConfig["extend"]` Omits the keys core builds, so a consumer
+      // cannot reach one from here — it is a compile error, not a silent drop.
+      ...(config.auth?.extend ?? {}),
       ...(config.auth?.baseURL ? { baseURL: config.auth.baseURL } : {}),
       // Endpoints whose only currency is a raw session bearer token. Read in
       // the router's own onRequest, before rate limiting and before any plugin
@@ -158,6 +162,33 @@ export function createAuth(
       emailAndPassword: {
         enabled: true,
         requireEmailVerification: config.auth?.requireEmailVerification ?? true,
+        // Forwarded from `config.auth.password`. Every one of these was dropped
+        // on the floor until 2026-09-20: Better Auth honours them, core never
+        // passed them, so setting them in a consumer config did nothing.
+        // `revokeSessionsOnPasswordReset` defaults to TRUE here, against Better
+        // Auth's own `false`. A password reset is the canonical "I think I am
+        // compromised" action, and leaving the attacker's session live through
+        // it is the wrong default for a commerce platform. Opt out explicitly.
+        revokeSessionsOnPasswordReset:
+          config.auth?.password?.revokeSessionsOnPasswordReset ?? true,
+        ...(config.auth?.password?.minLength !== undefined
+          ? { minPasswordLength: config.auth.password.minLength }
+          : {}),
+        ...(config.auth?.password?.maxLength !== undefined
+          ? { maxPasswordLength: config.auth.password.maxLength }
+          : {}),
+        ...(config.auth?.password?.disableSignUp !== undefined
+          ? { disableSignUp: config.auth.password.disableSignUp }
+          : {}),
+        ...(config.auth?.password?.autoSignIn !== undefined
+          ? { autoSignIn: config.auth.password.autoSignIn }
+          : {}),
+        ...(config.auth?.password?.resetTokenExpiresIn !== undefined
+          ? { resetPasswordTokenExpiresIn: config.auth.password.resetTokenExpiresIn }
+          : {}),
+        ...(config.auth?.password?.onPasswordReset !== undefined
+          ? { onPasswordReset: config.auth.password.onPasswordReset }
+          : {}),
         sendResetPassword: async ({ user, url }: AuthEmailPayload) => {
           if (!config.email) return;
           await config.email.send({

package/src/config/types.ts

@@ -1,3 +1,4 @@
+import type { betterAuth } from "better-auth";
 import type { Hono, MiddlewareHandler } from "hono";
 import type { Actor } from "../auth/types.js";
 import type { BeforeHook, AfterHook } from "../kernel/hooks/types.js";
@@ -14,6 +15,9 @@ import type {
   TaskDefinition,
 } from "../kernel/jobs/types.js";
 
+/** Better Auth's own options type, read off the function so no named export is required. */
+type BetterAuthOptions = Parameters<typeof betterAuth>[0];
+
 export interface RoleDefinition {
   permissions: string[];
 }
@@ -259,6 +263,63 @@ export interface AuthConfig {
    * a trusted actor for integration tests. Default false.
    */
   allowTestActor?: boolean;
+  /**
+   * Password policy and reset behaviour, forwarded into Better Auth's
+   * `emailAndPassword` block.
+   *
+   * These are surfaced deliberately rather than left to `extend`, because core
+   * OWNS `emailAndPassword` (it injects `sendResetPassword` and
+   * `sendVerificationEmail` from `config.email`), so a consumer cannot supply
+   * that block wholesale without losing the transactional email wiring.
+   *
+   * Every field here is one Better Auth honours and core previously dropped on
+   * the floor: setting them in a consumer config typechecked and did nothing.
+   */
+  password?: {
+    /** Minimum password length. Better Auth's own default is 8. */
+    minLength?: number;
+    /** Maximum password length. Better Auth's own default is 128. */
+    maxLength?: number;
+    /** Block new email+password registrations. */
+    disableSignUp?: boolean;
+    /** Sign the user in immediately after sign-up. */
+    autoSignIn?: boolean;
+    /**
+     * End every other session when a password is reset. Better Auth defaults
+     * this to FALSE, which leaves an attacker's session live through the one
+     * action a compromised user takes to evict them. Set it to true unless you
+     * have a specific reason not to.
+     */
+    revokeSessionsOnPasswordReset?: boolean;
+    /** Seconds a reset token stays valid. Better Auth's own default is 3600. */
+    resetTokenExpiresIn?: number;
+    /** Audit hook fired after a password is successfully changed. */
+    onPasswordReset?: (
+      data: { user: { id: string; email: string; name: string } },
+      request?: Request,
+    ) => Promise<void>;
+  };
+  /**
+   * Upstream Better Auth options core does not own, passed straight through.
+   *
+   * This is the escape hatch that stops the next upstream option from being
+   * silently dropped. The keys core builds itself are `Omit`ted, so setting one
+   * here is a COMPILE ERROR naming the key rather than a value that is accepted
+   * and ignored — the failure mode this option exists to remove.
+   *
+   * Spread FIRST in `createAuth`, so a core-owned key can never be clobbered.
+   */
+  extend?: Omit<
+    BetterAuthOptions,
+    | "database"
+    | "trustedOrigins"
+    | "emailAndPassword"
+    | "socialProviders"
+    | "session"
+    | "advanced"
+    | "user"
+    | "plugins"
+  >;
 }
 
 export interface CartConfig {

package/src/modules/catalog/entity-service.ts

@@ -538,6 +538,37 @@ export class EntityService {
     return Ok(undefined);
   }
 
+  /**
+   * Fire `catalog.afterUpdate` for an entity whose RELATED rows changed while the entity row did
+   * not. Same before/after pair as `setAttributes` above, for the same reason: every consumer of
+   * this hook keys on the entity, not on the row that actually moved.
+   *
+   * It exists because `CatalogService.reviewCustomField` wrote an approved custom field straight
+   * through the repository and ran no hooks at all. `create`, `update` and `setAttributes` each
+   * resolve and run their after-hooks; that one method did not, so approving a proposal notified
+   * nothing. Anything downstream that keeps a derived copy of an entity's custom fields — a search
+   * projection, a feed, a cache — had no way to learn that a value a person had just approved was
+   * now the live one, and went on serving the old one until something else happened to touch the
+   * entity.
+   *
+   * Callers pass the paths they changed so a handler can narrow. A missing entity is not an error:
+   * the caller has already established it, and racing a delete is not this method's problem.
+   */
+  async notifyEntityUpdated(
+    entityId: string,
+    changedFieldPaths: readonly string[],
+    actor: Actor | null,
+    ctx?: CatalogWriteContext,
+  ): Promise<void> {
+    const txCtx = isWriteContextTransactional(ctx) ? ctx : undefined;
+    const entity = await this.repo.findEntityById(entityId, txCtx);
+    if (!entity) return;
+    const afterHooks = this.deps.hooks.resolve("catalog.afterUpdate") as CatalogUpdateAfterHook[];
+    const context = catalogHookContext(this.deps, actor, ctx, "update");
+    context.context.changedFieldPaths = [...changedFieldPaths];
+    await runAfterHooks(afterHooks, entity, entity, "update", context, (hook) => this.deps.hooks.runsInTransaction(hook));
+  }
+
   async getAttributes(entityId: string, locale: string, actor: Actor | null, ctx?: TxContext): Promise<Result<SellableAttribute>> {
     try {
       assertPermission(actor, "catalog:read");

package/src/modules/catalog/service.ts

@@ -1050,6 +1050,13 @@ export class CatalogServiceImpl implements CatalogService {
         await this.repository.rejectOtherProposedCustomFields(entityId, fieldName, locale, updated.id, txCtx);
       }
       await this.captureRevision(entityId, reviewer, "update", txCtx);
+      // An approval REPLACES the live value: the approved row was deleted above and this proposal
+      // takes its place. That is an entity change to every consumer of `catalog.afterUpdate`, and
+      // until now it fired none, so an approved fact reached nothing downstream. A rejection is
+      // not: the live row is untouched and there is nothing for a consumer to re-read.
+      if (status === "approved") {
+        await this.entities.notifyEntityUpdated(entityId, [`customFields.${locale}.${fieldName}`], reviewer, txCtx);
+      }
       return Ok(updated);
     });
   }