@protobase/server 0.3.4 → 0.4.1

package/dist/better-auth/create-auth.js

@@ -1,11 +1,18 @@
 import { readMailSettings } from "../mail/mail-settings.js";
 import { smtpMailer } from "../mail/smtp-mailer.js";
+import { readOperatorSettings, resolveOperator } from "./operator-provider.js";
 import { passwordResetOptions } from "./password-reset.js";
+import { signInPolicyPlugin } from "./policy-plugin.js";
+import { emailCodeOptions, twoFactorCodeOptions, unusedEmailCodePaths } from "./sign-in-mail.js";
+import { staffSignInPlugin } from "./staff-plugin.js";
+import { twoFactorAfterPasswordOrCode } from "./two-factor-challenge.js";
+import { passkey } from "@better-auth/passkey";
 import { APIError } from "better-auth/api";
 import { betterAuth } from "better-auth";
-import { admin, jwt } from "better-auth/plugins";
+import { admin, emailOTP, jwt } from "better-auth/plugins";
 import { adminAc, userAc } from "better-auth/plugins/admin/access";
 //#region src/better-auth/create-auth.ts
+const platformOperator = () => readOperatorSettings(globalThis.process?.env ?? {});
 const platformMailer = () => {
 	const settings = readMailSettings(globalThis.process?.env ?? {});
 	return settings && smtpMailer(settings);
@@ -13,8 +20,9 @@ const platformMailer = () => {
 const tokenLifetime = "15m";
 const authBasePath = "/api/auth";
 /**
-* Better Auth for a single-tenant admin: email and password sign-in, no public sign-up (every account is created on the
-* host with `createUser`, or by an admin through the admin plugin), roles from the admin plugin's `role` column, 15 minute JWTs
+* Better Auth for a single-tenant admin: sign-in with a password, an emailed code or a passkey, two-factor
+* authentication, and the sign-in policy admins set; no public sign-up (every account is created on the host with
+* `createUser`, or by an admin through the admin plugin), roles from the admin plugin's `role` column, 15 minute JWTs
 * at `/api/auth/token` with the keys at `/api/auth/jwks`.
 */
 const roleName = /^[a-z][a-z0-9_-]*$/;
@@ -24,10 +32,12 @@ const normalizeRoles = (roles = ["admin", "user"]) => {
 	if (bad !== void 0) throw new Error(`Invalid role "${bad}": use lowercase letters, digits, "_" or "-"`);
 	return ["admin", ...new Set(roles.filter((role) => role !== "admin"))];
 };
-/** The options `createAuth` gives Better Auth, with the roles, default role and mailer already resolved. */
-const betterAuthOptions = (options, { roles, defaultRole, mailer }) => {
+const adminImpersonationPaths = ["/admin/impersonate-user", "/admin/stop-impersonating"];
+/** The options `createAuth` gives Better Auth, with the roles, default role, mailer and operator provider already resolved. */
+const betterAuthOptions = (options, { roles, defaultRole, mailer, operator }) => {
 	const secure = options.baseURL.startsWith("https://");
 	return {
+		appName: options.appName ?? "Protobase",
 		database: options.database,
 		baseURL: options.baseURL,
 		basePath: authBasePath,
@@ -45,24 +55,49 @@ const betterAuthOptions = (options, { roles, defaultRole, mailer }) => {
 		},
 		...options.socialProviders && { socialProviders: options.socialProviders },
 		...options.encryptOAuthTokens && { account: { encryptOAuthTokens: true } },
-		plugins: [admin({
-			defaultRole: defaultRole ?? "unassigned",
-			roles: Object.fromEntries(roles.map((role) => [role, role === "admin" ? adminAc : userAc]))
-		}), jwt({ jwt: {
-			expirationTime: tokenLifetime,
-			issuer: options.baseURL,
-			audience: options.baseURL,
-			definePayload: ({ user }) => ({
-				email: user.email,
-				role: user.role
+		plugins: [
+			admin({
+				defaultRole: defaultRole ?? "unassigned",
+				roles: Object.fromEntries(roles.map((role) => [role, role === "admin" ? adminAc : userAc]))
+			}),
+			jwt({
+				jwt: {
+					expirationTime: tokenLifetime,
+					issuer: options.baseURL,
+					audience: options.baseURL,
+					definePayload: ({ user }) => ({
+						email: user.email,
+						role: user.role
+					})
+				},
+				disableSettingJwtHeader: true
+			}),
+			twoFactorAfterPasswordOrCode({
+				allowPasswordless: true,
+				...mailer && { otpOptions: twoFactorCodeOptions(mailer) }
+			}),
+			passkey(),
+			...mailer ? [emailOTP(emailCodeOptions(mailer))] : [],
+			signInPolicyPlugin({
+				mail: Boolean(mailer),
+				socialProviders: Object.keys(options.socialProviders ?? {}),
+				...operator && { operator: operator.name }
+			}),
+			staffSignInPlugin({
+				...operator && { operator },
+				...mailer && { mailer }
 			})
-		} })],
+		],
+		disabledPaths: [...unusedEmailCodePaths, ...adminImpersonationPaths],
 		databaseHooks: { user: { create: {
-			before: async (user) => {
+			before: async (user, context) => {
 				const given = String(user.role ?? "").split(",").map((name) => name.trim()).filter(Boolean);
 				const unknown = given.find((name) => !roles.includes(name));
 				if (given.length === 0 || unknown !== void 0) throw new APIError("BAD_REQUEST", { message: `Choose a role for the new user: ${roles.join(", ")}` });
-				return { data: user };
+				return { data: context?.path === "/admin/create-user" ? {
+					...user,
+					emailVerified: true
+				} : user };
 			},
 			...options.onUserCreated && { after: options.onUserCreated }
 		} } },
@@ -70,10 +105,16 @@ const betterAuthOptions = (options, { roles, defaultRole, mailer }) => {
 			enabled: true,
 			window: 60,
 			max: 100,
-			customRules: { "/sign-in/email": {
-				window: 60,
-				max: options.signInPerMinute ?? 5
-			} }
+			customRules: {
+				"/sign-in/email": {
+					window: 60,
+					max: options.signInPerMinute ?? 5
+				},
+				"/staff/sign-in": {
+					window: 60,
+					max: 5
+				}
+			}
 		},
 		advanced: {
 			useSecureCookies: secure,
@@ -91,17 +132,22 @@ const createAuth = (options) => {
 	const others = roles.filter((role) => role !== "admin");
 	const defaultRole = options.defaultRole ?? (others.length === 1 ? others[0] : void 0);
 	const mailer = options.mailer === void 0 ? platformMailer() : options.mailer || void 0;
+	const provider = options.operator === void 0 ? platformOperator() : options.operator || void 0;
+	const operator = provider && resolveOperator(provider);
 	const auth = betterAuth(betterAuthOptions(options, {
 		roles,
 		defaultRole,
-		mailer
+		mailer,
+		operator
 	}));
 	const socialProviders = Object.keys(options.socialProviders ?? {});
 	return Object.assign(auth, {
 		roles,
 		defaultRole,
+		mail: Boolean(mailer),
 		passwordReset: Boolean(mailer),
-		socialProviders
+		socialProviders,
+		operator: operator?.name
 	});
 };
 //#endregion

package/dist/better-auth/operator-provider.d.ts

@@ -0,0 +1,29 @@
+//#region src/better-auth/operator-provider.d.ts
+/**
+ * The identity provider the operator's staff sign in with to sign in as people of this app: any OpenID Connect
+ * provider, with this app registered as a confidential client whose redirect URI is `{baseURL}/api/auth/staff/callback`.
+ */
+export type OperatorProvider = {
+  /** The provider's issuer URL; its settings are read from `{issuer}/.well-known/openid-configuration`. */
+  issuer: string;
+  clientId: string;
+  clientSecret: string;
+  /** Shown on the staff sign-in page as "Continue with {name}". Default `the operator`. */
+  name?: string;
+  /** The group in the ID token's `groups` claim that lets staff sign in as people. Default `protobase-staff-access`. */
+  group?: string;
+  /** Scopes asked for besides `openid email profile`, for a provider that puts `groups` in the ID token only for one of its own. */
+  scopes?: string[];
+  /** `acr` values that count as a strong sign-in, asked for as `acr_values`, for a provider that reports levels instead of `amr`. */
+  acrValues?: string[];
+  /** How long a staff session lasts, in minutes: default 30, at most 240. It is not extended while in use. */
+  sessionMinutes?: number;
+};
+/**
+ * The operator provider the platform passes in `PROTOBASE_OPERATOR_ISSUER`, `PROTOBASE_OPERATOR_CLIENT_ID` and
+ * `PROTOBASE_OPERATOR_CLIENT_SECRET` (with `PROTOBASE_OPERATOR_NAME` and `PROTOBASE_OPERATOR_GROUP` optional);
+ * `undefined` when none of the three is set. Some but not all of them, or an issuer that is not a URL, stops the
+ * server at startup.
+ */
+export declare const readOperatorSettings: (env: Record<string, string | undefined>) => OperatorProvider | undefined;
+//#endregion

package/dist/better-auth/operator-provider.js

@@ -0,0 +1,130 @@
+import { createRemoteJWKSet, jwtVerify } from "jose";
+//#region src/better-auth/operator-provider.ts
+const operatorIssuerVariable = "PROTOBASE_OPERATOR_ISSUER";
+const operatorClientIdVariable = "PROTOBASE_OPERATOR_CLIENT_ID";
+const operatorClientSecretVariable = "PROTOBASE_OPERATOR_CLIENT_SECRET";
+const operatorNameVariable = "PROTOBASE_OPERATOR_NAME";
+const operatorGroupVariable = "PROTOBASE_OPERATOR_GROUP";
+/**
+* The operator provider the platform passes in `PROTOBASE_OPERATOR_ISSUER`, `PROTOBASE_OPERATOR_CLIENT_ID` and
+* `PROTOBASE_OPERATOR_CLIENT_SECRET` (with `PROTOBASE_OPERATOR_NAME` and `PROTOBASE_OPERATOR_GROUP` optional);
+* `undefined` when none of the three is set. Some but not all of them, or an issuer that is not a URL, stops the
+* server at startup.
+*/
+const readOperatorSettings = (env) => {
+	const required = [
+		operatorIssuerVariable,
+		operatorClientIdVariable,
+		operatorClientSecretVariable
+	];
+	const [issuer, clientId, clientSecret] = required.map((name) => env[name]?.trim() || void 0);
+	if (!issuer && !clientId && !clientSecret) return void 0;
+	if (!issuer || !clientId || !clientSecret) throw new Error(`${required.join(", ")} go together: set all three for staff sign-in, or none`);
+	const name = env[operatorNameVariable]?.trim();
+	const group = env[operatorGroupVariable]?.trim();
+	return {
+		issuer,
+		clientId,
+		clientSecret,
+		...name && { name },
+		...group && { group }
+	};
+};
+const defaultStaffGroup = "protobase-staff-access";
+const defaultSessionMinutes = 30;
+const maxSessionMinutes = 240;
+/** The provider with its defaults filled in; a session length out of range or an issuer that is not a URL is an error. */
+const resolveOperator = (provider) => {
+	if (!URL.canParse(provider.issuer)) throw new Error(`The operator provider's issuer must be a URL, not "${provider.issuer}"`);
+	const sessionMinutes = provider.sessionMinutes ?? defaultSessionMinutes;
+	if (!Number.isInteger(sessionMinutes) || sessionMinutes < 1 || sessionMinutes > maxSessionMinutes) throw new Error(`The operator provider's sessionMinutes must be a whole number from 1 to ${maxSessionMinutes}`);
+	return {
+		...provider,
+		name: provider.name ?? "the operator",
+		group: provider.group ?? "protobase-staff-access",
+		scopes: provider.scopes ?? [],
+		acrValues: provider.acrValues ?? [],
+		sessionMinutes
+	};
+};
+const base64url = (bytes) => btoa(String.fromCharCode(...bytes)).replace(/\+/g, "-").replace(/\//g, "_").replace(/=+$/, "");
+/** A random value for `state`, `nonce` and the PKCE verifier. */
+const randomValue = () => base64url(crypto.getRandomValues(/* @__PURE__ */ new Uint8Array(32)));
+const challengeOf = async (verifier) => base64url(new Uint8Array(await crypto.subtle.digest("SHA-256", new TextEncoder().encode(verifier))));
+/**
+* An OpenID Connect client of the operator provider: the authorization code flow with PKCE, a client secret, and an
+* ID token verified against the provider's keys, issuer, this client and the nonce. The provider's settings and keys
+* are read on first use and kept; settings that fail to load are read again next time.
+*/
+const operatorClient = (operator, redirectURI) => {
+	let discovery;
+	let keys;
+	const settings = () => {
+		discovery ??= (async () => {
+			const response = await fetch(`${operator.issuer.replace(/\/$/, "")}/.well-known/openid-configuration`);
+			if (!response.ok) throw new Error(`The operator provider's settings answered ${response.status}`);
+			const found = await response.json();
+			if (found.issuer !== operator.issuer) throw new Error(`The operator provider names its issuer "${found.issuer}", not "${operator.issuer}"`);
+			return found;
+		})().catch((error) => {
+			discovery = void 0;
+			throw error;
+		});
+		return discovery;
+	};
+	return {
+		/** Where to send the staff member's browser; their sign-in there must be at most 15 minutes old. */
+		authorizationURL: async ({ state, nonce, verifier }) => {
+			const url = new URL((await settings()).authorization_endpoint);
+			url.search = new URLSearchParams({
+				response_type: "code",
+				client_id: operator.clientId,
+				redirect_uri: redirectURI,
+				scope: [
+					"openid",
+					"email",
+					"profile",
+					...operator.scopes
+				].join(" "),
+				state,
+				nonce,
+				code_challenge: await challengeOf(verifier),
+				code_challenge_method: "S256",
+				max_age: String(900),
+				...operator.acrValues.length > 0 && { acr_values: operator.acrValues.join(" ") }
+			}).toString();
+			return url.toString();
+		},
+		/** Trades the code for an ID token and returns its verified claims; rejects when anything does not match. */
+		signedInStaff: async ({ code, nonce, verifier }) => {
+			const found = await settings();
+			const response = await fetch(found.token_endpoint, {
+				method: "POST",
+				headers: {
+					"content-type": "application/x-www-form-urlencoded",
+					accept: "application/json",
+					authorization: `Basic ${btoa(`${encodeURIComponent(operator.clientId)}:${encodeURIComponent(operator.clientSecret)}`)}`
+				},
+				body: new URLSearchParams({
+					grant_type: "authorization_code",
+					code,
+					redirect_uri: redirectURI,
+					code_verifier: verifier
+				})
+			});
+			if (!response.ok) throw new Error(`The operator provider refused the code: ${response.status}`);
+			const { id_token: idToken } = await response.json();
+			if (typeof idToken !== "string") throw new Error("The operator provider sent no ID token");
+			keys ??= createRemoteJWKSet(new URL(found.jwks_uri));
+			const { payload } = await jwtVerify(idToken, keys, {
+				issuer: operator.issuer,
+				audience: operator.clientId
+			});
+			if (payload.nonce !== nonce) throw new Error("The ID token is for another sign-in");
+			if (typeof payload.sub !== "string") throw new Error("The ID token has no subject");
+			return payload;
+		}
+	};
+};
+//#endregion
+export { defaultStaffGroup, operatorClient, operatorClientIdVariable, operatorClientSecretVariable, operatorGroupVariable, operatorIssuerVariable, operatorNameVariable, randomValue, readOperatorSettings, resolveOperator };

package/dist/better-auth/parse-roles.d.ts

@@ -0,0 +1,7 @@
+//#region src/better-auth/parse-roles.d.ts
+/**
+ * The admin plugin stores roles as a comma separated string. A value written as a JS array through a Postgres driver
+ * comes back as an array literal (`{admin,sales}`); that is read too, and rewritten as a plain string on the next change.
+ */
+export declare const parseRoles: (role: string | string[] | null | undefined) => string[];
+//#endregion

package/dist/better-auth/parse-roles.js

@@ -0,0 +1,12 @@
+//#region src/better-auth/parse-roles.ts
+/**
+* The admin plugin stores roles as a comma separated string. A value written as a JS array through a Postgres driver
+* comes back as an array literal (`{admin,sales}`); that is read too, and rewritten as a plain string on the next change.
+*/
+const parseRoles = (role) => {
+	if (Array.isArray(role)) return role;
+	const text = (role ?? "user").trim();
+	return (text.startsWith("{") && text.endsWith("}") ? text.slice(1, -1) : text).split(",").map((name) => name.trim().replace(/^"|"$/g, "")).filter(Boolean);
+};
+//#endregion
+export { parseRoles };

package/dist/better-auth/policy-plugin.js

@@ -0,0 +1,142 @@
+import { isStaffSession } from "./staff-checks.js";
+import { effectiveSignInPolicy, missingRequiredMethods, parseSignInPolicy, signInPolicyProblem } from "./sign-in-policy.js";
+import { readSignInPolicy, saveSignInPolicy, signInPolicySchema } from "./policy-store.js";
+import { isPoliced, lastPasskeyRequired, policyRefusal, setupRequired } from "./sign-in-enforcement.js";
+import { adminOnly } from "./admin-only.js";
+import { APIError, createAuthEndpoint, createAuthMiddleware, getSessionFromCtx, sessionMiddleware } from "better-auth/api";
+import * as z$1 from "zod";
+//#region src/better-auth/policy-plugin.ts
+const accountMethods = async (context, user, socialProviders) => {
+	const accounts = await context.internalAdapter.findAccounts(user.id);
+	const passkeys = await context.adapter.count({
+		model: "passkey",
+		where: [{
+			field: "userId",
+			value: user.id
+		}]
+	});
+	const app = await context.adapter.findOne({
+		model: "twoFactor",
+		where: [{
+			field: "userId",
+			value: user.id
+		}]
+	});
+	return {
+		password: accounts.some((account) => account.providerId === "credential"),
+		passkeys,
+		twoFactor: Boolean(user.twoFactorEnabled),
+		authenticatorApp: Boolean(user.twoFactorEnabled) && app !== null && app.verified !== false,
+		socialSignIn: accounts.some((account) => socialProviders.includes(account.providerId))
+	};
+};
+const refuse = (status, refusal) => new APIError(status, refusal);
+/**
+* Protobase's sign-in policy as a Better Auth plugin: its table, the endpoints that read and change it, and a hook that
+* applies it to Better Auth's own endpoints. A method the policy turns off answers `403 SIGN_IN_METHOD_FORBIDDEN`;
+* someone without what it requires gets a session, so they can set it up, but no API token (`403 SIGN_IN_SETUP_REQUIRED`).
+*/
+const signInPolicyPlugin = ({ mail, socialProviders, operator }) => {
+	const currentPolicy = async (context) => effectiveSignInPolicy((await readSignInPolicy(context.adapter)).policy, { mail });
+	const policyAdmin = adminOnly("Only an admin can change how people sign in.");
+	const policyAnswer = async (context) => {
+		const stored = await readSignInPolicy(context.adapter);
+		const savedBy = stored.savedBy && (await context.internalAdapter.findUserById(stored.savedBy))?.email;
+		return {
+			policy: stored.policy,
+			effective: effectiveSignInPolicy(stored.policy, { mail }),
+			mail,
+			...operator && { operator },
+			...stored.savedAt && { savedAt: stored.savedAt },
+			...savedBy && { savedBy }
+		};
+	};
+	return {
+		id: "protobase-sign-in-policy",
+		schema: signInPolicySchema,
+		endpoints: {
+			/** `GET /policy/sign-in`, for admins: the saved policy, how it applies (`effective`), and whether mail is on. */
+			getSignInPolicy: createAuthEndpoint("/policy/sign-in", {
+				method: "GET",
+				use: [policyAdmin]
+			}, async (ctx) => ctx.json(await policyAnswer(ctx.context))),
+			/** `POST /policy/sign-in`, for admins: saves a policy, or answers 400 with why it cannot be saved. */
+			setSignInPolicy: createAuthEndpoint("/policy/sign-in", {
+				method: "POST",
+				use: [policyAdmin],
+				body: z$1.record(z$1.string(), z$1.unknown())
+			}, async (ctx) => {
+				const policy = parseSignInPolicy(ctx.body);
+				if (!policy) throw refuse("BAD_REQUEST", {
+					code: "INVALID_SIGN_IN_POLICY",
+					message: "Choose one of the offered rules for every sign-in method."
+				});
+				const user = ctx.context.session.user;
+				const problem = signInPolicyProblem(policy, {
+					mail,
+					admin: await accountMethods(ctx.context, user, socialProviders)
+				});
+				if (problem) throw refuse("BAD_REQUEST", {
+					code: "SIGN_IN_POLICY_REFUSED",
+					message: problem
+				});
+				await saveSignInPolicy(ctx.context.adapter, policy, user.id);
+				return ctx.json(await policyAnswer(ctx.context));
+			}),
+			/**
+			* `GET /account/sign-in-methods`, for the signed-in user: the policy as it applies, what the account has, and what
+			* it still has to set up; nothing for a staff session, which cannot set anything up for the person.
+			*/
+			getSignInMethods: createAuthEndpoint("/account/sign-in-methods", {
+				method: "GET",
+				use: [sessionMiddleware]
+			}, async (ctx) => {
+				const policy = await currentPolicy(ctx.context);
+				const { socialSignIn: _, ...account } = await accountMethods(ctx.context, ctx.context.session.user, socialProviders);
+				return ctx.json({
+					policy,
+					mail,
+					account,
+					missing: isStaffSession(ctx.context.session.session) ? [] : missingRequiredMethods(policy, account)
+				});
+			})
+		},
+		hooks: { before: [{
+			matcher: (context) => isPoliced(context.path),
+			handler: createAuthMiddleware(async (ctx) => {
+				const path = ctx.path;
+				if (path === "/email-otp/send-verification-otp" && ctx.body?.type !== "sign-in") throw refuse("BAD_REQUEST", {
+					code: "SIGN_IN_CODES_ONLY",
+					message: "Only sign-in codes can be emailed."
+				});
+				const policy = await currentPolicy(ctx.context);
+				const refusal = policyRefusal(policy, {
+					path,
+					body: ctx.body
+				});
+				if (refusal) throw refuse("FORBIDDEN", refusal);
+				if (path === "/sign-in/email-otp") return vouchForCreatedAccount(ctx.context, ctx.body.email);
+				if (!(path === "/token" && (policy.twoFactor === "required" || policy.passkey === "required") || path === "/passkey/delete-passkey" && policy.passkey === "required")) return;
+				const session = await getSessionFromCtx(ctx);
+				if (!session || isStaffSession(session.session)) return;
+				const account = await accountMethods(ctx.context, session.user, socialProviders);
+				if (path === "/token" && missingRequiredMethods(policy, account).length > 0) throw refuse("FORBIDDEN", setupRequired);
+				if (path === "/passkey/delete-passkey" && account.passkeys <= 1) throw refuse("FORBIDDEN", lastPasskeyRequired);
+			})
+		}] }
+	};
+};
+/**
+* Accounts are created by an admin or on the host, who vouch for the address, so they count as verified. Better Auth
+* would otherwise treat a first emailed-code sign-in to an unverified account as taking it over, and delete its
+* password. New accounts are created verified (see `createAuth`); this marks one created before that, which has a
+* password, when an emailed code is used for it. A sign-up through a provider has no password and is left alone.
+*/
+const vouchForCreatedAccount = async (context, email) => {
+	if (typeof email !== "string") return;
+	const found = await context.internalAdapter.findUserByEmail(email.toLowerCase(), { includeAccounts: true });
+	if (!found || found.user.emailVerified || !found.accounts.some((account) => account.providerId === "credential")) return;
+	await context.internalAdapter.updateUser(found.user.id, { emailVerified: true });
+};
+//#endregion
+export { signInPolicyPlugin };

package/dist/better-auth/policy-store.js

@@ -0,0 +1,65 @@
+import { defaultSignInPolicy, parseSignInPolicy } from "./sign-in-policy.js";
+//#region src/better-auth/policy-store.ts
+/** Better Auth's model for the sign-in policy: one row per save, the newest applies, the older ones are its history. */
+const signInPolicyModel = "signInPolicy";
+const signInPolicySchema = { [signInPolicyModel]: { fields: {
+	password: {
+		type: "string",
+		required: true
+	},
+	emailCode: {
+		type: "string",
+		required: true
+	},
+	passkey: {
+		type: "string",
+		required: true
+	},
+	twoFactor: {
+		type: "string",
+		required: true
+	},
+	staffAccess: {
+		type: "string",
+		required: true,
+		defaultValue: "allowed"
+	},
+	createdAt: {
+		type: "date",
+		required: true
+	},
+	createdBy: {
+		type: "string",
+		required: false
+	}
+} } };
+/** The newest saved policy, or the default when none was saved. A row that no longer parses counts as none. */
+const readSignInPolicy = async (adapter) => {
+	const [row] = await adapter.findMany({
+		model: signInPolicyModel,
+		sortBy: {
+			field: "createdAt",
+			direction: "desc"
+		},
+		limit: 1
+	});
+	const policy = row && parseSignInPolicy(row);
+	if (!policy) return { policy: defaultSignInPolicy };
+	return {
+		policy,
+		savedAt: new Date(row.createdAt).toISOString(),
+		...row.createdBy && { savedBy: row.createdBy }
+	};
+};
+const saveSignInPolicy = async (adapter, policy, savedBy) => {
+	await adapter.create({
+		model: signInPolicyModel,
+		data: {
+			...policy,
+			createdAt: /* @__PURE__ */ new Date(),
+			createdBy: savedBy
+		}
+	});
+};
+//#endregion
+export { readSignInPolicy, saveSignInPolicy, signInPolicyModel, signInPolicySchema };

package/dist/better-auth/sign-in-enforcement.js

@@ -0,0 +1,65 @@
+import { signInPolicyMethods } from "./sign-in-policy.js";
+//#region src/better-auth/sign-in-enforcement.ts
+const passwordPaths = [
+	"/sign-in/email",
+	"/request-password-reset",
+	"/reset-password"
+];
+const emailCodePaths = ["/sign-in/email-otp"];
+const passkeyPaths = [
+	"/passkey/generate-authenticate-options",
+	"/passkey/verify-authentication",
+	"/passkey/generate-register-options",
+	"/passkey/verify-registration"
+];
+const staffSignInPath = "/staff/sign-in";
+const accountPaths = [
+	"/email-otp/send-verification-otp",
+	"/passkey/delete-passkey",
+	"/two-factor/enable",
+	"/two-factor/disable",
+	"/token"
+];
+/** Whether the policy can refuse a request to `path`; every other request goes through without reading the policy. */
+const isPoliced = (path) => path !== void 0 && ([
+	...passwordPaths,
+	...emailCodePaths,
+	...passkeyPaths,
+	...accountPaths,
+	"/staff/sign-in"
+].includes(path) || path.startsWith("/reset-password/"));
+const methodOf = (path, body) => {
+	if (passwordPaths.includes(path) || path.startsWith("/reset-password/")) return "password";
+	if (emailCodePaths.includes(path)) return "emailCode";
+	if (path === "/email-otp/send-verification-otp" && body?.type === "sign-in") return "emailCode";
+	if (passkeyPaths.includes(path)) return "passkey";
+	if (path === "/two-factor/enable") return "twoFactor";
+	if (path === "/staff/sign-in") return "staffAccess";
+};
+/**
+* Why the policy refuses a request to Better Auth at `path`, or `undefined` when it lets it through: a method the
+* policy turns off, or turning off two-factor authentication while the policy requires it. Removing the last passkey
+* while passkeys are required depends on the account, so the plugin checks that itself.
+*/
+const policyRefusal = (policy, { path, body }) => {
+	const method = methodOf(path, body);
+	if (method && policy[method] === "forbidden") return {
+		code: "SIGN_IN_METHOD_FORBIDDEN",
+		message: signInPolicyMethods[method].forbidden
+	};
+	if (path === "/two-factor/disable" && policy.twoFactor === "required") return {
+		code: "TWO_FACTOR_REQUIRED",
+		message: "Two-factor authentication is required for every account, so it cannot be turned off."
+	};
+};
+/** The answer of `/token` to someone who has not set up what the policy requires. */
+const setupRequired = {
+	code: "SIGN_IN_SETUP_REQUIRED",
+	message: "Set up what this app requires for signing in first."
+};
+const lastPasskeyRequired = {
+	code: "PASSKEY_REQUIRED",
+	message: "Passkeys are required for every account, so the last one cannot be removed."
+};
+//#endregion
+export { isPoliced, lastPasskeyRequired, policyRefusal, setupRequired, staffSignInPath };