@protobase/server 0.3.4 → 0.4.1

package/dist/better-auth/sign-in-mail.js

@@ -0,0 +1,78 @@
+const codeLifetimeMinutes = 5;
+const codeLifetime = "5 minutes";
+/** The email with a code to sign in with instead of a password. */
+const signInCodeEmail = ({ to, code }) => ({
+	to,
+	subject: "Your sign-in code",
+	text: [
+		"Use this code to sign in:",
+		"",
+		code,
+		"",
+		`It works for ${codeLifetime}, once.`,
+		"If you did not try to sign in, ignore this email: nobody can sign in without the code.",
+		""
+	].join("\n")
+});
+/** The email with the second step of a sign-in, for an account with two-factor authentication by email. */
+const twoFactorCodeEmail = ({ to, code }) => ({
+	to,
+	subject: "Your verification code",
+	text: [
+		"Use this code to finish signing in:",
+		"",
+		code,
+		"",
+		`It works for ${codeLifetime}, once.`,
+		"If you did not just sign in, someone else may know your password or have your sign-in code: change your password.",
+		""
+	].join("\n")
+});
+/**
+* Better Auth's email OTP plugin as sign-in only: never a sign-up, codes stored hashed, sent with `mailer`. The
+* plugin's other uses (email verification, its own password reset, changing the address) are not offered.
+*/
+const emailCodeOptions = (mailer) => ({
+	disableSignUp: true,
+	expiresIn: 300,
+	storeOTP: "hashed",
+	sendVerificationOTP: ({ email, otp }) => mailer.send(signInCodeEmail({
+		to: email,
+		code: otp
+	}))
+});
+/** The email OTP plugin's endpoints Protobase does not use; `createAuth` turns them off. */
+const unusedEmailCodePaths = [
+	"/email-otp/check-verification-otp",
+	"/email-otp/verify-email",
+	"/email-otp/request-password-reset",
+	"/forget-password/email-otp",
+	"/email-otp/reset-password",
+	"/email-otp/request-email-change",
+	"/email-otp/change-email"
+];
+/** The two-factor plugin's emailed code, sent with `mailer`; stored hashed. */
+const twoFactorCodeOptions = (mailer) => ({
+	period: codeLifetimeMinutes,
+	storeOTP: "hashed",
+	sendOTP: ({ user, otp }) => mailer.send(twoFactorCodeEmail({
+		to: user.email,
+		code: otp
+	}))
+});
+/** The email to someone whose app lets staff sign in as people only when they are told: who, why, and until when. */
+const staffSignInEmail = ({ to, staff, reason, expiresAt }) => ({
+	to,
+	subject: "Staff signed in as you",
+	text: [
+		`${staff}, of the team that runs this app, signed in as you to help. The reason they gave:`,
+		"",
+		reason,
+		"",
+		`Their session ends by ${expiresAt.toUTCString()}. The app's admins see it in the app's log of staff sign-ins.`,
+		"If you did not expect this, tell your admin.",
+		""
+	].join("\n")
+});
+//#endregion
+export { emailCodeOptions, signInCodeEmail, staffSignInEmail, twoFactorCodeEmail, twoFactorCodeOptions, unusedEmailCodePaths };

package/dist/better-auth/sign-in-policy.d.ts

@@ -0,0 +1,49 @@
+//#region src/better-auth/sign-in-policy.d.ts
+/** What a policy says about one way of signing in: people may use it, must set it up, or cannot use it. */
+export type SignInRule = 'allowed' | 'required' | 'forbidden';
+/** Whether staff of the operator may sign in as people: yes, yes and each person gets an email about it, or no. */
+export type StaffAccessRule = 'allowed' | 'notify' | 'forbidden';
+/**
+ * The app's sign-in policy. `password`, `emailCode` and `passkey` are ways to sign in; `twoFactor` is the second step
+ * after a password or an emailed code. Only a passkey and two-factor authentication can be required: they are set up
+ * once per person, so "required" sends everyone without one to set it up. `staffAccess` is whether the operator's
+ * staff may sign in as people, for support.
+ */
+export type SignInPolicy = {
+  password: 'allowed' | 'forbidden';
+  emailCode: 'allowed' | 'forbidden';
+  passkey: SignInRule;
+  twoFactor: SignInRule;
+  staffAccess: StaffAccessRule;
+};
+/** Each method with the rules it takes, its name, and what the server answers when the policy turns it off. */
+export declare const signInPolicyMethods: {
+  readonly password: {
+    readonly label: "Password";
+    readonly rules: readonly ["allowed", "forbidden"];
+    readonly forbidden: "Signing in with a password is turned off.";
+  };
+  readonly emailCode: {
+    readonly label: "Emailed sign-in code";
+    readonly rules: readonly ["allowed", "forbidden"];
+    readonly forbidden: "Signing in with an emailed code is turned off.";
+  };
+  readonly passkey: {
+    readonly label: "Passkeys";
+    readonly rules: readonly ["allowed", "required", "forbidden"];
+    readonly forbidden: "Passkeys are turned off.";
+  };
+  readonly twoFactor: {
+    readonly label: "Two-factor authentication";
+    readonly rules: readonly ["allowed", "required", "forbidden"];
+    readonly forbidden: "Two-factor authentication is turned off.";
+  };
+  readonly staffAccess: {
+    readonly label: "Staff sign-in as a person";
+    readonly rules: readonly ["allowed", "notify", "forbidden"];
+    readonly forbidden: "Staff sign-in is turned off for this app.";
+  };
+};
+/** Everything allowed and nothing required: the policy of an app whose admins never saved one. */
+export declare const defaultSignInPolicy: SignInPolicy;
+//#endregion

package/dist/better-auth/sign-in-policy.js

@@ -0,0 +1,83 @@
+//#region src/better-auth/sign-in-policy.ts
+/** Each method with the rules it takes, its name, and what the server answers when the policy turns it off. */
+const signInPolicyMethods = {
+	password: {
+		label: "Password",
+		rules: ["allowed", "forbidden"],
+		forbidden: "Signing in with a password is turned off."
+	},
+	emailCode: {
+		label: "Emailed sign-in code",
+		rules: ["allowed", "forbidden"],
+		forbidden: "Signing in with an emailed code is turned off."
+	},
+	passkey: {
+		label: "Passkeys",
+		rules: [
+			"allowed",
+			"required",
+			"forbidden"
+		],
+		forbidden: "Passkeys are turned off."
+	},
+	twoFactor: {
+		label: "Two-factor authentication",
+		rules: [
+			"allowed",
+			"required",
+			"forbidden"
+		],
+		forbidden: "Two-factor authentication is turned off."
+	},
+	staffAccess: {
+		label: "Staff sign-in as a person",
+		rules: [
+			"allowed",
+			"notify",
+			"forbidden"
+		],
+		forbidden: "Staff sign-in is turned off for this app."
+	}
+};
+/** Everything allowed and nothing required: the policy of an app whose admins never saved one. */
+const defaultSignInPolicy = {
+	password: "allowed",
+	emailCode: "allowed",
+	passkey: "allowed",
+	twoFactor: "allowed",
+	staffAccess: "allowed"
+};
+const methodNames = Object.keys(signInPolicyMethods);
+/** A policy from a request body or a stored row; `undefined` when a method is missing or has a rule it does not take. */
+const parseSignInPolicy = (input) => {
+	if (typeof input !== "object" || input === null) return void 0;
+	const values = input;
+	return methodNames.every((method) => signInPolicyMethods[method].rules.includes(values[method])) ? Object.fromEntries(methodNames.map((method) => [method, values[method]])) : void 0;
+};
+/**
+* The policy as it applies. Emailed codes need mail; without mail, password sign-in is on whatever the policy says, so
+* an app whose mail settings went missing does not lock out everyone who had only emailed codes left. Staff sign-in
+* that emails the person is off without mail, since nobody would be told.
+*/
+const effectiveSignInPolicy = (policy, { mail }) => mail ? policy : {
+	...policy,
+	password: "allowed",
+	emailCode: "forbidden",
+	...policy.staffAccess === "notify" && { staffAccess: "forbidden" }
+};
+/** The required methods `account` has not set up yet, in the order a setup page asks for them. */
+const missingRequiredMethods = (policy, account) => [...policy.twoFactor === "required" && !account.twoFactor ? ["twoFactor"] : [], ...policy.passkey === "required" && account.passkeys === 0 ? ["passkey"] : []];
+/**
+* Why `policy` cannot be saved by an admin whose account is `admin`, or `undefined` when it can. It must keep a way
+* in for someone who has set nothing up (a password, or an emailed code with mail on), and leave the admin a way to
+* sign in. What it requires can always be set up after signing in.
+*/
+const signInPolicyProblem = (policy, { mail, admin }) => {
+	if (policy.password === "forbidden" && policy.emailCode === "forbidden") return "Keep password or emailed-code sign-in on: people without a passkey need one of them to sign in.";
+	if (policy.password === "forbidden" && !mail) return "Emailed codes need mail settings (PROTOBASE_SMTP_URL and PROTOBASE_MAIL_FROM), so password sign-in has to stay on.";
+	if (policy.staffAccess === "notify" && !mail) return "Emailing people when staff sign in as them needs mail settings (PROTOBASE_SMTP_URL and PROTOBASE_MAIL_FROM).";
+	if (policy.password === "forbidden" && policy.twoFactor === "required") return "Two-factor authentication is turned on with the account password, so it cannot be required while password sign-in is off.";
+	return policy.password === "allowed" && admin.password || policy.emailCode === "allowed" && mail || policy.passkey !== "forbidden" && admin.passkeys > 0 || admin.socialSignIn ? void 0 : "This policy would leave you without a way to sign in. Add a passkey first, or keep password sign-in on.";
+};
+//#endregion
+export { defaultSignInPolicy, effectiveSignInPolicy, missingRequiredMethods, parseSignInPolicy, signInPolicyMethods, signInPolicyProblem };

package/dist/better-auth/staff-checks.js

@@ -0,0 +1,65 @@
+const strongMethods = [
+	"mfa",
+	"hwk",
+	"swk"
+];
+/**
+* Whether the operator provider says the staff member signed in strongly: with a passkey or a second step (`amr`), or
+* at one of the configured `acr` levels.
+*/
+const isStrongSignIn = (claims, acrValues) => {
+	return (Array.isArray(claims.amr) ? claims.amr : []).some((method) => strongMethods.includes(method)) || typeof claims.acr === "string" && acrValues.includes(claims.acr);
+};
+const groupsOf = (groups) => Array.isArray(groups) ? groups : typeof groups === "string" ? groups.split(/[\s,]+/) : [];
+const permissionMissing = {
+	code: "STAFF_PERMISSION_MISSING",
+	message: "Your staff account has no permission to sign in as people here."
+};
+const signInNotStrong = {
+	code: "STAFF_SIGN_IN_NOT_STRONG",
+	message: "Sign in to the staff account with a passkey or a second step first."
+};
+const signInStale = {
+	code: "STAFF_SIGN_IN_STALE",
+	message: "Your staff sign-in is too old: sign in to the staff account again."
+};
+/**
+* Why a verified staff ID token cannot start a session as someone, or `undefined` when it can: the staff member needs
+* the explicit permission (the configured group), a strong sign-in, and one made in the last 15 minutes.
+*/
+const staffClaimsRefusal = (claims, { group, acrValues, now }) => {
+	if (!groupsOf(claims.groups).includes(group)) return permissionMissing;
+	if (!isStrongSignIn(claims, acrValues)) return signInNotStrong;
+	if (typeof claims.auth_time !== "number" || now - claims.auth_time > 900) return signInStale;
+};
+/** Why `reason` cannot be logged as the reason for signing in as someone, or `undefined` when it can. */
+const reasonProblem = (reason) => reason.trim().length < 10 ? `Say why you sign in as this person, in at least 10 characters, for the app's log.` : void 0;
+/** The staff member as the log and the banner name them: the address, else the provider's subject. */
+const staffLabel = (claims) => typeof claims.email === "string" && claims.email ? claims.email : claims.sub;
+const accountChanges = [
+	"/change-password",
+	"/set-password",
+	"/change-email",
+	"/delete-user",
+	"/link-social",
+	"/unlink-account",
+	"/revoke-sessions",
+	"/revoke-other-sessions",
+	"/two-factor/enable",
+	"/two-factor/disable",
+	"/two-factor/generate-backup-codes",
+	"/passkey/generate-register-options",
+	"/passkey/verify-registration",
+	"/passkey/update-passkey",
+	"/passkey/delete-passkey"
+];
+const staffCannotChange = {
+	code: "STAFF_CANNOT_CHANGE_SIGN_IN",
+	message: "Staff cannot change a person's sign-in or the sign-in policy."
+};
+/** Whether a staff session's request to `path` is refused: changes to the person's sign-in, and saving the sign-in policy. */
+const isRefusedForStaff = (path, method) => accountChanges.includes(path) || path === "/policy/sign-in" && method === "POST";
+/** Whether a Better Auth session is one staff started as someone: the admin plugin's `impersonatedBy` names the staff member. */
+const isStaffSession = (session) => Boolean(session.impersonatedBy);
+//#endregion
+export { isRefusedForStaff, isStaffSession, isStrongSignIn, permissionMissing, reasonProblem, signInNotStrong, signInStale, staffCannotChange, staffClaimsRefusal, staffLabel };

package/dist/better-auth/staff-log.d.ts

@@ -0,0 +1,14 @@
+import "better-auth";
+//#region src/better-auth/staff-log.d.ts
+/** A staff sign-in as the log and the banner show it: who, as whom, why, and when it started and ends (or ended). */
+export type StaffSignIn = {
+  id: string;
+  user: string;
+  staff: string;
+  staffName?: string;
+  reason: string;
+  startedAt: string;
+  expiresAt: string;
+  endedAt?: string;
+};
+//#endregion

package/dist/better-auth/staff-log.js

@@ -0,0 +1,96 @@
+//#region src/better-auth/staff-log.ts
+/** Better Auth's model for the log of staff sign-ins: one row per session staff started as someone. */
+const staffSignInModel = "staffSignIn";
+const staffSignInSchema = { [staffSignInModel]: { fields: {
+	userId: {
+		type: "string",
+		required: true
+	},
+	userEmail: {
+		type: "string",
+		required: true
+	},
+	staff: {
+		type: "string",
+		required: true
+	},
+	staffName: {
+		type: "string",
+		required: false
+	},
+	staffSubject: {
+		type: "string",
+		required: true
+	},
+	issuer: {
+		type: "string",
+		required: true
+	},
+	reason: {
+		type: "string",
+		required: true
+	},
+	sessionId: {
+		type: "string",
+		required: true
+	},
+	startedAt: {
+		type: "date",
+		required: true
+	},
+	expiresAt: {
+		type: "date",
+		required: true
+	},
+	endedAt: {
+		type: "date",
+		required: false
+	}
+} } };
+const entry = (row) => ({
+	id: row.id,
+	user: row.userEmail,
+	staff: row.staff,
+	...row.staffName && { staffName: row.staffName },
+	reason: row.reason,
+	startedAt: new Date(row.startedAt).toISOString(),
+	expiresAt: new Date(row.expiresAt).toISOString(),
+	...row.endedAt && { endedAt: new Date(row.endedAt).toISOString() }
+});
+const logStaffSignIn = async (adapter, data) => {
+	await adapter.create({
+		model: staffSignInModel,
+		data
+	});
+};
+const staffSignInOfSession = async (adapter, sessionId) => {
+	const row = await adapter.findOne({
+		model: staffSignInModel,
+		where: [{
+			field: "sessionId",
+			value: sessionId
+		}]
+	});
+	return row ? entry(row) : void 0;
+};
+const endStaffSignIn = async (adapter, sessionId) => {
+	await adapter.update({
+		model: staffSignInModel,
+		where: [{
+			field: "sessionId",
+			value: sessionId
+		}],
+		update: { endedAt: /* @__PURE__ */ new Date() }
+	});
+};
+/** The newest staff sign-ins first, at most `limit`. */
+const listStaffSignIns = async (adapter, limit = 100) => (await adapter.findMany({
+	model: staffSignInModel,
+	sortBy: {
+		field: "startedAt",
+		direction: "desc"
+	},
+	limit
+})).map(entry);
+//#endregion
+export { endStaffSignIn, listStaffSignIns, logStaffSignIn, staffSignInModel, staffSignInOfSession, staffSignInSchema };

package/dist/better-auth/staff-plugin.js

@@ -0,0 +1,61 @@
+import { isRefusedForStaff, isStaffSession, staffCannotChange } from "./staff-checks.js";
+import { adminOnly } from "./admin-only.js";
+import { endStaffSignIn, listStaffSignIns, staffSignInOfSession, staffSignInSchema } from "./staff-log.js";
+import { staffSignInEndpoints } from "./staff-sign-in-endpoints.js";
+import { APIError, createAuthEndpoint, createAuthMiddleware, getSessionFromCtx, sessionMiddleware } from "better-auth/api";
+import { deleteSessionCookie } from "better-auth/cookies";
+//#region src/better-auth/staff-plugin.ts
+/**
+* Staff of the operator sign in as a person of this app, for support (see `staffSignInEndpoints`). A staff session
+* shows who started it and why, can be stopped, and cannot change the person's sign-in or the sign-in policy. Every
+* staff sign-in is logged for the app's admins. The plugin is there without an operator provider too, so its table
+* exists from the first `auth:migrate`.
+*/
+const staffSignInPlugin = ({ operator, mailer }) => ({
+	id: "protobase-staff-sign-in",
+	schema: staffSignInSchema,
+	endpoints: {
+		...operator && staffSignInEndpoints({
+			operator,
+			...mailer && { mailer }
+		}),
+		/** `GET /staff/session`: for a staff session, who started it, as whom, why, and until when; otherwise `{ staff: null }`. */
+		getStaffSession: createAuthEndpoint("/staff/session", {
+			method: "GET",
+			use: [sessionMiddleware]
+		}, async (ctx) => {
+			const { session } = ctx.context.session;
+			if (!isStaffSession(session)) return ctx.json({ staff: null });
+			return ctx.json({ staff: await staffSignInOfSession(ctx.context.adapter, session.id) ?? null });
+		}),
+		/** `POST /staff/stop`: ends the staff session, signs the browser out, and notes the end in the log. */
+		stopStaffSession: createAuthEndpoint("/staff/stop", {
+			method: "POST",
+			use: [sessionMiddleware]
+		}, async (ctx) => {
+			const { session } = ctx.context.session;
+			if (!isStaffSession(session)) throw new APIError("BAD_REQUEST", {
+				code: "NOT_A_STAFF_SESSION",
+				message: "This is not a staff session."
+			});
+			await ctx.context.internalAdapter.deleteSession(session.token);
+			await endStaffSignIn(ctx.context.adapter, session.id);
+			deleteSessionCookie(ctx);
+			return ctx.json({ stopped: true });
+		}),
+		/** `GET /staff/sign-ins`, for admins: the log of staff sign-ins, newest first. */
+		listStaffSignIns: createAuthEndpoint("/staff/sign-ins", {
+			method: "GET",
+			use: [adminOnly("Only an admin can read the log of staff sign-ins.")]
+		}, async (ctx) => ctx.json({ signIns: await listStaffSignIns(ctx.context.adapter) }))
+	},
+	hooks: { before: [{
+		matcher: (context) => context.path !== void 0 && isRefusedForStaff(context.path, context.request?.method ?? "POST"),
+		handler: createAuthMiddleware(async (ctx) => {
+			const session = await getSessionFromCtx(ctx);
+			if (session && isStaffSession(session.session)) throw new APIError("FORBIDDEN", staffCannotChange);
+		})
+	}] }
+});
+//#endregion
+export { staffSignInPlugin };

package/dist/better-auth/staff-sign-in-endpoints.js

@@ -0,0 +1,162 @@
+import { reasonProblem, staffClaimsRefusal, staffLabel } from "./staff-checks.js";
+import { operatorClient, randomValue } from "./operator-provider.js";
+import { effectiveSignInPolicy } from "./sign-in-policy.js";
+import { readSignInPolicy } from "./policy-store.js";
+import { policyRefusal, staffSignInPath } from "./sign-in-enforcement.js";
+import { staffSignInEmail } from "./sign-in-mail.js";
+import { logStaffSignIn } from "./staff-log.js";
+import { APIError, createAuthEndpoint } from "better-auth/api";
+import * as z$1 from "zod";
+import { expireCookie, setSessionCookie } from "better-auth/cookies";
+//#region src/better-auth/staff-sign-in-endpoints.ts
+const startLifetimeMs = 6e5;
+const stateCookie = "staff_state";
+const stateIdentifier = (state) => `staff-sign-in:${state}`;
+const expired = {
+	code: "STAFF_SIGN_IN_EXPIRED",
+	message: "This staff sign-in expired or was used already: start again."
+};
+const providerFailed = {
+	code: "STAFF_SIGN_IN_FAILED",
+	message: "The staff sign-in did not go through at the operator provider."
+};
+const userUnavailable = {
+	code: "STAFF_USER_UNAVAILABLE",
+	message: "There is no account with this address, or it is disabled."
+};
+const withError = (url, code) => {
+	const target = new URL(url, "http://relative");
+	target.searchParams.set("staff-error", code);
+	return url.startsWith("/") ? `${target.pathname}${target.search}${target.hash}` : target.toString();
+};
+/**
+* The two steps of a staff sign-in: the staff sign-in page starts it with the person's address and a reason, the staff
+* member signs in at the operator provider, and the provider sends them back to the callback, which checks their
+* permission and sign-in and starts a session as the person, of Better Auth's admin plugin (`impersonatedBy` names
+* them). The session is short and never extended, and the person's two-factor and passkey requirements do not stop it.
+*/
+const staffSignInEndpoints = ({ operator, mailer }) => {
+	let client;
+	const clientOf = (context) => client ??= operatorClient(operator, `${context.baseURL}/staff/callback`);
+	const startSession = async (ctx, started, claims) => {
+		const refusal = staffClaimsRefusal(claims, {
+			group: operator.group,
+			acrValues: operator.acrValues,
+			now: Math.floor(Date.now() / 1e3)
+		});
+		if (refusal) return refusal;
+		const policy = effectiveSignInPolicy((await readSignInPolicy(ctx.context.adapter)).policy, { mail: Boolean(mailer) });
+		const off = policyRefusal(policy, { path: staffSignInPath });
+		if (off) return off;
+		const found = await ctx.context.internalAdapter.findUserByEmail(started.email.toLowerCase());
+		if (!found || found.user.banned) return userUnavailable;
+		const staff = staffLabel(claims);
+		const expiresAt = new Date(Date.now() + operator.sessionMinutes * 60 * 1e3);
+		if (policy.staffAccess === "notify" && mailer) await mailer.send(staffSignInEmail({
+			to: found.user.email,
+			staff,
+			reason: started.reason,
+			expiresAt
+		}));
+		const session = await ctx.context.internalAdapter.createSession(found.user.id, true, {
+			impersonatedBy: staff,
+			expiresAt
+		}, true);
+		await logStaffSignIn(ctx.context.adapter, {
+			userId: found.user.id,
+			userEmail: found.user.email,
+			staff,
+			...typeof claims.name === "string" && { staffName: claims.name },
+			staffSubject: claims.sub,
+			issuer: operator.issuer,
+			reason: started.reason,
+			sessionId: session.id,
+			startedAt: /* @__PURE__ */ new Date(),
+			expiresAt
+		});
+		await setSessionCookie(ctx, {
+			session,
+			user: found.user
+		}, true);
+	};
+	return {
+		/**
+		* `POST /staff/sign-in` with `{ email, reason, callbackURL }`: answers `{ url }` at the operator provider, where
+		* the staff member signs in. Only this browser can finish it, within ten minutes, once.
+		*/
+		startStaffSignIn: createAuthEndpoint(staffSignInPath, {
+			method: "POST",
+			body: z$1.object({
+				email: z$1.email(),
+				reason: z$1.string(),
+				callbackURL: z$1.string()
+			})
+		}, async (ctx) => {
+			const problem = reasonProblem(ctx.body.reason);
+			if (problem) throw new APIError("BAD_REQUEST", {
+				code: "STAFF_REASON_REQUIRED",
+				message: problem
+			});
+			if (!ctx.context.isTrustedOrigin(ctx.body.callbackURL, { allowRelativePaths: true })) throw new APIError("FORBIDDEN", {
+				code: "INVALID_CALLBACK_URL",
+				message: "The page to come back to is not on a trusted origin."
+			});
+			const [state, nonce, verifier] = [
+				randomValue(),
+				randomValue(),
+				randomValue()
+			];
+			const started = {
+				email: ctx.body.email,
+				reason: ctx.body.reason.trim(),
+				callbackURL: ctx.body.callbackURL,
+				nonce,
+				verifier
+			};
+			await ctx.context.internalAdapter.createVerificationValue({
+				identifier: stateIdentifier(state),
+				value: JSON.stringify(started),
+				expiresAt: new Date(Date.now() + startLifetimeMs)
+			});
+			const cookie = ctx.context.createAuthCookie(stateCookie, { maxAge: startLifetimeMs / 1e3 });
+			await ctx.setSignedCookie(cookie.name, state, ctx.context.secret, cookie.attributes);
+			return ctx.json({ url: await clientOf(ctx.context).authorizationURL({
+				state,
+				nonce,
+				verifier
+			}) });
+		}),
+		/**
+		* `GET /staff/callback`, where the operator provider sends the staff member back: signed in as the person, to the
+		* `callbackURL` they started from, or there with `?staff-error=<code>`.
+		*/
+		staffCallback: createAuthEndpoint("/staff/callback", {
+			method: "GET",
+			query: z$1.object({
+				state: z$1.string().optional(),
+				code: z$1.string().optional()
+			})
+		}, async (ctx) => {
+			const cookie = ctx.context.createAuthCookie(stateCookie);
+			const browserState = await ctx.getSignedCookie(cookie.name, ctx.context.secret);
+			expireCookie(ctx, cookie);
+			const { state, code } = ctx.query;
+			if (!state || state !== browserState) throw new APIError("BAD_REQUEST", expired);
+			const stored = await ctx.context.internalAdapter.consumeVerificationValue(stateIdentifier(state));
+			if (!stored) throw new APIError("BAD_REQUEST", expired);
+			const started = JSON.parse(stored.value);
+			if (!code) throw ctx.redirect(withError(started.callbackURL, providerFailed.code));
+			const claims = await clientOf(ctx.context).signedInStaff({
+				code,
+				nonce: started.nonce,
+				verifier: started.verifier
+			}).catch((error) => {
+				ctx.context.logger.error("Staff sign-in at the operator provider failed", error);
+			});
+			const refusal = claims ? await startSession(ctx, started, claims) : providerFailed;
+			throw ctx.redirect(refusal ? withError(started.callbackURL, refusal.code) : started.callbackURL);
+		})
+	};
+};
+//#endregion
+export { staffSignInEndpoints };

package/dist/better-auth/status-route.js

@@ -1,18 +1,33 @@
+import { effectiveSignInPolicy } from "./sign-in-policy.js";
+import { readSignInPolicy } from "./policy-store.js";
 import { hasUsers } from "./users.js";
 import { Hono } from "hono";
 //#region src/better-auth/status-route.ts
 /**
-* `GET {authBase}/status`: `needsAdmin` while the admin store has no user, so a login page can say how to create one,
-* `passwordReset` when reset mail can be sent, so it offers "Forgot password?" only then, and the ids of the configured
-* `socialProviders`, so it offers "Continue with GitHub" when `github` is one.
+* `GET {authBase}/status`: `needsAdmin` while the admin store has no user, so a login page can say how to create one;
+* `signInMethods`, the ways to sign in the sign-in policy leaves on (`password`, `emailCode`, `passkey`), so it offers
+* only those; `passwordReset` when reset mail can be sent and passwords are on, so it offers "Forgot password?" only
+* then; the ids of the configured `socialProviders`, so it offers "Continue with GitHub" when `github` is one; and
+* `staffSignIn`, the operator provider's name, when staff can sign in as people.
 */
 const statusRoute = (auth) => {
 	const app = new Hono();
-	app.get("/status", async (c) => c.json({
-		needsAdmin: !await hasUsers(auth),
-		passwordReset: auth.passwordReset,
-		socialProviders: auth.socialProviders
-	}));
+	app.get("/status", async (c) => {
+		const policy = effectiveSignInPolicy((await readSignInPolicy((await auth.$context).adapter)).policy, { mail: auth.mail });
+		const signInMethods = [
+			...policy.password === "allowed" ? ["password"] : [],
+			...policy.emailCode === "allowed" ? ["emailCode"] : [],
+			...policy.passkey !== "forbidden" ? ["passkey"] : []
+		];
+		const staffSignIn = auth.operator && policy.staffAccess !== "forbidden" ? auth.operator : void 0;
+		return c.json({
+			needsAdmin: !await hasUsers(auth),
+			signInMethods,
+			passwordReset: auth.passwordReset && policy.password === "allowed",
+			socialProviders: auth.socialProviders,
+			...staffSignIn && { staffSignIn }
+		});
+	});
 	return app;
 };
 //#endregion

package/dist/better-auth/tokens.js

@@ -1,4 +1,4 @@
-import { parseRoles } from "./users.js";
+import { parseRoles } from "./parse-roles.js";
 //#region src/better-auth/tokens.ts
 const defaultTtlSeconds = 900;
 const maxTokenTtlSeconds = 86400;