@protobase/server 0.5.0 → 0.7.0

package/dist/better-auth/auth-schema.d.ts

@@ -0,0 +1,16 @@
+import { AdminAuth } from "./create-auth.js";
+//#region src/better-auth/auth-schema.d.ts
+/**
+ * The SQL that brings the admin store up to what this version of Protobase and the project's Better Auth plugins need:
+ * for a store with the camelCase names of Protobase 0.6, their rename to snake_case (`snakeCaseMigration`); otherwise
+ * new tables, columns and indexes, never a drop, each skipped where it exists. `undefined` when the store is current. A
+ * change Better Auth cannot make safely, such as a required column without a default on a table with rows, is an error.
+ */
+export declare const authSchemaMigration: (auth: AdminAuth) => Promise<string | undefined>;
+/**
+ * Refuses to go on while the admin store lacks a table or column Better Auth needs, or still has the camelCase names
+ * of Protobase 0.6, since every sign-in would fail. The server never changes the schema itself: the project's
+ * migrations do, before the new version serves.
+ */
+export declare const checkAuthSchema: (auth: AdminAuth) => Promise<void>;
+//#endregion

package/dist/better-auth/auth-schema.js

@@ -0,0 +1,45 @@
+import { snakeCaseMigration } from "./snake-case-migration.js";
+import { getMigrations } from "better-auth/db/migration";
+//#region src/better-auth/auth-schema.ts
+/** The command that writes the pending changes as a migration file of the project. */
+const authMigrationCommand = "protobase auth migration";
+/**
+* Better Auth's statements, each made to skip what exists already, so a migration written from an empty database also
+* applies to one an earlier Protobase set up in place.
+*/
+const skipExisting = (sql) => sql.split(";\n\n").map((statement) => statement.replace(/^create table (?!if not exists )/, "create table if not exists ").replace(/^create (unique )?index (?!if not exists )/, (_, unique) => `create ${unique ?? ""}index if not exists `).replace(/^(alter table .+? )add column (?!if not exists )/, "$1add column if not exists ")).join(";\n\n");
+/**
+* Better Auth adds `email_verified` to a `user` table that exists only when the table still has the camelCase names
+* of Protobase 0.6, whose `emailVerified` it does not know: such a store is renamed, never given new columns beside
+* the old ones.
+*/
+const hasCamelCaseNames = ({ toBeAdded }) => toBeAdded.some(({ table, fields }) => table === "user" && "email_verified" in fields);
+const storeSchema = ({ options: { database } }) => database && "schemaName" in database ? database.schemaName : void 0;
+/**
+* The SQL that brings the admin store up to what this version of Protobase and the project's Better Auth plugins need:
+* for a store with the camelCase names of Protobase 0.6, their rename to snake_case (`snakeCaseMigration`); otherwise
+* new tables, columns and indexes, never a drop, each skipped where it exists. `undefined` when the store is current. A
+* change Better Auth cannot make safely, such as a required column without a default on a table with rows, is an error.
+*/
+const authSchemaMigration = async (auth) => {
+	if (hasCamelCaseNames(await getMigrations(auth.options, { throwOnUnsafe: false }))) return snakeCaseMigration(storeSchema(auth));
+	const { toBeCreated, toBeAdded, toBeAddedIndexes, compileMigrations } = await getMigrations(auth.options);
+	if (toBeCreated.length === 0 && toBeAdded.length === 0 && toBeAddedIndexes.length === 0) return void 0;
+	return skipExisting(await compileMigrations());
+};
+/** The tables and `table.column`s the admin store lacks; an index missing is not a reason to refuse requests. */
+const missingTablesAndColumns = ({ toBeCreated, toBeAdded }) => [...toBeCreated.map(({ table }) => table), ...toBeAdded.flatMap(({ table, fields }) => Object.keys(fields).map((field) => `${table}.${field}`))];
+/**
+* Refuses to go on while the admin store lacks a table or column Better Auth needs, or still has the camelCase names
+* of Protobase 0.6, since every sign-in would fail. The server never changes the schema itself: the project's
+* migrations do, before the new version serves.
+*/
+const checkAuthSchema = async (auth) => {
+	const plan = await getMigrations(auth.options, { throwOnUnsafe: false });
+	if (hasCamelCaseNames(plan)) throw new Error(`The auth schema still has the camelCase names of Protobase 0.6, which this version names in snake_case. Write their rename as a migration with \`${authMigrationCommand}\`, apply it with the project's migrations, then start again.`);
+	const missing = missingTablesAndColumns(plan);
+	if (missing.length === 0) return;
+	throw new Error(`The auth schema is behind this version of Protobase (missing ${missing.join(", ")}). Write the change as a migration with \`${authMigrationCommand}\`, apply it with the project's migrations, then start again.`);
+};
+//#endregion
+export { authMigrationCommand, authSchemaMigration, checkAuthSchema, skipExisting };

package/dist/better-auth/create-auth.d.ts

@@ -2,6 +2,7 @@ import { SignInPolicy } from "./sign-in-policy.js";
 import { StaffSignIn } from "./staff-log.js";
 import { Mailer } from "../mail/smtp-mailer.js";
 import { OperatorProvider } from "./operator-provider.js";
+import { PlatformSignIn } from "./platform-sign-in.js";
 import { BetterAuthOptions } from "better-auth";
 //#region src/better-auth/create-auth.d.ts
 export type CreateAuthOptions = {
@@ -33,7 +34,7 @@ export type CreateAuthOptions = {
   /**
    * Sign-in providers for Better Auth, for example `{ github: { clientId, clientSecret } }`; the callback is
    * `{baseURL}/api/auth/callback/<provider>`. A provider also signs up people without an account, with the default role.
-   * Default none.
+   * One with the id of `signInProvider` takes its place. Default none.
    */
   socialProviders?: BetterAuthOptions['socialProviders'];
   /** Encrypt the OAuth access, refresh and ID tokens Better Auth stores for social sign-ins, with `secret`. Default off. */
@@ -47,6 +48,13 @@ export type CreateAuthOptions = {
    * whatever the environment says.
    */
   operator?: OperatorProvider | false;
+  /**
+   * A sign-in provider the platform adds for people who already have an account: an OpenID Connect provider that never
+   * signs anyone up. Defaults to the one the platform passes in `PROTOBASE_SIGN_IN_ISSUER`, `PROTOBASE_SIGN_IN_CLIENT_ID`
+   * and `PROTOBASE_SIGN_IN_CLIENT_SECRET` (see `readPlatformSignIn`), when set; `false` turns it off whatever the
+   * environment says. Left out when `socialProviders` has a provider with the same id.
+   */
+  signInProvider?: PlatformSignIn | false;
 };
 type UserCreateHooks = NonNullable<NonNullable<NonNullable<BetterAuthOptions['databaseHooks']>['user']>['create']>;
 /** Better Auth's `databaseHooks.user.create.after`: the created user (with its `role`) and the request context, `null` outside a request. */
@@ -54,6 +62,48 @@ export type UserCreatedHook = NonNullable<UserCreateHooks['after']>;
 /** The configured roles with `admin` first; `admin` is added when missing. */
 export declare const normalizeRoles: (roles?: string[]) => string[];
 export declare const createAuth: (options: CreateAuthOptions) => import("better-auth").Auth<{
+  user: {
+    fields: {
+      emailVerified: string;
+      createdAt: string;
+      updatedAt: string;
+    };
+  };
+  session: {
+    fields: {
+      expiresAt: string;
+      createdAt: string;
+      updatedAt: string;
+      ipAddress: string;
+      userAgent: string;
+      userId: string;
+    };
+  };
+  verification: {
+    fields: {
+      expiresAt: string;
+      createdAt: string;
+      updatedAt: string;
+    };
+  };
+  account: {
+    encryptOAuthTokens?: true | undefined;
+    accountLinking: {
+      allowDifferentEmails: true;
+    };
+    fields: {
+      accountId: string;
+      providerId: string;
+      userId: string;
+      accessToken: string;
+      refreshToken: string;
+      idToken: string;
+      accessTokenExpiresAt: string;
+      refreshTokenExpiresAt: string;
+      createdAt: string;
+      updatedAt: string;
+    };
+  };
   plugins: [{
     id: "admin";
     version: string;
@@ -940,6 +990,19 @@ export declare const createAuth: (options: CreateAuthOptions) => import("better-
       };
     };
     options: NoInfer<{
+      schema: {
+        user: {
+          fields: {
+            banReason: string;
+            banExpires: string;
+          };
+        };
+        session: {
+          fields: {
+            impersonatedBy: string;
+          };
+        };
+      };
       defaultRole: string;
       roles: {
         [k: string]: import("better-auth/plugins").Role<import("better-auth/plugins").ExactRoleStatements<{
@@ -961,6 +1024,16 @@ export declare const createAuth: (options: CreateAuthOptions) => import("better-
     id: "jwt";
     version: string;
     options: NoInfer<{
+      schema: {
+        jwks: {
+          fields: {
+            publicKey: string;
+            privateKey: string;
+            createdAt: string;
+            expiresAt: string;
+          };
+        };
+      };
       jwt: {
         expirationTime: string;
         issuer: string;
@@ -2458,7 +2531,7 @@ export declare const createAuth: (options: CreateAuthOptions) => import("better-
       RESOLVED_USER_INVALID: import("better-auth").RawError<"RESOLVED_USER_INVALID">;
     };
     options: import("@better-auth/passkey").PasskeyOptions | undefined;
-  }, ...{
+  }, ...({
     id: "email-otp";
     version: string;
     init(ctx: import("better-auth").AuthContext): {
@@ -2990,10 +3063,24 @@ export declare const createAuth: (options: CreateAuthOptions) => import("better-
       INVALID_OTP: import("better-auth").RawError<"INVALID_OTP">;
       TOO_MANY_ATTEMPTS: import("better-auth").RawError<"TOO_MANY_ATTEMPTS">;
     };
-  }[], {
+  } | {
+    id: "generic-oauth";
+    version: string;
+    init: (ctx: import("better-auth").AuthContext) => Promise<{
+      context: {
+        socialProviders: import("better-auth").OAuthProvider<object, Partial<import("better-auth").ProviderOptions<object>>>[];
+      };
+    }>;
+    options: import("better-auth/plugins").GenericOAuthOptions<string>;
+    $ERROR_CODES: {
+      INVALID_OAUTH_CONFIGURATION: import("better-auth").RawError<"INVALID_OAUTH_CONFIGURATION">;
+      TOKEN_URL_NOT_FOUND: import("better-auth").RawError<"TOKEN_URL_NOT_FOUND">;
+    };
+  })[], {
     id: "protobase-sign-in-policy";
     schema: {
       readonly signInPolicy: {
+        readonly modelName: "sign_in_policy";
         readonly fields: {
           readonly password: {
             readonly type: "string";
@@ -3002,6 +3089,7 @@ export declare const createAuth: (options: CreateAuthOptions) => import("better-
           readonly emailCode: {
             readonly type: "string";
             readonly required: true;
+            readonly fieldName: "email_code";
           };
           readonly passkey: {
             readonly type: "string";
@@ -3010,19 +3098,29 @@ export declare const createAuth: (options: CreateAuthOptions) => import("better-
           readonly twoFactor: {
             readonly type: "string";
             readonly required: true;
+            readonly fieldName: "two_factor";
           };
           readonly staffAccess: {
             readonly type: "string";
             readonly required: true;
             readonly defaultValue: "allowed";
+            readonly fieldName: "staff_access";
+          };
+          readonly platformSignIn: {
+            readonly type: "string";
+            readonly required: true;
+            readonly defaultValue: "allowed";
+            readonly fieldName: "platform_sign_in";
           };
           readonly createdAt: {
             readonly type: "date";
             readonly required: true;
+            readonly fieldName: "created_at";
           };
           readonly createdBy: {
             readonly type: "string";
             readonly required: false;
+            readonly fieldName: "created_by";
           };
         };
       };
@@ -3041,7 +3139,12 @@ export declare const createAuth: (options: CreateAuthOptions) => import("better-
                 expiresAt: Date;
                 token: string;
                 ipAddress?: string | null | undefined;
-                userAgent?: string | null | undefined;
+                userAgent? /**
+                 * A sign-in provider the platform adds for people who already have an account: an OpenID Connect provider that never
+                 * signs anyone up. Defaults to the one the platform passes in `PROTOBASE_SIGN_IN_ISSUER`, `PROTOBASE_SIGN_IN_CLIENT_ID`
+                 * and `PROTOBASE_SIGN_IN_CLIENT_SECRET` (see `readPlatformSignIn`), when set; `false` turns it off whatever the
+                 * environment says. Left out when `socialProviders` has a provider with the same id.
+                 */ : string | null | undefined;
               };
               user: Record<string, any> & {
                 id: string;
@@ -3065,7 +3168,12 @@ export declare const createAuth: (options: CreateAuthOptions) => import("better-
                 expiresAt: Date;
                 token: string;
                 ipAddress?: string | null | undefined;
-                userAgent?: string | null | undefined;
+                userAgent? /**
+                 * A sign-in provider the platform adds for people who already have an account: an OpenID Connect provider that never
+                 * signs anyone up. Defaults to the one the platform passes in `PROTOBASE_SIGN_IN_ISSUER`, `PROTOBASE_SIGN_IN_CLIENT_ID`
+                 * and `PROTOBASE_SIGN_IN_CLIENT_SECRET` (see `readPlatformSignIn`), when set; `false` turns it off whatever the
+                 * environment says. Left out when `socialProviders` has a provider with the same id.
+                 */ : string | null | undefined;
               };
               user: Record<string, any> & {
                 id: string;
@@ -3088,7 +3196,12 @@ export declare const createAuth: (options: CreateAuthOptions) => import("better-
               expiresAt: Date;
               token: string;
               ipAddress?: string | null | undefined;
-              userAgent?: string | null | undefined;
+              userAgent? /**
+               * A sign-in provider the platform adds for people who already have an account: an OpenID Connect provider that never
+               * signs anyone up. Defaults to the one the platform passes in `PROTOBASE_SIGN_IN_ISSUER`, `PROTOBASE_SIGN_IN_CLIENT_ID`
+               * and `PROTOBASE_SIGN_IN_CLIENT_SECRET` (see `readPlatformSignIn`), when set; `false` turns it off whatever the
+               * environment says. Left out when `socialProviders` has a provider with the same id.
+               */ : string | null | undefined;
             };
             user: Record<string, any> & {
               id: string;
@@ -3124,6 +3237,7 @@ export declare const createAuth: (options: CreateAuthOptions) => import("better-
       }, {
         savedBy?: string | undefined;
         savedAt?: string | undefined;
+        platformSignIn?: string | undefined;
         operator?: string | undefined;
         policy: SignInPolicy;
         effective: SignInPolicy;
@@ -3142,7 +3256,12 @@ export declare const createAuth: (options: CreateAuthOptions) => import("better-
                 expiresAt: Date;
                 token: string;
                 ipAddress?: string | null | undefined;
-                userAgent?: string | null | undefined;
+                userAgent? /**
+                 * A sign-in provider the platform adds for people who already have an account: an OpenID Connect provider that never
+                 * signs anyone up. Defaults to the one the platform passes in `PROTOBASE_SIGN_IN_ISSUER`, `PROTOBASE_SIGN_IN_CLIENT_ID`
+                 * and `PROTOBASE_SIGN_IN_CLIENT_SECRET` (see `readPlatformSignIn`), when set; `false` turns it off whatever the
+                 * environment says. Left out when `socialProviders` has a provider with the same id.
+                 */ : string | null | undefined;
               };
               user: Record<string, any> & {
                 id: string;
@@ -3166,7 +3285,12 @@ export declare const createAuth: (options: CreateAuthOptions) => import("better-
                 expiresAt: Date;
                 token: string;
                 ipAddress?: string | null | undefined;
-                userAgent?: string | null | undefined;
+                userAgent? /**
+                 * A sign-in provider the platform adds for people who already have an account: an OpenID Connect provider that never
+                 * signs anyone up. Defaults to the one the platform passes in `PROTOBASE_SIGN_IN_ISSUER`, `PROTOBASE_SIGN_IN_CLIENT_ID`
+                 * and `PROTOBASE_SIGN_IN_CLIENT_SECRET` (see `readPlatformSignIn`), when set; `false` turns it off whatever the
+                 * environment says. Left out when `socialProviders` has a provider with the same id.
+                 */ : string | null | undefined;
               };
               user: Record<string, any> & {
                 id: string;
@@ -3189,7 +3313,12 @@ export declare const createAuth: (options: CreateAuthOptions) => import("better-
               expiresAt: Date;
               token: string;
               ipAddress?: string | null | undefined;
-              userAgent?: string | null | undefined;
+              userAgent? /**
+               * A sign-in provider the platform adds for people who already have an account: an OpenID Connect provider that never
+               * signs anyone up. Defaults to the one the platform passes in `PROTOBASE_SIGN_IN_ISSUER`, `PROTOBASE_SIGN_IN_CLIENT_ID`
+               * and `PROTOBASE_SIGN_IN_CLIENT_SECRET` (see `readPlatformSignIn`), when set; `false` turns it off whatever the
+               * environment says. Left out when `socialProviders` has a provider with the same id.
+               */ : string | null | undefined;
             };
             user: Record<string, any> & {
               id: string;
@@ -3226,6 +3355,7 @@ export declare const createAuth: (options: CreateAuthOptions) => import("better-
       }, {
         savedBy?: string | undefined;
         savedAt?: string | undefined;
+        platformSignIn?: string | undefined;
         operator?: string | undefined;
         policy: SignInPolicy;
         effective: SignInPolicy;
@@ -3243,7 +3373,12 @@ export declare const createAuth: (options: CreateAuthOptions) => import("better-
               expiresAt: Date;
               token: string;
               ipAddress?: string | null | undefined;
-              userAgent?: string | null | undefined;
+              userAgent? /**
+               * A sign-in provider the platform adds for people who already have an account: an OpenID Connect provider that never
+               * signs anyone up. Defaults to the one the platform passes in `PROTOBASE_SIGN_IN_ISSUER`, `PROTOBASE_SIGN_IN_CLIENT_ID`
+               * and `PROTOBASE_SIGN_IN_CLIENT_SECRET` (see `readPlatformSignIn`), when set; `false` turns it off whatever the
+               * environment says. Left out when `socialProviders` has a provider with the same id.
+               */ : string | null | undefined;
             };
             user: Record<string, any> & {
               id: string;
@@ -3265,7 +3400,7 @@ export declare const createAuth: (options: CreateAuthOptions) => import("better-
           twoFactor: boolean;
           authenticatorApp: boolean;
         };
-        missing: ("passkey" | "twoFactor")[];
+        missing: ("twoFactor" | "passkey")[];
       }>;
     };
     hooks: {
@@ -3278,14 +3413,17 @@ export declare const createAuth: (options: CreateAuthOptions) => import("better-
     id: "protobase-staff-sign-in";
     schema: {
       readonly staffSignIn: {
+        readonly modelName: "staff_sign_in";
         readonly fields: {
           readonly userId: {
             readonly type: "string";
             readonly required: true;
+            readonly fieldName: "user_id";
           };
           readonly userEmail: {
             readonly type: "string";
             readonly required: true;
+            readonly fieldName: "user_email";
           };
           readonly staff: {
             readonly type: "string";
@@ -3294,10 +3432,12 @@ export declare const createAuth: (options: CreateAuthOptions) => import("better-
           readonly staffName: {
             readonly type: "string";
             readonly required: false;
+            readonly fieldName: "staff_name";
           };
           readonly staffSubject: {
             readonly type: "string";
             readonly required: true;
+            readonly fieldName: "staff_subject";
           };
           readonly issuer: {
             readonly type: "string";
@@ -3310,18 +3450,22 @@ export declare const createAuth: (options: CreateAuthOptions) => import("better-
           readonly sessionId: {
             readonly type: "string";
             readonly required: true;
+            readonly fieldName: "session_id";
           };
           readonly startedAt: {
             readonly type: "date";
             readonly required: true;
+            readonly fieldName: "started_at";
           };
           readonly expiresAt: {
             readonly type: "date";
             readonly required: true;
+            readonly fieldName: "expires_at";
           };
           readonly endedAt: {
             readonly type: "date";
             readonly required: false;
+            readonly fieldName: "ended_at";
           };
         };
       };
@@ -3339,7 +3483,12 @@ export declare const createAuth: (options: CreateAuthOptions) => import("better-
               expiresAt: Date;
               token: string;
               ipAddress?: string | null | undefined;
-              userAgent?: string | null | undefined;
+              userAgent? /**
+               * A sign-in provider the platform adds for people who already have an account: an OpenID Connect provider that never
+               * signs anyone up. Defaults to the one the platform passes in `PROTOBASE_SIGN_IN_ISSUER`, `PROTOBASE_SIGN_IN_CLIENT_ID`
+               * and `PROTOBASE_SIGN_IN_CLIENT_SECRET` (see `readPlatformSignIn`), when set; `false` turns it off whatever the
+               * environment says. Left out when `socialProviders` has a provider with the same id.
+               */ : string | null | undefined;
             };
             user: Record<string, any> & {
               id: string;
@@ -3367,7 +3516,12 @@ export declare const createAuth: (options: CreateAuthOptions) => import("better-
               expiresAt: Date;
               token: string;
               ipAddress?: string | null | undefined;
-              userAgent?: string | null | undefined;
+              userAgent? /**
+               * A sign-in provider the platform adds for people who already have an account: an OpenID Connect provider that never
+               * signs anyone up. Defaults to the one the platform passes in `PROTOBASE_SIGN_IN_ISSUER`, `PROTOBASE_SIGN_IN_CLIENT_ID`
+               * and `PROTOBASE_SIGN_IN_CLIENT_SECRET` (see `readPlatformSignIn`), when set; `false` turns it off whatever the
+               * environment says. Left out when `socialProviders` has a provider with the same id.
+               */ : string | null | undefined;
             };
             user: Record<string, any> & {
               id: string;
@@ -3396,7 +3550,12 @@ export declare const createAuth: (options: CreateAuthOptions) => import("better-
                 expiresAt: Date;
                 token: string;
                 ipAddress?: string | null | undefined;
-                userAgent?: string | null | undefined;
+                userAgent? /**
+                 * A sign-in provider the platform adds for people who already have an account: an OpenID Connect provider that never
+                 * signs anyone up. Defaults to the one the platform passes in `PROTOBASE_SIGN_IN_ISSUER`, `PROTOBASE_SIGN_IN_CLIENT_ID`
+                 * and `PROTOBASE_SIGN_IN_CLIENT_SECRET` (see `readPlatformSignIn`), when set; `false` turns it off whatever the
+                 * environment says. Left out when `socialProviders` has a provider with the same id.
+                 */ : string | null | undefined;
               };
               user: Record<string, any> & {
                 id: string;
@@ -3420,7 +3579,12 @@ export declare const createAuth: (options: CreateAuthOptions) => import("better-
                 expiresAt: Date;
                 token: string;
                 ipAddress?: string | null | undefined;
-                userAgent?: string | null | undefined;
+                userAgent? /**
+                 * A sign-in provider the platform adds for people who already have an account: an OpenID Connect provider that never
+                 * signs anyone up. Defaults to the one the platform passes in `PROTOBASE_SIGN_IN_ISSUER`, `PROTOBASE_SIGN_IN_CLIENT_ID`
+                 * and `PROTOBASE_SIGN_IN_CLIENT_SECRET` (see `readPlatformSignIn`), when set; `false` turns it off whatever the
+                 * environment says. Left out when `socialProviders` has a provider with the same id.
+                 */ : string | null | undefined;
               };
               user: Record<string, any> & {
                 id: string;
@@ -3443,7 +3607,12 @@ export declare const createAuth: (options: CreateAuthOptions) => import("better-
               expiresAt: Date;
               token: string;
               ipAddress?: string | null | undefined;
-              userAgent?: string | null | undefined;
+              userAgent? /**
+               * A sign-in provider the platform adds for people who already have an account: an OpenID Connect provider that never
+               * signs anyone up. Defaults to the one the platform passes in `PROTOBASE_SIGN_IN_ISSUER`, `PROTOBASE_SIGN_IN_CLIENT_ID`
+               * and `PROTOBASE_SIGN_IN_CLIENT_SECRET` (see `readPlatformSignIn`), when set; `false` turns it off whatever the
+               * environment says. Left out when `socialProviders` has a provider with the same id.
+               */ : string | null | undefined;
             };
             user: Record<string, any> & {
               id: string;
@@ -3556,9 +3725,6 @@ export declare const createAuth: (options: CreateAuthOptions) => import("better-
       handler: () => void;
     };
   };
-  account?: {
-    encryptOAuthTokens: true;
-  } | undefined;
   socialProviders?: import("better-auth").SocialProviders | undefined;
   appName: string;
   database: any;
@@ -3585,6 +3751,10 @@ export declare const createAuth: (options: CreateAuthOptions) => import("better-
   passwordReset: boolean;
   socialProviders: string[];
   operator: string | undefined;
+  platformSignIn: {
+    provider: string;
+    name: string;
+  } | undefined;
 };
 export type AdminAuth = ReturnType<typeof createAuth>;
 //#endregion

package/dist/better-auth/create-auth.js

@@ -2,17 +2,20 @@ import { readMailSettings } from "../mail/mail-settings.js";
 import { smtpMailer } from "../mail/smtp-mailer.js";
 import { readOperatorSettings, resolveOperator } from "./operator-provider.js";
 import { passwordResetOptions } from "./password-reset.js";
+import { platformSignInFor, platformSignInProvider, readPlatformSignIn, resolvePlatformSignIn } from "./platform-sign-in.js";
 import { signInPolicyPlugin } from "./policy-plugin.js";
 import { emailCodeOptions, twoFactorCodeOptions, unusedEmailCodePaths } from "./sign-in-mail.js";
+import { coreNames, pluginNames } from "./snake-case-names.js";
 import { staffSignInPlugin } from "./staff-plugin.js";
 import { twoFactorAfterPasswordOrCode } from "./two-factor-challenge.js";
 import { passkey } from "@better-auth/passkey";
 import { APIError } from "better-auth/api";
 import { betterAuth } from "better-auth";
-import { admin, emailOTP, jwt } from "better-auth/plugins";
+import { admin, emailOTP, genericOAuth, jwt } from "better-auth/plugins";
 import { adminAc, userAc } from "better-auth/plugins/admin/access";
 //#region src/better-auth/create-auth.ts
 const platformOperator = () => readOperatorSettings(globalThis.process?.env ?? {});
+const platformSignInSettings = () => readPlatformSignIn(globalThis.process?.env ?? {});
 const platformMailer = () => {
 	const settings = readMailSettings(globalThis.process?.env ?? {});
 	return settings && smtpMailer(settings);
@@ -33,9 +36,13 @@ const normalizeRoles = (roles = ["admin", "user"]) => {
 	return ["admin", ...new Set(roles.filter((role) => role !== "admin"))];
 };
 const adminImpersonationPaths = ["/admin/impersonate-user", "/admin/stop-impersonating"];
-/** The options `createAuth` gives Better Auth, with the roles, default role, mailer and operator provider already resolved. */
-const betterAuthOptions = (options, { roles, defaultRole, mailer, operator }) => {
+/**
+* The options `createAuth` gives Better Auth, with the roles, default role, mailer, operator provider and platform
+* sign-in provider already resolved.
+*/
+const betterAuthOptions = (options, { roles, defaultRole, mailer, operator, platformSignIn }) => {
 	const secure = options.baseURL.startsWith("https://");
+	const signIn = platformSignInFor(platformSignIn, Object.keys(options.socialProviders ?? {}));
 	return {
 		appName: options.appName ?? "Protobase",
 		database: options.database,
@@ -54,13 +61,22 @@ const betterAuthOptions = (options, { roles, defaultRole, mailer, operator }) =>
 			...mailer && passwordResetOptions(mailer)
 		},
 		...options.socialProviders && { socialProviders: options.socialProviders },
-		...options.encryptOAuthTokens && { account: { encryptOAuthTokens: true } },
+		user: coreNames.user,
+		session: coreNames.session,
+		verification: coreNames.verification,
+		account: {
+			...coreNames.account,
+			accountLinking: { allowDifferentEmails: true },
+			...options.encryptOAuthTokens && { encryptOAuthTokens: true }
+		},
 		plugins: [
 			admin({
+				schema: pluginNames.admin,
 				defaultRole: defaultRole ?? "unassigned",
 				roles: Object.fromEntries(roles.map((role) => [role, role === "admin" ? adminAc : userAc]))
 			}),
 			jwt({
+				schema: pluginNames.jwt,
 				jwt: {
 					expirationTime: tokenLifetime,
 					issuer: options.baseURL,
@@ -73,15 +89,21 @@ const betterAuthOptions = (options, { roles, defaultRole, mailer, operator }) =>
 				disableSettingJwtHeader: true
 			}),
 			twoFactorAfterPasswordOrCode({
+				schema: pluginNames.twoFactor,
 				allowPasswordless: true,
 				...mailer && { otpOptions: twoFactorCodeOptions(mailer) }
 			}),
-			passkey(),
+			passkey({ schema: pluginNames.passkey }),
 			...mailer ? [emailOTP(emailCodeOptions(mailer))] : [],
+			...signIn ? [genericOAuth({ config: [platformSignInProvider(signIn)] })] : [],
 			signInPolicyPlugin({
 				mail: Boolean(mailer),
 				socialProviders: Object.keys(options.socialProviders ?? {}),
-				...operator && { operator: operator.name }
+				...operator && { operator: operator.name },
+				...signIn && { platformSignIn: {
+					provider: signIn.provider,
+					name: signIn.name
+				} }
 			}),
 			staffSignInPlugin({
 				...operator && { operator },
@@ -134,20 +156,27 @@ const createAuth = (options) => {
 	const mailer = options.mailer === void 0 ? platformMailer() : options.mailer || void 0;
 	const provider = options.operator === void 0 ? platformOperator() : options.operator || void 0;
 	const operator = provider && resolveOperator(provider);
+	const signInSettings = options.signInProvider === void 0 ? platformSignInSettings() : options.signInProvider || void 0;
+	const socialProviders = Object.keys(options.socialProviders ?? {});
+	const platformSignIn = platformSignInFor(signInSettings && resolvePlatformSignIn(signInSettings), socialProviders);
 	const auth = betterAuth(betterAuthOptions(options, {
 		roles,
 		defaultRole,
 		mailer,
-		operator
+		operator,
+		platformSignIn
 	}));
-	const socialProviders = Object.keys(options.socialProviders ?? {});
 	return Object.assign(auth, {
 		roles,
 		defaultRole,
 		mail: Boolean(mailer),
 		passwordReset: Boolean(mailer),
 		socialProviders,
-		operator: operator?.name
+		operator: operator?.name,
+		platformSignIn: platformSignIn && {
+			provider: platformSignIn.provider,
+			name: platformSignIn.name
+		}
 	});
 };
 //#endregion

package/dist/better-auth/platform-sign-in.d.ts

@@ -0,0 +1,30 @@
+import "better-auth/plugins";
+//#region src/better-auth/platform-sign-in.d.ts
+/**
+ * A sign-in provider the platform adds to the app, for people who already have an account: any OpenID Connect
+ * provider, with this app registered as a confidential client whose redirect URI is
+ * `{baseURL}/api/auth/callback/{provider}`. It never creates accounts.
+ */
+export type PlatformSignIn = {
+  /** The provider's issuer URL; its settings are read from `{issuer}/.well-known/openid-configuration`. */
+  issuer: string;
+  clientId: string;
+  clientSecret: string;
+  /**
+   * The id of the provider: the button, the callback path, and the namespace of the linked accounts. Default `oidc`.
+   * Use `github` only when the provider's `sub` is the GitHub user id, so its accounts are those of Better Auth's own
+   * GitHub provider.
+   */
+  provider?: string;
+  /** Shown on the sign-in page as "Continue with {name}". Default `GitHub` for the `github` provider, `SSO` otherwise. */
+  name?: string;
+  /** Scopes asked for besides `openid email profile`. */
+  scopes?: string[];
+};
+/**
+ * The provider the platform passes in `PROTOBASE_SIGN_IN_ISSUER`, `PROTOBASE_SIGN_IN_CLIENT_ID` and
+ * `PROTOBASE_SIGN_IN_CLIENT_SECRET` (with `PROTOBASE_SIGN_IN_PROVIDER` and `PROTOBASE_SIGN_IN_NAME` optional);
+ * `undefined` when none of the three is set. Some but not all of them stops the server at startup.
+ */
+export declare const readPlatformSignIn: (env: Record<string, string | undefined>) => PlatformSignIn | undefined;
+//#endregion