@remit/auth-service 0.0.10 → 0.0.12

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@remit/auth-service",
-  "version": "0.0.10",
-  "description": "better-auth identity service for the Postgres-parity stack (pg-parity)",
+  "version": "0.0.12",
+  "description": "better-auth identity service for the self-host stack",
   "type": "module",
   "main": "src/index.ts",
   "types": "src/index.ts",
@@ -23,14 +23,9 @@
     "test:typecheck": "tsgo --noEmit -p tsconfig.json",
     "test:run": "node --import tsx --experimental-test-coverage --test-coverage-include='src/**' --test-coverage-exclude='src/**/*.test.ts' --test-coverage-exclude='src/**/*.test.tsx' --test-coverage-lines=94 --test 'src/**/*.test.ts'",
     "test": "npm run test:typecheck && npm run test:run",
-    "auth:schema:generate": "npx @better-auth/cli generate --config src/auth.gen.ts --output src/schema/auth-schema.ts -y",
-    "auth:schema:push": "npx drizzle-kit push",
     "fix": "biome check --write src"
   },
   "devDependencies": {
-    "@better-auth/cli": "^1.4.21",
-    "drizzle-kit": "^0.31.1",
-    "embedded-postgres": "^18.4.0-beta.17",
     "tsx": "*"
   },
   "dependencies": {
@@ -38,7 +33,6 @@
     "better-sqlite3": "^12.11.1",
     "drizzle-orm": "^0.45.2",
     "jose": "^6.2.3",
-    "pg": "^8.0.0",
     "@types/better-sqlite3": "^7.6.13"
   },
   "license": "MIT",

package/src/auth.ts

@@ -2,19 +2,14 @@ import type { Auth as BetterAuthInstance } from "better-auth";
 import { betterAuth } from "better-auth";
 import { drizzleAdapter } from "better-auth/adapters/drizzle";
 import { jwt } from "better-auth/plugins";
-import { drizzle as drizzlePg } from "drizzle-orm/node-postgres";
-import pg from "pg";
-import * as authSchema from "./schema/auth-schema.js";
 import * as authSchemaSqlite from "./schema/auth-schema-sqlite.js";
 
 export interface AuthConfig {
 	/**
-	 * The relational backend better-auth runs on, off `DATA_BACKEND` (RFC 036).
-	 * `pg` (the default) reads `connectionString` as a Postgres URL; `sqlite`
-	 * reads it as the path to the shared database file (D3), and drives the
-	 * SQLite identity schema through the drizzle adapter's `sqlite` provider.
+	 * Path to the shared database file (RFC 036 D3). The identity tables live
+	 * beside the app tables and are driven through the drizzle adapter's
+	 * `sqlite` provider.
 	 */
-	provider?: "pg" | "sqlite";
 	connectionString: string;
 	secret: string;
 	baseURL: string;
@@ -27,34 +22,36 @@ export interface AuthConfig {
 	selfSignUpEnabled: boolean;
 }
 
-// The drizzle adapter better-auth runs against, chosen by backend. better-sqlite3
-// and its drizzle driver are imported dynamically so the Postgres path never
-// loads the native binding, and the module stays out of any bundle that never
-// runs on SQLite. On SQLite the auth connection sets the same WAL/busy_timeout
+// The drizzle adapter better-auth runs against. better-sqlite3 and its drizzle
+// driver are imported dynamically so the module stays out of any bundle that
+// never opens the database. The auth connection sets the same WAL/busy_timeout
 // coordination every writer uses (RFC 036 D3) — it shares the file with the app
 // tables through its own connection.
 const buildAuthAdapter = async (config: AuthConfig) => {
-	if (config.provider === "sqlite") {
-		const { default: Database } = await import("better-sqlite3");
-		const { drizzle } = await import("drizzle-orm/better-sqlite3");
-		const sqlite = new Database(config.connectionString);
-		sqlite.pragma("journal_mode = WAL");
-		sqlite.pragma("busy_timeout = 5000");
-		sqlite.pragma("synchronous = NORMAL");
-		sqlite.pragma("foreign_keys = ON");
-		return drizzleAdapter(drizzle(sqlite, { schema: authSchemaSqlite }), {
-			provider: "sqlite",
-			schema: authSchemaSqlite,
-		});
-	}
-
-	const pool = new pg.Pool({ connectionString: config.connectionString });
-	return drizzleAdapter(drizzlePg(pool, { schema: authSchema }), {
-		provider: "pg",
-		schema: authSchema,
+	const { default: Database } = await import("better-sqlite3");
+	const { drizzle } = await import("drizzle-orm/better-sqlite3");
+	const sqlite = new Database(config.connectionString);
+	sqlite.pragma("journal_mode = WAL");
+	sqlite.pragma("busy_timeout = 5000");
+	sqlite.pragma("synchronous = NORMAL");
+	sqlite.pragma("foreign_keys = ON");
+	return drizzleAdapter(drizzle(sqlite, { schema: authSchemaSqlite }), {
+		provider: "sqlite",
+		schema: authSchemaSqlite,
 	});
 };
 
+/**
+ * The header carrying the client address, set by the edge proxy from the
+ * connection it terminates (deploy/vps/caddy/routes.caddy). It is deliberately
+ * not `X-Forwarded-For`: that header arrives with an appended hop per proxy,
+ * which resolves to no single client and collapses rate limiting onto one
+ * shared bucket for everybody. Nothing else in the chain writes this name, and
+ * the edge replaces any value a client sends, so it is single-valued and
+ * trustworthy at the point better-auth reads it.
+ */
+export const CLIENT_IP_HEADER = "x-remit-client-ip";
+
 const intEnv = (name: string, fallback: number): number => {
 	const raw = process.env[name];
 	if (!raw) return fallback;
@@ -63,7 +60,7 @@ const intEnv = (name: string, fallback: number): number => {
 };
 
 /**
- * Build a better-auth instance bound to the pg-parity Postgres.
+ * Build a better-auth instance bound to the self-host database file.
  *
  * RS256 is deliberate: the edge tier (APISIX, or the dev-server verifier)
  * follows JWKS key rotation offline, so signing must be asymmetric. The JWKS is
@@ -91,6 +88,12 @@ export const createAuth = async (
 			autoSignIn: true,
 			disableSignUp: !config.selfSignUpEnabled,
 		},
+		// Listing one header, and not better-auth's `x-forwarded-for` default,
+		// is what keeps the resolved address out of a caller's reach: an
+		// `X-Forwarded-For` a client sends is never read at all.
+		advanced: {
+			ipAddress: { ipAddressHeaders: [CLIENT_IP_HEADER] },
+		},
 		rateLimit: {
 			enabled: true,
 			window: intEnv("BETTER_AUTH_RATE_LIMIT_WINDOW", 60),

package/src/config.ts

@@ -29,29 +29,22 @@ export const resolveSelfSignUpEnabled = (
 };
 
 export interface DataConnectionConfig {
-	provider: "pg" | "sqlite";
 	connectionString: string;
 }
 
 /**
- * Resolve which relational backend identity data lives on, from the same env
- * vars the rest of the self-host stack reads (RFC 036 D5). On
- * `DATA_BACKEND=sqlite` the identity tables share the app database file, so
- * the locator is `SQLITE_DB_PATH`; otherwise it is the Postgres URL.
+ * Resolve where identity data lives, from the same env vars the rest of the
+ * self-host stack reads (RFC 036 D5). The identity tables share the app
+ * database file, so the locator is `SQLITE_DB_PATH`.
  */
-export const resolveDataConnectionConfig = (): DataConnectionConfig => {
-	const provider = process.env.DATA_BACKEND === "sqlite" ? "sqlite" : "pg";
-	const connectionString =
-		provider === "sqlite"
-			? required("SQLITE_DB_PATH", process.env.SQLITE_DB_PATH)
-			: required("PG_CONNECTION_URL", process.env.PG_CONNECTION_URL);
-	return { provider, connectionString };
-};
+export const resolveDataConnectionConfig = (): DataConnectionConfig => ({
+	connectionString: required("SQLITE_DB_PATH", process.env.SQLITE_DB_PATH),
+});
 
 /**
  * Resolve the better-auth config from the environment. Callers reach this only
- * on the self-host relational backends (Postgres or SQLite); the Cognito/AWS
- * path never touches better-auth.
+ * on the self-host relational backend; the Cognito/AWS path never touches
+ * better-auth.
  */
 export const resolveAuthConfig = (): AuthConfig => {
 	const baseURL = required("BETTER_AUTH_URL", process.env.BETTER_AUTH_URL);

package/src/index.ts

@@ -1,5 +1,10 @@
 export { toNodeHandler } from "better-auth/node";
-export { type Auth, type AuthConfig, createAuth } from "./auth.js";
+export {
+	type Auth,
+	type AuthConfig,
+	CLIENT_IP_HEADER,
+	createAuth,
+} from "./auth.js";
 export {
 	AUTH_BASE_PATH,
 	AUTH_JWKS_PATH,

package/src/rate-limit.test.ts

@@ -0,0 +1,106 @@
+import assert from "node:assert/strict";
+import { mkdtempSync, rmSync } from "node:fs";
+import { tmpdir } from "node:os";
+import { join, resolve } from "node:path";
+import { after, before, describe, it } from "node:test";
+import type { Auth } from "./auth.js";
+import { CLIENT_IP_HEADER, createAuth } from "./auth.js";
+
+const SIGN_IN_MAX = 2;
+const MIGRATIONS = resolve(
+	import.meta.dirname,
+	"../../../deploy/vps/migrations-sqlite/auth",
+);
+
+const createDatabase = async (dir: string, name: string): Promise<string> => {
+	const path = join(dir, `${name}.db`);
+	const { default: Database } = await import("better-sqlite3");
+	const { drizzle } = await import("drizzle-orm/better-sqlite3");
+	const { migrate } = await import("drizzle-orm/better-sqlite3/migrator");
+	const sqlite = new Database(path);
+	migrate(drizzle(sqlite), { migrationsFolder: MIGRATIONS });
+	sqlite.close();
+	return path;
+};
+
+const signIn = (auth: Auth, headers: Record<string, string>) =>
+	auth.handler(
+		new Request("http://localhost:3000/api/auth/sign-in/email", {
+			method: "POST",
+			headers: { "content-type": "application/json", ...headers },
+			body: JSON.stringify({
+				email: "nobody@example.com",
+				password: "a-sufficiently-long-password",
+			}),
+		}),
+	);
+
+/**
+ * Spend one client's sign-in budget, returning the attempt number that was
+ * turned away. `null` means the budget never ran out.
+ */
+const exhaust = async (
+	auth: Auth,
+	headers: Record<string, string>,
+): Promise<number | null> => {
+	for (let attempt = 0; attempt <= SIGN_IN_MAX; attempt++) {
+		const response = await signIn(auth, headers);
+		if (response.status === 429) return attempt;
+	}
+	return null;
+};
+
+describe("sign-in rate limiting is per client", () => {
+	const previousMax = process.env.BETTER_AUTH_RATE_LIMIT_SIGN_IN_MAX;
+	let dir: string;
+
+	before(() => {
+		process.env.BETTER_AUTH_RATE_LIMIT_SIGN_IN_MAX = String(SIGN_IN_MAX);
+		dir = mkdtempSync(join(tmpdir(), "remit-rate-limit-"));
+	});
+
+	after(() => {
+		if (previousMax === undefined) {
+			delete process.env.BETTER_AUTH_RATE_LIMIT_SIGN_IN_MAX;
+		} else {
+			process.env.BETTER_AUTH_RATE_LIMIT_SIGN_IN_MAX = previousMax;
+		}
+		rmSync(dir, { recursive: true, force: true });
+	});
+
+	const build = async (name: string): Promise<Auth> =>
+		createAuth({
+			connectionString: await createDatabase(dir, name),
+			secret: "rate-limit-test-secret-value-32chars-min",
+			baseURL: "http://localhost:3000",
+			selfSignUpEnabled: true,
+		});
+
+	it("locks out only the client that spent the budget", async () => {
+		const auth = await build("per-client");
+
+		assert.equal(
+			await exhaust(auth, { [CLIENT_IP_HEADER]: "203.0.113.10" }),
+			SIGN_IN_MAX,
+		);
+
+		const other = await signIn(auth, { [CLIENT_IP_HEADER]: "198.51.100.20" });
+		assert.equal(other.status, 401);
+	});
+
+	it("ignores a forwarded address the client supplies itself", async () => {
+		const auth = await build("spoofed");
+		const client = { [CLIENT_IP_HEADER]: "203.0.113.30" };
+
+		assert.equal(
+			await exhaust(auth, { ...client, "x-forwarded-for": "203.0.113.31" }),
+			SIGN_IN_MAX,
+		);
+
+		const spoofed = await signIn(auth, {
+			...client,
+			"x-forwarded-for": "198.51.100.40",
+		});
+		assert.equal(spoofed.status, 429);
+	});
+});

package/src/schema/auth-schema-sqlite.ts

@@ -1,9 +1,15 @@
-// SQLite twin of auth-schema.ts (RFC 036 D5). Same five better-auth identity
-// tables in the SQLite dialect — the shape better-auth's drizzle adapter emits
-// with `provider: "sqlite"`: `sqliteTable`, `text` unchanged, `boolean` and
-// `timestamp` mapped to `integer` (mode boolean / timestamp). Used only to
-// generate the committed sqlite migrations (deploy/vps/migrations-sqlite/auth);
-// the Postgres schema stays the source for the pg migrations.
+// The five better-auth identity tables, in the shape better-auth's drizzle
+// adapter emits with `provider: "sqlite"`. Used to generate the committed
+// sqlite migrations (deploy/vps/migrations-sqlite/auth).
+//
+// Hand-maintained, deliberately. The `@better-auth/cli generate` command no
+// longer emits this shape: it writes `mode: "timestamp_ms"` where these columns
+// store seconds, and a SQL `DEFAULT (cast(unixepoch('subsecond') * 1000 as
+// integer))` where these use a JS-side `$defaultFn` and the committed migration
+// has no DEFAULT clause. Taking its output would reinterpret every timestamp on
+// every deployed instance and rewrite all five tables. Match better-auth's
+// runtime expectations by hand when a version bump changes them, and let
+// vps-migrations-drift.sqlite.test.ts catch the migration side.
 import { relations } from "drizzle-orm";
 import { index, integer, sqliteTable, text } from "drizzle-orm/sqlite-core";
 

package/src/schema/meta-schema-sqlite.ts

@@ -1,7 +1,5 @@
-// SQLite twin of meta-schema.ts. Same shape in the SQLite dialect — used only
-// to generate the committed SQLite migrations
-// (deploy/vps/migrations-sqlite/meta); the Postgres schema stays the source
-// for the pg migrations.
+// The instance-owner singleton, used to generate the committed SQLite
+// migrations (deploy/vps/migrations-sqlite/meta).
 import { sql } from "drizzle-orm";
 import { check, integer, sqliteTable, text } from "drizzle-orm/sqlite-core";
 

package/src/signup.test.ts

@@ -29,7 +29,7 @@ describe("resolveSelfSignUpEnabled", () => {
 });
 
 const baseConfig = {
-	connectionString: "postgresql://remit:remit@localhost:5432/remit_test",
+	connectionString: ":memory:",
 	secret: "signup-test-secret-value-32chars-minimum",
 	baseURL: "http://localhost:3000",
 };
@@ -45,9 +45,8 @@ describe("createAuth self-signup gate", () => {
 		assert.equal(closed.options.emailAndPassword?.disableSignUp, true);
 	});
 
-	it("selects the sqlite drizzle provider when configured", async () => {
+	it("drives the sqlite drizzle provider", async () => {
 		const auth = await createAuth({
-			provider: "sqlite",
 			connectionString: ":memory:",
 			secret: baseConfig.secret,
 			baseURL: baseConfig.baseURL,

package/src/verifier.ts

@@ -1,10 +1,10 @@
 // JWT-verification-only slice of this package's barrel. The full barrel
-// (`index.ts`) re-exports `createAuth` from `./auth.js`, which constructs a
-// `pg.Pool` + `drizzle-orm/node-postgres` at module scope, and `toNodeHandler`
-// from `better-auth/node` — neither needed to verify a token, both dragging a
-// Postgres client into any Lambda bundle that only checks a bearer token (see
-// #1242's FAQ, #1244/#1247). `config.ts`'s `AuthConfig` import from `./auth.js`
-// is type-only and erases at build, so this stays free of that chain.
+// (`index.ts`) re-exports `createAuth` from `./auth.js` and `toNodeHandler`
+// from `better-auth/node` — neither needed to verify a token, both dragging the
+// whole better-auth server graph into any Lambda bundle that only checks a
+// bearer token (see #1242's FAQ, #1244/#1247). `config.ts`'s `AuthConfig`
+// import from `./auth.js` is type-only and erases at build, so this stays free
+// of that chain.
 
 export {
 	AUTH_BASE_PATH,

package/drizzle.config.ts

@@ -1,24 +0,0 @@
-const url =
-	process.env.DATABASE_URL ??
-	process.env.PG_CONNECTION_URL ??
-	"postgresql://remit:remit@localhost:5432/remit_dev";
-
-/**
- * The better-auth identity tables share the pg-parity database with the entity
- * schema (remit-drizzle-service). `tablesFilter` scopes drizzle-kit to only the
- * auth tables so a push here never proposes dropping the entity tables it does
- * not know about.
- */
-export default {
-	dialect: "postgresql",
-	schema: "./src/schema/auth-schema.ts",
-	out: "./.drizzle",
-	dbCredentials: { url },
-	tablesFilter: [
-		"auth_user",
-		"auth_session",
-		"auth_account",
-		"auth_verification",
-		"auth_jwks",
-	],
-};

package/src/auth.gen.ts

@@ -1,35 +0,0 @@
-import type { Auth as BetterAuthInstance } from "better-auth";
-import { betterAuth } from "better-auth";
-import { drizzleAdapter } from "better-auth/adapters/drizzle";
-import { jwt } from "better-auth/plugins";
-import { drizzle } from "drizzle-orm/node-postgres";
-import pg from "pg";
-
-/**
- * Schema-generation-only config for `@better-auth/cli generate`. It mirrors the
- * plugin set of the real `createAuth` so the emitted Drizzle schema matches what
- * runtime expects, but omits the schema import to break the generate-time
- * chicken-and-egg (the schema file is this command's output).
- */
-const pool = new pg.Pool({
-	connectionString:
-		process.env.PG_CONNECTION_URL ??
-		"postgresql://remit:remit@localhost:5432/remit_dev",
-});
-
-export const auth = betterAuth({
-	secret: "schema-generation-only",
-	baseURL: "http://localhost",
-	database: drizzleAdapter(drizzle(pool), { provider: "pg" }),
-	emailAndPassword: { enabled: true },
-	user: { modelName: "auth_user" },
-	session: { modelName: "auth_session" },
-	account: { modelName: "auth_account" },
-	verification: { modelName: "auth_verification" },
-	plugins: [
-		jwt({
-			schema: { jwks: { modelName: "auth_jwks" } },
-			jwks: { keyPairConfig: { alg: "RS256", modulusLength: 2048 } },
-		}),
-	],
-}) as unknown as BetterAuthInstance;

package/src/schema/auth-schema.ts

@@ -1,101 +0,0 @@
-import { relations } from "drizzle-orm";
-import { boolean, index, pgTable, text, timestamp } from "drizzle-orm/pg-core";
-
-export const auth_user = pgTable("auth_user", {
-	id: text("id").primaryKey(),
-	name: text("name").notNull(),
-	email: text("email").notNull().unique(),
-	emailVerified: boolean("email_verified").default(false).notNull(),
-	image: text("image"),
-	createdAt: timestamp("created_at").defaultNow().notNull(),
-	updatedAt: timestamp("updated_at")
-		.defaultNow()
-		.$onUpdate(() => /* @__PURE__ */ new Date())
-		.notNull(),
-});
-
-export const auth_session = pgTable(
-	"auth_session",
-	{
-		id: text("id").primaryKey(),
-		expiresAt: timestamp("expires_at").notNull(),
-		token: text("token").notNull().unique(),
-		createdAt: timestamp("created_at").defaultNow().notNull(),
-		updatedAt: timestamp("updated_at")
-			.$onUpdate(() => /* @__PURE__ */ new Date())
-			.notNull(),
-		ipAddress: text("ip_address"),
-		userAgent: text("user_agent"),
-		userId: text("user_id")
-			.notNull()
-			.references(() => auth_user.id, { onDelete: "cascade" }),
-	},
-	(table) => [index("auth_session_userId_idx").on(table.userId)],
-);
-
-export const auth_account = pgTable(
-	"auth_account",
-	{
-		id: text("id").primaryKey(),
-		accountId: text("account_id").notNull(),
-		providerId: text("provider_id").notNull(),
-		userId: text("user_id")
-			.notNull()
-			.references(() => auth_user.id, { onDelete: "cascade" }),
-		accessToken: text("access_token"),
-		refreshToken: text("refresh_token"),
-		idToken: text("id_token"),
-		accessTokenExpiresAt: timestamp("access_token_expires_at"),
-		refreshTokenExpiresAt: timestamp("refresh_token_expires_at"),
-		scope: text("scope"),
-		password: text("password"),
-		createdAt: timestamp("created_at").defaultNow().notNull(),
-		updatedAt: timestamp("updated_at")
-			.$onUpdate(() => /* @__PURE__ */ new Date())
-			.notNull(),
-	},
-	(table) => [index("auth_account_userId_idx").on(table.userId)],
-);
-
-export const auth_verification = pgTable(
-	"auth_verification",
-	{
-		id: text("id").primaryKey(),
-		identifier: text("identifier").notNull(),
-		value: text("value").notNull(),
-		expiresAt: timestamp("expires_at").notNull(),
-		createdAt: timestamp("created_at").defaultNow().notNull(),
-		updatedAt: timestamp("updated_at")
-			.defaultNow()
-			.$onUpdate(() => /* @__PURE__ */ new Date())
-			.notNull(),
-	},
-	(table) => [index("auth_verification_identifier_idx").on(table.identifier)],
-);
-
-export const auth_jwks = pgTable("auth_jwks", {
-	id: text("id").primaryKey(),
-	publicKey: text("public_key").notNull(),
-	privateKey: text("private_key").notNull(),
-	createdAt: timestamp("created_at").notNull(),
-	expiresAt: timestamp("expires_at"),
-});
-
-export const auth_userRelations = relations(auth_user, ({ many }) => ({
-	auth_sessions: many(auth_session),
-	auth_accounts: many(auth_account),
-}));
-
-export const auth_sessionRelations = relations(auth_session, ({ one }) => ({
-	auth_user: one(auth_user, {
-		fields: [auth_session.userId],
-		references: [auth_user.id],
-	}),
-}));
-
-export const auth_accountRelations = relations(auth_account, ({ one }) => ({
-	auth_user: one(auth_user, {
-		fields: [auth_account.userId],
-		references: [auth_user.id],
-	}),
-}));

package/src/schema/meta-schema.ts

@@ -1,12 +0,0 @@
-import { sql } from "drizzle-orm";
-import { check, integer, pgTable, text, timestamp } from "drizzle-orm/pg-core";
-
-export const instance_owner = pgTable(
-	"instance_owner",
-	{
-		id: integer("id").primaryKey().default(1),
-		userId: text("user_id").notNull(),
-		claimedAt: timestamp("claimed_at").defaultNow().notNull(),
-	},
-	(table) => [check("instance_owner_singleton", sql`${table.id} = 1`)],
-);