@remit/auth-service 0.0.14 → 0.0.16

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@remit/auth-service",
-  "version": "0.0.14",
+  "version": "0.0.16",
   "description": "better-auth identity service for the self-host stack",
   "type": "module",
   "main": "src/index.ts",
@@ -17,6 +17,10 @@
     "./verifier": {
       "types": "./src/verifier.ts",
       "default": "./src/verifier.ts"
+    },
+    "./schema": {
+      "types": "./src/schema/auth-schema-sqlite.ts",
+      "default": "./src/schema/auth-schema-sqlite.ts"
     }
   },
   "scripts": {
@@ -29,7 +33,8 @@
     "tsx": "*"
   },
   "dependencies": {
-    "better-auth": "^1.6.23",
+    "@remit/logger": "*",
+    "better-auth": "^1.7.12",
     "better-sqlite3": "^12.11.1",
     "drizzle-orm": "^0.45.2",
     "jose": "^6.2.3",

package/src/auth.ts

@@ -6,9 +6,9 @@ import * as authSchemaSqlite from "./schema/auth-schema-sqlite.js";
 
 export interface AuthConfig {
 	/**
-	 * Path to the shared database file (RFC 036 D3). The identity tables live
-	 * beside the app tables and are driven through the drizzle adapter's
-	 * `sqlite` provider.
+	 * Path to the app database file (#1420). The identity tables live beside
+	 * the app tables and are driven through the drizzle adapter's `sqlite`
+	 * provider.
 	 */
 	connectionString: string;
 	secret: string;

package/src/config.ts

@@ -34,11 +34,14 @@ export interface DataConnectionConfig {
 
 /**
  * Resolve where identity data lives, from the same env vars the rest of the
- * self-host stack reads (RFC 036 D5). The identity tables share the app
- * database file, so the locator is `SQLITE_DB_PATH`.
+ * self-host stack reads (RFC 036 D5). The identity tables live in the app
+ * database, so the locator is `SQLITE_APP_DB_PATH`.
  */
 export const resolveDataConnectionConfig = (): DataConnectionConfig => ({
-	connectionString: required("SQLITE_DB_PATH", process.env.SQLITE_DB_PATH),
+	connectionString: required(
+		"SQLITE_APP_DB_PATH",
+		process.env.SQLITE_APP_DB_PATH,
+	),
 });
 
 /**

package/src/index.ts

@@ -16,6 +16,10 @@ export {
 	resolveVerifierConfig,
 	type VerifierConfig,
 } from "./config.js";
+export {
+	type AuthFetchHandler,
+	withRateLimitLogging,
+} from "./rate-limit-log.js";
 export {
 	createJwtVerifier,
 	extractBearerToken,

package/src/rate-limit-log.test.ts

@@ -0,0 +1,190 @@
+import assert from "node:assert/strict";
+import { mkdtempSync, rmSync } from "node:fs";
+import { tmpdir } from "node:os";
+import { join, resolve } from "node:path";
+import { after, before, describe, it } from "node:test";
+import type { Auth } from "./auth.js";
+import { CLIENT_IP_HEADER, createAuth } from "./auth.js";
+
+/**
+ * #441: better-auth answers a rate-limited request from inside its own router,
+ * so the stack log stayed completely silent while an instance was throttled.
+ * This drives the real handler until it really answers 429 and reads the line
+ * off the real logger — a stub handler would prove nothing about the seam the
+ * server actually mounts.
+ */
+
+process.env.LOG_LEVEL = "info";
+
+const originalWrite = process.stdout.write.bind(process.stdout);
+const written: string[] = [];
+let capturing = false;
+
+// The logger writes its lines through `process.stdout`. Writes pass through
+// while nothing is capturing, so the test runner's own output still reaches
+// the terminal.
+process.stdout.write = ((
+	chunk: string | Uint8Array,
+	...rest: unknown[]
+): boolean => {
+	if (capturing && typeof chunk === "string") {
+		written.push(chunk);
+		return true;
+	}
+	return (originalWrite as (...args: unknown[]) => boolean)(chunk, ...rest);
+}) as typeof process.stdout.write;
+
+const { withRateLimitLogging } = await import("./rate-limit-log.js");
+
+const SIGN_IN_MAX = 2;
+const MIGRATIONS = resolve(
+	import.meta.dirname,
+	"../../../deploy/vps/migrations-sqlite/app",
+);
+
+type Line = Record<string, unknown>;
+
+// better-auth writes its own advisories through console, so the captured
+// stream is not all JSON; only the structured lines are of interest here.
+const asJsonObject = (line: string): Line | null => {
+	try {
+		const parsed: unknown = JSON.parse(line);
+		return parsed !== null && typeof parsed === "object"
+			? (parsed as Line)
+			: null;
+	} catch {
+		return null;
+	}
+};
+
+const captured = (): Line[] =>
+	written
+		.join("")
+		.split("\n")
+		.map(asJsonObject)
+		.filter((line): line is Line => line !== null);
+
+const capture = async (emit: () => Promise<void>): Promise<Line[]> => {
+	written.length = 0;
+	capturing = true;
+	try {
+		await emit();
+	} finally {
+		capturing = false;
+	}
+	return captured();
+};
+
+const createDatabase = async (dir: string, name: string): Promise<string> => {
+	const path = join(dir, `${name}.db`);
+	const { default: Database } = await import("better-sqlite3");
+	const { drizzle } = await import("drizzle-orm/better-sqlite3");
+	const { migrate } = await import("drizzle-orm/better-sqlite3/migrator");
+	const sqlite = new Database(path);
+	migrate(drizzle(sqlite), { migrationsFolder: MIGRATIONS });
+	sqlite.close();
+	return path;
+};
+
+const signIn = (
+	handler: (request: Request) => Promise<Response>,
+	headers: Record<string, string>,
+) =>
+	handler(
+		new Request("http://localhost:3000/api/auth/sign-in/email", {
+			method: "POST",
+			headers: { "content-type": "application/json", ...headers },
+			body: JSON.stringify({
+				email: "nobody@example.com",
+				password: "a-sufficiently-long-password",
+			}),
+		}),
+	);
+
+describe("a rate-limited auth response is logged", () => {
+	const previousMax = process.env.BETTER_AUTH_RATE_LIMIT_SIGN_IN_MAX;
+	let dir: string;
+
+	before(() => {
+		process.env.BETTER_AUTH_RATE_LIMIT_SIGN_IN_MAX = String(SIGN_IN_MAX);
+		dir = mkdtempSync(join(tmpdir(), "remit-rate-limit-log-"));
+	});
+
+	after(() => {
+		if (previousMax === undefined) {
+			delete process.env.BETTER_AUTH_RATE_LIMIT_SIGN_IN_MAX;
+		} else {
+			process.env.BETTER_AUTH_RATE_LIMIT_SIGN_IN_MAX = previousMax;
+		}
+		rmSync(dir, { recursive: true, force: true });
+	});
+
+	const build = async (name: string): Promise<Auth> =>
+		createAuth({
+			connectionString: await createDatabase(dir, name),
+			secret: "rate-limit-log-test-secret-value-32chars",
+			baseURL: "http://localhost:3000",
+			selfSignUpEnabled: true,
+		});
+
+	it("names the endpoint and the address the limit is keyed on", async () => {
+		const handler = withRateLimitLogging(await build("logged"));
+		const client = { [CLIENT_IP_HEADER]: "203.0.113.50" };
+
+		let refused: Response | undefined;
+		const lines = await capture(async () => {
+			for (let attempt = 0; attempt <= SIGN_IN_MAX; attempt++) {
+				const response = await signIn(handler, client);
+				if (response.status === 429) {
+					refused = response;
+					break;
+				}
+			}
+		});
+
+		assert.equal(refused?.status, 429, "expected the budget to run out");
+
+		const line = lines.find(
+			(entry) => entry.msg === "Auth request rate limited",
+		);
+		assert.ok(line, `no rate-limit line in: ${JSON.stringify(lines)}`);
+		assert.equal(line.level, "warn");
+		assert.equal(line.endpoint, "/sign-in/email");
+		assert.equal(line.method, "POST");
+		assert.equal(line.clientIp, "203.0.113.50");
+		assert.equal(typeof line.retryAfterSeconds, "number");
+	});
+
+	it("says so when the edge resolved no address, so one bucket serves everyone", async () => {
+		const handler = withRateLimitLogging(await build("unresolved"));
+
+		const lines = await capture(async () => {
+			for (let attempt = 0; attempt <= SIGN_IN_MAX; attempt++) {
+				const response = await signIn(handler, {});
+				if (response.status === 429) break;
+			}
+		});
+
+		const line = lines.find(
+			(entry) => entry.msg === "Auth request rate limited",
+		);
+		assert.ok(line, `no rate-limit line in: ${JSON.stringify(lines)}`);
+		assert.equal(line.clientIp, "unresolved");
+	});
+
+	it("leaves an answered request alone", async () => {
+		const handler = withRateLimitLogging(await build("allowed"));
+
+		const lines = await capture(async () => {
+			const response = await signIn(handler, {
+				[CLIENT_IP_HEADER]: "198.51.100.60",
+			});
+			assert.equal(response.status, 401);
+		});
+
+		assert.equal(
+			lines.filter((entry) => entry.msg === "Auth request rate limited").length,
+			0,
+		);
+	});
+});

package/src/rate-limit-log.ts

@@ -0,0 +1,56 @@
+import { logger } from "@remit/logger";
+import type { Auth } from "./auth.js";
+import { CLIENT_IP_HEADER } from "./auth.js";
+import { AUTH_BASE_PATH } from "./config.js";
+
+export type AuthFetchHandler = Auth["handler"];
+
+const TOO_MANY_REQUESTS = 429;
+
+/** better-auth's own name for the seconds it wants the caller to wait. */
+const RETRY_AFTER_HEADER = "x-retry-after";
+
+const endpointOf = (url: string): string => {
+	const { pathname } = new URL(url);
+	if (!pathname.startsWith(AUTH_BASE_PATH)) return pathname;
+	return pathname.slice(AUTH_BASE_PATH.length) || "/";
+};
+
+const retryAfterSeconds = (response: Response): number | undefined => {
+	const raw = response.headers.get(RETRY_AFTER_HEADER);
+	if (raw === null) return undefined;
+	const seconds = Number(raw);
+	return Number.isFinite(seconds) ? seconds : undefined;
+};
+
+/**
+ * Wrap the better-auth fetch handler so a rate-limited answer leaves a line.
+ *
+ * better-auth enforces its limits inside the router it owns and answers 429
+ * before any route, hook or middleware of ours runs, so the response on its way
+ * out is the only place the event can be observed at all. Without this a
+ * throttled instance is silent on the operator's side while its users read the
+ * failure as having been signed out.
+ *
+ * `clientIp` is the bucket the limit is keyed on, not incidental context: the
+ * limits are per address, so it is what says whether one caller is looping or a
+ * whole office behind one NAT is sharing a budget. An absent header means the
+ * edge did not set it and better-auth has collapsed every caller onto one
+ * bucket, which is itself the thing to see.
+ */
+export const withRateLimitLogging =
+	(auth: { handler: AuthFetchHandler }): AuthFetchHandler =>
+	async (request: Request): Promise<Response> => {
+		const response = await auth.handler(request);
+		if (response.status !== TOO_MANY_REQUESTS) return response;
+		logger.warn(
+			{
+				endpoint: endpointOf(request.url),
+				method: request.method,
+				clientIp: request.headers.get(CLIENT_IP_HEADER) ?? "unresolved",
+				retryAfterSeconds: retryAfterSeconds(response),
+			},
+			"Auth request rate limited",
+		);
+		return response;
+	};

package/src/rate-limit.test.ts

@@ -9,7 +9,7 @@ import { CLIENT_IP_HEADER, createAuth } from "./auth.js";
 const SIGN_IN_MAX = 2;
 const MIGRATIONS = resolve(
 	import.meta.dirname,
-	"../../../deploy/vps/migrations-sqlite/auth",
+	"../../../deploy/vps/migrations-sqlite/app",
 );
 
 const createDatabase = async (dir: string, name: string): Promise<string> => {

package/src/schema/auth-schema-sqlite.ts

@@ -1,6 +1,6 @@
 // The five better-auth identity tables, in the shape better-auth's drizzle
 // adapter emits with `provider: "sqlite"`. Used to generate the committed
-// sqlite migrations (deploy/vps/migrations-sqlite/auth).
+// sqlite migrations (deploy/vps/migrations-sqlite/app).
 //
 // Hand-maintained, deliberately. The `@better-auth/cli generate` command no
 // longer emits this shape: it writes `mode: "timestamp_ms"` where these columns
@@ -104,4 +104,6 @@ export const auth_jwks = sqliteTable("auth_jwks", {
 	privateKey: text("private_key").notNull(),
 	createdAt: integer("created_at", { mode: "timestamp" }).notNull(),
 	expiresAt: integer("expires_at", { mode: "timestamp" }),
+	alg: text("alg"),
+	crv: text("crv"),
 });

package/src/signup.test.ts

@@ -35,26 +35,6 @@ const baseConfig = {
 };
 
 describe("createAuth self-signup gate", () => {
-	it("flips better-auth disableSignUp from the selfSignUpEnabled flag", async () => {
-		const open = await createAuth({ ...baseConfig, selfSignUpEnabled: true });
-		const closed = await createAuth({
-			...baseConfig,
-			selfSignUpEnabled: false,
-		});
-		assert.equal(open.options.emailAndPassword?.disableSignUp, false);
-		assert.equal(closed.options.emailAndPassword?.disableSignUp, true);
-	});
-
-	it("drives the sqlite drizzle provider", async () => {
-		const auth = await createAuth({
-			connectionString: ":memory:",
-			secret: baseConfig.secret,
-			baseURL: baseConfig.baseURL,
-			selfSignUpEnabled: true,
-		});
-		assert.equal(auth.options.emailAndPassword?.disableSignUp, false);
-	});
-
 	it("rejects a signup request server-side when disabled, before any DB access", async () => {
 		const auth = await createAuth({ ...baseConfig, selfSignUpEnabled: false });
 		const request = new Request(

package/src/schema/meta-schema-sqlite.ts

@@ -1,16 +0,0 @@
-// The instance-owner singleton, used to generate the committed SQLite
-// migrations (deploy/vps/migrations-sqlite/meta).
-import { sql } from "drizzle-orm";
-import { check, integer, sqliteTable, text } from "drizzle-orm/sqlite-core";
-
-export const instance_owner = sqliteTable(
-	"instance_owner",
-	{
-		id: integer("id").primaryKey().default(1),
-		userId: text("user_id").notNull(),
-		claimedAt: integer("claimed_at", { mode: "timestamp" })
-			.$defaultFn(() => /* @__PURE__ */ new Date())
-			.notNull(),
-	},
-	(table) => [check("instance_owner_singleton", sql`${table.id} = 1`)],
-);