@remit/auth-service 0.0.15 → 0.0.16

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@remit/auth-service",
-  "version": "0.0.15",
+  "version": "0.0.16",
   "description": "better-auth identity service for the self-host stack",
   "type": "module",
   "main": "src/index.ts",
@@ -17,6 +17,10 @@
     "./verifier": {
       "types": "./src/verifier.ts",
       "default": "./src/verifier.ts"
+    },
+    "./schema": {
+      "types": "./src/schema/auth-schema-sqlite.ts",
+      "default": "./src/schema/auth-schema-sqlite.ts"
     }
   },
   "scripts": {
@@ -29,8 +33,8 @@
     "tsx": "*"
   },
   "dependencies": {
-    "@remit/logger-lambda": "*",
-    "better-auth": "^1.6.23",
+    "@remit/logger": "*",
+    "better-auth": "^1.7.12",
     "better-sqlite3": "^12.11.1",
     "drizzle-orm": "^0.45.2",
     "jose": "^6.2.3",

package/src/auth.ts

@@ -6,9 +6,9 @@ import * as authSchemaSqlite from "./schema/auth-schema-sqlite.js";
 
 export interface AuthConfig {
 	/**
-	 * Path to the shared database file (RFC 036 D3). The identity tables live
-	 * beside the app tables and are driven through the drizzle adapter's
-	 * `sqlite` provider.
+	 * Path to the app database file (#1420). The identity tables live beside
+	 * the app tables and are driven through the drizzle adapter's `sqlite`
+	 * provider.
 	 */
 	connectionString: string;
 	secret: string;

package/src/config.ts

@@ -34,11 +34,14 @@ export interface DataConnectionConfig {
 
 /**
  * Resolve where identity data lives, from the same env vars the rest of the
- * self-host stack reads (RFC 036 D5). The identity tables share the app
- * database file, so the locator is `SQLITE_DB_PATH`.
+ * self-host stack reads (RFC 036 D5). The identity tables live in the app
+ * database, so the locator is `SQLITE_APP_DB_PATH`.
  */
 export const resolveDataConnectionConfig = (): DataConnectionConfig => ({
-	connectionString: required("SQLITE_DB_PATH", process.env.SQLITE_DB_PATH),
+	connectionString: required(
+		"SQLITE_APP_DB_PATH",
+		process.env.SQLITE_APP_DB_PATH,
+	),
 });
 
 /**

package/src/rate-limit-log.test.ts

@@ -15,16 +15,14 @@ import { CLIENT_IP_HEADER, createAuth } from "./auth.js";
  */
 
 process.env.LOG_LEVEL = "info";
-process.env.REMIT_SERVICE_NAME = "auth-service-test";
 
 const originalWrite = process.stdout.write.bind(process.stdout);
 const written: string[] = [];
 let capturing = false;
 
-// pino writes to `process.stdout` only when its `write` has been replaced, and
-// to the raw fd otherwise, so the hook must be installed before the module
-// under test imports the logger. Writes pass through while nothing is
-// capturing, so the test runner's own output still reaches the terminal.
+// The logger writes its lines through `process.stdout`. Writes pass through
+// while nothing is capturing, so the test runner's own output still reaches
+// the terminal.
 process.stdout.write = ((
 	chunk: string | Uint8Array,
 	...rest: unknown[]
@@ -41,13 +39,13 @@ const { withRateLimitLogging } = await import("./rate-limit-log.js");
 const SIGN_IN_MAX = 2;
 const MIGRATIONS = resolve(
 	import.meta.dirname,
-	"../../../deploy/vps/migrations-sqlite/auth",
+	"../../../deploy/vps/migrations-sqlite/app",
 );
 
 type Line = Record<string, unknown>;
 
 // better-auth writes its own advisories through console, so the captured
-// stream is not all pino JSON; only the structured lines are of interest here.
+// stream is not all JSON; only the structured lines are of interest here.
 const asJsonObject = (line: string): Line | null => {
 	try {
 		const parsed: unknown = JSON.parse(line);

package/src/rate-limit-log.ts

@@ -1,4 +1,4 @@
-import { logger } from "@remit/logger-lambda";
+import { logger } from "@remit/logger";
 import type { Auth } from "./auth.js";
 import { CLIENT_IP_HEADER } from "./auth.js";
 import { AUTH_BASE_PATH } from "./config.js";

package/src/rate-limit.test.ts

@@ -9,7 +9,7 @@ import { CLIENT_IP_HEADER, createAuth } from "./auth.js";
 const SIGN_IN_MAX = 2;
 const MIGRATIONS = resolve(
 	import.meta.dirname,
-	"../../../deploy/vps/migrations-sqlite/auth",
+	"../../../deploy/vps/migrations-sqlite/app",
 );
 
 const createDatabase = async (dir: string, name: string): Promise<string> => {

package/src/schema/auth-schema-sqlite.ts

@@ -1,6 +1,6 @@
 // The five better-auth identity tables, in the shape better-auth's drizzle
 // adapter emits with `provider: "sqlite"`. Used to generate the committed
-// sqlite migrations (deploy/vps/migrations-sqlite/auth).
+// sqlite migrations (deploy/vps/migrations-sqlite/app).
 //
 // Hand-maintained, deliberately. The `@better-auth/cli generate` command no
 // longer emits this shape: it writes `mode: "timestamp_ms"` where these columns
@@ -104,4 +104,6 @@ export const auth_jwks = sqliteTable("auth_jwks", {
 	privateKey: text("private_key").notNull(),
 	createdAt: integer("created_at", { mode: "timestamp" }).notNull(),
 	expiresAt: integer("expires_at", { mode: "timestamp" }),
+	alg: text("alg"),
+	crv: text("crv"),
 });

package/src/signup.test.ts

@@ -35,26 +35,6 @@ const baseConfig = {
 };
 
 describe("createAuth self-signup gate", () => {
-	it("flips better-auth disableSignUp from the selfSignUpEnabled flag", async () => {
-		const open = await createAuth({ ...baseConfig, selfSignUpEnabled: true });
-		const closed = await createAuth({
-			...baseConfig,
-			selfSignUpEnabled: false,
-		});
-		assert.equal(open.options.emailAndPassword?.disableSignUp, false);
-		assert.equal(closed.options.emailAndPassword?.disableSignUp, true);
-	});
-
-	it("drives the sqlite drizzle provider", async () => {
-		const auth = await createAuth({
-			connectionString: ":memory:",
-			secret: baseConfig.secret,
-			baseURL: baseConfig.baseURL,
-			selfSignUpEnabled: true,
-		});
-		assert.equal(auth.options.emailAndPassword?.disableSignUp, false);
-	});
-
 	it("rejects a signup request server-side when disabled, before any DB access", async () => {
 		const auth = await createAuth({ ...baseConfig, selfSignUpEnabled: false });
 		const request = new Request(

package/src/schema/meta-schema-sqlite.ts

@@ -1,16 +0,0 @@
-// The instance-owner singleton, used to generate the committed SQLite
-// migrations (deploy/vps/migrations-sqlite/meta).
-import { sql } from "drizzle-orm";
-import { check, integer, sqliteTable, text } from "drizzle-orm/sqlite-core";
-
-export const instance_owner = sqliteTable(
-	"instance_owner",
-	{
-		id: integer("id").primaryKey().default(1),
-		userId: text("user_id").notNull(),
-		claimedAt: integer("claimed_at", { mode: "timestamp" })
-			.$defaultFn(() => /* @__PURE__ */ new Date())
-			.notNull(),
-	},
-	(table) => [check("instance_owner_singleton", sql`${table.id} = 1`)],
-);