@rimelight/auth 0.0.1

package/README.md

@@ -0,0 +1,19 @@
+# Rimelight Entertainment Workspace
+
+## Structure
+
+### Apps (`/packages`)
+
+- **`rimelight.com`**: The main company website.
+- **`starter.rimelight.com`**: Our standardized starter template for Astro websites.
+
+### Packages (`/packages`)
+
+- **`@rimelight/auth`**: Authentication and authorization utilities for the Rimelight ecosystem.
+- **`@rimelight/cli`**: The command line interface for managing Rimelight projects.
+- **`@rimelight/cms`**: Enterprise content management, block rendering, and wiki engine.
+- **`@rimelight/docs`**: Documentation components and utilities.
+- **`@rimelight/i18n`**: Internationalization and localization tools.
+- **`@rimelight/security`**: Astro security integration (CSP, SRI, and more).
+- **`@rimelight/seo`**: SEO utilities including sitemap, robots, and meta components.
+- **`@rimelight/ui`**: Our component library used in all our web projects.

package/package.json

@@ -0,0 +1,61 @@
+{
+  "name": "@rimelight/auth",
+  "version": "0.0.1",
+  "private": false,
+  "description": "Rimelight Entertainment's Authentication Package",
+  "homepage": "https://rimelight.com/docs",
+  "bugs": {
+    "url": "https://github.com/Rimelight-Entertainment/rimelight/issues"
+  },
+  "license": "MIT",
+  "author": {
+    "name": "Rimelight Entertainment"
+  },
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/Rimelight-Entertainment/rimelight.git"
+  },
+  "files": [
+    "src"
+  ],
+  "type": "module",
+  "exports": {
+    ".": "./src/index.ts",
+    "./server": "./src/server/index.ts",
+    "./client": "./src/client/index.ts",
+    "./permissions": "./src/permissions/index.ts",
+    "./schema/drizzle": "./src/schema/drizzle/index.ts",
+    "./plugins/reserved-usernames": "./src/plugins/reserved-usernames/index.ts",
+    "./plugins/discriminator-tag": "./src/plugins/discriminator-tag/index.ts",
+    "./plugins/synthetic-user": "./src/plugins/synthetic-user/index.ts",
+    "./plugins/construction-guest": "./src/plugins/construction-guest/index.ts"
+  },
+  "publishConfig": {
+    "access": "public"
+  },
+  "scripts": {
+    "check": "pnpm audit --audit-level=moderate && vp check --fix"
+  },
+  "dependencies": {
+    "@better-auth/drizzle-adapter": "1.6.30",
+    "better-auth": "1.6.30",
+    "drizzle-orm": "0.45.2"
+  },
+  "devDependencies": {
+    "@rimelight/config": "workspace:*"
+  },
+  "peerDependencies": {
+    "better-auth": ">=1.0.0",
+    "drizzle-orm": ">=0.30.0",
+    "hono": ">=4.12.34"
+  },
+  "peerDependenciesMeta": {
+    "hono": {
+      "optional": true
+    }
+  },
+  "engines": {
+    "node": ">=26.7.0"
+  },
+  "packageManager": "pnpm@11.22.0"
+}

package/src/client/index.ts

@@ -0,0 +1,3 @@
+import { createAuthClient } from "better-auth/client"
+
+export const createRimelightAuthClient = createAuthClient

package/src/index.ts

@@ -0,0 +1,6 @@
+export * from "./server/index"
+export * from "./permissions/index"
+export * from "./plugins/reserved-usernames/index"
+export * from "./plugins/synthetic-user/index"
+export * from "./plugins/construction-guest/index"
+export * from "./plugins/discriminator-tag/index"

package/src/permissions/index.ts

@@ -0,0 +1,27 @@
+import { createAccessControl } from "better-auth/plugins/access"
+import {
+  defaultStatements,
+  ownerAc,
+  adminAc,
+  memberAc
+} from "better-auth/plugins/organization/access"
+
+export { createAccessControl, defaultStatements, ownerAc, adminAc, memberAc }
+
+export interface CreatePermissionsOptions<TStatements extends Record<string, readonly string[]>> {
+  statements: TStatements
+}
+
+export function createPermissions<const TStatements extends Record<string, readonly string[]>>(
+  statements: TStatements
+) {
+  const mergedStatements = {
+    ...defaultStatements,
+    ...statements
+  }
+  const ac = createAccessControl(mergedStatements)
+  return {
+    ac,
+    statements: mergedStatements
+  }
+}

package/src/plugins/construction-guest/index.ts

@@ -0,0 +1,107 @@
+import { getCookie, setCookie } from "hono/cookie"
+
+export const CONSTRUCTION_GUEST_COOKIE = "rimelight-construction-guest"
+
+export type GuestEnv = {
+  CONSTRUCTION_GUEST_EMAIL?: string
+  CONSTRUCTION_GUEST_PASSWORD?: string
+  CONSTRUCTION_GUEST_SECRET?: string
+  BETTER_AUTH_SECRET?: string
+}
+
+const getConfig = (env?: GuestEnv) => ({
+  email: env?.CONSTRUCTION_GUEST_EMAIL ?? process.env.CONSTRUCTION_GUEST_EMAIL,
+  password: env?.CONSTRUCTION_GUEST_PASSWORD ?? process.env.CONSTRUCTION_GUEST_PASSWORD,
+  secret:
+    env?.CONSTRUCTION_GUEST_SECRET ??
+    process.env.CONSTRUCTION_GUEST_SECRET ??
+    env?.BETTER_AUTH_SECRET ??
+    process.env.BETTER_AUTH_SECRET
+})
+
+const encode = (value: Uint8Array) =>
+  btoa(String.fromCharCode(...value))
+    .replace(/\+/g, "-")
+    .replace(/\//g, "_")
+    .replace(/=+$/, "")
+
+const decode = (value: string) => {
+  const padded = value
+    .replace(/-/g, "+")
+    .replace(/_/g, "/")
+    .padEnd(Math.ceil(value.length / 4) * 4, "=")
+  return Uint8Array.from(atob(padded), (char) => char.charCodeAt(0))
+}
+
+const sign = async (payload: string, secret: string) => {
+  const key = await crypto.subtle.importKey(
+    "raw",
+    new TextEncoder().encode(secret),
+    { name: "HMAC", hash: "SHA-256" },
+    false,
+    ["sign", "verify"]
+  )
+  return {
+    key,
+    signature: await crypto.subtle.sign("HMAC", key, new TextEncoder().encode(payload))
+  }
+}
+
+export const isConstructionGuest = async (c: any) => {
+  const token = getCookie(c, CONSTRUCTION_GUEST_COOKIE)
+  const secret = getConfig(c.env).secret
+  if (!token || !secret) return false
+
+  try {
+    const [encodedPayload, encodedSignature] = token.split(".")
+    if (!encodedPayload || !encodedSignature) return false
+    const payload = new TextDecoder().decode(decode(encodedPayload))
+    const { key } = await sign(payload, secret)
+    const valid = await crypto.subtle.verify(
+      "HMAC",
+      key,
+      decode(encodedSignature),
+      new TextEncoder().encode(payload)
+    )
+    return valid && JSON.parse(payload).expiresAt > Date.now()
+  } catch {
+    return false
+  }
+}
+
+export const signInConstructionGuest = async (
+  c: any,
+  email: string,
+  password: string,
+  rememberMe = true
+) => {
+  const config = getConfig(c.env)
+  if (
+    !config.email ||
+    !config.password ||
+    !config.secret ||
+    email !== config.email ||
+    password !== config.password
+  ) {
+    return false
+  }
+
+  const payload = JSON.stringify({
+    email: config.email,
+    expiresAt: Date.now() + 1000 * 60 * 60 * 24 * 7
+  })
+  const { signature } = await sign(payload, config.secret)
+  setCookie(
+    c,
+    CONSTRUCTION_GUEST_COOKIE,
+    encode(new TextEncoder().encode(payload)) + "." + encode(new Uint8Array(signature)),
+    {
+      httpOnly: true,
+      secure: true,
+      sameSite: "Lax",
+      path: "/",
+      ...(rememberMe ? { maxAge: 60 * 60 * 24 * 7 } : {})
+    }
+  )
+  return true
+}

package/src/plugins/discriminator-tag/index.ts

@@ -0,0 +1,55 @@
+import { APIError } from "better-auth/api"
+import { normalizeUsername, RESTRICTED_SET } from "../reserved-usernames"
+import { eq, and, count } from "drizzle-orm"
+
+export interface TagHookOptions {
+  userTable?: any
+  restrictedSet?: Set<string>
+}
+
+export function createTagAndUsernameHook(db: any, userTable: any, options?: TagHookOptions) {
+  const restricted = options?.restrictedSet ?? RESTRICTED_SET
+
+  return async (userData: any, _ctx: any) => {
+    // 1. Normalize the username and check against the restricted set
+    const normalizedInput = normalizeUsername(userData.name)
+    if (restricted.has(normalizedInput)) {
+      throw new APIError("BAD_REQUEST", {
+        message: "This username is reserved for official use."
+      })
+    }
+
+    // 2. Generate a unique 4-digit discriminator tag
+    let uniqueTag = "0000"
+    const tryFindTag = async (attemptsLeft: number): Promise<string> => {
+      if (attemptsLeft <= 0) return "0000"
+      const newTag = Math.floor(Math.random() * 10000)
+        .toString()
+        .padStart(4, "0")
+
+      const result = await db
+        .select({ count: count() })
+        .from(userTable)
+        .where(and(eq(userTable.name, userData.name), eq(userTable.tag, newTag)))
+
+      const tagCount = result[0]?.count ?? 0
+      if (tagCount === 0) return newTag
+      return tryFindTag(attemptsLeft - 1)
+    }
+
+    uniqueTag = await tryFindTag(50)
+
+    if (uniqueTag === "0000") {
+      throw new APIError("INTERNAL_SERVER_ERROR", {
+        message: "Failed to generate a unique tag for this username. Please try again."
+      })
+    }
+
+    return {
+      data: {
+        ...userData,
+        tag: uniqueTag
+      }
+    }
+  }
+}

package/src/plugins/reserved-usernames/index.ts

@@ -0,0 +1,198 @@
+const HOMOGLYPH_MAP: Record<string, string> = {
+  "0": "o",
+  "1": "i",
+  "3": "e",
+  "4": "a",
+  "5": "s",
+  "7": "t",
+  "8": "b",
+  "9": "g",
+  "@": "a",
+  "!": "i",
+  "$": "s",
+  "|": "i"
+}
+
+export const normalizeUsername = (input: string): string => {
+  return input
+    .toLowerCase()
+    .split("")
+    .map((char) => HOMOGLYPH_MAP[char] || char)
+    .join("")
+    .replace(/[^a-z0-9]/g, "")
+}
+
+export const STANDARD_RESTRICTED_GROUPS = {
+  STAFF_ROLES: [
+    "admin",
+    "administrator",
+    "moderator",
+    "mod",
+    "staff",
+    "support",
+    "help",
+    "official",
+    "verified",
+    "system",
+    "root",
+    "bot",
+    "security",
+    "community",
+    "manager",
+    "dev",
+    "developer",
+    "designer",
+    "gamemaster",
+    "gm",
+    "assistant",
+    "coordinator",
+    "representative",
+    "agent",
+    "supervisor",
+    "executive",
+    "ambassador",
+    "expert",
+    "specialist",
+    "advocate",
+    "internal",
+    "employee",
+    "associate",
+    "webmaster",
+    "sysop",
+    "operator",
+    "host",
+    "referee",
+    "council",
+    "ceo",
+    "founder",
+    "owner"
+  ],
+  LEGAL_FINANCIAL: [
+    "checkout",
+    "subscribe",
+    "subscription",
+    "premium",
+    "vip",
+    "store",
+    "shop",
+    "marketplace",
+    "wallet",
+    "refund",
+    "invoice",
+    "payout",
+    "rewards",
+    "prize",
+    "giveaway",
+    "claims",
+    "verification",
+    "billing",
+    "payment",
+    "sales",
+    "marketing",
+    "legal",
+    "compliance",
+    "privacy",
+    "tos",
+    "terms",
+    "copyright",
+    "trademark",
+    "dmca",
+    "abuse",
+    "report"
+  ],
+  TECHNICAL: [
+    "null",
+    "undefined",
+    "nan",
+    "none",
+    "everyone",
+    "all",
+    "guest",
+    "user",
+    "test",
+    "tester",
+    "account",
+    "api",
+    "webhook",
+    "index",
+    "config",
+    "settings",
+    "profile",
+    "auth",
+    "login",
+    "signup",
+    "signin",
+    "logout",
+    "signout",
+    "localhost",
+    "ftp",
+    "smtp",
+    "pop3",
+    "imap",
+    "dns",
+    "proxy",
+    "cdn",
+    "static",
+    "assets",
+    "media",
+    "upload",
+    "download",
+    "docs",
+    "manual",
+    "guide",
+    "tutorial",
+    "error",
+    "404",
+    "500",
+    "maintenance",
+    "update",
+    "patch",
+    "changelog",
+    "status",
+    "db",
+    "database",
+    "sql",
+    "query",
+    "health",
+    "ping",
+    "metrics",
+    "logs",
+    "no-reply",
+    "noreply",
+    "donotreply",
+    "security-alert",
+    "mail",
+    "email",
+    "postmaster"
+  ],
+  LEETSPEAK: [
+    "4dmin",
+    "@dmin",
+    "st4ff",
+    "m0d",
+    "m0derator",
+    "4dm1n",
+    "4dmin1strator",
+    "m0d3rator",
+    "st4f",
+    "5upport",
+    "0fficial",
+    "v3rified",
+    "5ystem",
+    "r00t",
+    "b0t",
+    "s3curity",
+    "d3v",
+    "d3veloper",
+    "@dministrator",
+    "adm1n",
+    "adm1nistrator"
+  ]
+}
+
+export const createRestrictedUsernameSet = (customBlacklist: string[] = []): Set<string> => {
+  const base = Object.values(STANDARD_RESTRICTED_GROUPS).flat().concat(customBlacklist)
+  return new Set(base.map((name) => normalizeUsername(name)))
+}
+
+export const RESTRICTED_SET = createRestrictedUsernameSet()

package/src/plugins/synthetic-user/index.ts

@@ -0,0 +1,50 @@
+export interface CoreFields {
+  name: string
+  email: string
+  emailVerified: boolean | null
+  image: string | null
+  createdAt: Date
+  updatedAt: Date
+}
+
+export interface SyntheticUserData {
+  coreFields: CoreFields
+  additionalFields: Record<string, unknown>
+  id: string
+}
+
+export function createSyntheticUser({ coreFields, additionalFields, id }: SyntheticUserData) {
+  return {
+    ...coreFields,
+    role: "user",
+    banned: false,
+    banReason: null,
+    banExpires: null,
+    tag: typeof additionalFields.tag === "string" ? additionalFields.tag : "0000",
+    firstName: typeof additionalFields.firstName === "string" ? additionalFields.firstName : "",
+    lastName: typeof additionalFields.lastName === "string" ? additionalFields.lastName : "",
+    availability:
+      typeof additionalFields.availability === "string"
+        ? additionalFields.availability
+        : "available",
+    status: typeof additionalFields.status === "string" ? additionalFields.status : "",
+    publicKey:
+      typeof additionalFields.publicKey === "string" ? additionalFields.publicKey : undefined,
+    id
+  }
+}
+
+export function createSyntheticUserWrapper(userData: any) {
+  return createSyntheticUser({
+    coreFields: {
+      name: userData.name,
+      email: userData.email,
+      emailVerified: userData.emailVerified,
+      image: userData.image,
+      createdAt: userData.createdAt,
+      updatedAt: userData.createdAt
+    },
+    additionalFields: userData,
+    id: crypto.randomUUID()
+  })
+}

package/src/schema/drizzle/index.ts

@@ -0,0 +1,363 @@
+import { relations, sql } from "drizzle-orm"
+import {
+  type AnyPgColumn,
+  pgTable,
+  text,
+  uniqueIndex,
+  index,
+  boolean,
+  timestamp,
+  integer
+} from "drizzle-orm/pg-core"
+
+export type UserAvailability = "available" | "busy" | "away" | "offline" | (string & {})
+
+// ============================================================================
+// Core Auth Tables
+// ============================================================================
+
+export const user = pgTable(
+  "user",
+  {
+    id: text("id")
+      .$defaultFn(() => crypto.randomUUID())
+      .notNull()
+      .primaryKey(),
+    name: text("name").notNull(),
+    tag: text("tag").notNull().default("0000"),
+    email: text("email").notNull().unique(),
+    emailVerified: boolean("email_verified").default(false).notNull(),
+    image: text("image"),
+    firstName: text("first_name").notNull(),
+    lastName: text("last_name").notNull(),
+    availability: text("availability").$type<UserAvailability>().notNull().default("available"),
+    status: text("status"),
+    updatedAt: timestamp("updated_at").$onUpdate(() => new Date()),
+    createdAt: timestamp("created_at")
+      .$defaultFn(() => new Date())
+      .notNull(),
+    deletedAt: timestamp("deleted_at"),
+    role: text("role"),
+    banned: boolean("banned").default(false),
+    banReason: text("ban_reason"),
+    banExpires: timestamp("ban_expires"),
+    publicKey: text("public_key"),
+    encryptedPrivateKey: text("encrypted_private_key"),
+    derivationSalt: text("derivation_salt")
+  },
+  (table) => [uniqueIndex("user_name_tag_unique").on(table.name, table.tag)]
+)
+
+export const session = pgTable(
+  "session",
+  {
+    id: text("id")
+      .$defaultFn(() => crypto.randomUUID())
+      .notNull()
+      .primaryKey(),
+    expiresAt: timestamp("expires_at").notNull(),
+    token: text("token").notNull().unique(),
+    updatedAt: timestamp("updated_at").$onUpdate(() => new Date()),
+    createdAt: timestamp("created_at")
+      .$defaultFn(() => new Date())
+      .notNull(),
+    deletedAt: timestamp("deleted_at"),
+    ipAddress: text("ip_address"),
+    userAgent: text("user_agent"),
+    userId: text("user_id")
+      .notNull()
+      .references(() => user.id, { onDelete: "cascade" }),
+    impersonatedBy: text("impersonated_by"),
+    activeOrganizationId: text("active_organization_id"),
+    activeTeamId: text("active_team_id")
+  },
+  (table) => [index("session_userId_idx").on(table.userId)]
+)
+
+export const account = pgTable(
+  "account",
+  {
+    id: text("id")
+      .$defaultFn(() => crypto.randomUUID())
+      .notNull()
+      .primaryKey(),
+    accountId: text("account_id").notNull(),
+    providerId: text("provider_id").notNull(),
+    userId: text("user_id")
+      .notNull()
+      .references(() => user.id, { onDelete: "cascade" }),
+    accessToken: text("access_token"),
+    refreshToken: text("refresh_token"),
+    idToken: text("id_token"),
+    accessTokenExpiresAt: timestamp("access_token_expires_at"),
+    refreshTokenExpiresAt: timestamp("refresh_token_expires_at"),
+    scope: text("scope"),
+    password: text("password"),
+    updatedAt: timestamp("updated_at").$onUpdate(() => new Date()),
+    createdAt: timestamp("created_at")
+      .$defaultFn(() => new Date())
+      .notNull(),
+    deletedAt: timestamp("deleted_at")
+  },
+  (table) => [index("account_userId_idx").on(table.userId)]
+)
+
+export const verification = pgTable(
+  "verification",
+  {
+    id: text("id")
+      .$defaultFn(() => crypto.randomUUID())
+      .notNull()
+      .primaryKey(),
+    identifier: text("identifier").notNull(),
+    value: text("value").notNull(),
+    expiresAt: timestamp("expires_at").notNull(),
+    updatedAt: timestamp("updated_at").$onUpdate(() => new Date()),
+    createdAt: timestamp("created_at")
+      .$defaultFn(() => new Date())
+      .notNull(),
+    deletedAt: timestamp("deleted_at")
+  },
+  (table) => [index("verification_identifier_idx").on(table.identifier)]
+)
+
+export const rateLimit = pgTable("rate_limit", {
+  id: text("id")
+    .$defaultFn(() => crypto.randomUUID())
+    .notNull()
+    .primaryKey(),
+  key: text("key"),
+  count: integer("count"),
+  lastRequest: integer("last_request")
+})
+
+// ============================================================================
+// Organization Tables
+// ============================================================================
+
+export const organization = pgTable("organization", {
+  id: text("id")
+    .$defaultFn(() => crypto.randomUUID())
+    .notNull()
+    .primaryKey(),
+  name: text("name").notNull(),
+  slug: text("slug").notNull().unique(),
+  logo: text("logo"),
+  updatedAt: timestamp("updated_at").$onUpdate(() => new Date()),
+  createdAt: timestamp("created_at")
+    .$defaultFn(() => new Date())
+    .notNull(),
+  deletedAt: timestamp("deleted_at"),
+  metadata: text("metadata")
+})
+
+export const member = pgTable(
+  "member",
+  {
+    id: text("id")
+      .$defaultFn(() => crypto.randomUUID())
+      .notNull()
+      .primaryKey(),
+    organizationId: text("organization_id")
+      .notNull()
+      .references(() => organization.id, { onDelete: "cascade" }),
+    userId: text("user_id")
+      .notNull()
+      .references(() => user.id, { onDelete: "cascade" }),
+    role: text("role").default("member").notNull(),
+    updatedAt: timestamp("updated_at").$onUpdate(() => new Date()),
+    createdAt: timestamp("created_at")
+      .$defaultFn(() => new Date())
+      .notNull(),
+    deletedAt: timestamp("deleted_at")
+  },
+  (table) => [
+    index("member_organizationId_idx").on(table.organizationId),
+    index("member_userId_idx").on(table.userId)
+  ]
+)
+
+export const invitation = pgTable(
+  "invitation",
+  {
+    id: text("id")
+      .$defaultFn(() => crypto.randomUUID())
+      .notNull()
+      .primaryKey(),
+    organizationId: text("organization_id")
+      .notNull()
+      .references(() => organization.id, { onDelete: "cascade" }),
+    email: text("email").notNull(),
+    role: text("role"),
+    status: text("status").default("pending").notNull(),
+    expiresAt: timestamp("expires_at").notNull(),
+    updatedAt: timestamp("updated_at").$onUpdate(() => new Date()),
+    createdAt: timestamp("created_at")
+      .$defaultFn(() => new Date())
+      .notNull(),
+    deletedAt: timestamp("deleted_at"),
+    inviterId: text("inviter_id")
+      .notNull()
+      .references(() => user.id, { onDelete: "cascade" })
+  },
+  (table) => [
+    index("invitation_organizationId_idx").on(table.organizationId),
+    index("invitation_email_idx").on(table.email)
+  ]
+)
+
+export const team = pgTable(
+  "team",
+  {
+    id: text("id")
+      .$defaultFn(() => crypto.randomUUID())
+      .notNull()
+      .primaryKey(),
+    name: text("name").notNull(),
+    organizationId: text("organization_id")
+      .notNull()
+      .references(() => organization.id, { onDelete: "cascade" }),
+    parentId: text("parent_id").references((): AnyPgColumn => team.id, {
+      onDelete: "cascade"
+    }),
+    updatedAt: timestamp("updated_at").$onUpdate(() => new Date()),
+    createdAt: timestamp("created_at")
+      .$defaultFn(() => new Date())
+      .notNull(),
+    deletedAt: timestamp("deleted_at"),
+    metadata: text("metadata")
+  },
+  (table) => [index("team_organizationId_idx").on(table.organizationId)]
+)
+
+export const teamMember = pgTable("team_member", {
+  id: text("id")
+    .$defaultFn(() => crypto.randomUUID())
+    .notNull()
+    .primaryKey(),
+  teamId: text("team_id")
+    .notNull()
+    .references(() => team.id, { onDelete: "cascade" }),
+  userId: text("user_id")
+    .notNull()
+    .references(() => user.id, { onDelete: "cascade" }),
+  role: text("role").notNull(),
+  updatedAt: timestamp("updated_at").$onUpdate(() => new Date()),
+  createdAt: timestamp("created_at")
+    .$defaultFn(() => new Date())
+    .notNull(),
+  deletedAt: timestamp("deleted_at")
+})
+
+// ============================================================================
+// Relations
+// ============================================================================
+
+export const userRelations = relations(user, ({ many }) => ({
+  sessions: many(session),
+  accounts: many(account),
+  members: many(member),
+  invitations: many(invitation),
+  teamMembers: many(teamMember)
+}))
+
+export const sessionRelations = relations(session, ({ one }) => ({
+  user: one(user, {
+    fields: [session.userId],
+    references: [user.id]
+  })
+}))
+
+export const accountRelations = relations(account, ({ one }) => ({
+  user: one(user, {
+    fields: [account.userId],
+    references: [user.id]
+  })
+}))
+
+export const organizationRelations = relations(organization, ({ many }) => ({
+  members: many(member),
+  invitations: many(invitation),
+  teams: many(team)
+}))
+
+export const memberRelations = relations(member, ({ one }) => ({
+  organization: one(organization, {
+    fields: [member.organizationId],
+    references: [organization.id]
+  }),
+  user: one(user, {
+    fields: [member.userId],
+    references: [user.id]
+  })
+}))
+
+export const invitationRelations = relations(invitation, ({ one }) => ({
+  organization: one(organization, {
+    fields: [invitation.organizationId],
+    references: [organization.id]
+  }),
+  user: one(user, {
+    fields: [invitation.inviterId],
+    references: [user.id]
+  })
+}))
+
+export const teamRelations = relations(team, ({ one, many }) => ({
+  organization: one(organization, {
+    fields: [team.organizationId],
+    references: [organization.id]
+  }),
+  parentTeam: one(team, {
+    fields: [team.parentId],
+    references: [team.id],
+    relationName: "subteams"
+  }),
+  subteams: many(team, { relationName: "subteams" }),
+  members: many(teamMember)
+}))
+
+export const teamMemberRelations = relations(teamMember, ({ one }) => ({
+  team: one(team, {
+    fields: [teamMember.teamId],
+    references: [team.id]
+  }),
+  user: one(user, {
+    fields: [teamMember.userId],
+    references: [user.id]
+  })
+}))
+
+// ============================================================================
+// Roles & Permissions Tables
+// ============================================================================
+
+export const role = pgTable("role", {
+  id: text("id")
+    .$defaultFn(() => crypto.randomUUID())
+    .notNull()
+    .primaryKey(),
+  name: text("name").notNull().unique(),
+  displayName: text("display_name").notNull(),
+  description: text("description"),
+  permissions: text("permissions")
+    .$type<string[]>()
+    .notNull()
+    .default(sql`'[]'`),
+  updatedAt: timestamp("updated_at").$onUpdate(() => new Date()),
+  createdAt: timestamp("created_at")
+    .$defaultFn(() => new Date())
+    .notNull(),
+  deletedAt: timestamp("deleted_at")
+})
+
+export type User = typeof user.$inferSelect
+export type Session = typeof session.$inferSelect
+export type Account = typeof account.$inferSelect
+export type Verification = typeof verification.$inferSelect
+export type Organization = typeof organization.$inferSelect
+export type Member = typeof member.$inferSelect
+export type Invitation = typeof invitation.$inferSelect
+export type Team = typeof team.$inferSelect
+export type TeamMember = typeof teamMember.$inferSelect
+export type Role = typeof role.$inferSelect

package/src/server/index.ts

@@ -0,0 +1,148 @@
+import type { BetterAuthOptions } from "better-auth"
+import { betterAuth } from "better-auth"
+import { createSyntheticUserWrapper } from "../plugins/synthetic-user"
+import { createTagAndUsernameHook } from "../plugins/discriminator-tag"
+
+export interface RimelightAuthFactoryOptions {
+  database: BetterAuthOptions["database"]
+  db?: any
+  userTable?: any
+  emailHandlers?: {
+    sendVerificationEmail?: (data: any, request?: Request) => Promise<void>
+    sendPasswordResetEmail?: (data: any, request?: Request) => Promise<void>
+    sendExistingUserSignUpNotification?: (existingUser: any) => Promise<void>
+  }
+  additionalUserFields?: Record<string, any>
+  plugins?: BetterAuthOptions["plugins"]
+  statements?: any
+  advanced?: BetterAuthOptions["advanced"]
+  session?: BetterAuthOptions["session"]
+  rateLimit?: BetterAuthOptions["rateLimit"]
+  customDatabaseHooks?: BetterAuthOptions["databaseHooks"]
+  enableTagGenerator?: boolean
+  restrictedUsernameBlacklist?: string[]
+}
+
+export function createRimelightAuth(options: RimelightAuthFactoryOptions) {
+  const enableTag = options.enableTagGenerator ?? (options.db && options.userTable)
+
+  const defaultUserHooks =
+    enableTag && options.db && options.userTable
+      ? {
+          create: {
+            before: createTagAndUsernameHook(options.db, options.userTable)
+          }
+        }
+      : undefined
+
+  const emailAndPasswordConfig: BetterAuthOptions["emailAndPassword"] = {
+    enabled: true,
+    autoSignIn: false,
+    requireEmailVerification: true,
+    minPasswordLength: 8,
+    maxPasswordLength: 128,
+    customSyntheticUser: createSyntheticUserWrapper
+  }
+
+  if (options.emailHandlers?.sendPasswordResetEmail) {
+    emailAndPasswordConfig.sendResetPassword = options.emailHandlers.sendPasswordResetEmail
+  }
+  if (options.emailHandlers?.sendExistingUserSignUpNotification) {
+    const handler = options.emailHandlers.sendExistingUserSignUpNotification
+    emailAndPasswordConfig.onExistingUserSignUp = async (existingUser: any) => {
+      await handler(existingUser)
+    }
+  }
+
+  const emailVerificationConfig: BetterAuthOptions["emailVerification"] = {
+    autoSignInAfterVerification: true
+  }
+
+  if (options.emailHandlers?.sendVerificationEmail) {
+    emailVerificationConfig.sendVerificationEmail = options.emailHandlers.sendVerificationEmail
+  }
+
+  return betterAuth({
+    database: options.database,
+    emailAndPassword: emailAndPasswordConfig,
+    emailVerification: emailVerificationConfig,
+    user: {
+      changeEmail: {
+        enabled: true
+      },
+      deleteUser: {
+        enabled: true
+      },
+      additionalFields: {
+        tag: {
+          type: "string",
+          required: false,
+          input: false
+        },
+        firstName: {
+          type: "string",
+          required: true,
+          default: "",
+          input: true
+        },
+        lastName: {
+          type: "string",
+          required: true,
+          default: "",
+          input: true
+        },
+        role: {
+          type: "string",
+          required: false,
+          default: "user",
+          input: false
+        },
+        availability: {
+          type: "string",
+          required: false,
+          default: "available"
+        },
+        status: {
+          type: "string",
+          required: false,
+          default: ""
+        },
+        publicKey: {
+          type: "string",
+          required: false,
+          input: true
+        },
+        ...options.additionalUserFields
+      }
+    },
+    session: {
+      expiresIn: 60 * 60 * 24 * 7,
+      updateAge: 60 * 60 * 24,
+      freshAge: 60 * 15,
+      cookieCache: {
+        enabled: true,
+        maxAge: 60 * 5
+      },
+      ...options.session
+    },
+    rateLimit: {
+      window: 10,
+      max: 100,
+      storage: "database",
+      modelName: "rateLimit",
+      ...options.rateLimit
+    },
+    plugins: options.plugins ?? [],
+    auth: options.statements ? { statements: options.statements } : undefined,
+    advanced: {
+      useSecureCookies: process.env.NODE_ENV === "production",
+      cookiePrefix: "auth",
+      database: {
+        generateId: () => crypto.randomUUID()
+      },
+      ...options.advanced
+    },
+    databaseHooks:
+      options.customDatabaseHooks ?? (defaultUserHooks ? { user: defaultUserHooks } : undefined)
+  })
+}