@samanhappy/mcphub 1.0.5 → 1.0.7

package/dist/services/betterAuthConfig.js

@@ -1,55 +1,158 @@
-import { loadSettings } from '../config/index.js';
+import { expandEnvVars, loadSettings } from '../config/index.js';
 import { getSystemConfigDao } from '../dao/DaoFactory.js';
 import { getCachedSystemConfig, isDatabaseModeEnabled } from '../utils/systemConfigCache.js';
 const DEFAULT_BETTER_AUTH_BASE_PATH = '/api/auth/better';
 const DEFAULT_OIDC_SCOPES = ['openid', 'profile', 'email'];
 const DEFAULT_OIDC_PROVIDER_ID = 'oidc';
+const VALID_OIDC_PROMPTS = new Set([
+    'none',
+    'login',
+    'create',
+    'consent',
+    'select_account',
+    'select_account consent',
+    'login consent',
+]);
+const parseBoolean = (value) => {
+    if (typeof value === 'boolean') {
+        return value;
+    }
+    if (typeof value !== 'string') {
+        return undefined;
+    }
+    const normalizedValue = value.trim().toLowerCase();
+    if (!normalizedValue) {
+        return undefined;
+    }
+    if (['true', '1', 'yes', 'on'].includes(normalizedValue)) {
+        return true;
+    }
+    if (['false', '0', 'no', 'off'].includes(normalizedValue)) {
+        return false;
+    }
+    return undefined;
+};
+const normalizeOptionalString = (value) => {
+    if (typeof value !== 'string') {
+        return undefined;
+    }
+    const trimmedValue = expandEnvVars(value).trim();
+    return trimmedValue || undefined;
+};
 const normalizePath = (value) => {
-    if (!value) {
+    const normalizedValue = normalizeOptionalString(value);
+    if (!normalizedValue) {
         return DEFAULT_BETTER_AUTH_BASE_PATH;
     }
-    return value.startsWith('/') ? value : `/${value}`;
+    return normalizedValue.startsWith('/') ? normalizedValue : `/${normalizedValue}`;
 };
 const normalizeTrustedOrigin = (value) => {
-    if (typeof value !== 'string') {
-        return null;
-    }
-    const trimmedValue = value.trim();
-    if (!trimmedValue) {
+    const normalizedValue = normalizeOptionalString(value);
+    if (!normalizedValue) {
         return null;
     }
     try {
-        return new URL(trimmedValue).origin;
+        return new URL(normalizedValue).origin;
     }
     catch {
         return null;
     }
 };
-const normalizeStringArray = (value, fallback = []) => {
-    const values = Array.isArray(value) ? value : fallback;
-    const normalized = values
-        .filter((item) => typeof item === 'string')
+const splitStringArray = (value) => {
+    const normalizedValue = expandEnvVars(value).trim();
+    if (!normalizedValue) {
+        return [];
+    }
+    if (normalizedValue.startsWith('[')) {
+        try {
+            const parsedValue = JSON.parse(normalizedValue);
+            if (Array.isArray(parsedValue)) {
+                return parsedValue
+                    .map((item) => normalizeOptionalString(item))
+                    .filter((item) => Boolean(item));
+            }
+        }
+        catch {
+            // Fall back to delimiter-based parsing below.
+        }
+    }
+    const delimiter = normalizedValue.includes(',') ? /,/ : /\s+/;
+    return normalizedValue
+        .split(delimiter)
         .map((item) => item.trim())
         .filter((item) => item.length > 0);
+};
+const normalizeStringArray = (value, fallback = []) => {
+    const normalized = Array.isArray(value)
+        ? value
+            .map((item) => normalizeOptionalString(item))
+            .filter((item) => Boolean(item))
+        : typeof value === 'string'
+            ? splitStringArray(value)
+            : [];
     return normalized.length > 0 ? normalized : fallback;
 };
-const normalizeOptionalString = (value) => {
-    if (typeof value !== 'string') {
+const normalizePrompt = (value) => {
+    const normalizedValue = normalizeOptionalString(value);
+    if (!normalizedValue || !VALID_OIDC_PROMPTS.has(normalizedValue)) {
         return undefined;
     }
-    const trimmedValue = value.trim();
-    return trimmedValue || undefined;
+    return normalizedValue;
+};
+const resolveBooleanSetting = (envValue, settingsValue, defaultValue) => {
+    const envOverride = parseBoolean(envValue);
+    if (envOverride !== undefined) {
+        return envOverride;
+    }
+    const settingsOverride = parseBoolean(settingsValue);
+    if (settingsOverride !== undefined) {
+        return settingsOverride;
+    }
+    return defaultValue;
+};
+const resolveStringSetting = (envValue, settingsValue, defaultValue) => {
+    const envOverride = normalizeOptionalString(envValue);
+    if (envOverride !== undefined) {
+        return envOverride;
+    }
+    const settingsOverride = normalizeOptionalString(settingsValue);
+    if (settingsOverride !== undefined) {
+        return settingsOverride;
+    }
+    return defaultValue;
+};
+const resolveStringArraySetting = (envValue, settingsValue, defaultValue = []) => {
+    if (envValue !== undefined) {
+        const envOverride = normalizeStringArray(envValue, []);
+        if (envOverride.length > 0) {
+            return envOverride;
+        }
+    }
+    const settingsOverride = normalizeStringArray(settingsValue, []);
+    if (settingsOverride.length > 0) {
+        return settingsOverride;
+    }
+    return defaultValue;
+};
+const resolvePromptSetting = (envValue, settingsValue) => {
+    const envOverride = normalizePrompt(envValue);
+    if (envOverride !== undefined) {
+        return envOverride;
+    }
+    return normalizePrompt(settingsValue);
 };
 export const resolveBetterAuthRuntimeConfig = (systemConfig) => {
     const betterAuthSettings = systemConfig?.auth?.betterAuth || {};
-    const databaseModeEnabled = isDatabaseModeEnabled();
-    const enabled = Boolean(betterAuthSettings.enabled ?? true) && databaseModeEnabled;
-    const basePath = normalizePath(betterAuthSettings.basePath || DEFAULT_BETTER_AUTH_BASE_PATH);
     const providerSettings = betterAuthSettings.providers || {};
+    const oidcSettings = providerSettings.oidc || {};
+    const databaseModeEnabled = isDatabaseModeEnabled();
+    const betterAuthEnabled = resolveBooleanSetting(process.env.BETTER_AUTH_ENABLED, betterAuthSettings.enabled, true) &&
+        databaseModeEnabled;
+    const basePath = normalizePath(resolveStringSetting(process.env.BETTER_AUTH_BASE_PATH, betterAuthSettings.basePath));
+    const trustedOriginSettings = resolveStringArraySetting(process.env.BETTER_AUTH_TRUSTED_ORIGINS, betterAuthSettings.trustedOrigins, []);
     const trustedOrigins = Array.from(new Set([
-        ...(Array.isArray(betterAuthSettings.trustedOrigins)
-            ? betterAuthSettings.trustedOrigins
-            : []),
+        ...trustedOriginSettings,
+        process.env.BETTER_AUTH_URL,
         systemConfig?.install?.baseUrl,
     ]
         .map((value) => normalizeTrustedOrigin(value))
@@ -57,19 +160,29 @@ export const resolveBetterAuthRuntimeConfig = (systemConfig) => {
     const googleEnvConfigured = Boolean(process.env.GOOGLE_CLIENT_ID && process.env.GOOGLE_CLIENT_SECRET);
     const githubEnvConfigured = Boolean(process.env.GITHUB_CLIENT_ID && process.env.GITHUB_CLIENT_SECRET);
     const oidcEnvConfigured = Boolean(process.env.OIDC_CLIENT_ID && process.env.OIDC_CLIENT_SECRET);
-    const oidcSettings = providerSettings.oidc || {};
-    const oidcDiscoveryUrl = normalizeOptionalString(oidcSettings.discoveryUrl);
-    const oidcEnabled = enabled &&
-        Boolean(oidcSettings.enabled) &&
+    const oidcDiscoveryUrl = resolveStringSetting(process.env.BETTER_AUTH_OIDC_DISCOVERY_URL, resolveStringSetting(process.env.OIDC_DISCOVERY_URL, oidcSettings.discoveryUrl));
+    const oidcProviderId = resolveStringSetting(process.env.BETTER_AUTH_OIDC_PROVIDER_ID, oidcSettings.providerId, DEFAULT_OIDC_PROVIDER_ID) || DEFAULT_OIDC_PROVIDER_ID;
+    const oidcScopes = resolveStringArraySetting(process.env.BETTER_AUTH_OIDC_SCOPES, oidcSettings.scopes, DEFAULT_OIDC_SCOPES);
+    const oidcPkce = resolveBooleanSetting(process.env.BETTER_AUTH_OIDC_PKCE, oidcSettings.pkce, true);
+    const oidcPrompt = resolvePromptSetting(process.env.BETTER_AUTH_OIDC_PROMPT, oidcSettings.prompt);
+    const oidcEnabledSetting = resolveBooleanSetting(process.env.BETTER_AUTH_OIDC_ENABLED, oidcSettings.enabled, false);
+    const oidcEnabled = betterAuthEnabled &&
+        oidcEnabledSetting &&
         Boolean(oidcDiscoveryUrl) &&
         oidcEnvConfigured;
-    const googleEnabled = enabled && Boolean(providerSettings.google?.enabled ?? true) && googleEnvConfigured;
-    const githubEnabled = enabled && Boolean(providerSettings.github?.enabled ?? true) && githubEnvConfigured;
+    const googleEnabled = betterAuthEnabled &&
+        resolveBooleanSetting(process.env.BETTER_AUTH_GOOGLE_ENABLED, providerSettings.google?.enabled, true) &&
+        googleEnvConfigured;
+    const githubEnabled = betterAuthEnabled &&
+        resolveBooleanSetting(process.env.BETTER_AUTH_GITHUB_ENABLED, providerSettings.github?.enabled, true) &&
+        githubEnvConfigured;
     const anyProviderEnabled = googleEnabled || githubEnabled || oidcEnabled;
+    const disableAutoCreate = resolveBooleanSetting(process.env.BETTER_AUTH_DISABLE_AUTO_CREATE, betterAuthSettings.disableAutoCreate, false);
     return {
         enabled: anyProviderEnabled,
         basePath,
         trustedOrigins,
+        disableAutoCreate,
         providers: {
             google: {
                 enabled: googleEnabled,
@@ -79,11 +192,11 @@ export const resolveBetterAuthRuntimeConfig = (systemConfig) => {
             },
             oidc: {
                 enabled: oidcEnabled,
-                providerId: normalizeOptionalString(oidcSettings.providerId) || DEFAULT_OIDC_PROVIDER_ID,
+                providerId: oidcProviderId,
                 discoveryUrl: oidcDiscoveryUrl,
-                scopes: normalizeStringArray(oidcSettings.scopes, DEFAULT_OIDC_SCOPES),
-                pkce: oidcSettings.pkce ?? true,
-                prompt: normalizeOptionalString(oidcSettings.prompt),
+                scopes: oidcScopes,
+                pkce: oidcPkce,
+                prompt: oidcPrompt,
             },
         },
     };

package/dist/services/betterAuthConfig.js.map

@@ -1 +1 @@
-{"version":3,"file":"betterAuthConfig.js","sourceRoot":"","sources":["../../src/services/betterAuthConfig.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAClD,OAAO,EAAE,kBAAkB,EAAE,MAAM,sBAAsB,CAAC;AAE1D,OAAO,EAAE,qBAAqB,EAAE,qBAAqB,EAAE,MAAM,+BAA+B,CAAC;AAE7F,MAAM,6BAA6B,GAAG,kBAAkB,CAAC;AACzD,MAAM,mBAAmB,GAAG,CAAC,QAAQ,EAAE,SAAS,EAAE,OAAO,CAAC,CAAC;AAC3D,MAAM,wBAAwB,GAAG,MAAM,CAAC;AAwBxC,MAAM,aAAa,GAAG,CAAC,KAAa,EAAU,EAAE;IAC9C,IAAI,CAAC,KAAK,EAAE,CAAC;QACX,OAAO,6BAA6B,CAAC;IACvC,CAAC;IACD,OAAO,KAAK,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,KAAK,EAAE,CAAC;AACrD,CAAC,CAAC;AAEF,MAAM,sBAAsB,GAAG,CAAC,KAAc,EAAiB,EAAE;IAC/D,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QAC9B,OAAO,IAAI,CAAC;IACd,CAAC;IAED,MAAM,YAAY,GAAG,KAAK,CAAC,IAAI,EAAE,CAAC;IAClC,IAAI,CAAC,YAAY,EAAE,CAAC;QAClB,OAAO,IAAI,CAAC;IACd,CAAC;IAED,IAAI,CAAC;QACH,OAAO,IAAI,GAAG,CAAC,YAAY,CAAC,CAAC,MAAM,CAAC;IACtC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC,CAAC;AAEF,MAAM,oBAAoB,GAAG,CAAC,KAAc,EAAE,WAAqB,EAAE,EAAY,EAAE;IACjF,MAAM,MAAM,GAAG,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,QAAQ,CAAC;IACvD,MAAM,UAAU,GAAG,MAAM;SACtB,MAAM,CAAC,CAAC,IAAI,EAAkB,EAAE,CAAC,OAAO,IAAI,KAAK,QAAQ,CAAC;SAC1D,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC;SAC1B,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;IAErC,OAAO,UAAU,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,QAAQ,CAAC;AACvD,CAAC,CAAC;AAEF,MAAM,uBAAuB,GAAG,CAAC,KAAc,EAAsB,EAAE;IACrE,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QAC9B,OAAO,SAAS,CAAC;IACnB,CAAC;IAED,MAAM,YAAY,GAAG,KAAK,CAAC,IAAI,EAAE,CAAC;IAClC,OAAO,YAAY,IAAI,SAAS,CAAC;AACnC,CAAC,CAAC;AAEF,MAAM,CAAC,MAAM,8BAA8B,GAAG,CAC5C,YAAkC,EACT,EAAE;IAC3B,MAAM,kBAAkB,GAAqB,YAAY,EAAE,IAAI,EAAE,UAAU,IAAI,EAAE,CAAC;IAClF,MAAM,mBAAmB,GAAG,qBAAqB,EAAE,CAAC;IACpD,MAAM,OAAO,GAAG,OAAO,CAAC,kBAAkB,CAAC,OAAO,IAAI,IAAI,CAAC,IAAI,mBAAmB,CAAC;IACnF,MAAM,QAAQ,GAAG,aAAa,CAAC,kBAAkB,CAAC,QAAQ,IAAI,6BAA6B,CAAC,CAAC;IAC7F,MAAM,gBAAgB,GAAG,kBAAkB,CAAC,SAAS,IAAI,EAAE,CAAC;IAC5D,MAAM,cAAc,GAAG,KAAK,CAAC,IAAI,CAC/B,IAAI,GAAG,CACL;QACE,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,kBAAkB,CAAC,cAAc,CAAC;YAClD,CAAC,CAAC,kBAAkB,CAAC,cAAc;YACnC,CAAC,CAAC,EAAE,CAAC;QACP,YAAY,EAAE,OAAO,EAAE,OAAO;KAC/B;SACE,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,sBAAsB,CAAC,KAAK,CAAC,CAAC;SAC7C,MAAM,CAAC,CAAC,KAAK,EAAmB,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CACtD,CACF,CAAC;IAEF,MAAM,mBAAmB,GAAG,OAAO,CACjC,OAAO,CAAC,GAAG,CAAC,gBAAgB,IAAI,OAAO,CAAC,GAAG,CAAC,oBAAoB,CACjE,CAAC;IACF,MAAM,mBAAmB,GAAG,OAAO,CACjC,OAAO,CAAC,GAAG,CAAC,gBAAgB,IAAI,OAAO,CAAC,GAAG,CAAC,oBAAoB,CACjE,CAAC;IACF,MAAM,iBAAiB,GAAG,OAAO,CAC/B,OAAO,CAAC,GAAG,CAAC,cAAc,IAAI,OAAO,CAAC,GAAG,CAAC,kBAAkB,CAC7D,CAAC;IACF,MAAM,YAAY,GAAG,gBAAgB,CAAC,IAAI,IAAI,EAAE,CAAC;IACjD,MAAM,gBAAgB,GAAG,uBAAuB,CAAC,YAAY,CAAC,YAAY,CAAC,CAAC;IAC5E,MAAM,WAAW,GACf,OAAO;QACP,OAAO,CAAC,YAAY,CAAC,OAAO,CAAC;QAC7B,OAAO,CAAC,gBAAgB,CAAC;QACzB,iBAAiB,CAAC;IAEpB,MAAM,aAAa,GACjB,OAAO,IAAI,OAAO,CAAC,gBAAgB,CAAC,MAAM,EAAE,OAAO,IAAI,IAAI,CAAC,IAAI,mBAAmB,CAAC;IACtF,MAAM,aAAa,GACjB,OAAO,IAAI,OAAO,CAAC,gBAAgB,CAAC,MAAM,EAAE,OAAO,IAAI,IAAI,CAAC,IAAI,mBAAmB,CAAC;IAEtF,MAAM,kBAAkB,GAAG,aAAa,IAAI,aAAa,IAAI,WAAW,CAAC;IAEzE,OAAO;QACL,OAAO,EAAE,kBAAkB;QAC3B,QAAQ;QACR,cAAc;QACd,SAAS,EAAE;YACT,MAAM,EAAE;gBACN,OAAO,EAAE,aAAa;aACvB;YACD,MAAM,EAAE;gBACN,OAAO,EAAE,aAAa;aACvB;YACD,IAAI,EAAE;gBACJ,OAAO,EAAE,WAAW;gBACpB,UAAU,EAAE,uBAAuB,CAAC,YAAY,CAAC,UAAU,CAAC,IAAI,wBAAwB;gBACxF,YAAY,EAAE,gBAAgB;gBAC9B,MAAM,EAAE,oBAAoB,CAAC,YAAY,CAAC,MAAM,EAAE,mBAAmB,CAAC;gBACtE,IAAI,EAAE,YAAY,CAAC,IAAI,IAAI,IAAI;gBAC/B,MAAM,EAAE,uBAAuB,CAAC,YAAY,CAAC,MAAM,CAA2C;aAC/F;SACF;KACF,CAAC;AACJ,CAAC,CAAC;AAEF,MAAM,CAAC,MAAM,0BAA0B,GAAG,KAAK,EAC7C,oBAA0C,EACR,EAAE;IACpC,IAAI,oBAAoB,KAAK,SAAS,EAAE,CAAC;QACvC,OAAO,8BAA8B,CAAC,oBAAoB,CAAC,CAAC;IAC9D,CAAC;IAED,MAAM,YAAY,GAAG,MAAM,kBAAkB,EAAE,CAAC,GAAG,EAAE,CAAC;IACtD,OAAO,8BAA8B,CAAC,YAAY,CAAC,CAAC;AACtD,CAAC,CAAC;AAEF,MAAM,CAAC,MAAM,uBAAuB,GAAG,CAAC,GAAG,EAAE;IAC3C,MAAM,kBAAkB,GAAG,qBAAqB,EAAE,CAAC;IACnD,IAAI,kBAAkB,EAAE,CAAC;QACvB,OAAO,8BAA8B,CAAC,kBAAkB,CAAC,CAAC;IAC5D,CAAC;IAED,IAAI,CAAC,qBAAqB,EAAE,EAAE,CAAC;QAC7B,MAAM,QAAQ,GAAG,YAAY,EAAE,CAAC;QAChC,OAAO,8BAA8B,CAAC,QAAQ,CAAC,YAAY,IAAI,IAAI,CAAC,CAAC;IACvE,CAAC;IAED,OAAO,8BAA8B,CAAC,IAAI,CAAC,CAAC;AAC9C,CAAC,CAAC,EAAE,CAAC"}
+{"version":3,"file":"betterAuthConfig.js","sourceRoot":"","sources":["../../src/services/betterAuthConfig.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,aAAa,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AACjE,OAAO,EAAE,kBAAkB,EAAE,MAAM,sBAAsB,CAAC;AAE1D,OAAO,EAAE,qBAAqB,EAAE,qBAAqB,EAAE,MAAM,+BAA+B,CAAC;AAE7F,MAAM,6BAA6B,GAAG,kBAAkB,CAAC;AACzD,MAAM,mBAAmB,GAAG,CAAC,QAAQ,EAAE,SAAS,EAAE,OAAO,CAAC,CAAC;AAC3D,MAAM,wBAAwB,GAAG,MAAM,CAAC;AACxC,MAAM,kBAAkB,GAAG,IAAI,GAAG,CAAS;IACzC,MAAM;IACN,OAAO;IACP,QAAQ;IACR,SAAS;IACT,gBAAgB;IAChB,wBAAwB;IACxB,eAAe;CAChB,CAAC,CAAC;AAyBH,MAAM,YAAY,GAAG,CAAC,KAAc,EAAuB,EAAE;IAC3D,IAAI,OAAO,KAAK,KAAK,SAAS,EAAE,CAAC;QAC/B,OAAO,KAAK,CAAC;IACf,CAAC;IAED,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QAC9B,OAAO,SAAS,CAAC;IACnB,CAAC;IAED,MAAM,eAAe,GAAG,KAAK,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;IACnD,IAAI,CAAC,eAAe,EAAE,CAAC;QACrB,OAAO,SAAS,CAAC;IACnB,CAAC;IAED,IAAI,CAAC,MAAM,EAAE,GAAG,EAAE,KAAK,EAAE,IAAI,CAAC,CAAC,QAAQ,CAAC,eAAe,CAAC,EAAE,CAAC;QACzD,OAAO,IAAI,CAAC;IACd,CAAC;IAED,IAAI,CAAC,OAAO,EAAE,GAAG,EAAE,IAAI,EAAE,KAAK,CAAC,CAAC,QAAQ,CAAC,eAAe,CAAC,EAAE,CAAC;QAC1D,OAAO,KAAK,CAAC;IACf,CAAC;IAED,OAAO,SAAS,CAAC;AACnB,CAAC,CAAC;AAEF,MAAM,uBAAuB,GAAG,CAAC,KAAc,EAAsB,EAAE;IACrE,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QAC9B,OAAO,SAAS,CAAC;IACnB,CAAC;IAED,MAAM,YAAY,GAAG,aAAa,CAAC,KAAK,CAAC,CAAC,IAAI,EAAE,CAAC;IACjD,OAAO,YAAY,IAAI,SAAS,CAAC;AACnC,CAAC,CAAC;AAEF,MAAM,aAAa,GAAG,CAAC,KAAc,EAAU,EAAE;IAC/C,MAAM,eAAe,GAAG,uBAAuB,CAAC,KAAK,CAAC,CAAC;IACvD,IAAI,CAAC,eAAe,EAAE,CAAC;QACrB,OAAO,6BAA6B,CAAC;IACvC,CAAC;IACD,OAAO,eAAe,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,eAAe,CAAC,CAAC,CAAC,IAAI,eAAe,EAAE,CAAC;AACnF,CAAC,CAAC;AAEF,MAAM,sBAAsB,GAAG,CAAC,KAAc,EAAiB,EAAE;IAC/D,MAAM,eAAe,GAAG,uBAAuB,CAAC,KAAK,CAAC,CAAC;IACvD,IAAI,CAAC,eAAe,EAAE,CAAC;QACrB,OAAO,IAAI,CAAC;IACd,CAAC;IAED,IAAI,CAAC;QACH,OAAO,IAAI,GAAG,CAAC,eAAe,CAAC,CAAC,MAAM,CAAC;IACzC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC,CAAC;AAEF,MAAM,gBAAgB,GAAG,CAAC,KAAa,EAAY,EAAE;IACnD,MAAM,eAAe,GAAG,aAAa,CAAC,KAAK,CAAC,CAAC,IAAI,EAAE,CAAC;IACpD,IAAI,CAAC,eAAe,EAAE,CAAC;QACrB,OAAO,EAAE,CAAC;IACZ,CAAC;IAED,IAAI,eAAe,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;QACpC,IAAI,CAAC;YACH,MAAM,WAAW,GAAG,IAAI,CAAC,KAAK,CAAC,eAAe,CAAC,CAAC;YAChD,IAAI,KAAK,CAAC,OAAO,CAAC,WAAW,CAAC,EAAE,CAAC;gBAC/B,OAAO,WAAW;qBACf,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,uBAAuB,CAAC,IAAI,CAAC,CAAC;qBAC5C,MAAM,CAAC,CAAC,IAAI,EAAkB,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC;YACrD,CAAC;QACH,CAAC;QAAC,MAAM,CAAC;YACP,8CAA8C;QAChD,CAAC;IACH,CAAC;IAED,MAAM,SAAS,GAAG,eAAe,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,KAAK,CAAC;IAC9D,OAAO,eAAe;SACnB,KAAK,CAAC,SAAS,CAAC;SAChB,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC;SAC1B,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;AACvC,CAAC,CAAC;AAEF,MAAM,oBAAoB,GAAG,CAAC,KAAc,EAAE,WAAqB,EAAE,EAAY,EAAE;IACjF,MAAM,UAAU,GAAG,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;QACrC,CAAC,CAAC,KAAK;aACF,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,uBAAuB,CAAC,IAAI,CAAC,CAAC;aAC5C,MAAM,CAAC,CAAC,IAAI,EAAkB,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;QACpD,CAAC,CAAC,OAAO,KAAK,KAAK,QAAQ;YACzB,CAAC,CAAC,gBAAgB,CAAC,KAAK,CAAC;YACzB,CAAC,CAAC,EAAE,CAAC;IAET,OAAO,UAAU,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,QAAQ,CAAC;AACvD,CAAC,CAAC;AAEF,MAAM,eAAe,GAAG,CACtB,KAAc,EACsC,EAAE;IACtD,MAAM,eAAe,GAAG,uBAAuB,CAAC,KAAK,CAAC,CAAC;IACvD,IAAI,CAAC,eAAe,IAAI,CAAC,kBAAkB,CAAC,GAAG,CAAC,eAAe,CAAC,EAAE,CAAC;QACjE,OAAO,SAAS,CAAC;IACnB,CAAC;IAED,OAAO,eAAyD,CAAC;AACnE,CAAC,CAAC;AAEF,MAAM,qBAAqB,GAAG,CAC5B,QAA4B,EAC5B,aAAsB,EACtB,YAAqB,EACZ,EAAE;IACX,MAAM,WAAW,GAAG,YAAY,CAAC,QAAQ,CAAC,CAAC;IAC3C,IAAI,WAAW,KAAK,SAAS,EAAE,CAAC;QAC9B,OAAO,WAAW,CAAC;IACrB,CAAC;IAED,MAAM,gBAAgB,GAAG,YAAY,CAAC,aAAa,CAAC,CAAC;IACrD,IAAI,gBAAgB,KAAK,SAAS,EAAE,CAAC;QACnC,OAAO,gBAAgB,CAAC;IAC1B,CAAC;IAED,OAAO,YAAY,CAAC;AACtB,CAAC,CAAC;AAEF,MAAM,oBAAoB,GAAG,CAC3B,QAA4B,EAC5B,aAAsB,EACtB,YAAqB,EACD,EAAE;IACtB,MAAM,WAAW,GAAG,uBAAuB,CAAC,QAAQ,CAAC,CAAC;IACtD,IAAI,WAAW,KAAK,SAAS,EAAE,CAAC;QAC9B,OAAO,WAAW,CAAC;IACrB,CAAC;IAED,MAAM,gBAAgB,GAAG,uBAAuB,CAAC,aAAa,CAAC,CAAC;IAChE,IAAI,gBAAgB,KAAK,SAAS,EAAE,CAAC;QACnC,OAAO,gBAAgB,CAAC;IAC1B,CAAC;IAED,OAAO,YAAY,CAAC;AACtB,CAAC,CAAC;AAEF,MAAM,yBAAyB,GAAG,CAChC,QAA4B,EAC5B,aAAsB,EACtB,eAAyB,EAAE,EACjB,EAAE;IACZ,IAAI,QAAQ,KAAK,SAAS,EAAE,CAAC;QAC3B,MAAM,WAAW,GAAG,oBAAoB,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC;QACvD,IAAI,WAAW,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YAC3B,OAAO,WAAW,CAAC;QACrB,CAAC;IACH,CAAC;IAED,MAAM,gBAAgB,GAAG,oBAAoB,CAAC,aAAa,EAAE,EAAE,CAAC,CAAC;IACjE,IAAI,gBAAgB,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAChC,OAAO,gBAAgB,CAAC;IAC1B,CAAC;IAED,OAAO,YAAY,CAAC;AACtB,CAAC,CAAC;AAEF,MAAM,oBAAoB,GAAG,CAC3B,QAA4B,EAC5B,aAAsB,EAC8B,EAAE;IACtD,MAAM,WAAW,GAAG,eAAe,CAAC,QAAQ,CAAC,CAAC;IAC9C,IAAI,WAAW,KAAK,SAAS,EAAE,CAAC;QAC9B,OAAO,WAAW,CAAC;IACrB,CAAC;IAED,OAAO,eAAe,CAAC,aAAa,CAAC,CAAC;AACxC,CAAC,CAAC;AAEF,MAAM,CAAC,MAAM,8BAA8B,GAAG,CAC5C,YAAkC,EACT,EAAE;IAC3B,MAAM,kBAAkB,GAAqB,YAAY,EAAE,IAAI,EAAE,UAAU,IAAI,EAAE,CAAC;IAClF,MAAM,gBAAgB,GAAG,kBAAkB,CAAC,SAAS,IAAI,EAAE,CAAC;IAC5D,MAAM,YAAY,GAAG,gBAAgB,CAAC,IAAI,IAAI,EAAE,CAAC;IACjD,MAAM,mBAAmB,GAAG,qBAAqB,EAAE,CAAC;IACpD,MAAM,iBAAiB,GACrB,qBAAqB,CAAC,OAAO,CAAC,GAAG,CAAC,mBAAmB,EAAE,kBAAkB,CAAC,OAAO,EAAE,IAAI,CAAC;QACxF,mBAAmB,CAAC;IACtB,MAAM,QAAQ,GAAG,aAAa,CAC5B,oBAAoB,CAAC,OAAO,CAAC,GAAG,CAAC,qBAAqB,EAAE,kBAAkB,CAAC,QAAQ,CAAC,CACrF,CAAC;IACF,MAAM,qBAAqB,GAAG,yBAAyB,CACrD,OAAO,CAAC,GAAG,CAAC,2BAA2B,EACvC,kBAAkB,CAAC,cAAc,EACjC,EAAE,CACH,CAAC;IACF,MAAM,cAAc,GAAG,KAAK,CAAC,IAAI,CAC/B,IAAI,GAAG,CACL;QACE,GAAG,qBAAqB;QACxB,OAAO,CAAC,GAAG,CAAC,eAAe;QAC3B,YAAY,EAAE,OAAO,EAAE,OAAO;KAC/B;SACE,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,sBAAsB,CAAC,KAAK,CAAC,CAAC;SAC7C,MAAM,CAAC,CAAC,KAAK,EAAmB,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CACtD,CACF,CAAC;IAEF,MAAM,mBAAmB,GAAG,OAAO,CACjC,OAAO,CAAC,GAAG,CAAC,gBAAgB,IAAI,OAAO,CAAC,GAAG,CAAC,oBAAoB,CACjE,CAAC;IACF,MAAM,mBAAmB,GAAG,OAAO,CACjC,OAAO,CAAC,GAAG,CAAC,gBAAgB,IAAI,OAAO,CAAC,GAAG,CAAC,oBAAoB,CACjE,CAAC;IACF,MAAM,iBAAiB,GAAG,OAAO,CAC/B,OAAO,CAAC,GAAG,CAAC,cAAc,IAAI,OAAO,CAAC,GAAG,CAAC,kBAAkB,CAC7D,CAAC;IACF,MAAM,gBAAgB,GAAG,oBAAoB,CAC3C,OAAO,CAAC,GAAG,CAAC,8BAA8B,EAC1C,oBAAoB,CAAC,OAAO,CAAC,GAAG,CAAC,kBAAkB,EAAE,YAAY,CAAC,YAAY,CAAC,CAChF,CAAC;IACF,MAAM,cAAc,GAClB,oBAAoB,CAClB,OAAO,CAAC,GAAG,CAAC,4BAA4B,EACxC,YAAY,CAAC,UAAU,EACvB,wBAAwB,CACzB,IAAI,wBAAwB,CAAC;IAChC,MAAM,UAAU,GAAG,yBAAyB,CAC1C,OAAO,CAAC,GAAG,CAAC,uBAAuB,EACnC,YAAY,CAAC,MAAM,EACnB,mBAAmB,CACpB,CAAC;IACF,MAAM,QAAQ,GAAG,qBAAqB,CAAC,OAAO,CAAC,GAAG,CAAC,qBAAqB,EAAE,YAAY,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;IACnG,MAAM,UAAU,GAAG,oBAAoB,CAAC,OAAO,CAAC,GAAG,CAAC,uBAAuB,EAAE,YAAY,CAAC,MAAM,CAAC,CAAC;IAClG,MAAM,kBAAkB,GAAG,qBAAqB,CAC9C,OAAO,CAAC,GAAG,CAAC,wBAAwB,EACpC,YAAY,CAAC,OAAO,EACpB,KAAK,CACN,CAAC;IACF,MAAM,WAAW,GACf,iBAAiB;QACjB,kBAAkB;QAClB,OAAO,CAAC,gBAAgB,CAAC;QACzB,iBAAiB,CAAC;IAEpB,MAAM,aAAa,GACjB,iBAAiB;QACjB,qBAAqB,CACnB,OAAO,CAAC,GAAG,CAAC,0BAA0B,EACtC,gBAAgB,CAAC,MAAM,EAAE,OAAO,EAChC,IAAI,CACL;QACD,mBAAmB,CAAC;IACtB,MAAM,aAAa,GACjB,iBAAiB;QACjB,qBAAqB,CACnB,OAAO,CAAC,GAAG,CAAC,0BAA0B,EACtC,gBAAgB,CAAC,MAAM,EAAE,OAAO,EAChC,IAAI,CACL;QACD,mBAAmB,CAAC;IAEtB,MAAM,kBAAkB,GAAG,aAAa,IAAI,aAAa,IAAI,WAAW,CAAC;IAEzE,MAAM,iBAAiB,GAAG,qBAAqB,CAC7C,OAAO,CAAC,GAAG,CAAC,+BAA+B,EAC3C,kBAAkB,CAAC,iBAAiB,EACpC,KAAK,CACN,CAAC;IAEF,OAAO;QACL,OAAO,EAAE,kBAAkB;QAC3B,QAAQ;QACR,cAAc;QACd,iBAAiB;QACjB,SAAS,EAAE;YACT,MAAM,EAAE;gBACN,OAAO,EAAE,aAAa;aACvB;YACD,MAAM,EAAE;gBACN,OAAO,EAAE,aAAa;aACvB;YACD,IAAI,EAAE;gBACJ,OAAO,EAAE,WAAW;gBACpB,UAAU,EAAE,cAAc;gBAC1B,YAAY,EAAE,gBAAgB;gBAC9B,MAAM,EAAE,UAAU;gBAClB,IAAI,EAAE,QAAQ;gBACd,MAAM,EAAE,UAAU;aACnB;SACF;KACF,CAAC;AACJ,CAAC,CAAC;AAEF,MAAM,CAAC,MAAM,0BAA0B,GAAG,KAAK,EAC7C,oBAA0C,EACR,EAAE;IACpC,IAAI,oBAAoB,KAAK,SAAS,EAAE,CAAC;QACvC,OAAO,8BAA8B,CAAC,oBAAoB,CAAC,CAAC;IAC9D,CAAC;IAED,MAAM,YAAY,GAAG,MAAM,kBAAkB,EAAE,CAAC,GAAG,EAAE,CAAC;IACtD,OAAO,8BAA8B,CAAC,YAAY,CAAC,CAAC;AACtD,CAAC,CAAC;AAEF,MAAM,CAAC,MAAM,uBAAuB,GAAG,CAAC,GAAG,EAAE;IAC3C,MAAM,kBAAkB,GAAG,qBAAqB,EAAE,CAAC;IACnD,IAAI,kBAAkB,EAAE,CAAC;QACvB,OAAO,8BAA8B,CAAC,kBAAkB,CAAC,CAAC;IAC5D,CAAC;IAED,IAAI,CAAC,qBAAqB,EAAE,EAAE,CAAC;QAC7B,MAAM,QAAQ,GAAG,YAAY,EAAE,CAAC;QAChC,OAAO,8BAA8B,CAAC,QAAQ,CAAC,YAAY,IAAI,IAAI,CAAC,CAAC;IACvE,CAAC;IAED,OAAO,8BAA8B,CAAC,IAAI,CAAC,CAAC;AAC9C,CAAC,CAAC,EAAE,CAAC"}

package/dist/services/betterAuthSession.js

@@ -1,13 +1,7 @@
 import crypto from 'crypto';
-import { createUser, findUserByUsername } from '../models/User.js';
+import { createUser, findUserByUsername, findUserByEmail } from '../models/User.js';
 import { getBetterAuthRuntimeConfig } from './betterAuthConfig.js';
-const buildUsernameFromSession = (session) => {
-    const user = session?.user;
-    if (!user) {
-        return null;
-    }
-    return user.email || user.name || user.id || null;
-};
+import { getUserDao } from '../dao/index.js';
 export const getBetterAuthSession = async (req) => {
     if (!(await getBetterAuthRuntimeConfig()).enabled) {
         return null;
@@ -31,19 +25,52 @@ export const resolveBetterAuthUser = async (req) => {
     if (!session) {
         return null;
     }
-    const username = buildUsernameFromSession(session);
+    const email = session.user?.email;
+    // Priority 1: Email match
+    if (email) {
+        const emailMatch = await findUserByEmail(email);
+        if (emailMatch) {
+            return emailMatch;
+        }
+    }
+    // Priority 2: Username match (backward compatibility)
+    const username = email || session.user?.name || session.user?.id;
+    if (username) {
+        const usernameMatch = await findUserByUsername(username);
+        if (usernameMatch) {
+            // Backfill email for existing users to enable Priority 1/2 on subsequent logins
+            if (email && !usernameMatch.email) {
+                try {
+                    const userDao = getUserDao();
+                    await userDao.update(usernameMatch.username, { email });
+                }
+                catch (backfillError) {
+                    console.warn('Email backfill failed (non-critical):', backfillError);
+                }
+            }
+            return usernameMatch;
+        }
+    }
+    // Priority 3: Create new user (unless disabled)
     if (!username) {
         return null;
     }
-    const existingUser = await findUserByUsername(username);
-    if (existingUser) {
-        return existingUser;
+    const runtimeConfig = await getBetterAuthRuntimeConfig();
+    if (runtimeConfig.disableAutoCreate) {
+        console.warn(`SSO auto-creation disabled: user "${username}" not found in system`);
+        return null;
     }
     const generatedPassword = crypto.randomUUID();
-    const createdUser = await createUser({ username, password: generatedPassword, isAdmin: false });
+    const createdUser = await createUser({
+        username,
+        password: generatedPassword,
+        isAdmin: false,
+        email: email || undefined,
+    });
     if (createdUser) {
         return createdUser;
     }
+    // Handle race condition: another request created the user between our check and create
     const refreshedUser = await findUserByUsername(username);
     return refreshedUser || null;
 };

package/dist/services/betterAuthSession.js.map

@@ -1 +1 @@
-{"version":3,"file":"betterAuthSession.js","sourceRoot":"","sources":["../../src/services/betterAuthSession.ts"],"names":[],"mappings":"AAAA,OAAO,MAAM,MAAM,QAAQ,CAAC;AAE5B,OAAO,EAAE,UAAU,EAAE,kBAAkB,EAAE,MAAM,mBAAmB,CAAC;AAEnE,OAAO,EAAE,0BAA0B,EAAE,MAAM,uBAAuB,CAAC;AAEnE,MAAM,wBAAwB,GAAG,CAAC,OAAY,EAAiB,EAAE;IAC/D,MAAM,IAAI,GAAG,OAAO,EAAE,IAAI,CAAC;IAC3B,IAAI,CAAC,IAAI,EAAE,CAAC;QACV,OAAO,IAAI,CAAC;IACd,CAAC;IAED,OAAO,IAAI,CAAC,KAAK,IAAI,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,EAAE,IAAI,IAAI,CAAC;AACpD,CAAC,CAAC;AAEF,MAAM,CAAC,MAAM,oBAAoB,GAAG,KAAK,EAAE,GAAY,EAAuB,EAAE;IAC9E,IAAI,CAAC,CAAC,MAAM,0BAA0B,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC;QAClD,OAAO,IAAI,CAAC;IACd,CAAC;IAED,IAAI,CAAC;QACH,MAAM,CAAC,EAAE,IAAI,EAAE,EAAE,EAAE,eAAe,EAAE,CAAC,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC;YACxD,MAAM,CAAC,kBAAkB,CAAC;YAC1B,MAAM,CAAC,kBAAkB,CAAC;SAC3B,CAAC,CAAC;QACH,MAAM,OAAO,GAAG,eAAe,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;QAC7C,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,GAAG,CAAC,UAAU,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC;QACvD,OAAO,OAAO,IAAI,IAAI,CAAC;IACzB,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,OAAO,CAAC,IAAI,CAAC,oCAAoC,EAAE,KAAK,CAAC,CAAC;QAC1D,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC,CAAC;AAEF,MAAM,CAAC,MAAM,qBAAqB,GAAG,KAAK,EAAE,GAAY,EAAyB,EAAE;IACjF,MAAM,OAAO,GAAG,MAAM,oBAAoB,CAAC,GAAG,CAAC,CAAC;IAChD,IAAI,CAAC,OAAO,EAAE,CAAC;QACb,OAAO,IAAI,CAAC;IACd,CAAC;IAED,MAAM,QAAQ,GAAG,wBAAwB,CAAC,OAAO,CAAC,CAAC;IACnD,IAAI,CAAC,QAAQ,EAAE,CAAC;QACd,OAAO,IAAI,CAAC;IACd,CAAC;IAED,MAAM,YAAY,GAAG,MAAM,kBAAkB,CAAC,QAAQ,CAAC,CAAC;IACxD,IAAI,YAAY,EAAE,CAAC;QACjB,OAAO,YAAY,CAAC;IACtB,CAAC;IAED,MAAM,iBAAiB,GAAG,MAAM,CAAC,UAAU,EAAE,CAAC;IAC9C,MAAM,WAAW,GAAG,MAAM,UAAU,CAAC,EAAE,QAAQ,EAAE,QAAQ,EAAE,iBAAiB,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC,CAAC;IAChG,IAAI,WAAW,EAAE,CAAC;QAChB,OAAO,WAAW,CAAC;IACrB,CAAC;IAED,MAAM,aAAa,GAAG,MAAM,kBAAkB,CAAC,QAAQ,CAAC,CAAC;IACzD,OAAO,aAAa,IAAI,IAAI,CAAC;AAC/B,CAAC,CAAC"}
+{"version":3,"file":"betterAuthSession.js","sourceRoot":"","sources":["../../src/services/betterAuthSession.ts"],"names":[],"mappings":"AAAA,OAAO,MAAM,MAAM,QAAQ,CAAC;AAE5B,OAAO,EAAE,UAAU,EAAE,kBAAkB,EAAE,eAAe,EAAE,MAAM,mBAAmB,CAAC;AAEpF,OAAO,EAAE,0BAA0B,EAAE,MAAM,uBAAuB,CAAC;AACnE,OAAO,EAAE,UAAU,EAAE,MAAM,iBAAiB,CAAC;AAE7C,MAAM,CAAC,MAAM,oBAAoB,GAAG,KAAK,EAAE,GAAY,EAAuB,EAAE;IAC9E,IAAI,CAAC,CAAC,MAAM,0BAA0B,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC;QAClD,OAAO,IAAI,CAAC;IACd,CAAC;IAED,IAAI,CAAC;QACH,MAAM,CAAC,EAAE,IAAI,EAAE,EAAE,EAAE,eAAe,EAAE,CAAC,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC;YACxD,MAAM,CAAC,kBAAkB,CAAC;YAC1B,MAAM,CAAC,kBAAkB,CAAC;SAC3B,CAAC,CAAC;QACH,MAAM,OAAO,GAAG,eAAe,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;QAC7C,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,GAAG,CAAC,UAAU,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC;QACvD,OAAO,OAAO,IAAI,IAAI,CAAC;IACzB,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,OAAO,CAAC,IAAI,CAAC,oCAAoC,EAAE,KAAK,CAAC,CAAC;QAC1D,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC,CAAC;AAEF,MAAM,CAAC,MAAM,qBAAqB,GAAG,KAAK,EAAE,GAAY,EAAyB,EAAE;IACjF,MAAM,OAAO,GAAG,MAAM,oBAAoB,CAAC,GAAG,CAAC,CAAC;IAChD,IAAI,CAAC,OAAO,EAAE,CAAC;QACb,OAAO,IAAI,CAAC;IACd,CAAC;IAED,MAAM,KAAK,GAAG,OAAO,CAAC,IAAI,EAAE,KAAK,CAAC;IAElC,0BAA0B;IAC1B,IAAI,KAAK,EAAE,CAAC;QACV,MAAM,UAAU,GAAG,MAAM,eAAe,CAAC,KAAK,CAAC,CAAC;QAChD,IAAI,UAAU,EAAE,CAAC;YACf,OAAO,UAAU,CAAC;QACpB,CAAC;IACH,CAAC;IAED,sDAAsD;IACtD,MAAM,QAAQ,GAAG,KAAK,IAAI,OAAO,CAAC,IAAI,EAAE,IAAI,IAAI,OAAO,CAAC,IAAI,EAAE,EAAE,CAAC;IACjE,IAAI,QAAQ,EAAE,CAAC;QACb,MAAM,aAAa,GAAG,MAAM,kBAAkB,CAAC,QAAQ,CAAC,CAAC;QACzD,IAAI,aAAa,EAAE,CAAC;YAClB,gFAAgF;YAChF,IAAI,KAAK,IAAI,CAAC,aAAa,CAAC,KAAK,EAAE,CAAC;gBAClC,IAAI,CAAC;oBACH,MAAM,OAAO,GAAG,UAAU,EAAE,CAAC;oBAC7B,MAAM,OAAO,CAAC,MAAM,CAAC,aAAa,CAAC,QAAQ,EAAE,EAAE,KAAK,EAAE,CAAC,CAAC;gBAC1D,CAAC;gBAAC,OAAO,aAAa,EAAE,CAAC;oBACvB,OAAO,CAAC,IAAI,CAAC,uCAAuC,EAAE,aAAa,CAAC,CAAC;gBACvE,CAAC;YACH,CAAC;YACD,OAAO,aAAa,CAAC;QACvB,CAAC;IACH,CAAC;IAED,gDAAgD;IAChD,IAAI,CAAC,QAAQ,EAAE,CAAC;QACd,OAAO,IAAI,CAAC;IACd,CAAC;IAED,MAAM,aAAa,GAAG,MAAM,0BAA0B,EAAE,CAAC;IACzD,IAAI,aAAa,CAAC,iBAAiB,EAAE,CAAC;QACpC,OAAO,CAAC,IAAI,CAAC,qCAAqC,QAAQ,uBAAuB,CAAC,CAAC;QACnF,OAAO,IAAI,CAAC;IACd,CAAC;IAED,MAAM,iBAAiB,GAAG,MAAM,CAAC,UAAU,EAAE,CAAC;IAC9C,MAAM,WAAW,GAAG,MAAM,UAAU,CAAC;QACnC,QAAQ;QACR,QAAQ,EAAE,iBAAiB;QAC3B,OAAO,EAAE,KAAK;QACd,KAAK,EAAE,KAAK,IAAI,SAAS;KAC1B,CAAC,CAAC;IACH,IAAI,WAAW,EAAE,CAAC;QAChB,OAAO,WAAW,CAAC;IACrB,CAAC;IAED,uFAAuF;IACvF,MAAM,aAAa,GAAG,MAAM,kBAAkB,CAAC,QAAQ,CAAC,CAAC;IACzD,OAAO,aAAa,IAAI,IAAI,CAAC;AAC/B,CAAC,CAAC"}

package/dist/services/hostedAuthService.js

@@ -0,0 +1,314 @@
+import { randomUUID } from 'node:crypto';
+import { getHostedUserState, HostedControlPlaneError, reserveHostedCredit, settleHostedCredit, validateHostedApiKey, } from './hostedControlPlaneClient.js';
+import { isHostedModeEnabled } from './hostedMode.js';
+import { getHostedNodeIdentity } from './hostedNodeIdentity.js';
+import { safeCompare } from '../utils/safeCompare.js';
+const KEY_PREFIX = 'mcphub-sk';
+const API_KEY_PREFIX_CHARS = 12;
+const DEFAULT_CACHE_TTL_SECONDS = 30;
+const DEFAULT_STALE_TTL_MS = 60 * 60 * 1000;
+const MAX_CACHE_ENTRIES = 1000;
+const CACHE_CLEANUP_INTERVAL_MS = 5 * 60 * 1000;
+export class HostedAuthorizationError extends Error {
+    constructor(message, code = 'hosted_forbidden') {
+        super(message);
+        this.code = code;
+        this.name = 'HostedAuthorizationError';
+    }
+}
+export class HostedAuthUnavailableError extends Error {
+    constructor(message) {
+        super(message);
+        this.name = 'HostedAuthUnavailableError';
+    }
+}
+function createVerificationToken(apiKey) {
+    return apiKey;
+}
+function matchesVerificationToken(apiKey, verificationToken) {
+    return safeCompare(apiKey, verificationToken);
+}
+class MemoryHostedAuthStateCache {
+    constructor() {
+        this.keyCache = new Map();
+        this.userCacheIndex = new Map();
+        this.apiKeyIdCacheIndex = new Map();
+    }
+    get(prefix) {
+        return this.keyCache.get(prefix);
+    }
+    set(prefix, entry) {
+        this.remove(prefix);
+        this.keyCache.set(prefix, entry);
+        this.addIndexedPrefix(this.userCacheIndex, entry.userId, prefix);
+        this.addIndexedPrefix(this.apiKeyIdCacheIndex, entry.apiKeyId, prefix);
+        this.prune();
+    }
+    touch(prefix, entry) {
+        this.keyCache.delete(prefix);
+        this.keyCache.set(prefix, entry);
+    }
+    remove(prefix) {
+        const existing = this.keyCache.get(prefix);
+        if (!existing)
+            return;
+        this.keyCache.delete(prefix);
+        this.removeIndexedPrefix(this.userCacheIndex, existing.userId, prefix);
+        this.removeIndexedPrefix(this.apiKeyIdCacheIndex, existing.apiKeyId, prefix);
+    }
+    invalidateUser(userId) {
+        const prefixes = this.userCacheIndex.get(userId);
+        if (!prefixes)
+            return;
+        for (const prefix of [...prefixes]) {
+            this.remove(prefix);
+        }
+    }
+    invalidateApiKeyId(apiKeyId) {
+        const prefixes = this.apiKeyIdCacheIndex.get(apiKeyId);
+        if (!prefixes)
+            return;
+        for (const prefix of [...prefixes]) {
+            this.remove(prefix);
+        }
+    }
+    prune(now = Date.now()) {
+        for (const [prefix, entry] of this.keyCache.entries()) {
+            if (entry.staleUntil <= now) {
+                this.remove(prefix);
+            }
+        }
+        while (this.keyCache.size > MAX_CACHE_ENTRIES) {
+            const oldestPrefix = this.keyCache.keys().next().value;
+            if (!oldestPrefix)
+                break;
+            this.remove(oldestPrefix);
+        }
+    }
+    size() {
+        return this.keyCache.size;
+    }
+    addIndexedPrefix(index, key, prefix) {
+        const prefixes = index.get(key);
+        if (prefixes) {
+            prefixes.add(prefix);
+            return;
+        }
+        index.set(key, new Set([prefix]));
+    }
+    removeIndexedPrefix(index, key, prefix) {
+        const prefixes = index.get(key);
+        if (!prefixes)
+            return;
+        prefixes.delete(prefix);
+        if (prefixes.size === 0) {
+            index.delete(key);
+        }
+    }
+}
+const authStateCache = new MemoryHostedAuthStateCache();
+const cacheCleanupTimer = setInterval(() => {
+    authStateCache.prune();
+}, CACHE_CLEANUP_INTERVAL_MS);
+cacheCleanupTimer.unref?.();
+export function isHostedApiKey(value) {
+    return Boolean(value?.startsWith(`${KEY_PREFIX}-`));
+}
+function extractApiKeyPrefix(key) {
+    const prefix = `${KEY_PREFIX}-`;
+    if (!key.startsWith(prefix))
+        return null;
+    const token = key.slice(prefix.length);
+    if (token.length < API_KEY_PREFIX_CHARS)
+        return null;
+    return token.slice(0, API_KEY_PREFIX_CHARS);
+}
+function projectState(validation, state, apiKey) {
+    const matchingKey = state.apiKeys.find((key) => key.id === validation.apiKeyId);
+    const ttlSeconds = Math.max(1, state.cacheTtlSeconds || validation.cacheTtlSeconds || DEFAULT_CACHE_TTL_SECONDS);
+    const now = Date.now();
+    const entry = {
+        userId: validation.userId,
+        apiKeyId: validation.apiKeyId,
+        apiKeyPrefix: validation.prefix,
+        verificationToken: createVerificationToken(apiKey),
+        scopeSlugs: matchingKey?.scopeSlugs ?? validation.scopeSlugs,
+        contentRecordingEnabled: state.contentRecordingEnabled || validation.contentRecordingEnabled,
+        subscriptions: state.subscriptions.map((subscription) => ({
+            serverSlug: subscription.serverSlug,
+            tools: subscription.tools ?? 'all',
+            byokCredentialId: subscription.byokCredentialId,
+        })),
+        expiresAt: now + ttlSeconds * 1000,
+        staleUntil: now + DEFAULT_STALE_TTL_MS,
+    };
+    Object.defineProperty(entry, 'verificationToken', {
+        value: entry.verificationToken,
+        enumerable: false,
+        writable: true,
+        configurable: true,
+    });
+    return entry;
+}
+async function loadFreshContext(apiKey, prefix) {
+    const validation = await validateHostedApiKey(apiKey);
+    if (!validation.valid || !validation.userId || !validation.apiKeyId || !validation.prefix) {
+        authStateCache.remove(prefix);
+        return null;
+    }
+    const state = await getHostedUserState(validation.userId);
+    const entry = projectState({
+        userId: validation.userId,
+        apiKeyId: validation.apiKeyId,
+        prefix: validation.prefix,
+        scopeSlugs: validation.scopeSlugs,
+        contentRecordingEnabled: validation.contentRecordingEnabled,
+        cacheTtlSeconds: validation.cacheTtlSeconds,
+    }, state, apiKey);
+    authStateCache.set(prefix, entry);
+    return entry;
+}
+function publicContext(entry) {
+    return {
+        userId: entry.userId,
+        apiKeyId: entry.apiKeyId,
+        apiKeyPrefix: entry.apiKeyPrefix,
+        scopeSlugs: entry.scopeSlugs,
+        contentRecordingEnabled: entry.contentRecordingEnabled,
+        subscriptions: entry.subscriptions,
+    };
+}
+export async function validateHostedBearer(apiKey) {
+    if (!isHostedModeEnabled() || !isHostedApiKey(apiKey)) {
+        return null;
+    }
+    const prefix = extractApiKeyPrefix(apiKey);
+    if (!prefix)
+        return null;
+    authStateCache.prune();
+    const cached = authStateCache.get(prefix);
+    if (cached &&
+        Date.now() < cached.expiresAt &&
+        matchesVerificationToken(apiKey, cached.verificationToken)) {
+        authStateCache.touch(prefix, cached);
+        return publicContext(cached);
+    }
+    try {
+        const fresh = await loadFreshContext(apiKey, prefix);
+        return fresh ? publicContext(fresh) : null;
+    }
+    catch (error) {
+        if (cached &&
+            Date.now() < cached.staleUntil &&
+            matchesVerificationToken(apiKey, cached.verificationToken)) {
+            console.warn('[hosted] control plane unavailable, serving stale cached auth state', {
+                error: String(error),
+            });
+            authStateCache.touch(prefix, cached);
+            return publicContext(cached);
+        }
+        if (error instanceof HostedControlPlaneError) {
+            throw new HostedAuthUnavailableError(error.message);
+        }
+        throw error;
+    }
+}
+function findSubscription(context, serverSlug) {
+    return (context.subscriptions.find((subscription) => subscription.serverSlug === serverSlug) ?? null);
+}
+export function assertHostedToolAllowed(context, serverSlug, toolName) {
+    if (!context)
+        return;
+    if (context.scopeSlugs && !context.scopeSlugs.includes(serverSlug)) {
+        throw new HostedAuthorizationError('API key is not scoped for this hosted server');
+    }
+    const subscription = findSubscription(context, serverSlug);
+    if (!subscription) {
+        throw new HostedAuthorizationError('User is not subscribed to this hosted server');
+    }
+    if (subscription.tools !== 'all' && !subscription.tools.includes(toolName)) {
+        throw new HostedAuthorizationError('Tool is not enabled in this hosted toolset');
+    }
+}
+export function filterHostedTools(context, serverSlug, tools, nameSeparator) {
+    if (!context)
+        return tools;
+    if (context.scopeSlugs && !context.scopeSlugs.includes(serverSlug))
+        return [];
+    const subscription = findSubscription(context, serverSlug);
+    if (!subscription)
+        return [];
+    if (subscription.tools === 'all')
+        return tools;
+    const prefix = `${serverSlug}${nameSeparator}`;
+    return tools.filter((tool) => {
+        const cleanName = tool.name.startsWith(prefix) ? tool.name.slice(prefix.length) : tool.name;
+        return subscription.tools !== 'all' && subscription.tools.includes(cleanName);
+    });
+}
+export async function reserveHostedToolCall(context, serverSlug, toolName) {
+    if (!context)
+        return null;
+    assertHostedToolAllowed(context, serverSlug, toolName);
+    const hubRequestId = randomUUID();
+    const reservation = await reserveHostedCredit({
+        userId: context.userId,
+        apiKeyId: context.apiKeyId,
+        serverSlug,
+        toolName,
+        hubRequestId,
+    });
+    return {
+        reservationId: reservation.reservationId,
+        hubRequestId,
+        userId: context.userId,
+        apiKeyId: context.apiKeyId,
+        serverSlug,
+        toolName,
+        estimatedCostMillicents: reservation.estimatedCostMillicents,
+        contentRecordingEnabled: context.contentRecordingEnabled,
+    };
+}
+export async function settleHostedToolCall(reservation, input) {
+    if (!reservation)
+        return;
+    try {
+        const nodeIdentity = getHostedNodeIdentity();
+        await settleHostedCredit({
+            reservationId: reservation.reservationId,
+            hubEventId: randomUUID(),
+            success: input.success,
+            latencyMs: input.latencyMs,
+            occurredAt: new Date().toISOString(),
+            costMillicents: input.success ? reservation.estimatedCostMillicents : 0,
+            metadata: {
+                ...(input.metadata ?? {}),
+                hubRequestId: reservation.hubRequestId,
+                hubClusterId: nodeIdentity.clusterId,
+                hubNodeId: nodeIdentity.nodeId,
+                serverSlug: reservation.serverSlug,
+                toolName: reservation.toolName,
+            },
+            requestContent: reservation.contentRecordingEnabled ? input.requestContent : undefined,
+            responseContent: reservation.contentRecordingEnabled ? input.responseContent : undefined,
+        });
+    }
+    catch (error) {
+        console.warn('[hosted] failed to settle hosted tool call', {
+            reservationId: reservation.reservationId,
+            error: String(error),
+        });
+    }
+}
+export function applyHostedWebhookEvent(event) {
+    if (event.type === 'api_key.created' && event.prefix) {
+        authStateCache.remove(event.prefix);
+        return;
+    }
+    if (event.type === 'api_key.revoked' && event.keyId) {
+        authStateCache.invalidateApiKeyId(event.keyId);
+        return;
+    }
+    authStateCache.invalidateUser(event.userId);
+}
+//# sourceMappingURL=hostedAuthService.js.map