@sanoma-ai/connector-better-auth 0.2.2 → 0.2.4
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/README.md +23 -11
- package/dist/login.d.ts +7 -6
- package/dist/login.js +30 -25
- package/dist/login.js.map +1 -1
- package/dist/staff.js +52 -7
- package/dist/staff.js.map +1 -1
- package/package.json +5 -5
package/README.md
CHANGED
|
@@ -1,6 +1,6 @@
|
|
|
1
1
|
# @sanoma-ai/connector-better-auth
|
|
2
2
|
|
|
3
|
-
[Better Auth](https://www.better-auth.com) as a visitor login for a [Sanoma](https://github.com/Sanoma-AI/sanoma) public site, and as the app's staff sign-in on a host: visitors sign up and sign in with an email and a password
|
|
3
|
+
[Better Auth](https://www.better-auth.com) as a visitor login for a [Sanoma](https://github.com/Sanoma-AI/sanoma) public site, and as the app's staff sign-in on a host: visitors sign up and sign in with an email and a password, an email code or GitHub, staff by an email code, an invite link or GitHub, and the accounts live on the company's own database. It has no operations and no credential; it attaches a login half (`withSetup({ login })`, see [`@sanoma-ai/workflows`](https://www.npmjs.com/package/@sanoma-ai/workflows#usage)), which the app calls once for each public site that names it.
|
|
4
4
|
|
|
5
5
|
## Usage
|
|
6
6
|
|
|
@@ -66,32 +66,44 @@ When the company's config names a sender (`login: { sender: resend.emails.send,
|
|
|
66
66
|
|
|
67
67
|
### GitHub
|
|
68
68
|
|
|
69
|
-
When the app has the company's GitHub App client (`SANOMA_GITHUB_CLIENT_ID` and `SANOMA_GITHUB_CLIENT_SECRET`, which `sanoma` reads on a host, the staff login's too), the login offers GitHub (`methods` lists `"github"`): a visitor signed in links their GitHub account, and is then said to be that GitHub login (`ctx.startedBy.github` in a run they start, `user.github` in the session). Add `https://<site host>/auth/better-auth/callback/github` to the App's callback URLs (its settings, "Callback URL"), one for each site's host.
|
|
69
|
+
When the app has the company's GitHub App client (`SANOMA_GITHUB_CLIENT_ID` and `SANOMA_GITHUB_CLIENT_SECRET`, which `sanoma` reads on a host, the staff login's too), the login offers GitHub (`methods` lists `"github"`): a visitor signs up or in with GitHub ("Continue with GitHub", beside the email code), or, signed in, links their GitHub account, and is then said to be that GitHub login (`ctx.startedBy.github` in a run they start, `user.github` in the session). Add `https://<site host>/auth/better-auth/callback/github` to the App's callback URLs (its settings, "Callback URL"), one for each site's host; signing in and linking come back to the same one.
|
|
70
70
|
|
|
71
|
-
| Route | Body | What it does
|
|
72
|
-
| --------------------------------------- | ------------------------------------- |
|
|
73
|
-
| `POST /auth/better-auth/
|
|
74
|
-
| `POST /auth/better-auth/
|
|
75
|
-
| `GET /auth/better-auth/get-session` | | `{ session, user }`, `user.github` the
|
|
71
|
+
| Route | Body | What it does |
|
|
72
|
+
| --------------------------------------- | ------------------------------------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
|
|
73
|
+
| `POST /auth/better-auth/sign-in/social` | `{ provider: "github", callbackURL }` | Answers `{ url, redirect: true }`, GitHub's authorize page to send the browser to; back at `/callback/github`, it signs the visitor in (making the account on first use), then `callbackURL`. |
|
|
74
|
+
| `POST /auth/better-auth/link-social` | `{ provider: "github", callbackURL }` | The same, signed in: links the GitHub account to the visitor's, then `callbackURL`. |
|
|
75
|
+
| `GET /auth/better-auth/get-session` | | `{ session, user }`, `user.github` the GitHub login, or null when signed out. |
|
|
76
76
|
|
|
77
77
|
```ts
|
|
78
|
-
|
|
78
|
+
// "Continue with GitHub" on the sign-in page, when the login offers it
|
|
79
|
+
const response = await fetch("/auth/better-auth/sign-in/social", {
|
|
79
80
|
method: "POST",
|
|
80
81
|
headers: { "content-type": "application/json" },
|
|
81
82
|
body: JSON.stringify({ provider: "github", callbackURL: location.pathname }),
|
|
82
83
|
});
|
|
83
84
|
const { url } = await response.json();
|
|
84
|
-
window.location.assign(url); // GitHub, then back on this page
|
|
85
|
+
window.location.assign(url); // GitHub, then back on this page signed in
|
|
85
86
|
```
|
|
86
87
|
|
|
87
|
-
Each `callbackURL` (and `errorCallbackURL`, where an error goes as `?error=<code
|
|
88
|
+
Each `callbackURL` (and `errorCallbackURL`, where an error goes as `?error=<code>`, and `newUserCallbackURL`, where a new account goes) is a path on the site's host.
|
|
89
|
+
|
|
90
|
+
- **One person, one account.** A GitHub sign-in whose email matches a visitor's account signs into that account when GitHub verified the email and the account's own is verified (by a code, or by GitHub at sign-up); otherwise it is refused, so an email nobody proved never joins someone's account.
|
|
91
|
+
- **A new account by GitHub** has its email verified only when GitHub verified it, and `verify` says the email only then. An email code to that address later proves it, and drops the GitHub account that had not.
|
|
92
|
+
- **A link** may use a GitHub account of another email, which GitHub must have verified.
|
|
93
|
+
- **The login** is GitHub's answer for the account's own token at each sign-in or link (Better Auth sets no field a person may not set from a provider's profile), and is cleared when the visitor unlinks it (`POST /unlink-account { accountId }`, the account's id in `GET /list-accounts`). The account's tokens are dropped then, as a GitHub App's user token reaches what the App and the person both reach.
|
|
94
|
+
|
|
95
|
+
| `?error=` | When |
|
|
96
|
+
| ------------------------------------------ | -------------------------------------------------------------------------------------------------------------------------------- |
|
|
97
|
+
| `account_not_linked` | A sign-in's email matches an account, but one side has not verified it. |
|
|
98
|
+
| `account_already_linked_to_different_user` | A link of a GitHub account that is another visitor's. |
|
|
99
|
+
| `unable_to_link_account` | A second GitHub account for a visitor who has one (by link or by sign-in), or a link whose GitHub email GitHub has not verified. |
|
|
88
100
|
|
|
89
101
|
## The staff sign-in
|
|
90
102
|
|
|
91
103
|
`betterAuthStaffLogin` is the app's sign-in for the company's own people on a host, which the `sanoma` bin uses off this machine (`staffLogin(betterAuthStaffLogin, { github })` from `@sanoma-ai/app`). Unlike the visitor login, nobody signs up: a code is sent, and an account made, only for an email the people file declares (anyone else gets the same answer, and nothing is stored or sent), or a GitHub login it declares. Its tables are in the schema `better_auth_staff`, migrated under the advisory lock `sanoma.login.better-auth.better_auth_staff`; its cookie is `sanoma.session_token`, for seven days, on whatever host the app answers on. Its ways in, under `/auth/better-auth/`:
|
|
92
104
|
|
|
93
105
|
- an email code (`/email-otp/send-verification-otp`, `/sign-in/email-otp`), with a sender;
|
|
94
|
-
- GitHub (`/sign-in/social`, back at `/callback/github`), with the company's GitHub App's client, matched by the verified email GitHub gives, else the login;
|
|
106
|
+
- GitHub (`/sign-in/social`, back at `/callback/github`), with the company's GitHub App's client, matched by the verified email GitHub gives, else the login (GitHub's `/user` for the sign-in's own token, which is then dropped; the App needs the account permission "Email addresses: read", or a private email ends in Better Auth's `?error=email_not_found`); a GitHub account the files declare by neither is refused as `?error=not_declared` (or, when its unverified email is a row's, Better Auth's `account_not_linked`), with no row left, as is a new GitHub account under a login a row already carries, since GitHub frees a renamed login; declare people by email where you can;
|
|
95
107
|
- an invite (`/magic-link/verify`), a one-use magic link valid 24 hours that the app mints server-side (`invite`), a new one replacing the person's last; Better Auth's own `/sign-in/magic-link` is not served.
|
|
96
108
|
|
|
97
109
|
Every other Better Auth route is a 404, a POST whose `Origin` is not the request's own host is a 403, and a `callbackURL`, `errorCallbackURL` or `newUserCallbackURL` that is not a path on the request's host is a 400. Invites are minted one at a time. Each sign-in is told to the app (`signin.recorded` in the ledger, with how).
|
package/dist/login.d.ts
CHANGED
|
@@ -2,11 +2,12 @@ import type { LoginContext, LoginHalf } from "@sanoma-ai/workflows";
|
|
|
2
2
|
/**
|
|
3
3
|
* Better Auth's login half for one public site: email and password, and an email code when the
|
|
4
4
|
* app can send one (`context.sendCode`); every email may sign up. With the company's GitHub client
|
|
5
|
-
* (`context.social.github`), a visitor
|
|
6
|
-
*
|
|
7
|
-
* login (`verify`'s `github`). Its tables are in schema
|
|
8
|
-
* migrated here before the first site starts, its
|
|
9
|
-
* (`context.key`). The site's origins are its allowed
|
|
10
|
-
* refused) and set the cookie's `Secure` flag: an `https`
|
|
5
|
+
* (`context.social.github`), a visitor also signs up and in with GitHub (`/sign-in/social`, which
|
|
6
|
+
* joins the account of GitHub's verified email), or links it once signed in (`/link-social`), and
|
|
7
|
+
* is then said to be that GitHub login (`verify`'s `github`). Its tables are in schema
|
|
8
|
+
* `better_auth` on the company's database, migrated here before the first site starts, its
|
|
9
|
+
* cookies signed with the app's key for it (`context.key`). The site's origins are its allowed
|
|
10
|
+
* hosts (a request for another host is refused) and set the cookie's `Secure` flag: an `https`
|
|
11
|
+
* origin's is.
|
|
11
12
|
*/
|
|
12
13
|
export declare function betterAuthLogin({ databaseUrl, key, origins, sendCode, social, }: LoginContext): Promise<LoginHalf>;
|
package/dist/login.js
CHANGED
|
@@ -8,12 +8,13 @@ const SIGN_OUT = `${BASE_PATH}/sign-out`;
|
|
|
8
8
|
/**
|
|
9
9
|
* Better Auth's login half for one public site: email and password, and an email code when the
|
|
10
10
|
* app can send one (`context.sendCode`); every email may sign up. With the company's GitHub client
|
|
11
|
-
* (`context.social.github`), a visitor
|
|
12
|
-
*
|
|
13
|
-
* login (`verify`'s `github`). Its tables are in schema
|
|
14
|
-
* migrated here before the first site starts, its
|
|
15
|
-
* (`context.key`). The site's origins are its allowed
|
|
16
|
-
* refused) and set the cookie's `Secure` flag: an `https`
|
|
11
|
+
* (`context.social.github`), a visitor also signs up and in with GitHub (`/sign-in/social`, which
|
|
12
|
+
* joins the account of GitHub's verified email), or links it once signed in (`/link-social`), and
|
|
13
|
+
* is then said to be that GitHub login (`verify`'s `github`). Its tables are in schema
|
|
14
|
+
* `better_auth` on the company's database, migrated here before the first site starts, its
|
|
15
|
+
* cookies signed with the app's key for it (`context.key`). The site's origins are its allowed
|
|
16
|
+
* hosts (a request for another host is refused) and set the cookie's `Secure` flag: an `https`
|
|
17
|
+
* origin's is.
|
|
17
18
|
*/
|
|
18
19
|
export async function betterAuthLogin({ databaseUrl, key, origins, sendCode, social, }) {
|
|
19
20
|
const github = social?.github;
|
|
@@ -32,14 +33,11 @@ export async function betterAuthLogin({ databaseUrl, key, origins, sendCode, soc
|
|
|
32
33
|
plugins: sendCode ? [emailCode(sendCode)] : [],
|
|
33
34
|
user: { additionalFields: GITHUB_FIELD },
|
|
34
35
|
...(github && {
|
|
35
|
-
|
|
36
|
-
//
|
|
37
|
-
|
|
38
|
-
|
|
39
|
-
},
|
|
40
|
-
// A visitor's GitHub email is seldom the one they signed in with. Linking still needs
|
|
41
|
-
// GitHub to have verified its email (GitHub is no trusted provider).
|
|
42
|
-
account: { accountLinking: { allowDifferentEmails: true, disableImplicitLinking: true } },
|
|
36
|
+
socialProviders: { github: { clientId: github.clientId, clientSecret: github.clientSecret } },
|
|
37
|
+
// GitHub stays untrusted, and the account's own email must be verified (Better Auth's
|
|
38
|
+
// default, pinned): a sign-in joins an account only by an email both sides verified
|
|
39
|
+
// (AGENTS.md). A link's may differ.
|
|
40
|
+
account: { accountLinking: { allowDifferentEmails: true, requireLocalEmailVerified: true } },
|
|
43
41
|
databaseHooks: {
|
|
44
42
|
account: {
|
|
45
43
|
create: { before: oneGitHub, after: noteLogin },
|
|
@@ -99,23 +97,30 @@ async function oneGitHub(account, ctx) {
|
|
|
99
97
|
return false;
|
|
100
98
|
}
|
|
101
99
|
/**
|
|
102
|
-
* Keeps a GitHub account's login on its user, once Better Auth has linked
|
|
100
|
+
* Keeps a GitHub account's login on its user, once Better Auth has made, linked or signed its user
|
|
103
101
|
* in with it (GitHub's redirect back, `/callback/:id`), then drops the account's tokens, which
|
|
104
102
|
* nothing here uses again: a GitHub App's user token reaches what the App and the person both
|
|
105
|
-
* reach. The
|
|
106
|
-
*
|
|
103
|
+
* reach. The tokens go even when GitHub does not answer: the hook runs once the account is
|
|
104
|
+
* written, so its error undoes nothing. The login is GitHub's `/user` for that token, since
|
|
105
|
+
* Better Auth sets no field from a profile that a person may not set (`input: false`), the GitHub
|
|
106
|
+
* login among them.
|
|
107
107
|
*/
|
|
108
108
|
async function noteLogin(account, ctx) {
|
|
109
109
|
if (account?.providerId !== "github" || !account.accessToken || ctx?.path !== "/callback/:id")
|
|
110
110
|
return;
|
|
111
|
-
const { internalAdapter
|
|
112
|
-
|
|
113
|
-
|
|
114
|
-
|
|
115
|
-
|
|
116
|
-
|
|
117
|
-
|
|
118
|
-
|
|
111
|
+
const { internalAdapter } = ctx.context;
|
|
112
|
+
try {
|
|
113
|
+
const answer = await fetch("https://api.github.com/user", {
|
|
114
|
+
headers: { authorization: `Bearer ${account.accessToken}`, "user-agent": "sanoma" },
|
|
115
|
+
});
|
|
116
|
+
const { login } = (answer.ok ? await answer.json() : {});
|
|
117
|
+
if (typeof login !== "string")
|
|
118
|
+
throw new Error("better-auth: GitHub did not say whose account it is");
|
|
119
|
+
await internalAdapter.updateUser(account.userId, { github: login });
|
|
120
|
+
}
|
|
121
|
+
finally {
|
|
122
|
+
await internalAdapter.updateAccount(account.id, { accessToken: null, refreshToken: null, idToken: null });
|
|
123
|
+
}
|
|
119
124
|
}
|
|
120
125
|
/** A GitHub account unlinked: its user is no longer that login. */
|
|
121
126
|
async function forgetLogin(account, ctx) {
|
package/dist/login.js.map
CHANGED
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"login.js","sourceRoot":"","sources":["../src/login.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,iBAAiB,EAAE,kBAAkB,EAAE,MAAM,aAAa,CAAC;AACpE,OAAO,EACL,SAAS,EACT,YAAY,EACZ,UAAU,EACV,cAAc,EACd,cAAc,EAGd,eAAe,GAChB,MAAM,eAAe,CAAC;AAEvB,yHAAyH;AACzH,MAAM,MAAM,GAAG,aAAa,CAAC;AAC7B,wHAAwH;AACxH,MAAM,SAAS,GAAG,mBAAmB,CAAC;AACtC,MAAM,QAAQ,GAAG,GAAG,SAAS,WAAW,CAAC;
|
|
1
|
+
{"version":3,"file":"login.js","sourceRoot":"","sources":["../src/login.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,iBAAiB,EAAE,kBAAkB,EAAE,MAAM,aAAa,CAAC;AACpE,OAAO,EACL,SAAS,EACT,YAAY,EACZ,UAAU,EACV,cAAc,EACd,cAAc,EAGd,eAAe,GAChB,MAAM,eAAe,CAAC;AAEvB,yHAAyH;AACzH,MAAM,MAAM,GAAG,aAAa,CAAC;AAC7B,wHAAwH;AACxH,MAAM,SAAS,GAAG,mBAAmB,CAAC;AACtC,MAAM,QAAQ,GAAG,GAAG,SAAS,WAAW,CAAC;AAoBzC;;;;;;;;;;GAUG;AACH,MAAM,CAAC,KAAK,UAAU,eAAe,CAAC,EACpC,WAAW,EACX,GAAG,EACH,OAAO,EACP,QAAQ,EACR,MAAM,GACO;IACb,MAAM,MAAM,GAAG,MAAM,EAAE,MAAM,CAAC;IAC9B,MAAM,KAAK,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IAC/B,MAAM,KAAK,GAAG,IAAI,GAAG,EAAsB,CAAC;IAC5C,KAAK,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,IAAI,KAAK;QAAE,KAAK,CAAC,GAAG,CAAC,QAAQ,EAAE,CAAC,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,QAAQ,CAAC,IAAI,EAAE,CAAC,EAAE,IAAI,CAAC,CAAC,CAAC;IACpG,MAAM,EAAE,KAAK,EAAE,KAAK,EAAE,GAAG,MAAM,cAAc,CAAC;QAC5C,WAAW;QACX,GAAG;QACH,MAAM,EAAE,MAAM;QACd,QAAQ,EAAE,SAAS;QACnB,KAAK;QACL,OAAO,EAAE;YACP,gBAAgB,EAAE,EAAE,OAAO,EAAE,IAAI,EAAE;YACnC,OAAO,EAAE,QAAQ,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE;YAC9C,IAAI,EAAE,EAAE,gBAAgB,EAAE,YAAY,EAAE;YACxC,GAAG,CAAC,MAAM,IAAI;gBACZ,eAAe,EAAE,EAAE,MAAM,EAAE,EAAE,QAAQ,EAAE,MAAM,CAAC,QAAQ,EAAE,YAAY,EAAE,MAAM,CAAC,YAAY,EAAE,EAAE;gBAC7F,sFAAsF;gBACtF,oFAAoF;gBACpF,oCAAoC;gBACpC,OAAO,EAAE,EAAE,cAAc,EAAE,EAAE,oBAAoB,EAAE,IAAI,EAAE,yBAAyB,EAAE,IAAI,EAAE,EAAE;gBAC5F,aAAa,EAAE;oBACb,OAAO,EAAE;wBACP,MAAM,EAAE,EAAE,MAAM,EAAE,SAAS,EAAE,KAAK,EAAE,SAAS,EAAE;wBAC/C,MAAM,EAAE,EAAE,KAAK,EAAE,SAAS,EAAE;wBAC5B,MAAM,EAAE,EAAE,KAAK,EAAE,WAAW,EAAE;qBAC/B;iBACF;aACF,CAAC;SACH;KACF,CAAC,CAAC;IACH,sFAAsF;IACtF,MAAM,OAAO,GAAG,CAAC,OAAgB,EAAE,EAAE;QACnC,MAAM,IAAI,GAAG,iBAAiB,CAAC,OAAO,EAAE,KAAK,CAAC,IAAI,EAAE,CAAC;QACrD,MAAM,IAAI,GAAG,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,kBAAkB,CAAC,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC;QACjE,OAAO,IAAI,IAAI,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;IAC1C,CAAC,CAAC;IACF,MAAM,OAAO,GAAkB;QAC7B,UAAU;QACV,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAE,CAAC,MAAM,CAAW,CAAC,CAAC,CAAC,EAAE,CAAC;QACxC,GAAG,CAAC,MAAM,CAAC,CAAC,CAAE,CAAC,QAAQ,CAAW,CAAC,CAAC,CAAC,EAAE,CAAC;KACzC,CAAC;IACF,OAAO;QACL,KAAK,CAAC,MAAM,CAAC,OAAO;YAClB,MAAM,IAAI,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;YAC9B,IAAI,CAAC,IAAI;gBAAE,MAAM,IAAI,KAAK,CAAC,gBAAgB,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,iCAAiC,CAAC,CAAC;YACzG,gDAAgD;YAChD,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,GAAG,CAAC,UAAU,CAAC,EAAE,OAAO,EAAE,OAAO,CAAC,OAAO,EAAE,CAAC,CAAC;YACxE,IAAI,CAAC,OAAO;gBAAE,OAAO,IAAI,CAAC;YAC1B,OAAO,EAAE,OAAO,EAAE,OAAO,CAAC,IAAI,CAAC,EAAE,EAAE,GAAG,UAAU,CAAC,OAAO,CAAC,IAAY,CAAC,EAAE,CAAC;QAC3E,CAAC;QACD,KAAK,CAAC,MAAM,CAAC,OAAO;YAClB,MAAM,EAAE,QAAQ,EAAE,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;YAC1C,IAAI,QAAQ,KAAK,SAAS,IAAI,CAAC,QAAQ,CAAC,UAAU,CAAC,GAAG,SAAS,GAAG,CAAC;gBAAE,OAAO,SAAS,CAAC;YACtF,yEAAyE;YACzE,MAAM,IAAI,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;YAC9B,IAAI,CAAC,IAAI;gBAAE,OAAO,IAAI,QAAQ,CAAC,qBAAqB,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,CAAC;YACvE,0GAA0G;YAC1G,IAAI,CAAC,cAAc,CAAC,IAAI,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;gBAAE,OAAO,IAAI,QAAQ,CAAC,aAAa,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,CAAC;YAC/F,OAAO,IAAI,CAAC,OAAO,CAAC,eAAe,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC,CAAC;QAC1D,CAAC;QACD,OAAO,EAAE,QAAQ;QACjB,OAAO;QACP,KAAK;KACN,CAAC;AACJ,CAAC;AAED,6GAA6G;AAC7G,KAAK,UAAU,SAAS,CAAC,OAAsB,EAAE,GAAuB;IACtE,IAAI,OAAO,CAAC,UAAU,KAAK,QAAQ,IAAI,CAAC,GAAG;QAAE,OAAO;IACpD,MAAM,QAAQ,GAAG,MAAM,GAAG,CAAC,OAAO,CAAC,eAAe,CAAC,YAAY,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;IAChF,IAAI,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,UAAU,KAAK,QAAQ,CAAC;QAAE,OAAO,KAAK,CAAC;AACpE,CAAC;AAED;;;;;;;;GAQG;AACH,KAAK,UAAU,SAAS,CAAC,OAA6B,EAAE,GAAuB;IAC7E,IAAI,OAAO,EAAE,UAAU,KAAK,QAAQ,IAAI,CAAC,OAAO,CAAC,WAAW,IAAI,GAAG,EAAE,IAAI,KAAK,eAAe;QAAE,OAAO;IACtG,MAAM,EAAE,eAAe,EAAE,GAAG,GAAG,CAAC,OAAO,CAAC;IACxC,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,MAAM,KAAK,CAAC,6BAA6B,EAAE;YACxD,OAAO,EAAE,EAAE,aAAa,EAAE,UAAU,OAAO,CAAC,WAAW,EAAE,EAAE,YAAY,EAAE,QAAQ,EAAE;SACpF,CAAC,CAAC;QACH,MAAM,EAAE,KAAK,EAAE,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC,MAAM,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAwB,CAAC;QAChF,IAAI,OAAO,KAAK,KAAK,QAAQ;YAAE,MAAM,IAAI,KAAK,CAAC,qDAAqD,CAAC,CAAC;QACtG,MAAM,eAAe,CAAC,UAAU,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,CAAC;IACtE,CAAC;YAAS,CAAC;QACT,MAAM,eAAe,CAAC,aAAa,CAAC,OAAO,CAAC,EAAE,EAAE,EAAE,WAAW,EAAE,IAAI,EAAE,YAAY,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC;IAC5G,CAAC;AACH,CAAC;AAED,mEAAmE;AACnE,KAAK,UAAU,WAAW,CAAC,OAA6B,EAAE,GAAuB;IAC/E,IAAI,OAAO,EAAE,UAAU,KAAK,QAAQ,IAAI,GAAG;QACzC,MAAM,GAAG,CAAC,OAAO,CAAC,eAAe,CAAC,UAAU,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC;AACnF,CAAC;AAED,4GAA4G;AAC5G,SAAS,OAAO,CAAC,OAA0B;IACzC,IAAI,CAAC,OAAO,CAAC,MAAM;QAAE,MAAM,IAAI,KAAK,CAAC,qCAAqC,CAAC,CAAC;IAC5E,OAAO,OAAO,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE;QAC5B,MAAM,CAAC,EAAE,QAAQ,EAAE,IAAI,CAAC,GAAG,wBAAwB,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC;QACvE,IAAI,CAAC,IAAI;YACP,MAAM,IAAI,KAAK,CACb,yFAAyF,MAAM,EAAE,CAClG,CAAC;QACJ,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,QAAoB,EAAE,CAAC;IAClD,CAAC,CAAC,CAAC;AACL,CAAC"}
|
package/dist/staff.js
CHANGED
|
@@ -27,6 +27,13 @@ const ROUTES = new Set([
|
|
|
27
27
|
]);
|
|
28
28
|
/** The routes of the email code, which answer only when the app can send one. */
|
|
29
29
|
const CODE_ROUTES = new Set([SEND_CODE, "/sign-in/email-otp"]);
|
|
30
|
+
/** GitHub's tokens are never kept: a GitHub App's user token reaches what the App and the person both reach. */
|
|
31
|
+
const dropTokens = async () => ({ data: { accessToken: null, refreshToken: null, idToken: null } });
|
|
32
|
+
/** A GitHub account gone (a code proves an email its unverified row had, and drops its accounts): its user is no longer that login. */
|
|
33
|
+
const forgetLogin = async (account, ctx) => {
|
|
34
|
+
if (account?.providerId === "github" && ctx)
|
|
35
|
+
await ctx.context.internalAdapter.updateUser(account.userId, { github: null });
|
|
36
|
+
};
|
|
30
37
|
/** How a session was made, by the route that made it. */
|
|
31
38
|
const METHOD_OF = {
|
|
32
39
|
"/sign-in/email-otp": "code",
|
|
@@ -48,6 +55,14 @@ export async function betterAuthStaffLogin({ databaseUrl, key, sendCode, staff }
|
|
|
48
55
|
const github = staff.social.github;
|
|
49
56
|
/** Each invite's token as Better Auth hands it over, by email, until `invite` takes it. */
|
|
50
57
|
const minted = new Map();
|
|
58
|
+
/** The login GitHub's profile names, by the request it came in, until `keepLogin` writes it. */
|
|
59
|
+
const logins = new WeakMap();
|
|
60
|
+
/** Keeps the login GitHub named for this request on the account's user, once the account is made or refreshed. */
|
|
61
|
+
const keepLogin = async (account, ctx) => {
|
|
62
|
+
const login = account?.providerId === "github" && ctx ? logins.get(ctx) : undefined;
|
|
63
|
+
if (login)
|
|
64
|
+
await ctx.context.internalAdapter.updateUser(account.userId, { github: login });
|
|
65
|
+
};
|
|
51
66
|
const { auths, close } = await openBetterAuth({
|
|
52
67
|
databaseUrl,
|
|
53
68
|
key,
|
|
@@ -60,14 +75,45 @@ export async function betterAuthStaffLogin({ databaseUrl, key, sendCode, staff }
|
|
|
60
75
|
]),
|
|
61
76
|
options: {
|
|
62
77
|
session: { expiresIn: SESSION_SECONDS },
|
|
63
|
-
user: {
|
|
78
|
+
user: {
|
|
79
|
+
additionalFields: GITHUB_FIELD,
|
|
80
|
+
// Nobody the files do not declare gets a row, whatever the route: by the verified email
|
|
81
|
+
// the route proved, or by the login GitHub's own profile names (Better Auth sets no field
|
|
82
|
+
// from a profile that a person may not set, so the login is kept by `keepLogin`), before
|
|
83
|
+
// anything is written. A GitHub sign-in is checked again each time, with the fresh profile.
|
|
84
|
+
validateUserInfo: async ({ user, source }, ctx) => {
|
|
85
|
+
const refused = {
|
|
86
|
+
error: "not_declared",
|
|
87
|
+
errorDescription: "This company's files declare nobody with that account",
|
|
88
|
+
};
|
|
89
|
+
const said = source.oauth?.providerId === "github" ? source.oauth.profile?.login : undefined;
|
|
90
|
+
const login = typeof said === "string" ? said : undefined;
|
|
91
|
+
if (login)
|
|
92
|
+
logins.set(ctx, login);
|
|
93
|
+
const { adapter, internalAdapter } = ctx.context;
|
|
94
|
+
// A new GitHub account under a login a row already carries is another account (GitHub
|
|
95
|
+
// frees a renamed login): it is not the declared person, whatever the files say.
|
|
96
|
+
if (login && source.action === "create-user") {
|
|
97
|
+
const holder = await adapter.findOne({ model: "user", where: [{ field: "github", value: login }] });
|
|
98
|
+
if (holder)
|
|
99
|
+
return refused;
|
|
100
|
+
}
|
|
101
|
+
// Signing in again, or linking: GitHub's email may have moved; the row's verified one still vouches.
|
|
102
|
+
const row = typeof user.id === "string" ? await internalAdapter.findUserById(user.id) : null;
|
|
103
|
+
const identity = {
|
|
104
|
+
...identityOf(user),
|
|
105
|
+
...(row && row.emailVerified && { email: row.email }),
|
|
106
|
+
...(login && { github: login }),
|
|
107
|
+
};
|
|
108
|
+
return staff.admits(identity) ? undefined : refused;
|
|
109
|
+
},
|
|
110
|
+
},
|
|
64
111
|
advanced: { cookiePrefix: "sanoma" },
|
|
65
112
|
...(github && {
|
|
66
113
|
socialProviders: {
|
|
67
114
|
github: {
|
|
68
115
|
clientId: github.clientId,
|
|
69
116
|
clientSecret: github.clientSecret,
|
|
70
|
-
mapProfileToUser: (profile) => ({ github: profile.login }),
|
|
71
117
|
},
|
|
72
118
|
},
|
|
73
119
|
}),
|
|
@@ -91,11 +137,10 @@ export async function betterAuthStaffLogin({ databaseUrl, key, sendCode, staff }
|
|
|
91
137
|
}),
|
|
92
138
|
},
|
|
93
139
|
databaseHooks: {
|
|
94
|
-
|
|
95
|
-
create: {
|
|
96
|
-
|
|
97
|
-
|
|
98
|
-
},
|
|
140
|
+
account: {
|
|
141
|
+
create: { before: dropTokens, after: keepLogin },
|
|
142
|
+
update: { before: dropTokens, after: keepLogin },
|
|
143
|
+
delete: { after: forgetLogin },
|
|
99
144
|
},
|
|
100
145
|
session: {
|
|
101
146
|
create: {
|
package/dist/staff.js.map
CHANGED
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"staff.js","sourceRoot":"","sources":["../src/staff.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,cAAc,EAId,UAAU,GAEX,MAAM,sBAAsB,CAAC;AAC9B,OAAO,EAAE,oBAAoB,EAAE,MAAM,iBAAiB,CAAC;AACvD,OAAO,EAAE,SAAS,EAAE,MAAM,gCAAgC,CAAC;AAC3D,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EACL,SAAS,EACT,YAAY,EACZ,UAAU,EACV,cAAc,EACd,cAAc,EAEd,UAAU,EAEV,eAAe,GAChB,MAAM,eAAe,CAAC;AAEvB,mGAAmG;AACnG,gGAAgG;AAChG,iGAAiG;AACjG,mGAAmG;AACnG,oFAAoF;AAEpF,sFAAsF;AACtF,MAAM,MAAM,GAAG,mBAAmB,CAAC;AACnC,MAAM,SAAS,GAAG,mBAAmB,CAAC;AACtC,MAAM,QAAQ,GAAG,GAAG,SAAS,WAAW,CAAC;AACzC,MAAM,SAAS,GAAG,kCAAkC,CAAC;AACrD,sIAAsI;AACtI,MAAM,eAAe,GAAG,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,CAAC;AAEzC,+HAA+H;AAC/H,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC;IACrB,SAAS;IACT,oBAAoB;IACpB,iBAAiB;IACjB,kBAAkB;IAClB,oBAAoB;IACpB,WAAW;IACX,cAAc;CACf,CAAC,CAAC;AAEH,iFAAiF;AACjF,MAAM,WAAW,GAAG,IAAI,GAAG,CAAC,CAAC,SAAS,EAAE,oBAAoB,CAAC,CAAC,CAAC;
|
|
1
|
+
{"version":3,"file":"staff.js","sourceRoot":"","sources":["../src/staff.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,cAAc,EAId,UAAU,GAEX,MAAM,sBAAsB,CAAC;AAC9B,OAAO,EAAE,oBAAoB,EAAE,MAAM,iBAAiB,CAAC;AACvD,OAAO,EAAE,SAAS,EAAE,MAAM,gCAAgC,CAAC;AAC3D,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EACL,SAAS,EACT,YAAY,EACZ,UAAU,EACV,cAAc,EACd,cAAc,EAEd,UAAU,EAEV,eAAe,GAChB,MAAM,eAAe,CAAC;AAEvB,mGAAmG;AACnG,gGAAgG;AAChG,iGAAiG;AACjG,mGAAmG;AACnG,oFAAoF;AAEpF,sFAAsF;AACtF,MAAM,MAAM,GAAG,mBAAmB,CAAC;AACnC,MAAM,SAAS,GAAG,mBAAmB,CAAC;AACtC,MAAM,QAAQ,GAAG,GAAG,SAAS,WAAW,CAAC;AACzC,MAAM,SAAS,GAAG,kCAAkC,CAAC;AACrD,sIAAsI;AACtI,MAAM,eAAe,GAAG,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,CAAC;AAEzC,+HAA+H;AAC/H,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC;IACrB,SAAS;IACT,oBAAoB;IACpB,iBAAiB;IACjB,kBAAkB;IAClB,oBAAoB;IACpB,WAAW;IACX,cAAc;CACf,CAAC,CAAC;AAEH,iFAAiF;AACjF,MAAM,WAAW,GAAG,IAAI,GAAG,CAAC,CAAC,SAAS,EAAE,oBAAoB,CAAC,CAAC,CAAC;AAmB/D,gHAAgH;AAChH,MAAM,UAAU,GAAG,KAAK,IAAI,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE,EAAE,WAAW,EAAE,IAAI,EAAE,YAAY,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,EAAE,CAAC,CAAC;AACpG,uIAAuI;AACvI,MAAM,WAAW,GAAG,KAAK,EAAE,OAAuB,EAAE,GAAuB,EAAE,EAAE;IAC7E,IAAI,OAAO,EAAE,UAAU,KAAK,QAAQ,IAAI,GAAG;QACzC,MAAM,GAAG,CAAC,OAAO,CAAC,eAAe,CAAC,UAAU,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC;AACnF,CAAC,CAAC;AAEF,yDAAyD;AACzD,MAAM,SAAS,GAAiC;IAC9C,oBAAoB,EAAE,MAAM;IAC5B,eAAe,EAAE,QAAQ;IACzB,oBAAoB,EAAE,QAAQ;CAC/B,CAAC;AAEF;;;;;;;;GAQG;AACH,MAAM,CAAC,KAAK,UAAU,oBAAoB,CAAC,EAAE,WAAW,EAAE,GAAG,EAAE,QAAQ,EAAE,KAAK,EAAgB;IAC5F,IAAI,CAAC,KAAK;QAAE,MAAM,IAAI,KAAK,CAAC,4DAA4D,CAAC,CAAC;IAC1F,MAAM,MAAM,GAAG,KAAK,CAAC,MAAM,CAAC,MAAM,CAAC;IACnC,2FAA2F;IAC3F,MAAM,MAAM,GAAG,IAAI,GAAG,EAAkB,CAAC;IACzC,gGAAgG;IAChG,MAAM,MAAM,GAAG,IAAI,OAAO,EAAkB,CAAC;IAC7C,kHAAkH;IAClH,MAAM,SAAS,GAAG,KAAK,EAAE,OAAuB,EAAE,GAAuB,EAAE,EAAE;QAC3E,MAAM,KAAK,GAAG,OAAO,EAAE,UAAU,KAAK,QAAQ,IAAI,GAAG,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;QACpF,IAAI,KAAK;YAAE,MAAM,GAAI,CAAC,OAAO,CAAC,eAAe,CAAC,UAAU,CAAC,OAAQ,CAAC,MAAM,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,CAAC;IAC/F,CAAC,CAAC;IACF,MAAM,EAAE,KAAK,EAAE,KAAK,EAAE,GAAG,MAAM,cAAc,CAAC;QAC5C,WAAW;QACX,GAAG;QACH,MAAM,EAAE,MAAM;QACd,QAAQ,EAAE,SAAS;QACnB,iGAAiG;QACjG,KAAK,EAAE,IAAI,GAAG,CAAqB;YACjC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC;YACf,CAAC,OAAO,EAAE,CAAC,GAAG,CAAC,CAAC;SACjB,CAAC;QACF,OAAO,EAAE;YACP,OAAO,EAAE,EAAE,SAAS,EAAE,eAAe,EAAE;YACvC,IAAI,EAAE;gBACJ,gBAAgB,EAAE,YAAY;gBAC9B,wFAAwF;gBACxF,0FAA0F;gBAC1F,yFAAyF;gBACzF,4FAA4F;gBAC5F,gBAAgB,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,EAAE,GAAG,EAAE,EAAE;oBAChD,MAAM,OAAO,GAAG;wBACd,KAAK,EAAE,cAAc;wBACrB,gBAAgB,EAAE,uDAAuD;qBAC1E,CAAC;oBACF,MAAM,IAAI,GAAG,MAAM,CAAC,KAAK,EAAE,UAAU,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC,CAAC,SAAS,CAAC;oBAC7F,MAAM,KAAK,GAAG,OAAO,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC;oBAC1D,IAAI,KAAK;wBAAE,MAAM,CAAC,GAAG,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;oBAClC,MAAM,EAAE,OAAO,EAAE,eAAe,EAAE,GAAG,GAAG,CAAC,OAAO,CAAC;oBACjD,sFAAsF;oBACtF,iFAAiF;oBACjF,IAAI,KAAK,IAAI,MAAM,CAAC,MAAM,KAAK,aAAa,EAAE,CAAC;wBAC7C,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC,OAAO,CAAC,EAAE,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,EAAE,KAAK,EAAE,QAAQ,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC,EAAE,CAAC,CAAC;wBACpG,IAAI,MAAM;4BAAE,OAAO,OAAO,CAAC;oBAC7B,CAAC;oBACD,qGAAqG;oBACrG,MAAM,GAAG,GAAG,OAAO,IAAI,CAAC,EAAE,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,eAAe,CAAC,YAAY,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;oBAC7F,MAAM,QAAQ,GAAG;wBACf,GAAG,UAAU,CAAC,IAAY,CAAC;wBAC3B,GAAG,CAAC,GAAG,IAAI,GAAG,CAAC,aAAa,IAAI,EAAE,KAAK,EAAE,GAAG,CAAC,KAAK,EAAE,CAAC;wBACrD,GAAG,CAAC,KAAK,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC;qBAChC,CAAC;oBACF,OAAO,KAAK,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,OAAO,CAAC;gBACtD,CAAC;aACF;YACD,QAAQ,EAAE,EAAE,YAAY,EAAE,QAAQ,EAAE;YACpC,GAAG,CAAC,MAAM,IAAI;gBACZ,eAAe,EAAE;oBACf,MAAM,EAAE;wBACN,QAAQ,EAAE,MAAM,CAAC,QAAQ;wBACzB,YAAY,EAAE,MAAM,CAAC,YAAY;qBAClC;iBACF;aACF,CAAC;YACF,OAAO,EAAE;gBACP,SAAS,CAAC;oBACR,SAAS,EAAE,cAAc;oBACzB,UAAU,EAAE,QAAQ;oBACpB,aAAa,EAAE,KAAK,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,EAAE,EAAE,CAAC,KAAK,MAAM,CAAC,GAAG,CAAC,KAAK,EAAE,KAAK,CAAC;iBACzE,CAAC;gBACF,yFAAyF;gBACzF,SAAS,CAAC,QAAQ,CAAC;aACpB;YACD,KAAK,EAAE;gBACL,uFAAuF;gBACvF,MAAM,EAAE,oBAAoB,CAAC,KAAK,EAAE,GAAG,EAAE,EAAE;oBACzC,IAAI,GAAG,CAAC,IAAI,KAAK,SAAS;wBAAE,OAAO;oBACnC,MAAM,KAAK,GAAI,GAAG,CAAC,IAAwC,EAAE,KAAK,CAAC;oBACnE,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,EAAE,KAAK,EAAE,CAAC;wBAAE,OAAO,GAAG,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC;gBAChG,CAAC,CAAC;aACH;YACD,aAAa,EAAE;gBACb,OAAO,EAAE;oBACP,MAAM,EAAE,EAAE,MAAM,EAAE,UAAU,EAAE,KAAK,EAAE,SAAS,EAAE;oBAChD,MAAM,EAAE,EAAE,MAAM,EAAE,UAAU,EAAE,KAAK,EAAE,SAAS,EAAE;oBAChD,MAAM,EAAE,EAAE,KAAK,EAAE,WAAW,EAAE;iBAC/B;gBACD,OAAO,EAAE;oBACP,MAAM,EAAE;wBACN,KAAK,EAAE,KAAK,EAAE,OAA2B,EAAE,GAAuB,EAAE,EAAE;4BACpE,MAAM,MAAM,GAAG,GAAG,EAAE,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;4BACzE,IAAI,CAAC,MAAM,IAAI,CAAC,GAAG;gCAAE,OAAO;4BAC5B,MAAM,IAAI,GAAG,MAAM,GAAG,CAAC,OAAO,CAAC,eAAe,CAAC,YAAY,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;4BAC5E,IAAI,IAAI;gCAAE,MAAM,KAAK,CAAC,MAAM,CAAC,MAAM,EAAE,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC;wBACzD,CAAC;qBACF;iBACF;aACF;SACF;KACF,CAAC,CAAC;IACH,MAAM,OAAO,GAAG,CAAC,OAAgB,EAAE,EAAE,CAAC,KAAK,CAAC,GAAG,CAAC,UAAU,CAAC,OAAO,CAAC,CAAE,CAAC;IACtE,MAAM,OAAO,GAAkB;QAC7B,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAE,CAAC,MAAM,CAAW,CAAC,CAAC,CAAC,EAAE,CAAC;QACxC,GAAG,CAAC,MAAM,CAAC,CAAC,CAAE,CAAC,QAAQ,CAAW,CAAC,CAAC,CAAC,EAAE,CAAC;QACxC,QAAQ;KACT,CAAC;IAEF,iGAAiG;IACjG,KAAK,UAAU,IAAI,CAAC,KAAa,EAAE,OAAgB;QACjD,MAAM,IAAI,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;QAC9B,MAAM,UAAU,GAAG,KAAK,CAAC,WAAW,EAAE,CAAC;QACvC,0DAA0D;QAC1D,MAAM,EAAE,OAAO,EAAE,GAAG,MAAM,IAAI,CAAC,QAAQ,CAAC;QACxC,MAAM,OAAO,CAAC,UAAU,CAAC;YACvB,KAAK,EAAE,cAAc;YACrB,KAAK,EAAE,CAAC,EAAE,KAAK,EAAE,OAAO,EAAE,KAAK,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,IAAI,EAAE,YAAY,EAAE,KAAK,EAAE,UAAU,EAAE,CAAC,EAAE,CAAC;SAC9F,CAAC,CAAC;QACH,MAAM,IAAI,CAAC,GAAG,CAAC,eAAe,CAAC,EAAE,IAAI,EAAE,EAAE,KAAK,EAAE,UAAU,EAAE,WAAW,EAAE,GAAG,EAAE,EAAE,OAAO,EAAE,OAAO,CAAC,OAAO,EAAE,CAAC,CAAC;QAC5G,MAAM,KAAK,GAAG,MAAM,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;QACrC,MAAM,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC;QAC1B,IAAI,CAAC,KAAK;YAAE,MAAM,IAAI,KAAK,CAAC,wCAAwC,CAAC,CAAC;QACtE,OAAO,KAAK,CAAC;IACf,CAAC;IACD,yDAAyD;IACzD,IAAI,OAAO,GAAqB,OAAO,CAAC,OAAO,EAAE,CAAC;IAElD,OAAO;QACL,KAAK,CAAC,MAAM,CAAC,OAAO;YAClB,MAAM,OAAO,GAAG,MAAM,OAAO,CAAC,OAAO,CAAC,CAAC,GAAG,CAAC,UAAU,CAAC,EAAE,OAAO,EAAE,OAAO,CAAC,OAAO,EAAE,CAAC,CAAC;YACpF,OAAO,OAAO,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,OAAO,CAAC,IAAI,CAAC,EAAE,EAAE,GAAG,UAAU,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;QACpF,CAAC;QACD,KAAK,CAAC,MAAM,CAAC,OAAO;YAClB,MAAM,EAAE,QAAQ,EAAE,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;YAC1C,IAAI,QAAQ,KAAK,SAAS,IAAI,CAAC,QAAQ,CAAC,UAAU,CAAC,GAAG,SAAS,GAAG,CAAC;gBAAE,OAAO,SAAS,CAAC;YACtF,MAAM,KAAK,GAAG,QAAQ,CAAC,KAAK,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC;YAC/C,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,QAAQ,IAAI,WAAW,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;gBAC7D,OAAO,IAAI,QAAQ,CAAC,WAAW,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,CAAC;YACpD,IAAI,OAAO,CAAC,MAAM,KAAK,KAAK,IAAI,CAAC,UAAU,CAAC,OAAO,CAAC;gBAAE,OAAO,IAAI,QAAQ,CAAC,WAAW,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,CAAC;YACxG,8FAA8F;YAC9F,IAAI,CAAC,cAAc,CAAC,IAAI,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;gBAAE,OAAO,IAAI,QAAQ,CAAC,aAAa,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,CAAC;YAC/F,OAAO,OAAO,CAAC,OAAO,CAAC,CAAC,OAAO,CAAC,eAAe,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC,CAAC;QACtE,CAAC;QACD,OAAO,EAAE,QAAQ;QACjB,OAAO;QACP,MAAM,CAAC,KAAK,EAAE,OAAO;YACnB,wFAAwF;YACxF,MAAM,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC,CAAC;YACtD,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;YACtC,OAAO,IAAI,CAAC;QACd,CAAC;QACD,KAAK,CAAC,UAAU,CAAC,KAAK;YACpB,qDAAqD;YACrD,MAAM,IAAI,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,KAAM,CAAC;YAC1C,MAAM,EAAE,eAAe,EAAE,GAAG,MAAM,IAAI,CAAC,QAAQ,CAAC;YAChD,MAAM,KAAK,GAAG,MAAM,eAAe,CAAC,qBAAqB,CAAC,cAAc,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;YACzF,IAAI,CAAC,KAAK,IAAI,KAAK,CAAC,SAAS,GAAG,IAAI,IAAI,EAAE;gBAAE,OAAO,SAAS,CAAC;YAC7D,MAAM,EAAE,KAAK,EAAE,GAAG,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,KAAK,CAAuB,CAAC;YAChE,IAAI,OAAO,KAAK,KAAK,QAAQ;gBAAE,OAAO,SAAS,CAAC;YAChD,MAAM,KAAK,GAAG,IAAI,eAAe,CAAC,EAAE,KAAK,EAAE,WAAW,EAAE,GAAG,EAAE,CAAC,CAAC;YAC/D,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,GAAG,SAAS,sBAAsB,KAAK,EAAE,EAAE,CAAC;QACpE,CAAC;QACD,KAAK;KACN,CAAC;AACJ,CAAC;AAED,+GAA+G;AAC/G,MAAM,MAAM,GAAG,CAAC,KAAa,EAAE,EAAE,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC"}
|
package/package.json
CHANGED
|
@@ -1,6 +1,6 @@
|
|
|
1
1
|
{
|
|
2
2
|
"name": "@sanoma-ai/connector-better-auth",
|
|
3
|
-
"version": "0.2.
|
|
3
|
+
"version": "0.2.4",
|
|
4
4
|
"description": "Better Auth for Sanoma: the visitor login of public sites (email and password, or an email code) and the staff sign-in on a host (email code, invite links, GitHub), on the company's own database",
|
|
5
5
|
"keywords": [
|
|
6
6
|
"auth",
|
|
@@ -44,13 +44,13 @@
|
|
|
44
44
|
"pg": "^8.23.1"
|
|
45
45
|
},
|
|
46
46
|
"devDependencies": {
|
|
47
|
-
"@sanoma-ai/app": "0.10.
|
|
48
|
-
"@sanoma-ai/testing": "0.1.
|
|
49
|
-
"@sanoma-ai/workflows": "0.11.
|
|
47
|
+
"@sanoma-ai/app": "0.10.9",
|
|
48
|
+
"@sanoma-ai/testing": "0.1.1",
|
|
49
|
+
"@sanoma-ai/workflows": "0.11.6",
|
|
50
50
|
"@types/pg": "^8.23.1"
|
|
51
51
|
},
|
|
52
52
|
"peerDependencies": {
|
|
53
|
-
"@sanoma-ai/workflows": "^0.11.
|
|
53
|
+
"@sanoma-ai/workflows": "^0.11.6"
|
|
54
54
|
},
|
|
55
55
|
"engines": {
|
|
56
56
|
"node": ">=26"
|